MongoDB claims its new “Queryable Encryption” lets users search their databases while sensitive data stays encrypted. Oh, and its cryptography is open source.

After years of data breaches, leaks, and hacks leaving the world desperate for tools to stem the illicit flow of sensitive personal data, a key advance has appeared on the horizon.

On Tuesday, MongoDB is announcing “Queryable Encryption,” a feature that will allow database users to search their data while it remains encrypted. The tool, which is debuting in preview as part of MongoDB 6.0, attempts to bridge academic cryptography findings and real-world environments so users can adopt the feature without needing advanced theoretical expertise. Crucially, Queryable Encryption is built to work with existing databases rather than requiring users to re-architect their systems before they can take advantage of it.

Institutions from businesses to governments, health care facilities, and critical infrastructure already lean on encryption to render data unintelligible (and therefore not worth stealing) when it's traveling across networks or sitting in storage. But none of that protects data when it's actively being used for legitimate reasons—looking up a patient's medical records, say, or setting up a car rental reservation. That means an attacker—including a rogue employee—could potentially gain access to data the same way a doctor or customer service agent does. This is a nut everyone wants to crack, and the database maker MongoDB has been working on possible solutions for years. Now, the company says, it has one.

“This is exactly the kind of thing that customers are wanting. We work with the biggest banks, pension systems, treasury exchanges, payment networks, pizza chains—and everyone wants better assurances,” says Kenn White, MongoDB's security principal. “And because of some practical engineering breakthroughs, it went from an academic kind of thing to something that actually could work on big databases.”

Queryable Encryption could let a bank agent investigate your account for possible fraud on a range of dates without knowing which dates specifically flagged the system. Or it could allow a customer service rep to type the first few letters of a name and start a claims process while leaving the name encrypted and indecipherable. 

Many of these breakthroughs came from Brown University cryptographer Seny Kamara and his longtime collaborator Tarik Moataz. Several years ago, the pair cofounded a searchable encrypted database startup known as Aroki Systems along with entrepreneur John Partridge. Aroki collaborated with MongoDB on a database security feature, announced in 2019, and Kamara and Moataz continued working on a prototype of a truly searchable encrypted database. In 2021, MongoDB acquired Aroki.

The Queryable Encryption system is built with a combination of established cryptographic protocols and conceptual advances Kamara and Moataz have been working on for years in an area of cryptography known as structured encryption. The approach involves encrypting data with a specific architecture so it can be searched with special tokens specific to each query without data ever being decrypted. Other techniques such as homomorphic encryption allow users to do computations on encrypted data, like adding two columns in an encrypted spreadsheet. But structured encryption is specifically focused on organizing encrypted data so it can be found without exposing the data itself.

“What we focus on is not how to do arithmetic operations on encrypted data, but how to find information fast—like really, really fast,” says Kamara, who is currently on leave from his associate professor role at Brown.

Speed is a challenge in encrypted operations, where every extra key check and computation add complications to basic operations. But MongoDB claims that searches performed with Queryable Encryption are impressively fast and won't cause unreasonable performance losses—a claim that customers will be able to test for themselves with the new preview. MongoDB is also open-sourcing much of the Queryable Encryption system, so users and other researchers can vet its underlying cryptography.

“A lot of the work is very theoretical in nature, algorithms, crypto security definitions, but for me at the end of the day I want to see something come out of it,” Kamara says. “There is a social imperative behind the work that scientists do. Working with a company at the scale of Mongo, this will be available to a huge number of people, a huge number of work loads.”

Moataz and Kamara say the big breakthrough that allowed them to move their concept from the academic world toward the real world was emulation, which enabled them to use the properties of structured encryption with existing databases that have different architectures. Like emulating Super Nintendo games on your PC or emulating Windows on a Mac, the approach creates a liminal space in which structured encryption can run on top of traditional databases.

Still, Kamara and Moataz emphasize that it's been a challenge and a learning process to collaborate with MongoDB engineers and turn the Aroki Systems prototype into something that can actually be deployed at scale around the world.

“Seny and I have been learning a lot about the constraints of real-world deployments that academics know nothing about,” Moataz says. “Models in academia are less restrictive. So we are enjoying being exposed to that and improving our models and our designs with respect to these constraints.”

Though Tuesday's release will be the first time that the public can vet Queryable Encryption in the wild, Aroki Systems had cryptographer JP Aumasson conduct technical due diligence on the cryptographic underpinning of their prototype system. And MongoDB invited University of Chicago cryptographer and searchable encryption researcher David Cash to take an early look as well. Both told WIRED that while they haven't audited the entire system deployment, the underlying cryptography appears sound. And they both emphasize that it's exciting to see a real-world searchable encryption scheme take shape after so long.

