After scammers duped a friend with a hacked Twitter account and a “deal” on a MacBook, I enlisted the help of a fellow threat researcher to trace the criminals’ offline identities.

Embarrassed, angry, victimized. That's just a few of the words my friend uses to describe his recent run-in with a cybercriminal that used a hacked Twitter account to scam people out of hundreds of dollars. Twitter, meanwhile, ignored his pleas for help. That’s when I got involved.

After Tim Utzig lost $1,000 to a fraudster who tricked him using a hacked Twitter account, I asked an expert in social engineering and hunting scammers to help. Ultimately, we tracked down the suspected culprits and identified a network of apparent scammers and money mules expertly swindling people out of their savings. This scamming saga shows how fraudsters use social media, build a network of people to operate different payment accounts, and apply effective techniques to bilk their victims.

It also shows the additional challenges that blind users like Utzig face on the internet and how they are at higher risk of exploitation by indiscriminate online criminals.

Inaccessible and Unacceptable

On May 23, Utzig realized he’d been scammed. He was gearing up for a journalism master’s program at the City University of London and happened to be in the market for a new laptop. By coincidence, someone using the Twitter account of longtime Baltimore sports reporter Roch Kubatko tweeted that they had a new Apple laptop for sale. Utzig trusted Kubatko, whom he’d previously met, and the tweet seemed innocent—and arrived at the perfect moment. So Utzig responded to the tweet with a DM.

Utzig uses a screen reader to navigate the internet and social media apps, including Twitter. A sighted person may have observed oddities in the initial tweet and profile, but the screen reader did nothing to alert Utzig about a key fact: Kubatko’s Twitter account had been hacked, and the person he was talking to wasn’t Kubatko.

“I feel like people with disabilities as a whole are more susceptible to online fraud—screen readers are just one of the methods used by a population who are visually impaired or blind to assist in using technology,” Utzig says. “You’re going to miss certain visual cues that might signify fraud, such as someone changing their profile picture to something different, and the screen reader won’t pick up on it.”

Screen readers also often don’t vocalize misspellings, inaudible grammatical errors, or typography such as fully capitalized words that a sighted person may see as suspicious. And the alternative text on image descriptions, which are manually applied by the individual sharing the content, is the only way a screen reader can describe an image.

Then there’s Twitter itself. Check marks are now effectively useless, especially if you’re blind. Since Twitter changed its verification system under Elon Musk’s ownership, the blue tick that used to be a reliable sign of identity can now be obtained by pretty much anyone. A screen reader will call the Twitter Blue check mark “verified” as before, but the blind user can no longer rely on it as much as they once did.

Recent moves by Twitter concern accessibility advocates. Last year, Twitter laid off its accessibility team, which was responsible for ensuring the platform was usable for people with disabilities, and restrictions on Twitter’s API broke some tools and resources used by blind people. These changes prompted the National Federation of the Blind to move away from Twitter and create a Mastodon server, which the group says is more friendly and accessible for blind users.

“You have people with disabilities scammed, and yet you laid off your whole accessibility team,” Utzig says. “It takes a team to maintain a safe and accessible platform for people with disabilities to use it.”

Then, to top it all off, Twitter is now rebranding as X, with the goal of creating an “everything app” that will apparently also process payments and serve as a “bank.” This, despite the fact that just two months before the X rebranding, the very same platform was being used to swindle people out of their hard-earned cash.

A $1,000 Loss

Courtesy of “Steve”

After a short conversation with not-Kubatko, the person controlling the account asked him for his phone number to send a payment request via Apple Pay. When Utzig followed up after making a payment, he realized the phone number had blocked his number.

Utzig quickly realized he had just paid $1,000 to a criminal. He then reported the account to Twitter. The company did not respond to his requests for help, and the account remained active for days after it was reported as hacked.

Utzig turned to the media for help and reached out to a local reporter. When a local Maryland news station contacted Twitter for comment, the company responded with the poop emoji, the response that press requests have been receiving since March 2023. Utzig says that response made the situation feel so much worse—not only had he lost a lot of money, but the platform he used and loved didn’t care at all about the serious personal and financial impact on its users who were victims of crime.

In the eight months since Musk bought Twitter in October 2022, the platform has increasingly been home to fraudulent accounts. Users across the site have reported a massive uptick in spammers and scammers tweeting, replying to users, and messaging them directly. There have also been multiple reported instances of hacked, high-profile accounts distributing fraudulent content.

Utzig says his DMs are filled with sketchy accounts either sending spam directly or trying to engage in conversation. The social engineering expert I contacted, who asked to use a pseudonym because they carried out this investigation outside their normal work duties, operates several Twitter accounts both for research and personal use. He—let’s call him Steve—says that in the past few months, the number of malicious accounts he observes on the platform has skyrocketed, especially accounts likely associated with pig butchering. This social engineering threat, which is used to drain people’s bank accounts through bogus investment advice, typically originates on social networks and messaging apps and was recently identified by the US Federal Bureau of Investigation as the most costly online threat, with users reporting billions of dollars in losses in 2022.

Social media fraud is part of an ecosystem of online crime that relies on social engineering and trust between users. There are many different kinds of fraud originating on social media, including pig butchering and other financial or cryptocurrency scams, romance scams, and consumer fraud like the kind Utzig experienced.

The attack that hit Kubatko appears similar to a series of related hacks that took over accounts of high-profile Twitter users, and which has been ongoing since at least January of this year. The scammers all used similar language and photos about offering laptops for sale. It is not clear whether the hacked accounts and related scams are all operated by the same people. A search of the language used in the tweet suggests the scammers are still active on the platform. Kubatko, who did not respond to WIRED's request for comment, eventually got his Twitter account back and apologized to Utzig when he learned of the financial loss.

Different scams require different levels of sophistication; for example, hacking Twitter accounts of high-profile users, many of whom may use multi-factor authentication, is typically more difficult than using said accounts to scam users. It is possible the individuals who swindled Utzig are not the ones who initially hacked Kubatko’s account, but they may have purchased access from the original hacker to use as their scamming platform.

Trap and Trace

Steve was enraged that Utzig had been swindled, and offered to help. But all we had was a phone number. So he contacted the number and told the person on the other end that he was interested in buying laptops. Immediately, he received a text from a _different_ number: “Are you looking for laptops?”

Throughout the conversation, Steve said he was willing to pay via Bitcoin, Cash App, or Zelle. Bitcoin wallet information is useful because all transactions are stored on the blockchain, and you can use it to “follow the money” and identify how much money accounts have made. It’s also possible to cross-reference blockchain accounts with other data sets such as open-source reporting or private threat data to identify related fraudulent activity. Cash App and PayPal are also useful data points because users must provide a lot of personal information including phone numbers, email addresses, usernames, and possibly bank accounts. And Zelle is tied to a bank account, making the information very useful to fraud investigators.

Typically, Steve is able to get at least one of these accounts from the threat actors he interacts with—in this case, we got three.

By claiming he didn’t have enough money in one of his accounts, and that another was not working, Steve got the scammers to send him links to multiple payment accounts. The accounts all had different usernames, suggesting they belonged to different people. In fact, Steve was able to link the usernames and phone numbers from the payment apps to three different people and their suspected real names. He found LinkedIn profiles; Twitter, Facebook, TikTok, Snap, and Instagram accounts; Poshmark accounts; dating profiles; a Soundcloud; and personal websites. By pivoting on this data and information provided on their various social and public profiles, Steve was then able to link the individuals to physical addresses in the eastern US.

Steve also sent the scammers Grabify links to see whether we could collect more data on the users. Grabify is used to identify technical characteristics belonging to a user, such as IP addresses, location data, and “user agents” that indicate what type of device they’re clicking from. In this case, one recipient clicked, and we could see they were using an iPhone on the AT&T network and were apparently located in Ohio, providing a possible estimate of where the user was when they clicked the link.

Based on the conversations with the people associated with the various phone numbers and payment accounts, Steve identified at least four individuals involved in this scam ring.

At least one person—Utzig’s original scammer—is the suspected organizer of the fraud, with at least one person who appears to work directly with him, according to Steve’s findings. After Steve received a message from the new, unknown number, he asked the original scammer who this person was. That phone number claimed it was a “business partner.” It had initially been possible there was one person using two different phone numbers involved in the scam. But based on subsequent investigations and conversations with both, Steve identified two likely separate individuals belonging to those numbers.

