Apps collect sensitive data that could be subpoenaed by law enforcement or sold by data brokers.

When the draft of the Supreme Court’s decision on _Roe v. Wade_ was leaked to the public in early May, Elizabeth C. McLaughlin kicked off a social media storm. The founder of the Gaia Leadership Project, a company that trains women leaders and entrepreneurs, tweeted: “If you are using an online period tracker or tracking your cycles through your phone, get off it and delete your data. Now.” It had never occured to many women, until then, that their data could be weaponized against them. But experts that spoke to WIRED say that fertility and period-tracking apps—along with the myriad other data trails that users leave behind—could be a rich source of data for law enforcement looking to punish women if abortion is outlawed or criminalized.

“If there's an app out there that's collecting health data, it will soon be a target,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project (STOP). “One of the sad ironies of this is that people who are actively trying to get pregnant will have a harder time using the technology to do it for fear of how that technology might be used against them in a court of law.”

Fertility and period-tracking apps vary, but most allow users to manually enter when their periods start and end, whether they use birth control, the length of their cycle, and their moods. Some allow users to track their periods as well as pregnancy. Many apps also allow users to sign in with their Google or Facebook accounts. Some also collect geolocation data.

WIRED reached out to five popular fertility and period-tracking apps: Flo, Glowing, Clue, Glow, and Pinkbird. Only Clue pointed to a public statement it released in the wake of widespread public concern. According to the statement, Clue abides by the European General Data Protection Regulation (GDPR), and “any change to US abortion laws would not affect these privacy protections.” The company did not address whether it would respond to legal requests for user data from law enforcement. In a statement to WIRED, Flo said that it “does not share personal health data with any third party” and that it “will never require a user to log an abortion or offer details that they feel should be kept private.” Glowing, Glow, and Pinkbird did not respond. None of the companies would comment on whether usership had dropped in the wake of the Supreme Court leak.

Search history and other data has already been used as evidence to criminalize those seeking an abortion in US states with stringent local laws. But privacy experts worry that the more granular data collected by period tracking and fertility apps could be particularly incriminating for those seeking an abortion. Just two weeks after the leaked decision, Vice reported that Narrative, a data marketplace, allowed anyone to purchase information about who had downloaded period-tracking apps (though not the data in the apps themselves), and last year, _The New York Times_ revealed that Flo was selling its user data.

But most users will never know if their data has been sold or exactly how much is already out there. “Actually knowing where your data has gone and if your data was sold is almost impossible in this day and age,” says Deven McGraw, data stewardship lead at Invitae, whose platform Ciitizen helps patients control their health care data.

According to Fox Cahn, apps that collect and store data on their own servers are particularly dangerous, both because the data can be sold and hacked, but also because law enforcement can serve companies with subpoenas for user data. In a recent report, STOP pointed out that some apps let users store data on their phone—a much safer option—but one that still won’t protect them in the face of a search warrant.

But Fox Cahn says that the concern goes far deeper than just fertility apps. “Basically any health data app for pregnant people or potentially pregnant people could be weaponized.”

To understand how, one need only look at the country’s immigration infrastructure, says Paromita Shah, executive director at Just Futures Law. The Department of Homeland Security and Immigration and Customs Enforcement have long used data to surveil and arrest activists and immigrants, she says. “There is no consumer privacy law that I have seen that really can impact the police,” says Shah. “And they're buying this data to get around their obligations to follow the Constitution.”

Even if users decide to delete period-tracking apps, their data may have already been collected. For those who want to keep using them, McGraw says “it takes a lot of effort” to ensure data isn’t being shared. None of the companies responded to questions about their usership figures.

“Mostly what you can do, but which people rarely do, is pay a bit more attention to the terms of service and the privacy policies of the apps you use,” she says. But removing data that’s already out there would only be possible “if you've got a company that's covered by a state law that gives you a right of deletion.”

Euki, an app released by the international group Women Help Women, anticipated many of these problems. “When somebody creates an app, obviously they want to monetize, they want to pay for it. And the way they recoup their costs and make profits into the future is by marketing the data,” says Susan Yanow, a reproductive health consultant and the US representative for the organization. "We were never looking to make up that cost. The goal was to get it into the hands of as many people as possible, as securely as possible.”

