Following a string of serious security incidents, Microsoft says it has a plan to deal with escalating threats from cybercriminals and state-backed hackers.

Today, in a blog post and email to employees, Microsoft is announcing a broad vision for tackling the cybersecurity challenges that have increasingly plagued the company and its customers in recent years. Known as the Secure Future Initiative, the plan leans heavily on artificial intelligence tools as a “game changer” and also includes a call for international cyberspace norms, an expansion of the company's 2017 Digital Geneva Convention.

The most tangible and immediately applicable component of the strategy, though, relates to improvements in Microsoft's software development and engineering approach. In Thursday's email, executive vice president for Microsoft security Charlie Bell and colleagues Scott Guthrie and Rajesh Jha lay out a plan to further safeguard identity management systems in Microsoft products, improve security software development, and shorten response and patch release times for addressing vulnerabilities, specifically those in the cloud.

The announcement comes as Microsoft has faced scrutiny over situations where vulnerabilities in its products have enabled attackers—both financially-motivated cybercriminals and state-backed hackers—to rampage through the company's own systems and those of customers. And the climate around accountability is evolving as regulators and law enforcement look for new paths to deterring, but also preventing, damaging hacks. On Monday, for example, the United States Securities and Exchange Commission (SEC) announced charges against the IT management company SolarWinds and its chief information security officer over “cybersecurity risks and vulnerabilities” that the SEC alleges were known and should have been addressed.

Microsoft said on Thursday that its Secure Future Initiative comes in response to wildly escalating threats from attackers. “In recent months, we’ve concluded within Microsoft that the increasing speed, scale, and sophistication of cyberattacks call for a new response," company vice chair and president Brad Smith wrote.

In an interview with WIRED, Microsoft's Bell emphasized that both cybercriminal and state-backed actors are professionalizing and homing in on phishing and creative approaches to credential theft as the most direct and effective method for infiltrating organizations of all sorts. He noted that while it is difficult to get an accurate accounting of total global economic losses due to cybercrime and cyberattacks, Microsoft believes that total losses have been greater than $6 trillion and could close in on $10 trillion by 2025.

“The threat is growing,” he tells WIRED. “It's a huge drag on the world. So when you look at all of this going on and you say well what can we do? Microsoft is in the center of much of the ability to defend. It caused us to step back.”

Speeding vulnerability response times by 50 percent and moving toward mandating secure default settings for customers are two aggressive steps Microsoft says it plans to take to make a tangible impact on customer security. Bell says that multi-factor authentication adoption among Microsoft customers is at roughly 34 percent, but “it should be 100 percent.”

The changes come as other giants across the industry, including Google, are acknowledging the need to push secure defaults, particularly around authentication. The software development platform GitHub, which Microsoft owns, has been working on rolling out mandatory two-factor for months. Apple has long mandated two-factor for most accounts, and Google has been publicly working toward the goal for years.

On many components of the Secure Future Initiative, Microsoft is not exactly late to the party on hardline changes, but is noticeably behind the early advocates. And in general, concepts of engineering software to be secure by design or building system architecture to be zero trust were prominent features of the past decade. Yet, between cloud services and all of the legacy Windows systems around the world, Microsoft is at the very heart of IT infrastructure, and in many ways, global cybersecurity moves at Microsoft’s pace.

“It’s an absolutely terrible world if we don’t get ahead of it,” Bell says. “We have all the data right now that the threat actors—they’re poking from the outside, they see a little bit. We know everything because we’re on the inside. If we’re gonna tackle the security problem we’ve got to be real about the fact that you’re not going to flip a light switch and everybody’s running in the cloud. There’s a lot of operational ground to cover between here and there. And Microsoft is the company that supports that world, that critical infrastructure that’s out there.”

Microsoft Does Damage Control With Its New 'Secure Future Initiative'

CulturePulse's AI model promises to create a realistic virtual simulation of every Israeli and Palestinian citizen. But don't roll your eyes: It's already been put to the test in other conflict zones.

Training artificial intelligence models does not typically involve coming face-to-face with an armed soldier who is pointing a gun at you and shouting at your driver to get out of the car. But the system that F. LeRon Shults and Justin Lane, cofounders of CulturePulse, are developing for the United Nations is not a typical AI model.

“I got pulled over by the \[Israeli\] military, by a guy holding \[a military rifle\] because we had a Palestinian taxi driver who drove past a line he wasn't supposed to,” Shults tells WIRED. “So that was an adventure.”

Shults and Lane were in the West Bank in September, just weeks before Hamas attacked Israel on October 7, sparking what has become one of the worst periods of violence in the region in at least 50 years.

Shults and Lane—both Americans who are now based in Europe—were on the ground as part of a contract they signed with the UN in August to develop a first-of-its-kind AI model that they hope will help analyze solutions to the Israel-Palestinian conflict.

Shults and Lane are aware that claiming that AI could “solve the crisis” between Israelis and Palestinians is likely to result in a lot of eye-rolling if not outright hostility, especially given the horrific scenes coming out of Gaza daily. So they are quick to dispel that this is what they are trying to do.

“Quite frankly, if I were to phrase it that way, I'd roll my eyes too,” Shults says. “The key is that the model is not designed to resolve the situation; it's to understand, analyze, and get insights into implementing policies and communication strategies.”

The conflict in the region is centuries old and deeply complex, and it's made even more complicated by the current crisis. Countless efforts at finding a political solution have failed, and any eventual end to the crisis will need support not just from the two sides involved, but likely the wider international community. All of this makes it impossible for an AI system to simply spit out a fully formed solution. Instead, CulturePulse aims to pinpoint the underlying causes of the conflict.

“We know that you can't solve a problem this complex with a single AI system. That's not ever going to be feasible in my opinion,” Lane tells WIRED. “What is feasible is using an intelligent AI system—using a digital twin of a conflict—to explore the potential solutions that are there.”

