Plus: Mozilla patches 10 Firefox bugs, Cisco fixes a vulnerability with a rare maximum severity score, and SAP releases updates to stamp out three highly critical flaws.

Fall is here, but hot zero-day summer shows no signs of cooling down, with the likes of Apple, Microsoft, and Google fixing flaws being used in real-life attacks.

Some major enterprise fixes were released during the month, including a Cisco patch for a vulnerability with a maximum CVSS score of 10.

Spyware has been a prominent trend over the past couple of months, and it’s a threat everyone should take seriously. Attacks can reach devices without any interaction from the user, so it’s important to keep your operating system up to date.

Here’s everything you need to know about the patches issued in September.

Apple iOS and iPad OS

Apple didn’t release any security updates in August, but the iPhone maker sure made up for it in September. First came iOS 16.6.1, an emergency security update released on September 9 to fix two flaws already being used in so-called “zero-click” attacks.

Reported by researchers at the University of Toronto’s Citizen Lab, the vulnerabilities were used to plant spyware via attachments containing malicious images in an iMessage, in an attack the researchers called BLASTPASS.

In mid-September, Apple released its major software upgrade, iOS 17, followed by iOS 17.0.1 a few days later. The surprise iOS 17.0.1 upgrade was important because it fixed another three iPhone flaws being used in spyware attacks.

Tracked as CVE-2023-41992 and reported by security researchers at Citizen Lab and Google, the first issue is a flaw in the kernel that could allow an attacker to escalate privileges. The other two vulnerabilities in WebKit and Security could potentially be chained together to take over a user’s device.

The flaws patched in iOS 17.0.1 were also fixed in the iOS 16.7 release for users of older iPhones or people who don’t want to upgrade to the latest software.

At the end of September, Apple released iOS 17.0.2 to fix some early iOS 17 bugs, and this is the latest version of the software, as of publication.

Apple has also released macOS Sonoma 14 to fix over 60 vulnerabilities.

Google Android

September was a big security month for Google’s Android users, with the monthly patch fixing 33 flaws, including one already being used in attacks. Tracked as CVE-2023-35674, the vulnerability in the framework could allow an adversary to elevate privileges without any interaction from the user. “There are indications that CVE-2023-35674 may be under limited, targeted exploitation,” Google said in its Android Security Bulletin.

Another severe issue is a critical security vulnerability in the system component that could lead to remote code execution with no additional execution privileges needed.

The Android security update has already reached Google’s own Pixel devices as well as Samsung devices, including the Galaxy S23 and S22 series.

Google Chrome

At the end of September, Google updated its Chrome browser after fixing 10 vulnerabilities, one of which was already being exploited by adversaries. Tracked as CVE-2023-5217 and rated as having a high impact, the already-exploited bug is a heap buffer overflow flaw in vp8 encoding in libvpx. “Google is aware that an exploit for CVE-2023-5217 exists in the wild,” the software giant said in an advisory.

The flaw was used in targeted spyware attacks, Google security researcher Maddie Stone later confirmed on Twitter.

Earlier in the month, Google fixed another zero-day flaw, a heap buffer overflow issue initially tracked as CVE-2023-4863, which it thought impacted only the Chrome browser. But two weeks after fixing the issue, researchers discovered it was worse than they thought, affecting the widely-used libwebp image library for rendering images in the WebP format.

Now tracked as CVE-2023-5129, it is thought the bug impacts every application that uses the libwebp library to process WebP images. “The scope of this vulnerability is much wider than initially assumed, affecting millions of different applications worldwide,” security firm Rezilion wrote in a blog.

The security outfit also thinks it is “highly likely” that the underlying issue in the libwebp library is the same issue resulting in CVE-2023-41064—one of the Apple flaws used as part of the BLASTPASS exploit chain to deploy the NSO Group’s Pegasus spyware.

Microsoft

Microsoft’s September Patch Tuesday is one to remember, as it fixed around 65 flaws, two of which are already being exploited by attackers. Tracked as CVE-2023-36761, the first is a Microsoft Word information disclosure vulnerability that could allow NTLM hashes to be exposed.

The second and most severe flaw is a privilege-escalation vulnerability in Microsoft Streaming Service Proxy tracked as CVE-2023-36802. An attacker who successfully exploited this vulnerability could gain system privileges, Microsoft said, adding that exploitation of the flaw has been detected.

Both flaws are marked as important, so it’s a good idea to update your devices as soon as you can.

Mozilla Firefox

Firefox has had a hectic month after Mozilla fixed 10 flaws in its privacy-conscious browser. CVE-2023-5168 is an out-of-bounds write bug in FilterNodeD2D1 affecting Firefox on Windows, rated as having a high impact.

CVE-2023-5170 is a flaw that could result in memory leak from a privileged process. This could be used to effect a sandbox escape if the correct data was leaked, Firefox owner Mozilla said in an advisory.

Meanwhile, CVE-2023-5176 covers memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

Cisco

At the start of the month, Cisco issued a patch for a vulnerability in the single sign-on implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform that could allow an unauthenticated, remote attacker to forge credentials to access an affected system. Tracked as CVE-2023-20238, the flaw has been given a maximum CVSS score of 10.

Also this month, Cisco patched a zero-day in Adaptive Security Appliance and Firepower Threat Defense software already exploited in Akira ransomware attacks. Tracked as CVE-2023-20269 and with a medium severity CVSS score of 5, the vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute-force attack to identify valid username and password combinations.

SAP

Enterprise software firm SAP has issued several important fixes as part of its September Security Patch Day. This includes a patch for CVE-2023-40622, an information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform with a CVSS score of 9.9. “A successful exploit provides information that can be used in subsequent attacks, leading to a complete compromise of the application,” security firm Onapsis said.

CVE-2023-40309 is a missing authorization check issue in SAP CommonCryptoLib with a CVSS score of 9.8. The flaw can result in an escalation of privileges and in the worst case, attackers can compromise the affected application completely, Onapsis said.

Meanwhile, CVE-2023-42472 is an insufficient file type validation flaw in SAP BusinessObjects Business Intelligence Platform with a CVSS score of 8.7.

Apple, Microsoft, and Google Just Fixed Multiple Zero-Day Flaws

A civil liberties group has asked the DOJ to investigate deployment of the ShotSpotter gunfire-detection system, which research shows is often installed in predominantly Black neighborhoods.

The United States Justice Department (DOJ) is being asked to investigate whether a gunshot-detection system widely in use across the US is being selectively deployed to justify the over-policing of mainly Black neighborhoods, as critics of the technology claim.