“A lot of crypto research since the 1980s has sort of been centered on how do we do this stuff, so this is a long time coming," Cash says. “Everything in cryptography is about trade-offs, and the world is complicated, so it's important to be careful about absolute statements, but that this vision is realized in some form is very exciting. And this is not at all snake oil or security theater. They're going deep on this and thinking about the important stuff carefully.”

Aumasson says that many others have claimed to offer searchable encryption without the technical depth or capability. “There have been other products advertising encrypted search, but academics would really laugh at those,” he says. “What Mongo is doing is something that is academic-compliant, and I’m very happy to see it.”

A Long-Awaited Defense Against Data Leaks May Have Just Arrived

Apps collect sensitive data that could be subpoenaed by law enforcement or sold by data brokers.

When the draft of the Supreme Court’s decision on _Roe v. Wade_ was leaked to the public in early May, Elizabeth C. McLaughlin kicked off a social media storm. The founder of the Gaia Leadership Project, a company that trains women leaders and entrepreneurs, tweeted: “If you are using an online period tracker or tracking your cycles through your phone, get off it and delete your data. Now.” It had never occured to many women, until then, that their data could be weaponized against them. But experts that spoke to WIRED say that fertility and period-tracking apps—along with the myriad other data trails that users leave behind—could be a rich source of data for law enforcement looking to punish women if abortion is outlawed or criminalized.

“If there's an app out there that's collecting health data, it will soon be a target,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project (STOP). “One of the sad ironies of this is that people who are actively trying to get pregnant will have a harder time using the technology to do it for fear of how that technology might be used against them in a court of law.”

Fertility and period-tracking apps vary, but most allow users to manually enter when their periods start and end, whether they use birth control, the length of their cycle, and their moods. Some allow users to track their periods as well as pregnancy. Many apps also allow users to sign in with their Google or Facebook accounts. Some also collect geolocation data.

WIRED reached out to five popular fertility and period-tracking apps: Flo, Glowing, Clue, Glow, and Pinkbird. Only Clue responded, pointing to a public statement it released in the wake of widespread public concern. According to the statement, Clue abides by the European General Data Protection Regulation (GDPR), and “any change to US abortion laws would not affect these privacy protections.” The company did not address whether it would respond to legal requests for user data from law enforcement. None of the companies responded to questions about whether usership had dropped in the wake of the Supreme Court leak.

Search history and other data has already been used as evidence to criminalize those seeking an abortion in US states with stringent local laws. But privacy experts worry that the more granular data collected by period tracking and fertility apps could be particularly incriminating for those seeking an abortion. Just two weeks after the leaked decision, Vice reported that Narrative, a data marketplace, allowed anyone to purchase information about who had downloaded period-tracking apps (though not the data in the apps themselves), and last year, _The New York Times_ revealed that Flo was selling its user data.

But most users will never know if their data has been sold or exactly how much is already out there. “Actually knowing where your data has gone and if your data was sold is almost impossible in this day and age,” says Deven McGraw, data stewardship lead at Invitae, whose platform Ciitizen helps patients control their health care data.

According to Fox Cahn, apps that collect and store data on their own servers are particularly dangerous, both because the data can be sold and hacked, but also because law enforcement can serve companies with subpoenas for user data. In a recent report, STOP pointed out that some apps let users store data on their phone—a much safer option—but one that still won’t protect them in the face of a search warrant.

But Fox Cahn says that the concern goes far deeper than just fertility apps. “Basically any health data app for pregnant people or potentially pregnant people could be weaponized.”

To understand how, one need only look at the country’s immigration infrastructure, says Paromita Shah, executive director at Just Futures Law. The Department of Homeland Security and Immigration and Customs Enforcement have long used data to surveil and arrest activists and immigrants, she says. “There is no consumer privacy law that I have seen that really can impact the police,” says Shah. “And they're buying this data to get around their obligations to follow the Constitution.”

Even if users decide to delete period-tracking apps, their data may have already been collected. For those who want to keep using them, McGraw says “it takes a lot of effort” to ensure data isn’t being shared. None of the companies responded to questions about their usership figures.

“Mostly what you can do, but which people rarely do, is pay a bit more attention to the terms of service and the privacy policies of the apps you use,” she says. But removing data that’s already out there would only be possible “if you've got a company that's covered by a state law that gives you a right of deletion.”

