Plus: WhatsApp plugs holes that could be used for remote execution attacks, Microsoft patches a zero-day vulnerability, and more.

None of the issues patched by Google are known to have been exploited in attacks, but if the update is available to you, it’s a good idea to apply it as soon as possible.

Microsoft

Microsoft Patch Tuesday is an important one because it comes with a fix for a flaw already being used in attacks. The zero-day vulnerability, tracked as CVE-2022-37969, is a privilege escalation issue in the Windows Common Log File System Driver that could allow an adversary to take control of the machine.

The zero-day is among 63 vulnerabilities patched by Microsoft, including five rated as critical. These include CVE-2022-34722 and CVE-2022-34721, remote code execution (RCE) flaws in the Windows Internet Key Exchange Protocol (IKE) which both have a CVSS score of 9.8.

Later in September, Microsoft issued an out-of-band security update for a spoofing vulnerability in its Endpoint Configuration Manager tracked as CVE 2022 37972.

WhatsApp

Encrypted messaging service WhatsApp has released an update to fix two vulnerabilities that could result in remote code execution. CVE-2022-36934 is an integer overflow issue in WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, and Business for iOS prior to v2.22.16.12, which could result in remote code execution in a video call.

Meanwhile, CVE-2022-27492 is an integer underflow flaw in WhatsApp for Android prior to v2.22.16.2 and WhatsApp for iOS v2.22.15.9 that could have caused remote code execution for someone receiving a crafted video file, according to the WhatsApp security advisory.

WhatsApp patched these flaws about a month ago, so if you are running the current version, you should be safe.

HP

HP has fixed a serious issue in the support assistant tool that comes preinstalled on all of its laptops. The privilege escalation bug in HP Support Assistant is ranked as a high-severity issue and is tracked as CVE-2022-38395.

HP has released only limited details about the vulnerability on its support page, but it goes without saying that those with affected equipment should ensure they update now.

SAP

SAP’s September Patch Day saw the release of 16 new and updated patches, including three high-priority fixes for SAP Business One, SAP BusinessObjects, and SAP GRC.

The SAP Business One fix, which patches an Unquoted Service Path vulnerability, is the most critical of the three. Attackers could exploit the flaw “to execute an arbitrary binary file when the vulnerable service starts, which could allow it to escalate privileges to SYSTEM,” security firm Onapsis says.

A second fix for SAP BusinessObjects patches an information disclosure vulnerability. “Under certain conditions, the vulnerability allows an attacker to gain access to unencrypted sensitive information in the Central Management Console of SAP BusinessObjects Business Intelligence Platform,” says Onapsis in its blog.

The third High Priority Note affecting SAP GRC customers could allow an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad.

Cisco

Software giant Cisco has issued a patch to fix a high-severity security issue in the binding configuration of SD-WAN vManage software containers. Tracked as CVE-2022-20696, the flaw could allow an unauthenticated attacker who has access to the VPN0 logical network to access the messaging service ports on an affected system.

“A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload,” Cisco warned in an advisory.

Sophos

Security company Sophos has just fixed an RCE flaw in its firewall product that it says is already being used in attacks. Tracked as CVE-2022-3236, the code injection vulnerability was discovered in the User Portal and Webadmin of Sophos Firewall.

“Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region,” the firm said in a security advisory.

WP Gateway WordPress Plugin

A vulnerability in a WordPress plugin called AP Gateway is already being used in attacks. Tracked as CVE-2022-3180, the privilege escalation bug could allow attackers to add a malicious user with admin privileges to take over sites running the plugin.

“As this is an actively exploited zero-day vulnerability, and attackers are already aware of the mechanism required to exploit it, we are releasing this public service announcement to all of our users,” said Ram Gall, a Wordfence senior threat analyst, adding that certain details have been withheld intentionally to prevent further exploitation.

Go Update iOS, Chrome, and HP Computers to Fix Serious Flaws

The messenger protocol had gained popularity for its robust security, but vulnerabilities allowed attackers to decrypt messages and impersonate users.

Developers of the open source Matrix messenger protocol have released an update to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform’s meteoric rise.

Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there’s a dizzying array of other members as well.

Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can’t be spoofed and that only the senders and receivers of messages can read the contents.

Matthew Hodgson—the cofounder and project lead for Matrix and the CEO and CTO at Element, maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany.

On Wednesday, a team published research that reports a host of vulnerabilities that undermine Matrix’s authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect that an attack is underway.

The researchers privately reported the vulnerabilities to Matrix earlier this year and agreed to a coordinated disclosure timed to Wednesday’s release by Matrix of updates that address the most serious flaws.

“Our attacks allow a malicious server operator or someone who gains control of a Matrix server to read the messages of users and to impersonate them to each other,” the researchers wrote in an email. “Matrix aims to protect against such behavior by providing end-to-end encryption, but our attacks highlight flaws in its protocol design and its flagship client implementation Element.”

Hodgson said he disagrees with the researchers’ contention that some of the vulnerabilities reside in the Matrix protocol itself and asserts they are all implementation bugs in the first generation of Matrix apps, which include Element. He said that a newer generation of Matrix apps, including ElementX, Hydrogen, and Third Room, are unaffected. There are no indications that the vulnerabilities have ever been actively exploited, he added.

Breaking Confidentiality, Attacking Verification, and More

The first two attacks provide a simple confidentiality break by exploiting the homeserver’s control over the users and devices that are permitted to join a private room. Only a person who creates a room or is deputized by the room creator is permitted to invite and admit new members, but the room management messages that make this mechanism possible aren’t required to be authenticated with the cryptographic keys of these authorized users. It’s trivial for someone with control of the homeserver to spoof such messages and, from there, admit users without the permission of the authorized users. Once admitted, the attacker gains access to decrypted communications sent in that room.

The researchers are careful to note that all new room entrants are automatically logged in an event timeline and hence can be detected by anyone in the room who manually inspects the membership list in real time. In large rooms with lots of activity, however, this kind of inspection may not be practical, the researchers said.

A variation of this attack is for the homeserver to add a device under the attacker’s control to the account of a user already in a private room. In a case like this, the new device will be displayed and labeled as “unverified” to all users, but at that point, all existing devices will automatically share the keys needed to decrypt all future messages.

A third proof-of-concept exploit provides an attack on the out-of-band mechanism Element offers so users can verify that the cryptographic identity they’re communicating with matches the person they think it does. This verification allows users or devices to compare short authentication strings to make sure they match, in much the way that the Signal messenger uses safety numbers. In either case, users perform the comparison outside of the app.

The researchers wrote:

_Our attack against out-of-band verification in Matrix enables an attacker to convince a target to cryptographically sign (and thus verify) a cross-signing identity controlled by the attacker. In this attack, a malicious homeserver assigns each device a device identifier that is also a valid cryptographic identity (under the homeserver’s control). At the end of the out-of-band verification process, each device will send a homeserver-controlled cryptographic identity to the other device. They do this by assigning the target device a device identifier that is also a cryptographic identity, exploiting a lack of domain separation between the two. When a device receives such a message, it is interpreted as a cryptographic identity. The receiving device will then sign (and thus verify) a homeserver-controlled cryptographic identity, with the false understanding that they have verified this identity out-of-band!_

With that, the attacker can perform a mallory-in-the-middle attack that breaks the confidentiality and authenticity of an underlying “Olm” channel, which under the Matrix design is the protocol for transmitting end-to-end data sent between two chat partners.