Attorneys for the nonprofit Electronic Privacy Information Center—a leading US-based civil liberties group—argue that “substantial evidence” suggests American cities are disproportionately deploying an acoustic tool known as ShotSpotter in majority-minority neighborhoods. Citing past studies, EPIC alleges that data derived from these sensors has encouraged some police departments to spend more and more time patrolling areas where the fewest number of white residents live—an allegation disputed by SoundThinking, the system’s manufacturer.

In a letter today to Merrick Garland, the US attorney general, attorneys for EPIC call for an investigation into whether cities using ShotSpotter are running afoul of the Civil Rights Act—namely, Title VI, which forbids racial discrimination by anyone who receives federal funds.

“State and local police departments around the country have used federal financial assistance to facilitate the purchase of a slew of surveillance and automated decision-making technologies, including ShotSpotter,” EPIC says. Despite mounting evidence of ShotSpotter’s discriminatory impact, there is no indication that its Title VI compliance has ever been seriously assessed. 

A spokesperson for SoundThinking says a statement by the company is forthcoming.

ShotSpotter has been deployed in more than 150 cities in the US, according to the company. It relies on internet-connected acoustic sensors, often attached to utility poles, and aims to detect gunfire using machine algorithms. SoundThinking says “acoustic experts” are on staff around the clock to review alerts and “ensure and confirm that the events are indeed gunfire.” The company claims its sensors have a 97 percent accuracy rate, disputing reports that alerts triggered by fireworks and other high-impact sounds affect the system’s accuracy.

EPIC is urging the DOJ to consider research that suggests ShotSpotter has produced “tens of thousands of false alerts” while simultaneously being deployed “in predominantly Black neighborhoods.” One such study, launched by the city of Chicago’s inspector general in 2021, noted that the “frequency of ShotSpotter alerts in a given area may be substantively changing policing behavior.” The agency concluded that, despite the city’s investment of $23-33 million, ShotSpotter alerts “rarely produce evidence of a gun-related crime, rarely give rise to investigatory stops, and even less frequently lead to the recovery of gun crime-related evidence during an investigatory stop.”

News investigations in Ohio and Texas have similarly raised doubts about the system's effectiveness, revealing that in some cases its alerts have delayed responses to 911 calls. Working to expand the use of ShotSpotter in Houston in late 2020, the city also green-lit a pilot program that saw sensors deployed across two areas where communities are between 80 and 95 percent people of color.

EPIC is pressing Garland to investigate whether local law enforcement agencies have used federal grant money to buy ShotSpotter, and if so, ascertain whether those grants conformed with Title VI. Moreover, EPIC is seeking new guidelines for funding systems designed to automate police work: rules to ensure such arrangements are “transparent, accountable, and nondiscriminatory.” The attorney general should take additional steps, EPIC says, to ensure agencies dispersing federal funds are careful to assess whether tech companies meet “minimum standards of nondiscrimination” and that new police technologies are not only justified but necessary to achieve a “defined goal.”

The attorney general’s office did not immediately respond to a request for comment.

Ron Wyden, a leading privacy hawk in the US Senate, tells WIRED that he planned to urge Garland to adopt EPIC’s recommendations.

“There is more than enough evidence at this point to conclude that technologies like ShotSpotter do essentially nothing to stop crime,” Wyden says, “but instead have a well-documented discriminatory impact on marginalized and vulnerable communities.”

A spokesperson for SoundThinking told WIRED earlier this week that ShotSpotter has previously implemented safeguards meant to improve “impartiality” with regard to patrols, as well as other features designed to curb over-policing. The algorithms that drive patrol recommendations use “objective, noncrime data that mitigates potential bias,” the company said, adding that no personally identifiable information is used to determine where patrols are sent.

WIRED reported yesterday that SoundThinking has been quietly acquiring parts of Geolitica—formerly known as PredPol—the maker of an eponymous “predictive policing” tool. Researchers and critics have accused PredPol of perpetuating racial biases in policing by recycling historic crime data that was built on discriminatory police practices.

The danger, critics say, is that data- and AI-driven policing may prove an effective tool for “laundering” racist police conduct, granting it a veneer of scientific authority.

In 2021, Gizmodo and The Markup coauthored an investigation into PredPol and found that in many cases PredPol’s predictions predominantly targeted Black and Latinx residents. In a majority of the jurisdictions where the tool was being used, PredPol had urged police to mainly patrol neighborhoods in which the cities’ poorest people reside. ( The authors of this story were also members of the team that previously investigated PredPol, and EPIC cites the investigation and another Gizmodo report by an author of this story in its letter.)

“The possibility that ShotSpotter data would be an input for predictive policing tools raises yet another huge red flag,” says Chris Baumohl, an EPIC law fellow. “ShotSpotter has well-documented accuracy issues, and its sensors are placed based on historical crime data, baking in discriminatory policing patterns. Laundering this ‘dirty data’ through predictive policing tools only compounds this discriminatory impact.”

Following the Gizmodo-Markup investigation into PredPol, the Justice Department conceded in 2022 that it was unaware of how often the government was helping local police acquire “predictive policing” technology. For this purpose, it said, the DOJ has no “specific records” of how federal funding is used.

US Justice Department Urged to Investigate Gunshot Detector Purchases

SoundThinking is purchasing parts of Geolitica, the company that created PredPol. Experts say the acquisition marks a new era of companies dictating how police operate.

SoundThinking, the company behind the gunshot-detection system ShotSpotter, is quietly acquiring staff, patents, and customers of the firm that created the notorious predictive policing software PredPol, WIRED has learned.

In an August earnings call, SoundThinking CEO Ralph Clark announced to investors that the company was negotiating an agreement to acquire parts of Geolitica—formerly called PredPol—and transition its customers to SoundThinking’s own “patrol management” solution.

“We have already hired their engineering team,” Clark said during the call, a transcript of which is public. He added that the acquisition of patents and staff would “facilitate our application of AI and machine learning technology to public safety.”

SoundThinking’s absorption of Geolitica marks its latest step in becoming the Google of crime fighting—a one-stop shop for policing tools. Experts who study law enforcement use of technology say the bundling of two controversial technologies signals a new era for the cop-tech industry and has the potential to shape the future of policing in the United States. And while SoundThinking has rebranded “predictive policing” as resource management for police departments, a WIRED analysis of one of the company’s apps found that crime-forecasting technology remains one of its key offerings.

“As a moment of tech history, the purchase is significant,” Andrew Ferguson, an American University law professor and author of _The Rise of Big Data Policing_, tells WIRED. “We are in a consolidation moment with big police tech companies getting bigger, and this move is one step in that process.”

