Every DJI quadcopter broadcasts its operator's position via radio—unencrypted. Now, a group of researchers has learned to decode those coordinates.

There’s a reason consumer drones have evolved from an expensive toy into a tool of war: They can perform high-altitude surveillance, carry out reconnaissance, or even deploy weapons, with their operator safely hidden as far as miles away. But hackers are revealing that for quadcopters sold by the world’s biggest drone manufacturer, operators aren’t nearly as hidden as they might think. In fact, these small flying machines are continually broadcasting their pilots’ exact locations from the sky, and anyone with some cheap radio hardware and a newly released software tool can eavesdrop on those broadcasts and decode them to extract their coordinates.

At the Network and Distributed System Security Symposium (NDSS) in San Diego this week, researchers from Ruhr University Bochum and the CISPA Helmholtz Center for Information Security demonstrated that they were able to reverse engineer the radio signals of drones sold by DJI, the leading manufacturer of consumer quadcopter drones, to decode a radio protocol they use called DroneID. By deconstructing this signal, the researchers could see that every DJI drone’s DroneID communications transmit not only its own GPS location and a unique identifier for that drone, but also the GPS coordinates of its operator.

A screenshot of the German researchers’ tool shows how it decodes the radio broadcasts of a DJI drone to extract both the drone and operator locations.

Courtesy of Ruhr University Bochum and CISPA Helmholtz Center for Information Security

That DroneID system was designed to allow governments, regulators, and law enforcement to monitor drones and prevent their abuse. But hackers and security researchers have warned for the past year that DroneID is unencrypted and open to anyone who can receive its radio signals. The German researchers, as well as another researcher working separately at the University of Tulsa, have now shown just how completely that signal can be decoded and read, allowing any hacker who can eavesdrop on DroneID to pinpoint a drone’s hidden operator, even if that drone pilot is miles away.

The German group has released a prototype tool to receive and decode that DroneID data here.

The researchers’ findings—and their public tool—provide new evidence of the serious privacy and operational security concerns DroneID presents for operators, especially considering that DJI drones are now often used in war zones, where revealing a drone operator’s location can draw enemy fire. And while DJI has an enormous majority share of the consumer drone market, the problem will only grow when new US Federal Aviation Administration regulations go into effect in September, mandating that all consumer drones implement systems similar to DroneID.

“This is a big problem, right?” says Moritz Schloegel, one of the Ruhr University graduate researchers presenting the DroneID findings at NDSS. “You might think your drone transmits its position. But suddenly, it’s transmitting _your_ position as well. Whether you’re privacy-minded or you’re in a conflict zone, nasty stuff can happen.”

DJI’s DroneID became the subject of controversy last spring when the Ukrainian government criticized the company because Russian military forces were using DJI drones for their missile targeting and using the radio signals broadcast from Ukraine’s own DJI drones to locate Ukrainian military personnel. China-based DJI has long sold a suitcase-sized device called Aeroscope to government regulators and law enforcement agencies that allows them to receive and decode DroneID data, determining the location of any drone and its operator from as far as 30 miles away.

DJI’s DroneID and Aeroscope devices are advertised for civilian security uses, like preventing disruptions of airport runways, protecting public events, and detecting efforts to smuggle cargo into prisons. But Ukraine’s vice minister of defense wrote in a letter to DJI that Russia had repurposed Aeroscope devices from Syria to track Ukrainian drones and their operators, with potentially deadly consequences.

DJI responded by warning against any military use of its consumer drones and later cutting off all sales of its drones to both Ukraine and Russia. It also initially claimed in response to the Verge’s reporting on the controversy that DroneID was encrypted, and thus inaccessible to anyone who didn’t have its carefully controlled Aeroscope devices. But DJI later admitted to the Verge that the transmissions were _not_ in fact encrypted, after security researcher Kevin Finisterre showed that he could intercept some DroneID data with a commercially available Ettus software-defined radio.

The German researchers—who also helped debunk DJI’s initial encryption claim—have gone further. By analyzing the firmware of a DJI drone and its radio communications, they’ve reverse engineered DroneID and built a tool that can receive DroneID transmissions with an Ettus software-defined radio or even the much cheaper HackRF radio, which sells for just a few hundred dollars compared to over $1,000 for most Ettus devices. With that inexpensive setup and their software, its possible to fully decode the signal to find the drone operator’s location, just as DJI’s Aeroscope does.

While the German researchers only tested their radio eavesdropping on a DJI drone from ranges of 15 to 25 feet, they say they didn’t attempt to optimize for distance, and they believe they could extend that range with more engineering. Another hacker, University of Tulsa graduate researcher Conner Bender, quietly released a pre-publication paper last summer with similar findings that will be presented at the CyCon cybersecurity conference in Estonia in late May. Bender found that his HackRF-based system with a custom antenna could pick up DroneID data from hundreds or thousands of feet away, sometimes as far as three-quarters of a mile.

WIRED reached out to DJI for comment in multiple emails, but the company hasn’t responded. The former DJI executive who first conceived of DroneID, however, offered his own surprising answer in response to WIRED’s query: DroneID is working exactly as it’s supposed to.

Brendan Schulman, DJI’s former VP of policy and legal affairs, says he led the company’s development of DroneID in 2017 as a direct response to US government demands for a drone-monitoring system, and that it was never intended to be encrypted. The  FAA, federal security agencies, and Congress were strongly pushing at the time for a system that would allow anyone to identify a drone—and its operator’s location—as a public safety mechanism, not with hacker tools or DJI’s proprietary ones, but with mobile phones and tablets that would allow for easy citizen monitoring.

“As we were told in 2017 during a summer-long FAA advisory committee process, the location of the operator is an essential aspect of remote identification for US government security purposes,” Schulman says. “And the US government _wanted_ members of the public to have access to that information, just like how a car’s license plate is accessible to everyone who can see it, so they can file a report with authorities if they have concerns about how a drone is being used.”

