New EU rules mean WhatsApp and Messenger must be interoperable with other chat apps. Here’s how that will work.

A frequent annoyance of contemporary life is having to shuffle through different messaging apps to reach the right person. Messenger, iMessage, WhatsApp, Signal—they all exist in their own silos of group chats and contacts. Soon, though, WhatsApp will do the previously unthinkable for its 2 billion users: allow people to message you from another app. At least, that's the plan.

For about the past two years, WhatsApp has been building a way for other messaging apps to plug themselves into its service and let people chat across apps—all without breaking the end-to-end encryption it uses to protect the privacy and security of people’s messages. The move is the first time the chat app has opened itself up this way, and it potentially offers greater competition.

It isn’t a shift entirely of WhatsApp’s own making. In September, European, lawmakers designated WhatsApp parent Meta as one of six influential “gatekeeer” companies under its sweeping Digital Markets Act, giving it six months to open its walled garden to others. With just a few weeks to go before that time is up, WhatsApp is detailing how its interoperability with other apps may work.

“There’s real tension between offering an easy way to offer this interoperability to third parties whilst at the same time preserving the WhatsApp privacy, security, and integrity bar,” says Dick Brouwer, an engineering director at WhatsApp who has worked on Meta rolling out encryption to its Messenger app. “I think we're pretty happy with where we’ve landed.”

Interoperability in both WhatsApp and Messenger—as dictated by Europe’s rules—will initially focus on text messaging, sending images, voice messages, videos, and files between two people. Calls and group chats will come years down the line. Europe’s rules apply only to messaging services, not traditional SMS messaging. “One of the core requirements here, and this is really important, is for users for this to be opt-in,” says Brouwer. “I can choose whether or not I want to participate in being open to exchanging messages with third parties. This is important, because it could be a big source of spam and scams.”

WhatsApp users who opt in will see messages from other apps in a separate section at the top of their inbox. This “third-party chats” inbox has previously been spotted in development versions of the app. “The early thinking here is to put a separate inbox, given that these networks are very different,” Brouwer says. “We cannot offer the same level of privacy and security,” he says. If WhatsApp were to add SMS, it would use a separate inbox as well, although there are no plans to add it, he says.

Overall, the idea behind interoperability is simple. You shouldn’t need to know what messaging app your friends or family use to get in touch with them, and you should be able to communicate from one app to another without having to download both. In an ideal interoperable world, you could, for example, use Apple’s iMessage to chat with someone on Telegram. However, for apps with millions or billions of users, making this a reality isn’t straightforward—encrypted messaging apps use their own configurations and different protocols and have different standards when it comes to privacy.

Despite WhatsApp working on its interoperability plan for more than a year, it will still take some time for third-party chats to hit people’s apps. Messaging companies that want to interoperate with WhatsApp or Messenger will need to sign an agreement with the company and follow its terms. The full details of the plan will be published in March, Brouwer says; under EU laws, the company will have several months to implement it.

Brouwer says Meta would prefer if other apps use the Signal encryption protocol, which its systems are based upon. Other than its namesake app and the Meta-owned messengers, the Signal Protocol is publicly disclosed as being used in Google Messages and Skype. To send messages, third-party apps will need to encrypt content using the Signal Protocol and then package it into message stanzas in the eXtensible Markup Language (XML). When receiving messages, apps will need to connect to WhatsApp’s servers.

“We think that the best way to deliver this approach is through a solution that is built on WhatsApp’s existing client-server architecture,” Brouwer says, adding it has been working with other companies on the plans. “This effectively means that the approach that we’re trying to take is for WhatsApp to document our client- server protocol and letting third-party clients connect directly to our infrastructure and exchange messages with WhatsApp clients.”

There is some flexibility to WhatsApp interoperability. Meta’s app will also allow other apps to use different encryption protocols if they can “demonstrate” they reach the security standards that WhatsApp outlines in its guidance. There will also be the option, Brouwer says, for third-party developers to add a proxy between their apps and WhatsApp’s server. This, he says, could give developers more “flexibility” and remove the need for them to use WhatsApp’s client-server protocols, but it also “increases the potential attack vectors.”

So far, it is unclear which companies, if any, are planning to connect their services to WhatsApp. WIRED asked 10 owners of messaging or chat services—including Google, Telegram, Viber, and Signal—whether they intend to look at interoperability or had worked with WhatsApp on its plans. The majority of companies didn’t respond to the request for comment. Those that did, Snap and Discord, said they had nothing to add. (The European Commission is investigating whether Apple’s iMessage meets the thresholds to offer interoperability with other apps itself. The company did not respond to a request for comment. It has also faced recent challenges in the US about the closed nature of iMessage.)