PredPol was one of the first, and perhaps the most widely used, predictive policing algorithms in the United States. Its name, a portmanteau of “predictive policing,” became synonymous with the practice.

The software was developed in 2011 and uses historical crime incident reports to produce daily predictions for where future crime is likely to occur. For years, critics and academics have argued that since the PredPol algorithm relies on historical and unreliable crime data, it reproduces and reinforces biased policing patterns. In December 2021, Gizmodo and The Markup analyzed millions of Geolitica’s crime predictions that were discovered on an unsecured server and found that the software disproportionately—and often relentlessly—targeted low-income communities of color for additional patrols.

In recent years, police departments have dropped PredPol after ultimately finding it ineffective. In 2019, a report by the Los Angeles Police Department’s inspector general found that it was unclear whether PredPol had any effect on crime trends. The LAPD, which was the earliest adopter of PredPol, and had even partnered with researchers to develop the technology, dropped the product in 2020, citing budget costs.

Brian MacDonald, the CEO of Geolitica, declined an interview and did not answer specific questions about the acquisitions. A third-party spokesperson for SoundThinking, Rob Merritt, tells WIRED that Geolitica is ceasing operations at the end of the year.

Consolidation Game

Founded in 1996, SoundThinking is now worth around $232 million. Its flagship product, ShotSpotter, is a gunshot-detection system that uses microphones mounted on traffic signals and light poles to detect and locate possible gunfire sounds. For years, activists and academics around the US have fought against the expansion of ShotSpotter, claiming that it is not only inaccurate but is deployed disproportionately in non-white neighborhoods.

Two investigations by local media—_The Houston Chronicle_ and Southwest Ohio’s WYSO—found that ShotSpotter alerts largely resulted in dead ends for police and, in some cases, delayed response times for other calls for service. In 2021, the MacArthur Justice Center at the Northwestern University School of Law analyzed records kept by Chicago’s Office of Emergency Management and Communications over a two-year period and found that 89 percent of ShotSpotter alerts in the city did not lead to police finding evidence of a gun-related crime.

SoundThinking, Maker of ShotSpotter, Is Buying Parts of PredPol Creator Geolitica

Egged on by a far-reaching conservative media ecosystem, right-wing hardliners are forcing Washington to bend to their reality as the federal government careens toward a possible shutdown.

washington’s biggest problem these days isn’t partisanship. It’s that far-right lawmakers are living in their own reality.

Extremist Republicans have broken off from the rest of their party to create an alternate universe in which they’re in charge, empowered by Donald Trump’s followers. This disconnect is fueling an internal GOP fight in the US House of Representatives that has the federal government careening toward a shutdown at midnight on Sunday, October 1. As he claws and scrapes in an attempt to negotiate federal spending legislation, House Speaker Kevin McCarthy seems to be realizing that his rank-and-file Republicans now occupy a different universe than everyone else.

“This is a whole new concept of individuals that just want to burn the whole place down,” an exasperated McCarthy told the congressional press corps last week. “That doesn’t work.”

McCarthy’s far-right foes say their bomb-throwing ways are working. They’re being rewarded in kind. With the fifth slimmest majority in history, McCarthy can afford to lose only four GOP votes. If he reaches across the aisle, his speakership will likely be challenged. While his Republican agitators don’t have any replacement waiting in the wings, the speaker hasn’t dared negotiate with Democrats.

The meme-centric culture that swept former president Donald Trump into power is now increasingly mainstream in the Republican Party. On the surface, McCarthy’s struggle is to persuade an estimated seven to 10 conservatives to avert a government shutdown. In reality, the speaker’s battling against a nameless army of tens of thousands of angry antiestablishment voices whose frustrations have increasingly become Republican orthodoxy and mirrored by the powerhouses of conservative media—many of whom remain niche figures, even as they’re followed by hundreds of thousands of fans.

“We’re beyond the alt-right and the fringe-right. The fantasy-right is making policy,” former Virginia congressman Denver Riggleman tells WIRED. “It’s the fantasy-right. It is a cult. It is a religious belief system. It is a way of living. It’s that simple. It is the party.”

McCarthy’s paradox is the same one facing the Republican Party and America’s two-party system as a whole: Which reality does he govern in? While he campaigned for Speaker of the House with Trump’s backing, will he—can he—govern from Planet Trump? Like all party leaders who preceded him, McCarthy is tasked with leading a diverse, divided, yet ultimately _United_ States. That’s dismissed as “normie” nonsense in Trump’s angry, amped, and very online GOP. A few of Trump’s biggest supporters in Congress, some of which have more social media followers than the speaker himself, are demanding McCarthy embrace their new minority-rule vision for America.

Under Trump, the far-right Freedom Caucus proved loyal lieutenants who held the line for his border wall funding for 34 days on Capitol Hill. That period stretched from the waning days of Paul Ryan’s speakership in December 2018 through the kickoff of Nancy Pelosi’s second act as speaker in January 2019—and holds the dubious record as the US’s longest shutdown in history. It ended without Trump getting his wall. But the former president has also remade the Republican Party in his own image, one that party leaders have tried to mirror, remaking themselves in the process. Since recapturing the House, Trump’s ranks of loyal soldiers in Congress have expanded. Still a relatively small band, they’re emboldened now, especially since Trump indictments stacked up this summer.

“Congress is in charge of money and everything for the government, and Congress should be in charge of funding special counsels. Those are my red lines,” Marjorie Taylor Greene, the Georgia Republican, told a group of congressional reporters.

Greene’s other top demand is impeaching President Joe Biden. McCarthy has already launched an inquiry. With Trump polling popularly in the GOP, McCarthy and other Republican leaders continue to float along as the party moves rightward.

“It’s polling. They’re willing to absolutely destroy their own integrity \[and\] have no moral baseline in order to spout cross-tabs from a poll,” says Riggleman, a former member of the Freedom Caucus.

McCarthy’s been trying to negotiate around the impasse using the traditional means of persuasion and promises. He may be negotiating with the wrong people, though, because today’s rank-and-file serve different masters. These days, what was once confined to 4chan has become normalized in the GOP, with some elected officials on the new right seemingly fine with torching the party as the internet has demanded. Social media screens have come to life on Capitol Hill in part because MAGAism is now packaged as a lifestyle.

There are right-wing alternatives to seemingly everything. Patriot Mobile boasts being “America's only Christian conservative wireless provider.” Tusk Search is an alternative to Google, labeling itself a “free speech web browser with \[an\] anti-censorship newsfeed.” Public Square directs conservatives to “patriotic businesses” and has become the go-to app for Republicans like Donald Trump Jr., who also launched MxM News, an alternative news aggregator for Republicans, earlier this year. The Right Stuff, a dating app, aims to Make Conservatives Sexy Again. Owning the libs, and the establishment, has morphed into an identity.