Funding for Euki came instead from a grant obtained by Ibis Reproductive Health, a partner organization of Women Help Women. The app contains information about abortion, contraception, sexually transmitted infections, and miscarriages, stores all data on the user’s device rather than uploading it to a third-party server. It is password protected, and allows users to set up a second password that, when entered, will bring up a second, fake app, keeping even the nature of the app a secret. There is even an option to delete all of the collected data.

In the weeks since the draft decision leaked, Yanow says Women Help Women has seen a massive influx of users to the organization’s website—which she hopes will lead people to the Euki app.

“We truly believe that the person who owns the app is the person who should be deciding what to do about \[a missed period or pregnancy\], should that happen,” says Yanow.

_**Update 6/8/22 1:33PM ET:** This story has been updated to include comment from Flo and to give the correct name of Women Help Women._

Period-Tracking and Fertility Apps Can Put Women Seeking Abortions at Risk

Five years after it was torn offline, the resurrected dark web marketplace is clawing its way back to the top of the online underworld.

For years, dark web markets and the law enforcement agencies that combat them have been locked into a cycle of raid, rinse, repeat: For every online black market destroyed, another has always been there to take its place. But rarely has a dominant dark web market been busted by a massive law enforcement operation only to rise from the ashes half a decade later and regain its top spot—a feat that may very soon be achieved by AlphaBay, the once and future king of the contraband crypto-economy.

In July of 2017, a global law enforcement sting known as Operation Bayonet took down AlphaBay’s sprawling narcotics-and-cybercrime bazaar, seizing the site’s central server in Lithuania and arresting its creator, Alexandre Cazes, outside his home in Bangkok. Yet in August of last year, AlphaBay’s number-two administrator and security specialist, publicly known only as DeSnake, suddenly reappeared, announcing AlphaBay’s resurrection in a new and improved form. Now, 10 months later, thanks in part to a tumult of takedowns and the mysterious disappearances of competing dark web markets, DeSnake’s reincarnated AlphaBay is now well on its way to its former heights atop the digital underworld. By some measures, it appears to have already regained that spot.

“Yes, AlphaBay is the #1 darknet marketplace right now,” says DeSnake, writing to WIRED in a text-based conversation last week. “I did tell you we were going to be #1 before,” he added, referring to our interview with AlphaBay’s new admin at the time of its relaunch last summer. “As I have told you, I do what I say.”

DeSnake’s boast is at least partly true: As of last week, AlphaBay had more than 30,000 unique product listings—largely drugs, from ecstasy to opioids to methamphetamines—but also thousands of listings for malware and stolen data, like Social Security numbers and credit card details. That’s up from a mere 500 listings in September of last year. Another older market called ASAP displays more than 50,000 listings. But ASAP is known to allow vendors to post duplicate listings. And according to security firm Flashpoint, which closely tracks the competing markets, AlphaBay had more than 1,300 active vendors in roughly the first six months of this year, compared to about 1,000 for ASAP. According to Flashpoint’s data, AlphaBay’s listings also appear to be growing significantly faster.

Other markets touted in dark web forums like Archetyp and Incognito, meanwhile, have only a few thousand or just a few hundred listings. All of that suggests AlphaBay may already be the most popular market for dark web vendors to list their wares for sale.

AlphaBay’s tens of thousands of product listings are still a tiny fraction of the more than 350,000 it offered before its 2017 takedown, when it was the biggest dark web market ever seen. By the FBI’s estimate, it was 10 times the size of the legendary Silk Road drug market. DeSnake concedes that the new AlphaBay's revenue hasn’t yet come close to the level of its 2017 peak, when blockchain analysis firm Chainalysis estimates that AlphaBay generated as much as $2 million a day in sales. (DeSnake declined to share current sales numbers but said they are “in the big digits.”)

Also, unlike most competitors, the new version of AlphaBay only allows users to buy and sell in the privacy-focused cryptocurrency Monero, not Bitcoin, transactions of which can often be tracked through blockchain surveillance. That makes the site’s sales difficult to measure and may mean it has fewer sales per listing, since many users prefer to trade in Bitcoin.

