Plus: Cyber Command’s disruption of Iranian election hacking, an exposé on child sex trafficking on Meta’s platforms, and more.

Ransomware gangs have long sought pain points where their extortion demands have the greatest leverage. Now an investigation from NBC News has made clear what that merciless business model looks like when it targets kids: One ransomware group's giant leak of sensitive files from the Minneapolis school system exposes thousands of children at their most vulnerable, complete with behavioral and psychological reports on individual students and highly sensitive documentation of cases where they've allegedly been abused by teachers and staff.

We'll get to that. But first, WIRED contributor Kim Zetter broke the news this week that the Russian hackers who carried out the notorious SolarWinds espionage operation were detected in the US Department of Justice's network six months earlier than previously reported—but the DOJ didn't realize the full scale of the hacking campaign that would later be revealed. 

Meanwhile, WIRED reporter Lily Hay Newman was at the RSA cybersecurity conference in San Francisco, where she brought us stories of how security researchers disrupted the operators of the Gootloader malware who sold access to victims' networks to ransomware groups and other cybercriminals, and how Google Cloud partnered with Intel to hunt for and fix serious security vulnerabilities that underlie critical cloud servers. She also captured a warning in a talk from NSA cybersecurity director Rob Joyce, who told the cybersecurity industry to "buckle up" and prepare for big changes to come from AI tools like ChatGPT, which will no doubt be wielded by both attackers and defenders alike.

On that same looming AI issue, we looked at how the deepfakes enabled by tools like ChatGPT, Midjourney, DALL-E, and StableDiffusion will have far-reaching political consequences. We examined a newly introduced US bill that would ban kids under the age of 13 from joining social media. We tried out the new feature in Google's Authenticator App that allows you to back up your two-factor codes to a Google account in case you lose your 2FA device. And we opined—well, ranted—on the ever-growing sprawl of silly names that the cybersecurity industry gives to hacker groups.

But that’s not all. Each week, we round up the news we didn’t report in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

What happens when a school system is targeted by a ransomware group, refuses to pay, and thus gets their stolen data dumped wholesale onto the dark web? Well, it's even worse than it sounds, as NBC's Kevin Collier found this week when he dug through portions of a trove of 200,000 files leaked online after the Minneapolis public school system was hit by hackers earlier this year. 

The leaked files include detailed dossiers linking children by name, birth date, and address to a laundry list of highly private information: their special needs, their psychological profiles and behavioral analyses, their medications, the results of intelligence tests, and which kids' parents have divorced, among many other sensitive secrets. In some cases, the files even note which children have been victims of alleged abuse by school teachers or staff. The hackers also took special pains to publicly promote their toxic dump of children's information, with links posted to social media sites and a video showing off the files and instructing viewers how to download them.

The Minneapolis school system is offering free credit monitoring to parents and children affected by the data dump. But given the radioactive nature of the personal information released by the hackers, identity fraud may be the least of their victims' worries.

In a rare declassified disclosure at a panel at this week's RSA Conference, General William Hartman revealed that US Cyber Command had disrupted an Iranian hacking operation that targeted a local elections website ahead of the 2020 election. According to Hartman, who leads Cyber Command's National Mission Force, the intrusion couldn't have affected actual vote counts or voting machines, but—had Cyber Command's own hackers not kiboshed the operation—might have potentially been used to post false results as part of a disinformation effort. 

Hartman named the Iranian hackers as a group known as Pioneer Kitten, also sometimes referred to as UNC757 or Parisite, but didn't name the specific elections website that they targeted. Hartman added that the hacking operation was found thanks to Cyber Command's Hunt Forward operations, in which it hacks foreign networks to preemptively discover and disrupt adversaries who target the US.

Following a two-year investigation, _The Guardian_ this week published a harrowing exposé on Facebook and Instagram's use as hunting grounds for child predators, many of whom traffic in children as sexual abuse victims for money on the two social media services. Despite the claims of the services' parent company Meta that it's closely monitoring its services for child sexual abuse materials or sexual trafficking, _The_ _Guardian_ found horrific cases of children whose accounts were hijacked by traffickers and used to advertise them for sexual victimization. 

One prosecutor who spoke to _The Guardian_ said that he'd seen child trafficking crimes on social media sites increase by about 30 percent each year from 2019 to 2022. Many of the victims were as young as 11 or 12 years old, and most were Black, Latinx, or LGBTQ+.

A group of hackers has been taking over AT&T email accounts—the telecom provider runs email domains including att.net, sbcglobal.net, bellsouth.net—to hack their cryptocurrency wallets, TechCrunch reports. 

A tipster tells TechCrunch that the hackers have access to a part of AT&T's internal network that allows them to generate "mail keys" that are used to offer access to an email inbox via email applications like Thunderbird or Outlook. The hackers then use that access to reset the victims' passwords on cryptocurrency wallet services like Gemini and Coinbase, and, according to TechCrunch's source, have already amassed between $10 million and $15 million in stolen crypto, though TechCrunch couldn't verify those numbers.

The Tragic Fallout From a School District’s Ransomware Breach

Maybe you don't want your phone number, email, home address, and other details out there for all the web to see. Here's how to make them vanish.

Last year, Google expanded the ways you can submit removal requests for search results containing personal info. Before this change, people had to meet a very high bar to get results with sensitive data wiped. Finding personal details in a Google search, like a home address or phone number, can be quite frightening, but you can take action to protect your privacy.

In addition to the removal of personal information, Google is considering removal requests for images of minors, as well as deepfake pornography and other explicit content. Although getting results scrubbed from Google Search won’t remove web pages from the internet, it will divert one of the biggest drivers of traffic.