Matthew Hodgson, the cofounder of Matrix, which is building an open source standard for encryption and operates the messaging app Element, confirms that his company has worked with WhatsApp on interoperability in an “experimental” way but that he cannot say any more due to signing a nondisclosure agreement. In a talk last weekend, Hodgson demonstrated “hypothetical” architectures for ways that Matrix could connect to the systems of two gatekeepers that don’t use the same encryption protocols.

Meanwhile, Julia Weis, a spokesperson for the Swiss messaging app Threema, says that while WhatsApp did approach it to discuss its interoperability plans, the proposed system didn’t meet Threema’s security and privacy standards. “WhatsApp specifies all the protocols, and we’d have no way of knowing what actually happens with the user data that gets transferred to WhatsApp—after all, WhatsApp is closed source,” Weis says. (WhatsApp’s privacy policy states how it uses people’s data.)

When the EU first announced that messaging apps may have to work together in early 2022, many leading cryptographers opposed the idea, saying it adds complexity and potentially introduces more security and privacy risks. Carmela Troncoso, an associate professor at the Swiss university École Polytechnique Fédérale de Lausanne, who focuses on security and privacy engineering, says interoperability moves could potentially lead to different power relationships between companies, depending on how they are implemented.

“This move for interoperability will, on the one hand, open the market, but also maybe close the market in the sense that now the bigger players are going to have more decisional power,” Troncoso says. “Now, if the big player makes a move and you want to continue being interoperable with this big player, because your users are hooked up to this, you're going to have to follow.”

While the interoperability of encrypted messaging apps may be possible, there are some fundamental challenges about how the systems will work in the real world. How much of a problem spam and scamming will be across apps is largely unknown until people start using interoperable setups. There are also questions about how people will find each other across different apps. For instance, WhatsApp uses your phone number to interact and message other people, while Threema randomly generates eight-digit IDs for people’s accounts. Linking up with WhatsApp “could de-anonymize Threema users,” Weis, the Threema spokesperson says.

Meta’s Brouwer says the company is still working on the interoperability features and the level of support it will make available for companies wanting to integrate with it. “Nobody quite knows how this works,” Brouwer says. “We have no idea what the demand is.” However, he says, the decision was made to use WhatsApp’s existing architecture to run interoperability, as it means that it can more easily scale up the system for group chats in the future. It also reduces the potential for people’s data to be exposed to multiple servers, Brouwer says.

Ultimately, interoperability will evolve over time, and from Meta’s perspective, Brouwer says, it will be more challenging to add new features to it quickly. “We don't believe interop chats and WhatsApp chats can evolve at the same pace,” he says, claiming it is “harder to evolve an open network” compared to a closed one. “The second you do something different—than what we know works really well—you open up a wormhole of security, privacy issues, and complexity that is always going to be much bigger than you think it is.”

WhatsApp Chats Will Soon Work With Other Encrypted Messaging Apps

“If molecules really were the new microchips, the promise of remote gene editing was that the body could be manipulated to upgrade itself.” An exclusive excerpt from 2054: A Novel.

2054, Part II: Next Big Thing

“They had, quite swiftly, begun an algorithmic scrub of any narrative of the president suffering a health emergency, burying those stories.” An exclusive excerpt from 2054: A Novel.

2054, Part I: Death of a President

Plus: Russia was likely behind widespread GPS outages, Vault 7 leaker was sentenced, police claim to trace Monero cryptocurrency, and more.

An indictment from the US Department of Justice may have solved the mystery of how disgraced cryptocurrency exchange FTX lost over $400 million in crypto. The indictment, filed last week, alleges that three individuals used a SIM-swapping attack to steal hundreds of millions in virtual currency from an unnamed company. The timing and the amount stolen coincides with FTX's theft. Meanwhile, in a letter obtained by WIRED this week, seven lawmakers have demanded the DOJ stop funding biased and inaccurate predictive policing tools until the agency has a way to ensure law enforcement won’t use them in a way that has a “discriminatory impact.”

In Florida, prosecutors say a 17-year-old named Alan Winston Filion is responsible for hundreds of swatting attacks around the United States. The news of his arrest was first reported by WIRED days before law enforcement made it public. It was the culmination of a multi-agency manhunt to piece together a trail of digital breadcrumbs left by the teenager. In Ukraine, unmanned aerial vehicles have been powerful tools since the Russian invasion began in February 2022. But as the war rages on, another kind of unmanned robot has increasingly appeared on the front-lines: the unmanned ground vehicle, or UGV.