The “business partner” sent Steve a Cash App screenshot asking for payment that contained a username, which Steve found associated with multiple social media accounts that included photos. One appeared to have a real name attached.

When Steve said he didn’t have enough money in his Cash account, the business partner sent a link to a PayPal account, which used the apparent first and last name of a different real person. The real name and username were linked to multiple social media accounts that all used photos of what appeared to be the same person. Finally, Steve told the business partner his PayPal was not working, and received a name and phone number allegedly belonging to someone’s Zelle account. The business partner claimed this was an “assistant.” By using the details provided, Steve identified yet another individual and their apparent real name who appeared to reside in the same area as our scammers.

It is unclear whether the individuals belonging to the Zelle and PayPal accounts knew about the laptop scam or whether they were just “money mules.” These are accounts that receive money from victims and then funnel it to other accounts belonging to the original scammers. Sometimes money mules are unaware they are moving stolen money and may be unwitting participants in the fraud. Indeed, sometimes money mules are recruited by scammers under the guise of legitimate employment.

Our investigation resulted in us identifying three payment accounts that were at least associated with the laptop scam, dozens of social media profiles potentially belonging to people involved, and three phone numbers with two different area codes belonging to the same state. While this data could end up being useful to a law enforcement fraud investigation, Steve’s open source intelligence gathering serves as a stark reminder of how easily our digital footprints can be traced back to our real-life existence.

A Drop in the Bucket

Local police and the FBI all encourage users to report when they have been victims of online fraud, but victims rarely get the support they need. Utzig filed a police report with the Washington, DC, Metropolitan Police Department, and we reported it to the FBI via the bureau’s Internet Crime Complaint Center. He also contacted his bank and Apple. Unfortunately, using payment apps is the same as sending someone cash. At this point, there is really nothing more Utzig can do—and it’s likely his complaint will just become a drop in a sea of hundreds of thousands of internet crimes reported each year, many of which don’t get any follow-up.

We provided the police with details of our own investigation and reported high-confidence malicious payment accounts to the payment platforms to remove them for fraud. As private citizens, we’ve done all we can, but we hope our investigations can help prevent further exploitation by these threat actors.

While fraud takes place on pretty much every social media platform, Twitter appears to be hosting more hostile accounts now than it had been prior to the sale last year. And not just from scammers. The company fired much of its Trust and Safety staff in December 2022, and in June, Twitter’s recently appointed head of Trust and Safety exited the company. Without the personnel operating the technical guardrails to prevent widespread harassment, exploitation, and cybercrime, such tactics will likely be allowed to proliferate, making the platform less safe. All this as Musk wants Twitter (sorry, I’m not calling it X) to effectively become a financial institution, which requires more user trust than it has ever enjoyed.

Users should be aware of the hallmarks of fraudulent behavior on social media, like receiving messages from strangers, receiving offers to purchase goods and services, and being asked to switch platforms in the middle of a conversation. However, in Utzig’s case, the social platforms themselves could learn a thing or two. Without improvements in screen reading technology and accessibility in general, platforms are enabling exploitation of their more vulnerable users.

Working with my friend to help him report this crime also reminded me that security practitioners often forget there are real human beings on the receiving end of cybercrime, and the emotional and mental toll of being a victim can be huge.

“Billions of dollars in losses” sounds bad. Your friend losing a lot of their savings and feeling violated and betrayed by platforms and people he trusted feels a lot worse.

Twitter Scammers Stole $1,000 From My Friend—So I Hunted Them Down

Third-party plugins boost ChatGPT’s capabilities. But security researchers say they add an extra layer of risk.

Over the past eight months, ChatGPT has impressed millions of people with its ability to generate realistic-looking text, writing everything from stories to code. But the chatbot, developed by OpenAI, is still relatively limited in what it can do.

The large language model (LLM) takes "prompts" from users that it uses to generate ostensibly related text. These responses are created partly from data scraped from the internet in September 2021, and it doesn't pull in new data from the web. Enter plugins, which add functionality but are available only to people who pay for access to GPT-4, the updated version of OpenAI's model.

Since OpenAI launched plugins for ChatGPT in March, developers have raced to create and publish plugins that allow the chatbot to do a lot more. Existing plugins let you search for flights and plan trips, and make it so ChatGPT can access and analyze text on websites, in documents, and on videos. Other plugins are more niche, promising you the ability to chat with the Tesla owner’s manual or search through British political speeches. There are currently more than 100 pages of plugins listed on ChatGPT’s plugin store.

But amid the explosion of these extensions, security researchers say there are some problems with the way that plugins operate, which can put people’s data at risk or potentially be abused by malicious hackers.

Johann Rehberger, a red team director at Electronic Arts and security researcher, has been documenting issues with ChatGPT’s plugins in his spare time. The researcher has documented how ChatGPT plugins could be used to steal someone’s chat history, obtain personal information, and allow code to be remotely executed on someone’s machine. He has mostly been focusing on plugins that use OAuth, a web standard that allows you to share data across online accounts. Rehberger says he has been in touch privately with around a half-dozen plugin developers to raise issues, and has contacted OpenAI a handful of times.

“ChatGPT cannot trust the plugin,” Rehberger says. “It fundamentally cannot trust what comes back from the plugin because it could be anything.” A malicious website or document could, through the use of a plugin, attempt to run a prompt injection attack against the large language model (LLM). Or it could insert malicious payloads, Rehberger says.

Data could also potentially be stolen through cross plugin request forgery, the researcher says. A website could include a prompt injection that makes ChatGPT open another plugin and perform extra actions, which he has shown through a proof of concept. Researchers call this “chaining,” where one plugin calls another one to operate. “There are no real security boundaries” within ChatGPT plugins, Rehberger says. “It is not very well defined, what the security and trust, what the actual responsibilities \[are\] of each stakeholder.”

Since they launched in March, ChatGPT’s plugins have been in beta—essentially an early experimental version. When using plugins on ChatGPT, the system warns that people should trust a plugin before they use it, and that for the plugin to work ChatGPT may need to send your conversation and other data to the plugin.

Niko Felix, a spokesperson for OpenAI, says the company is working to improve ChatGPT against “exploits” that can lead to its system being abused. It currently reviews plugins before they are included in its store. In a blog post in June, the company said it has seen research showing how “untrusted data from a tool’s output can instruct the model to perform unintended actions.” And that it encourages developers to make people click confirmation buttons before actions with “real-world impact,” such as sending an email, are done by ChatGPT.

ChatGPT Plugins Pose Security Risks

A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty.

For more than 25 years, a technology used for critical data and voice radio communications around the world has been shrouded in secrecy to prevent anyone from closely scrutinizing its security properties for vulnerabilities. But now it’s finally getting a public airing thanks to a small group of researchers in the Netherlands who got their hands on its viscera and found serious flaws, including a deliberate backdoor.

The backdoor, known for years by vendors that sold the technology but not necessarily by customers, exists in an encryption algorithm baked into radios sold for commercial use in critical infrastructure. It’s used to transmit encrypted data and commands in pipelines, railways, the electric grid, mass transit, and freight trains. It would allow someone to snoop on communications to learn how a system works, then potentially send commands to the radios that could trigger blackouts, halt gas pipeline flows, or re-route trains.

Researchers found a second vulnerability in a different part of the same radio technology that is used in more specialized systems sold exclusively to police forces, prison personnel, military, intelligence agencies, and emergency services, such as the C2000 communication system used by Dutch police, fire brigades, ambulance services, and Ministry of Defense for mission-critical voice and data communications. The flaw would let someone decrypt encrypted voice and data communications and send fraudulent messages to spread misinformation or redirect personnel and forces during critical times.

Three Dutch security analysts discovered the vulnerabilities—five in total—in a European radio standard called TETRA (Terrestrial Trunked Radio), which is used in radios made by Motorola, Damm, Hytera, and others. The standard has been used in radios since the ’90s, but the flaws remained unknown because encryption algorithms used in TETRA were kept secret until now.

The technology is not widely used in the US, where other radio standards are more commonly deployed. But Caleb Mathis, a consultant with Ampere Industrial Security, conducted open source research for WIRED and uncovered contracts, press releases, and other documentation showing TETRA-based radios are used in at least two dozen critical infrastructures in the US. Because TETRA is embedded in radios supplied through resellers and system integrators like PowerTrunk, it’s difficult to identify who might be using them and for what. But Mathis helped WIRED identify several electric utilities, a state border control agency, an oil refinery, chemical plants, a major mass transit system on the East Coast, three international airports that use them for communications among security and ground crew personnel, and a US Army training base.