The digital twin Lane is speaking of is CulturePulse’s multi-agent AI model that they are currently building for the UN. The model will ultimately create a virtual version of each and every one of the 15 million people who live in Israel and the Palestinian territories, each imbued with demographics, religious beliefs, and moral values that echo their real-world counterparts, according to Shults and Lane.

In total, CulturePulse’s model can factor in over 80 categories to each “agent,” including traits like anger, anxiety, personality, morality, family, friends, finances, inclusivity, racism, and hate speech.

“These models are entire artificial societies, with thousands or millions of simulated adaptive artificially intelligent agents that are networked with each other, and they're designed in a way that is more psychologically realistic and more sociologically realistic,” Shults says. “Basically you have a laboratory, an artificial laboratory, that you can play with on your PC in ways that you could never do ethically, certainly, in the real world.”

The system will allow the UN to see how the virtual society would react to changes in economic prosperity, heightened security, changing political influences, and a range of other parameters. Shults and Lane claim their model predicts outcomes with clinical accuracy of over 95 percent correlation to real-world outcomes.

“It goes beyond just learning randomly and finding patterns like machine learning, and it goes beyond statistics, which gives you correlations,” Shults says. “It actually gets to a causality, because of the multi-agent AI system which grows the conflict, or the polarization, or the peaceful immigration policy from the ground up. So it shows you what you want to create before you try it out in the real world.”

Discussions around AI and the Israel-Hamas war have so far been focused on the threat posed by generative AI to push disinformation. While those threats have yet to materialize, news cycles have been clouded by disinformation and misinformation being shared by all sides. Rather than trying to eliminate this disruptive element, CulturePulse’s model will factor it into its analysis.

“We actually deliberately want to make sure that those materials that are biased are being put into these models. They just need to be put into the model in a psychologically real way,” Lane says.

The horrific massacres and humanitarian crises happening in Israel and Gaza over the past month have brought home the pressing need for a solution to the deeply rooted conflict. But before the latest outbreak in violence in the region, the UN Development Program (UNDP) was already exploring new options in trying to find a resolution, signing an initial five-month contact with CulturePulse in August.

The application of artificial intelligence technologies to conflict situations has been around since at least 1996, with machine learning being used to predict where conflicts may occur. The use of AI in this area has expanded in the intervening years, being used to improve logistics, training, and other aspects of peacekeeping missions. Lane and Shults believe they could use artificial intelligence to dig deeper and find the root causes of conflicts.

Their idea for an AI program that models the belief systems that drive human behavior first began when Lane moved to Northern Ireland a decade ago to study whether computation modeling and cognition could be used to understand issues around religious violence.

In Belfast, Lane figured out that by modeling aspects of identity and social cohesion, and identifying the factors that make people motivated to fight and die for a particular cause, he could accurately predict what was going to happen next.

“We set out to try and come up with something that could help us better understand what it is about human nature that sometimes results in conflict, and then how can we use that tool to try and get a better handle or understanding on these deeper, more psychological issues at really large scales,” Lane says.

The result of their work was a study published in 2018 in _The Journal for Artificial Societies and Social Simulation,_ which found that people are typically peaceful but will engage in violence when an outside group threatens the core principles of their religious identity.

A year later, Lane wrote that the model he had developed predicted that measures introduced by Brexit—the UK’s departure from the European Union that included the introduction of a hard border in the Irish Sea between Northern Ireland and the rest of the UK—would result in a rise in paramilitary activity. Months later, the model was proved right.

The multi-agent model developed by Lane and Shults relied on distilling more than 50 million articles from GDelt, a project that ​​monitors “the world's broadcast, print, and web news from nearly every corner of every country in over 100 languages.” But feeding the AI millions of articles and documents was not enough, the researchers realized. In order to fully understand what was driving the people of Northern Ireland to engage in violence against their neighbors, they would need to conduct their own research.

Lane spent months finding and speaking to those directly involved in the violence, such as members of the Ulster Volunteer Force (UVF), a paramilitary group loyal to the British crown, and the Irish Republican Army (IRA), a paramilitary group seeking the end of British rule on the island of Ireland. The information that Lane gathered in these interviews was fed into his model in order to give a more complete understanding of the psychology behind the violence that had riven the country for three decades.

While Lane is now based in Slovakia, he maintains the links he built up while in Northern Ireland, returning at least once a year to speak to the people again, and update his model with the latest information. If during these conversations Lane hears about a particular issue or a reason why someone took a particular action that’s not present in the AI model, the team will see if there is lab data to back it up before putting it into his model.

“And if the data doesn’t exist, we'll go out and we'll do our own experimentation with universities to see if there is evidence, and then we will build that into our project,” Lane says.

In recent years, Lane and Shults have worked with a number of groups and governments to apply their model to better understand situations across the globe, including the conflicts in South Sudan and the Balkans. The model has also been used in the Syrian Refugee Crisis, where Lane and Shults traveled to the Greek island of Lesbos to gather firsthand information to help their system integrate refugees with host families. CulturePulse has also worked with the Norwegian government to tackle the spread of Covid-19 misinformation by better understanding the reasons why someone is sharing inaccurate information.

Key to the success of all of these efforts is the collection of firsthand information about what’s happening on the ground. And so, when they signed the contract with the UNDP in August, the first thing Shults and Lane wanted to arrange was a visit to Israel and the West Bank, where they spent “about a week” gathering data. “We met with the UN and different NGOs going out to the villages, seeing firsthand what it looks like with the settler dynamics that are there,” Shults says. The pair attempted to go to Gaza but were refused entry.

The trip to Israel also included time speaking to their employers to find out exactly what it is they are hoping to get from this project.