A fourth attack provides for what the researchers call “semi-trusted impersonation.” At times—such as when a user adds a new device to their account—a Matrix device may not have access to inbound messages in so-called Megolm sessions, as they’re known in the Matrix specification. This can prevent the device from being able to decrypt messages sent before it was added. The device can recover by using a key request to obtain the needed decryption keys.

Matrix, the researchers said, doesn’t provide a cryptographic mechanism for ensuring that the keys shared through the key request are legitimate. Instead, the Matrix specification requires sharing of inbound messages to be completed only between devices that trust each other. When this occurs, Matrix generates a warning message to messages that were decrypted using a forwarded key.

The researchers continued:

_Whilst Element clients restrict who they share keys with, no verification is implemented on who to accept key shares from. Our attack exploits this lack of verification in order to send attacker-controlled Megolm sessions to a target device, claiming they belong to a session of the device they wish to impersonate. The attacker can then send messages to the target device using these sessions, which will authenticate the messages as coming from the device being impersonated. Whilst these messages will be accompanied by a warning, this is the same warning that accompanies keys \*honestly\* forwarded with the “Key Request protocol.”_

The fifth and sixth attacks are what the researchers call trusted impersonation and impersonation to confidentiality break. Each builds off the other to enable a server to impersonate users and read their messages. A seventh attack works against a backup feature and is only of theoretical interest because the researchers can’t instantiate an attack exploiting it against a real Matrix server.

Agreeing to Disagree

In his email, Hodgson said Matrix regards only three of the vulnerabilities—the trusted impersonation, the attack on key verification, and the malicious backup attack—as critical security issues. And even then, he said all three are flaws in how Matrix was implemented in its first-generation client software developer kit, known as matrix-js-sdk. He added:

_They have highlighted two issues with the protocol which are much lower severity: that homeservers can currently add malicious users and devices to conversations that they are hosting, and that homeservers can fake history which users did not directly receive at the time. However, users are clearly warned when these situations occur: if you have verified the users in a conversation and an unverified user or device is added to a conversation, it is very clearly marked in all Matrix clients with a big red warning cross. Similarly, if an unexpected user suddenly appears in a conversation, everyone in the room is immediately informed that this user has joined, and can take appropriate evasive action._

_By confusing the legitimate implementation bugs which only affect matrix-js-sdk and derivatives with these lower severity protocol design considerations, the researchers have artificially inflated the overall severity of the problem, by falsely implying that the protocol itself is vulnerable._

_This said, we are also addressing these protocol design issues—we’ve already eliminated most situations where the server could fake history in tomorrow’s release, and we’ll be following up with an update which cryptographically ensures that users/devices can only be added to a room if they were invited by an admin in the room. We are also shifting to “trust on first use,” so that any unexpected devices/users get flagged, whether or not you’ve verified the users in a room._

Besides disagreeing on some of the specific vulnerabilities, the researchers and Hodgson remain at odds on another point. The researchers said the vulnerabilities they uncovered “highlight a lack of a unified and formal approach to security guarantees in Matrix” and that the specification has grown “organically with new sub-protocols adding new functionalities and thus inadvertently subverting the security guarantees of the core protocol.”

For his part, Hodgson said:

_We consider the protocol itself to be sound, and we consider our security processes to be robust. We agree that the first generation implementations have grown organically (they predated the formal protocol specification), and the fact is that we have been focusing our efforts on auditing our next generation implementations which we will be switching over to in the coming months. We have 4 independent public audits booked in with Least Authority, one of which is already published:_ _https://matrix.org/blog/2022/05/16/independent-public-audit-of-vodozemac-a-native-rust-reference-implementation-of-matrix-end-to-end-encryption__, and it’s worth reiterating that the next gen implementations were not susceptable\[sic\] to these attacks. It’s obviously unfortunate that we didn’t catch the first gen SDK vulns in an existing audit (the bugs occurred since our original 2016 NCC Group audit), but going forwards our reference implementations will all be independently verified. Unfortunately we didn’t have resources to audit both the legacy and next-gen implementations recently, and so focused on the next-gen \[implementations\], knowing they will shortly obsolete the legacy \[implementations\]._

The research paper, _Practically-exploitable Cryptographic Vulnerabilities in Matrix_, was authored by Martin R. Albrecht, Sofía Celi, Benjamin Dowling, and Daniel Jones. Albrecht and Jones are with the Information Security Group at the Royal Holloway University of London; Celi is with Brave Software; and Dowling is with the Security of Advanced Systems Group, University of Sheffield.

Putting It All Together

The researchers and Hodgson disagree on some key points, but there’s an important consensus that has led to changes that once again restore the confidentiality and authentication guarantees of Matrix, even in the case of a malicious or compromised homeserver. But for users to avail themselves of these assurances, the researchers said:

_Each user must enable “cross-signing” and perform out-of-band verification with each of their own devices, and with each user they interact with. They must then remain vigilant: any warning messages or icons must be spotted and investigated. In the Element user interface, this requires checking the room icon and each individual message they receive (in some cases, past messages can retroactively receive a warning). Note that such warnings could be expected behavior (for example if the message was decrypted using a server-side Megolm backup or through the “Key Request protocol”). Users would need the expertise to investigate these warnings thoroughly and, if an issue is found, recover from it. If you follow these instructions without fail, Matrix can provide you with confidentiality and authentication._

_This places an unnecessary burden on users of Matrix clients, limits the user base to those with an understanding of the cryptography used in Matrix and how it is applied, and is impractical for daily use. The burden this places on users is unnecessary and the result of the design flaws we highlight in our paper (this is our “Simple confidentiality break”/“Homeserver Control of Room Membership” attack). Whilst this issue will persist after today’s fixes, a remediation is planned by the Matrix developers for a later date. It is understandable that they have delayed the release of this remediation, since it requires sizable changes to the protocol._

Besides updating Element, people will also want to install patches for Beeper, Cinny, SchildiChat, Circuli, Synod.im, and any other clients based on matrix-js-sdk, matrix-ios-sdk, or matrix-android-sdk2. It’s important to install the fixes first and only then perform the verification with new devices.

_This story originally appeared on_ _Ars Technica__._

_Update 9-29-22, 4:30 pm ET: Updated to clarify that the patch has already been released._

A Matrix Update Patches Serious End-to-End Encryption Flaws

For decades, security researchers warned about techniques for hijacking virtualization software. Now one group has put them into practice.

For decades, virtualization software has offered a way to vastly multiply computers’ efficiency, hosting entire collections of computers as “virtual machines” on just one physical machine. And for almost as long, security researchers have warned about the potential dark side of that technology: theoretical “hyperjacking” and “Blue Pill” attacks, where hackers hijack virtualization to spy on and manipulate virtual machines, with potentially no way for a targeted computer to detect the intrusion. That insidious spying has finally jumped from research papers to reality with warnings that one mysterious team of hackers has carried out a spree of “hyperjacking” attacks in the wild.