Carlo Meijer, Wouter Bokslag, and Jos Wetzels of Midnight Blue in the Netherlands discovered the TETRA vulnerabilities–which they’re calling TETRA:Burst–in 2021 but agreed not to disclose them publicly until radio manufacturers could create patches and mitigations. Not all of the issues can be fixed with a patch, however, and it’s not clear which manufacturers have prepared them for customers. Motorola—one of the largest radio vendors—didn’t respond to repeated inquiries from WIRED.

The Dutch National Cyber Security Centre assumed the responsibility of notifying radio vendors and computer emergency response teams around the world about the problems, and of coordinating a timeframe for when the researchers should publicly disclose the issues.

In a brief email, NCSC spokesperson Miral Scheffer called TETRA “a crucial foundation for mission-critical communication in the Netherlands and around the world” and emphasized the need for such communications to always be reliable and secure, “especially during crisis situations.” She confirmed the vulnerabilities would let an attacker in the vicinity of impacted radios “intercept, manipulate or disturb” communications and said the NCSC had informed various organizations and governments, including Germany, Denmark, Belgium, and England, advising them how to proceed. A spokesperson for DHS’s Cybersecurity and Infrastructure Security Agency said they are aware of the vulnerabilities but wouldn’t comment further.

The researchers say anyone using radio technologies should check with their manufacturer to determine if their devices are using TETRA and what fixes or mitigations are available.

The researchers plan to present their findings next month at the BlackHat security conference in Las Vegas, when they will release detailed technical analysis as well as the secret TETRA encryption algorithms that have been unavailable to the public until now. They hope others with more expertise will dig into the algorithms to see if they can find other issues.

TETRA was developed in the ’90s by the European Telecommunications Standards Institute, or ETSI. The standard includes four encryption algorithms—TEA1, TEA2, TEA3, and TEA4—that can be used by radio manufacturers in different products, depending on their intended use and customer. TEA1 is for commercial uses; for radios used in critical infrastructure in Europe and the rest of the world, though, it is also designed for use by public safety agencies and military, according to an ETSI document, and the researchers found police agencies that use it.

TEA2 is restricted for use in Europe by police, emergency services, military, and intelligence agencies. TEA3 is available for police and emergency services outside Europe—in countries deemed “friendly” to the EU, such as Mexico and India; those not considered friendly—such as Iran—only had the option to use TEA1. TEA4, another commercial algorithm, is hardly used, the researchers say.

The vast majority of police forces around the world, aside from the US, use TETRA-based radio technology, the researchers found, after conducting open source research. TETRA is used by police forces in Belgium and the Scandinavian countries, East European countries like Serbia, Moldova, Bulgaria, and Macedonia, as well as in the Middle East in Iran, Iraq, Lebanon, and Syria.

Additionally, the Ministries of Defense in Bulgaria, Kazakhstan, and Syria use it. The Polish military counterintelligence agency uses it, as does the Finnish defense forces, and Lebanon and Saudi Arabia’s intelligence service, to name just a few.

Critical infrastructure in the US and other countries use TETRA for machine-to-machine communication in SCADA and other industrial control system settings—especially in widely distributed pipelines, railways, and electric grids, where wired and cellular communications may not be available.

Although the standard itself is publicly available for review, the encryption algorithms are only available with a signed NDA to trusted parties, such as radio manufacturers. The vendors have to include protections in their products to make it difficult for anyone to extract the algorithms and analyze them.

To obtain the algorithms, the researchers purchased an off-the-shelf Motorola MTM5400 radio and spent four months locating and extracting the algorithms from the secure enclave in the radio’s firmware. They had to use a number of zero-day exploits to defeat Motorola protections, which they reported to Motorola to fix. Once they reverse-engineered the algorithms, the first vulnerability they found was the backdoor in TEA1.

All four TETRA encryption algorithms use 80-bit keys, which, even more than two decades after their release, still provides sufficient security to prevent someone from cracking them, the researchers say. But TEA1 has a feature that reduces its key to just 32 bits—less than half the key’s length. The researchers were able to crack it in less than a minute using a standard laptop and just four ciphertexts.

Brian Murgatroyd, chair of the technical body at ETSI responsible for the TETRA standard, objects to calling this a backdoor. He says when they developed the standard, they needed an algorithm for commercial use that could meet export requirements to be used outside Europe, and that in 1995 a 32-bit key still provided security, though he acknowledges that with today’s computing power that’s not the case.

Matthew Green, a Johns Hopkins University cryptographer and professor, calls the weakened key a “disaster.”

"I wouldn’t say it’s equivalent to using no encryption, but it’s really, really bad,” he says.

Gregor Leander, a professor of computer science and cryptographer with a security research team known as CASA at Ruhr University Bochum in Germany, says it would be “stupid” for critical infrastructure to use TEA1, especially without adding end-to-end encryption on top of it. “Nobody should rely on this,” he says.

Murgatroyd insists the most anyone can do with the backdoor is decrypt and eavesdrop on data and conversations. TETRA has strong authentication, he says, that would prevent anyone from injecting false communication.

“That’s not true,” says Wetzels. TETRA only requires that devices authenticate themselves to the network, but data and voice communications between radios are not digitally signed or otherwise authenticated. The radios and base stations trust that any device that has the proper encryption key is authenticated, so someone who can crack the key as the researchers did can encrypt their own messages with it and send them to base stations and other radios.

While the TEA1 weakness has been withheld from the public, it’s apparently widely known in the industry and governments. In a 2006 US State Department cable leaked to Wikileaks, the US embassy in Rome describes an Italian radio manufacturer asking about exporting TETRA radio systems to municipal police forces in Iran. The US pushed back on the plan, so the company representative reminded the US that encryption in the TETRA-based radio system they planned to sell to Iran is “less than 40-bits,” implying that the US shouldn’t object to the sale because the system isn’t using a strong key.

The second major vulnerability the researchers found isn’t in one of the secret algorithms, but it affects all of them. The issue lies in the standard itself and how TETRA handles time syncing and keystream generation.

When a TETRA radio contacts a base station, they initiate communication with a time sync. The network broadcasts the time, and the radio establishes that it’s in sync. Then they both generate the same keystream, which is tied to that timestamp, to encrypt the subsequent communication.

“The problem is that the network broadcasts the time in packets that are unauthenticated and unencrypted,” says Wetzels.

As a result, an attacker can use a simple device to intercept and collect encrypted communication passing between a radio and base station, while noting the timestamp that initiated the communication. Then he can use a rogue base station to contact the same radio or a different one in the same network and broadcast the time that matches the time associated with the intercepted communication. The radio is dumb and believes the correct time is whatever a base station says it is. So it will generate the keystream that was used at that time to encrypt the communication the attacker collected. The attacker recovers that keystream and can use it to decrypt the communication collected earlier.

To inject false messages, he would use his base station to tell a radio that the time is tomorrow noon and ask the radio to generate the keystream associated with that future time. Once the attacker has it, he can use the keystream to encrypt his rogue messages, and the next day at noon send them to a target radio using the correct keystream for that time.

Wetzels imagines Mexican drug cartels could use this to intercept police communications to eavesdrop on investigations and operations or deceive police with false messages sent to radios. The attacker needs to be near a target radio, but the proximity is only dependent on the strength of the rogue base station’s signal and the terrain.

“You can do this within a distance of tens of meters,” he says. The rogue base station would cost $5,000 or less to build.

ETSI’s Murgatroyd downplays the attack saying TETRA’s strong authentication requirements would prevent a non-authenticated base station from injecting messages. Wetzel disagrees, saying TETRA only requires devices to authenticate to the network, not to each other.

The researchers didn’t find any weaknesses in the TEA2 algorithm used by police, military, and emergency services in Europe, but they did initially think they found another backdoor in TEA3. Given that TEA3 is the exportable version of TEA2, there was good reason to believe it might also have a backdoor to meet export requirements.

They thought they found something suspicious in a substitution box, or S-box, used in the algorithm, which contains a bad property they say would “never appear in serious cryptography.” The researchers didn’t have sufficient skill to examine it to determine if it was exploitable. But Leander’s team did examine it and he says it’s not.