But even accounting for that difference and other unknowns in a side-by-side analysis of dark web markets, AlphaBay appears to be the leading marketplace, or will be soon, says Ian Gray, a dark web-focused analyst at security firm Flashpoint. “The writing is on the wall that AlphaBay is probably going to regain that spot as the most popular marketplace,” says Gray, “And it already seems like it’s the biggest in terms of volume of vendors.”

AlphaBay’s quick growth—or regrowth—has been fueled in part by what Gray calls “the Great Cyber Resignation.” At least 10 dark web markets have dropped offline for various reasons in the last 18 months. Some have been busted by law enforcement, like Dark Market, which was the target of a Europol-led takedown operation early last year; or Hydra, the massive Russian-language drug and money-laundering market whose servers were seized in a law enforcement raid in April. Others, like Dark0de and World Market, are believed to have pulled “exit scams,” disappearing suddenly with their users’ money. Still others, like Cannazon and White House Market, staged more considerate and organized exits, giving users time to pull out any funds held on the sites.

Dark web market product listing data shows how the new AlphaBay market has survived a mass exodus of competitors. (Data does not include ASAP data for the last two days of the analyzed time period.)

Flashpoint

Until late May, that left a site called Versus as the last leading market standing. But then, just two weeks ago, DeSnake published a post on the dark web market forum Dread with evidence that pointed to a security vulnerability in Versus—provided to him, DeSnake claimed, by a user named “threesixty”—that exposed Versus’ IP address, potentially leaving its users vulnerable to hackers or law enforcement. “Both threesixty and myself have the best intentions,” DeSnake wrote in his post. “We hope to have a fruitful conversation about security on marketplaces.”

Versus responded by immediately announcing its retirement. “We will say that there was a clear agenda behind the way this was originally handled,” wrote the site’s administrator, who went by the name William Gibson, “but we leave you to draw your own conclusions.”

DeSnake, meanwhile, maintained both on Dread and to WIRED that he doesn’t have any personal or professional connection to threesixty, the hacker whose vulnerability discovery took down AlphaBay's largest remaining competitor. “We handled it the best possible way, due to the severity of the issue,” DeSnake says.

Aside from the circumstances around Versus’ exit, the recently dwindling number of dark web markets is perhaps due to the generally hostile environment they face, says Flashpoint’s Ian Gray. Markets are often under bombardment from distributed denial of service attacks launched by competitors using waves of junk traffic to knock them offline and have to deal with constant disputes among buyers and sellers. Market administrators also feel the ever-present threat of law enforcement looming in the background. All of this incentivizes a take-the-money-and-run approach for any dark web administrator who achieves a certain level of success—and has allowed DeSnake, who appears to be more ambitious and persistent in his goals, to elevate AlphaBay back to the top. “With all these other shutdowns, you have so few players in the space,” says Gray. “There’s really only one that’s fairly well established, and that’s AlphaBay.”

When AlphaBay first reappeared, Gray and other dark web analysts and users expressed suspicion that DeSnake might be compromised by law enforcement. Although he seemed to prove his identity as the former AlphaBay’s right hand by signing messages with the same PGP cryptographic key he’d used in the past, many dark web denizens were wary that he might be controlled by a police agency as part of an undercover operation, as when Dutch police secretly took over the Hansa dark web drug market in 2017.

After nearly a year back online, though, DeSnake says he feels “vindicated,” given that few if any undercover operations have lasted that long. “For majority of vendors and customers the question has been put to rest,” DeSnake says.

If DeSnake has proven himself to be the legit heir to AlphaBay—and doesn’t pull an exit scam himself—he still faces the risk of a law enforcement takedown, which only grows as the reborn market takes the limelight. “It’s Russian roulette running a dark web marketplace, particularly with all the information we got from the AlphaBay takedown,” says Grant Rabenn, a former federal prosecutor who led the investigation that resulted in AlphaBay’s 2017 bust and the arrest of its original admin, Alexandre Cazes, who was later found dead in a Thai jail of an apparent suicide. (DeSnake has claimed, without proof, that Cazes was murdered.)

Rabenn hints that the 2017 case also resulted in US law enforcement obtaining a “fair amount of information” on AlphaBay’s staff. As the dark web market grows, that previous investigation might provide leads on DeSnake’s identity, with federal agencies refocusing their attention on AlphaBay and its new boss. “It’s definitely putting a target on your back, not only from the historical conduct and connections but also being the top one,” Rabenn says. “Everyone’s going to look for that one.”