There’s no guarantee that unwanted search results will disappear completely, however. As a result of your request, the web page could be removed from all searches on Google, only searches involving your name, or none of the above. For more information about disappearing digitally and services like DeleteMe, check out WIRED’s tips on deleting yourself from the internet.

At the time of the announcement, Michelle Chang, Google’s global policy lead for search, wrote “Open access to information is a key goal of Search, but so is empowering people with the tools they need to protect themselves and keep their sensitive, personally identifiable information private.” The new procedures can protect against malicious doxxing, as well as information leaks that are only implicit threats.

To begin the removal process, visit the topic’s support page, scroll halfway down, and click the blue **Start Removal request** button. You will initially be asked whether you have reached out to the owners of the website. It is not necessary to do this, so you can just tap **No, I prefer not to**. When Google asks what you would like removed, select: **Personal info, like ID numbers and private documents**.

Then you can specify what type of personal information is showing up in Google Search, such as your contact details or driver’s license. These steps are only for removing results from live websites; there’s a separate form to fill out for cached pages. Check the box indicating that the content is live. The next question asks whether the request pertains to doxxing, which Google defines as “contact information being shared with malicious, threatening, or harassing intent.”

After that, Google requests your full name, country of residence, and email. You are only permitted to submit takedown requests for results pertaining to yourself or someone you officially represent.

You can submit up to 1,000 links at once. Google asks for the URL of the offending content or image, and the company wants you to share the search results where it shows up. For more directions on gathering these links, check out Google’s guide to finding content URLs, image URLs, and search results page URLs.

Attach a screenshot to your request showing where on the web page your personal info is appearing. Near the end of the form, you will be asked to share a list of relevant search terms, such as your full name, nickname, and maiden name. You are given the opportunity to share supplemental details before signing and submitting the removal request.

You should get a confirmation email from Google indicating that the removal request was received. It’s not clear how long it will take to review your case, but Google will let you know when it has decided to take action—or do nothing at all. The company promises to include brief explanations with any rejections and allows repeat submissions.

How to Remove Your Personal Info From Google's Search Results

In May 2020, the US Department of Justice noticed Russian hackers in its network but did not realize the significance of what it had found for six months.

The US Department of Justice, Mandiant, and Microsoft stumbled upon the SolarWinds breach six months earlier than previously reported, WIRED has learned, but were unaware of the significance of what they had found.

The breach, publicly announced in December 2020, involved Russian hackers compromising the software maker SolarWinds and inserting a backdoor into software served to about 18,000 of its customers. That tainted software went on to infect at least nine US federal agencies, among them the Department of Justice (DOJ), the Department of Defense, Department of Homeland Security, and the Treasury Department, as well as top tech and security firms including Microsoft, Mandiant, Intel, Cisco, and Palo Alto Networks. The hackers had been in these various networks for between four and nine months before the campaign was exposed by Mandiant. 

WIRED can now confirm that the operation was actually discovered by the DOJ six months earlier, in late May 2020—but the scale and significance of the breach wasn’t immediately apparent. Suspicions were triggered when the department detected unusual traffic emanating from one of its servers that was running a trial version of the Orion software suite made by SolarWinds, according to sources familiar with the incident. The software, used by system administrators to manage and configure networks, was communicating externally with an unfamiliar system on the internet. The DOJ asked the security firm Mandiant to help determine whether the server had been hacked. It also engaged Microsoft, though it’s not clear why the software maker was also brought onto the investigation.

It’s not known what division of the DOJ experienced the breach, but representatives from the Justice Management Division and the US Trustee Program participated in discussions about the incident. The Trustee Program oversees the administration of bankruptcy cases and private trustees. The Management Division advises DOJ managers on budget and personnel management, ethics, procurement, and security.

Investigators suspected the hackers had breached the DOJ server directly, possibly by exploiting a vulnerability in the Orion software. They reached out to SolarWinds to assist with the inquiry, but the company’s engineers were unable to find a vulnerability in their code. In July 2020, with the mystery still unresolved, communication between investigators and SolarWinds stopped. A month later, the DOJ purchased the Orion system, suggesting that the department was satisfied that there was no further threat posed by the Orion suite, the sources say.

A DOJ spokesperson confirmed that the incident and investigation occurred but wouldn’t provide any details about what investigators concluded. “While the incident response and mitigation effort was completed, the FBI’s criminal investigation remained open throughout,” the spokesperson wrote in an email. WIRED confirmed with sources that Mandiant, Microsoft, and SolarWinds were involved in discussions about the incident and investigation. All three companies declined to discuss the matter.

The DOJ told WIRED that it notified the US Cybersecurity and Infrastructure Agency (CISA) about the breach at the time it occurred—though a US National Security Agency spokesperson expressed frustration that the agency was not also notified. But in December 2020, when the public learned that a number of  federal agencies were compromised in the SolarWinds campaign—the DOJ among them—neither the DOJ nor CISA revealed to the public that the operation had unknowingly been found months earlier. The DOJ initially said its chief information officer had discovered the breach on December 24.

In November 2020, months after the DOJ completed the mitigation of its breach, Mandiant discovered that it had been hacked, and traced its breach to the Orion software on one of its servers the following month. An investigation of the software revealed that it contained a backdoor that the hackers had embedded in the Orion software while it was being compiled by SolarWinds in February 2020. The tainted software went out to about 18,000 SolarWinds customers, who downloaded it between March and June, right around the time the DOJ discovered the anomalous traffic exiting its Orion server. The hackers chose only a small subset of these to target for their espionage operation, however. They burrowed further into the infected federal agencies and about 100 other organizations, including technology firms, government agencies, defense contractors, and think tanks.