“We spent a whole week extracting from the UN officials we met information that's relevant, that we need to know for the model, getting a sense of their understanding of the dynamics, the data that they might have that could inform the model's calibration and final validation,” Shults says.

Shults would not discuss the detailed parameters the UN had specified be built into the model, but his team gives the UN team regular updates over Zoom on the construction of the model and “the simulation experiments that are being run to test out the conditions and mechanisms that might lead to outcomes that they desire,” he says.

The UNDP has not yet responded to WIRED’s request for comment.

CulturePulse’s contract with the UNDP runs out in January, but they are hopeful of signing a phase-two contract that would see them build out a fully functional model. CulturePulse this month also signed a nine-month contract with UNDP to work on a system that would help resolve cultural and religious issues still causing conflict in Bosnia and Herzegovina since the end of the Bosnian War in 1995.

The reason the UN is turning to AI in the Israeli-Palestinian conflict, according to Lane, is that it simply has nowhere else to turn. “The way that the UN phrased it to us is that there's no more low-hanging fruit in that situation,” Lane says. “They needed to try something that was new and innovative, something that was really thinking outside of the box yet still really addressing the root issues of the problem.”

The UN Hired an AI Company to Untangle the Israeli-Palestinian Crisis

The slow-motion implosion of Elon Musk’s X has given rise to a slew of competitors, where privacy invasions that ran rampant over the past decade still largely persist.

When Elon Musk took over Twitter in October 2022, experts warned that his proposed changes—including less content moderation and a subscription-based verification system—would lead to an exodus of users and advertisers. A year later, those predictions have largely borne out. Advertising revenue on the platform has declined 55 percent since Musk’s takeover, and the number of daily active users fell from 140 million to 121 million in the same time period, according to third-party analyses.

As users moved to other online spaces, the past year could have marked a moment for other social platforms to change the way they collect and protect user data. “Unfortunately, it just feels like no matter what their interest or cultural tone is from the outset of founding their company, it's just not enough to move an entire field further from a maximalist, voracious approach to our data,” says Jenna Ruddock, policy council at Free Press, a nonprofit media watchdog organization, and a lead author on a new report examining Bluesky, Mastodon, and Meta’s Threads, all of which have jockeyed to fill the void left by Twitter, which is now named X.

Companies like Google, X, and Meta collect vast amounts of user data, in part to better understand and improve their platforms but largely to be able to sell targeted advertising. But collection of sensitive information around users’ race, ethnicity, sexuality, or other identifiers can put people at risk. For instance, earlier this year, Meta and the US Department of Justice reached a settlement after it was found that the company’s algorithm allowed advertisers to exclude certain racial groups from seeing ads for things like housing, jobs, and financial services. In 2018, the company was slapped with a $5 billion fine—one of the largest in history—after a Federal Trade Commission probe found multiple instances of the company failing to protect user data, triggered by an investigation into data shared with British consulting firm Cambridge Analytica. (Meta has since made changes to some of these ad targeting options.)

“There’s a very strong corollary between the data that's collected about us and then the automated tools that platforms and other services use, which often produce discriminatory results,” says Nora Benavidez, director of digital justice and civil rights at Free Press. “And when that happens, there's really no recourse other than litigation.”

Even for users who want to opt out of ravenous data collection, privacy policies remain complicated and vague, and many users don’t have the time or knowledge of legalese to parse through them. At best, says Benavidez, users can figure out what data won’t be collected, “but either way, the onus is really on the users to sift through policies, trying to make sense of what's really happening with their data,” she says. “I worry these corporate practices and policies are nefarious enough and befuddling enough that people really don't understand the stakes.”

Mastodon, according to the report, offers users the most protection, because it doesn’t collect sensitive personal information or geo-location data and doesn’t track user activity off the platform, at least not on the platform’s default server. Other servers—or “instances,” in Mastodon parlance—can set their own privacy and moderation policies. Bluesky, founded by Twitter cofounder and former CEO Jack Dorsey, also doesn’t collect sensitive data but does track user behavior across other platforms. But there are no laws that require platforms like Bluesky and Mastodon to keep their privacy policies this way. “Folks can sign on with particular privacy expectations that they might feel satisfied by a privacy policy or disclosures,” says Ruddock. “And that can still change over time. And I think that's what we're going to see with some of these emerging platforms.”

Mastodon spokesperson Renaud Chaput told WIRED that the platform does not have any plans to change its privacy policies and noted that user data is only available on the server where a user’s account is hosted. Bluesky and Meta did not immediately respond to requests for comment. Meta spokesperson Emil Vazquez directed WIRED to a thread from the company’s deputy chief privacy officer, Rob Sherman, in which he said, “Meta’s privacy policy, and the Threads supplementary privacy policy, are the best resources to understand how Threads uses and collects data.”

Nazanin Andalibi, assistant professor of information at the University of Michigan, says that while privacy can be a competitive advantage for a newer platform, “people might still use a platform that they believe will not respect their privacy,” even if they have concerns. Mastodon has fewer than 3 million users, and Bluesky, which remains in beta, has just over 1 million. And greater privacy may not be enough to shift users’ behaviors away from bigger platforms like X and Meta’s Threads.

Unlike Bluesky and Mastodon, Threads largely abides by the same wide-reaching data collection policies as its parent company, which also owns Facebook and Instagram. Launched in July off the back of Instagram, the platform saw an initial spike in growth, followed by a plateau. But in its quarterly earnings call last week, Meta CEO Mark Zuckerberg said that Threads now has over 100 million monthly active users. “I’ve thought for a long time there should be a billion-person public conversations app that is a bit more positive,” Zuckerberg said. “I think that if we keep at this for a few more years, then I think we have a good chance of achieving our vision there.”