Schulman notes that he advocated for that broadcasting system over what he saw as a far more invasive suggestion from the government, that drone makers should both broadcast operators’ locations _and_ connect all drones to a network of drone-monitoring services that would record every operator’s detailed flight records in government-accessible databases. He also notes that the DroneID issue isn’t unique to DJI:  He expects that all consumer drones will have a function similar to DroneID when the new FAA regulations take effect later this year.

But none of that changes the fact that DJI drone operators don’t expect to have their locations revealed by their drone’s radio broadcasts, says University of Tulsa’s Bender. “The average drone user definitely doesn’t know that their location is being broadcasted in a way anyone with a cheap receiver can view in real time,” Bender says. He adds that DJI’s handling of the issue—claiming last year that the broadcast was encrypted when it wasn’t—further confused users. “I don’t know if they intentionally marketed Aeroscope this way, but they made it seem like you could really only intercept DroneID with this one device. And that wasn’t the case.”

Regardless of DJI’s motives in including drone pilots’ location in the data their drones continually transmit, the fact that this location data can be intercepted—not just with DJI’s Aeroscope devices but by any knowledgeable hacker—will have a significant impact on how the world’s most common quadcopter drones are used in war zones and other adversarial settings, says August Cole, a futurist and fellow at the Scowcroft Center for Strategy and Security at the Atlantic Council.

“The ability to ID an operator of a drone is sort of the holy grail right now in terms of targeting,” Cole says. “And to be able to do this so easily, when a drone maker adds that through either intentional or unintentional engineering, it’s a pretty profound revelation for this new kind of warfare.”

This Hacker Tool Can Pinpoint a DJI Drone Operator's Exact Location

Plus: Microsoft fixes several zero-day bugs, Google patches Chrome and Android, Mozilla rids Firefox of a full-screen vulnerability, and more.

February has been a big month for security updates, with the likes of Apple, Microsoft, and Google releasing patches to fix serious vulnerabilities. Meanwhile, a number of enterprise bugs have been squashed by firms that include VMware, SAP, and Citrix. 

The flaws fixed during the month include several that were being used in real-life attacks, so it’s worth checking that your software is up to date.

Here’s everything you need to know about the security updates released this month. 

Apple iOS and iPadOS 16.3.1

Just weeks after the release of iOS 16.3, Apple issued iOS and iPadOS 16.3.1—an emergency patch to fix vulnerabilities that included a flaw in the browser engine WebKit that was already being used in attacks.

Tracked as CVE-2023-23529, the already exploited bug could lead to arbitrary code execution, Apple warned on its support page. “Apple is aware of a report that this issue may have been actively exploited,” the firm added. Another flaw patched in iOS 16.3.1 is in the Kernel at the heart of the iPhone operating system. The bug, which is tracked as CVE-2023-23514, could allow an attacker to execute arbitrary code with Kernel privileges.

Later in the month, Apple documented another vulnerability fixed in iOS 16.3.1, CVE-2023-23524. Reported by David Benjamin, a software engineer at Google, the flaw could enable a denial of service attack via a maliciously crafted certificate.

Apple also released macOS Ventura 13.2.1, tvOS 16.3.2, and watchOS 9.3.1 during the month.

Microsoft 

In mid-February, Microsoft warned that its Patch Tuesday has fixed 76 security vulnerabilities, three of which are already being used in attacks. Seven of the flaws are marked as critical, according to Microsoft’s update guide.

Tracked as CVE-2023-21823, one of the most serious of the already exploited bugs in the Windows graphics component could allow an attacker to gain System privileges.

Another already exploited flaw, CVE-2023-21715, is a feature bypass issue in Microsoft Publisher, while CVE-2023-23376 is a privilege escalation vulnerability in Windows common log file system driver.

That’s a lot of zero-day flaws fixed in one release, so take it as a prompt to update your Microsoft-based systems as soon as possible.

Google Android 

Android’s February security update is here, fixing multiple vulnerabilities in devices running the tech giant’s smartphone software. The most severe of these issues is a security vulnerability in the Framework component that could lead to local escalation of privilege with no additional privileges needed, Google noted in an advisory. 

Among the issues fixed in the Framework, eight are rated as having a high impact. Meanwhile, Google has squashed six bugs in the Kernel, as well as flaws in the System, MediaTek, and Unisoc components.

During the month, Google patched multiple privilege escalation flaws, as well as information disclosure and denial of service vulnerabilities. The company also released a patch for three Pixel-specific security issues. The Android February patch is already available for Google’s Pixel devices, while Samsung has moved quickly to issue the update to users of its Galaxy Note 20 series.

Google Chrome 

Google has released Chrome 110 for its browser, fixing 15 security vulnerabilities, three of which are rated as having a high impact. Tracked as CVE-2023-0696, the first of these is a type confusion bug in the V8 JavaScript engine, Google wrote in a security advisory. 

Meanwhile, CVE-2023-0697 is a flaw that allows inappropriate implementation in full-screen mode, and CVE-2023-0698 is an out-of-bounds read flaw in WebRTC. Four medium-severity vulnerabilities include a use after free in GPU, a heap buffer overflow flaw in WebUI, and a type confusion vulnerability in Data Transfer. Two further flaws are rated as having a low impact.

Apple Users Need to Update iOS Now to Patch Serious Flaws

New details reveal that Beijing-backed hackers targeted the Association of Southeast Asian Nations, adding to a string of attacks in the region.

In May 2022, Joe Biden was on a charm offensive. The US president invited the leaders of 10 Southeast Asian nations to the White House for the first time for talks about the region, which is home to more than 600 million people. High on the agenda was China—a key trading partner for all the countries, but also a potential threat to their stability. Biden promised $150 million in extra support for the nations to help improve their security, infrastructure, and ongoing pandemic response. 

However, in the weeks leading up to the meeting, according to a cybersecurity alert seen by WIRED, hackers working on behalf of China were stealing thousands of emails and sensitive details from the Southeast Asian nations. The cyberespionage, which has not been previously reported, is the latest in a string of incidents where Chinese-linked hackers have quietly compromised neighboring countries, looking to gain political and economic information.