Euki, an app released by the international group Women Helping Women, anticipated many of these problems. “When somebody creates an app, obviously they want to monetize, they want to pay for it. And the way they recoup their costs and make profits into the future is by marketing the data,” says Susan Yanow, a reproductive health consultant and the US representative for the organization. “We obtained a grant to make Euki, because we were a nonprofit. We were never looking to make up that cost. The goal was to get it into the hands of as many people as possible, as securely as possible.”

Euki, which contains information about abortion, contraception, sexually transmitted infections, and miscarriages, stores all data on the user’s device rather than uploading it to a third-party server. It is password protected, and allows users to set up a second password that, when entered, will bring up a second, fake app, keeping even the nature of the app a secret. There is even an option to delete all of the collected data.

In the weeks since the draft decision leaked, Yanow says Women Helping Women has seen a massive influx of users to the organization’s website—which she hopes will lead people to the Euki app.

“We truly believe that the person who owns the app is the person who should be deciding what to do about \[a missed period or pregnancy\], should that happen,” says Yanow.

Period-Tracking and Fertility Apps Can Put Women Seeking Abortions at Risk

When the draft of the Supreme Court’s decision on _Roe v. Wade_ was leaked to the public in early May, Elizabeth C. McLaughlin kicked off a social media storm. The founder of the Gaia Leadership Project, a company that trains women leaders and entrepreneurs, tweeted: “If you are using an online period tracker or tracking your cycles through your phone, get off it and delete your data. Now.” It had never occured to many women, until then, that their data could be weaponized against them. But experts that spoke to WIRED say that fertility and period-tracking apps—along with the myriad other data trails that users leave behind—could be a rich source of data for law enforcement looking to punish women if abortion is outlawed or criminalized.

“If there's an app out there that's collecting health data, it will soon be a target,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project (STOP). “One of the sad ironies of this is that people who are actively trying to get pregnant will have a harder time using the technology to do it for fear of how that technology might be used against them in a court of law.”

Fertility and period-tracking apps vary, but most allow users to manually enter when their periods start and end, whether they use birth control, the length of their cycle, and their moods. Some allow users to track their periods as well as pregnancy. Many apps also allow users to sign in with their Google or Facebook accounts. Some also collect geolocation data.

WIRED reached out to five popular fertility and period-tracking apps: Flo, Glowing, Clue, Glow, and Pinkbird. Only Clue pointed to a public statement it released in the wake of widespread public concern. According to the statement, Clue abides by the European General Data Protection Regulation (GDPR), and “any change to US abortion laws would not affect these privacy protections.” The company did not address whether it would respond to legal requests for user data from law enforcement. In a statement to WIRED, Flo said that it “does not share personal health data with any third party” and that it “will never require a user to log an abortion or offer details that they feel should be kept private.” Glowing, Glow, and Pinkbird did not respond. None of the companies would comment on whether usership had dropped in the wake of the Supreme Court leak.

Search history and other data has already been used as evidence to criminalize those seeking an abortion in US states with stringent local laws. But privacy experts worry that the more granular data collected by period tracking and fertility apps could be particularly incriminating for those seeking an abortion. Just two weeks after the leaked decision, Vice reported that Narrative, a data marketplace, allowed anyone to purchase information about who had downloaded period-tracking apps (though not the data in the apps themselves), and last year, _The New York Times_ revealed that Flo was selling its user data.

But most users will never know if their data has been sold or exactly how much is already out there. “Actually knowing where your data has gone and if your data was sold is almost impossible in this day and age,” says Deven McGraw, data stewardship lead at Invitae, whose platform Ciitizen helps patients control their health care data.

According to Fox Cahn, apps that collect and store data on their own servers are particularly dangerous, both because the data can be sold and hacked, but also because law enforcement can serve companies with subpoenas for user data. In a recent report, STOP pointed out that some apps let users store data on their phone—a much safer option—but one that still won’t protect them in the face of a search warrant.

But Fox Cahn says that the concern goes far deeper than just fertility apps. “Basically any health data app for pregnant people or potentially pregnant people could be weaponized.”

To understand how, one need only look at the country’s immigration infrastructure, says Paromita Shah, executive director at Just Futures Law. The Department of Homeland Security and Immigration and Customs Enforcement have long used data to surveil and arrest activists and immigrants, she says. “There is no consumer privacy law that I have seen that really can impact the police,” says Shah. “And they're buying this data to get around their obligations to follow the Constitution.”

Even if users decide to delete period-tracking apps, their data may have already been collected. For those who want to keep using them, McGraw says “it takes a lot of effort” to ensure data isn’t being shared. None of the companies responded to questions about their usership figures.