“In many ciphers if you used such a box it would break the cipher very badly,“ he says. “But the way it’s used in TEA3, we couldn’t see that this is exploitable.” This doesn’t mean someone else might not find something in it he says, but he’d “be very surprised if it leads to an attack that’s practical.”

With regard to fixes for the other problems the researchers found, Murgatroyd says ETSI fixed the keystream/timestamp issue in a revised TETRA standard published last October, and they created three additional algorithms for vendors to use, including one that replaces TEA1. Vendors have created firmware updates that fix the keystream/timestamp issue. But the problem with TEA1 cannot be fixed with an update. The only solution for that is to use another algorithm—not an easy thing to switch—or to add end-to-end encryption on top of TETRA, something Wetzels says is impractical. It’s very expensive since the encryption has to be applied to every device, it requires some downtime to do the upgrade—something not always feasible for critical infrastructure—and can create incompatibility issues with other components.

As for asking their vendor to switch out TEA1 for one of the new algorithms meant to replace it, Wetzels says this is problematic as well, since ETSI plans to keep those algorithms secret, like the others, asking users to trust again that the algorithms have no critical weakness.

“There’s a very high chance that \[the replacement algorithm for TEA1\] will be weakened” as well, he says.

The researchers don’t know if the vulnerabilities they found are being actively exploited. But they did find evidence in the Edward Snowden leaks that indicate the US National Security Agency (NSA) and UK’s GCHQ intelligence agency targeted TETRA for eavesdropping in the past. One document discusses an NSA and Australian Signals Directorate project to collect Malaysian police communications during a climate change conference in Bali in 2007 and mentions that they obtained some TETRA collections on Indonesian security forces' communications.

Another Snowden leak describes GCHQ, possibly with NSA assistance, collecting TETRA communications in Argentina in 2010 when tensions rose between it and the UK over oil exploration rights in a deep-sea oil field off the coast of the Falkland Islands. It describes an operation to collect high-priority military and leadership communications of Argentina and reveals that the project resulted in successful TETRA collections.

“This doesn’t indicate they exploited these vulnerabilities that we found,” Wetzels says. “But it does show … that state-sponsored actors are actively looking at and collecting these TETRA networks, even in the early 2000s.”

TETRA Radio Code Encryption Has a Flaw: A Backdoor

Plus: Microsoft expands access to premium security features, AI child sexual abuse material is on the rise, and Netflix’s password crackdown has its intended effect.

Microsoft wrote last week that its “investigations have not detected any other use of this pattern by other actors and Microsoft has taken steps to block related abuse.” But if the stolen signing key could have been used to breach other services, even if it wasn’t used this way in the recent incident, the finding has significant implications for the security of Microsoft’s cloud services and other platforms.

The attack “seems to have a broader scope than originally assumed,” the Wiz researchers wrote. They added , “This isn't a Microsoft-specific issue—if a signing key for Google, Facebook, Okta, or any other major identity provider leaks, the implications are hard to comprehend.”

Microsoft’s products are ubiquitous worldwide, though, and Wiz’s Luttwak emphasizes that the incident should serve as an important warning.

“There are still questions that only Microsoft can answer. For example, when was the key compromised? And how?” he says. “Once we know that, the next question is, do we know it’s the only key that they had compromised?

In response to China’s attack on US government cloud email accounts from Microsoft—a campaign that US officials have described publicly as espionage—Microsoft announced this past week that it will make more of its cloud logging services free to all customers. Previously, customers had to pay for a license to Microsoft's Purview Audit (Premium) offering to log the data.

The US Cybersecurity and Infrastructure Security Agency’s executive assistant director for cybersecurity, Eric Goldstein, wrote in a blog post also published this past week that “asking organizations to pay more for necessary logging is a recipe for inadequate visibility into investigating cybersecurity incidents and may allow adversaries to have dangerous levels of success in targeting American organizations.”

Since OpenAI revealed ChatGPT to the world last November, the potential of generative AI has been thrust into the mainstream. But it isn't just text that can be created, and many of the emerging harms of the technology are only starting to be realized. This week, UK-based child safety charity the Internet Watch Foundation (IWF), which scours the web for child sexual abuse images and videos and removes them, revealed it is increasingly finding AI-generated abuse images online.

In June, the charity started logging AI images for the first time—saying it found seven URLs sharing dozens of images. These included AI generations of girls around 5 years old posing naked in sexual positions, according to the BBC. Other images were even more graphic. While generated content only represents a fraction of the child sexual abuse material available online overall, its existence is worrying experts. The IWF says it found guides on how people could create lifelike images of children using AI and that the creation of the images, which is illegal in many countries, is likely to normalize and encourage predatory behaviors toward children.

After threatening to roll out global password-sharing crackdowns for years, Netflix launched the initiatives in the US and UK at the end of May. And the effort seems to be going as planned. In earnings reported on Thursday, the company said that it added 5.9 million new subscribers in the past three months, a jump nearly three times higher than analysts predicted. Streaming subscribers have grown accustomed to sharing passwords and balked at Netflix’s strict new rules, which were prompted by stagnating new subscriber signups. But ultimately, at least a portion of account-sharers seem to have bit the bullet and started paying on their own.

China’s Breach of Microsoft Cloud Email May Expose Deeper Problems

A landmark $13 million settlement with the City of New York is the latest in a string of legal wins for protesters who were helped by a video-analysis tool that smashes the “bad apple” myth.

Beaten, blinded by pepper spray, corralled like animals, and indiscriminately arrested for marching against police violence and racial injustice. Such was the fate hundreds of people suffered at the hands of New York Police Department (NYPD) officers in late May and early June of 2020, as thousands of people across the United States protested the murder of George Floyd by a Minneapolis police officer.

Three years later, a class action lawsuit has resulted in the City of New York agreeing to pay $9,950 each to some 1,380 protesters as part of a settlement. Costing taxpayers more than $13 million, it’s the largest amount paid to protesters in US history, according to the legal team behind the class action suit.

Lawyers secured the settlement with the aid of a little-known tool that helped them quickly categorize and analyze terabytes of video footage from police body cams, helicopter surveillance, and social media. “We had multiple weeks of protests. We had protests spanning the city of New York. We had thousands of arrests,” says David Rankin, a partner at the law firm Beldock, Levine & Hoffman who was part of the protesters’ legal team. “We had tens of thousands of hours of body cam footage, we had text messages, we had emails, we had just an absolute truckload of data to get through.”

The path through all this data was carved by Codec, a video categorization tool developed by the civil liberties-focused design agency SITU Research. Launched in June 2022, the tool is proving essential in legal battles around the world, where hours of disparate video footage can reveal orchestrated, state-backed violence against protesters.

Clip by Clip

Dozens of videos shared with WIRED show how the legal team built their case. Using this data, which also included geospatial information, time stamps, and the category of the alleged misconduct, we were able to build a map that allows anyone to watch the police incidents that were central to the lawsuit. Each dot represents an incident the legal team characterized as police misconduct. Of the 72 videos the legal team flagged as most pertinent to their case, the map includes 47 videos recorded by police body cams or surveillance cameras. The locations of the remaining 25 videos, which appear to have been taken from social media and other sources, are also pinpointed on the map. In total, the legal team analyzed more than 6,300 videos. 

Some of the videos on the map contain graphic violence, and viewer discretion is advised. Videos will autoplay with the sound on.

Video evidence was obtained from various sources, including police body cameras and helicopters. SITU Research geolocated the data and provided it to WIRED.

Among the videos we reviewed, an NYPD officer can be seen running down the sidewalk while pepper-spraying a person who’s standing against a building, entirely out of the officer’s way. In another video, an officer hits a protester with a car door while driving down the street. Another video shows a group of officers interlocking arms as one of them says, “Just like we fucking practiced.” The officers then charge a group of protesters before singling out a person on the sidewalk and beating them with batons. Taken together, the footage demonstrates widespread, systematic police misconduct during protests that spanned from May 28 to June 4, 2020, across multiple neighborhoods in New York City, according to the lawsuit.

While looting and vandalism took place in several neighborhoods during the protests, the demonstrations were largely peaceful. The defendants in the lawsuit have not admitted wrongdoing as part of the settlement, and city attorneys deny an orchestrated effort to violate protesters’ rights. Reached for comment, the NYPD referred WIRED to the city’s Law Department, which has not yet responded to a request for comment.