“Threads looks like they're collecting much more information than they actually need in order for the service to function. And some of the information they're collecting is pretty sensitive,” says Calli Schroeder, global privacy counsel at the Electronic Privacy Information Center, a nonprofit focused on privacy and free speech online. “I think this is just inextricably tied to the fact that behind Threads, Meta already holds just an absolutely obscene amount of information on individuals.”

Twitter, prior to Musk’s takeover, has had its own spotty history of protecting user data. In 2009, hackers compromised the platform twice, accessing users’ private information and, in some cases, taking over accounts. In 2011, the FTC issued a consent decree—a threat of legal action—against Twitter for failing to protect user data in relation to the 2009 hacks. As part of the settlement, “Twitter will be barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information,” according to the FTC, with each violation carrying a $16,000 penalty.

So far, attempts to curtail the collection of users’ data has been piecemeal, largely driven by state-level laws and individual enforcement actions. The American Data Privacy and Protection Act, proposed in 2022, remains in congressional limbo.

“Regulation continues to be extraordinarily behind,” says Ruddock. “The companies are not going to change on their own.”

The New Era of Social Media Looks as Bad for Privacy as the Last One

Hamas posted gruesome images and videos that were designed to go viral. Sources argue that Telegram’s lax moderation ensured they were seen around the world.

How Telegram Became a Terrifying Weapon in the Israel-Hamas War

Plus: Major vulnerability fixes are now available for a number of enterprise giants, including Cisco, VMWare, Citrix, and SAP.

October has been a security flaw-fest, with Apple, Microsoft, and Google issuing patches for vulnerabilities that are being used in real-life attacks. There were also multiple enterprise fixes during the month, with Cisco, VMWare, and Citrix fixing serious security bugs.

Some of the patches are more urgent than others, so read on to find out what you need to know about the updates released in October.

Apple iOS and iPad OS

October was a busy month for Apple, with the iPhone maker issuing its second set of fixes as part of iOS 17.1 at the end of the month. The two dozen security fixes in iOS 17.1 include patches for serious flaws in the Kernel at the heart of the iOS operating system and WebKit, the engine that underpins the Safari browser.

Tracked as CVE-2023-42849, the Kernel issue fixed in iOS 17.1 could allow an attacker that has already achieved code execution to bypass memory mitigations, Apple said on its support page. The three WebKit flaws—tracked as CVE-2023-40447, CVE-2023-41976, and CVE-2023-42852—could lead to arbitrary code execution.

Apple has also issued iOS and iPad OS 16.7.2, fixing the same flaws for users of older devices or those who don’t want to upgrade right away. They came alongside macOS Sonoma 14.1, macOS Ventura 13.6, macOS Monterey 12.7.1, tvOS 17.1, WatchOS 10.1, and Safari 17.1.

Earlier this month, Apple released iOS 17.0.3 and iOS 16.7.1, fixing issues being used in real-life attacks. Tracked as CVE-2023-42824, the first is a Kernel bug that could allow an attacker with access to your device to elevate their privileges.

Apple also fixed CVE-2023-5217, a buffer overflow flaw that could allow an attacker to execute code. Affecting multiple browsers and platforms, the bug has already been patched in Google’s Chrome browser.

Microsoft

Microsoft’s Patch Tuesday has seen the tech giant fix over 100 flaws, including two zero-day vulnerabilities in Microsoft WordPad and Skype for Business.

CVE-2023-36563 is an information disclosure bug in the WordPad word processing program that could expose NTLM hashes and result in NTLM relay attacks. However, it requires user interaction: The attacker must send someone a malicious file and convince them to open it, Microsoft said.

CVE-2023-41763 is an elevation of privilege vulnerability in Skype for Business. “An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address,” potentially disclosing IP addresses or port numbers, Microsoft said.

Microsoft also patched a flaw in Message Queuing tracked as CVE-2023-35349 with a CVSS critical score of 9.8, which could allow an unauthenticated attacker to remotely execute code.

October’s Patch Tuesday is a particularly urgent one, so it’s important to update as soon as you can.

Google Chrome

Google has released 20 security fixes for its Chrome browser, including one patch for a flaw rated as critical. Tracked as CVE-2023-5218, the bug is a use-after-free issue in Site Isolation. Another six fixes cover inappropriate implementation vulnerabilities marked as having medium impact, while CVE-2023-5476 is a use-after-free flaw in Blink History. Another issue, CVE-2023-5474, is a heap buffer overflow in PDF, according to Google’s blog.

A further four inappropriate implementation vulnerabilities are rated as having a low impact, with Google also fixing a low severity use-after-free bug in Cast tracked as CVE-2023-5473.

None of the flaws fixed in October have been exploited, but given how actively the browser is targeted, it makes sense to update as soon as you can.

Google Android

Google’s October Android update was a major one because it fixed 53 issues, including two vulnerabilities already being used in real-life attacks. The first is CVE-2023-4863, a heap buffer overflow bug in libwebp affecting the applications that use the library to encode and decode images in the WebP format. This vulnerability impacts many applications and could be used to install spyware, security firm Malwarebytes wrote in a blog.

There are indications that the bug “may be under limited, targeted exploitation,” Google said in an advisory.

CVE-2023-4211 is an issue in Arm components rated as having a high impact, which Google said is also being used in attacks. “A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory,” Malwarebytes said, adding that the vulnerability affects multiple versions of Arm Mali GPU drivers. These are used in multiple Android device models, including those made by Google, Samsung, Huawei, and Xiaomi.

Another scary flaw in the System tracked as CVE-2023-40129 is rated as critical. “The \[vulnerability\] could lead to remote code execution with no additional execution privileges needed,” Google said.

The update is available for Google’s Pixel and Samsung’s Galaxy series, so if you have an Android device, check your settings ASAP.