“Mostly what you can do, but which people rarely do, is pay a bit more attention to the terms of service and the privacy policies of the apps you use,” she says. But removing data that’s already out there would only be possible “if you've got a company that's covered by a state law that gives you a right of deletion.”

Euki, an app released by the international group Women Help Women, anticipated many of these problems. “When somebody creates an app, obviously they want to monetize, they want to pay for it. And the way they recoup their costs and make profits into the future is by marketing the data,” says Susan Yanow, a reproductive health consultant and the US representative for the organization. "We were never looking to make up that cost. The goal was to get it into the hands of as many people as possible, as securely as possible.”

Funding for Euki came instead from a grant obtained by Ibis Reproductive Health, a partner organization of Women Help Women. The app contains information about abortion, contraception, sexually transmitted infections, and miscarriages, stores all data on the user’s device rather than uploading it to a third-party server. It is password protected, and allows users to set up a second password that, when entered, will bring up a second, fake app, keeping even the nature of the app a secret. There is even an option to delete all of the collected data.

In the weeks since the draft decision leaked, Yanow says Women Help Women has seen a massive influx of users to the organization’s website—which she hopes will lead people to the Euki app.

“We truly believe that the person who owns the app is the person who should be deciding what to do about \[a missed period or pregnancy\], should that happen,” says Yanow.

_**Update 6/8/22 1:33PM ET:** This story has been updated to include comment from Flo and to give the correct name of Women Help Women._

Five years after it was torn offline, the resurrected dark web marketplace is clawing its way back to the top of the online underworld.

For years, dark web markets and the law enforcement agencies that combat them have been locked into a cycle of raid, rinse, repeat: For every online black market destroyed, another has always been there to take its place. But rarely has a dominant dark web market been busted by a massive law enforcement operation only to rise from the ashes half a decade later and regain its top spot—a feat that may very soon be achieved by AlphaBay, the once and future king of the contraband crypto-economy.

In July of 2017, a global law enforcement sting known as Operation Bayonet took down AlphaBay’s sprawling narcotics-and-cybercrime bazaar, seizing the site’s central server in Lithuania and arresting its creator, Alexandre Cazes, outside his home in Bangkok. Yet in August of last year, AlphaBay’s number-two administrator and security specialist, publicly known only as DeSnake, suddenly reappeared, announcing AlphaBay’s resurrection in a new and improved form. Now, 10 months later, thanks in part to a tumult of takedowns and the mysterious disappearances of competing dark web markets, DeSnake’s reincarnated AlphaBay is now well on its way to its former heights atop the digital underworld. By some measures, it appears to have already regained that spot.

“Yes, AlphaBay is the #1 darknet marketplace right now,” says DeSnake, writing to WIRED in a text-based conversation last week. “I did tell you we were going to be #1 before,” he added, referring to our interview with AlphaBay’s new admin at the time of its relaunch last summer. “As I have told you, I do what I say.”

DeSnake’s boast is at least partly true: As of last week, AlphaBay had more than 30,000 unique product listings—largely drugs, from ecstasy to opioids to methamphetamines—but also thousands of listings for malware and stolen data, like Social Security numbers and credit card details. That’s up from a mere 500 listings in September of last year. Another older market called ASAP displays more than 50,000 listings. But ASAP is known to allow vendors to post duplicate listings. And according to security firm Flashpoint, which closely tracks the competing markets, AlphaBay had more than 1,300 active vendors in roughly the first six months of this year, compared to about 1,000 for ASAP. According to Flashpoint’s data, AlphaBay’s listings also appear to be growing significantly faster.

Other markets touted in dark web forums like Archetyp and Incognito, meanwhile, have only a few thousand or just a few hundred listings. All of that suggests AlphaBay may already be the most popular market for dark web vendors to list their wares for sale.

AlphaBay’s tens of thousands of product listings are still a tiny fraction of the more than 350,000 it offered before its 2017 takedown, when it was the biggest dark web market ever seen. By the FBI’s estimate, it was 10 times the size of the legendary Silk Road drug market. DeSnake concedes that the new AlphaBay's revenue hasn’t yet come close to the level of its 2017 peak, when blockchain analysis firm Chainalysis estimates that AlphaBay generated as much as $2 million a day in sales. (DeSnake declined to share current sales numbers but said they are “in the big digits.”)

Also, unlike most competitors, the new version of AlphaBay only allows users to buy and sell in the privacy-focused cryptocurrency Monero, not Bitcoin, transactions of which can often be tracked through blockchain surveillance. That makes the site’s sales difficult to measure and may mean it has fewer sales per listing, since many users prefer to trade in Bitcoin.

