The crypto money-laundering market is tighter than at any time in the past decade, and the few big players are moving a “shocking” amount of currency.

For years, the cryptocurrency economy has been rife with black market sales, theft, ransomware, and money laundering—despite the strange fact that in that economy, practically every transaction is written into a blockchain’s permanent, unchangeable ledger. But new evidence suggests that years of advancements in blockchain tracing and crackdowns on that illicit underworld may be having an effect—if not reducing the overall volume of crime, then at least cutting down on the number of laundering outlets, leaving the crypto black market with fewer options to cash out its proceeds than it’s had in a decade.

In a portion of its annual crime report focused on money laundering that was published today, cryptocurrency-tracing firm Chainalysis points to a new consolidation in crypto criminal cash-out services over the past year. It counted just 915 of those services used in 2022, the fewest it’s seen since 2012 and the latest sign of a steady drop-off in the number of those services since 2018. Chainalysis says an even smaller number of exchanges now enable the money-laundering trade of cryptocurrency for actual dollars, euros, and yen: It found that just five cryptocurrency exchanges now handle nearly 68 percent of all black market cash-outs. 

In fact, Chainalysis saw just 542 cryptocurrency deposit addresses receive more than half of the $6.3 billion in total illicit funds it tracked to those cash-out services in 2022, and just _four_ addresses received $1.1 billion of those funds.

That intense narrowing of so-called “off-ramps” for crypto crime is a result of an ongoing government crackdown on crypto money laundering and a sign of additional enforcement on the way, says Kim Grauer, Chainalysis’ director of research. “It’s shocking to see some of these deposit addresses moving more than a hundred million dollars in illicit funds and still operating when it’s something that’s extremely transparent and easy to see with blockchain analytics,” Grauer says. “So it does seem like a good chokepoint, where we can shut down and profile and—to some degree—eradicate this activity.”

Whether the overall amount of crypto crime rose or fell in 2022, meanwhile, is far from clear: By some measures, Chainalysis’ data has shown that criminal use of cryptocurrency increased last year despite the steep decline in cryptocurrency exchange rates. But those numbers include a huge spike in illegal transactions at sanctioned cryptocurrency exchanges—which may have less to do with a rise in crime than with the US Treasury’s Office of Foreign Asset Control (OFAC) increasingly imposing those sanctions on major players in the crypto underground. In April of last year, for instance, OFAC sanctioned Garantex, an exchange based in Russia that it says laundered over $100 million in criminal proceeds, including ransomware payments. The year before, it sanctioned two other Russian exchanges, Chatex and Suex, which have since gone out of business. And just last week, OFAC sanctioned another exchange, Bitzlato, and the Justice Department indicted its Russian founder, Anatoly Legkodymov, and tore his operation offline.

“You don’t carry out a ransomware attack if there’s no way of converting that ransom into something usable,” says Grauer. “What we’re really seeing OFAC doing, and what we’ve really highlighted, is that the money-laundering off-ramps are what’s facilitating crime. And I think the ongoing crackdown has shown that people understand they’re at a point where there can be meaningful intervention.”

Chainalysis declined to name the five exchanges it says enabled the majority of cryptocurrency money laundering. That’s because, the company says, those exchanges may be the targets of ongoing investigations. (Chainalysis often works with law enforcement agencies in those investigations.) Further, the exchanges may not actually be aware that they’re enabling that money laundering, since money launderers often take pains to hide the source of their funds before it hits an exchange.

In fact, Chainalysis found that a large chunk of the illicit cash-outs went through two types of intermediaries that might obfuscate criminal funds: Many were traded through “nested services,” essentially exchanges that appear to be independent but actually use a larger exchange to carry out their trades. In those cases, the nested service, rather than the underlying exchange, is often responsible for complying with “know-your-customer” requirements, even as the larger exchange provides the cash reserves for transactions. 

In another growing subset of cases, Chainalysis says, criminals are turning to individual dark-web-based money-laundering services, many of which offer to hide the origin of funds by combining them with other users’ transactions in a “mixer.” As law enforcement has cracked down on major mixing services in recent years—seizing and tearing offline the mixers Bitcoin Fog and Helix and sanctioning the mixing service Tornado Cash, for instance—more criminals have turned to smaller dark-web services that Chainalysis’ Grauer refers to as “mom-and-pop” mixers, whose distributed nature makes them harder to seize or disrupt.

Despite its reluctance to name the top five money-laundering exchanges in its most recent report, in another report in February of last year Chainalysis did point to a collection of Russia-based exchanges it says have cashed out large sums of criminal proceeds. While some of the exchanges named in that report have since been sanctioned or gone offline, others—including Cashbank and TETChange—appear to still be active.

When WIRED reached out to the US Treasury, an official there declined to comment on any specific exchanges or ongoing investigations. The official, who asked to remain unnamed due to the sensitive nature of sanctions policies that are coordinated between multiple government agencies, also suggested that Chainalysis’ data offered only one incomplete perspective on the crypto money-laundering landscape and that much of the consolidation it describes might simply be due to 2022’s crypto crash and the resulting bankruptcy of several exchanges—particularly more “fly-by-night” ones with looser compliance rules.

But the official also pointed to the Treasury’s own enforcement efforts—along with those of international partners—as an ongoing crackdown that has intentionally reduced options for criminals. “The way you get at money laundering on a broad scale is you slowly whittle down the number of open vulnerabilities. Little by little you make the gaps fewer and fewer, smaller and smaller,” the official says. “If you close up more gaps in the dam, more water flows through those open holes.”

As gradual as that process may be, Chainalysis’ Grauer says it’s a sign that efforts to trace and disrupt the crypto criminal world’s ATMs are slowly but surely having their intended effect. “We’ve worked to show where the money-laundering gaps are. There are gaps that remain,” says Grauer. “The crackdown is in progress.”