DeSnake tells WIRED, however, that he’s developed a few forms of protection that give him confidence he’ll continue to stay a step ahead of the feds. Perhaps most importantly, he claims to be based in a former Soviet country that has no extradition treaty with the US. His choice for AlphaBay to use only Monero, rather than Bitcoin, may make the sort of blockchain analysis that contributed to the original site’s takedown far more difficult. And he claims to have built complex technical protections that include redundant infrastructure in multiple countries, along with a system called AlphaGuard that’s designed to automatically relaunch the site on new servers in the case of a bust. “We will be back and running within a few days and without a cent lost,” DeSnake says.

DeSnake has announced that he eventually hopes to develop a “decentralized marketplace network” where dark web markets are hosted across hundreds or thousands of servers—a kind of uncensorable, unseizable Bittorrent to the current markets’ Napster. He claims a test version of that decentralization scheme is planned for the end of this year, and that AlphaBay will move to it sometime in 2023. “First we want to reach the scale we did before in 2017 that is our milestone. Second, we want to launch a beta of the decentralized project,” says DeSnake “Then migrate step by step fully to allow AlphaBay to exist for many years ahead and usher the \[darknet market\] scene into a new golden era like we did before.”

It’s far from clear whether that plan—or DeSnake’s self-described invulnerability—is real or a mirage. But he does appear to have followed through—or will soon—on his first promise: to regain the dark web’s crown. And another period of AlphaBay’s reign may be just beginning.

AlphaBay Is Taking Over the Dark Web—Again

As governments crack down on ransomware, cybercriminals may soon shift to business email compromise—already the world's most profitable type of scam.

Ransomware attacks, including those of the massively disruptive and dangerous variety, have proved difficult to combat comprehensively. Hospitals, government agencies, schools, and even critical infrastructure companies continue to face debilitating attacks and large ransom demands from hackers. But as governments around the world and law enforcement in the United States have grown serious about cracking down on ransomware and have started to make some progress, researchers are trying to stay a step ahead of attackers and anticipate where ransomware gangs may turn next if their main hustle becomes impractical.

At the RSA security conference in San Francisco on Monday, longtime digital scams researcher Crane Hassold will present findings that warn it would be logical for ransomware actors to eventually convert their operations to business email compromise (BEC) attacks as ransomware becomes less profitable or carries a higher risk for attackers. In the US, the Federal Bureau of Investigation has repeatedly found that total money stolen in BEC scams far exceeds that pilfered in ransomware attacks—though ransomware attacks can be more visible and cause more disruption and associated losses. 

In business email compromise, attackers infiltrate a legitimate corporate email account and use the access to send phony invoices or initiate contract payments that trick businesses into wiring money to criminals when they think they’re just paying their bills.

“So much attention is being paid to ransomware, and governments all over the world are taking action to disrupt it, so eventually the return on investment is going to be impacted,” says Hassold, who is director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “And ransomware actors are not going to say, ‘Oh, hey, you got me’ and go away. So it’s possible that you would have this new threat where you have the more sophisticated actors behind ransomware campaigns moving over to the BEC space where all the money is being made.”

BEC attacks, many of which originate in West Africa and specifically Nigeria, are historically less technical and rely more on social engineering, the art of creating a compelling narrative that tricks victims into taking actions against their own interests. But Hassold points out that a lot of the malware used in ransomware attacks is built to be flexible, with a modular quality so different types of scammers can assemble the combination of software tools they need for their specific hustle. And the technical ability to establish “initial access,” or a digital foothold, to then deploy other malware would be extremely useful for BEC, where gaining access to strategic email accounts is the first step in most campaigns. Ransomware actors would bring a much higher level of technical sophistication to this aspect of the scams.

Hassold also points out that while the most notorious and aggressive ransomware gangs are typically small teams, BEC actors are usually organized into much looser and more decentralized groups, making it more difficult for law enforcement to target a central organization or kingpin. Similar to Russia’s unwillingness to cooperate on ransomware investigations, it has taken time for global law enforcement to develop working relationships with the Nigerian government to counter BEC. But even as Nigeria has put more emphasis on BEC enforcement, countering the sheer scale of the scam operations is still a challenge.