Mandiant itself got infected with the Orion software on July 28, 2020, the company told WIRED, which would have coincided with the period that the company was helping the DOJ investigate its breach.

When asked why, when the company announced the supply-chain hack in December, it didn’t publicly disclose that it had been tracking an incident related to the SolarWinds campaign in a government network months earlier, a spokesperson noted only that “when we went public, we had identified other compromised customers.”

The incident underscores the importance of information-sharing among agencies and industry, something the Biden administration has emphasized. Although the DOJ had notified CISA, a spokesperson for the National Security Agency told WIRED that it didn’t learn of the early DOJ breach until January 2021, when the information was shared in a call among employees of several federal agencies.

That was the same month the DOJ—whose 100,000-plus employees span multiple agencies including the FBI, Drug Enforcement Agency, and US Marshals Service—publicly revealed that the hackers behind the SolarWinds campaign had possibly accessed about 3 percent of its Office 365 mailboxes. There are conflicting reports about whether this attack was part of the SolarWinds campaign or carried out by the same actors. Six months later, the department expanded on this and announced that the hackers had managed to breach email accounts of employees at 27 US Attorneys' offices, including ones in California, New York, and Washington, DC. 

In its latter statement, the DOJ said that to “encourage transparency and strengthen homeland resilience,” it wanted to provide new details, including that the hackers were believed to have had access to compromised accounts from about May 7 to December 27, 2020. And the compromised data included “all sent, received, and stored emails and attachments found within those accounts during that time.”

The investigators of the DOJ incident weren’t the only ones to stumble upon early evidence of the breach. Around the same time of the department’s investigation, security firm Volexity, as the company previously reported, was also investigating a breach at a US think tank and traced it to the organization’s Orion server. Later in September, the security firm Palo Alto Networks also discovered anomalous activity in connection with its Orion server. Volexity suspected there might be a backdoor on its customer’s server but ended the investigation without finding one. Palo Alto Networks contacted SolarWinds, as the DOJ had, but in that case as well, they failed to pinpoint the problem.

Senator Ron Wyden, an Oregon Democrat who has been critical of the government’s failure to prevent and detect the campaign in its early stages, says the revelation illustrates the need for an investigation into how the US government responded to the attacks and missed opportunities to halt it.

“Russia’s SolarWinds hacking campaign was only successful because of a series of cascading failures by the US government and its industry partners,” he wrote in an email. “I haven’t seen any evidence that the executive branch has thoroughly investigated and addressed these failures. The federal government urgently needs to get to the bottom of what went wrong so that in the future, backdoors in other software used by the government are promptly discovered and neutralized.“

DOJ Detected SolarWinds Breach Months Before Public Disclosure

The security issues raised by ChatGPT and similar tech are just beginning to emerge, but Rob Joyce says it’s time to prepare for what comes next.

At the RSA security conference in San Francisco this week, there's been a feeling of inevitability in the air. At talks and panels across the sprawling Moscone convention center, at every vendor booth on the show floor, and in casual conversations in the halls, you just know that someone is going to bring up generative AI and its potential impact on digital security and malicious hacking. NSA cybersecurity director Rob Joyce has been feeling it too. 

“You can’t walk around RSA without talking about AI and malware,” he said on Wednesday afternoon during his now annual “State of the Hack” presentation. “I think we’ve all seen the explosion. I won’t say it’s delivered yet, but this truly is some game-changing technology."

In recent months, chatbots powered by large language models, like OpenAI's ChatGPT, have made years of machine-learning development and research feel more concrete and accessible to people all over the world. But there are practical questions about how these novel tools will be manipulated and abused by bad actors to develop and spread malware, fuel the creation of misinformation and inauthentic content, and expand attackers' abilities to automate their hacks. At the same time, the security community is eager to harness generative AI to defend systems and gain a protective edge. In these early days, though, it's difficult to break down exactly what will happen next.

Joyce said the National Security Agency expects generative AI to fuel already effective scams like phishing. Such attacks rely on convincing and compelling content to trick victims into unwittingly helping attackers, so generative AI has obvious uses for quickly creating tailored communications and materials.

“That Russian-native hacker who doesn’t speak English well is no longer going to craft a crappy email to your employees,” Joyce said. “It’s going to be native-language English, it’s going to make sense, it’s going to pass the sniff test … So that right there is here today, and we are seeing adversaries, both nation-state and criminals, starting to experiment with the ChatGPT-type generation to give them English language opportunities.”

Meanwhile, although AI chatbots may not be able to develop perfectly weaponized novel malware from scratch, Joyce noted that attackers can use the coding skills the platforms do have to make smaller changes that could have a big effect. The idea would be to modify existing malware with generative AI to change its characteristics and behavior enough that scanning tools like antivirus software may not recognize and flag the new iteration.

“It is going to help rewrite code and make it in ways that will change the signature and the attributes of it,” Joyce said. “That \[is\] going to be challenging for us in the near term.”

In terms of defense, Joyce seemed hopeful about the potential for generative AI to aid in big data analysis and automation. He cited three areas where the technology is “showing real promise” as an “accelerant for defense”: scanning digital logs, finding patterns in vulnerability exploitation, and helping organizations prioritize security issues. He cautioned, though, that before defenders and communities more broadly come to depend on these tools in daily life, they must first study how generative AI systems can be manipulated and exploited.

Mostly, Joyce emphasized the murky and unpredictable nature of the current moment for AI and security, cautioning the security community to “buckle up” for what's likely yet to come.