Most Criminal Cryptocurrency Funnels Through Just 5 Exchanges

Your smartphone or wearable could help you out in a truly dangerous situation. Here are some options to consider.

The Best Personal Safety Devices, Apps, and Alarms (2023)

The notorious Russian-speaking cybercriminals grew successful by keeping a low profile. But now they have a target on their backs.

High-profile ransomware attacks have become a fact of life in recent years, and it’s not unusual to hear about major monthly attacks perpetrated by Russia-based gangs and their affiliates. But since late 2019, one group has been steadily making a name for itself on a multi-year rampage that has impacted hundreds of organizations around the world. The LockBit ransomware gang may not be the most wildly unhinged of these criminal groups, but its callous persistence, effectiveness, and professionalism make it sinister in its own way.

One of the most prolific ransomware groups ever, the LockBit collective has attempted to maintain a low profile in spite of its volume of attacks. But as it has grown, the group has gotten more aggressive and perhaps careless. Earlier this month, the LockBit malware was notably used in an attack on the United Kingdom’s Royal Mail that hobbled operations. After other recent visible attacks, like one on a Canadian children’s hospital, all eyes are now on LockBit.   

“They are the most notorious ransomware group, because of sheer volume. And the reason for their success is that the leader is a good businessman,” says Jon DiMaggio, chief security strategist at Analyst1 who has studied LockBit’s operations extensively. “It’s not that he’s got this great leadership capability. They made a point-and-click ransomware that anyone could use, they update their software, they’re constantly looking for user feedback, they care about their user experience, they poach people from rival gangs. He runs it like a business, and because of that, it is very, very attractive to criminals.”

Keep It Professional

For the Royal Mail, LockBit was a chaos agent. On January 11, the UK postal service’s international shipping ground to a halt after being hit with a cyberattack. For more than a week, the company has told customers not to send new international parcels—adding further disorganization after workers went on strike over pay and conditions. The attack was later linked to LockBit.

Just before Christmas, a LockBit member attacked the SickKids hospital in Canada, impacting its internal systems and phone lines, causing delays to medical images and lab tests. The group quickly backtracked after the attack, providing a free decryptor and saying it had blocked the member responsible. In October, LockBit also demanded an unusually high $60 million payment from a UK car dealership chain. 

Adding to its infamy, LockBit is also one of the most prolific and aggressive ransomware groups when it comes to targeting manufacturing and industrial control systems. Security firm Dragos estimated in October that in the second and third quarters of 2022, the LockBit malware was used in 33 percent of ransomware attacks on industrial organizations and 35 percent of those against infrastructure.

In November, the US Department of Justice reported that LockBit’s ransomware has been used against at least 1,000 victims worldwide, including in the United States. “LockBit members have made at least $100 million in ransom demands and have extracted tens of millions of dollars in actual ransom payments from their victims,” the Justice Department wrote. The FBI first began investigating the group in early 2020. In February 2022, the agency released an alert warning that LockBit “employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense.”

LockBit emerged at the end of 2019, first calling itself “ABCD ransomware.” Since then, it has grown rapidly. The group is a “ransomware-as-a-service” operation, meaning that a core team creates its malware and runs its website while licensing out its code to “affiliates” who launch attacks.

Typically, when ransomware-as-a-service groups successfully attack a business and get paid, they’ll share a cut of the profits with the affiliates. In the case of LockBit, Jérôme Segura, senior director of threat intelligence at Malwarebytes, says the affiliate model is flipped on its head. Affiliates collect payment from their victims directly and then pay a fee to the core LockBit team. The structure seemingly works well and is reliable for LockBit. “The affiliate model was really well ironed out,” Segura says.

Though researchers have repeatedly seen cybercriminals of all sorts professionalizing and streamlining their operations over the past decade, many prominent and prolific ransomware groups adopt flamboyant and unpredictable public personas to garner notoriety and intimidate victims. In contrast, LockBit is known for being relatively consistent, focused, and organized. 

“Of all the groups, I think they have probably been the most businesslike, and that is part of the reason for their longevity,” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “But the fact that they post a lot of victims on their site doesn’t necessarily equate to them being the most prolific ransomware group of all, as some would claim. They are probably quite happy with being described that way, though. That’s just good for recruitment of new affiliates.”

The group certainly isn’t all hype, though. LockBit seems to invest in both technical and logistical innovations in an attempt to maximize profits. Peter Mackenzie, director of incident response at security firm Sophos, says, for example, that the group has experimented with new methods for pressuring its victims into paying ransoms. 

“They've got different ways of paying,” Mackenzie says. “You could pay to have your data deleted, pay to have it released early, pay to extend your deadline,” Mackenzie says, adding that LockBit opened its payment options to anyone. This could, theoretically at least, result in a rival company buying a ransomware victim’s data. “From the victim's perspective, it's extra pressure on them, which is what helps make people pay,” Mackenzie says.

Since LockBit debuted, its creators have spent significant time and effort developing its malware. The group has issued two big updates to the code—LockBit 2.0, released in mid-2021, and LockBit 3.0, released in June 2022. The two versions are also known as LockBit Red and LockBit Black, respectively. Researchers say the technical evolution has paralleled changes in how LockBit works with affiliates. Prior to the release of LockBit Black, the group worked with an exclusive group of 25 to 50 affiliates at most. Since the 3.0 release, though, the gang has opened up significantly, making it harder to keep tabs on the number of affiliates involved and also making it more difficult for LockBit to exercise control over the collective.

LockBit frequently expands its malware with new features, but above all, the malware’s characteristic trait is that it's simple and easy to use. At its core, the ransomware has always offered anti-detection capabilities, tools for circumventing Microsoft Windows defenses, and features for privilege escalation within a compromised device. LockBit uses publicly available hacking tools when it can, but it also develops custom capabilities. The 2022 FBI report noted that the group sometimes uses previously unknown or zero day vulnerabilities in its attacks. And the group has the capability to target many different types of systems.