Cisco

Software giant Cisco has released patches to fix two already exploited flaws. Tracked as CVE-2023-20198 and with an eye-watering CVSS score of 10, the first is an issue in the web user interface feature of Cisco IOS XE software. It affects physical and virtual devices running Cisco IOS XE software that also have the HTTP or HTTPS Server feature enabled, researchers at Cisco Talos said in a blog.

“Successful exploitation of CVE-2023-20198 allows an attacker to gain privilege level 15 access to the device, which the attacker can then use to create a local user and log in with normal user access,” the researchers warned.

The attacker can use the new unauthorized local user account to exploit a second vulnerability, CVE-2023-20273, in another component of the WebUI feature. “This allows the adversary to inject commands with elevated root privileges, giving them the ability to run arbitrary commands on the device,” said Talos Intelligence, Cisco’s cybersecurity firm.

Cisco “strongly recommends that customers disable the HTTP Server feature on all internet-facing systems or restrict its access to trusted source addresses,” the firm wrote in an advisory.

VMWare

VMWare has patched two out-of-bounds write and information disclosure vulnerabilities in its vCenter Server. Tracked as CVE-2023-34048, the first is a vulnerability in the implementation of the DCERPC protocol that could lead to remote code execution. VMware has rated the flaw as critical with a CVSS base score of 9.8.

At the other end of the CVSS scale but still worth mentioning is CVE-2023-34056, a partial information disclosure bug with a score of 4.3. “A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data,” VMWare wrote in an advisory.

Citrix

Enterprise software firm Citrix has issued urgent fixes for vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Tracked as CVE-2023-4966 and with a CVSS score of 9.4, the first bug could allow an attacker to expose sensitive information.

CVE-2023-4967 is a denial of service issue with a CVSS score of 8.2. Exploits of CVE-2023-4966 on unmitigated appliances “have been observed,” Citrix said. “Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions of NetScaler ADC and NetScaler Gateway as soon as possible.”

SAP

SAP’s October Security Patch Day saw the release of seven new security notes, all of which were rated as having a medium impact. Tracked as CVE-2023-42474, the worst flaw is a cross-site scripting vulnerability in SAP BusinessObjects Web Intelligence with a CVSS score of 6.8.

With only nine new and updated security notes, SAP’s October Patch Day “belongs to the calmest of the last five years,” security firm Onapsis said.

While SAP’s October flaw count was much smaller than its peers’, attackers are still out there, so you should still keep up to date and get patching as soon as you can.

Apple, Google, and Microsoft Just Patched Some Spooky Security Flaws

Plus: Details emerge of a US government social media-scanning tool that flags “derogatory” speech, and researchers find vulnerabilities in the global mobile communications network.

As the Israel-Hamas war raged on this week and Israel expanded its ground invasion of the Gaza Strip, the territory's compromised internet infrastructure and access to connectivity went fully dark on Friday, leaving Palestinians without access to ground or mobile data connections. Meanwhile, researchers are bracing for the fallout if Hamas makes good on its threats to distribute hostage execution videos online. And TikTokkers are using a niche livestreaming feature and exploiting the Israeli-Hamas conflict to collect virtual gifts from viewers, a portion of which goes to the social media company as a fee.

As the worst mass shooting in Maine's history unfolded this week and the gunman remained at large, disinformation about the situation and the suspect flooded social media, adding to the already chaotic and horrific situation. Elon Musk, the owner of X (formerly Twitter) posted remarks earlier this month mocking Ukrainian president Vlodymr Zelensky that were met with a flood of support and enthusiasm from Russian trolls and accounts distributing pro-Russia propaganda.

The US federal foreign intelligence collection tool—a frequently abused surveillance authority—known as Section 702 is facing its demise at the end of the year despite being viewed as the “crown jewel” of US surveillance powers. So far, no members of Congress have introduced a bill to prevent its January 1 sunset. And the identity-management platform Okta suffered a breach that had implications for nearly 200 of its corporate clients and brought up memories of a similar hack the company suffered last year that also had knock-on effects for customers.

An EU government body has been pushing a controversial proposal with far-reaching privacy implications in an attempt to combat child sexual abuse material, but its most outspoken advocates recently added to the drama significantly by essentially launching an influence campaign to support its passage. The long-foreseen nightmare of using generative AI to create digital child abuse materials has arrived with a flood of images, some of which are completely fabricated while others depict real victims generated from old datasets.

We also went deep this week on a situation in which hackers say they can crack a locked USB drive that contains a massive 7,002 bitcoins, worth about $235 million—but the drive's owner hasn't let them try.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

A cryptominer that never seemed to generate very much cryptocurrency for its creators is part of a larger digital espionage campaign, according to researchers from security firm Kaspersky Lab. The platform, which they call StripedFly, has infected more than 1 million Windows and Linux targets globally since 2017. StripedFly is modular and has multiple components for compromising targets' devices and collecting different types of data, indicating that it was likely created as part of a well-funded state espionage program, not a cybercriminal enterprise. It also includes an update mechanism so attackers can distribute improvements and new functionality to the malware.

StripedFly can, among other things, steal access credentials from compromised devices; take screenshots; grab databases, sensitive files, videos, or other information of interest; and record live audio by compromising a target's microphone. Notably, StripedFly uses an innovative, custom Tor client to mask communication and exfiltration between the malware and its command-and-control servers. It also has a ransomware component that attackers have occasionally deployed. It infects targets initially using a customized version of the notorious EternalBlue exploit leaked from the US National Security Agency.

Documents reviewed by 404 Media shed new light on US Immigration and Customs Enforcement’s scanning and database tool for identifying “derogatory” online speech about the US. Dubbed Giant Oak Search Technology (GOST), it assists ICE agents in scanning social media posts. According to the documents, they then use the findings in immigration enforcement actions.