“I don’t expect some magical technical capability that is AI-generated that will exploit all the things,” he said. But “next year, if we’re here talking a similar year in review, I think we’ll have a bunch of examples of where it’s been weaponized, where it’s been used, and where it’s succeeded.”

NSA Cybersecurity Director Says ‘Buckle Up’ for Generative AI

No matter what happens with generative AI, its disruptive forces are already beginning to play a role in the fast-approaching US presidential race.

“It consistently amazes me that in the physical world, when we release products there are really stringent guidelines,” Farid says. “You can’t release a product and hope it doesn’t kill your customer. But with software, we’re like, ‘This doesn’t really work, but let’s see what happens when we release it to billions of people.’”

If we start to see a significant number of deepfakes spreading during the election, it’s easy to imagine someone like Donald Trump sharing this kind of content on social media and claiming it’s real. A deepfake of President Biden saying something disqualifying could come out shortly before the election, and many people might never find out it was AI-generated. Research has consistently shown, after all, that fake news spreads further than real news. 

Even if deepfakes don’t become ubiquitous before the 2024 election, which is still 18 months away, the mere fact that this kind of content can be created could affect the election. Knowing that fraudulent images, audio, and video can be created relatively easily could make people distrust the legitimate material they come across.

“In some respects, deepfakes and generative AI don’t even need to be involved in the election for them to still cause disruption, because now the well has been poisoned with this idea that anything could be fake,” says Ajder. “That provides a really useful excuse if something inconvenient comes out featuring you. You can dismiss it as fake.”

So what can be done about this problem? One solution is something called C2PA. This technology cryptographically signs any content created by a device, such as a phone or video camera, and documents who captured the image, where, and when. The cryptographic signature is then held on a centralized immutable ledger. This would allow people producing legitimate videos to show that they are, in fact, legitimate.

Some other options involve what’s called fingerprinting and watermarking images and videos. Fingerprinting involves taking what are called “hashes” from content, which are essentially just strings of its data, so it can be verified as legitimate later on. Watermarking, as you might expect, involves inserting a digital watermark on images and videos.

It’s often been proposed that AI tools can be developed to spot deepfakes, but Ajder isn’t sold on that solution. He says the technology isn’t reliable enough and that it won’t be able to keep up with the constantly changing generative AI tools that are being developed.

One last possibility for solving this problem would be to develop a sort of instant fact-checker for social media users. Aviv Ovadya, a researcher at the Berkman Klein Center for Internet & Society at Harvard, says you could highlight a piece of content in an app and send it to a contextualization engine that would inform you of its veracity.

“Media literacy that evolves at the rate of advances in this technology is not easy. You need it to be almost instantaneous—where you look at something that you see online and you can get context on that thing,” Ovadya says. “What is it you’re looking at? You could have it cross-referenced with sources you can trust.”

If you see something that might be fake news, the tool could quickly inform you of its veracity. If you see an image or video that looks like it might be fake, it could check sources to see if it’s been verified. Ovadya says it could be available within apps like WhatsApp and Twitter, or could simply be its own app. The problem, he says, is that many founders he has spoken with simply don’t see a lot of money in developing such a tool. 

Whether any of these possible solutions will be adopted before the 2024 election remains to be seen, but the threat is growing, and there’s a lot of money going into developing generative AI and little going into finding ways to prevent the spread of this kind of disinformation.

“I think we’re going to see a flood of tools, as we’re already seeing, but I think \[AI-generated political content\] will continue,” Ajder says. “Fundamentally, we’re not in a good position to be dealing with these incredibly fast-moving, powerful technologies.”

Brace Yourself for the 2024 Deepfake Election

The legislation would insert the government into online platforms' age-verification efforts—a move that makes some US lawmakers queasy.

While all the major Silicon Valley social media firms—from Instagram to TikTok—say they block children from using their apps, these senators say those efforts have failed. 

“It’s not working,” Schatz says.“There’s no free speech right to be jammed with an algorithm that makes you upset, and these algorithms are making us increasingly polarized and disparaging and depressed and angry at each other. And it’s bad enough that it’s happening to all of us adults, the least we can do is protect our kids.” 

While the measure’s sponsored by progressive Democrats and one of the most ardent conservatives in the Senate, lawmakers from across the ideological spectrum are equally skeptical of the proposal, showing the difficult road ahead for passing any new media measure, including those aimed at children. Many lawmakers are torn between protecting kids online and preserving the robust internet as we know it. Naturally, most senators are looking at their own families for guidance. 

“My grandkids have flip phones. They don't have smartphones until they get older,” senator Mitt Romney, a Utah Republican, says. Romney—who’s open to the idea, if initially dubious—says there’s not even uniformity in his own family on these issues. 

“I have five sons, so there are five different families and they do have different approaches,” Romney says. “And the youngest son is the one that's most strict, and the oldest son didn't really think of it as being such a big deal.”

For Smith, the Minnesota senator worried about her party coming across as Big Sister, there wasn’t even uniformity in her own household when her boys were fighting over the family’s first desktop computer ages ago. And her kids also proved to be (mini)hackers. 

“We were trying to figure out how to monitor their interactions with the computer, and we quickly figured out that, at least for them, it was hard to put hard and fast rules, because kids find a way,” Smith says. “And different parents have different rules for what they think is the right thing for their kids.”

While Smith is open to the new measure, she’s wary. “I tend to be, I guess, a little bit suspicious of hard and fast rules, because I'm not sure that they work and because I sort of think that parents and kids should have the freedom to decide what’s right for their family,” Smith says.