“It's not just Windows. They'll attack Linux, they'll go after your virtual host machines,” Mackenzie says. “They offer a solid payment system. There's a lot of backend infrastructure that comes with this. It's just a well-made product, unfortunately.” In October, it was reported that LockBit’s malware was deployed after a zero day was used to hack Microsoft Exchange servers—a relatively rare occurrence when it comes to ransomware gangs.

“Theer are additional features that make the ransomware more dangerous—for example, having worm components to it,” Segura adds. “They've also discussed things like doing denial-of-service attacks against victims, in addition to the extortion.”  

With the release of LockBit 3.0, the group also signaled its intention to evolve. It introduced the first ransomware bug bounty scheme, promising to pay legitimate security researchers or criminals who could identify flaws in its website or encryption software. LockBit said it would pay anyone $1 million if they could name who is behind LockBitSupp, the public persona of the group.

The core members at the top of LockBit seem to include its leader and one or two other trusted partners. Analyst1’s DiMaggio, who has tracked the actors for years, notes that the group claims to be based in the Netherlands. Its leader has said at various times that he personally operates out of China or even the United States, where he has said he is a part owner of two restaurants in New York City. LockBit members all seem to be Russian-speaking, though, and DiMaggio says that while he cannot be certain, he believes the group is based in Russia.

“The leader doesn’t seem to have any concern about being arrested. He thinks he’s a supervillain, and he plays the part well,” DiMaggio says. “But I do believe he has a healthy concern that if the Russian government were to get their hooks in him, he would have to make the decision to turn over most of his money to them or do work for them like helping them with the Ukraine war.”

Beware the Spotlight

Despite LockBit’s relative professionalism, the group has, at times, slipped into showboating and bizarre behavior. During desperate efforts to get attention—and attract affiliates—in its early months, the criminal group held an essay-writing competition and paid prizes to the winners. And in September 2022, the group memorably posted a message on a cybercrime forum claiming it would pay anyone $1,000 if they got the LockBit logo tattooed on themselves. Around 20 people shared photos and videos with their feet, wrists, arms, and chests all branded with the cybercrime gang’s logo.

LockBit’s meteoric rise and recent attacks against high-profile targets could ultimately be its downfall, though. Notorious ransomware groups have been infiltrated, exposed, and disrupted in recent years. Before Russia’s full-scale invasion of Ukraine in February 2022, the Russian Federal Security Service (FSB) arrested high-profile REvil hackers, although the group has since returned. Meanwhile, the US military hacking unit Cyber Command has admitted to disrupting some ransomware groups. And a Ukrainian cybersecurity researcher contributed to the downfall of the Conti ransomware brand last year after infiltrating the group and publishing more than 60,000 of the group’s internal chat messages.

These deterrent actions appear to be having some impact on the overall ransomware ecosystem. While it is difficult to determine real totals of how much money ransomware actors take in, researchers who track cybercriminal groups and those who specialize in cryptocurrency tracing have noticed that ransomware gangs seem to be taking in less money as government enforcement actions impede their operations and more victims refuse to pay. 

The screws are already turning on LockBit. An apparently disgruntled LockBit developer leaked its 3.0 code in September, and Japanese law enforcement has claimed it can decrypt the ransomware. US law enforcement is closely watching the group as well, and its recent attacks can only have raised its profile. In November 2022, the FBI revealed that an alleged LockBit affiliate, Mikhail Vasiliev, 33, had been arrested in Canada and would be extradited to the US. At the time, deputy attorney general Lisa O. Monaco said officials had been investigating LockBit for more than two and a half years.

“I think LockBit is going to have a rough year this year and potentially see their numbers go down,” Analyst1’s DiMaggio says. “They are under a lot of scrutiny now, and they also may have lost their main developer, so they could have development issues that bite them in the ass. It’ll be interesting to see. These guys don’t care about anyone or anything.”

LockBit has seemingly been so dangerous and prolific because it maintained standards for the types of targets its affiliates could hit and avoided attracting too much attention while casting a wide net. But times have changed, and shutting down the UK’s international mail exports for more than a week isn’t exactly keeping a low profile.

“They do have a bit of a PR problem when it comes to their affiliates at this point, because they obviously can't seem to handle them very well,” Malwarebytes’ Segura says. “The bragging, hitting some pretty critical infrastructure, and high-visibility targets is a very dangerous game they're playing. LockBit has a big target on its back right now.”

The Unrelenting Menace of the LockBit Ransomware Gang

A mandatory app exposed the personal information of students and teachers across the country for over a year.

A security lapse in an app operated by India’s Education Ministry exposed the personally identifying information of millions of students and teachers for over a year. 

The data was stored by the Digital Infrastructure for Knowledge Sharing app, or Diksha, a public education app launched in 2017. At the height of the Covid-19 pandemic, when the government was forced to shutter schools across the country, Diksha became a primary tool for allowing students to access materials and coursework from home. 

But a cloud server storing Diksha’s data was left unprotected, exposing millions of individuals’ data to hackers, scammers, and virtually anyone who knew where to look.

Files stored on the unsecured server contained the full names, phone numbers, and email addresses of more than 1 million teachers. According to data in the files, verified by WIRED, the teachers worked for hundreds of thousands of schools located in every state in India. Another file contained information about nearly 600,000 students. While the students’ email addresses and phone numbers were partially obscured, the data included the students’ full names and information about where they went to school, when they enrolled in a course through the app, and how much of the course they completed.  

According to a UK-based security researcher who identified the exposure, there were thousands of files like this on the server. (The researcher asked not to be named because they were not authorized to speak to the media.) 