But even accounting for that difference and other unknowns in a side-by-side analysis of dark web markets, AlphaBay appears to be the leading marketplace, or will be soon, says Ian Gray, a dark web-focused analyst at security firm Flashpoint. “The writing is on the wall that AlphaBay is probably going to regain that spot as the most popular marketplace,” says Gray, “And it already seems like it’s the biggest in terms of volume of vendors.”

AlphaBay’s quick growth—or regrowth—has been fueled in part by what Gray calls “the Great Cyber Resignation.” At least 10 dark web markets have dropped offline for various reasons in the last 18 months. Some have been busted by law enforcement, like Dark Market, which was the target of a Europol-led takedown operation early last year; or Hydra, the massive Russian-language drug and money-laundering market whose servers were seized in a law enforcement raid in April. Others, like Dark0de and World Market, are believed to have pulled “exit scams,” disappearing suddenly with their users’ money. Still others, like Cannazon and White House Market, staged more considerate and organized exits, giving users time to pull out any funds held on the sites.

Dark web market product listing data shows how the new AlphaBay market has survived a mass exodus of competitors. (Data does not include ASAP data for the last two days of the analyzed time period.)

Flashpoint

Until late May, that left a site called Versus as the last leading market standing. But then, just two weeks ago, DeSnake published a post on the dark web market forum Dread with evidence that pointed to a security vulnerability in Versus—provided to him, DeSnake claimed, by a user named “threesixty”—that exposed Versus’ IP address, potentially leaving its users vulnerable to hackers or law enforcement. “Both threesixty and myself have the best intentions,” DeSnake wrote in his post. “We hope to have a fruitful conversation about security on marketplaces.”

Versus responded by immediately announcing its retirement. “We will say that there was a clear agenda behind the way this was originally handled,” wrote the site’s administrator, who went by the name William Gibson, “but we leave you to draw your own conclusions.”

DeSnake, meanwhile, maintained both on Dread and to WIRED that he doesn’t have any personal or professional connection to threesixty, the hacker whose vulnerability discovery took down AlphaBay's largest remaining competitor. “We handled it the best possible way, due to the severity of the issue,” DeSnake says.

Aside from the circumstances around Versus’ exit, the recently dwindling number of dark web markets is perhaps due to the generally hostile environment they face, says Flashpoint’s Ian Gray. Markets are often under bombardment from distributed denial of service attacks launched by competitors using waves of junk traffic to knock them offline and have to deal with constant disputes among buyers and sellers. Market administrators also feel the ever-present threat of law enforcement looming in the background. All of this incentivizes a take-the-money-and-run approach for any dark web administrator who achieves a certain level of success—and has allowed DeSnake, who appears to be more ambitious and persistent in his goals, to elevate AlphaBay back to the top. “With all these other shutdowns, you have so few players in the space,” says Gray. “There’s really only one that’s fairly well established, and that’s AlphaBay.”

When AlphaBay first reappeared, Gray and other dark web analysts and users expressed suspicion that DeSnake might be compromised by law enforcement. Although he seemed to prove his identity as the former AlphaBay’s right hand by signing messages with the same PGP cryptographic key he’d used in the past, many dark web denizens were wary that he might be controlled by a police agency as part of an undercover operation, as when Dutch police secretly took over the Hansa dark web drug market in 2017.

After nearly a year back online, though, DeSnake says he feels “vindicated,” given that few if any undercover operations have lasted that long. “For majority of vendors and customers the question has been put to rest,” DeSnake says.

If DeSnake has proven himself to be the legit heir to AlphaBay—and doesn’t pull an exit scam himself—he still faces the risk of a law enforcement takedown, which only grows as the reborn market takes the limelight. “It’s Russian roulette running a dark web marketplace, particularly with all the information we got from the AlphaBay takedown,” says Grant Rabenn, a former federal prosecutor who led the investigation that resulted in AlphaBay’s 2017 bust and the arrest of its original admin, Alexandre Cazes, who was later found dead in a Thai jail of an apparent suicide. (DeSnake has claimed, without proof, that Cazes was murdered.)

Rabenn hints that the 2017 case also resulted in US law enforcement obtaining a “fair amount of information” on AlphaBay’s staff. As the dark web market grows, that previous investigation might provide leads on DeSnake’s identity, with federal agencies refocusing their attention on AlphaBay and its new boss. “It’s definitely putting a target on your back, not only from the historical conduct and connections but also being the top one,” Rabenn says. “Everyone’s going to look for that one.”