For months lawyers affiliated with an India based hacker-for-hire firm called Appin Technology have used legal threats to censor reporting about the company’s alleged cyber mercenary past. The EFF, Techdirt, MuckRock, and DDoSecrets are now pushing back, publicly sharing details for the first time about the firm's efforts to remove content from the web. It’s a dangerous world out there, so we’ve also got a list of some major patches issued in January that you can use to update your devices to keep them secure.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

For years Western security officials have warned about the threat of China collecting data about millions of people and the country’s hackers infiltrating sensitive systems. This week, Federal Bureau of Investigation director Christopher Wray said hackers affiliated with the Chinese Communist Party are constantly targeting US critical infrastructure, such as water treatment plants, the electrical grid, and oil and gas pipelines. Wray’s testimony, at a House subcommittee on China, came as the FBI also revealed it removed malware from hundreds of routers in people’s homes and offices that had been planted by the Chinese hacking group Volt Typhoon.

“China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities,” Wray said in the public appearance. “Low blows against civilians are part of China’s plan.” The FBI director added that China has a bigger hacking operation than “every other major nation combined,” and claimed that if all of the FBI’s cyber-focused agents were assigned to work on issues related to China, they would still be outnumbered “by at least 50 to 1.”

While concerns about the scale of China’s espionage and cyber operations aren’t new, the US intelligence community has been increasingly vocal and worried about critical infrastructure being targeted by Volt Typhoon and other groups. “The threat is extremely sophisticated and pervasive,” NSA officials warned in November. In May 2023, Microsoft revealed it had been tracking Volt Typhoon intrusions at communications and transportation infrastructure, among other critical infrastructure, in US states and Guam.

The FBI and DOJ, also revealed this week that they remotely removed the KV Botnet malware from hundreds of routers infected by Volt Typhoon. The impacted routers, from Cisco and Netgear, were mostly at the end of their life, but were being used as part of wider operations. “​​The Volt Typhoon malware enabled China to hide, among other things, pre-operational reconnaissance and network exploitation against critical infrastructure like our communications, energy, transportation, and water sectors,” Wray said. It isn’t the first time US officials have obtained a court order to remotely wipe devices infected by hackers, but the move is still rare.

Since the first cryptocurrencies emerged more than a decade ago, there has been the assumption that the blockchain-based digital currencies are anonymous and untraceable. They are, in fact, very traceable. Researchers have shown how people can be linked to the transactions they make and law enforcement have used the techniques to help bust illicit dark web markets and catch pedophiles. There are, however, still some privacy-focused cryptocurrencies that appear to be less traceable than Bitcoin. This includes Monero, which is increasingly being adopted by sellers of child sexual abuse materials.

This week investigators in Finland said Moreno-tracing helped reveal the identity of a hacker who allegedly attacked psychotherapy company Vastaamo in 2020, stealing thousands of patient records and threatening to leak them unless people paid a ransom. Investigators from the Finnish National Bureau of Investigation claim they used heuristic analysis to infer where funds were moved to. The investigators did not reveal the full methods of how they allegedly traced the Monero payments, however, they add to the growing body of evidence that cryptocurrency tracing firms and investigators may be able to track the currency.

Planes flying over Europe have faced a spike in accuracy issues with GPS systems used for navigation in recent months. The head of Estonia’s Defense Forces has claimed that Russia is likely the source of this interference, according to an interview with Bloomberg. “Someone is causing it, and we think it’s Russia,” Martin Herem told the publication, adding that Russia may be testing its electronic warfare capabilities and “learning” the most effective tactics. Across Europe, and particularly the Baltics region, there has been a reported increase in GPS jamming, with Finland reporting large interferences in December and pilots repeatedly reporting issues with their navigation systems.

In 2017, the Vault 7 leaks exposed some of the CIA’s most sophisticated hacking tools, including how the agency could compromise routers, phones, PC, and TVs. Joshua Schulte, a former CIA engineer in the agency’s Operations Support Branch who prosecutors identified as being behind the data breach and responsible for leaking the materials to Wikileaks, was convicted in numerous trials in recent years. Schulte, who denied the allegations, has been sentenced to 40 years in prison for the espionage and also for possessing thousands of child abuse images. Judge Jesse Furman, sentencing Schulte, said he had caused “untold damage to national security.” In June 2022, _The New Yorker_ published this comprehensive investigation into the data breach and Schulte’s troubled history working at the agency.

China’s Hackers Keep Targeting US Water and Electricity Supplies

An indictment against three Americans suggests that at least some of the culprits behind the theft of an FTX crypto fortune may be in custody.

When more than $400 million worth of crypto was mysteriously pulled out of the coffers of what was once the world's biggest cryptocurrency exchange, FTX, on the very day that it declared bankruptcy in November of 2022, many initially suspected insiders at the company—including, potentially, then CEO Sam Bankman-Fried, now convicted of fraud. But clues left across blockchains over the past year suggested instead that external thieves had chosen a particularly inconvenient moment during FTX's meltdown to pull off an enormous heist.

Now, new clues revealed in a US Department of Justice indictment suggest something even more surprising: Some of those suspected thieves appear to have been in the United States and have now been arrested.