After initially discovering the exposure in June, the researcher contacted the Diksha support email, alerting them to the data breach, identifying the source, and offering to share more information. They received no response. “There's zero chance that it hasn't been accessed and downloaded by a bunch of other people,” the employee says of the exposed data.

WIRED reached out to the Ministry of Education and did not receive a response. 

Diksha was developed by EkStep, a foundation cofounded by Nandan Nilekani, who helped develop Aadhar, the country’s national identification system. According to Deepika Mogilishetty, the chief of policy and partnerships at EkStep, while the foundation had been supporting Diksha for many years, India’s Ministry of Education ultimately implements the security and policies for how data is managed on Diksha. However, after WIRED sent Mogilishetty links to the unsecured server, it was quickly taken offline. 

This isn’t the first time Diksha has potentially mishandled sensitive information. A 2022 report from Human Rights Watch found that Diksha not only was able to track the location of students, but also shared data with Google. In many cases, the Indian government mandated that teachers and students use Diksha, and Hye Jung Han, a researcher at Human Rights Watch who authored the 2022 report, says that the government provided no alternative methods for those who may not have wanted to use the app.

“What's happening there from a child-rights lens is, you are fulfilling your responsibility to provide free education to every child, but the only type of state education that you're making available is one that inherently violates kids' rights,” says Han.

The unsecured storage server was hosted on Azure, Microsoft’s cloud storage service. It’s unknown how long the data was left unprotected, but Google indexed more than 100 files from this server as early as October 2018. In other words, information stored on this vulnerable server was likely findable through a simple Google search for at least four years. While WIRED could not find instances of sensitive student and teacher data through a Google search, files with sensitive data were available for download through Grayhat Warfare, a searchable database of unsecured servers popular with security researchers and hackers.

“If you have information about children's names, contact details, and what schools they attend, that tells you about the neighborhood where they live. This raises what we call traditional children's protection concerns,” says Han. “They can also use children as a way to get to their parents—blackmail and harassment being fairly common, unfortunately, in India, specifically around education data.”

The market for student data in India appears to be thriving. In 2020, security researchers at CloudSEK, an India-based security firm, found that personally identifying information of hundreds of thousands of students who took India’s Common Aptitude Test Exam was for sale on a forum for leaked data. A year later, India Times reported that confidential data of millions of students was for sale on a website called “studentdatabase.in.”

Han also says that in India’s burgeoning data-broker market, education data like that available via the exposed Diksha server, which can be particularly appealing for prep schools to purchase, can go for as little as 2 to 5 rupees for a single child’s data.

Flaw in Diksha App Exposed the Data of Millions of Indian Students

Encrypting files, folders, and drives on your computer means that no one else can make sense of the data they contain without a particular decryption key—which in most cases is a password known only to you. 

So while someone could get at your files if they know your password (the decryption key), they won't be able to take out a drive from your system and access what's on it, or use a second computer to read your data—it'll all be gibberish. It means that if your Windows or macOS machine gets lost or stolen, you don't have to worry about someone using the data on it.

How the most popular operating systems have handled encryption has changed over the years, and there are third-party tools that give you more encryption options to choose from. We'll guide you through everything you need to know about these options to help you pick the right one.

Built-in Options for Windows

Device encryption is available in the Home versions of Windows.

Windows via David Nield

Encryption on Windows is a little more complicated than perhaps it should be. First of all, there are differences between the Windows Home and Windows Pro editions: Pro users get a powerful tool called BitLocker for encryption, but with the Home edition, there's a more basic alternative. It's simply referred to as device encryption, and you can find it by choosing **Privacy & security** and then **Device encryption** from the Settings panel in Windows.

Not so fast though, as this option won't appear for everyone: It requires a certain level of hardware security support from your desktop or laptop computer. It's all rather complex, and we don't have room to go into everything in detail here, but The Windows Club has an excellent explainer. If you search the Start menu for a tool called "system information," then right-click and run it as an administrator, you can see why your computer does or doesn't support this feature via the Device Encryption Support entry.

Assuming your hardware does meet all of the requirements, and the **Device encryption** entry is visible, you can click through it to see if your system drives are encrypted—they should be, by default, if you log in to your computer with a Microsoft account. It means that anyone who accesses your hard drives without that authorization won't be able to see the data on them, because it'll be encrypted and protected. If encryption isn't enabled for whatever reason, you can turn the toggle switch to **On**.

When it comes to external drives and USB sticks, if you have the Pro version of Windows you can use BitLocker: Just right-click on the drive in File Explorer, pick **Show more options** and **Turn on BitLocker**, and set a password. For those on the Home edition though, this option isn't available—you're going to have to use a third-party tool for the job of encrypting external drives, and we'll get on to those later on in this article.

Built-in Options for macOS

Use FileVault for maximum protection on a Mac.

Apple via David Nield

Encryption on macOS isn't quite as confusing as it is on Windows, but it still needs some explaining. If you have a Mac with a T2 security chip or Apple silicon inside (so one from late 2017 or later), then the contents of your system disk are encrypted by default. Your account password is required to get into the computer and at all of the data secured on the drive.

However, without getting into too much technical detail (which you can access here if you want to dive deeper), you can add an extra layer of encryption protection by enabling a tool called FileVault. Enabling FileVault means the information required to decrypt your Mac drive is harder to get at—if, for example, someone steals your computer and connects a second computer to it. Traditionally, this could impact speed and performance, but in recent years that's become less and less of a problem and is practically unnoticeable on the newest Macs.

You'll be asked to enable FileVault when you first set up macOS on a new machine, and it's something we'd recommend. You can also turn FileVault on (or off) whenever you like by opening the **Apple** menu and choosing **System Settings** then **Privacy & Security**. There's a FileVault option there, together with some details about what it does. You'll also need to specify your preferred way of unlocking the system disk if you ever forget your password, either through iCloud or through a dedicated recovery key.