One of the documents shows a GOST catchphrase, “We see the people behind the data,” and a user guide from the documents says GOST is “capable of providing behavioral-based internet search capabilities.” ICE agents can search the system for specific names, addresses, email addresses, and countries of citizenship. The documents say that “potentially derogatory social media can be reviewed within the interface.”

The world’s telephony networks have often been built on legacy infrastructure and with a convoluted maze of interconnections. The system enables mobile data access across much of the world, but its complexity and the collision of new and archaic technologies can lead to vulnerabilities. This week, University of Toronto’s Citizen Lab published extensive research on the degree to which roaming arrangements between mobile providers contain security issues that can be exploited to track devices, and by extension the people who own them. The flaw comes from a lack of protection on the communications between cell towers as you, for instance, travel on a train, ride a motorcycle, or walk around town. The concern is that governments, criminals, or other snoops can manipulate the weaknesses in these handoff communications to track device locations. “These vulnerabilities are most often tied to the signaling messages that are sent between telecommunications networks which expose the phones to different modes of location disclosure,” Citizen Lab researchers wrote.

This Cryptomining Tool Is Stealing Secrets

As Israel increases its ground operation in Gaza, the last remaining internet and mobile connections have gone dark.

For more than three weeks, Gaza has faced an almost total internet blackout. The cables, cell towers, and infrastructure needed to keep people online have been damaged or destroyed as Israel launched thousands of missiles in response to Hamas attacking Israel and taking hundreds of hostages on October 7. Then, this evening, amid reports of heavy bombing in Gaza, some of the last remaining connectivity disappeared.

In the days after October 7, people living in Gaza have been unable to communicate with family or friends, leaving them unsure whether loved ones are alive. Finding reliable news about events has become harder. Rescue workers have not been able to connect to mobile networks, hampering recovery efforts. And information flowing out of Gaza, showing the conditions on the ground, has been stymied.

As the Israel Defense Forces said it was expanding its ground operations in Gaza this evening, internet connectivity fell further. Paltel, the main Palestinian communications company, has been able to keep some of its services online during Israel’s military response to Hamas’ attack. However, at around 7:30 pm local time today, internet monitoring firm NetBlocks confirmed a “collapse” in connectivity in the Gaza Strip, mostly impacting remaining Paltel services.

“We regret to announce a complete interruption of all communications and internet services within the Gaza Strip,” Paltel posted in a post on its Facebook page. The company claimed that bombing had “caused the destruction of all remaining international routes.” An identical post was made on the Facebook page of Jawwal, the region’s biggest mobile provider, which is owned by Paltel. Separately, Palestinian Red Crescent, a humanitarian organization, said on X (formerly Twitter) that it had lost contact with its operation room in Gaza and is “deeply concerned” about its ability to keep caring for people, with landline, cell, and internet connections being inaccessible.

“This is a terrifying development,” Marwa Fatafta, a policy manager focusing on the Middle East and North Africa at the digital rights group Access Now, tells WIRED. “Taking Gaza completely off the grid while launching an unprecedented bombardment campaign only means something atrocious is about to happen.”

A WIRED review of internet analysis data, social media posts, and Palestinian internet and telecom company statements shows how connectivity in the Gaza Strip drastically plummeted after October 7 and how some buildings linked to internet firms have been damaged in attacks. Photos and videos show sites that house various internet and telecom firms have been damaged, while reports from official organizations, including the United Nations, describe the impact of people being offline.

Damaged Lines

Around the world, the internet and telecoms networks that typically give web users access to international video calls, online banking, and endless social media are a complicated, sprawling mix of hardware and software. Networks of networks, combining data centers, servers, switches, and reams of cables, communicate with each other and send data globally. Local internet access is provided by a mix of companies with no clear public documentation of their infrastructure, making it difficult to monitor the overall status of the system as a whole. In Gaza, experts say, internet connectivity is heavily reliant on Israeli infrastructure to connect to the outside world.

Amid Israel’s intense bombing of Gaza, physical systems powering the internet have been destroyed. On October 10, the United Nations’ Office for the Coordination of Humanitarian Affairs (OCHA), which oversees emergency responses, said air strikes “targeted several telecommunication installations” and had destroyed two of the three main lines of communications going into Gaza.

The Destruction of Gaza’s Internet Is Complete

TikTokkers are using a little-known livestreaming feature to falsely represent Israelis and Palestinians—and the company is taking a cut of costly in-app gifts viewers give to participants.

TikTokkers are using a little-known livestreaming feature to cash in on the huge interest in the Israel-Hamas war despite having no links to the crisis. TikTok, meanwhile, is taking up to 50 percent of the earnings.

In the days after Hamas attacked Israel on October 7, TikTok creators have been engaging in “live matches” on the platform where one creator plays the role of Israelis and the other that of Palestinians, while encouraging—and often shouting at—their followers to continue to donate expensive gifts. The side with the most gifts after five minutes wins the battle.

Some of these gifts cost hundreds of dollars each, and several livestreams WIRED observed in recent days have continued for multiple hours without a break. One battle had seen the creator representing Palestinians winning 72 matches in a row.

The creators can cash out their winnings for real currency, but only after TikTok itself has taken a major cut of the earnings.

As the humanitarian crisis in Gaza continues to worsen, social media platforms have been accused of allowing disinformation to fester while platforms including TikTok have been accused of silencing certain viewpoints. Now TikTok appears to be profiting off their users’ fascination with Israel and Palestinians, and allowing creators who may not be from Israel or the Palestinian territories to earn money off the conflict.

WIRED found dozens of examples of creators seeking to cash in on people’s interest in the crisis, but one pair of creators appears to be cashing in more than most.

On multiple days over the course of the past week, a Turkish streamer who claims to represent Palestinians battled a Greek-Georgian streamer who claims to represent Israelis. In case there was any doubt about who each was supposedly representing, each had the flag of their respective adopted sides onscreen during the battles.