Those ventures are all pushed by the stars of today’s new conservative media universe, which includes the likes of anti-politically-correct online spaces, like Truth Social, Rumble, and Parlor. Elon Musk’s makeover of Twitter (now X) into his personal selective-free-speech-absolutist site has made it feel like a safe place for many of those who used to hide in the shadows.

Over the weekend, former Trump strategist Steve Bannon had Colorado congresswoman Lauren Boebert on his show _War Room_, which now airs live on Newsmax, and thanked his audience for empowering her and other Freedom Caucus members during their time on Capitol Hill.

“You are also part of this fight. You’re just not some passive person listening to talk radio or watching some TV or streaming,” Bannon encouraged his audience. “No, you’re actually part of this, and we know you are because you’re kind of the driving force in this. You’re the protagonist, this audience.”

With a supportive audience outside of Washington, DC, Boebert’s not looking for ways to help her party while she’s there. That was on display when she and other Freedom Caucus members held out their support for McCarthy’s speakership in January, gleefully turning the routine start of a Congress into a 15-round slugfest that ended with them obtaining a myriad of McCarthy promises—from a vote on term limits to releasing the January 6, 2021, Capitol footage publicly. The demands have only expanded since then.

“We were called domestic terrorists by members of our own party, simply by wanting reforms in Congress,” Boebert told Bannon. “No one likes the way Congress operates, and so my colleagues and I took a stand—a 15-round stand—to make fundamental historic changes to the way this place operates, and right now we are at the breaking point on one of those promises that we said needed to be kept.”

What “reality” means on the right largely depends on which social and media ecosystems one inhabits, even as the party is more unified than ever in its anti-Biden fever.

If you tuned in to most Fox News shows last week, the government funding battle probably seemed like an afterthought, if it made the cut at all. Instead, viewers were bombarded with stories of an “invasion” at the southern border.

Some Fox News hosts like Sean Hannity are pro-shutdown. “Take a stand,” he encouraged House Republicans on his radio show on September 19, while others, like host Laura Ingraham, make taking a stand against Biden and Senate majority leader Chuck Schumer the only moral option. As Ingraham casually told viewers last week, Democrats “hate America so much—our tradition, our history, our culture—that they prefer to start over with millions of poor migrants.”

The rightward shift has been decades in the making. Former congressman Tom Davis, a Republican from northern Virginia, was first sent to Washington in 1995. Then-speaker Newt Gingrich and the GOP had just recaptured the House for the first time in 40 years. “You didn’t even have Fox in 1995. It has fragmented everything. You’re in a world now where bad behavior gets rewarded, where Marjorie Taylor Greene raises more money than a committee chairman because she raises it online,” Davis tells WIRED. “That’s the problem, and it makes governance very hard.”

Republicans also controlled the Senate in 1995. The party was itching for a fight then, after having endured a political drought that stretched from 1955 through 1995. “It was unified at that point,” Davis says. “Everybody wanted the same thing, and Republicans decided to stay together, and that’s how we were.”

The tides turn quickly in today’s GOP. After he officiated a former staffer’s same-sex marriage, Riggleman, the libertarian-leaning former Freedom Caucus member from Virginia, lost his seat in a nationalized local primary that overflowed with distortions and lies. The vitriol was fueled, in part, by QAnon, whose members targeted Riggleman after he spoke out against far-right conspiracy theorists.

“Disinformation has a better return on investment than any other data-specific type of activity. I think it’s massive,” Riggleman says. “I experienced it. I mean, if you think about what happened to me, they won. QAnon beat me … Bad guys win, and they don’t think they’re the bad guys.”

A former US intelligence official, Riggleman was tapped by the special January 6 committee to be a senior technical adviser, helping to scour the recesses of the dark (and not-so-dark) web for any digital chatter the FBI might have missed in the lead-up to the attack on the Capitol. He has since launched the Riggleman Information and Intelligence Group, which advertises itself as a “boutique firm specializing in open source intelligence and e-discovery.”

One of Riggleman’s first clients was Hunter Biden, the president’s legally beleaguered son, whose team sought Riggleman’s services because they wanted to understand where the unrelenting streams of digital accusations, threats, memes, and falsehoods were coming from. Many of the same accounts hammering Hunter Biden have been encouraging this small band of House Republicans to go to war with their own party leaders.

“These people are nuts,” Riggleman says. “And, by the way, crazy has more energy than sanity.”

After losing his seat and watching the Capitol be overrun on January 6, Riggleman says there’s no time for passivity and patience.

“You need to go after the disinformation, and you need to have people brave enough to call it out,” Riggleman says. “Because I don't want to get rid of the First Amendment, but if people are using the First Amendment for danger, weaponization, and stupidity, the people who are sane need to use their First Amendment \[rights\] as a wrecking ball. You gotta destroy these people.”

Risk of a US Government Shutdown Is Fueled by Very Online Republicans

As civil conflict continues in and above the streets of Khartoum, satellite images from the Conflict Observatory at Yale University have captured the catastrophic damage.

On Thursday, the head of the Sudanese Army, Abdel Fattah al-Burhan, addressed the United Nations General Assembly in New York City, asking for increased aid from the international community for Sudan and condemning the paramilitary groups that he says “have killed, looted, raped, robbed, and seized citizens’ homes and properties, and destroyed infrastructure and government buildings.” Since April, the country has been gripped by a civil conflict between the government and the Rapid Support Forces (RSF), a rebel group backed by the Russian mercenary company, the Wagner Group. At the beginning of the week, ahead of the General Assembly, a group of 50 human rights and humanitarian organizations published an open letter urgently calling for the UN Security Council to address the crisis in Sudan.

A new report from the Conflict Observatory at Yale University has used satellite imagery and open source investigative tools to chart the catastrophic damage caused by fighting in the capital city of Khartoum. Open source imagery has been particularly hard to come by in Sudan, due in part to power and telecom blackouts, which makes it hard to assess the full extent of the damage caused by the conflict.

The Conflict Observatory, a US-government-backed initiative between Yale University’s Humanitarian Research Lab, the Smithsonian Cultural Rescue Initiative, PlanetScape AI, and the mapping software Esri, has identified at least five explosions that took place within the city, including attacks that damaged a market and a hospital and which researchers estimate have left hundreds of people dead. At least one of the explosions—the attack on the market—was most likely caused by a drone strike.