According to the cybersecurity alert, Chinese-linked hackers were able to break into mail servers operated by the Association of Southeast Asian Nations (ASEAN) in February 2022 and steal a trove of data. The ASEAN organization is an intergovernmental body made up of 10 Southeast Asian countries, including Singapore, Malaysia, and Thailand. This was the third time the organization has been compromised since 2019, the document says.

The hackers were able to steal “gigabytes” of emails sent by ASEAN countries, and the data was stolen “daily,” according to the cybersecurity alert. It’s believed that the attackers stole more than 10,000 emails, making up more than 30 GB of data. The incident “impacts all ASEAN members due to correspondence that was compromised,” the alert says. The notification was sent to cybersecurity agencies, foreign affairs ministries, and other governmental organizations in all 10 of the ASEAN member countries. 

Haji Amirudin Abdul Wahab, the CEO of CyberSecurity Malaysia, an agency under the country’s Ministry of Science, Technology, and Innovation, says it received the alert in 2022, notified officials within the country, and generally condemns hacking. Other nations impacted declined to comment or did not respond to WIRED’s request for comment. The ASEAN group itself did not respond to repeated requests for comment. 

China's embassy in the US did not immediately respond to a request for comment.

Amplified Voices, Quiet Theft

“ASEAN is really important as the key regional grouping, not just in Southeast Asia but beyond,” says Susannah Patton, director of the Southeast Asia Program at Australian think tank the Lowy Institute. Patton explains that ASEAN helps coordinate Southeast Asian policies across a number of different areas. “Even beyond Southeast Asia, ASEAN has an important role because it convenes or organizes other big regional summits,” Patton says. As a result, the data it holds could be useful for understanding political feelings in the region.

ASEAN helps to “amplify” the voices of the 10 member countries that are involved in it, says Scot Marciel, an Oksenberg-Rohlen Fellow at Stanford University and former US ambassador to Indonesia and Myanmar. The group holds both formal meetings and informal conversations, Marciel says, and will discuss everything from economic integration and infrastructure plans to trade negotiations and geopolitics. “That would all be stuff that I would think Beijing would be interested in,” Marciel says.

China Is Relentlessly Hacking Its Neighbors

Plus: Iran’s secret torture black sites, hacking a bank account with AI-generated voice, and Lance Bass’ unhinged encounter in Russia.

Late last week, Twitter announced that it would no longer allow users to secure their accounts using SMS-based two-factor authentication (2FA) unless users paid for its Twitter Blue subscription—a move that’s baffled security experts. It’s especially confusing because SMS 2FA is widely considered to be one of the less secure multi-factor authentication options. Fortunately, Twitter will still allow anyone to use other 2FA options, including authentication apps and physical security keys. Here’s how to switch away from SMS 2FA.

Physical security keys are one of the most secure methods of multi-factor authentication. But they’re not just for logging in to Twitter. You can also unlock your iPhone using a physical key in just a few steps. Unlocking a device isn’t the only security issue iPhone users need to worry about. Research published this week details a new class of bugs that affected Apple’s iOS and macOS that could have potentially allowed an attacker to access a target’s message, photos, and call histories. So if you haven’t updated to the latest version of those operating systems, now is the time.

If anyone knows what it’s like to be targeted by hackers, it’s Ukraine. Over the past year, the country’s systems have faced an unprecedented Russian bombardment of data-destroying “wiper” malware, according to multiple cybersecurity firms. Researchers say Russia unleashed more wipers on Ukraine than at any point in its long-running cyberwar against its neighbor. The only upside—if you can call it that—is that the newly discovered wipers are less destructive than earlier Russian wipers, especially compared to NotPetya, which Russia unleashed on Ukraine in 2017. The malware spread around the world, causing a still-unmatched $10 billion in damage.

In addition to cyberattacks, Russia’s war has also severely impacted Ukraine’s electric grid, which has caused blackouts and internet outages. To keep themselves online and connected to each other and the world, Ukrainians have increasingly turned toward high-capacity lithium-ion batteries to keep cell phone towers online when Russia attacks Ukraine’s electric grid. 

Elsewhere in the world, China hawks in the US Congress continue to gather support for a nationwide ban on TikTok, which is owned by China-based ByteDance. The intense focus on a single app, which TikTok critics claim is a national security threat, has some wondering why lawmakers care so much about Americans’ privacy when it comes to TikTok but not US-based tech firms. The answer? Silicon Valley is our friend, China isn’t.

That notion doesn’t always ring true, however. Mozilla researchers this week say they found rampant inaccuracies in the privacy claims app developers make on Google Play’s Data Safety labels. Facebook received a “poor” grade from Mozilla, while Google’s YouTube, Gmail, and Google Maps apps ranked as “needs improvement.” 

But that’s not all. Each week, we round up the security news we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

On Tuesday, TechCrunch reported that the US Department of Defense had secured an unprotected server that had been leaking internal US military emails to anyone who knew where to look. The server was hosted on Microsoft’s Azure and was part of an internal government mailbox system that stored terabytes of internal military emails. According to TechCrunch, a simple misconfiguration allowed anyone who knew the server’s IP address access the sensitive data using only a web browser—no password needed.

The exposed server was discovered by security researcher Anurag Sen, who provided the details to TechCrunch. The data had been exposed for two weeks, but it’s unclear if anyone other than Sen accessed it while it was available.

US Special Operations Command’s spokesperson Ken McGraw told TechCrunch that an investigation is underway. “We can confirm at this point \[that\] no one hacked US Special Operations Command’s information systems,” said McGraw.

In an investigation published Tuesday, CNN pinpointed the locations of more than three dozen black sites across Iran where protesters were brutally tortured. According to the report, many are undeclared prisons inside government facilities or makeshift jails in warehouses. Some are even in the basements of mosques. Survivors of torture at these sites told CNN that the brutality they faced was unprecedented: electrocutions, removal of nails, lashings, beatings, and sexual violence.