An indictment filed last week details charges against three people—Robert Powell, Carter Rohn, and Emily Hernandez—who are accused of running a massive cybercriminal theft ring. The group, which authorities say was known as the “Powell SIM Swapping Crew,” allegedly used SIM swaps—tricking phone companies into switching a user's mobile phone registration to the thieves' SIM card so that they can gain access to authentication codes sent to the victim's phone—to steal hundreds of millions of dollars from victims' accounts.

Most notably, the gang is accused of siphoning $400 million in virtual currency from the accounts of a company—named in the indictment only as Victim Company-1—on the night of November 11, 2022, continuing into November 12. As first spotted by cybersecurity journalist Brian Krebs, that is also the exact timing of FTX's theft, which the company itself has pegged at between $415 million and $432 million in stolen crypto.

The blockchain analysis firm Elliptic corroborated Krebs' inference that the $400 million theft described in the report is almost certainly the FTX heist. “We are not aware of any other thefts from crypto businesses on this scale, on these dates,” Elliptic wrote in a blog post. “It therefore appears likely that FTX is the ‘Victim Company-1’ named in the indictment.”

FTX didn't immediately respond to WIRED's request for comment on whether it is the SIM-swapping victim described in the indictment.

If the indictment does, in fact, describe the FTX theft—and given the relative rarity of nine-figure crypto thefts and the exact timing of this one—then the charging document reveals key details about how the FTX heist was pulled off. It describes how Powell allegedly asked Hernandez to target a specific phone number for SIM-swapping. According to prosecutors, Hernandez then obtained a fake ID with her photo but the name of her victim—potentially an FTX staffer—and presented it at an AT&T retail store in Texas to prove her identity as she requested that the staffer's account be transferred to her own phone.

That allowed the group to hijack messages intended for the victim, including authentication codes for his or her account, according to the indictment. Given that those codes usually represent a second-factor authentication mechanism required after a user enters their username and password, it’s not clear how those other credentials might have been stolen, though cybercriminals typically obtain them through phishing, credential-stealing malware, or trying credentials leaked in other database dumps and potentially reused across accounts.

The possibility that the FTX thieves have been identified as Americans, within reach of US law enforcement, comes as a surprise following Elliptic’s discovery in October of last year that the crypto stolen from FTX had moved across blockchains and through cryptocurrency swapping services in a way that suggested Russia-linked money launderers. Portions of the funds, for instance, moved through mixing services—which take in users’ funds and return others to muddy the trail of any blockchain tracing—that are popular with Russian cybercriminals, such as ChipMixer and Sinbad.

Both mixers, in fact, have been sanctioned by the US Treasury Department for their illicit use, including by Russian ransomware gangs. “It’s looking increasingly likely that the perpetrator has links to Russia,” Elliptic’s chief scientist and cofounder Tom Robison told WIRED in October. “We can’t attribute this to a Russian actor, but it’s an indication it might be.”

If the money is FTX's, those blockchain footprints suggest that the $400 million that the hackers allegedly stole is long gone, moved into the hands of international money launderers. “It is therefore not clear whether any of the stolen assets are under their control, and might be recovered,” Elliptic wrote in its blog post today. Nonetheless, if the alleged hackers were paid a portion of that sum in exchange for their work to steal it, that money might still be seized and repaid as restitution to FTX’s many creditors.

Either way, it suggests that another mystery in the story of FTX’s implosion and the billions of dollars in missing funds that disappeared with it may be at least partially solved. If so, it would seem this FTX-related crime, at least, can’t be blamed on Sam Bankman-Fried.

The Mystery of the $400 Million FTX Heist May Have Been Solved

A loose coalition of anti-censorship voices is working to highlight reports of one Indian company’s hacker-for-hire past—and the legal threats aimed at making them disappear.

Hacker-for-hire firms like NSO Group and Hacking Team have become notorious for enabling their customers to spy on vulnerable members of civil society. But as far back as a decade ago in India, a startup called Appin Technology and its subsidiaries allegedly played a similar cyber-mercenary role while attracting far less attention. Over the past two years, a collection of people with direct and indirect links to that company have been working to keep it that way, using a campaign of legal threats to silence publishers and anyone else reporting on Appin Technology’s alleged hacking past. Now, a loose coalition of anti-censorship voices is working to make that strategy backfire.

For months, lawyers and executives with ties to Appin Technology and to a newer organization that shares part of its name, called the Association of Appin Training Centers, have used lawsuits and legal threats to carry out an aggressive censorship campaign across the globe. These efforts have demanded that more than a dozen publications amend or fully remove references to the original Appin Technology’s alleged illegal hacking or, in some cases, mentions of that company’s cofounder, Rajat Khare. Most prominently, a lawsuit against Reuters brought by the Association of Appin Training Centers resulted in a stunning order from a Delhi court: It demanded that Reuters take down its article based on a blockbuster investigation into Appin Technology that had detailed its alleged targeting and spying on opposition leaders, corporate competitors, lawyers, and wealthy individuals on behalf of customers worldwide. Reuters “temporarily” removed its article in compliance with that injunction and is fighting the order in Indian court.