Photograph: Maxar Technologies

Government forces have acquired Turkish Bayraktar drones, while the RSF has been using commercial unmanned aerial vehicles (UAVs) likely sourced from Russia, according to Nathaniel Raymond, a coleader of the Humanitarian Research Lab and lecturer at Yale’s Jackson School of Global Affairs.

“Welcome to the new world order,” says Raymond. “All conflicts are now shaped by the use of UAVs by state and nonstate actors.”

Most of the aerial strike damage that the Conflict Observatory found appears to have been attributed to the Sudanese Armed Forces (SAF), though both sides have released statements accusing the other of attacks on various locations. The RSF, headed by Mohamed Hamdan Daglo, known as Hemedit, has also been receiving weapons, including drones, from Wagner for months. The mercenary group has forces stationed across the border in eastern Libya. Though technically a private company, Wagner has been an integral part of Russia’s assertion of military and foreign power overseas, particularly in Africa. A recent convoy carrying Russian weapons to the RSF crossed into Sudan via Chad on September 6.

Violence has been steadily worsening in Sudan since April, when negotiations meant to return the government to civilian rule broke down. Al-Burhan has been the country’s de facto ruler since a coup in 2021, following the ouster of the country’s president Omar al-Bashir in 2019. A key tension point was around whether and how quickly the RSF’s 100,000-person force would be absorbed into the Sudanese military. On April 15, the RSF launched an assault on Khartoum. Fighting escalated in Khartoum on September 16, with images of the city’s Greater Nile Petroleum Oil Company Tower skyscraper engulfed in flames circulating widely on X (formerly known as Twitter). But Raymond says that the attacks also seem to have hit two Ministry of Justice buildings, including the headquarters of the Internal Security Services.

Photograph: Maxar Technologies

“The fighting in Khartoum has significantly escalated, including indiscriminate bombardment,” says Raymond, who adds that drones have become “increasingly part of SAF’s element” and notes an official transfer of Turkish Bayraktars to the SAF. The human cost of the brutal conflict has only increased as more of the fighting—including airstrikes—has taken place in densely populated areas. The report estimates that at least 2,875,125 civilians from Khartoum State are now displaced.

Data from Action on Armed Violence (AOAV), a UK-based nonprofit that tracks armed violence against civilians around the world, found that markets and residential areas were particularly likely to be affected by explosive air strikes.

“The IED that haunted the battlefields of Afghanistan, Iraq, and Syria is now becoming airborne,” says Iain Overton, executive director at AOAV.

“When you begin to use … whether it’s Turkish drones or other aerial assaults that are promised in the halls of arms as being precise and proportionate, the end result is imprecision and disproportionate,” says Overton. “These weapons are then sold to militaries and groups that often have very poor human rights records in the first place. And then they go and use them in some scenarios that almost invariably will cause civilian casualties.”

Satellite Images Show the Devastating Cost of Sudan’s Aerial War

Corporations are using software to monitor employees on a large scale. Some experts fear the data these tools collect could be used to automate people out of their jobs.

You’ve probably heard the story: A young buck comes into a new job full of confidence, and the weathered older worker has to show them the ropes—only to find out they’ll be unemployed once the new employee is up to speed. This has been happening among humans for a long time—but it may soon start happening between humans and artificial intelligence.

Countless headlines over the years have warned that automation isn’t just coming for blue-collar jobs, but that AI would threaten scores of white-collar jobs as well. AI tools are becoming capable of automating tasks and sometimes entire jobs in the corporate world, especially when those jobs are repetitive and rely on processing data. This could affect everyone from workers at banks and insurance companies to paralegals and beyond.

Carl Frey, an economist at Oxford University, coauthored a landmark study in 2013 that claimed AI could threaten nearly 50 percent of US jobs in the coming decades. Frey says that he doesn’t think new AI tools like ChatGPT are going to automate jobs in this way because they still require human involvement and are often unreliable. Still, many of the underlying factors that were outlined in that paper remain pertinent today. Considering the rapid pace at which AI is advancing, it’s hard to predict how it could soon be utilized and what it will be capable of.

Then there’s the issue of how it’s being incorporated into daily work and how it’s being trained. Enter corporate spyware, invasive monitoring apps that allow bosses to keep close tabs on everything their employees are doing—collecting reams of data that could come into play here in interesting ways. Corporations, which are monitoring their employees on a large scale, are now having workers utilize AI tools more frequently, and many questions remain regarding how the many AI tools that are currently being developed are being trained.

Put all of this together and there’s the potential that companies could use data they’ve harvested from workers—by monitoring them and having them interact with AI that can learn from them—to develop new AI programs that could actually replace them. If your boss can figure out exactly how you do your job, and an AI program is learning from the data you’re producing, then eventually your boss might be able to just have the program do the job instead.

“When it comes to monitoring workflows, I do think that’s going to be a way we automate a lot of this stuff,” Frey says. “What you might be able to do is take some of those foundational models and train them on some of the data you have internally and fine-tune them, or you could train a model from scratch just with your internal data.”

David Autor, a professor of economics at MIT, says he also thinks AI could be trained in this way. While there is a lot of employee surveillance happening in the corporate world, and some of the data that’s collected from it could be used to help train AI programs, simply learning from how people are interacting with AI tools throughout the workday could help train those programs to replace workers.

“They will learn from the workflow in which they’re engaged,” Autor says. “Often people will be in the process of working with a tool, and the tool will be learning from that interaction.”

Whether you’re training an AI tool directly by interacting with it throughout the day, or the data you’re producing while you work is simply being used to create an AI program that can do the work you’re doing, there are multiple ways in which a worker could inadvertently end up training an AI program to replace them. Even if the program doesn’t end up being incredibly effective, a lot of companies might be happy with an AI program that’s good enough because it doesn’t require a salary and benefits.

“I think there are a lot of discretionary white-collar jobs where you’re kind of using a mixture of hard information and soft information and trying to make advanced decisions,” Autor says. “People aren’t that good at that, machines aren’t that good at that, but probably machines can be pretty much as good as people.”

Autor says he doesn’t see a “labor market apocalypse” coming. Many workers won’t be entirely replaced but will simply have their jobs changed by AI, Autor says, while some workers will certainly be made redundant by advancements in AI. The problem there, he says, is what happens to those workers after they’re no longer able to find a well-paying job with the education and skill sets they have.

“It’s not that we’re going to run out of work. It’s much more that people are doing something they’re good at, and that thing goes away. And then they end up doing a kind of generic activity that everybody’s good at, which means it pays very little—food service, cleaning, security, vehicle driving,” Autor says. “These are low-paying activities.”

Once someone’s automated out of a well-paying job, they can end up slipping through the cracks. Autor says we’ve seen this happen in the past.