Iran was rocked by protests last year during the Mahsa Amini uprising, which prompted a spread of black sites around Iran’s capital city, Tehran. According to the investigation, these unofficial detention centers were instrumental in making torture systematic and laid the groundwork for scores of death sentences against protesters. More than 100 protesters have been charged with crimes that carry the death sentence.

CNN reached out to the Iranian government for comment on the allegations of torture in their secret prisons but has not received a response.

On Thursday, Vice reporter Joseph Cox detailed how he was able to break into his bank account using an AI-generated voice. Banks across the US and Europe have implemented so-called “voice verification” technology that lets customers log in to their bank accounts over the phone. While advertised as a safe and convenient form of authentication, Cox’s experiment demonstrates a very real, albeit rare, attack that fraudsters could exploit to access bank accounts.  

Using a free voice creation service to spoof his own voice, Cox gained entry into his account at Lloyds Bank. To do this, all he had to do was record about five minutes of speech and upload it to the service. Within minutes, the service spit out a synthetic voice capable of fooling his bank’s voice verification software. Lloyds Bank told Vice that it is aware of the threat of synthetic voices and is deploying countermeasures. 

In an interview with Ars Technica, Lance Bass, a former member of NSYNC, recalled how he was held at gunpoint by Russian officials after failing to secure funding for a trip to space. In 2002, the singer was scheduled to spend 10 days aboard the International Space Station alongside two cosmonauts. When the singer and his production team couldn’t come up with $20 million to finance the trip, he says that Russian officials threatened him at gunpoint. 

“There were a lot of problems with Russia and Hollywood in trying to make this happen,” Bass told Ars. “There were even a couple of weekends that I would get kicked off the base in Russia. They would put a gun to my head and be like, ‘Where’s the money? Where’s the money?’”

Bass never ended up going to space.

Security News This Week: Sensitive US Military Emails Exposed

Mozilla researchers found that apps often provide inaccurate data use disclosures, giving people “a false sense of security.”

It's basically impossible to keep track of what all your mobile apps are doing and what data they share with whom and when. So over the past couple of years, Apple and Google have both added mechanisms to their app stores meant to act as a sort of privacy nutrition label, giving users some insight into how apps behave and what information they may share. These transparency tools, though, are populated with self-reported information from app developers themselves. And a new study focused on the Data Safety information in Google Play indicates that the details developers are providing are often inaccurate.

Researchers from the nonprofit software group Mozilla looked at the Data Safety information of Google Play's top 40 most-downloaded apps and rated these privacy disclosures as “poor,” “needs improvement,” or “OK.” The assessments were based on the degree to which the Data Safety information did or did not align with the information in each app's privacy policy. Sixteen of the 40 apps, including Facebook and Minecraft, received the lowest grade for their Data Safety disclosures. Fifteen apps received the middle grade. These included the Meta-owned apps Instagram and WhatsApp, but also the Google-owned YouTube, Google Maps, and Gmail. Six of the apps were awarded the highest grade, including Google Play Games and _Candy Crush Saga_.

“When you land on Twitter’s app page or TikTok’s app page and click on Data Safety, the first thing you see is these companies declaring that they don’t share data with third parties. That’s ridiculous—you immediately know something is off,” says Jen Caltrider, Mozilla’s project lead. “As a privacy researcher, I could tell this information was not going to help people make informed decisions. What’s more, a regular person reading it would most certainly walk away with a false sense of security.”

Google mandates that all app developers submitting to Google Play complete the Data Safety form. The rationale is that the developers are the ones who have the information on how their product handles data and interacts with other parties, not the app store that facilitates distribution. 

“If we find that a developer has provided inaccurate information in their Data Safety form and is in violation of the policy, we will require the developer to correct the issue to comply. Apps that aren’t compliant are subject to enforcement actions,” Google told the Mozilla researchers. The company did not address questions from WIRED about the nature of these enforcement actions or how often they have been taken.

Google refutes the researchers' methodology, though. “This report conflates company-wide privacy policies that are meant to cover a variety of products and services with individual Data Safety labels, which inform users about the data that a specific app collects,” the company says in a statement. “The arbitrary grades Mozilla Foundation assigned to apps are not a helpful measure of the safety or accuracy of labels given the flawed methodology and lack of substantiating information.”

In other words, Google is saying that the Mozilla researchers misunderstood the scope of the privacy policies they were looking at or even consulted the wrong policies entirely. But the researchers say the privacy policies they used in their analysis are the exact policies each app developer links to on Google Play, indicating that they apply to the apps in question.

“Google's own response to our research highlights the exact problem we highlighted,” Mozilla's Caltrider says. “What information are consumers to trust and rely on if the self-reported information from app developers in the Data Safety section is different from the privacy policies linked on the same app page? Ultimately, our goal is to help Google give consumers what they need to make informed decisions about their privacy. This starts with Google improving their Data Safety information.”

The report also lays out how Google's current Data Safety form creates blind spots and opportunities for developers to leave out information about how their apps behave and share user data. For example,  the form has broad exemptions for app developers to report data sharing with “service providers” and for “specific legal purposes.” And the researchers found that the definitions Google uses for the words “collection” and “sharing” are narrow, meaning that developers may not be required to report activity that users would think of as data collection and sharing. Additionally, the researchers note that Google doesn't require app developers to disclose data collection when the information is being anonymized. This is noteworthy because of debates over whether it is possible to truly anonymize data as well as a long track record of app developers making mistakes or using flawed schemes in their attempts to anonymize data.

Both Google and Mozilla's researchers note that Google Play's Data Safety mechanism is still new. And the researchers say it can be refined to be a valuable indicator for users. Without urgent reform, though, they argue that the Data Safety information is currently doing more harm than good by giving users an inaccurate privacy picture of what's going on inside their apps.

You Can’t Trust App Developers’ Privacy Claims on Google Play

With Russia regularly knocking out Ukraine’s power grid, the country has turned to high-capacity batteries to keep it connected to the world—and itself.