As Appin Training Centers has sought to enforce that same order against a slew of other news outlets, however, resistance is building. Earlier this week, the digital rights group the Electronic Frontier Foundation (EFF) sent a response—published here—pushing back against Appin Training Centers’ legal threats on behalf of media organizations caught in this crossfire, including the tech blog Techdirt and the investigative news nonprofit MuckRock.

No media outlet has claimed that Appin Training Centers—a group that describes itself as an educational firm run in part by former franchisees of the original Appin Technology, which reportedly ceased its alleged hacking operations more than a decade ago—has been involved in any illegal hacking. In December, however, Appin Training Centers sent emails to Techdirt and MuckRock demanding they too take down all content related to allegations that Appin Technology previously engaged in widespread cyberspying operations, citing the court order against Reuters.

Techdirt, Appin Training Centers argued, fell under that injunction by writing about Reuters' story and the takedown order targeting it. So had MuckRock, the plaintiffs claimed, which hosted some of the documents that Reuters had cited in its story and uploaded to MuckRock's DocumentCloud service. In the response sent on their behalf, the EFF states that the two media organizations are refusing to comply, arguing that the Indian court's injunction “is in no way the global takedown order your correspondence represents it to be.” It also cites an American law called the SPEECH Act that deems any foreign court’s libel ruling that violates the First Amendment unenforceable in the US.

“It's not a good state for a free press when one company can, around the world, disappear news articles,” Michael Morisy, the CEO and cofounder of MuckRock, tells WIRED. “That's something that fundamentally we need to push back against.”

Techdirt founder Mike Masnick says that, beyond defeating the censorship of the Appin Technology story, he hopes their public response to that censorship effort will ultimately bring even more attention to the group’s past. In fact, 19 years ago, Masnick coined the term “the Streisand effect” to describe a situation in which someone's attempt to hide information results in its broader exposure—exactly the situation he hopes to help create in this case. “The suppression of accurate reporting is problematic,” says Masnick. “When it happens, it deserves to be called out, and there should be more attention paid to those trying to silence it.”

The anti-secrecy nonprofit Distributed Denial of Secrets (DDoSecrets) has also joined the effort to spark that Streisand Effect, “uncensoring” Reuters' story on the original Appin Technology as part of a new initiative it calls the Greenhouse Project. DDoSecrets cofounder Emma Best says the name comes from its intention to foster a “warming effect”—the opposite of the “chilling effect” used to describe the self-censorship created by legal threats. “It sends a signal to would-be censors, telling them that their success may be fleeting and limited,” Best says. “And it assures other journalists that their work can survive.”

Neither Appin Training Centers nor Rajat Khare responded to WIRED's request for comment, nor did Reuters.

The fight to expose the original Appin Technology’s alleged hacking history began to reach a head in November of 2022, when the Association for Appin Training Centers sued Reuters based only on its reporters’ unsolicited messages to Appin Training Centers’ employees and students. The company’s legal complaint, filed in India’s judicial system, accused Reuters not only of defamation, but “mental harassment, stalking, sexual misconduct and trauma.”

Nearly a full year later, Reuters nonetheless published its article, “How an Indian Startup Hacked the World.” The judge in the case initially sided with Appin Training Centers, writing that the article could have a “devastating effect on the general students population of India.” He quickly ordered an injunction stating that Appin Training Centers can demand Reuters take down their claims about Appin Technology.

That ruling has preceded any legal arguments over the truth of Reuters’ reporting, which the news agency has promised to bring up in an appeal. In fact, Reuters wrote that it based its story on interviews with dozens of Appin Technology's former staff and hundreds of alleged targets, as well as thousands of its internal documents. Those files include Appin Technology's marketing pitch documents that remain publicly available on DocumentCloud thanks to MuckRock, and appear to show the company explicitly offering to hack targets on behalf of clients via “phishing,” “social engineering,” “trojan” infections, and even discussing specific cases when clients hired them for hacking operations.

Appin Training Centers, for its part, argues that it’s merely a collection of educational institutions whose brand has been tarnished by Reuters’ reporting. Reuters has responded in a legal filing arguing that Appin Training Centers was created “solely for purposes of this lawsuit, with ulterior motive,” and pointed out, through an exhibit attached to a court filing, that it was incorporated only months _after_ it named itself as the plaintiff suing Reuters.