“The hollowing out of manufacturing and office work over the past 40 years has definitely put downward pressure on the wages of people who would do that type of work, and it’s not because they’re doing it now at a lower rate of pay. It’s because they’re not doing it,” Autor says.

Frey says politicians will need to offer solutions to those who fall through the cracks to prevent the destabilization of the economy and society. That would likely include offering social safety net programs to those affected. Frey has written extensively on the effects of the first Industrial Revolution, and he says there are lessons to be learned there. In Britain, for example, there was a program called the Poor Laws, where people who were harmed by automation were given financial relief.

“What you see back then is a lot of social unrest. Wages are stagnant or falling for a large part of the population. You have riots,” Frey says. “If you look at the places where the Poor Laws were more generous, there was less social unrest and less upheaval. Using welfare systems to compensate people who lose out is something we’ve done for a long time and should continue to do.”

Many people would also benefit from being retrained for other work, but Autor says the US has never been very good at retraining people, so there’d have to be some work done to create effective retraining programs. He says technology might actually be able to help there because people could be retrained using helpful new digital tools.

There was a lot of hype surrounding ChatGPT and similar AI tools when they came out. That hype has since died down a bit, suggesting to some that maybe these tools won’t be as useful as they were promised to be. Perhaps they won’t be taking everybody’s jobs. However, at the rate at which AI is advancing, there’s no saying where things could be in five to 10 years—or even next year.

Vincent Conitzer, a professor of computer science at Carnegie Mellon University, says people shouldn’t underestimate what these AI tools may soon be capable of. They may be somewhat limited in their use now, but that could change relatively rapidly and end up being as disruptive as some have warned it could be.

“I worry about this being a ‘boiling frog’ kind of scenario, where we see amazing advances in AI but then don’t immediately see them take over people’s jobs, and \[people\] conclude there wasn’t all that much to worry about, and we accept the new technology as the new normal but not all that impressive after all,” Conitzer says. “Meanwhile, gradually but quickly, the world and the job market do adjust to the new technologies in complex ways, and at some point we realize large societal problems have emerged.”

Your Boss’s Spyware Could Train AI to Replace You

With the number of internet blackouts on the rise, cybersecurity firm eQualitie figured out how to hide censored online news in satellite TV signals.

All over the world, walls are going up around the internet.

For years, autocratic regimes have been in a race to heighten those walls, as their citizens develop taller and taller ladders. The more they filter and block, the more their citizens come up with clever technical solutions to access the uncensored truth. There is mounting evidence, however, that repressive regimes are opting to just shut down access to the open internet entirely—and that such blackouts could become permanent.

A team of cybersecurity researchers believe they have come up with a clever new way to fight back: a trojan horse. Specifically, a satellite feed designed to look like a television station, which actually carries a payload of uncensored news and information. It’s a particularly retro solution to a very modern problem.

The program, dubbed eQsat, has been tested and is ready to be put into action during the next internet shutdown—whether it’s in Russian-occupied Ukraine, Iran, or one of the many repressive regimes that regularly block internet access.

The cybersecurity firm behind the program, eQualitie, has spent years developing tools designed for civil society in countries with aggressive internet filtering. Its mobile browser, Ceno, connects users to the open internet and serves content peer-to-peer. When a particular website is blocked or throttled, Ceno grabs a copy of the website supplied by another user who can access the site normally.

Ceno’s weakness—like all peer-to-peer services—is that it still requires some connection to the outside world to deliver blocked content. During a total shutdown, Ceno’s peer-to-peer connections are severed as well.

There are some unreliable solutions to this problem. In some cases, mobile internet or Wi-Fi can be broadcast into an area experiencing an internet shutdown—there have been plans to try to broadcast a cellular or Wi-Fi signal from Finland into Russia, for example. In North Korea, balloons with USB keys attached bring news and entertainment into one of the most heavily censored countries in the world.

But cell signals can be jammed, Starlink terminals can be triangulated, and balloons can be intercepted. The best way to deliver information into a closed country without being caught or thwarted, Jason Roks tells WIRED, is steganography: the act of camouflaging information inside another message. And eQsat is the answer to the question “How do you blend in the most?”

Roks and the team at eQualitie rented space on commercial satellites and began broadcasting their own television channel to countless home satellite receivers throughout Asia and Africa. But should anyone be flipping through the channels, the eQualitie station will be static or color bars. Anyone who records the channel to a USB key, however, would discover that one of the audio tracks is, in fact, a compressed file. Extracted on a computer, it reveals a wealth of information.

“So this is a mechanism we developed to replenish from the outside,” Roks says. “We partnered with dozens of news organizations to, basically, take a snapshot of their websites and—very much like Internet Archive, the Wayback Machine—we keep a version of their site. And we update them daily, quarterly, whatever that basis is. And that works out to about, all those sites for Russia and Ukraine, about a gig and a half of data.” That data, once extracted, can be fed into the BitTorrent network, and can update the cache for their Ceno browser.

A Tricky New Way to Sneak Past Repressive Internet Censorship

Plus: MGM hackers hit more than just casinos, Microsoft researchers accidentally leak terabytes of data, and China goes on the PR offensive over cyberespionage.

Mandiant researchers published findings this week about a newly revealed Chinese espionage operation that used Sogu malware to spy on the African operations of both European and US organizations. The campaign is significant for the scope of its victims, but also because attackers used a classic malware distribution method: thumb drives. The attacks are the latest example of China's aggressive global espionage—but read on for statements from the Chinese government about alleged US cyberattacks and digital espionage.

After Elon Musk claimed recently that primates used in Neuralink implant research were close to death anyway, a WIRED investigation this week revealed grisly details about the truth of their deaths that appear to dispute the characterization that the animals were all terminally ill. The revelations come as Neuralink is pursuing human trials of its brain-chip implants. 

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

Kia and Hyundai cars have been plagued for years by vulnerabilities—and simply missing protective features—in their antitheft systems that make the cars far too easy to steal. Recently, the companies have been attempting to distribute updates to remedy the situation, but the flaws have already resulted in skyrocketing car theft rates around the United States. New data from 10 US cities compiled by Motherboard through public records requests illustrate the extent of the problem. In Chicago, for example, average car theft rates of about 850 per month are now consistently up to more than 2,000 per month. Similarly, before 2021, rates in Denver used to hover around 800 stolen cars per month. They now typically top 1,000. Atlanta's car theft rates have doubled from their old level before 2022 of fewer than 250 incidents per month. 