In January 2022, Valeria Shashenok uploaded a TikTok video of herself playing tourist in Paris: red beret, fresh croissants, posing in front of the Eiffel Tower. A month later, her videos took on a much different character: Touring the bombed-out buildings of her town, Chernihiv, Ukraine; racing for cover as the air raid sirens sounded; reviewing the military rations served in her local bomb shelter.

Through the next year, Shashenok’s social media documented her life in the early days of the war, before seeking refuge in Western Europe—and then returning to Ukraine. In October, Shashenok uploaded a video promising to show her followers “how people live without electricity in Ukraine.” More than 3 million people watched the tour of her darkened city, all set to George Michael’s “Careless Whisper.”

Since Russia invaded Ukraine a year ago tomorrow, it has worked feverishly to stop Ukrainians like Shashenok from broadcasting to the world. Yet, even with the power out, Shashenok continued streaming to the world. The enormous work that has gone on behind the scenes to make that possible is a story of resiliency, planning, and batteries.

In the early days of the war, Russian airstrikes hit cell towers, hackers targeted Ukrainian internet service providers, and soldiers cut fiber optic cables. In the areas that Russian forces managed to occupy, internet traffic was rerouted through Russia’s heavily censored and aggressively monitored version of the internet. As the war raged on—and Moscow’s territorial ambitions were rebuffed by fierce Ukrainian resistance—Moscow resorted to even more desperate tactics, like shelling energy infrastructure, plunging Ukrainians like Shashenok into the dark.

“One thing that was demonstrated by the war is how important communication is for us,” Yurii Shchyhol, the head of Ukraine’s State Service for Special Communications and Information Protection, said in a media briefing last month. “When it’s up and running, everyone thinks that everything is normal—and this is how things should be. But when the communication disappears, we realize that we cannot get in touch with our loved ones, with our relatives.”

From the first month of Russia’s full-scale invasion, SpaceX’s Starlink service helped keep Ukraine online, even as the country’s communication infrastructure was being knocked offline. “We cannot ignore the fact that Starlink has been the signal of life for Ukraine,” Olha Stefanishyna, a deputy prime minister of Ukraine, told journalists late last year. “Our government has been able to be operational because I had Starlink over my head.”

While Starlink has been a critical stopgap, Kyiv has turned its attention to getting its regular infrastructure back up and running—thanks in no small part to SpaceX CEO Elon Musk’s hot-and-cold routine with Ukraine. Just this month, SpaceX president and chief operating officer Gwynne Shotwell said the company cut off Ukraine from using Starlink to connect its fleet of drones.

“Given this huge range of instability in the position of the SpaceX CEO—from the willingness and then unwillingness to continue financial support—we’re doing contingency planning for ourselves,” Stefanishyna said.

That’s where Shchyhol’s ministry comes in. Working with private industry, his agency has laid or repaired 3,200 kilometers of fiber optic cable and built or rebuilt 1,500 mobile base stations—another name for cell towers—since the war began. That work has returned Ukraine’s mobile communications to about 77 percent of its pre-war capacity. The biggest problems are in the areas along the front lines, such as Zaporizhzhya and Odessa, and towns occupied by the Russians in Luhansk and Donetsk regions. 

Kherson, which was liberated in November, has had a particularly hard time getting back online. “When the occupiers leave the occupied areas of Ukraine, they destroy the base stations, they destroy the fiber optic cables. So in the south of the country, we rebuilt the internet from scratch,” Shchyhol said during the press conference, adding that they have managed to repair about 20 percent of Kherson’s infrastructure. That’s only one part of the challenge, Shchyhol said. There’s still “the issue of electric power supply.”

Mobile base stations are normally hooked up to the power grid, using that electricity to amplify the cell signal to the broader area. During a power outage, an on-site battery kicks in to keep the tower running. If the outage persists, a crew could arrive with a diesel generator to keep powering the tower. That means Shashenok can keep uploading TikToks by candlelight in her neighborhood restaurant.

But Ukraine hasn’t just experienced a few short outages. Since October, it has faced an onslaught of attacks against its power grid, causing long periods of darkness. Ukraine responded by outfitting around 5,000 base stations with better generators. But those generators, and the diesel they rely on, are increasingly scarce, expensive, and in high demand everywhere in Ukraine. But they’ve been necessary, as the old lead batteries attached to its base stations only run for two or three hours, if that.

So Kyiv has turned to a simple solution: better batteries.

High-capacity lithium-ion batteries mean the base stations, Shchyhol said, “should have reserve power sources for at least three days.” And they can recharge themselves when the power comes back online.

Two of the biggest telecommunications firms in Ukraine have, between them, already sourced and installed 22,000 new high-capacity batteries. Shchyhol said his ministry has identified another 8,000 base stations that need to become “energy independent.” With demand for those batteries only increasing as Russia mounts a more serious offensive to break a stalemate in eastern Ukraine, there is a scramble to source more. And not every cell company is about to source tens of thousands of those batteries on their own.

“The main reason why we can still talk and have access to the internet, first of all, is because we have a very diverse market of internet providers,” says Vitaliy Moroz, a Kyiv-based outreach and support consultant for cybersecurity firm eQualitie. “This is quite a good situation for the customers because they can switch from one ISP to another.”

The Montreal-based firm has stood up an array of tools to help Ukrainians defend themselves against Russian cyberattacks and connect Ukrainians living under occupation to uncensored news and information, creating peer-to-peer connections that aren’t reliant on local internet access.

Late last year, eQualitie began crowdfunding to source batteries for some smaller ISPs in Ukraine. The money they raised helped them buy 172 batteries from Poland—the shipment weighed about 6.5 tons. Some of those batteries went to a small ISP in Chernihiv, which services hundreds of large residential buildings in the north-central Ukrainian city. ”With just five batteries, which they received within this donation, it means that tens of thousands of residents of Chernihiv remain connected,” Moroz says—residents like Valeria Shashenok.