In all of the battles WIRED observed, none of the participants appeared to have any link to the entities they claimed to be representing, and none of them suggested they were planning on donating any of the money earned to the people directly impacted by the current crisis.

Battles between influencers online have been a feature of streaming services since at least 2016, particularly in China, though on most other platforms, the participants have to complete tasks or show off a skill in order to win a battle. On TikTok, it’s mostly just screaming.

Live matches, also known as player knockout or PK battles, have been a feature on TikTok since at least 2021, though TikTok does not mention the feature on its own webpage describing how livestreaming works. Despite the feature being available for more than two years, it is not very well known, and to the uninitiated, the TikTok battles may make little sense, with viewer counters, stickers, and never-ending comments crowding the screen while the two creators shout and scream in a bid to get their followers to donate more gifts.

Rather than making any coherent argument about the rights of Israelis or Palestinians during this crisis, the streamers instead shout out their side’s name or scream comments such as: “Like, like, like,” and “Follow me.”

The streams WIRED observed were watched live by thousands of TikTok users. Today, just before this article was published, a push notification showed the streamers were going live once again.

The two streamers did not respond to WIRED’s messages about their battles.

The rise of TikTok live matches related to the Israel-Hamas war was first highlighted by Abbie Richards, a research fellow at the Accelerationism Research Consortium who specializes in tracking misinformation on TikTok. Richards said it was “gross to grift off atrocities.”

“So this is real people, sending real money to TikTokkers to gesture support for the concept of Israel or Palestine,” Richards said in a video posted on Instagram this week. “But do you know who’s really making money off of these? TikTok, because they take roughly half of the money creators make on live. This helps literally no one except these grifters and TikTok. It’s fucking disgusting.”

TikTok did not respond to WIRED’s request for comment.

A lot of TikTok creators use the app’s livestream feature to generate income, with some streamers broadcasting their entire lives on the platform. The “live match” feature is little known on the hugely popular video-sharing app that allows two people to “battle” against each other for five minutes at a time. The winner is the person who gains the most likes and gifts from their followers.

The strange phenomenon means that the TikTokkers participating need to encourage their followers to donate as many gifts as possible in order for them to “win.”

Virtual gifts are purchased with TikTok’s in-app currency, known as coins. The cost of coins vary depending on how many you are buying, but you can buy 70 coins for less than a dollar.

The gifts range from stickers of roses and the TikTok logo, which cost just a couple of coins, up to animations that take over the full screen that cost up to 45,000 coins. Purchasing enough coins to buy the most expensive gifts on TikTok can cost over $500.

After a user donates the gift to a creator during a battle, those gifts are then converted into Diamonds, which creators can then cash out for real currency.

However, the full value of the gift is not transferred to the creator, with TikTok taking a significant slice of each gift donated. The exact amount is unclear, but a BBC investigation last year found creators received just 30 percent of the money donated to them. TikTok at the time said its cut was significantly less than 70 percent but would not specify an exact percentage.

But even small purchases can quickly accumulate. In January, people spent $6 billion in-app on TikTok, according to a report released by Data.ai, a mobile market trends firm

It can be a lucrative business, with some TikTokkers claiming they are making up to $30,000 a month from live matches. Meanwhile, those who are sending the gifts are also reporting that they can easily become addicted, leading to financial and emotional problems.

TikTok Streamers Are Staging ‘Israel vs. Palestine’ Live Matches to Cash In on Virtual Gifts

In the hours following the worst mass shooting in Maine’s history, disinformation about the suspected gunman flooded social media with false claims that he had been arrested.

Following a mass shooting at a bowling alley and restaurant in Lewiston, Maine, yesterday evening that left at least 18 people dead, state police urgently warned residents to “stay inside your home with the doors locked” as they mounted a manhunt for the suspect.

Misinformation about the suspect flooded social media platforms like X (formerly Twitter), Facebook, and TikTok moments after the shooting. On X, verified accounts pushed out bogus claims that the threat had been neutralized and a suspect had been arrested. Police have since identified 40-year-old Robert Card as a “person of interest” in the shooting. While Card remains at large as of 10 am ET this morning, posts featured videos of the supposed arrest that have been viewed hundreds of thousands of times.

A prolific verified X account with almost 300,000 followers was among the first to post the claim that the suspect had been arrested, and while the account subsequently posted an update stating that the suspect was still at large, the original post—which has been seen over 170,000 times—remains active.

The top result for the search term “Robert Card arrested” on X was a post featuring the same video that has been viewed over 1.9 million times, even though it had a Community Note attached making it clear the claims in the post were false.

The same video circulating on X was also being shared on TikTok, where one post had been viewed 80,000 times by this morning.

Another of the main false narratives circulating in the hours after Card was identified was that he had been arrested in 2016 for possessing and disseminating sexually explicit materials. This was also inaccurate: It refers to a different person named Robert Card, who is also 40 years old and from Maine.

Some accounts labeled Card “a far-left lunatic” based on the unverified claim that he voted for former US president Barack Obama. Others wildly tried to link the incident to the current crisis in the Middle East, claiming, without evidence, that Card “was a Hamas supporter.”

While misinformation about the mass shooting proliferated across social media, the problem was acute on X, where owner Elon Musk has incentivized people to post engaging and viral content even if it’s not accurate. As a result, users rushed to be the first to post updates about the shooting despite being blatantly false.

“It’s as if everyone thinks disinformation is a problem, but not for them personally—only for _other_ people,” Caroline Orr, a behavioral scientist and postdoctoral researcher at the University of Maryland who tracks disinformation online, wrote on X, adding: “When 20+ people are murdered in a mass shooting, and the reaction of most people on this website is: ‘How can I use this to push a political agenda?’ or ‘How can I use this to attack XYZ person?’ … that reflects something far more disturbing.”