While Smith is a progressive Democrat, on this new measure, she’s currently aligned with senator Rand Paul, a Libertarian-leaning Kentucky Republican. “Parents exercise some oversight of what their kids view on the internet, what they view on television, all these things are important. I'm not sure I want the federal government \[involved\],” Paul says.

The new measure also has competition. Just last week senators Richard Blumenthal, a Connecticut Democrat, and South Carolina’s Lindsey Graham, the top Republican on the Senate Judiciary Committee, reintroduced their EARN IT Act—the Eliminating Abusive and Rampant Neglect of Interactive Technologies Act. That measure would strip away the current Section 230 protections for any sites that publish online child sexual exploitation content. Section 230 remains a highly controversial law because it protects online businesses from liability for much of what its users post on their platforms.

A US Bill Would Ban Kids Under 13 From Joining Social Media

The cybercriminals behind the Gootloader malware have found clever ways to avoid detection. But researchers are using those same mechanisms to stop them.

Certain cybercriminal groups like ransomware gangs, botnet operators, and financial fraud scammers get specific attention for their attacks and operations. But the larger ecosystem that underlies digital crime includes an array of actors and malicious organizations that essentially sell support services to these criminal customers. Today, researchers from security firm eSentire are revealing their methods for disrupting the operations of one longtime criminal enterprise that compromises businesses and other organizations and then sells that digital access to other attackers.

Known as an initial-access-as-a-service operation, the Gootloader malware and the criminals behind it have been compromising and scamming for years. The Gootloader gang infects victim organizations and then sells access to deliver a customer's preferred malware into the compromised target network, whether that's ransomware, mechanisms for data exfiltration, or other tools to compromise the target more deeply. From tracking Gootloader page data, for example, the eSentire researchers collected evidence that the notorious Russia-based ransomware gang REvil regularly worked with Gootloader between 2019 and 2022 to gain initial access to victims—a relationship that other researchers have noticed as well.

Joe Stewart, eSentire's principal security researcher, and senior threat researcher Keegan Keplinger designed a web crawler to keep track of live Gootloader web pages and formerly infected sites. Currently, the two see about 178,000 live Gootloader web pages and more than 100,000 pages that historically appear to have been infected with Gootloader. In a retrospective advisory last year, the United States Cybersecurity and Infrastructure Security Agency warned that Gootloader was one of the top malware strains of 2021 alongside 10 others.

By tracking Gootloader's activity and operations over time, Stewart and Keplinger identified characteristics of how Gootloader covers its tracks and attempts to evade detection that defenders can exploit to protect networks from being infected.

“Digging deeper into how the Gootloader system and malware works, you can find all these little opportunities to impact their operations,” Stewart says. “When you get my attention I get obsessed with things, and that’s what you don’t want as a malware author is for researchers to just completely dive into your operations.”

Out of Sight, Out of Mind

Gootloader evolved from a banking trojan known as Gootkit that has been infecting targets primarily in Europe since as early as 2010. Gootkit was typically distributed through phishing emails or tainted websites and was designed to steal financial information like credit card data and bank account logins. As a result of activity that began in 2020, though, researchers have been tracking Gootloader separately because the malware delivery mechanism has increasingly been used to distribute an array of criminal software, including spyware and ransomware. 

The Gootloader operator is known for distributing links to compromised documents, particularly templates and other generic forms. When targets click the links to download these documents they unintentionally infect themselves with Gootloader malware. To get targets to initiate the download, attackers use a tactic known as search-engine-optimization poisoning to compromise legitimate blogs, particularly WordPress blogs, and then quietly add content to them that includes malicious document links. 

Gootloader is designed to screen connections to tainted blog posts for a number of characteristics. For example, if someone is logged in to a compromised WordPress blog, whether they have administrator privileges or not, they will be blocked from seeing the blog posts containing the malicious links. And Gootloader goes so far as to also permanently block IP addresses that are numerically close to the address logged in to a relevant WordPress account. The idea is to keep other people in the same organization from seeing the malicious posts.

By focusing on hijacking blogs centered on particular topics, attackers can narrow their potential victim pool to target certain industries or sectors. For example, one Gootloader focus has been on targeting corporate legal departments and law firms by compromising relevant blogs and advertising their malicious documents as templates for “contracts” or other “legal agreements.” So far in 2023 alone, eSentire says it has remediated Gootloader infections at 12 different victim organizations, seven of which were law firms.

“Gootloader is kind of the last big one focusing on this, and their SEO poisoning is actually pretty unique,” Keplinger says. “They’ll spin up like 100 different agreement or contract phrasings on each of these domains that they infect, so there are in the tens of thousands of different iterations of these legal statements. When you’re selling sneakers, you have to compete with every other person using the word ‘sneakers’ in their SEO. But with this, you’re just competing with somebody using that exact legal phrasing, and that’s going to give you very little competition.”

In addition to blocking blog operators from seeing malicious pages, the Gootloader operation relies on a broader blocking system to cultivate victim pools by region while attempting to evade detection in others. For example, attackers set the system so it will only distribute the Gootloader malware to people in certain countries, which currently include the United States, Canada, the United Kingdom, and Australia. If you click one of the malicious links from an IP address associated with another country, you won't get the malware. Likewise, Gootloader only targets Windows devices, so it won't distribute if metrics from your browser indicate that you're on another type of device.

One Simple Trick

Crucially, the system is also designed so users can only download the malware once per day. That way, if a device gets infected and then IT or security staff go through the browsing history and look at the malicious page again, they'll only see the fake blog post. Stewart and Keplinger realized this Gootloader defense mechanism could also be used against it.