“The issue of connectivity is not very clear for everyone,” Moroz says the morning after another wave of airstrikes on the country’s energy grid. “Ukrainians have, for example, apps or websites where they can follow all the air alarms, which may happen almost every day.”

Internet and mobile service in Ukraine is surprisingly good, even by American standards. Moroz points out that for about $8 per month, Ukrainians can get download speeds of around 100 megabytes per second. “People now need immediate information. They want to know, right now, what's happening,” he says. “So access to internet … means security for people, it means being connected with their families and friends.”

Staying connected also means staying hopeful.

When the Ukrainian Army liberated Izium, which is near the border of Dontesk, they also liberated the residents from Russian propaganda—the only source of news for many in the city. “They believed Kharkiv was also surrounded by Russians. And it was under Russian control, which is not true,” Moroz says. 

“So all this, the combined efforts to keep Ukraine connected, is because everyone understands that the ultimate goal of Russia is to demoralize civilians—because if civilians are demoralized, the government will lose support,” Moroz says. “Instead, it’s the opposite: Civilians realize they might have some hardship in their lives, but still they manage to build their lives around all these difficulties.”

eQualitie is still raising money to purchase a new shipment of batteries to Ukraine. Shchyhol, meanwhile, is bullish that he could get Ukraine’s mobile networks back to 100 percent.

But, like many aspects of this war, Ukraine continues preparing for the worst. Late last year, after waves of brutal assaults on Ukraine’s cities and critical infrastructure, president Volodmyr Zelensky announced the creation of thousands of Points of Invincibility across the country—in government buildings, pharmacies, gas stations, and banks.

“All basic services will be there, including electricity, mobile communications and the Internet, heat, water, and a first-aid kit,” Zelensky posted on Telegram. “Absolutely free and 24/7.” The sites will be powered by generators and connected to the world via Starlink.

“This is what the Russian flag means—complete desolation,” Zelensky said in another address in November. “There is no electricity, no communication, no internet, no television. The occupiers destroyed everything themselves—on purpose.”

Batteries Are Ukraine’s Secret Weapon Against Russia

Lawmakers are increasingly hellbent on punishing the popular social network while efforts to pass a broader privacy law have dwindled.

“We hope that Congress will explore solutions to their concerns about TikTok that won’t have the effect of censoring the voices of millions of Americans,” says TikTok spokesperson Brooke Oberwetter. “The swiftest and most thorough way to address national security concerns is for CFIUS to adopt the proposed agreement that we worked with them on for nearly two years. That plan includes layers of government and independent oversight to ensure that there are no backdoors into TikTok that could be used to access data or manipulate the platform. These measures go beyond what any peer company is doing today on security.”  

Over in the House, Rubio’s tough-on-tech allies just got new job titles and powers. Representatives Mike Gallagher of Wisconsin, a Republican, and Raja Krishnamoorthi of Illinois, a Democrat, are now the chair and ranking member, respectively, of the new House Select Committee on China established by Speaker Kevin McCarthy. While their new roles go beyond tech and TikTok, the two are eager to use their new perch to punish TikTok, in part, for stonewalling Congress.

“Part of the reason there’s not good data is \[that\] TikTok hasn’t responded to basic questions,” says Gallagher, who’s advocating for TikTok to be fully divested from ByteDance. “We’ve asked for transparency around their algorithms in general. There’s this question about how they intended to use their location tracking service that they would never really answer.”

Bipartisanship has been key to anti-TikTok efforts, but conservatives—and the GOP’s powerful messaging machine—have rallied around what, to them, is a glaring new national security threat. While US tech firms are now the punching bag for America’s right who accuse them of “censoring” them, most Republicans say this TikTok debate supersedes domestic political and corporate squabbles. They say there’s no comparing Silicon Valley to ByteDance.

“Can we just admit that the Chinese Communist Party is an adversary and Silicon Valley is not an actual adversary?” says senator Kevin Cramer of North Dakota, a Republican. “There are similar issues, but they’re not the exact same issues. The Chinese Communist Party is an adversary. Silicon Valley is an unruly child.”

Whether the fears are warranted or ungrounded, Congress isn’t even having the right debate, according to Senate Finance Committee chair Ron Wyden, a Democrat from Oregon. “Banning TikTok would be a godsend for sleazy rip-off data brokers,” the Oregon Democrat says. “TikTok is one piece of the puzzle, but don’t miss the overall challenge—because until you reign in these data brokers … you’re going to have all kinds of people’s personal data in America still on its way to China and hostile powers.”

Nevertheless, bipartisan anti-TikTok energy remains palpable in DC, especially because the app is so popular, with around 113 million users in the US, according to web analytics firm Statista. And with Beijing’s proven willingness to use technology to control its own citizens, US policymakers fear the CCP will soon distort the world for millions of unsuspecting Americans. 

“If you can dial these algorithms to say what kind of content \[people see\], it’s hugely problematic in terms of a propaganda tool,” Warner, the Senate Intelligence Committee chair, says.  

Warner supports reining TikTok in, but he remains skeptical of these new efforts to outright ban the app. He’s been left holding his tongue while awaiting more detailed information and a potential policy solution from the Justice Department. It’s not an either-or, though, according to privacy advocates in Congress. While they argue TikTok is the immediate concern, they also want to regulate Silicon Valley.

“I think there’s a need for both. We still need to get a big privacy bill,” Democratic senator Maria Cantwell of Washington says.

Cantwell chairs the Senate Commerce Committee, which is where many of these bipartisan efforts have died, in part because she’s demanded a higher federal privacy standard—or at least one that doesn’t supersede stout state laws, like California’s—than Republicans have been willing to accept. She says the reason the TikTok ban sailed through in December is that the government funding bill was “held hostage over it” by the GOP.

“With Big Data, there can be abuses, and we need to rein it in. Period,” Cantwell says. “There’s just a lot more work to be done, and my colleagues have to have the same bipartisan zeal to address those issues.”