You can encrypt external drives with a password from Finder: Just right-click on them and choose **Encrypt**. If the encryption option doesn't appear, the drive needs to be wiped and reformatted to be compatible—open the Disk Utility tool in macOS, click **View** and **Show All Devices**, then select the relevant external drive and click **Erase**. Give the drive a name, choose an encrypted option under **Format** (the options are explained here) and choose **GUID Partition Map** under **Scheme**. Pick your password, then click **Erase**, and the drive is ready to go.

Third-party Options for Windows and macOS

VeraCrypt makes it simple to encrypt an external drive.

VeraCrypt via David Nield

There are a variety of free and paid third-party encryption tools available if the options built into Windows and macOS don't suit your needs, including Cryptomator, NordLocker, and AxCrypt. However, we recommend one in particular, VeraCrypt: It's available for Windows and macOS (and indeed Linux,) it's not difficult to use, and it's free.

We also recommend reading through the online documentation that accompanies the program, but getting started is quite straightforward. Say you're encrypting an external drive, for example: With the drive plugged in and formatted, open VeraCrypt and choose **Create Volume**. Next, select **Encrypt a non-system partition/drive** and select **Next**. Select the drive you want to encrypt and follow the instructions on the screen.

During the configuration process, you'll be asked whether you want to encrypt the existing data already on the drive, or format it ready for files to be added—if you already have files on the drive that you don't want to be wiped, make sure you pick the former option. You'll also be asked to specify a password to lock the drive, which you should make sure you won't forget (you won't be able to access the drive without it).

VeraCrypt also lets you create containers, or sections of a drive that are encrypted. If you need to lock up specific files and folders without encrypting an entire disk for whatever reason, then this is one of the ways of going about it. From the main VeraCrypt screen, click **Create Volume**, then **Create an encrypted file container**. You'll be asked to specify a file on disk that then acts as the encrypted container for other files and folders.

How to Encrypt any File, Folder, or Drive on Your System

Plus: A leaked US “no fly” list, the SCOTUS leaker slips investigators, and PayPal gets stuffed.

“Ordinary people’s private financial records are being siphoned indiscriminately into a massive database, with access given to virtually any cop who wants it,” Nathan Freed Wessler, deputy director of the ACLU’s Speech, Privacy, and Technology Project, told the _WSJ_. “This program should never have been launched, and it must be shut down now.”

A security researcher discovered a version of the United States’ controversial “no fly list” on an unsecured server run by CommuteAir, a regional airline based out of Ohio. The list, which contains more than 1.5 million entries, is far larger than previously reported and includes the names of individuals who are barred from flying to the United States.

CommuteAir confirmed the authenticity of the document to the Daily Dot, which was first to report about the leaked list.

According to the Daily Dot, the list contains the names of several notable figures, including the convicted Russian arms dealer Viktor Bout. The Biden administration sent Bout back to Russia in a prisoner exchange for WNBA star Brittney Griner, who returned to the US in December. In the data, which was shared with WIRED on Thursday evening, there were nearly 30 entries for individuals who were born after 2010. 

According to CNN, the US Transportation Security Administration is investigating the incident. 

After an eight-month investigation, the US Supreme Court has failed to discover who leaked the draft decision overturning _Roe v. Wade_, according to a report released by the court on Thursday. The unprecedented leak to _Politico_ last spring came more than a month before the final opinion was released and sparked nationwide protests.

Over the course of the leak investigation, the court interviewed 97 court employees and brought in forensic experts to examine call logs, printer logs, and fingerprints. According to the report, 80 people besides the nine justices had access to the draft opinion. 

“No one confessed to publicly disclosing the document, and none of the available forensic and other evidence provided a basis for identifying any individual as the source of the document,” the report states. “It is not possible to determine the identity of any individual who may have disclosed the document or how the draft opinion ended up with _Politico_.”

The report did not say whether the justices were interviewed.

According to a PayPal notice of security incident, attackers gained unauthorized access to the accounts of thousands of users between December 6 and December 8, 2022, using a credential-stuffing attack. Credential stuffing is when hackers, typically using a bot, attempt to access accounts using lists of leaked password and username pairs.

Over two days, hackers had access to account holders’ full names, dates of birth, postal addresses, Social Security numbers, and individual tax identification numbers. According to PayPal, 34,942 of its users have been impacted by the incident.

The affected users will get a free two-year identity monitoring service from Equifax.

The Biggest US Surveillance Program You Didn’t Know About

The mobile operator just suffered at least its fifth data breach since 2018, despite promising to spend a fortune shoring up its systems.

Yesterday, mobile giant T-Mobile said that it suffered a data breach beginning on November 26 that impacts 37 million current customers on both prepaid and postpay accounts. The company said in a US Securities and Exchange Commission filing that a “bad actor” manipulated one of the company's application programming interfaces (APIs) to steal customers' names, email addresses, phone numbers, billing addresses, dates of birth, account numbers, and service plan details. The initial intrusion occurred at the end of November, and T-Mobile discovered the activity on January 5.  

T-Mobile is one of the US's largest mobile carriers and is estimated to have more than 100 million customers. But in the past 10 years, the company has developed a reputation for suffering repeated data breaches alongside other security incidents. The company had a mega breach in 2021, two breaches in 2020, one in 2019, and another in 2018. Most large companies struggle with digital security, and no one is immune to data breaches, but T-Mobile seems to be approaching companies like Yahoo in the pantheon of repeated compromises.

“I'm certainly disappointed to hear that, after as many breaches as they've had, they still haven't been able to shore up their leaky ship,” says Chester Wisniewski, field chief technical officer of applied research at the security firm Sophos. “It is also concerning that the criminals were in T-Mobile's system for more than a month before being discovered. This suggests T-Mobile's defenses do not utilize modern security monitoring and threat hunting teams, as you might expect to find in a large enterprise like a mobile network operator.”