DeSnake tells WIRED, however, that he’s developed a few forms of protection that give him confidence he’ll continue to stay a step ahead of the feds. Perhaps most importantly, he claims to be based in a former Soviet country that has no extradition treaty with the US. His choice for AlphaBay to use only Monero, rather than Bitcoin, may make the sort of blockchain analysis that contributed to the original site’s takedown far more difficult. And he claims to have built complex technical protections that include redundant infrastructure in multiple countries, along with a system called AlphaGuard that’s designed to automatically relaunch the site on new servers in the case of a bust. “We will be back and running within a few days and without a cent lost,” DeSnake says.

DeSnake has announced that he eventually hopes to develop a “decentralized marketplace network” where dark web markets are hosted across hundreds or thousands of servers—a kind of uncensorable, unseizable Bittorrent to the current markets’ Napster. He claims a test version of that decentralization scheme is planned for the end of this year, and that AlphaBay will move to it sometime in 2023. “First we want to reach the scale we did before in 2017 that is our milestone. Second, we want to launch a beta of the decentralized project,” says DeSnake “Then migrate step by step fully to allow AlphaBay to exist for many years ahead and usher the \[darknet market\] scene into a new golden era like we did before.”

It’s far from clear whether that plan—or DeSnake’s self-described invulnerability—is real or a mirage. But he does appear to have followed through—or will soon—on his first promise: to regain the dark web’s crown. And another period of AlphaBay’s reign may be just beginning.

AlphaBay Is Taking Over the Dark Web—Again

As governments crack down on ransomware, cybercriminals may soon shift to business email compromise—already the world's most profitable type of scam.

Ransomware attacks, including those of the massively disruptive and dangerous variety, have proved difficult to combat comprehensively. Hospitals, government agencies, schools, and even critical infrastructure companies continue to face debilitating attacks and large ransom demands from hackers. But as governments around the world and law enforcement in the United States have grown serious about cracking down on ransomware and have started to make some progress, researchers are trying to stay a step ahead of attackers and anticipate where ransomware gangs may turn next if their main hustle becomes impractical.

At the RSA security conference in San Francisco on Monday, longtime digital scams researcher Crane Hassold will present findings that warn it would be logical for ransomware actors to eventually convert their operations to business email compromise (BEC) attacks as ransomware becomes less profitable or carries a higher risk for attackers. In the US, the Federal Bureau of Investigation has repeatedly found that total money stolen in BEC scams far exceeds that pilfered in ransomware attacks—though ransomware attacks can be more visible and cause more disruption and associated losses. 

In business email compromise, attackers infiltrate a legitimate corporate email account and use the access to send phony invoices or initiate contract payments that trick businesses into wiring money to criminals when they think they’re just paying their bills.

“So much attention is being paid to ransomware, and governments all over the world are taking action to disrupt it, so eventually the return on investment is going to be impacted,” says Hassold, who is director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “And ransomware actors are not going to say, ‘Oh, hey, you got me’ and go away. So it’s possible that you would have this new threat where you have the more sophisticated actors behind ransomware campaigns moving over to the BEC space where all the money is being made.”

BEC attacks, many of which originate in West Africa and specifically Nigeria, are historically less technical and rely more on social engineering, the art of creating a compelling narrative that tricks victims into taking actions against their own interests. But Hassold points out that a lot of the malware used in ransomware attacks is built to be flexible, with a modular quality so different types of scammers can assemble the combination of software tools they need for their specific hustle. And the technical ability to establish “initial access,” or a digital foothold, to then deploy other malware would be extremely useful for BEC, where gaining access to strategic email accounts is the first step in most campaigns. Ransomware actors would bring a much higher level of technical sophistication to this aspect of the scams.

Hassold also points out that while the most notorious and aggressive ransomware gangs are typically small teams, BEC actors are usually organized into much looser and more decentralized collectives, making it more difficult for law enforcement to target a central organization or kingpin. Similar to Russia’s unwillingness to cooperate on ransomware investigations, it has taken time for global law enforcement to develop working relationships with the Nigerian government to counter BEC. But even as Nigeria has put more emphasis on BEC enforcement, countering the sheer scale of the scam operations is still a challenge.

“You can’t just cut off the head of the snake,” Hassold says. “If you arrest a dozen or even a few hundred of these actors, you’re still not making much of a dent.”