“Stolen car rates are not up by 10 percent, or 20 percent, or even 50 percent,” the report says. “In many cities, they are up hundreds of percentage points, Motherboard has found. Rates of stolen Kias and Hyundais in particular are up thousands of percentage points.”

Over the past two weeks, MGM Resorts has been dealing with the very public fallout of a recent cyberattack. Caesars Entertainment also admitted last week that it recently suffered a data breach and faced criminal extortion demands. Adding to the larger context, an executive for the enterprise identity management firm Okta said this week that the same gang that targeted MGM and Caesars, known as Alphv, also hacked three other targets since August as part of the same spree.

That makes five Okta customers in total that were affected. David Bradbury, Okta's chief security officer, would not name the other three victims but said they are in the technology, retail, and manufacturing sectors. Bradbury said Okta is cooperating with law enforcement investigations into the hacks.

Wiz security firm published findings this week that Microsoft AI researchers unintentionally exposed 38 terabytes of private data on the developer platform GitHub while attempting to open-source a repository of training data. The leak included internal Microsoft data, including more than 30,000 Teams messages, passwords, and private keys. The exposure occurred because of a misconfiguration in how the researchers used an Azure Storage data-sharing feature.

This week, officials from China's Ministry of State Security publicly accused the US government of breaching and monitoring Huawei's networks in a 2009 espionage attack. The statement also alleges that the US has conducted “tens of thousands of malicious network attacks” on Chinese institutions and organizations to surveil networks and steal data. Furthermore, the officials claimed that the US government has planted backdoors in software and hardware produced around the world to enable global surveillance. China has accused the US of cyberespionage before—and certainly conducts its share of surveillance and data exfiltration operations. Meanwhile, Huawei has been a particular lightning rod in longtime disputes between the US and China about digital and technical security.

The Shocking Data on Kia and Hyundai Thefts in the US

Security researchers found USB-based Sogu espionage malware spreading within African operations of European and US firms.

For much of the cybersecurity industry, malware spread via USB drives represents the quaint hacker threat of the past decade—or the one before that. But a group of China-backed spies appears to have figured out that global organizations with staff in developing countries still keep one foot in the technological past, where thumb drives are passed around like business cards and internet cafés are far from extinct. Over the past year, those espionage-focused hackers have exploited this geographic time warp to bring retro USB malware back to dozens of victims’ networks.

At the mWise security conference today, researchers from cybersecurity firm Mandiant revealed that a China-linked hacker group they’re calling UNC53 has managed to hack at least 29 organizations around the world since the beginning of last year using the old-school approach of tricking their staff into plugging malware-infected USB drives into computers on their networks. While those victims span the United States, Europe, and Asia, Mandiant says many of the infections appear to originate from multinational organizations’ Africa-based operations, in countries including Egypt, Zimbabwe, Tanzania, Kenya, Ghana, and Madagascar. In some cases, the malware—in fact, several variants of a more than decade-old strain known as Sogu—appears to have traveled via USB stick from shared computers in print shops and internet cafés, indiscriminately infecting computers in a widespread data dragnet.

Mandiant researchers say the campaign represents a surprisingly effective revival of thumb drive-based hacking that has largely been replaced by more modern techniques, like phishing and remote exploitation of software vulnerabilities. “USB infections are back,” says Mandiant researcher Brendan McKeague. “In today’s globally distributed economy, an organization may be headquartered in Europe, but they have remote workers in regions of the world like Africa. In multiple instances, places like Ghana or Zimbabwe were the infection point for these USB-based intrusions.”

The malware Mandiant found, known as Sogu or sometimes Korplug or PlugX, has been used in non-USB forms by a broad array of largely China-based hacking groups for well over a decade. The remote-access trojan showed up, for instance, in China’s notorious breach of the US Office of Personnel Management in 2015, and the Cybersecurity and Infrastructure Security Agency warned about it being used again in a broad espionage campaign in 2017. But in January of 2022, Mandiant began to see new versions of the trojan repeatedly showing up in incident response investigations, and each time it traced those breaches to Sogu-infected USB thumb drives.

Since then, Mandiant has watched that USB-hacking campaign ramp up and infect new victims as recently as this month, stretching across consulting, marketing, engineering, construction, mining, education, banking, and pharmaceuticals, as well as government agencies. Mandiant found that in many cases the infection had been picked up from a shared computer at an internet café or print shop, spreading from machines like a publicly accessible internet-access terminal at the Robert Mugabe Airport in Harare, Zimbabwe. “That’s an interesting case if UNC53’s intended infection point is a place where people are traveling regionally throughout Africa or even possibly spreading this infection internationally outside of Africa,” says Mandiant researcher Ray Leong.

Leong notes that Mandiant couldn’t determine whether any such location was an intentional infection point or “just another stop along the way as this campaign was propagating throughout a particular region.” It also wasn’t entirely clear whether the hackers sought to use their access to a multinational’s operations in Africa to target the company’s European or US operations. In some cases at least, it appeared that the spies were focused on the African operations themselves, given China’s strategic and economic interest in the continent.

The new Sogu campaign’s method of spreading USB infections might seem a particularly indiscriminate way to conduct espionage. But, like the software supply chain attacks or watering hole attacks that Chinese state-sponsored spies have repeatedly carried out, this approach may allow the hackers to cast a wide net and sort through their victims for specific high-value targets, McKeague and Leong suggest. They also argue that it means the hackers behind the campaign likely have significant human resources to “sort and triage” the data they steal from those victims to find useful intelligence.

The Sogu USB malware uses a series of simple but clever tricks to infect machines and steal their data, including in some cases even accessing “air-gapped” computers with no internet connection. When an infected USB drive is inserted into a system, it doesn’t automatically run, given that most modern Windows machines have autorun disabled by default for USB devices. Instead, it tries to trick users into running an executable file on the drive by naming that file after the drive itself or, if the drive has no name, the more generic “removable media”—a ruse designed to fool the user into unthinkingly clicking the file when they attempt to open the drive. The Sogu malware then copies itself onto a hidden folder on the machine.

On a normal internet-connected computer, the malware beacons to a command-and-control server, then starts accepting commands to search the victim machine or upload its data to that remote server. It also copies itself to any other USB drive inserted into the PC to continue its machine-to-machine spread. If one variant of the Sogu USB malware instead finds itself on an air-gapped computer, it first attempts to turn on the victim’s Wi-Fi adapter and connect to local networks. If that fails, it puts stolen data in a folder on the infected USB drive itself, storing it there until it’s plugged into an internet-connected machine where the stolen data can be sent to the command-and-control server.