Today, Google-owned security firm Mandiant and virtualization firm VMware jointly published warnings that a sophisticated hacker group has been installing backdoors in VMware’s virtualization software on multiple targets’ networks as part of an apparent espionage campaign. By planting their own code in victims’ so-called hypervisors—VMware software that runs on a physical computer to manage all the virtual machines it hosts—the hackers were able to invisibly watch and run commands on the computers those hypervisors oversee. And because the malicious code targets the hypervisor on the physical machine rather than the victim’s virtual machines, the hackers’ trick multiplies their access and evades nearly all traditional security measures designed to monitor those target machines for signs of foul play.

“The idea that you can compromise one machine and from there have the ability to control virtual machines _en masse_ is huge,” says Mandiant consultant Alex Marvi. And even closely watching the processes of a target virtual machine, he says, an observer would in many cases see only “side effects” of the intrusion, given that the malware carrying out that spying had infected a part of the system entirely outside its operating system.

Mandiant discovered the hackers earlier this year and brought their techniques to VMware’s attention. Researchers say they’ve seen the group carry out their virtualization hacking—a technique historically dubbed hyperjacking in a reference to “hypervisor hijacking”—in fewer than 10 victims’ networks across North America and Asia. Mandiant notes that the hackers, which haven’t been identified as any known group, appear to be tied to China. But the company gives that claim only a “low confidence” rating, explaining that the assessment is based on an analysis of the group’s victims and some similarities between their code and that of other known malware.

While the group’s tactics appear to be rare, Mandiant warns that their techniques to bypass traditional security controls by exploiting virtualization represent a serious concern and are likely to proliferate and evolve among other hacker groups. “Now that people know this is possible, it will point them toward other comparable attacks,” says Mandiant’s Marvi. “Evolution is the big concern.”

In a technical writeup, Mandiant describes how the hackers corrupted victims’ virtualization setups by installing a malicious version of VMware’s software installation bundle to replace the legitimate version. That allowed them to hide two different backdoors, which Mandiant calls VirtualPita and VirtualPie, in VMware’s hypervisor program known as ESXi. Those backdoors let the hackers surveil and run their own commands on virtual machines managed by the infected hypervisor. Mandiant notes that the hackers didn’t actually exploit any patchable vulnerability in VMware’s software, but instead used administrator-level access to the ESXi hypervisors to plant their spy tools. That admin access suggests that their virtualization hacking served as a persistence technique, allowing them to hide their espionage more effectively long-term after gaining initial access to the victims’ network through other means.

In a statement to WIRED, VMware said that “while there is no VMware vulnerability involved, we are highlighting the need for strong operational security practices that include secure credential management and network security.” The company also pointed to a guide to “hardening” VMware setups against this sort of hacking, including better authentication measures to control who can tamper with ESXi software and validation measures to check whether hypervisors have been corrupted.

Since as early as 2006, security researchers have theorized that hyperjacking presents a method to stealthily spy on or manipulate victims using virtualization software. In a paper that year, Microsoft and University of Michigan researchers described the potential for hackers to install a malicious hypervisor they called a “hypervirus” on a target machine that places the victim inside a virtual machine run by the hacker without the victim’s knowledge. By controlling that malicious hypervisor, everything on the target machine would be under the hacker’s control, with practically no sign within the virtualized operating system that anything was amiss. Security researcher Joanna Rutkowska dubbed her own version of the technique a Blue Pill attack, since it trapped the victim in a seamless environment entirely created by the hacker, _Matrix_\-style, without their knowledge.

What Mandiant observed isn’t exactly that Blue Pill or hypervirus technique, argues Dino Dai Zovi, a well-known cybersecurity researcher who gave a talk at the Black Hat security conference about hypervisor hacking in the summer of 2006. In those theoretical attacks, including his own work, a hacker creates a new hypervisor without the victim’s knowledge, while in the cases Mandiant discovered, the spies merely hijacked existing ones. But he points out that this is a far easier and yet highly effective technique—and one he’s expected for years. “I’ve always assumed it was possible and even being done,” says Dai Zovi. “It’s just a powerful position that gives full access to any of the virtual machines running on that hypervisor.”

Aside from the difficulty of detecting the attack, he points out that it also serves as a multiplier of the hacker’s control: In virtualization setups, two to five virtual machines can typically run on any physical computer, and there are often thousands of virtual machines on an organization’s network running as everything from PCs to email servers. “That’s a lot of scale and leverage,” says Dai Zovi. “For an attacker, it’s a good return on their investment.”

Mandiant suggests in its writeup of the hacking campaign that attackers may be turning to hyperjacking as part of a larger trend of compromising network elements that have less rigorous monitoring tools than the average server or PC. But given the power of the technique—and the years of warnings—it’s perhaps most surprising that it hasn’t been put to malicious use earlier.

“When people first hear about virtualization technology, they always raise their eyebrows and ask, ‘What happens if someone takes control of the hypervisor?’” says Mandiant’s Marvi. “Now it’s happened.”

Mystery Hackers Are ‘Hyperjacking’ Targets for Insidious Spying

Damage to the pipeline that runs between Russia and Germany is being treated as deliberate. Finding out what happened may not be straightforward.

The Nord Stream gas pipelines are colossal pieces of infrastructure. Running more than 1,200 kilometers from Russia, across the Baltic Sea to Germany, the pipes can carry up to 110 billion cubic meters of gas, enough for 26 million homes. The Nord Stream 1 pipeline alone is constructed of 202,000 huge pieces of piping. Each section is 12 meters long and contains piping that uses around 4 centimeters of steel, which is covered with 11 centimeters of concrete. The pipes are not built to break.

So when the pressure in one of the Nord Stream pipes dropped on June 26, alarm bells started ringing. Danish authorities told ships to steer clear of the pipes as methane gas was bubbling into the sea. Hours later, two more leaks were detected, one in Nord Stream 2 and a second in Nord Stream 1. Now, authorities are suspecting foul play. “We are not talking about an accident,” Mette Frederiksen, the Danish prime minister said.

Ursula von der Leyen, head of the European Commission, believes the leaks may be a result of “sabotage” and said any “deliberate disruption” of energy infrastructure will “lead to the strongest possible response.” NATO officials agree; the US has pledged its support to help Europe find out what happened. However, the incidents have raised fears about attacks on critical infrastructure and the security protections in place around systems that can provide the world’s fuel. The incident comes on top of Russia reducing its supply of gas to Europe, with large parts of the continent facing winter energy crises.

While officials have indicated the leaks may have been caused deliberately, very little evidence about the attacks has emerged so far. Military flights over the region show gas bubbling at the surface more than a kilometer wide, and Swedish seismic experts say they are convinced explosions took place after they recorded tremors equal to a magnitude 2.3 earthquake.