For ransomware actors, the most difficult aspect of transitioning to BEC scams would likely be the dramatic difference in collecting stolen money. Ransomware gangs almost exclusively collect victim payments in cryptocurrency, while BEC actors primarily use local networks of money mules in the markets where they launch their scams to launder fiat currency. Ransomware actors would need to plug into existing networks or invest in establishing their own in order to monetize BEC scams and have somewhere for the errant payments to go. Hassold points out, though, that as law enforcement becomes increasingly adept at tracing and freezing cryptocurrency payments—and as the value of cryptocurrencies continues to fluctuate wildly—ransomware actors may be motivated to learn new techniques and switch gears.

Crucially, Hassold notes that while he and his colleagues have not seen evidence of active collaboration between Eastern European ransomware gangs and West African BEC actors, he does see evidence on criminal forums and in active engagement with attackers that ransomware actors are interested in BEC and have been learning about it. Whether this exploration is simply for, ahem, professional enrichment, remains to be seen.

“All of these types of attacks are very serious and the stakes are very high, so it got me thinking about what things will look like in the future when ransomware eventually gets disrupted,” Hassold says. “It’s possible that these two threats on opposite sides of the cybercrime spectrum will converge in the future—and we need to be ready for that.”

The Hacker Gold Rush That's Poised to Eclipse Ransomware

Ransomware attacks, including those of the massively disruptive and dangerous variety, have proved difficult to combat comprehensively. Hospitals, government agencies, schools, and even critical infrastructure companies continue to face debilitating attacks and large ransom demands from hackers. But as governments around the world and law enforcement in the United States have grown serious about cracking down on ransomware and have started to make some progress, researchers are trying to stay a step ahead of attackers and anticipate where ransomware gangs may turn next if their main hustle becomes impractical.

At the RSA security conference in San Francisco on Monday, longtime digital scams researcher Crane Hassold will present findings that warn it would be logical for ransomware actors to eventually convert their operations to business email compromise (BEC) attacks as ransomware becomes less profitable or carries a higher risk for attackers. In the US, the Federal Bureau of Investigation has repeatedly found that total money stolen in BEC scams far exceeds that pilfered in ransomware attacks—though ransomware attacks can be more visible and cause more disruption and associated losses. 

In business email compromise, attackers infiltrate a legitimate corporate email account and use the access to send phony invoices or initiate contract payments that trick businesses into wiring money to criminals when they think they’re just paying their bills.

“So much attention is being paid to ransomware, and governments all over the world are taking action to disrupt it, so eventually the return on investment is going to be impacted,” says Hassold, who is director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “And ransomware actors are not going to say, ‘Oh, hey, you got me’ and go away. So it’s possible that you would have this new threat where you have the more sophisticated actors behind ransomware campaigns moving over to the BEC space where all the money is being made.”

BEC attacks, many of which originate in West Africa and specifically Nigeria, are historically less technical and rely more on social engineering, the art of creating a compelling narrative that tricks victims into taking actions against their own interests. But Hassold points out that a lot of the malware used in ransomware attacks is built to be flexible, with a modular quality so different types of scammers can assemble the combination of software tools they need for their specific hustle. And the technical ability to establish “initial access,” or a digital foothold, to then deploy other malware would be extremely useful for BEC, where gaining access to strategic email accounts is the first step in most campaigns. Ransomware actors would bring a much higher level of technical sophistication to this aspect of the scams.

Hassold also points out that while the most notorious and aggressive ransomware gangs are typically small teams, BEC actors are usually organized into much looser and more decentralized groups, making it more difficult for law enforcement to target a central organization or kingpin. Similar to Russia’s unwillingness to cooperate on ransomware investigations, it has taken time for global law enforcement to develop working relationships with the Nigerian government to counter BEC. But even as Nigeria has put more emphasis on BEC enforcement, countering the sheer scale of the scam operations is still a challenge.

“You can’t just cut off the head of the snake,” Hassold says. “If you arrest a dozen or even a few hundred of these actors, you’re still not making much of a dent.”

For ransomware actors, the most difficult aspect of transitioning to BEC scams would likely be the dramatic difference in collecting stolen money. Ransomware gangs almost exclusively collect victim payments in cryptocurrency, while BEC actors primarily use local networks of money mules in the markets where they launch their scams to launder fiat currency. Ransomware actors would need to plug into existing networks or invest in establishing their own in order to monetize BEC scams and have somewhere for the errant payments to go. Hassold points out, though, that as law enforcement becomes increasingly adept at tracing and freezing cryptocurrency payments—and as the value of cryptocurrencies continues to fluctuate wildly—ransomware actors may be motivated to learn new techniques and switch gears.