Because of limits on the API (an interface that facilitates communication between two software programs), the attacker did not gain access to Social Security numbers or tax IDs, driver's license data, passwords and PINs, or financial information like payment card data. Such data has been compromised in other recent T-Mobile breaches, though, including one in August 2021. In July 2022, T-Mobile agreed to settle a class action suit about that breach in a deal that included $350 million to customers. At the time, the company also committed to a two-year, $150 million initiative to improve its digital security and data defenses.

T-Mobile, which did not respond to multiple requests for comment from WIRED, wrote in its SEC disclosure that in 2021, “We commenced a substantial multi-year investment working with leading external cybersecurity experts to enhance our cybersecurity capabilities and transform our approach to cybersecurity. We have made substantial progress to date, and protecting our customers’ data remains a top priority.”

It clearly hasn't been enough, given the recent incident, which exposed data for roughly a third of the company's US-based customers. 

“How many of these does T-Mobile have to have?” wondered Jake Williams, a longtime incident responder and an analyst at the Institute for Applied Network Security. “API security is just starting to be something people are really focusing on, which was a mistake. Detecting API abuse is not easy, especially if the threat actor is moving low and slow. I suspect there's a large number of these in general that simply go undetected. But the bottom line is that T-Mobile's API security clearly needs work. You shouldn't be having mass API abuse for more than six weeks.”

At this point in the saga, customers may be wondering whether it even matters if T-Mobile has more customer data breaches, given that they've already had so many. But every new compromise exposes more people and potentially expands the data that cybercriminals have available to launch phishing attacks and other targeted scams. The information involved in the new breach could be especially useful to attackers for SIM swap attacks, in which they take control of victims' phone numbers and then abuse the access to take over accounts, including by capturing two-factor authentication codes sent over SMS. 

“The information stolen in this breach is ideal for SIM swapping attacks and other forms of identity theft,” Sophos's Wisniewski says. It “should be another reason for T-Mobile customers to lock down their accounts and move away from SMS-based multifactor authentication for banks, cryptocurrency wallets, etc.”

If you're a T-Mobile customer, or just looking to improve your digital security, make sure you're using an authenticator app or hardware token for two-factor on as many accounts as possible. And add a PIN to your wireless account so attackers need that additional authentication mechanism before they can attempt to compromise your SIM card.

On January 6, the US Federal Communication Commission proposed more stringent data-breach reporting criteria for the telecom industry.

“The law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication, and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,” FCC chair Jessica Rosenworcel wrote. “This new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.”

At this point, T-Mobile is undoubtedly a big driver of the telecom industry's data-breach Groundhog Day. Of the latest incident, Sophos' Wisniewski  laments, “Another day, another T-Mobile breach.”

T-Mobile's New Data Breach Shows Its $150 Million Security Investment Isn't Cutting It

Research shows that relatively few people exist in perfectly sealed-off media bubbles—but they’re still having an outsize impact on US politics.

One of the top concerns when it comes to the harms of social media and political polarization in the United States is the fear of echo chambers or people operating in media bubbles. If people are only hearing opinions they already agree with or seeing stories that align with their worldview, they may become more entrenched in their beliefs, whether or not their beliefs reflect the real world. They may also become easier to manipulate and more extreme.

Interestingly, research largely shows the vast majority of people don’t inhabit perfectly sealed-off echo chambers. It’s been found that only about 4 percent of people operate in online echo chambers, and most people on Twitter, for example, don’t follow any political accounts. Essentially, most people aren’t following politics, and a lot of people who do are getting at least a little bit of information from different sides of the political spectrum. That said, echo chambers and media bubbles are an issue because they can radicalize people, negatively affect the people who inhabit them, and distort the broader political landscape.

“The subset of the population that does consume hyper-partisan media and inhabit echo chambers on social platforms is very consequential,” says Magdalena Wojcieszak, a professor of communication at the University of California, Davis. “They’re more politically interested, more participatory, more strongly partisan, and more polarized. Because of all these things, they’re more likely to take part in politics.”

Wojcieszak says because these people are so politically involved, they have a disproportionate influence on American politics. They’re often the loudest voices in the room. She says people who are politically active like to have their views confirmed, so they can end up following accounts that align with their views and end up in echo chambers. Social media makes it easier to find people who align with them politically, and algorithms often feed them the content they’re going to like. All of this can ultimately lead to people going down rabbit holes and becoming more politically extreme.

“It makes you more extreme or polarized. It reinforces your attitudes. It also reinforces your sense of belonging to this group, and it reinforces your negativity and hostility toward other groups,” Wojcieszak says. “You think you’re the legitimate one, the good one, the virtuous one. The others are evil.”

People can start to believe they’re the only ones with the facts and that the other side is illegitimate. (Perhaps you’ve seen this in a person who paid tens of billions of dollars for a social media company not long ago.) Wojcieszak says the process of people becoming radicalized can start with them having just a few political views in common with those who are more extreme than they are. Having a few stances that align with these extreme actors online can be the snare that pulls them into the rabbit hole.

“In order to enter that process of this individual psychological and algorithmic confirmation, you do need to have some extent of susceptibility to some sort of narratives from the left or the right,” Wojcieszak says. “If there are some social or political issues in which you have some views, that can start the process.”

You can imagine someone who isn’t particularly politically extreme but does harbor certain fears about ways the country is changing being pulled in by extremists and becoming extreme themselves as they get increasingly embedded in that community. People need community, and extremists can give them that. They’ll be welcomed by this community, Wojcieszak says, and they’ll feel the psychological need to start going along with whatever that community’s narrative is on any number of issues. 