Even so, a little more than two weeks after publishing its investigation into Appin Technology, on December 5, Reuters complied with the Indian court's injunction, removing its story. Soon, in a kind of domino effect of censorship, others began to take down their own reports about Appin Technology after receiving legal threats based on the same injunction. SentinelOne, the cybersecurity firm that had helped Reuters in its investigation, removed its research on an Appin Technology subsidiary’s alleged hacking from its website. The Internet Archive deleted its copy of the Reuters article. The legal news site Lawfare and cybersecurity news podcast Risky Biz both published analyses based on the article; Risky Biz took its podcast episode down, and Lawfare overwrote every part of its piece that referred to Appin Technology with Xs. WIRED, too, removed a summary of Reuters' article in a news roundup after receiving Appin Training Centers' threat.

Aside from the injunction that Appin Training Centers has used to demand publishers censor their stories, Appin cofounder Rajat Khare has separately sent legal threats to another collection of news outlets based on a court order he obtained in Switzerland. Two Swiss publications have publicly noted that they responded to court orders by removing Khare’s name from stories about alleged hacking. Others have removed Khare’s name or removed the articles altogether without a public explanation, including the Bureau of Investigative Journalism, the UK’s _Sunday Times_, several Swiss and French news outlets, and eight Indian ones.

“This is an organization throwing everything against the wall, trying to make as many allegations in as many venues as possible in the hopes that something, somewhere sticks,” says one person at a media outlet that has received multiple legal threats from people connected to Appin Technology, who declined to be named due to the legal risks of speaking out. “Sometimes it works, sometimes it doesn’t. Unfortunately, in India, it’s worked.”

Even before the EFF, Techdirt, MuckRock, and DDoSecrets began to push back against that censorship, some had immediately resisted it. _The New Yorker_, for instance, had mentioned a subsidiary of Appin Technology and Rajat Khare in a feature about India's hacker-for-hire industry in June of last year. It was sued by Appin Training Centers, but has kept its piece online while the lawsuit proceeds. (_The New Yorker_ and WIRED are both published by Condé Nast.) Ronald Deibert, a well-known security researcher and founder of the University of Toronto's Citizen Lab, a group that focuses on exposing hackers who target members of civil society, had also mentioned Appin Technology in a blog post. Deibert received and refused Appin Training Centers' takedown threat, posting a screenshot of its email to his X feed in December along with his response: seven middle-finger emojis.

As the backlash to the censorship of reporting on Appin Technology's alleged hacking snowballs, however, it may now be going beyond a few cases where Appin Training Centers’ and Rajat Khare’s censorship attempts have failed, says Seth Stern, director of advocacy for the Freedom of the Press Foundation, who has written about the censorship campaign. Instead, it may be backfiring, he says, particularly for Appin Technology cofounder Rajat Khare. “It does seem like a sort of dubious strategy to be stirring this up now, and I do wonder if he is starting to regret that given the coverage it's getting,” says Stern. “You could easily see that it'll do more reputational harm than good for Khare and for Appin.”

MuckRock's Morisy says that attention is exactly the intention of his move, along with Techdirt and the EFF, to put a spotlight on the legal threats they've received. “It’s leveraging the Streisand effect to an extent. But also just finding ways to push back,” says Morisy. “There needs to be a cost for groups that are trying to silence journalists.”

A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship—and Now the Backlash

For nearly two years, police have been tracking down the culprit behind a wave of hoax threats. A digital trail took them to the door of a 17-year-old in California.

A California teenager prosecutors say is responsible for hundreds of swatting attacks around the United States was exposed after law enforcement pieced together a digital trail left on some of the internet’s largest platforms, according to court records released this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces four felony charges in Florida’s Seminole County related to swatting, or fake threats called into the police to provoke a forceful response, according to Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the culmination of a multi-agency manhunt for the person police claim is responsible for swatting attacks on high schools, historically black colleges and universities, mosques, and federal agents, and for threats to bomb the Pentagon, members of the United States Senate, and the US Supreme Court. Ultimately, a YouTube channel, Discord chats, and usernames related to _The Lord of the Rings_ helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with four felony counts, including three related to allegedly making false reports to law enforcement and one for unlawful use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say targeted people based on race, religion, or other protected classes. While prosecutors alleged that Filion “is responsible for hundreds of swatting and bomb threat incidents throughout the United States,” the charges Filion faces relate to a single May 12, 2023, swatting attack against the Masjid Al Hayy Mosque in Sanford, Florida.

An attorney for Filion was not immediately available to respond to WIRED’s request for comment.

More than a year before the swatting attack on the Florida mosque, agents with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his home in Lancaster, California, according to court documents made public on Wednesday. The interview took place on April 21, 2022, the same day the owner of a Telegram channel linked to swatting activity posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a school in Anacortes, Washington, came across a Telegram user associated with multiple swatting and doxing channels. The user, “Nazgul Swattings,” had claimed responsibility in one of these channels for the threats to the Washington schools, according to the same court documents.