Fingers immediately pointed at Russia, which partly owns the pipes. Ukraine has said it is a “terrorist attack,” and German newspaper _Der Spiegel_ reported that the CIA warned German officials about possible attacks against Baltic pipelines several weeks ago. (Right-wing commentators in the US and one Polish MP accused the US of being involved after President Joe Biden said, in February, he would “put an end” to Nord Stream 2 if Russia invaded Ukraine.)

"It's a very classic Russian hybrid warfare approach,” says Hans Tino Hansen, the CEO of Risk Intelligence, a Denmark-based security firm that deals with maritime issues. Hansen says if Russia did attack the Nord Stream pipelines it would show they have “complete deniability.” Because Russia partly owns the Nord Stream infrastructure, it makes people question why it would be behind any attacks against it. (The Kremlin claimed suggestions it is behind the leaks are “stupid.) “They are showing that they can attack seabed energy infrastructure, with the pipelines, which then sends the signal that they can attack and destroy any energy infrastructure in Europe," Hansen says.

Investigators across Europe, including intelligence agencies, will now be trying to piece together exactly who and what caused the apparent explosions. This is likely to involve multiple steps, such as examining what data is held about the area, including seismic data and other sensors, checking whether any communications around the incident have been intercepted, and examining the pipelines to see if there are any signs of intentional destruction.

Neither of the pipes is operational—Nord Stream 1 was paused for repairs in August and Nord Stream 2 has not officially opened after Germany pulled support for it ahead of Russia’s full-scale invasion of Ukraine in late February—but both pipes are holding gas. All three leaks happened relatively close to each other, near the Danish island of Bornholm, in the Baltic sea. The island is surrounded by Denmark to the west, Sweden to the north, and both Germany and Poland to the south. The leaks are in international waters, but also sit in both Denmark and Sweden’s exclusive economic zones. “It's quite shallow, around 50 meters on average in this region,” says Julian Pawlak, a research associate at the Helmut Schmidt University and the German Institute for Defence and Strategic Studies.

Security sources have speculated if the attacks were deliberate, they could have been conducted by unmanned underwater drones, involve mines being dropped or planted by boats, been carried out by divers, or even from within the pipes themselves. “We still don't know what the origin is of those explosions or where they came from—if they originated from the outside or if they originated from the inside of the pipelines,” Pawlak says. In a process called “pigging,” cleaning and inspection machines can be sent down the pipes from Russia in the direction of Germany. It’s possible pigging was repurposed to carry out an attack.

Back in 2007, before the first Nord Stream pipeline was constructed, a review of the project by the Swedish Defence Research Agency (FOI) warned about potential explosions around the pipe, in the context of terrorism. “Despite its concrete coating, a pipeline is rather vulnerable, and one diver would be enough to set an explosive device,” its report said. “However, the impact of such an assault would probably be rather modest and most likely a minor incident of this type would not result in a large explosion.”

"They \[Russia\] have the capability for subsea warfare, with the divers, but also with mini-submarines and drones,” Hansen says. However, confirming any responsibility isn’t necessarily straightforward. The relatively shallow depth of the area around the Nord Stream pipes means it is unlikely that any large submarines would have been operating nearby, as they would be easy to detect.

Pawlak says any vessels in the area could potentially detect others that may have caused the damage. Undersea sensors could equally spot something in the area moving, but it is unclear where any of these systems are. “It's still not the case that all of the Baltic Sea is filled up with sensors and that NATO knows every movement,” Pawlak says. “On the surface, but especially on the seabed, it's still not possible to know, at every time, at every place, what's moving, what's going on.”

However, the Nord Stream incidents draw into focus the protections that are placed around critical infrastructure. In recent years, cyberattacks have shut down the US Colonial Pipeline, cutting off fuel supplies. And ahead of Russia’s full-scale invasion of Ukraine, its military hackers used the country as a cyberwarfare testing ground, shutting down power grids with their code.

Undersea infrastructure can be particularly vulnerable to damage—either from natural causes, such as earthquakes, or physical attacks. Since the Nord Stream pipes burst on Tuesday huge volumes of gas have poured into the sea, potentially causing an “unprecedented” environmental impact. "As we—and many others—have been saying for many years, we need to address the security of energy infrastructure and also everything subsea,” Hansen says. This includes the myriad of internet cables stretching thousands of kilometers around the world and keeping billions of people online.

In January, the head of the UK’s armed forces warned that Russian submarines have been threatening subsea cables. “Russia has grown the capability to put at threat those undersea cables and potentially exploit those undersea cables,” Admiral Tony Radakin said.

Hansen says there are two starting points for protecting subsea infrastructure: first, building out ways to detect faults and issues with equipment automatically and then also making sure there is equipment, such as underwater drones, that are able to scramble to sites to inspect them when damage has happened. Those steps may already be underway, with Norway’s prime minister saying the country will up the military protection of its energy infrastructure.

The Race to Find the Nord Stream Saboteurs

The internet infrastructure company has an alternative tool to check whether you’re human—and it doesn’t force you to pick out buses in tiny boxes.

There's a uniquely bitter rage that comes from being asked to click every box that contains a parking meter only to then be told that you missed one because of a tiny sliver of gray that barely floated into the periphery of an otherwise empty, adjacent square. It's a familiar fury, and one that captchas have been provoking across the web for years, but these maddening tools are important for blocking bots from conducting fraud and other abuse. Google's reCaptcha, the dominant tool around the world for implementing these checks, came out with a version in 2018 that uses machine learning to silently check humanness behind the scenes and phase out the garbled, blurry strings of letters and grids full of traffic lights. This week, the internet infrastructure company Cloudflare is releasing a competitor.

Like reCaptcha, Cloudflare's new alternative, dubbed Turnstile, is free, and you don't have to be a Cloudflare customer to put it on your site. Turnstile is based on a tool called Cloudflare Managed Challenge that the company released for its own services in April. When you do a captcha, you are completing a “challenge” of your humanness. Managed Challenge, on the other hand, runs quick and silent checks of your browser's technical behavior and other telemetry in an attempt to determine that you are human without asking you to do anything. Only when the tool lacks adequate confidence will it show you a “harder challenge” or a puzzle to solve. And Managed Challenge, which is an enterprise product for Cloudflare customers, is constantly testing different types of puzzles to find the options that are less frustrating for users. 

Anyone can now implement Turnstile for free through an application programming interface. You can set it up to only run invisible challenges that don't appear to the user at all or elect to have the system show a button for users to click as an additional humanness check. Unlike Managed Challenge, Turnstile never shows harder challenges or Captchas.

“If a person were walking down the street next to a robot, even without asking the person or robot any questions, you’d be able to observe differences between them just by watching them walk past,” says Cloudflare's chief technology officer, John Graham-Cumming. “Turnstile can do that for the signals your computer sends to the website you’re accessing, which include what web browser you are using or what device this is coming from. In the case of a machine trying to impersonate a human user, they often don’t get all these details right—there’s usually something ‘off’ about the request.”

Invisible challenges include tests like complex equations that devices are asked to solve. Turnstile has data about how long it takes different devices—say, a Macbook Air or a Samsung Galaxy—to solve the challenge. If a device claims to be a Samsung Galaxy S22, but solves the challenge much more quickly than that device should be able to, it may indicate that the request is really coming from an automated system run out of a data center. 