Mike Gruszczynski, an assistant professor of communication science at Indiana University, says a distrust in institutions, such as news media and the government, can lead to people creating echo chambers and often falling for disinformation because it appeals to their political beliefs. He says this has been found to be more common on the political right than the political left.

“You have a lot of people on the right wing of the political spectrum who have been highly distrustful of traditional journalism for quite a while,” Gruszczynski says. “Not only are they distrustful of it, but they exist in a kind of feedback loop where their chosen leaders tell them that the things that come out of the media are false or biased.”

One of the ways society can help prevent people from going down these rabbit holes and becoming more extreme is by teaching them media literacy. Gruszczynski says it won’t necessarily be easy to do, especially because there’s so much disinformation out there and it’s often quite convincing. But it’d be worth the effort. “Everyone kind of has to be their own detective in a way now,” Gruszczynski says.

It often feels like an insurmountable challenge, Wojcieszak says, because those who have become politically extreme are living in such a different reality than the rest of the populace. If someone is spending most of their time on extremist forums or in extreme groups on social media, for example, it’s hard to reach them and bring them back to reality. She says improving social media algorithms so these platforms are less likely to make people more extreme in the first place could be a good place to start when it comes to attacking this problem.

“In the US, things have gotten so deeply bad for some groups. The people who are, say, true Trump believers or who are convinced Covid was a hoax—I’m not sure if you can deprogram them,” Wojcieszak says.

Society may not be able to pull everyone out of these rabbit holes, but increased media literacy and social media platforms that aren’t designed to confirm people’s existing beliefs and make them more extreme could help fewer people become radicalized. It’s a widespread problem that will take time to address, but the status quo does not seem sustainable.

The Small but Mighty Danger of Echo Chamber Extremism

New research from Cloudflare shows that connectivity disruptions are becoming a problem around the globe, pointing toward a troubling new normal.

The Iranian government’s latest attempts in recent months to stifle protests through internet blackouts, digital curfews, and content blocking have presented a particularly extreme example of how far regimes can go in restricting digital access. But a new report from the internet infrastructure company Cloudflare, released today, highlights the stunning global prevalence of connectivity disruptions and their increasing relevance to people and organizations all around the world.

In 2022, Cloudflare began publishing reports that compile its internal observations about government internet blackouts and notable outages worldwide. As a content delivery network that also provides digital resiliency services, the company sees an array of signals when a chunk of the internet goes dark. For example, Cloudflare can assess internet protocol requests, like those for the routing system Border Gateway Protocol or the internet address book Domain Name System, to get insight into how a government executed a shutdown and where in the internet backbone it implemented the connectivity blocking.

The specific geopolitical context and technical nuances of different digital disruptions can make it difficult, or unhelpful, to make granular comparisons of disparate incidents. But Cloudflare, which operates in more than 100 countries and interconnects with more than 10,000 network providers, is using its vantage point and visibility into the global internet to track broader trends and offer a sense of scale about how pervasive internet shutdowns have become.

“There's an increasing use of shutdowns as a means of controlling communication,” says David Belson, Cloudflare's head of data insight and a longtime researcher of internet disruptions. “There are single points of failure for internet connectivity, and things that are outside of your control can impact your business, your organization, your individual collaborations. So if you are someone in a position of responsibility, you may have to start factoring that into your risk matrix and thinking about particular steps to ensure that your presence on the internet and the work you do on the internet remains uninterrupted.”

The new report, which looks at incidents from the fourth quarter of 2022, concluded that activity related to internet disruptions was actually lower, or “a little bit less active,” as Belson puts it, than previous quarters of last year. Still, the report listed intentional shutdowns and disruptions in Bangladesh, Cuba, Iran, Kenya, Pakistan, Sudan, and Ukraine, along with the United states, where Moore County, North Carolina, dealt with multiday internet outages thanks to assailants who shot at two electrical substations, causing power outages. In Ukraine and Iran particularly, Cloudflare's reporting was a continuation of ongoing monitoring and incidents.

An internet shutdown imposed by the Cuban government on October 1 was a continuation of shutdowns that began at the end of September in an attempt to curtail protests. The uprisings came in response to a hurricane that caused power outages on the island nation and a widespread feeling among the public that the Cuban government botched the recovery.

The report also highlights an accidental October cable cut in the UK’s Shetland Islands as well as technical failures in Australian, Haiti, and Kyrgyzstan.

“The interesting thing about internet shutdowns is that we typically don't see governments shutting down electricity or water or gas. They target the internet because they see shutting down the flow of information as a vital thing to do,” says John Graham-Cumming, Cloudflare's chief technical officer. “For a lot of us the internet is an essential utility that we can’t live without. These things really do have an impact, including an economic impact.”

Graham-Cumming and Belson note that they see increasing government reliance in many places on digital curfews and intermittent, recurring shutdowns—a trend that seems very likely to continue. It has even become common in some countries to impose connectivity blackouts for a few hours a day during university exams, purportedly to reduce the possibility of students cheating. And in places like Ukraine, where connectivity outages are driven by persistent, wartime attacks on critical infrastructure, the impacts are unrelenting and serve as a particularly sobering illustration of this new digital normal.

Welcome to the Era of Internet Blackouts

Some 1,700 spoofed apps, 120 targeted publishers, 12 billion false ad requests per day—Vastflux is one of the biggest ad frauds ever discovered.

Every time you open an app or website, a flurry of invisible processes takes place without you knowing. Behind the scenes, dozens of advertising companies are jostling for your attention: They want their ads in front of your eyeballs. For each ad, a series of instant auctions often determines which ads you see. This automated advertising, often known as programmatic advertising, is big business, with $418 billion spent on it last year. But it’s also ripe for abuse.