Over the following months, court records say, the FBI monitored channels linked to this user. One of those, a channel called Torswats (formerly Nazgul Swats), had shared recordings of nearly 20 hoax calls threatening locations around the country, including schools in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

As the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a private investigator, was running his own parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a user behind Torswats and asked to chat on a peer-to-peer chatting service called Tox under the guise of ordering a swat. According to records shared with WIRED, not mentioned in the arrest warrant, while interacting on Tox, Dennis used Wireshark to monitor his network traffic. In the process, he uncovered an IP address and the username “Paimon Arnum,” which was previously unknown to law enforcement.

YouTube, Discord, and ‘Lord of the Rings’ Led Police to a Teen Accused of a US Swatting Spree

Plus: Google fixes dozens of Android bugs, Microsoft rolls out nearly 50 patches, Mozilla squashes 15 Firefox flaws, and more.

Later in January, Google released Chrome 121 to the stable channel, fixing 17 security issues, three of which are rated as having a high impact. These include CVE-2024-0807, a use-after-free flaw in WebAudio, and CVE-2024-0812, an inappropriate implementation vulnerability in accessibility. The final high-impact vulnerability is CVE-2024-0808, an integer underflow in WebUI.

Obviously, these updates are important, so check and apply them as soon as you can.

Microsoft

Microsoft’s January Patch Tuesday squashes nearly 50 bugs in its popular software, including 12 remote code execution (RCE) flaws.

No security holes included in this month’s set of updates are known to have been used in attacks, but notable flaws include CVE-2024-20677, a bug in Microsoft Office that could allow attackers to create malicious documents with embedded FBX 3D model files to execute code.

To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it, Microsoft said.

Meanwhile, CVE-2024-20674 is a Windows Kerberos security feature bypass vulnerability rated as critical with a CVSS score of 8.8. In one scenario for this vulnerability, the attacker could convince a victim to connect to an attacker-controlled malicious application, Microsoft said. “Upon connecting, the malicious server could compromise the protocol,” the software giant added.

Mozilla Firefox

Hot on the heels of its market-dominant competitor Chrome, Mozilla’s Firefox has patched 15 security flaws in its latest update. Five of the bugs are rated as having a high severity, including CVE-2024-0741, an out-of-bounds write issue in Angle that could allow an attacker to corrupt memory, leading to an exploitable crash.

An unchecked return value in TLS handshake code tracked as CVE-2024-0743 could also cause an exploitable crash.

CVE-2024-0755 covers memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

Cisco

Enterprise software giant Cisco has patched a vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products that could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

Tracked as CVE-2024-20253 and with a whopping CVSS score of 9.9, Cisco said an attacker could exploit the vulnerability by sending a crafted message to a listening port of an affected device.

“A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user,” Cisco said. “With access to the underlying operating system, the attacker could also establish root access on the affected device,” it warned.

SAP

SAP has issued 10 new security fixes as part of its January Security Patch Day, which includes several issues with a CVSS score of 9.1. CVE-2023-49583 is an escalation-of-privilege issue in applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack, and SAP Web IDE for SAP HANA.

Meanwhile, CVE-2023-50422 and CVE-2023-49583 are escalation-of-privilege issues in SAP Edge Integration Cell.

Another notable flaw is CVE-2024-21737, a code injection vulnerability in SAP Application Interface Framework, which has a CVSS score of 8.4. “A vulnerable function module of the application allows an attacker to traverse through various layers and execute OS commands directly,” security firm Onapsis said. “Successful exploits can cause considerable impact on confidentiality, integrity, and availability of the application.”

Apple and Google Just Patched Their First Zero-Day Flaws of the Year

Aerial drones have changed the war in Ukraine. Now, both Russia’s and Ukraine’s militaries are deploying more unmanned ground robots—and the two are colliding.

Near the Ukrainian city of Avdiivka, a boxy robot zips along the rocky, cracked road. Snaking from side to side, the robot—a four-wheeled machine, around knee height—carries cargo and ammunition for Russian troops. However, it’s being watched. Hovering above the road, tracking the movements of the robot, is a Ukrainian drone. Suddenly, another drone smashes into the robot, blowing it to pieces.

The attack, which happened in early December and was claimed by the Ukrainian military’s 110th Mechanized Brigade, is one of a small but growing number of incidents where unsophisticated robots have been used against other robots in Russia’s war in Ukraine. Aerial drones have been used to surveil or attack ground robots, soldiers have attached weapons to land-based robots, and other small unmanned bots are being fitted with jamming technology to knock drones from the sky.

Since Russia’s full-scale invasion in February 2022, small aerial drones have played an outsize role in the war in Ukraine—with thousands of drones being used to monitor the battlefield, watch enemy movements, and carry explosives. Videos produced by Ukrainian and Russian soldiers show the drones, which are often first-person view (FPV) drones, being used to attack tanks and troops. As the war has raged on, another kind of robot has increasingly appeared in recent months: the unmanned ground vehicle, or UGV.