“You can’t just cut off the head of the snake,” Hassold says. “If you arrest a dozen or even a few hundred of these actors, you’re still not making much of a dent.”

For ransomware actors, the most difficult aspect of transitioning to BEC scams would likely be the dramatic difference in collecting stolen money. Ransomware gangs almost exclusively collect victim payments in cryptocurrency, while BEC actors primarily use local networks of money mules in the markets where they launch their scams to launder fiat currency. Ransomware actors would need to plug into existing networks or invest in establishing their own in order to monetize BEC scams and have somewhere for the errant payments to go. Hassold points out, though, that as law enforcement becomes increasingly adept at tracing and freezing cryptocurrency payments—and as the value of cryptocurrencies continues to fluctuate wildly—ransomware actors may be motivated to learn new techniques and switch gears.

Crucially, Hassold notes that while he and his colleagues have not seen evidence of active collaboration between Eastern European ransomware gangs and West African BEC actors, he does see evidence on criminal forums and in active engagement with attackers that ransomware actors are interested in BEC and have been learning about it. Whether this exploration is simply for, ahem, professional enrichment, remains to be seen.

“All of these types of attacks are very serious and the stakes are very high, so it got me thinking about what things will look like in the future when ransomware eventually gets disrupted,” Hassold says. “It’s possible that these two threats on opposite sides of the cybercrime spectrum will converge in the future—and we need to be ready for that.”

The Hacker Gold Rush That's Poised to Eclipse Ransomware

Ransomware attacks, including those of the massively disruptive and dangerous variety, have proved difficult to combat comprehensively. Hospitals, government agencies, schools, and even critical infrastructure companies continue to face debilitating attacks and large ransom demands from hackers. But as governments around the world and law enforcement in the United States have grown serious about cracking down on ransomware and have started to make some progress, researchers are trying to stay a step ahead of attackers and anticipate where ransomware gangs may turn next if their main hustle becomes impractical.

At the RSA security conference in San Francisco on Monday, longtime digital scams researcher Crane Hassold will present findings that warn it would be logical for ransomware actors to eventually convert their operations to business email compromise (BEC) attacks as ransomware becomes less profitable or carries a higher risk for attackers. In the US, the Federal Bureau of Investigation has repeatedly found that total money stolen in BEC scams far exceeds that pilfered in ransomware attacks—though ransomware attacks can be more visible and cause more disruption and associated losses. 

In business email compromise, attackers infiltrate a legitimate corporate email account and use the access to send phony invoices or initiate contract payments that trick businesses into wiring money to criminals when they think they’re just paying their bills.

“So much attention is being paid to ransomware, and governments all over the world are taking action to disrupt it, so eventually the return on investment is going to be impacted,” says Hassold, who is director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “And ransomware actors are not going to say, ‘Oh, hey, you got me’ and go away. So it’s possible that you would have this new threat where you have the more sophisticated actors behind ransomware campaigns moving over to the BEC space where all the money is being made.”

BEC attacks, many of which originate in West Africa and specifically Nigeria, are historically less technical and rely more on social engineering, the art of creating a compelling narrative that tricks victims into taking actions against their own interests. But Hassold points out that a lot of the malware used in ransomware attacks is built to be flexible, with a modular quality so different types of scammers can assemble the combination of software tools they need for their specific hustle. And the technical ability to establish “initial access,” or a digital foothold, to then deploy other malware would be extremely useful for BEC, where gaining access to strategic email accounts is the first step in most campaigns. Ransomware actors would bring a much higher level of technical sophistication to this aspect of the scams.

Hassold also points out that while the most notorious and aggressive ransomware gangs are typically small teams, BEC actors are usually organized into much looser and more decentralized collectives, making it more difficult for law enforcement to target a central organization or kingpin. Similar to Russia’s unwillingness to cooperate on ransomware investigations, it has taken time for global law enforcement to develop working relationships with the Nigerian government to counter BEC. But even as Nigeria has put more emphasis on BEC enforcement, countering the sheer scale of the scam operations is still a challenge.

“You can’t just cut off the head of the snake,” Hassold says. “If you arrest a dozen or even a few hundred of these actors, you’re still not making much of a dent.”