Courtesy of Cloudfare

Captchas are an important security defense across the web, but Cloudflare is billing Turnstile as particularly privacy-protective as well. The tool will look at some browser session data, like browser characteristics and data from website rendering mechanisms, but the service doesn't check advertising cookies or login cookies. And the company plans to outsource as much data review as possible to minimize how much Cloudflare ever sees. For example, Turnstile will check for Apple's "Private Access Tokens," launched this year as a tool for attesting that a user is human and reducing the need for captchas. 

Researchers have found in recent years that Google's reCaptcha checks to see whether a user has a Google login cookie as one of the factors in determining whether they are human. Google denies that reCaptcha data is used for anything other than challenges, but some have pointed out that the data could be used in targeted advertising campaigns.

Cloudflare says that since launching Managed Challenge, it has dramatically reduced the number of captchas it serves.

“Before we introduced Cloudflare Managed Challenge, if we believed a visitor was a bot but our customer wanted us to confirm that, then we would serve a Captcha 100 percent of the time,” Graham-Cumming says. “After introducing Cloudflare Managed Challenge, that number was reduced down to 9 percent. Today, that number is further reduced down to 3 percent.”

The company adds that users previously spent an average of 32 seconds doing captchas on its own sites. Since implementing Managed Challenge, the average wait time is one second because of the new feature's silent, behind-the-scenes challenges. In the Cloudflare dashboard, the captcha option is now called “Legacy Captcha." The company says that, “this more accurately describes what CAPTCHA is: an outdated tool that we don’t think people should use."

Turnstile is part of a broader industry effort to rework captchas and make them less frustrating for users. But reCaptcha's ubiquity and familiarity may hinder adoption of new alternatives. As the field shifts, though, it may be ripe for a new player—especially one that doesn't make you want to chuck your laptop into the sea.

_Updated 9-28-2022, 6:20 pm ET: Included additional details about Turnstile and comment from Cloudflare. We also clarified the types of “challenges” Turnstile will present users._

Cloudflare Takes a Stab at a Captcha That Doesn’t Suck

Pornhub is trialing a new automated tool that pushes CSAM-searchers to seek help for their online behavior. Will it work?

There are huge volumes of child sexual abuse photos and videos online—millions of pieces are removed from the web every year. These illegal images are often found on social media websites, image hosting services, dark web forums, and legal pornography websites. Now a new tool on one of the biggest pornography websites is trying to interrupt people as they search for child sexual abuse material and redirect them to a service where they can get help.

Since March this year, each time someone has searched for a word or phrase that could be related to child sexual abuse material (also known as CSAM) on Pornhub’s UK website, a chatbot has appeared and interrupted their attempted search, asking them whether they want to get help with the behavior they’re showing. During the first 30 days of the system’s trial, users triggered the chatbot 173,904 times.

“The scale of the problem is so huge that we really need to try and prevent it happening in the first place,” says Susie Hargreaves, the chief executive of the Internet Watch Foundation (IWF), a UK-based nonprofit that removes child sexual abuse content from the web. The IWF is one of two organizations that developed the chatbot being used on Pornhub. “We want the results to be that people don’t look for child sexual abuse. They stop and check their own behavior,” Hargreaves says.

The chatbot appears when someone searches Pornhub for any of 28,000 terms it has identified that it believes could have links to people looking for CSAM. And searches can include millions of potential keyword combinations. The popup, which has been designed by anti-child abuse charity the Lucy Faithfull Foundation alongside the IWF, will then ask people a series of questions and explain that what they are searching for may be illegal. The chatbot tells people it is run by the Lucy Faithfull Foundation and says it offers “confidential, nonjudgmental” support. People who click a prompt saying they would like help are offered details of the organization’s website, telephone help line, and email service.

“We realized this needs to be as simple a user journey as possible,” says Dan Sexton, the chief technology officer at the IWF. Sexton explains the chatbot has been in development for more than 18 months and involved multiple different groups as it was designed. The aim is to “divert” or “disrupt” someone who may be looking for child sexual abuse material and to do so using just a few clicks.

The key to the system’s success is at the heart of its premise: Does this kind of behavioral nudge stop people from looking for CSAM? The results can be difficult to measure, say those involved with the chatbot project. If someone closes their browser after seeing the chatbot, that could be considered a success, for example, but it is impossible to know what they did next.

A behavioral nudge isn’t unprecedented in efforts to reduce online harms though, and there is some data by which the results can be measured. It is possible to see how much time people interact with the chatbot and the number of clicks people make to get help. Before Pornhub started trialing the chatbot, it was already pointing people toward the Lucy Faithfull Foundation website using a static page when they searched for any of its 28,000 terms.

Using the chatbot is more direct and maybe more engaging, says Donald Findlater, the director of the Stop It Now help line run by the Lucy Faithfull Foundation. After the chatbot appeared more than 170,000 times in March, 158 people clicked through to the help line’s website. While the number is “modest,” Findlater says, those people have made an important step. “They’ve overcome quite a lot of hurdles to do that,” Findlater says. “Anything that stops people just starting the journey is a measure of success,” the IWF’s Hargreaves adds. “We know that people are using it. We know they are making referrals, we know they’re accessing services.”

Pornhub has a checkered reputation for the moderation of videos on its website, and reports have detailed how women and girls had videos of themselves uploaded without their consent. In December 2020, Pornhub removed more than 10 million videos from its website and started requiring people uploading content to verify their identity. Last year, 9,000 pieces of CSAM were removed from Pornhub.

“The IWF chatbot is yet another layer of protection to ensure users are educated that they will not find such illegal material on our platform, and referring them to Stop It Now to help change their behavior,” a spokesperson for Pornhub says, adding it has “zero tolerance” for illegal material and has clear policies around CSAM. Those involved in the chatbot project say Pornhub volunteered to take part, isn’t being paid to do so, and that the system will run on Pornhub’s UK website for the next year before being evaluated by external academics.

John Perrino, a policy analyst at the Stanford Internet Observatory who is not connected to the project, says there has been an increase in recent years to build new tools that use “safety by design” to combat harms online. “It’s an interesting collaboration, in a line of policy and public perception, to help users and point them toward healthy resources and healthy habits,” Perrino says. He adds that he has not seen a tool exactly like this being developed for a pornography website before.

There is already some evidence that this kind of technical intervention can make a difference in diverting people away from potential child sexual abuse material and reduce the number of searches for CSAM online. For instance, as far back as 2013, Google worked with the Lucy Faithfull Foundation to introduce warning messages when people search for terms that could be linked to CSAM. There was a “thirteen-fold reduction” in the number of searches for child sexual abuse material as a result of the warnings, Google said in 2018.

A separate study in 2015 found search engines that put in place blocking measures against terms linked to child sexual abuse saw the number of searches drastically decrease, compared to those that didn’t put measures in place. One set of advertisements designed to direct people looking for CSAM to help lines in Germany saw 240,000 website clicks and more than 20 million impressions over a three-year period. A 2021 study that looked at warning pop-up messages on gambling websites found the nudges had a “limited impact.”