“This is kind of a weakness,” Stewart says. “They’re trying to keep researchers and security teams from being able to view this page, but they rely on these infected blogs to tell them the IP addresses that visit. So what we can do is pretend to visit their payload page as any IP address on the internet, and we can get that IP address blocked, so now we can selectively keep anybody from seeing Gootloader just by hitting that page once a day. We can potentially protect wide swaths of the internet.”

Stewart and Keplinger say they debated speaking publicly about their findings because they know it will likely result in the Gootloader gang changing the design of their system. But they say they decided to come forward to raise awareness more broadly. This way, more defenders can learn about the current options for protecting IP addresses, and an expanded set of malware monitoring services can start to flag Gootloader-infected pages. And if the attackers eliminate their block lists, the researchers point out that it will just make samples of the malware more readily available so scanners can add more detections.

A Security Team Is Turning This Malware Gang’s Tricks Against It

You can now sync sign-in codes across devices—but they aren’t end-to-end encrypted.

One of the most effective ways to stop your online accounts from being hacked is to turn on two-factor authentication. The security measure, often known as 2FA or multifactor authentication, requires you to enter a numerical code in addition to your username and password. So even if someone gets your password, they can’t break into your account without having your sign-in code too.

For years, security experts have recommended using authentication apps to generate these codes. All you have to do is scan a QR code for the service you want to turn 2FA on for, and the app will generate a new log-in code around every 30 seconds. This week, Google has given its 2FA app, Google Authenticator, a much-needed overhaul.

Google redesigned Authenticator, making it less clunky, and in the process added one potentially handy new tool: the ability to sync your sign-in codes to your Google account and to different phones and tablets. This essentially means your Instagram, Gmail, or Reddit 2FA codes—plus, all the other accounts you have it turned on for—will be backed up. The tweak makes it far less burdensome to switch devices if your phone with 2FA codes stored on it is lost or stolen—and it can even save you from being locked out of some accounts entirely.

“Since one-time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator,” Christiaan Brand, a group product manager at Google, wrote in a blog post announcing the change. Brand says the sync feature has been one of the most requested since the Authenticator app was released in 2010. “This change means users are better protected from lockout and that services can rely on users retaining access, increasing both convenience and security.”

Syncing your Google Authenticator codes now happens through your Google account—the feature is available on the latest iOS and Android versions of Google’s app. Authenticator gives you the option to use the app with your Google login, and if you select this option, your Google profile will show in the top right corner of the app, next to a sync icon. When I downloaded Authenticator on my iPad after setting up sync on my phone, the codes appeared once I had logged in. There is also the option to keep using Google Authenticator without logging in to a Google account.

Jake Moore, global security advisor at security firm ESET, says he has previously been locked out of an authenticator app and knows the frustrations that come with trying to log back in to all your accounts when you don’t have access to your sign-in codes. “Upgrading a phone has been made easier over the years with cloud storage, but authenticating apps have been slow to the party and held back reservedly on security,” Moore says.

Google isn’t the only firm offering 2FA sign-in codes to provide backups. Since 2019, Microsoft has allowed people to use a “backup and restore” tool for its Microsoft Authenticator app. Other third-party apps, such as Authy, also sync across people’s devices. (Apple’s all-in-one password manager allows you to generate and store sign-in codes on iPhones and Macs but doesn’t have a stand-alone app.)

While Google’s Brand paints 2FA code backups as a win for users, Moore says there are always tradeoffs when balancing user security and convenience. Sure, backed-up codes might make it easier to gain access to your accounts if your phone is lost or stolen. But the more places your codes are stored, the greater the risk that a bad actor can access them.

For instance, if someone gains access to your Google account, they may also be able to access your 2FA codes for your other online accounts. Google spokesperson Kimberly Samra says “that risk is much smaller than that you lose your device, no longer have your OTPs, and then the service has to use a much weaker mechanism for allowing you to log in.”

Tommy Mysk, an app developer and security researcher who runs the software company Mysk, has tested multiple 2FA apps and found rogue apps available to download. Mysk says that there are security and privacy limitations to the major 2FA apps. For example, Microsoft’s sync doesn’t work between iOS and Android devices, making it harder to switch operating systems and take your 2FA codes with you.

In terms of data the apps collect, Mysk says Google’s Authenticator performs “very well” and doesn’t share details of QR codes with Google. “Most apps, including Microsoft Authenticator, send behavioral analytics—that is, how users use the apps and where they tap,” Mysk says. “Google Authenticator doesn’t send this sort of data.”

Despite adding more convenience, it doesn’t appear that either Google or Microsoft’s authentication apps back up people’s 2FA sign-in codes using end-to-end encryption when they are synced. The encryption method ensures the companies can’t see the contents of your sign-in codes. “Since 2FA apps deal with secrets, the only secure way to sync data across devices is by using end-to-end encryption,” Mysk says. “The app developer should not be able to read the content of the data.”

Google’s Authenticator App Now Lets You Sync 2FA Codes Across Devices

To protect its Confidential Computing cloud infrastructure and gain critical insights, Google leans on its relationships with chipmakers.

Google Cloud and Intel released results today from a nine-month audit of Intel's new hardware security product: Trust Domain Extensions (TDX). The analysis revealed 10 confirmed vulnerabilities, including two that researchers at both companies flagged as significant, as well as five findings that led to proactive changes to further harden TDX's defenses. The review and fixes were all completed before the production of Intel's fourth-generation Intel Xeon processors, known as “Sapphire Rapids,” which incorporate TDX. 

Security researchers from Google Cloud Security and Google's Project Zero bug-hunting team collaborated with Intel engineers on the assessment, which initially turned up 81 potential security issues that the group investigated more deeply. The project is part of Google Cloud's Confidential Computing initiative, a set of technical capabilities to keep customers' data encrypted at all times and ensure that they have full access controls.