Remy Green, a partner at Cohen & Green and a member of the protesters’ legal team, says the use of police body cameras, which have been touted as a step in the right direction for civil liberties, has become “a kind of band-aid solution to police brutality.” A single video can only reveal so much, Green says, and police departments can use this limitation to obfuscate what really happened. Protests that are met with an extreme police response require a zoomed-out vantage point, which is what Codec allowed the legal team to create. “It gives you a much more comprehensive look at the activities that occurred,” says Green.

Hard Pivot

The idea of using Codec in the lawsuit came from a related case settled earlier this year. Here, Human Rights Watch worked with SITU Research to analyze video footage of protests in the Mott Haven neighborhood of the Bronx, one of New York City’s five boroughs. Their work proved that the NYPD used an anti-protest tactic called “kettling”—trapping a group of people so they can’t escape—just prior to a government-mandated curfew, thus ensuring that they were in violation of the order. In March, a lawsuit against the city over the NYPD’s use of kettling ended in a $21,500 payout to each of more than 300 Mott Haven protesters, which is estimated to be the highest per-person settlement for a mass arrest in US history. The NYPD said in a statement following the settlement that it has since “re-envisioned” its “policies and training for policing large-scale demonstrations.”

Having seen the forensic video investigation SITU’s work on the Mott Haven protests produced, Rankin asked for help conducting a similar investigation. But this time it wouldn’t focus on police conduct during a single protest in one neighborhood, but rather protests across New York City.

Now an open source tool that’s free to use, Codec was first built for internal use only, according to Brad Samuels, a founding partner of SITU who oversees its research division. Codec categorizes video files using a range of criteria, including the location where a video was taken and the time and date it was recorded. Analysts can add their own parameters, such as whether a video shows police use of pepper spray, which enables them to more easily pinpoint clips that are relevant to an investigation.

Early on, the SITU team focused on international incidents, such as the 2014 Maidan Revolution in Ukraine and a 2019 uprising in Iraq in which security forces fired military-grade tear gas canisters directly at protesters’ heads. After the murder of George Floyd in May 2020, the US-based SITU team “pivoted hard” to investigate domestic incidents. The agency’s focus on the 2020 Black Lives Matter protests that followed resulted in investigations into police misconduct in Portland, Oregon, and Charlotte, North Carolina. Investigations in Mott Haven and across New York City are the latest to join that list.

The legal team behind the New York City-wide lawsuit, which operated through the National Lawyers Guild, a civil rights-focused nonprofit, obtained thousands of videos from the NYPD, the city, and social media feeds, most of which were unpublished until this week. Using Codec, analysts pinpointed four broad categories of what the legal team characterized as police misconduct: improper arrests, improper use of pepper spray, improper baton strikes, and excessive force.

While Codec greatly enhanced the legal team’s ability to analyze thousands of videos, it still took “a lot of human hours” to make the data usable and identify specific moments that were useful for their case, Rankin says. This included identifying the location of specific police interactions, categorizing the alleged misconduct, and adding accurate time stamps—all of which require ample hours of human work to complete, even with Codec’s help.

In future cases that require high-volume video analysis, however, that job may become easier. Samuels says the SITU team is currently working to add layers of machine learning and computer vision to Codec. He hopes that by next year the system can be tasked with, for example, detecting batons in footage—something that is currently done manually.

Widespread protests like those that took place in 2020 don’t often happen in the US. And Rankin points out that cases like the one settled this week are rare. But Green says they’re not nearly rare enough. “Our role as civil rights attorneys, I like to think, is to attempt to put ourselves out of a job,” Green says. “This settlement marks a high-water mark in terms of financial accountability, but I don’t see myself losing my job anytime soon.”

_Map creation and additional data work by Danielle Carrick_

NYPD Body Cam Data Shows the Scale of Violence Against Protesters

German researchers gained rare access to three satellites and found that they're years behind normal cybersecurity standards.

Hundreds of miles above Earth, thousands of satellites are orbiting the planet to keep the world running smoothly. Timing systems, GPS, and communications technologies are all powered by satellites. But for years, security researchers have warned that more needs to be done to secure the satellites against cyberattacks.

A new analysis from a group of German academics provides a rare glimpse into some of the security weaknesses in satellites currently circling the Earth. The researchers, from the Ruhr University Bochum and the Cispa Helmholtz Center for Information Security, have examined the software used by three small satellites and found that the systems lack some basic protections.

The satellites inspected by the researchers, according to an academic paper, contain “simple” vulnerabilities in their firmware and show “that little security research from the last decade has reached the space domain.” Among the problems are a lack of protection for who can communicate with the satellite systems and a failure to include encryption. Theoretically, the researchers say, the kinds of issues they discovered could allow an attacker to take control of a satellite and crash it into other objects.

There are multiple kinds of satellites in use today, ranging in size and purpose. Satellites created by commercial companies can be found photographing the Earth and providing navigation data. Military satellites are cloaked in secrecy and often used for spying. There are also research satellites, which are run by space agencies and universities.

Johannes Willbold, a PhD student at Ruhr University Bochum and the lead researcher behind the security analysis, says the current state of satellite security can be classed as “security by obscurity.” In other words: Little is known about how well they are protected. Willbold says the research team approached multiple organizations with satellites in space to ask if they could inspect their firmware, and the vast majority refused or didn’t reply—he praises the openness of the three that worked with his team.

The three satellites the team focused on are used for research, fly in low Earth orbit, and are largely operated by universities. The reserachers inspected the firmware of ESTCube-1, an Estonian cube satellite that launched in 2013; the European Space Agency’s OPS-SAT, which is an open research platform; and the Flying Laptop, a mini satellite created by Stuttgart University and defense firm Airbus.

The researchers’ analysis says they found six kinds of security vulnerabilities across all three satellites and 13 vulnerabilities in total. Among these vulnerabilities were “unprotected telecommand interfaces,” which satellite operators on the ground use to communicate with the vehicles when they are in orbit. “Oftentimes, they lack access protection in the first place,” says Willbold, who is also presenting the research at the Black Hat security conference in Las Vegas next month. “They’re essentially not checking anything.”

As well as the vulnerabilities within the satellites’ software, Willbold says, the team found an issue in a code library that appears to be used by multiple satellites. The research details a stack-based buffer overflow vulnerability in software developed by nanosatellite manufacturer GomSpace. The source of the problem, the research says, is within a library that was last updated in 2014. Willbold says GomSpace acknowledged the findings when the researchers reported the issue. GomSpace did not respond to WIRED’s request for comment.

The creators of the satellites examined by the researchers told WIRED that providing their firmware to the researchers was beneficial and that they will take the findings on board for future spacecraft. Simon Plum, head of the Mission Operations Department at the European Space Agency (ESA), says a different level of security is applied to OPS-SAT than to other missions, as it is a “space laboratory.” However, Plum says ESA is reviewing the findings and has made at least one change to the satellite already. “We want to protect space systems from cyber threats and develop culture and common knowledge of resilience in the field of space cybersecurity,” Plum says.

Andris Slavinskis, an associate professor at the University of Tartu in Estonia who works on the ESTCube project, says the findings are “important and relevant” and that the ESTCube-1 system was “developed and launched during the Wild West times of the cubesat world.” A second version of the satellite, ESTCube-2, is set to launch this year. Meanwhile, Sabine Klinkner, a professor of satellite technology at Stuttgart University, which partly developed the Flying Laptop, says the “weaknesses” the researchers found are a result of trade-offs around functionality and access to the satellite.

“As with many university satellites, our threat model weighted the small incentives to attack an academic satellite against the still not completely trivial challenges in establishing a link and sending valid commands to the satellite,” Klinkner says. No malicious connections to the satellite have been spotted, Klinkner adds. And she says future missions will have increased cybersecurity measures to protect against threats.

Despite the satellite security analysis mostly focusing on research and academic satellites, it highlights wider security issues around satellites that experts have been concerned about for years. Gregory Falco, an assistant professor at Johns Hopkins University who focuses on space cybersecurity, says it is rare for researchers to be able to get their hands on satellite firmware and publish research on it. There’s “almost nothing” publicly available that’s similar to the type of analysis the German team completed, Falco says.

The warnings about space systems aren’t new. Researchers have long said more needs to be done to protect space systems from attack and to improve how they are created. Falco says that space firmware and software development is a “nightmare” for two reasons. First, legacy software is often used in development and is rarely updated, Flaco says. “The other reason why is because space systems are not built by software developers. They are built by aerospace engineers, for the most part.” The German researchers also surveyed 19 satellite industry professionals about the levels of security in their systems. “We focused on providing a functioning system instead of a secure one,” one of those surveyed said, according to the academic paper.