Those involved with the chatbot stress that they don’t see it as the only way to stop people from finding child sexual abuse material online. “The solution is not a magic bullet that is going to stop the demand for child sexual abuse on the internet. It is deployed in a particular environment,” Sexton says. However, if the system is successful, he adds it could then be rolled out to other websites or online services.

“There are other places that they will also be looking, whether it’s on various social media sites, whether it’s on various gaming platforms,” Findlater says. However, if this was to happen, the triggers that cause it to pop up would have to be evaluated and the system rebuilt for the specific website that it is on. The search terms used by Pornhub, for instance, wouldn’t work on a Google search. “We can’t transfer one set of warnings to another context,” Findlater says.

This Chatbot Aims to Steer People Away From Child Abuse Material

Want to speak up against Big Tech, unjust data collection, and surveillance? Here's how to be an activist in your community and beyond.

Your Facebook is no longer a naked-to-the-public firehose of information about your family and social life. Your mobile phone is as do-not-track as you’re able to function under. You cover your webcam lens when it’s not in use.

In short, you’ve done what you can to mitigate the way the current world seeks to share and expose your personal information. It takes energy and knowledge to break away from the default settings of digital devices, social networks, and retailers seeking more, more, more information. But you’ve done it, at least what you can. You feel pretty good about safeguarding some (but not all) of your private data and being proactive about it.

So what’s this nagging feeling in the back of your skull? Do you sometimes feel like you could be doing even more in the battle to protect citizens from the overreach of data scrapers and tech moguls who value monetization over individual rights?

It takes a lot of committed people to fight these battles in courtrooms, in the digital marketplace, and on the platforms themselves (Facebook, Twitter, and LinkedIn, among others) that have become battlegrounds for our data. You could be one of these people: an advocate for data privacy who is actively involved in helping protect us all.

Advocacy Near Home

Getting your own house in order in regards to privacy could mean literally getting your house in order. Setting up a VPN (virtual private network) service for your entire household, for instance, can offer your entire family a shield to prying eyes online, including threats from hackers, although finding a reputable one with strong data privacy policies that also won’t scoop up your data can itself be a challenge.

If you have kids old enough to join social networks (the legal age is 13 in the US), take the time to help them set up and understand their privacy settings, especially on social networks that have a poor track record on that front (such as Facebook and TikTok). The same goes for online game networks they might play on such as Nintendo Online or the PlayStation Network, not to mention popular games like _Roblox_ and _Minecraft_ (which is owned by Microsoft, who also operates Xbox Live, which also has social features).

Similarly, stay in the loop on new policies and legal changes that could affect the way companies handle your kids’ data. You should also learn how your kids’ school and school district handle issues such as data on school devices, software in schools, and surveillance cameras on campus.

You don’t want to be the person who posts hoaxes about how Facebook is going to use your photos and information, but spreading the word from legit sources to extended family and friends about good privacy hygiene is one way to raise awareness of the problems that exist. The United States Privacy Digest from the International Association of Privacy Professionals, The Hacker News, Privacy International, and—not to toot our own horn—WIRED’s own coverage of privacy issues are good places to get informed or search for specific stories around these topics.

Take Your Advocacy Public

The Electronic Frontier Foundation (or EFF) is a civil liberties nonprofit founded in the San Francisco Bay Area in 1990. It’s been carrying the torch for fighting threats to free speech and privacy ever since. The EFF says it has seen a recent “big uptick” in interest from people wanting to protect privacy on their phone; for instance, there are 100,000 views on a post about disabling Ad ID on iOS and Android devices. “We are clearly seeing that people are increasingly concerned about digital rights,” says Karen Gullo, analyst and senior media relations specialist at EFF. 

The organization offered WIRED a list of things you can do if you’d like to get more involved in advocating for data privacy.

To start with, find out where your local and state lawmakers stand on privacy and make your own voice heard. Call or email them, or speak up at town halls and other meetings. “Check with your local city council to see if they have a committee that is looking into data-privacy issues, or suggest that they form one,” says Karen Gullo, analyst and senior media relations specialist at EFF. “Ask for a citizen advocate to be part of that committee.”

You could also form your own committee, briefing those local officials on data policies and threats, and informing the public with talks at local libraries and other public locations. The EFF pointed to Oakland Privacy, a citizen’s coalition that succeeded in this kind of effort; the group helped get an ordinance passed requiring towns in its area to be transparent about surveillance technology.

The EFF is currently pushing the My Body, My Data Act, which would protect personal health care data related to reproductive rights. You can learn how to take action to support this act on the EFF’s website.

Similarly, the Electronic Frontier Association itself is comprised of grassroots digital-rights advocacy groups in cities and campuses across the country, and they may be looking for volunteers in your area. You can get involved with security training projects and educational events through an existing chapter, or by starting your own coalition.

How to Advocate for Data Privacy and Users' Rights

The fun-loving cybercriminals blamed for breaches of Uber and Rockstar are exposing weaknesses in ways others aren't.

After suffering a breach earlier this month, the ride-share platform Uber said last week that it believes the infamous hacking group Lapsus$ was behind the attack. The incident was in line with the group's track record of using phishing to gain access to corporate accounts that can then be parlayed into broader access. Then on September 23, police in the United Kingdom said they had arrested an unnamed 17-year-old in Oxfordshire who seems to be one of the individuals previously arrested in connection to Lapsus$ in March.

Lapsus$, which may also have breached the _Grand Theft Auto_ developer Rockstar in this latest hacking spree, has established itself in the pantheon of memorable hacking groups for breaching a slew of massive tech companies, including Microsoft, Nvidia, Okta, Samsung, and Ubisoft. They did so to make money, sure, but they also apparently wanted to take the digital-teen joyride of a lifetime. Researchers say that this wild and unpredictable streak is an important key to the group's success that should not be overlooked.

“Lapsus$ probably aren’t causing as much destruction as other actors with different motivations could, and I think that's the answer—they aren’t entirely motivated by money,” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “They, therefore, attempt things that purely financially motivated cybercriminals wouldn’t. They are more likely to be adventurous and to try things—that may not have a payoff—just for the fun of it.”

This creative enthusiasm and flair for the dramatic is an important case study. While Lapsus$ seems to perpetrate crimes of opportunity rather than working under a mandate to target certain entities or achieve specific results, the way nation-state actors often do, their seemingly boundless success reveals just how many weaknesses are lurking in organizations around the world that have gone unexposed only because they weren't immediately useful to state-backed actors or cybercriminals. 

“I find the Lapsus$ group significant, because they have highlighted systemic problems in real-world implementations of single sign-on and multifactor authentication,” says independent security researcher Bill Demirkapi. “The techniques that they've used in their attacks are nothing new, but what we're seeing is the widespread abuse of these weaknesses and a wakeup call to organizations.”