Sogu’s focus on espionage and the relatively high number of USB-based infections is a rare sight in 2023. Its USB propagation is more reminiscent of tools like the NSA-created Flame malware that was discovered targeting air-gapped systems in 2012, or even the Russian Agent.btz malware that was found inside Pentagon networks in 2008.

Surprisingly, however, the Sogu campaign is just part of a broader resurgence of USB malware that Mandiant has spotted in recent years, the researchers say. In 2022, for instance, they saw a massive spike in infections from a piece of cybercrime-focused USB malware known as Raspberry Robin. And just this year, they spotted another strain of USB-based espionage malware known as Snowydrive being used in seven network intrusions.

All of this, McKeague and Leong argue, means that network defenders shouldn’t fool themselves into thinking that USB infections are a solved problem—particularly in global networks that include operations in developing countries. They should be aware that state-sponsored hackers are carrying out active espionage campaigns via those USB sticks. “In North America and Europe, we think this is an old infection vector that’s been locked down,” Leong says. “But there are exposures in this other geography that are being targeted. It’s still relevant, and it’s still being exploited.”

Chinese Spies Infected Dozens of Networks With Thumb Drive Malware

Plus: Spyware-packing ads, TikTok GDPR violations, Elon Musk investigations, and more.

China-linked hackers are increasingly moving beyond espionage and into the disturbing world of power grid attacks. Threat researchers at security software firm Symantec this week released new evidence that the Chinese hacking group known as APT41 infiltrated the power grid of an Asian nation. Some details of the latest intrusion echo a 2021 attack on India’s power grid, suggesting the same hackers are responsible.

In Argentina, a scandal is playing out over the use of facial recognition software in Buenos Aires. Despite laws that require authorities to limit searches to known fugitives, an investigation by a judge found that the system was used to look up people not wanted for any crimes. In other cases, errors led police to arrest or question the wrong people. While Buenos Aires is attempting to get the system back online after legal rulings ordered it turned off, the debacle shows how dangerous facial recognition can be even when laws are in place to limit it.

Facial recognition isn’t the only artificial-intelligence-powered system governments are using in new and upsetting ways. Like everyone else, state and local governments around the United States have begun to play with generative AI tools like ChatGPT. And so far, there’s no consensus on how to use the technology. Some US states, like Maine, have temporarily banned its use altogether, fearing cybersecurity concerns, while others are using it to craft speeches and social media posts.

Meanwhile, the US Senate is in the midst of getting an AI education. Around 60 senators attended a closed-door briefing this week, where they heard from major tech CEOs, including Elon Musk, Mark Zuckerberg, and Sam Altman, as well as civil liberties advocates and AI ethics experts. The Senate has been learning about AI and its myriad issues for much of the year, and another forum on AI innovation is scheduled for later this year. Despite these cramming sessions, some lawmakers question whether they’re any closer to tackling AI responsibly.

Finally, the cyberattack against MGM casinos continues to cause havoc for guests of its resorts nearly a week after the attack began. While an attack on a major casino company is inevitably high-profile, the group behind the breach, known as Alphv, has a long history of targeting schools and hospitals—attacks that are far more consequential.

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

Unless you updated your browser in the past few days, it likely contains a critical flaw. The recently disclosed vulnerability exists in the WebP code library known as libwebp, which encodes and decodes images in the widely used WebP format. Known generally as a “heap buffer overflow,” the flaw can be exploited using a specially crafted malicious image, allowing an attacker to run malicious code on a targeted device. Google says the bug has already been exploited in the wild.

Initially identified early this week as a zero-day vulnerability in Google’s Chrome browser, the libwebp bug impacts browsers built using Chromium, which means Chrome, Mozilla’s Firefox, Microsoft Edge, Opera, Brave, and more. It also affects apps like Telegram, 1Password, Thunderbird, and Gimp. Patches for the flaw are rolling out now, so keep your eyes peeled for updates.

Malicious online ads—also known as “malvertising”—have been around for years. Now, they’re going pro. Several Israeli companies are developing exploits that take advantage of weaknesses in the technical mechanisms that bombard you with ads online, _Haaretz_ reports, allowing attackers to track people and hack their devices. The exploit takes advantage of the online advertising bidding process, in which bots are competing for specific ad slots on web pages in real time. Taking advantage of the fraction of a second before an ad slot is filled, these companies have figured out how to show you an ad that reportedly contains “advanced spyware.” While there’s no quick fix for stopping the spread of this malware, there is something simple you can do to protect yourself: Use an ad blocker.

European data regulators fined TikTok €345 million ($368 million) this week for breaking laws related to the privacy of underage users. The Irish Data Protection Commission (DPC) said the company violated GDPR by failing to make the accounts of child users private by default. The DPC also says TikTok’s “family pairing” feature, which enables an adult to take control of a child’s account settings, did not ensure that the adult with access to the feature was a parent or guardian. TikTok says it opposes the fine because it had updated its settings to make the accounts of anyone under 16 years old private by default before the investigation began.

Turns out, secretly interfering in the battle plans of a United States ally doesn’t go over well in Washington. The US Senate Armed Services Committee has launched an inquiry into Elon Musk’s decision to not enable Starlink satellite communications in Crimea ahead of a Ukrainian military attack on Russian forces. The move, first revealed in author Walter Isaacson’s new biography on Musk, also prompted several Democratic senators to send a letter to the US defense secretary, Lloyd Austin, asking him to explain what actions the Department of Defense (DOD) has taken, or plans to take, to “prevent further dangerous meddling” by Musk.

“SpaceX is a prime contractor and a critical industry partner for the \[DOD\] and the recipient of billions of dollars in taxpayer funding,” the letter reads. “We are deeply concerned with the ability and willingness of SpaceX to interrupt their service at Mr. Musk’s whim and for the purpose of handcuffing a sovereign country’s self-defense, effectively defending Russian interests.”

Even if you have a spotless record, passing a background check can be one of the most stressful parts of landing a new job or an apartment. We have bad news: It’s possible the information used to assess your eligibility might not be accurate. The US Federal Trade Commission (FTC) this week announced a $5.8 million fine against background check providers TruthFinder and Instant Checkmate for “failing to ensure the maximum possible accuracy of their consumer reports,” a violation of the Fair Credit Reporting Act. The FTC alleges that the companies “made millions” by selling subscriptions that would alert people when a “criminal record” was found in their background check, “when the record was merely a traffic ticket.” The company also displayed “Remove” and “Flag as Inaccurate” buttons that the FTC says “did not work as advertised.”

The regulatory ding against TruthFinder and Instant Checkmate comes several months after the companies confirmed a data breach. In January, hackers leaked the personal information of millions of customers by leaking an April 2019 database backup stolen from the companies.

Source

Wired