For ransomware actors, the most difficult aspect of transitioning to BEC scams would likely be the dramatic difference in collecting stolen money. Ransomware gangs almost exclusively collect victim payments in cryptocurrency, while BEC actors primarily use local networks of money mules in the markets where they launch their scams to launder fiat currency. Ransomware actors would need to plug into existing networks or invest in establishing their own in order to monetize BEC scams and have somewhere for the errant payments to go. Hassold points out, though, that as law enforcement becomes increasingly adept at tracing and freezing cryptocurrency payments—and as the value of cryptocurrencies continues to fluctuate wildly—ransomware actors may be motivated to learn new techniques and switch gears.

Crucially, Hassold notes that while he and his colleagues have not seen evidence of active collaboration between Eastern European ransomware gangs and West African BEC actors, he does see evidence on criminal forums and in active engagement with attackers that ransomware actors are interested in BEC and have been learning about it. Whether this exploration is simply for, ahem, professional enrichment, remains to be seen.

“All of these types of attacks are very serious and the stakes are very high, so it got me thinking about what things will look like in the future when ransomware eventually gets disrupted,” Hassold says. “It’s possible that these two threats on opposite sides of the cybercrime spectrum will converge in the future—and we need to be ready for that.”

Plus: The US admits to cyber operations supporting Ukraine, SCOTUS investigates its own, and a Michael Flynn surveillance mystery is solved.

Not to freak out anyone, but there's a serious flaw in all supported versions of Microsoft Windows that allows attackers to take over your machine. The so-called Follina vulnerability can be exploited using a weaponized Word document, and security researchers say they've already spotted government-backed hackers using this attack in the wild. Fingers crossed that Microsoft, which has downplayed the severity of the flaw, issues a patch soon.

Speaking of patches, everything from Apple's iOS and Google Android to Chrome, Firefox, and Zoom received major security updates in May. Check out our complete list of available updates to see which apps you need to attend to as soon as possible.

We also explored the race to protect your voice from hackers and corporate greed. And we tried to unravel the mystery of China's sudden warnings about US state-sponsored hackers going after Chinese systems, despite the fact that these hacks are well known and happened ages ago.

Meanwhile, in India, the country's telecom regulator is preparing to crack down on robocall spam and scammers by requiring callers' names to appear on caller ID. The idea sounds good—until you realize the privacy implications and the fact that such a plan might not even work.

Finally, because nothing's sacred, Canada's privacy commissioner this week announced that a mobile app for Tim Hortons, the beloved coffee chain, illegally spied on its users' locations. The app, which used location-tracking tech from US-based firm Radar, collected a constant stream of users' location data—checking as frequently as every 2.5 minutes—and would create an “event” anytime a user “entered or left” their home, office, major sports complex, or rival coffee shop, according to the commissioner's office.

But that's not all, folks. Each week, we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there. 

If you lived in Illinois between May 1, 2015, and April 25, 2022, Google may owe you some cash. The company recently settled a class-action lawsuit over a feature in the Google Photos app that categorized photos of people based on their faces. The problem? According to the lawsuit, Google failed to receive consent to do so from millions of users, a violation of the state's Biometric Information Privacy Act. Google did not admit fault as part of the settlement, but it has agreed to pay $100 million and put in place measures to avoid further privacy violations. If you were an Illinois resident during that seven-year period and appeared in a photo uploaded to the Google Photos app, you can file a claim for your piece of the $100 million pie.

The blurry line between “at war” and “not at war” grew even fuzzier this week. General Paul Nakasone, the head of US Cyber Command and the NSA, told Sky News that the US military has conducted “a series of operations across the full spectrum," including “offensive, defensive, and information operations” in support of Ukraine's defense against Russia's invasion. Nakasone declined to detail what these operations entailed but assured that they were perfectly legal. The general's admission coincides with the US agreeing to provide Ukraine with advanced missile systems with a range of 50 miles. The Kremlin responded to this news by saying the US was “pouring fuel on the fire.”