Lapsus$ breached Uber by targeting an individual contractor whose username and password had been compromised by another entity through a malware infection and was sold on the dark web, the company said. Lapsus$ repeatedly sent the victim multifactor authentication login notifications until they mistakenly approved access. In a previous, unrelated attack, Lapsus$ breached a contractor working with the authentication company Okta in an attempt to compromise organizations through the identity management provider. The tactics in both instances show that there are weaknesses in some multifactor authentication strategies and they highlight a downside to “single sign-on” schemes in which one carefully protected authentication process grants access to a slew of services. The benefit to organizations is that there's only one account to protect and manage instead of many, and this cuts down on weaknesses like password reuse. The drawback, though, is that if an attacker compromises a single-sign-on account, they gain access to multiple internal services within an organization at once.

“At the end of the day, the flexibility of how you can abuse corporate accounts to move laterally and pivot over to other applications in the cloud—there are just so many different ways that attackers can use enterprise credentials,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “That's why phishing is so extremely popular with cybercriminals, because of that return on investment.”

There are stronger ways to implement two-factor authentication, and the new generation of “password-less” login schemes or “Passkeys” from the industry FIDO2 standard promise a much less phishable future. But organizations need to actually start implementing these more robust protections so they're in place when a ransomware actor (or restless teen) starts poking around.

“Phishing is obviously a huge problem, and most of the things that we normally think of as multifactor authentication, like using a code generator app, are at least somewhat phishable, because you can trick someone into revealing the code,” says Jim Fenton, an independent identity privacy and security consultant. “But with push notifications, it’s just too easy to get people to click ‘accept.’ If you have to plug something directly into your computer to authenticate or use something integrated with your endpoint, like a biometric sensor, those are phishing-resistant technologies."

Keeping attackers from clawing their way into an organization through phishing isn't the only problem, though. As the Uber incident showed, once Lapsus$ had compromised one account to gain access, they were able to burrow deeper into Uber's systems, because they found credentials for internal tools lying around unprotected. Security is all about raising the barrier to entry, not eliminating all threats, so strong authentication on external-facing accounts would certainly have gone a long way toward stopping a group like Lapsus$. But organizations must still implement multiple lines of defense so there's a fallback in case one is breached. 

In recent weeks, former Twitter security chief Peiter “Mudge” Zatko has publicly come out as a whistleblower against Twitter, testifying before a US Senate committee that the social media giant is woefully insecure. Zatko's claims—which Twitter denies—illuminate how high the cost could be when a company's internal defenses are lacking.

For its part, Lapsus$ may have a reputation as an outlandish and oddball actor, but researchers say that the extent of its success in compromising massive companies is not just remarkable but also disturbing.

“Lapsus$ has highlighted that the industry must take action against these weaknesses in common authentication implementations,” Demirkapi says. “In the short term we need to start by securing what we currently have, while in the longer term we must move toward forms of authentication that are secure by design.”

No wakeup call ever seems sufficiently dire to produce massive investment and quick, ubiquitous implementation of cybersecurity defenses, but with Lapsus$ organizations may have an additional motivation now that the group has shown the world just how much is possible if you're talented and have some time on your hands. 

“Cybercriminal enterprises are exactly the same as legitimate businesses in the sense that they look at what other people are doing and emulate the strategies that prove successful,” Emsisoft's Callow says. “So the ransomware gangs and other operations will absolutely be looking at what Lapsus$ has done to see what they can learn.”

The Dire Warnings in the Lapsus$ Hacker Joyride

It won’t solve all of your privacy problems, but a virtual private network can make you a less tempting target for hackers.

A virtual private network (VPN) is like a protective tunnel you can use to pass through a public network, protecting your data from outside eyes. Whether you're worried about hiding your browsing activity from your internet service provider so it doesn't sell your data to advertisers, or you want to stay safe on a public Wi-Fi hot spot to keep nearby digital snoops from capturing your passwords, a VPN can help protect you.

However, while a VPN will keep you safe at your local coffee shop, it comes with a cost. Using a VPN means your VPN provider will know everything about your browsing habits. This makes VPN providers a target for hackers. Be sure you even need one before you read on.

Picking the right VPN service is serious business. Most VPN providers say they keep no logs of their users' activity, but this is rarely verified. You're stuck taking companies at their word. For this reason, we've limited our testing to VPN providers that have been independently audited by security firms and have published the results.

To help you sort out when and why you might want a VPN, as well as why you might not, be sure to read through our complete guide to VPNs below. If you're sure you want to use a VPN, here are our top picks among commercial VPN providers.

_Updated September 2022: We've included some updated speed test results, included some new features from Surfshark, and noted our experiences paying for Mullvad with bitcoin._

_Special offer for Gear readers: Get a_ _**1-year subscription to**_ **WIRED** _**for $5 ($25 off)**__. This includes unlimited access to_ WIRED._com and our print magazine (if you'd like). Subscriptions help fund the work we do every day._

> If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more.

Best for Most People

**Surfshark VPN**

Surfshark wouldn't be my top pick if my life depended on my VPN, but for most of us that's not the case. If you just want a way to get around some geographical restrictions on content (aka access Netflix) and protect your traffic while using an open Wi-Fi hot spot, Surfshark is a good choice. It's secure, and it provides a great value for the money if you pay for two years up front.

Surfshark offers a kill switch that automatically stops your traffic if your VPN connection fails, and it supports multihop VPN connects, which means your traffic goes from your machine to a VPN server to another VPN server, and then to the destination server. This provides an extra layer of protection should the VPN itself be compromised, though there is a corresponding speed hit when using a multihop connection. The company also recently added support for manual Wireguard configuration. Most people will be fine sticking with Surfshark's apps, but if you're trying to connect your entire network to Surfshark directly through a router, the manual configuration will be welcome news.

In my testing over the years, Surfshark has consistently had some of the best speeds of any VPN I've used. Yes, it is slower than not using a VPN, but I have never had any problem streaming HD content through Surfshark. It's fast enough that in most cases you won't notice any speed degradation at all.

Surfshark is based in the British Virgin Islands, which, although technically a territory of Great Britain, is generally considered a safe haven and has no data-retention laws. What I don't like is that Surfshark is legally untested. The company has a zero-log policy, and you can (and should) opt out of the diagnostic crash reports in the app. Still, you're taking Surfshark at its word when it says it won't keep logs of your internet activity. Encouragingly, the company's browser extensions have undergone an independent security audit that didn't turn up any significant problems. 

Surfshark recently merged with NordVPN. So far we have not noticed any changes for its customers, but we will be keeping an eye on it going forward.

**Surfshark costs $2.50 per month if you buy two years up front, $4 per month if you buy one year up front.**

Best for Advanced Users

**Mullvad VPN**

Mullvad is based in Sweden and first came to my attention because of its early support for WireGuard, a faster protocol for tunneling VPN traffic.

Another thing I like is Mullvad's system for accepting cash payments. If you prefer to remain totally anonymous, you can generate a random account number, write that number down on a slip of paper, and mail it, along with cash, to Sweden. In theory, no one will be able to connect you to that account. (The truly paranoid will don a tinfoil hat, wear gloves, print from a public printer, and mail from a remote mailbox.) I have not tested the cash option, but I did recently extend my Mullvad subscription using bitcoin and it worked without a hitch.