X, Meta, and TikTok did not immediately respond to WIRED’s request for comment.

At 3 am ET this morning, Lewiston Police Department confirmed on its Facebook page that Card, a certified firearms instructor and a member of the US Army from Bowdoin, Maine, was still on the run. The department said Card “should be considered armed and dangerous” and that members of the public should not approach him.

Law enforcement believes the shooter killed at least 16 people and 13 more at around 7 pm yesterday at the Sparetime Recreation bowling alley and the nearby Schemengees Bar and Grille. Officials said the death toll is expected to rise, with one local city councilor telling CNN that it could be as high as 22.

The incident was the nation’s worst mass shooting this year, according to the Gun Violence Archive.

Card, whose own X profile was filled with conspiracy theories about trans mass shooters and pro-MAGA content, had been committed to a mental health facility for two weeks earlier this year after he reported “hearing voices and threats to shoot up the National Guard Base in Saco, Maine,” according to a police bulletin circulated by law enforcement and reported by AP.

Notably, Card also liked two posts, one from Donald Trump Jr. and another by far-right personality Dinesh D'Souza, about their opposition to gun control.

The rapid unchecked spread of misinformation last night and into this morning mirrored the response earlier this month when Hamas militants attacked Israel on October 7. In the hours and days following the attack and the bombing of Gaza by the Israeli government, X was overrun by disinformation shared by verified users, who rehashed old footage, video game content, and photoshopped images to push partisan narratives.

_Updated at 10:55 am ET, October 26, 2023, to include the latest casualty and wounded figures provided by Maine governor Janet Mills during a press conference this morning._

Maine Mass Shooting Disinformation Floods Social Media as Suspect Remains at Large

A recent breach of authentication giant Okta has impacted nearly 200 of its clients. But repeated incidents and the company’s delayed disclosure have security experts calling foul.

On Friday, October 20, the identity management platform Okta said it suffered an intrusion in its customer support system. As an access and authentication service, a breach of Okta always comes with risks to other organizations, and the company confirmed that “certain Okta customers” were affected. Okta tells WIRED that it notified “around 1 percent” of its 18,400 customers that they were impacted.

The password manager 1Password, an Okta customer, said this week that it had notified the company on September 29 of suspicious activity that ultimately was tied to the support system incident. BeyondTrust, another identity and access management firm and also an Okta customer, said last week that it had similarly flagged concerning behavior in its Okta administrator account and notified the company about the issue on October 2. Internet infrastructure company Cloudflare also said last week that it had detected a similar incident in its Okta systems on October 18 and notified the company as well.

Companies like Okta that provide crucial digital services to a large population of prominent customers are always going to be prime targets for attacks because they can serve as a sort of one-stop shop for hackers looking to compromise numerous organizations. And as tech giants like Microsoft have shown, some of these attacks may well lead to breaches even if the vast majority are blocked. The breach at Okta is particularly concerning because it shares many features with a security incident the company dealt with in 2022, in which attackers compromised a subprocessor that Okta had trusted to do customer support work.

“What I find surprising in this case is that, after the 2022 breach, you'd think Okta would be on high alert for any externally exposed systems or personnel who may be targeted—and yet something has happened again,” says Adam Chester, a senior security consultant at TrustedSec.

The latest incident directly affected Okta's internal customer support service rather than one provided by a third-party partner. In this case, attackers used stolen login credentials to compromise an Okta support account, and then leveraged this access to steal cookies and session tokens used to give customer support providers access to clients' systems for troubleshooting. With these access tokens, attackers could then compromise Okta customer accounts directly.

1Password, BeyondTrust, and Cloudflare all said that they were able to detect and block the intrusions before any of their own customers were affected, but they all highlighted the fact that they had notified Okta about the situation before Okta warned them—in some cases weeks before Okta's public disclosure.

“This is the second time Cloudflare has been impacted by a breach of Okta’s systems,” a group of Cloudflare engineers wrote on Friday. They went on to share a list of recommendations for how Okta can improve its security posture: “Take any report of compromise seriously and act immediately to limit damage. Provide timely, responsible disclosures to your customers when you identify that a breach of your systems has affected them. Require hardware keys to protect all systems, including third-party support providers.”

The Cloudflare engineers added that they view taking protective steps like these as “table stakes” for a company like Okta that provides such crucial security services to so many organizations.

When WIRED asked Okta a series of questions about what steps it is taking to improve customer service defenses in the wake of the two breaches, and why there appears to be a lack of urgency when the company receives reports of potential incidents, the company declined to comment. A spokesperson said it would share more information about these subjects soon.

“I really want to know what technical controls Okta had implemented following the 2022 breach, and why this time will be different,” says Evan Johnson, cofounder of RunReveal, which develops a system visibility and incident detection tool. “My hunch is they did not roll out hardware security keys, or didn’t roll them out for their contractors doing support.”

Jake Williams, a former US National Security Agency hacker and current faculty member at the Institute for Applied Network Security, emphasizes that “the issue is bigger than Okta,” noting that software supply chain attacks and the volume of hacks companies must defend against is significant. “It's unfortunately common for service providers of any size to have trouble believing they are the source of an incident until definitive proof is offered,” he says.

Still, Williams adds, “there's a pattern here with Okta, and it involves outsourced support.” He also notes that one of the remediations Okta suggested to customers in the wake of the recent incident—carefully removing support session tokens that could be compromised from troubleshooting data—is not realistic.

“Okta's suggestion—that somehow the customer must be responsible for stripping session tokens from the files they specifically request for troubleshooting purposes—is absurd,” he says. “That's like handing a knife to a toddler and then blaming the toddler for bleeding.”

Source

Wired