As part of the US Supreme Court's investigation into the leak of a draft opinion overturning guaranteed abortion rights in the United States, the Court's clerks have been asked to turn over their private phone records and sign an affidavit, according to CNN. The “unprecedented” move is jarring for civil liberties advocates. As Albert Fox Cahn, found of the Surveillance Technology Oversight Project, writes for WIRED: “The intrusive probe reveals a disturbing about-face from the Supreme Court, and particularly Chief Justice John Roberts, on surveillance powers.” The clerks, meanwhile, are reportedly hesitant to refuse the demand for phone records or seek legal counsel for fear of being wrongly suspected of leaking the draft opinion to _Politico_ reporters.

A Trump-era conspiracy theory can finally be put to rest—theoretically, at least. A 52-page classified report into the “unmasking” of Michael Flynn, a former US national security adviser to Donald Trump, has now been made public thanks to a Freedom of Information Act request filed by Jason Leopold of Buzzfeed News. Republicans have long accused Obama administration operatives of revealing Flynn's name in classified material for political purposes in the lead-up to the 2016 election. But the Justice Department report, prepared by former US Attorney John Brash, found “no evidence that unmasking requests were made for political purposes or other inappropriate reasons during the 2016 election period or the ensuing transition period." Flynn ultimately resigned in 2017 for misleading vice president Mike Pence about Flynn’s calls with Russia's ambassador to the US.

Google May Owe You a Chunk of $100 Million

The Canada-based company illegally collected “vast amounts of location data,” such as every time a person entered or left their home, workplace, or another coffee shop.

Canadian investigators determined that users of the Tim Hortons coffee chain's mobile app "had their movements tracked and recorded every few minutes of every day," even when the app wasn't open, in violation of the country's privacy laws.

"The Tim Hortons app asked for permission to access the mobile device's geolocation functions but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data," according to an announcement Wednesday by Canada's Office of the Privacy Commissioner. The federal office collaborated with provincial authorities in Quebec, British Columbia, and Alberta in the investigation of Tim Hortons.

"The app also used location data to infer where users lived, where they worked, and whether they were traveling," the Office of the Privacy Commissioner said. "It generated an 'event' every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace."

Tim Hortons scrapped plans to use the app for targeted advertising but "continued to collect vast amounts of location data" for another year "even though it had no legitimate need to do so," the Office of the Privacy Commissioner said. Tim Hortons said it used aggregated location data "to analyze user trends—for example, whether users switched to other coffee chains and how users' movements changed as the pandemic took hold," the federal office said.

“Inappropriate Form of Surveillance”

“Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers,” Canada Privacy Commissioner Daniel Therrien said. “Following people's movements every few minutes of every day was clearly an inappropriate form of surveillance."

Tim Hortons has more than 5,100 stores in 13 countries. Most are in Canada, but there are more than 600 in the US, mostly in New York, Michigan, and Ohio.

Tim Hortons halted the continual tracking of users' locations in 2020 after the government began investigating. But that "did not eliminate the risk of surveillance" because "Tim Hortons' contract with an American third-party location services supplier contained language so vague and permissive that it would have allowed the company to sell 'de-identified' location data for its own purposes," the Office of the Privacy Commissioner said. As the office noted, there "is a real risk that de-identified geolocation data could be re-identified."

Tim Hortons agreed to implement the agencies' recommendations but apparently will not face any punishment. The investigative report said that Tim Hortons' commitments "will bring the company into compliance" with Canadian law and that "we therefore find this matter to be well-founded and conditionally resolved." That's the language used when an organization violates Canadian privacy laws but has "committed to implementing satisfactory corrective actions."

The announcement said Tim Hortons agreed to "delete any remaining location data and direct third-party service providers to do the same," implement a privacy program that "includes privacy impact assessments for the app and any other apps it launches," implement "a process to ensure information collection is necessary and proportional to the privacy impacts identified," and ensure "that privacy communications are consistent with, and adequately explain, app-related practices." Tim Hortons also agreed to report back to the government with details on its compliance.

Reporter Uncovered Privacy Violation

The investigation began after a June 2020 Financial Post report titled "Double-double tracking: How Tim Hortons knows where you sleep, work, and vacation." Reporter James McLeod found that "Tim Hortons had recorded my longitude and latitude coordinates more than 2,700 times in less than five months, and not just when I was using the app," even though the app "told customers that it tracks location 'only when you have the app open.'"