Crucially, Hassold notes that while he and his colleagues have not seen evidence of active collaboration between Eastern European ransomware gangs and West African BEC actors, he does see evidence on criminal forums and in active engagement with attackers that ransomware actors are interested in BEC and have been learning about it. Whether this exploration is simply for, ahem, professional enrichment, remains to be seen.

“All of these types of attacks are very serious and the stakes are very high, so it got me thinking about what things will look like in the future when ransomware eventually gets disrupted,” Hassold says. “It’s possible that these two threats on opposite sides of the cybercrime spectrum will converge in the future—and we need to be ready for that.”

Plus: The US admits to cyber operations supporting Ukraine, SCOTUS investigates its own, and a Michael Flynn surveillance mystery is solved.

Not to freak out anyone, but there's a serious flaw in all supported versions of Microsoft Windows that allows attackers to take over your machine. The so-called Follina vulnerability can be exploited using a weaponized Word document, and security researchers say they've already spotted government-backed hackers using this attack in the wild. Fingers crossed that Microsoft, which has downplayed the severity of the flaw, issues a patch soon.

Speaking of patches, everything from Apple's iOS and Google Android to Chrome, Firefox, and Zoom received major security updates in May. Check out our complete list of available updates to see which apps you need to attend to as soon as possible.

We also explored the race to protect your voice from hackers and corporate greed. And we tried to unravel the mystery of China's sudden warnings about US state-sponsored hackers going after Chinese systems, despite the fact that these hacks are well known and happened ages ago.

Meanwhile, in India, the country's telecom regulator is preparing to crack down on robocall spam and scammers by requiring callers' names to appear on caller ID. The idea sounds good—until you realize the privacy implications and the fact that such a plan might not even work.

Finally, because nothing's sacred, Canada's privacy commissioner this week announced that a mobile app for Tim Hortons, the beloved coffee chain, illegally spied on its users' locations. The app, which used location-tracking tech from US-based firm Radar, collected a constant stream of users' location data—checking as frequently as every 2.5 minutes—and would create an “event” anytime a user “entered or left” their home, office, major sports complex, or rival coffee shop, according to the commissioner's office.

But that's not all, folks. Each week, we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there. 

If you lived in Illinois between May 1, 2015, and April 25, 2022, Google may owe you some cash. The company recently settled a class-action lawsuit over a feature in the Google Photos app that categorized photos of people based on their faces. The problem? According to the lawsuit, Google failed to receive consent to do so from millions of users, a violation of the state's Biometric Information Privacy Act. Google did not admit fault as part of the settlement, but it has agreed to pay $100 million and put in place measures to avoid further privacy violations. If you were an Illinois resident during that seven-year period and appeared in a photo uploaded to the Google Photos app, you can file a claim for your piece of the $100 million pie.

The blurry line between “at war” and “not at war” grew even fuzzier this week. General Paul Nakasone, the head of US Cyber Command and the NSA, told Sky News that the US military has conducted “a series of operations across the full spectrum," including “offensive, defensive, and information operations” in support of Ukraine's defense against Russia's invasion. Nakasone declined to detail what these operations entailed but assured that they were perfectly legal. The general's admission coincides with the US agreeing to provide Ukraine with advanced missile systems with a range of 50 miles. The Kremlin responded to this news by saying the US was “pouring fuel on the fire.”

As part of the US Supreme Court's investigation into the leak of a draft opinion overturning guaranteed abortion rights in the United States, the Court's clerks have been asked to turn over their private phone records and sign an affidavit, according to CNN. The “unprecedented” move is jarring for civil liberties advocates. As Albert Fox Cahn, found of the Surveillance Technology Oversight Project, writes for WIRED: “The intrusive probe reveals a disturbing about-face from the Supreme Court, and particularly Chief Justice John Roberts, on surveillance powers.” The clerks, meanwhile, are reportedly hesitant to refuse the demand for phone records or seek legal counsel for fear of being wrongly suspected of leaking the draft opinion to _Politico_ reporters.

A Trump-era conspiracy theory can finally be put to rest—theoretically, at least. A 52-page classified report into the “unmasking” of Michael Flynn, a former US national security adviser to Donald Trump, has now been made public thanks to a Freedom of Information Act request filed by Jason Leopold of Buzzfeed News. Republicans have long accused Obama administration operatives of revealing Flynn's name in classified material for political purposes in the lead-up to the 2016 election. But the Justice Department report, prepared by former US Attorney John Brash, found “no evidence that unmasking requests were made for political purposes or other inappropriate reasons during the 2016 election period or the ensuing transition period." Flynn ultimately resigned in 2017 for misleading vice president Mike Pence about Flynn’s calls with Russia's ambassador to the US.

Source

Wired