Juliana Suess, a research analyst and policy lead on space security at the defense think tank Royal United Services Institute, explains that there are multiple ways satellite systems can be attacked, beyond software and firmware vulnerabilities. These include jamming and spoofing attacks, which interfere with the signals being transmitted to and from satellites. “You don't need to be a space power to do it,” Suess says. Last year, security researchers with permission demonstrated how a decommissioned satellite could be used to broadcast rogue TV signals. And in October 2007 and July 2008, Chinese hackers were blamed for disrupting two US satellites.

Suess believes the cyberattack against the Viasat satellite system at the start of Russia’s full-scale invasion of Ukraine last year has acted as a further wake-up call to the space industry. In the early hours of February 24, 2022, when Russian troops first moved into Ukrainian land, a cyberattack interrupted thousands of modems from the satellite internet system. The attack knocked connections offline around the world, including German wind farms. The EU, UK, and US have linked the attack to Russia, and it has prompted the US National Security Agency to speak out about satellite security.

As experts continue to sound the alarm around space cybersecurity issues, the commercial space sector is going through a boom. SpaceX and other companies are racing to put thousands of satellites into orbit to provide internet connections, and it has become cheaper for satellites to photograph Earth from space. Alongside big firms, there’s a smaller array of companies building components and parts to be included in spacecraft. This supply chain poses extra security risks.

“They absolutely are not prioritizing security,” Falco says. “They probably don’t have any people who know anything about it on their staff.” In June of this year, the Institute of Electrical and Electronics Engineers Standards Association announced a new effort, which Falco is chairing, to introduce common practices and requirements for cybersecurity across the space industry. “There’s so much money that’s going into developing commercially led space systems, commercial entities need to have some guidance,” Falco says.

Satellites Are Rife With Basic Security Flaws

A bill to prevent cops and spies from buying Americans’ data instead of getting a warrant has a fighting chance in the US Congress as lawmakers team up against surveillance overreach.

United States lawmakers are moving with uncommon speed to close a loophole in federal law that police and intelligence agencies use to collect sensitive information on US citizens—up to and including their physical whereabouts—all without the need for a warrant.

The Federal Bureau of Investigation (FBI) and the Defense Intelligence Agency are among several government entities known to have solicited private data brokers to access information for which a court order is generally required. A growing number of lawmakers have come to view the practice as an end run around the US Constitution’s Fourth Amendment guarantees against unreasonable government searches and seizures. 

“This unconstitutional mass government surveillance must end,” Warren Davidson, Republican congressman from Ohio, says. 

Members of the House Judiciary Committee, led by Ohio’s Jim Jordan, a Republican, will hold a markup hearing tomorrow to consider a Davidson bill aimed at restricting purchases of Americans’ data without a subpoena, court order, or warrant. If passed into law, the legislation's restrictions would apply to federal agencies as well as state and local police departments. Known as the Fourth Amendment Is Not For Sale Act, the bill is cosponsored by four Republicans and four Democrats, including the committee’s ranking member, Jerry Nadler,  a Democrat, who first introduced it alongside California Democrat Zoe Lofgren in 2021. 

Notably, the bill's protections extend to data obtained from a person's account or device even if hacked by a third party, or when disclosure is referenced by a company's terms of service. The bill's sponsors note this would effectively prohibit the government from doing business with companies such as Clearview AI, which has admitted to scraping billions of photos from social media to fuel a facial recognition tool that's been widely tested by local police departments.

“The principle here is simple,” Nadler said when the legislation was first introduced two years ago. “The government should not be allowed to purchase its way around the rules Congress has enacted to protect the privacy of American citizens.”

In addition to Davidson, Nadler, and Lofgren, the bill is cosponsored by Republicans Andy Biggs, Ken Buck, and Thomas Massie, joining two other Democrats, Pramila Jayapal and Sara Jacobs.

An aide to Jim Jordan, the Judiciary Committee's Republican chairman, signaled that he would likewise support the bill, highlighting the degree to which domestic surveillance fears have risen to supersede fractious politics. The bill had been previously introduced by a bipartisan group of senators in 2021 and had acquired more than 20 cosponsors, including Chuck Schumer, the Senate majority leader. However, the legislation ultimately failed to make much headway in Congress.

A report declassified last month by the nation’s top intelligence official, Avril Haines, stated that a “large amount” of “sensitive and intimate information” has been purchased by the intelligence community, including information that the US Supreme Court has previously ruled is protected by the Fourth Amendment. Senior congressional sources say many lawmakers were taken aback by the apparent breadth of the collection and of the warnings in the report about its potential to “facilitate blackmail, stalking, harassment, and public shaming.” 

Other lawmakers are alarmed by the FBI’s disclosure of having purchased location information derived from people’s cell phones. During a hearing in March, the FBI director, Christopher Wray, told senators that the bureau had “previously—as in the past—purchased some such information for a specific national security pilot project.”

Americans have a reasonable expectation of privacy, the US Supreme Court says, when it comes to certain digital information, including that which could reveal “the whole of their physical movements.” Such data—which the court describes as “detailed, encyclopedic, and effortlessly compiled”—need not be GPS-precise merely to justify a warrant. Nevertheless, the government has widely adopted the view that the Fourth Amendment does not apply when that same data is available to it commercially. 

When provided, the government's reasoning typically hinges on analysis of the landmark 2018 _Carpenter v. United States_ decision, in which the Supreme Court ruled that the government’s warrantless acquisition of cellular records, which can be used to track a person’s movements, had violated the rights of a 32-year-old man who'd been convicted of carrying out a string of robberies.

In its 5–4 opinion, the court refers to police demanding or “compelling” access to data, something that literal interpreters of the law say places commercial arrangements with data brokers squarely outside the scope of the court opinion. What's more, government lawyers have pointed to acknowledgment from the court that the debate over _Carpenter_ did not consider “collection techniques involving foreign affairs or national security.”

The Supreme Court has erstwhile framed the Fourth Amendment as a means to “plac\[ing\] obstacles in the way of a too permeating police surveillance,” something that the Constitution’s authors deemed a “greater danger to a free people than the escape of some criminals from punishment.” Oft-cited by the court is a passage by a 19th-century American jurist: “Of all the rights of the citizen, few are of greater importance or more essential to his peace and happiness than the right of personal security, and that involves not merely protection of his person from assault, but exemption of his private affairs, books, and papers, from the inspection and scrutiny of others. Without the enjoyment of this right, all others would lose half their value.”

What rules or guidelines do exist within the intelligence community for purchasing commercial data often justify the activity by deeming the information “publicly available,” pointing to the fact that it may be open for purchase by not only private companies but foreign governments as well. While true and worrying, that is also irrelevant, says Bob Goodlatte, the former chairman of the House Judiciary Committee who now works as a senior policy adviser for the Project for Privacy & Surveillance Accountability, a pro-privacy group.

“None of those other entities can arrest you, can charge you with a crime, try you, sentence you, imprison you, restrain you, enjoin you, fine you, tax you,” Goodlatte says. “All of those are powers of government, and any American should be concerned about the ease with which the federal government can gather information about people.”

Sean Vitka, a senior attorney at the nonprofit Demand Progress, whose slate of issues encompasses privacy and national security reforms, says domestic surveillance was proving to be one of the most bipartisan issues today in Congress, pointing not only to tomorrow’s markup hearing but a concurrent battle being fought over similar purchases by the US military. The House of Representatives last week voted to support an amendment to a defense spending bill requiring a warrant for all data typically protected by the Fourth Amendment, regardless of whether it's for sale. (The amendment was narrowed earlier in the week to exclude non-military agencies, including state and local police departments, which do not fall under the committee of jurisdiction's purview.)

The defense measure, and even the Fourth Amendment Is Not For Sale Act, is a mere prelude to a much bigger fight coming this fall over what's considered the “crown jewel” of the US intelligence community: Section 702 of the Foreign Intelligence Surveillance Act. 

“We are now seeing momentous alignment of powerful political actors in favor of enacting major privacy protections for people in the United States,” says Vitka, “on the eve of the biggest fight over warrantless surveillance in generations.”

Fourth Amendment Is Not for Sale Act Goes Back to Congress

Plus: A fitness app may have leaked the location of a murdered submarine captain, the privacy risks of filing taxes online, and how Facebook data was used in an abortion trial.