Tim Hortons' statement said, "In June 2020, we took immediate steps to improve how we communicate with guests about the data they share with us and began reviewing our privacy practices with external experts. Shortly thereafter, we proactively removed the geolocation technology outlined in the report from the Tims app. Data from this geolocation technology was never used for personalized marketing for individual guests. The very limited use of this data was on an aggregated, de-identified basis to study trends in our business—and the results did not contain personal information from any guests."

Alberta Information and Privacy Commissioner Jill Clayton said the investigation provides "yet another example where an organization has not effectively notified customers about its practices. Tim Hortons' customers did not have adequate information to consent to the location tracking that was actually occurring."

_This story originally appeared on_ _Ars Technica__._

Your Tim Hortons Coffee App Knew Where You Were at All Times

The company continues to downplay the severity of the Follina vulnerability, which remains present in all supported versions of Windows.

Researchers warned last weekend that a flaw in Microsoft's Support Diagnostic Tool could be exploited using malicious Word documents to remotely take control of target devices. Microsoft released guidance on Monday, including temporary defense measures. By Tuesday, the United States Cybersecurity and Infrastructure Security Agency had warned that “a remote, unauthenticated attacker could exploit this vulnerability,” known as Follina, “to take control of an affected system.” But Microsoft would not say when or whether a patch is coming for the vulnerability, even though the company acknowledged that the flaw was being actively exploited by attackers in the wild. And the company still had no comment about the possibility of a patch when asked by WIRED yesterday.

The Follina vulnerability in a Windows support tool can be easily exploited by a specially crafted Word document. The lure is outfitted with a remote template that can retrieve a malicious HTML file and ultimately allow an attacker to execute Powershell commands within Windows. Researchers note that they would describe the bug as a “zero-day,” or previously unknown vulnerability, but Microsoft has not classified it as such.

“After public knowledge of the exploit grew, we began seeing an immediate response from a variety of attackers beginning to use it,” says Tom Hegel, senior threat researcher at security firm SentinelOne. He adds that while attackers have primarily been observed exploiting the flaw through malicious documents thus far, researchers have discovered other methods as well, including the manipulation of HTML content in network traffic.

 “While the malicious document approach is highly concerning, the less documented methods by which the exploit can be triggered are troubling until patched,” Hegel says. “I would expect opportunistic and targeted threat actors to use this vulnerability in a variety of ways when the option is available—it’s just too easy.” 

The vulnerability is present in all supported versions of Windows and can be exploited through Microsoft Office 365, Office 2013 through 2019, Office 2021, and Office ProPlus. Microsoft's main proposed mitigation involves disabling a specific protocol within Support Diagnostic Tool and using Microsoft Defender Antivirus to monitor for and block exploitation. 

But incident responders say that more action is needed, given how easy it is to exploit the vulnerability and how much malicious activity is being detected. 

“We are seeing a variety of APT actors incorporate this technique into longer infection chains that utilize the Follina vulnerability," says Michael Raggi, a staff threat researcher at the security firm Proofpoint who focuses on Chinese government-backed hackers. "For instance, on May 30, 2022, we observed Chinese APT actor TA413 send a malicious URL in an email which impersonated the Central Tibetan Administration. Different actors are slotting in the Follina-related files at different stages of their infection chain, depending on their preexisting toolkit and deployed tactics.”

Researchers have also seen malicious documents exploiting Follina with targets in Russia, India, the Philippines, Belarus, and Nepal. An undergraduate researcher first noticed the flaw in August 2020, but it was first reported to Microsoft on April 21. Researchers also noted that Follina hacks are particularly useful to attackers because they can stem from malicious documents without relying on Macros, the much-abused Office document feature that Microsoft has worked to rein in.

“Proofpoint has identified a variety of actors incorporating the Follina vulnerability within phishing campaigns," says Sherrod DeGrippo, Proofpoint's vice president of threat research.

With all this real-world exploitation, the question is whether the guidance Microsoft has published so far is adequate and proportionate to the risk. 

“Security teams could view Microsoft’s nonchalant approach as a sign that this is ‘just another vulnerability,’ which it most certainly is not,” says Jake Williams, director of cyber threat intelligence at the security firm Scythe. “It’s not clear why Microsoft continues to downplay this vulnerability, especially while it’s being actively exploited in the wild.”

Source

Wired