Why the US Congress Wants to Ban TikTok

As Russia has accelerated its cyberattacks on its neighbor, it's barraged the country with an unprecedented volume of different data-destroying programs.

Despite that sheer volume of wiper malware, Russia's cyberattacks against Ukraine in 2022 have in some respects seemed relatively ineffective compared to previous years of its conflict there. Russia has launched repeated destructive cyberwarfare campaigns against Ukraine since the country's 2014 revolution, all seemingly designed to weaken Ukraine's resolve to fight, sow chaos, and make Ukraine appear to the international community to be a failed state. From 2014 to 2017, for instance, Russia's GRU military intelligence agency carried out a series of unprecedented cyberattacks: They disrupted and then attempted to spoof results for Ukraine's 2014 presidential election, caused the first-ever blackouts triggered by hackers, and finally unleashed NotPetya, a self-replicating piece of wiper malware that hit Ukraine, destroying hundreds of networks across government agencies, banks, hospitals, and airports before spreading globally to cause a still-unmatched $10 billion in damage.

But since early 2022, Russia's cyberattacks against Ukraine have shifted into a different gear. Instead of masterpieces of malevolent code that required months to create and deploy, as in Russia's earlier attack campaigns, the Kremlin's cyberattacks have accelerated into quick, dirty, relentless, repeated, and relatively simple acts of sabotage.

In fact, Russia appears, to some degree, to have swapped quality for quantity in its wiper code. Most of the dozen-plus wipers launched in Ukraine in 2022 have been relatively crude and straightforward in their data destruction, with none of the complex self-spreading mechanisms seen in older GRU wiper tools like NotPetya, BadRabbit, or Olympic Destroyer. In some cases, they even show signs of rushed coding jobs. HermeticWiper, one of the first wiping tools that hit Ukraine just ahead of the February 2022 invasion, used a stolen digital certificate to appear legitimate and avoid detection, a sign of sophisticated pre-invasion planning. But HermeticRansom, a variant in the same family of malware designed to appear as ransomware to its victims, included sloppy programming errors, according to ESET. HermeticWizard, an accompanying tool designed to spread HermeticWiper from system to system, was also bizarrely half-baked. It was designed to infect new machines by attempting to log in to them with hardcoded credentials, but it only tried eight usernames and just three passwords: 123, Qaz123, and Qwerty123.

Perhaps the most impactful of all of Russia's wiper malware attacks on Ukraine in 2022 was AcidRain, a piece of data-destroying code that targeted Viasat satellite modems. That attack knocked out a portion of Ukraine's military communications and even spread to satellite modems outside the country, disrupting the ability to monitor data from thousands of wind turbines in Germany. The customized coding needed to target the form of Linux used on those modems suggests, like the stolen certificate used in HermeticWiper, that the GRU hackers who launched AcidRain had carefully prepared it ahead of Russia's invasion.

But as the war has progressed—and as Russia has increasingly appeared unprepared for the longer-term conflict it mired itself in—its hackers have switched to shorter-term attacks, perhaps in an effort to match the pace of a physical war with constantly changing front lines. By May and June, the GRU had come to increasingly favor the repeated use of the data-destruction tool CaddyWiper, one of its simplest wiper specimens. According to Mandiant, the GRU deployed CaddyWiper five times in those two months and four more times in October, changing its code only enough to avoid detection by antivirus tools.

Even then, however, the explosion of new wiper variants has only continued: ESET, for instance, lists Prestige, NikoWiper, Somnia, RansomBoggs, BidSwipe, ZeroWipe, and SwiftSlicer all as new forms of destructive malware—often posing as ransomware—that have appeared in Ukraine since just October.

But ESET doesn't see that flood of wipers as a kind of intelligent evolution, so much as a kind of brute-force approach. Russia appears to be throwing every possible destructive tool at Ukraine in an effort to stay ahead of its defenders and inflict whatever additional chaos it can in the midst of a grinding physical conflict. 

“You can’t say their technical sophistication is increasing or decreasing, but I would say they’re experimenting with all these different approaches,” says Robert Lipovsky, ESET's principal threat intelligence researcher. “They're all in, and they're trying to wreak havoc and cause disruption.”

Ukraine Suffered More Wiper Malware in 2022 Than Anywhere, Ever

Security researchers found a class of flaws that, if exploited, would allow an attacker to access people’s messages, photos, and call history.

For years, Apple has hardened the security systems on iPhones and Macs. But no company is immune from such issues. Research reveals a new class of bugs that can affect Apple’s iPhone and Mac operating systems and if exploited could allow an attacker to sweep up your messages, photos, and call history.

Researchers from security firm Trellix’s Advanced Research Center are today publishing details of a bug that could allow criminal hackers to break out of Apple’s security protections and run their own unauthorized code. The team says the security flaws they found—which they rank as medium to high severity—bypass protections Apple had put in place to protect users.

“The key thing here is the vulnerabilities break Apple’s security model at a fundamental level,” says Doug McKee, director of vulnerability research at Trellix. McKee says that finding the new bug class means researchers and Apple will potentially be able to find more similar bugs and improve overall security protections. Apple has fixed the bugs the company found, and there is no evidence they were exploited.

Trellix’s findings build on previous work by Google and Citizen Lab, a University of Toronto research facility. In 2021, the two organizations discovered ForcedEntry, a zero-click, zero-day iOS exploit that was linked to Israeli spyware maker NSO Group. (The exploit, described as highly sophisticated, was found on the iPhone of a Saudi activist and used to install NSO’s Pegasus malware.)

Analysis of ForcedEntry showed it involved two key parts. The first tricked an iPhone into opening a malicious PDF that was disguised as a GIF. The second part allowed attackers to escape Apple’s sandbox, which keeps apps from accessing data stored by other apps and from accessing other parts of the device. Trellix’s research, by senior vulnerability researcher Austin Emmitt, focuses on that second part and ultimately used the flaws he found to bypass the sandbox.