Security researchers today revealed a new widespread attack on the online advertising ecosystem that has impacted millions of people, defrauded hundreds of companies, and potentially netted its creators some serious profits. The attack, dubbed Vastflux, was discovered by researchers at Human Security, a firm focusing on fraud and bot activity. The attack impacted 11 million phones, with the attackers spoofing 1,700 app and targeting 120 publishers. At its peak, the attackers were making 12 billion requests for ads per day.

“When I first got the results for the volume of the attack, I had to run the numbers multiple times,” says Marion Habiby, a data scientist at Human Security and the lead researcher on the case. Habiby describes the attack as both one of the most sophisticated the company has seen and the largest. “It is clear the bad actors were well organized and went to great lengths to avoid detection, making sure the attack would run as long as possible—making as much money as possible,” Habiby says. 

Online and mobile advertising is a complex, often murky business. But it generates piles of money for those involved. Every day billions of ads are placed on websites and in apps—advertisers or ad networks pay to have their ads displayed and make money when people click on them or see them—and much of this is done as you open a website or an app.

Vastflux was first detected by Human Security researcher Vikas Parthasarathy in the summer of 2022 while he was investigating a different threat. Habiby says operating the fraud involved multiple steps, and the attackers behind it took a range of measures to avoid being caught out.

First, the group behind the attack—which Human Security hasn’t named due to ongoing investigations—would target popular apps and try to buy an advertising slot within them. “They were not trying to hijack an entire phone, or an entire app, they were literally going through one ad slot,” Habiby says. 

Once Vastflux won the auction for an ad, the group would insert some malicious JavaScript code into that ad to stealthily allow multiple video ads to be stacked on top of each other. 

Put simply, the attackers were able to hijack the advertising system so that when a phone was displaying an ad within an affected app, there would actually be up to 25 ads placed on top of each other. The attackers would get paid for each ad, and you would only see one ad on your phone. However, your phone battery would drain faster than usual as it processed all the fraudulent ads.

“It’s quite genius because the minute the ad disappears, your attack stops, which means that you’re not going to be found easily,” Habiby explains. 

The scale of this was colossal: In June 2022, at the peak of the group’s activity, it made 12 billion ad requests per day. Human Security says the attack primarily impacted iOS devices, although Android phones were also hit. In total, the fraud is estimated to have involved 11 million devices. There is little device owners could have done about the attack, as legitimate apps and advertising processes were impacted. 

Google spokesperson Michael Aciman says the company has strict policies against “invalid traffic” and there was limited Vastflux “exposure” on its networks. “Our team thoroughly evaluated the report’s findings and took prompt enforcement action,” Aciman says. Apple did not respond to WIRED's request for comment.

Mobile ad fraud can take many different forms. This can range, as with Vastflux, from types of ad stacking and phone farms to click farms and SDK spoofing. For phone owners, batteries dying quickly, large jumps in data use, or screens turning on at random times could be signs a device is being impacted by ad fraud. In November 2018, the FBI’s biggest ad fraud investigation charged eight men with running two notorious ad fraud schemes. (Human Security and other technology companies were involved in the investigation.) And in 2020, Uber won an ad fraud lawsuit after a company it hired to get more people to install its app did so through “click flooding.”

In the case of Vastflux, the biggest impact of the attack was arguably on those involved in the sprawling advertising industry itself. The fraud affected both advertising companies and apps that show ads. “They were trying to defraud all these different groups along the supply chain, with different tactics against very different ones,” says Zach Edwards, a senior manager of threat insights at Human Security. 

To avoid being detected—up to 25 simultaneous ad requests from one phone would look suspicious—the group used multiple tactics. They spoofed the advertising details of 1,700 apps, making it look like lots of different apps were involved in showing the ads, when only one was being used. Vastflux also modified its ads to only allow certain tags to be attached to adverts, helping it avoid detection. 

Matthew Katz, head of marketplace quality at FreeWheel, a Comcast-owned ad tech company that was partly involved in the investigation, says attackers in the space are becoming increasingly sophisticated. “Vastflux was an especially complicated scheme,” Katz says. 

The attack involved some significant infrastructure and planning, the researchers say. Edwards says Vastflux used multiple domains to launch its attack. The name Vastflux is based on “fast flux”—an attack type hackers use that involves linking multiple IP addresses to one domain name—and VAST, a template for video advertising, developed by a working group within the  Interactive Advertising Bureau (IAB), that was abused in the attack. (Shailley Singh, executive vice president, product and chief operating officer at IAB Tech Lab, says using the VAST 4 version of its template can help prevent attacks like Vastflux, and other technical measures from publishers and ad networks would help reduce its effectiveness.) “It’s not the very simple kind of fraud scheme that we see all the time,” Habiby says.

The researchers refused to reveal who may be behind the Vastflux—or how much money they potentially made—citing ongoing investigations. However, they say they’ve seen the same criminals running advertising fraud efforts as far back as 2020. In that instance, the ad fraud scheme was targeting US swing states and allegedly collecting users’ data.

For now, at least, Vastflux has been stopped. In June of last year, Human Security and several companies it has partnered with to take action against ad fraud began actively combating the group and the attack. Three separate disruptions of Vastflux took place during June and July 2022, dropping the number of ad requests from the attack to under a billion per day. “We identified the bad actors behind the operation and worked closely with abused organizations to mitigate the fraud,” the company said in a blog post.

In December, the actors behind the attack took down the servers, and Human Security hasn’t seen any activity from the group since then. Tamer Hassan, the firm’s CEO, says there are multiple actions people can take against criminal actors, some of which may lead to law enforcement action. However, money matters. Stopping attackers from profiting will reduce the attacks. “Winning the economic game is how we win as an industry against cybercriminals,” Hassan says.

_Update 11:55 am ET, January 19, 2023: Added comment from an IAB representative._

Source

Wired