IPVM disputes this allegation and says it promptly contacted the FBI upon discovering the crimes.

A murdered Russian submarine captain may have been tracked by his killer through the Strava fitness app. According to the BBC, the commander, Stanislav Rzhitsky, kept a public Strava profile that detailed his jogging routes—including one that took him through the park where he was killed early this week.

Privacy experts have been concerned about the dangers posed by social fitness apps like Strava for years. In 2018, for example, researchers exposed several secret US military installations using public data from soldiers tracking their fitness with the app.

While the killer’s motivations are currently unclear, Russian investigators say they arrested a man named Serhiy Denysenko, born in Ukraine, in connection with the murder. According to several Russian Telegram channels, Denysenko was the former head of the Ukrainian Karate Federation.

Ukrainian media reported that Rzhitsky commanded a Russian Kilo-class submarine that may have carried out a deadly missile attack on the Ukrainian city of Vinnytsia last year. Rhitsky’s personal information had previously been uploaded to the Ukrainian website Myrotvorets (Peacemaker), an unofficial database of people considered to be enemies of Ukraine, according to CNN.

Ukraine’s Defense Intelligence did not take responsibility for the commander’s death. “Obviously, he was eliminated by his own men for refusing to continue to carry out combat orders from his command regarding missile attacks on peaceful Ukrainian cities,” the agency wrote in a statement.

A congressional investigation, led by US senator Elizabeth Warren, found that millions of Americans who file their taxes online with H&R Block, TaxSlayer, and TaxAct had financial information shared with Google and Facebook. The investigation was spurred by a 2022 report by The Markup that revealed how the three companies were transmitting sensitive data to Facebook through a tool called the Meta Pixel. The data was sent as taxpayers filed their taxes and contained personal information, including income and refund amounts.

Warren and six other lawmakers wrote to the US Justice Department this week, asking for criminal charges against the tax companies for breaking laws forbidding them from sharing their clients’ personal information. “The tax prep firms were shockingly careless with their treatment of taxpayer data,” the lawmakers wrote.

A third of the 80,000 most popular websites on the internet use the Meta Pixel, a 2020 investigation by The Markup found. Website operators include the pixel to measure clicks from their ads on Facebook’s platforms, but at the expense of their users’ privacy. Crisis Pregnancy Centers, Suicide Hotlines, and hospitals and have all been caught sending sensitive user data to Meta in the past few years.

The seven Democrats called on the US Internal Revenue Service to build its own free tax preparation software, though government services have also been caught using the Pixel to send data to Meta.

A Nebraska woman has pleaded guilty to criminal charges after helping her 17-year-old daughter with a medication abortion last year; key evidence against her included her Facebook messages. In mid-June of 2022, Nebraska police sent a warrant to Meta requesting private messages from the mother and daughter as part of an investigation into an illegal abortion, court documents show. The chats appear to show the mother instructing her daughter about how to take the pills. “Ya the 1 pill stops the hormones an rhen u gotta wait 24 HR 2 take the other,” reads one of her messages.

Since the US Supreme Court overturned _Roe v. Wade_ in June 2022, experts have raised serious concerns about the variety of ways data will be weaponized by law enforcement who want to prosecute people seeking abortions. Because Facebook Messenger doesn’t default to end-to-end encryption (E2EE) the way messaging services like Signal, WhatsApp, and iMessage do, people are especially vulnerable to criminal investigations if they use the platform.

According to a recent report from Reuters, prosecutors told a London court that a teenager associated with the hacking group Lapsus$ was responsible for high-profile hacks of Uber and fintech company Revolut in September of last year. Arion Kurtaj, who is 18, faces 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the UK’s Computer Misuse Act.

The Uber hack reportedly cost the company $3 million in damages. At the time, Uber said the hacker who took responsibility posted pornographic material to an internal information page alongside the message: “Fuck you wankers.”

Kurtaj, along with an unnamed 17-year-old, is also facing allegations of blackmailing BT Group, EE, and Nvidia. Prosecutors described the pair as “key players” in Lapsus$. Kurtaj has been deemed not fit to stand trial by medical professionals; the jury will decide whether he is responsible for the hacking incidents rather than guilty of them.

Nude Videos of Kids From Hacked Baby Monitors Were Sold on Telegram

The FBI has collected sensitive data on millions of Americans without warrants, drawing intense scrutiny from Congress and turning the agency into a punching bag across the political divide.

Fears over the death of privacy in the United States are turning some of Washington’s most pronounced enemies into the strangest of bedfellows. Lawmakers usually thought incapable of reconciling even the smallest of differences are finding rare common ground over a shared mistrust of the Federal Bureau of Investigation, and a mutual disdain for domestic spying.

At a committee hearing Wednesday, US Representative Zoe Lofgren of California called out the FBI's director, Christopher Wray, over a disclosure he’d reluctantly made in March: Not long ago, he said, the FBI had circumvented the need to obtain search warrants by buying commercial data that revealed the whereabouts of an unknown number of Americans. Buying this data, rather than compelling its disclosure, allowed the FBI to forgo asking a judge’s permission—a requirement as of 2018, thanks to the Supreme Court decision _Carpenter v. United States._

Disturbed by this revelation, Lofgren—a 14-term Democrat and leader of past efforts to curb government surveillance on US soil—used the hearing to take a deeper interest in Wray’s claim that the data was originally collected for advertising purposes. Wray showed resistance to revealing anything new, saying only that the deal was legal and that his staff would follow up with Lofgren; that way, he added, “I don’t leave something important out.”

With limited time, Lofgren moved on to other concerns. But as her time expired she ended with a warning: “We’ll be looking into those warrant requirements later.” Jim Jordan, the committee's Republican chair, chimed in as Lofrgen’s microphone went dead. “We sure will,” he said. “We sure will.”

Since last year's raid on ex-president Donald Trump’s Mar-a-Lago residence, the FBI has been persona non grata in most conservative circles. Widely despised on the right, the bureau is a boogeyman featured in many right-wing conspiracy theories, largely designed to explain away Trump’s election defeat and the role of his supporters in the insurrection that followed. Many of the questions that top Republicans put to Wray on Wednesday were seemingly designed to lend credence to these theories. A few members, like Matt Gaetz of Florida, dove deep into InfoWars-like waters.

One line of questioning was plainly meant to implicate the FBI in helping to plant a bomb outside of a Democratic Party building on the day of the insurrection. Unfortunately, it’s the bureau’s own troubled history that makes it so difficult to defend against such claims.

It fell mostly on Democrats like Lofgren to point out the irony in labeling an organization known for its Christian conservative leanings of being secretly chock-full of anarchists. Congressman Ken Buck of Colorado noted that Wray’s Wikipedia page lists him as a registered Republican. “I hope," he said, "you don’t change your party affiliation after this hearing is over.”

One of the farthest-right members in the House, Gaetz took his turn questioning Wray immediately after Lofgren. His first words were in her defense. “The American people need to understand what just happened,” he railed. “My Democratic colleague just asked the director of the FBI whether or not they are buying information about our fellow Americans, and the answer is, ‘Well, we’ll just have to get back to you.’”

In an exchange overheard by an Associated Press reporter present for the hearing, Gaetz also heaped praise on another political rival moments after she, too, laid into the director. (“That was terrific," he reportedly said.)

Congresswoman Pramila Jayapal of Washington had dedicated much of her time to drawing attention to a report declassified last month by Avril Haines, the director of national intelligence and America’s “top spy.” The report states that the purchasing of personal information typically protected under the US constitution—GPS data pulled largely from cell phones, in particular—is a widespread practice throughout the intelligence community (of which, notably, the FBI is a member).

The report deems the data being actively collected by the US government to be both “sensitive and intimate.” In the wrong hands, a group of former spies turned advisers to Haines wrote, Americans would be vulnerable to serious crimes like harassment, identity theft, and blackmail. Intelligence agencies collect this data, nevertheless, the report states, using a legal theory that paying for it removes any need to obtain a search warrant.

Privacy experts at digital rights groups, including Demand Progress and the American Civil Liberties Union, consider this practice a legal loophole at odds with the US Constitution's goal of protecting against unlawful searches and seizures. Many lawmakers, including Jayapal and Lofgren, feel similarly.

Wray went on to explain that his story had not changed since he first disclosed the purchases in March and that the FBI was not actively purchasing location data at this moment. It is unclear what exactly became of the data it did purchase or how it was used, if at all. The FBI has said the data was collected by private companies for advertising purposes and that it was acquired by the government for a vague “pilot project.” An FBI spokesperson did not immediately respond to a request for comment.