Specifically, Emmitt found a class of vulnerabilities that revolve around NSPredicate, a tool that can filter code within Apple’s systems. NSPredicate was first abused in ForcedEntry, and as a result of that research in 2021, Apple introduced new ways to stop the abuse. However, those don’t appear to have been enough. “We discovered that these new mitigations could be bypassed,” Trellix says in a blog post outlining the details of its research.

McKee explains that the bugs within this new NSPredicate class existed in multiple places across macOS and iOS, including within Springboard, the app that manages the iPhone’s home screen and can access location data, photos, and the camera. Once the bugs are exploited, the attacker can access areas that are meant to be closed off. A proof-of-concept video published by Trellix shows how the vulnerabilities can be exploited. 

The new class of bugs “brings a lens to an area that people haven’t been researching before because they didn’t know it existed,” McKee says. “Especially with that backdrop of ForcedEntry because somebody at that sophistication level already was leveraging a bug in this class.”

Crucially, any attacker trying to exploit these bugs would require an initial foothold into someone’s device. They would need to have found a way in before being able to abuse the NSPredicate system. (The existence of a vulnerability doesn’t mean that it has been exploited.)

Apple patched the NSPredicate vulnerabilities Trellix found in its macOS 13.2 and iOS 16.3 software updates, which were released in January. Apple has also issued CVEs for the vulnerabilities that were discovered: CVE-2023-23530 and CVE-2023-23531. Since Apple addressed these vulnerabilities, it has also released newer versions of macOS and iOS. These included security fixes for a bug that was being exploited on people’s devices. Make sure you update your iPhone, iPad, and Mac each time a new version of the operating system becomes available.

A New Kind of Bug Spells Trouble for iOS and macOS Security

Twitter is disabling SMS-based two-factor authentication. Switch to these alternatives to keep your account safe.

The latest bizarre move of Elon Musk’s Twitter ownership weakens the security of millions of accounts. On February 17, Twitter announced plans to stop people using SMS-based two-factor authentication to secure their accounts—unless they start paying for a Twitter Blue subscription. However, there are more secure, free, and easier ways to continue protecting your Twitter account with two-factor authentication.

Two-factor authentication, also known as 2FA or multi-factor authentication, is one of the most effective ways to protect your online accounts from being hacked. When logging in to a website, app, or service, 2FA requires you to sign in using your username and password, then verify that the login is authentic using another piece of information. Most commonly, this involves entering a temporary code that’s generated or sent to you in real time.

This second piece of information helps to prove that the person logging in is actually you. While billions of passwords have been compromised online, the 2FA code is often delivered to or created by the device that’s in your pocket. Having any kind of two-factor authentication turned on is better than none. However, it isn’t entirely foolproof. For years, security researchers have warned that SMS-based two-factor authentication isn’t as secure as other 2FA options.

That’s because SIM-swapping attacks, where phone numbers are compromised by attackers, let criminals access 2FA messages and break into accounts. Put simply: Using another 2FA option, even if it is slightly less convenient, is your best option.

In its announcement, Twitter said people have 30 days to turn off SMS-based 2FA and move to another option. It said the system had been abused by “bad actors” in the past. On March 20, Twitter will “disable” using text messages for two-factor authentication—unless you pay for the privilege. People have already started seeing pop-ups telling them to “remove text message two-factor authentication” before this date. 

However, Twitter’s announcement has baffled, confused, and angered security researchers. They say removing SMS-based 2FA just for people who don’t pay for Twitter Blue doesn’t make any sense and will weaken people’s security if they do not move to another 2FA option. Here’s what you should do to keep your account secure.

Use an Authenticator App or Security Key

Instead of turning 2FA off on your Twitter account, there are two better options: authenticator apps and security keys. They both work using the same principles as SMS-based 2FA. To enable either of these alternatives you will need to visit Twitter, open its **Settings and privacy**, then **Security and account access**, **Security**, and finally **Two-factor authentication**. (Or just click here if you are logged in). Here you will get the option to use two-factor authentication via an app or using security keys.

Instead of sending your six-digit authentication code via SMS message, authenticator apps are constantly generating the codes themselves and are synced with the services you use. Authenticator apps list all the websites you have registered with them and display the codes you need to enter to log in. These codes refresh every 30 seconds. Each time you need to log in to a website or app, you visit the authenticator app after entering your username and password to get the authentication code instead of waiting for a text message. (It’s particularly helpful if your phone doesn’t have connectivity for some reason.)

There are multiple, free two-factor authentication apps to pick from, although they all offer the same essential service and can be used across platforms. The big players have their own apps:There’s Google’s Authenticator App and Microsoft Authenticator. Alternatively, various password managers that you may already use, such as 1Password, have their own authenticator services. There’s also Twilio’s Authy App. And if you have an iPhone, you can use Apple’s built-in generator. 

Each has pros and cons that you should consider before picking one. For instance, you may be heavily locked into Microsoft’s or Google’s ecosystems and want to use their apps. Google’s is relatively basic but doesn’t sync elsewhere; Microsoft’s app offers password management services. However, the Microsoft and Authy apps appear to collect more user analytics data than Google’s. Whatever app you pick, it’s possible to switch to another authenticator.

Setting up an authentication app on Twitter, and anywhere else, is simple. For Twitter, you need to visit its 2FA page. Then open your authentication app, select the option to add a new account, then scan the QR Twitter shows you. Enter the six-digit code on your app and you’re done.

Alternatively, instead of an authenticator app, you can use a security key. The keys are physical pieces of hardware that you either plug into your computer when logging in or connect to your phone. They’re the most secure method of 2FA as an attacker physically needs the key to log in to your account—whereas an attacker always has the possibility of trying to trick you into handing over a generated six-digit authentication code.

Once you’ve set up an authenticator app or hardware key for Twitter, you’ll also want to make a note of Twitter’s backup code for your account. The backup code can be used to log in to Twitter if you can’t access your 2FA options, such as losing your phone or security key. (The first time you set up 2FA on Twitter it will provide you with a backup code, although this can be regenerated online.) You should save this in a safe place, such as your password manager.

Source

Wired