The security stakes are incredibly high for massive cloud providers that run much of the world's digital infrastructure. And while they can refine the systems they build, cloud companies still rely on proprietary hardware from chip manufacturers for their underlying computing power. To get deeper insight into the processors they're depending on, Google Cloud worked with AMD on a similar audit last year and leaned on the longtime trusted relationship between Intel and Google to launch the initiative for TDX. The goal is to help chipmakers find and fix vulnerabilities before they create potential exposure for Google Cloud customers or anyone else.

“It's not trivial because companies, we all have our own intellectual property. And in particular, Intel had a lot of IP in the technologies that they were bringing to this,” says Nelly Porter, group product manager of Google Cloud. “For us to be able to be incredibly open and trusting each other is valuable. The research that we're doing will help everybody because Intel Trusted Domain Extension technology is going to be used not only in Google, but everywhere else as well.”

Researchers and hackers can always work on attacking hardware and online systems from the outside—and these exercises are valuable because they simulate the conditions under which attackers would typically be looking for weaknesses to exploit. But collaborations like the one between Google Cloud and Intel have the advantage of allowing outside researchers to conduct black box testing and then collaborate with engineers who have deep knowledge about how a product is designed to potentially uncover even more about how a product could be better secured.

After years of scrambling to remediate the security fallout from design flaws in the processor feature known as “speculative execution,” chipmakers have invested more in advanced security testing. For TDX, Intel's in-house hackers conducted their own audits, and the company also put TDX through its security paces by inviting researchers to vet the hardware as part of Intel's bug bounty program.

Anil Rao, Intel's vice president and general manager of systems architecture and engineering, says the opportunity for Intel and Google engineers to work as a team was particularly fruitful. The group had regular meetings, collaborated to track findings jointly, and developed a camaraderie that motivated them to bore even deeper into TDX.

Of the two vulnerabilities the researchers found that Rao called “critical,” one related to loose ends from a cryptographic integrity feature that had been dropped from the product. “It was a leftover thing that we didn’t catch, but the Google team caught it,” he says. The other major vulnerability uncovered by the project was in Intel's Authenticated Code Modules, which are cryptographically signed chunks of code that are built to run in the processor at a particular time. The vulnerability involved a small window in which an attacker could have hijacked the mechanism to execute malicious code.  

“For me, that was something which was surprising. I wasn't expecting that we had such a vulnerability in our internal system,” Rao says. “But I was super happy that this team caught it. It's not that these are easy vulnerabilities for someone to tap into, but the fact that it's there is not a good thing. So at least once we fix it then we can sleep better at night.”

Rao and Porter also point out that the finding was significant because ACM is used in other Intel security products beyond TDX.

Additionally, as part of the collaboration, Google worked with Intel to open source the TDX firmware, low-level code that coordinates between hardware and software. This way, Google Cloud customers and Intel TDX users around the world will have more insight into the product.

“Confidential computing is an area where we are opening up and telling customers, ‘bring your most sensitive applications, bring your most sensitive data, and operate it on shared infrastructure in the cloud,’” Rao says. “So we want to make sure that we follow a rigorous process in ensuring that the key handlers of that sensitive data are rugged. Whether we like it or not, establishment of trust takes a long time, and you can break it very easily.”

Intel Let Google Cloud Hack Its New Secure Chips and Found 10 Bugs

Pumpkin Sandstorm. Spandex Tempest. Charming Kitten. Is this really how we want to name the hackers wreaking havoc worldwide?

Hackers—particularly state-sponsored ones focused on espionage and cyberwar, and organized cybercriminals exploiting networks worldwide for profit—are not pets. They wreck businesses, sow chaos, disrupt critical infrastructure, support some of the world's most harmful militaries and dictatorships, and help those governments spy on and oppress innocent people worldwide.

So why, when I write about these organized hacker groups as a cybersecurity reporter, do I find myself referring to them with cute pet names like Fancy Bear, Refined Kitten, and Sea Turtle?

Why, when I interview different cybersecurity firms about a particular unit of Russian military intelligence hackers, do I have to internally translate that this company refers to Fancy Bear as Pawn Storm, while this one calls them Iron Twilight? Why, when I wrote a news piece earlier this week about a North Korea–linked hacking team that has spied on their South Korean neighbors, stolen millions in cryptocurrency to fund the totalitarian regime of Kim Jong-un, and corrupted the software distributed by multiple companies to spread malicious code worldwide, did I find myself referring to them as "the hacker group known as Kimsuky, Emerald Sleet, or Velvet Chollima"? It is all, frankly, a little embarrassing—and to the average reader, lends reporting about cyber conflict about as much gravity as the play-by-play of a Pokémon card game.

A few days ago, Microsoft's cybersecurity division announced it was changing the entire taxonomy of names it uses for the hundreds of hacker groups that it tracks. Instead of its previous system, which gave those organizations the names of elements—a fairly neutral, scientific-sounding system as these things go—it will now give hacker groups two-word names, including in their description a weather-based term indicating what country the hackers are believed to work on behalf of, as well as whether they're state-sponsored or criminal.

That means Phosphorous, an Iranian group that Microsoft reported this week has been targeting US critical infrastructure like seaports, energy companies, and transit systems, now has the less-than-fearsome name Mint Sandstorm. Iridium, Russia's most aggressive and dangerous cyberwar-focused military hacker unit more commonly known as Sandworm—responsible for multiple blackouts in Ukraine and the most destructive malware in history—now has the whimsical title of Seashell Blizzard. Barium, a team of Chinese hackers that's carried out more software-supply-chain attacks than perhaps any group worldwide, is now Brass Typhoon—a phrase that, I confess, I have a hard time separating from flatulence.