The protection of location and web browsing data were not the only concern raised by lawmakers Wednesday. Republican Thomas Massie would also pepper Wray with questions about another FBI request for “gun purchase records” reportedly issued to a major US bank. The records, Massie claimed, had “no geographical boundaries,” meaning the request was likely not limited to a particular area, city, or state.

Wray resisted the questions, as he had for most of the hearing. “What I do know,” the director said, “is that a number of business community partners all the time—including financial institutions–share information with us about possible criminal activity.” Massie then asked Wray to clarify whether the bank had volunteered the data or whether the FBI had requested it first.

Wray declined to respond to the question, saying he could not “speak to specifics.”

Wray was not entirely opposed to the idea of bettering privacy protections for at least some Americans. Law enforcement officers, he noted, face threats of violence every day as a result of being doxed online. “The more information, personalized information, about law enforcement professionals that is on the internet, the more people who may be unstable or inclined to violence there are out there who can choose to act on it,” he said.

But police officers, who are armed and trained to defend themselves from a variety of dangers, are not the only people who face such threats. As past reporting has shown, however, they are, on occasion, the ones who are doing the doxing.

Separately, another House committee on Thursday advanced an amendment to a “must-pass” defense spending bill that would order all US military departments to forgo purchasing data that would “otherwise require a warrant, court order, or subpoena.” This would include the same type of location-based purchases previously acknowledged by the FBI, though the FBI itself is not bound by the amendment. The new law would, instead, cover roughly half of the US intelligence community’s 17 members—those, such as the National Security Agency and Office of Naval Intelligence, that fall under the Defense Department’s umbrella.

Previously, several agencies reporting to the Defense Department, including special operations teams and the Defense Intelligence Agency, have acknowledged purchasing commercial data that would normally have required a warrant.

Whether the defense amendment—introduced by Warren Davidson, a Republican—will survive Congress and eventually become law is impossible to say at this juncture. But the fact that it was adopted by the House of Representatives at all is nothing short of a watershed moment for privacy defenders; a reflection of the growing unease among US lawmakers with the government's current outlook on its authority to warrantlessly surveil its own citizens.

FBI Surveillance Fears Are Uniting a Badly Broken Congress

Microsoft says hackers somehow stole a cryptographic key, perhaps from its own network, that let them forge user identities and slip past cloud defenses.

For most IT professionals, the move to the cloud has been a godsend. Instead of protecting your data yourself, let the security experts at Google or Microsoft protect it instead. But when a single stolen key can let hackers access cloud data from dozens of organizations, that trade-off starts to sound far more risky.

Late Tuesday evening, Microsoft revealed that a China-based hacker group, dubbed Storm-0558, had done exactly that. The group, which is focused on espionage against Western European governments, had accessed the cloud-based Outlook email systems of 25 organizations, including multiple government agencies.

Those targets encompass US government agencies including the State Department, according to CNN, though US officials are still working to determine the full scope and fallout of the breaches. An advisory from the US Cybersecurity and Infrastructure Security Agency says the breach, which was detected in mid-June by a US government agency, stole unclassified email data “from a small number of accounts.”

China has been relentlessly hacking Western networks for decades. But this latest attack uses a unique trick: Microsoft says hackers stole a cryptographic key that let them generate their own authentication “tokens”—strings of information meant to prove a user’s identity—giving them free rein across dozens of Microsoft customer accounts.

“We put trust in passports, and someone stole a passport-printing machine,” says Jake Williams, a former NSA hacker who now teaches at the Institute for Applied Network Security in Boston. “For a shop as large as Microsoft, with that many customers impacted—or who could have been impacted by this—it’s unprecedented.”

In web-based cloud systems, users’ browsers connect to a remote server and, when they enter credentials like a username and password, they’re given a bit of data, known as a token, from that server. The token serves as a kind of temporary identity card that lets users come and go as they please within a cloud environment while only occasionally reentering their credentials. To ensure that the token can’t be spoofed, it’s cryptographically signed with a unique string of data known as a certificate or key that the cloud service possesses, a kind of unforgeable stamp of authenticity.

Microsoft, in its blog post revealing the Chinese Outlook breaches, has described a kind of two-stage breakdown of that authentication system. First, hackers were somehow able to steal a key that Microsoft uses to sign tokens for consumer-grade users of its cloud services. Second, the hackers exploited a bug in Microsoft’s token validation system, which allowed them to sign consumer-grade tokens with the stolen key and then use them to instead access enterprise-grade systems. All of this occurred despite Microsoft’s attempt to check for signatures from different keys for those different grades of token.

Microsoft says it has now blocked all tokens that were signed with the stolen key and replaced the key with a new one, preventing the hackers from accessing victims’ systems. The company adds that it has also worked to improve the security of its “key management systems” since the theft occurred.

But exactly how such a sensitive key, allowing such broad access, could be stolen in the first place remains unknown. WIRED contacted Microsoft, but the company declined to comment further.

In the absence of more details from Microsoft, one theory of how the theft occurred is that the token-signing key wasn’t in fact stolen from Microsoft at all, according to Tal Skverer, who leads research at the security Astrix, which earlier this year uncovered a token security issue in Google’s cloud. In older setups of Outlook, the service is hosted and managed on a server owned by the customer rather than in Microsoft’s cloud. That might have allowed the hackers to steal the key from one of these “on-premises” setups on a customer’s network.

Then, Skverer suggests, hackers might have been able to exploit the bug that allowed the key to sign enterprise tokens to gain access to an Outlook cloud instance shared by all the 25 organizations hit by the attack. “My best guess is that they started from a single server that belonged to one of these organizations,” says Skverer, “and made the jump to the cloud by abusing this validation error, and then they got access to more organizations that are sharing the same cloud Outlook instance.”

But that theory doesn’t explain why an on-premises server for a Microsoft service inside an enterprise network would be using a key that Microsoft describes as intended for signing consumer account tokens. It also doesn’t explain why so many organizations, including US government agencies, would all be sharing one Outlook cloud instance.

Another theory, and a far more troubling one, is that the token-signing key used by the hackers was stolen from Microsoft’s own network, obtained by tricking the company into issuing a new key to the hackers, or even somehow reproduced by exploiting mistakes in the cryptographic process that created it. In combination with the token validation bug Microsoft describes, that may mean it could have been used to sign tokens for any Outlook cloud account, consumer or enterprise—a skeleton key for a large swath, or even all, of Microsoft’s cloud.

The well-known web security researcher Robert “RSnake” Hansen says he read the line in Microsoft’s post about improving the security of “key management systems” to suggest that Microsoft’s “certificate authority”—its own system for generating the keys for cryptographically signing tokens—was somehow hacked by the Chinese spies. “It’s very likely there was either a flaw in the infrastructure or configuration of Microsoft’s certificate authority that led an existing certificate to be compromised or a new certificate to be created,” Hansen says.

If the hackers did in fact steal a signing key that could be used to forge tokens broadly across consumer accounts—and, thanks to Microsoft’s token validation issue, on enterprise accounts, too—the number of victims could be far greater than 25 organizations Microsoft has publicly accounted for, warns Williams.

To identify enterprise victims, Microsoft could look for which of their tokens had been signed with a consumer-grade key. But that key could have been used to generate consumer-grade tokens, too, which might be far harder to spot given that the tokens might have been signed with the expected key. “On the consumer side, how would you know?” Williams asks. “Microsoft hasn’t discussed that, and I think there’s a lot more transparency that we should expect.”

Microsoft’s latest Chinese spying revelation isn’t the first time state-sponsored hackers have exploited tokens to breach targets or spread their access. The Russian hackers who carried out the notorious Solar Winds supply chain attack also stole Microsoft Outlook tokens from victims’ machines that could be used elsewhere on the network to maintain and expand their reach into sensitive systems.

For IT administrators, those incidents—and particularly this latest one—suggest some of the real-world trade-offs of migrating to the cloud. Microsoft, and most of the cybersecurity industry, has for years recommended the move to cloud-based systems to put security in the hands of tech giants rather than smaller companies. But centralized systems can have their own vulnerabilities—with potentially massive consequences.

“You’re handing over the keys to the kingdom to Microsoft,” says Williams. “If your organization is not comfortable with that now, you don’t have good options.”

Source

Wired