“There’s lots of unmanned ground vehicle development happening,” says Samuel Bendett, a Russia analyst at the think tank Center for Naval Analyses who tracks military drone and robotics technology use. Most of the UGVs being developed or used are small robots, Bendett says, as larger vehicles will be tracked, observed, and attacked with FPV and other aerial drones. “The Ukrainian battlefield is saturated with aerial sensors that basically track and attack anything that moves,” he says. That includes other robots.

The UGVs being developed within the war are typically four- or six-wheeled machines that can be kitted out for multiple purposes. There are logistics robots, which can carry supplies to the front lines; evacuation robots that carry injured people; and robots linked to combat such as those that can place or destroy landmines and have explosives or weapons attached. These robots are largely remote-controlled by humans—there’s little autonomy—and operate over ranges of a few kilometers.

UGVs themselves are not new. Some of the earliest UGVs were created in World War II and used as explosive devices, while they have also appeared in other conflicts. Most Russian UGV developments so far have been homemade or DIY, Bendett says, with troops or volunteers creating robots for specific tasks or needs. Ukraine has, to date, put more military effort into developing ground robots, with the government stating its ambition to build an “army of robots.”

Videos from within Ukraine, first shared on Telegram channels and reviewed by analysts such as Bendett, show a Russian drone monitoring a Ukrainian UGV as it trundles along laying mines. In another video, a small six-wheeled robot approaches a downed drone, lifting up its wings, before troops approach it. A third shows drones trying to destroy UGVs moving along the ground. In one demonstration, a person is dragged behind a UGV along the ground. Earlier in January, Mykhailo Fedorov, Ukraine’s deputy prime minister, announced a UGV with an “automated turret” that, he said, can also transport ammunition and provisions to fighters.

Robots Are Fighting Robots in Russia's War in Ukraine

Members of Congress say the DOJ is funding the use of AI tools that further discriminatory policing practices. They're demanding higher standards for federal grants.

The United States Department of Justice has failed to convince a group of US lawmakers that state and local police agencies aren't awarded federal grants to buy AI-based “policing” tools known to be inaccurate, if not prone to exacerbating biases long observed in US police forces.

Seven members of Congress wrote in a letter to the DOJ, first obtained by WIRED, that the information they pried loose from the agency had only served to inflame their concerns about the DOJ’s police grant program. Nothing in its responses so far, the lawmakers said, indicates the government has bothered to investigate whether departments awarded grants bought discriminatory policing software.

“We urge you to halt all Department of Justice grants for predictive policing systems until the DOJ can ensure that grant recipients will not use such systems in ways that have a discriminatory impact,” the letter reads. The Justice Department previously acknowledged that it had not kept track of whether police departments were using the funding, awarded under the Edward Byrne Memorial Justice Assistance Grant Program, to purchase so-called predictive policing tools.

Led by Senator Ron Wyden, a Democrat of Oregon, the lawmakers say the DOJ is required by law to “periodically review” whether grant recipients comply with Title VI of the nation’s Civil Rights Act. The DOJ is patently forbidden, they explain, from funding programs shown to discriminate on the basis of race, ethnicity, or national origin, whether that outcome is intentional or not.

Independent investigations in the press have found that popular “predictive” policing tools trained on historical crime data often replicate long-held biases, offering law enforcement, at best, a veneer of scientific legitimacy while perpetuating the over-policing of predominantly Black and Latino neighborhoods. An October headline from The Markup states bluntly: “Predictive Policing Software Terrible At Predicting Crimes.” The story recounts how researchers at the publication recently examined 23,631 police crime predictions—and found them accurate roughly 1 percent of the time.

“Predictive policing systems rely on historical data distorted by falsified crime reports and disproportionate arrests of people of color,” Wyden and the other lawmakers wrote, predicting—as many researchers have—that the technology serves only to create “dangerous” feedback loops. The statement notes that “biased predictions are used to justify disproportionate stops and arrests in minority neighborhoods,” further biasing statistics on where crimes occur.

Senators Jeffrey Merkley, Ed Markey, Alex Padilla, Peter Welch, and John Fetterman also cosigned the letter, as did Representative Yvette Clarke.

The lawmakers have requested that an upcoming presidential report on policing and artificial intelligence investigate the use of predictive policing tools in the US. “The report should assess the accuracy and precision of predictive policing models across protected classes, their interpretability, and their validity,” to include, they added, “any limits on assessing their risks posed by a lack of transparency from the companies developing them.”

Should the DOJ wish to continue funding the technology after this assessment, the lawmakers say, it should at least establish “evidence standards” to determine which predictive models are discriminatory—and then reject funding for all those that fail to live up to them.

Source

Wired