Many of the new names sounded so absurd that I actually double-checked Microsoft hadn't published the new labeling system on April 1. Periwinkle Tempest. Pumpkin Sandstorm. Spandex Tempest. Gingham Typhoon. “These names are just really silly,” says Rob Lee, the founder and CEO of industrial-control-system cybersecurity firm Dragos. “I mean, talk about not being taken seriously as a profession.”

Goofiness aside, the new system is counterproductive for actual cybersecurity analysis, Lee argues. Given that Microsoft's threat intelligence is some of the best in the world, analysts and customers across the industry will have to actually revise their databases—and even some of their products—to match Microsoft's new naming scheme, he says. And the revised system now locks in educated guesses about the national loyalties of hackers with no indication of the analysts' degree of confidence in those assessments, Lee adds.f

What if a hacker group thought to be part of a nation’s intelligence agency turns out to be a hacker-for-hire contractor? Or cybercriminals temporarily conscripted to work on behalf of a government? “Assessments change over time,” Lee says. “Like, ‘We told you it was Dirty Mustard and now it’s Swirling Tempest,’ and you’re like, what the fuck?” (Lee’s own firm, Dragos, admittedly gives hacker groups mineral names that are often confusingly similar to Microsoft’s old system. But at least Dragos has never called anyone Gingham Typhoon.)

When I reached out to Microsoft about its new naming scheme, the head of its Threat Intelligence Center, John Lambert, explained the rationale behind the change: Microsoft's new names are more distinct, memorable, and searchable. In contrast to Lee's point about choosing neutral names, the Microsoft team _wanted_ to give customers more context about hackers in the names, Lambert says, immediately identifying their nationality and motive. (Instances that are not yet fully attributed to a known group are given a temporary classifier, he notes.)

Microsoft's team was also just running out of elements—there are, after all, only 118 of them. “We liked weather because it's a pervasive force, it's disruptive, and there's a kindred spirit because the study of weather over time involves improvement in sensors, data, and analysis,” says Lambert. “That's cybersecurity defenders' world, too.” As for the adjectives preceding those meteorological terms—often the real source of the names' inadvertent comedy—they're chosen by analysts from a long list of words. Sometimes they have a semantic or phonetic connection to the hacker group, and sometimes they're random. “There’s some origin story to each one,” Lambert says, “or it could just be a name out of a hat.”

There's a certain, stubborn logic behind the cybersecurity industry's ever-growing sprawl of hacker group handles. When a threat intelligence firm finds evidence of a new team of network intruders, they can't be sure they're seeing the same group that another company has already spotted and labeled, even if they do see familiar malware, victims, and command-and-control infrastructure between the two groups. If your competitor isn't sharing everything they see, it's better to make no assumptions and track the new hackers under your own name. So Sandworm becomes Telebots, and Voodoo Bear, and Hades, and Iron Viking, and Electrum, and—_sigh_—Seashell Blizzard, as every company's analysts get a different glimpse of the group's anatomy.

But, sprawl aside, did these names have to be quite so on-their-face ridiculous? To some degree, it may be wise to give names to hacker gangs that rob them of their malevolent glamour. Members of the Russian ransomware group EvilCorp, for instance, are not likely to be happy with Microsoft's rebranding them as Manatee Tempest. On the other hand, is it really appropriate to label a group of Iranian hackers that seeks to penetrate crucial elements of US civilian infrastructure Mint Sandstorm, as if they're an exotic flavor of air freshener? (The older name given to them by Crowdstrike, Charming Kitten, is certainly not any better.) Did the Israeli hacker-for-hire mercenaries known as Candiru, who have sold their services to governments targeting journalists and human rights activists, really need to be renamed Caramel Tsunami, a brand befitting a Dunkin’ beverage, and one that's already taken by a strain of cannabis?

Kevin Mandia, one of the original hacker hunters and the founder and CEO of the cybersecurity firm Mandiant, captured this problem in a speech at the Cybersecurity Threat Intelligence Summit in 2018. “I’ve always wondered, how do you get into a boardroom and say, ‘Sir, I know you’re breached. You’re in the headlines. And you were hacked by Fluffy Snuggle Duck,’” Mandia said. “It just doesn’t work.”

Mandia concedes today that in the five years since his Fluffy Snuggle Duck comment, he's become more inured to the silly hacker group names. “I don't care what they're called, I just want to make sure we have the catalog right. Do we have the fingerprints for them, do we have defenses for them?” he says.

In our interview, though, he still seemed to be genuinely tripped up by the labeling scheme of his competitor Crowdstrike, which names hackers after different animals based on their nationality. “Bear is Russia … or is it?” Mandia pondered out loud. “Panda is China. But that’s a bear. I’m confused already.”

Mandia and Lee both dream of a day when a government body—say, the US National Institute of Standards and Technology—comes up with a hacker group naming convention that can be adopted across the industry. But they both also say that companies would never stick to it. Marketing aside, the fog of war in cybersecurity research means analysts at different companies will never be sure they're looking at the same entities—unless they all agree to openly share every scrap of their closely guarded intelligence.

Until then, well, just watch out for Periwinkle Tempest. Last year, Periwinkle Tempest launched crippling ransomware attacks across the entire nation of Costa Rica, leading the country's government to declare a national emergency. Periwinkle Tempest are some of the most dangerous hackers in the world. Periwinkle Tempest. Seriously.

Source

Wired