Part of what I like about Mullvad is its down-to-earth approach that doesn't overhype with its marketing and helps users take additional steps to protect their privacy. For example, the company has an entire page showing you how to disable WebRTC in your web browser. As long as WebRTC is enabled (and it is by default in most browsers), websites can view your actual IP address even when you use a VPN.

Mullvad offers apps for every major platform, as well as routers. The applications are all open source, and you can check the code yourself on GitHub. The service has been independently audited as well. Advanced users can download configuration files and use them directly with OpenVPN or Wireguard.

In my testing, speeds were very good. I never encountered a situation where I couldn't get a fast connection. Over the years Mullvad has become the VPN I rely on day-to-day.

**Mullvad VPN costs 5 euros (around $6) per month, cash or charge.**

Best for VPN Newcomers

**TunnelBear VPN**

Choosing a VPN can be overwhelming. If you're tired of security mumbo jumbo and lock icons, TunnelBear might be the VPN for you. Its cute bear animations help demystify what VPNs do, how they work, and what they can offer you. Sometimes the easiest way to make technology more approachable is to put a friendly face on it.

Don't worry though, TunnelBear isn't all cute bear animations. It has the same security features as other VPN providers, like a no-logging policy and a clear privacy policy, and it's been independently audited.

In my testing, speeds with TunnelBear were competitive with the other options listed here. One of my favorite parts of TunnelBear is the free trial option, which makes it easy to test-drive it and see what your speeds are like without committing. TunnelBear has fewer geographic server locations than some of our other options, but unless you're traveling abroad or need to get around a specific geo-restriction, that shouldn't matter for most users.

**TunnelBear costs $3.33 per month if you buy one year up front****.**

Best for Circumventing Geographic Restrictions

**NordVPN**

NordVPN is one of the most popular VPNs around, thanks to a wide selection of servers and reasonable prices. It's also one of the most reliable ways I've found to circumvent location-based restrictions. I used it extensively while living in Mexico to get around Netflix's geographic restrictions. That said, this is a cat-and-mouse game; Netflix is always updating its server ban list, so NordVPN might not work in the future.

NordVPN is based out of Panama, which is not part of the Five Eyes, Nine Eyes, or 14 Eyes jurisdictions. That doesn't mean your government can't spy on you, but it does at least mean it will have to put in some extra legwork to do it (yes, that's about where we are these days). NordVPN has been audited a number of times, most recently in June of last year, when third-party auditor VerSprite found nothing amiss. As noted above, NordVPN and Surfshark recently announced a merger. Both will continue to operate as separate entities, but they are now a single company.

NordVPN also recently added a new service dubbed Threat Protection, which will block web-based trackers, phishing attempts, some ads, and malicious websites. I have not tested it extensively, and I personally rely on browser-based plug-ins to block threats like this. But if you're looking for an all-in-one solution, this might work.

I've never had an issue with speed using NordVPN, and the user interface of its apps is dead simple. Just click the country you want to use and the app will take care of connecting and configuring everything for you. If you want manual control, you can connect by using NordVPN's configuration files.

**NordVPN costs $5 per month if you buy one year up front. It also has frequent sales on a two-year deal that works out to about $3 a month.**

Best for High-Risk Use Cases

**Tor**

If you're in a situation where personal security is of the utmost importance, do not rely on a VPN. Use Tor (ideally through Tails) instead.

Using the Tor network accomplishes some of the same things as a VPN, but it's a little bit different. Tor provides anonymity, meaning no one can figure out who you are, but not necessarily privacy. People still might be able to see what you're doing, they just won't know it's you doing it. (VPNs provide privacy because no one can see what you're doing while you're going out of a VPN tunnel, but you don't have anonymity because the VPN provider knows who you are.)

Tor is simple to set up. All you need to do is download the Tor browser, and it will connect you to the web. Once you're connected to the Tor network, you can browse the web as you normally would. Except everything will be slower. When using Tor, your request for a website hops around the Tor network, bouncing between servers, before emerging and connecting to the actual site you want to visit. This makes Tor slow, sometimes incredibly slow, but that's necessary to protect your anonymity. And yes, you can combine a VPN with Tor, though that's somewhat beyond the scope of this guide.

How We Picked

VPN providers like to claim they keep no logs, which means they know nothing about what you do using their services. There are a variety of reasons to be skeptical about this claim, namely because they have to have a user ID of some kind tied to a payment method, which means the potential exists to link your credit card number (and thus your identity) to your browsing activity.

For that reason, I mainly limited my testing to providers that have been subpoenaed for user data in the US or Europe and failed to produce the logs or have at least undergone a third-party security audit. While these criteria can't guarantee the providers aren't saving log data, this method of selection gives us a starting point for filtering through the hundreds of VPN providers. Unfortunately other factors also come into play, VPNs that once made our list—Like ExpressVPN—are sometimes sold to less reputable companies. In cases like ExpressVPN I chose to remove it mainly because I have no way to know if it remains trustworthy or not.

Using these criteria, I narrowed the field to the most popular, reputable VPN providers and began testing them over a variety of networks (4G, cable, FiOS, and plenty of painfully slow coffee shop networks) over the past nine months. I tested network speed and ease of use (how you connect), and I also considered available payment methods, how often connections dropped, and any slowdowns I encountered.

Why You Might Not Need a VPN

It's important to understand not just what a VPN can do, but also what it can't do. As noted above, VPNs act like a protective tunnel. A VPN shields you from people trying to snoop on your traffic while it's in transit between your computer and the website you're browsing or the service you're using.

Public networks that anyone can join—even if they have to use a password to connect—are easy hunting grounds for attackers who want to see your network data. If your data is being sent unencrypted—like if the website you're connecting to doesn't use the secure HTTPS method—the amount of information an attacker can gather from you can be disastrous. Web browsers make it easy to tell when your connection is secure. Just look for a green lock icon at the top of your screen next to the web address. These days, most websites connect using HTTPS, so you're probably fine. But if that green lock icon isn't there, as it sometimes isn't on school, library, and small business websites, anyone can view whatever data you're sending. Unless you're using a VPN, which hides all of your activity, even on unencrypted websites.

Just connecting to a VPN isn't enough. Be sure to check out our guide to using a VPN to make sure you have everything set up correctly.

A VPN also changes your IP address, which adds an additional layer of protection. By giving you a different IP address, a VPN can make it appear as though you're in a different physical location. So even if you're sitting in California, the website you're accessing will think you're in Canada, Hungary, Uruguay, or Thailand. Unfortunately, this method of obscuring your location is not airtight. Technology built into web browsers that's known as WebRTC can leak your true IP address even when you're using a VPN. If this is a concern, disable WebRTC in your browser before connecting to a VPN. Mullvad has instructions on how to disable WebRTC in most browsers.

It's debatable how much masking your IP address really helps protect your privacy in the first place. Your IP address is only one of many, many bits of data websites collect about you. If privacy is your concern, you're better off using web browsers (and extensions) that offer additional tools to protect your privacy. Mozilla Firefox has several of these tools available. Or if you want to get serious about it, use the ultra-private Tor browser as noted above.

To add to the confusion around VPNs, providers—even some I've recommended here, unfortunately—often engage in misleading marketing. Nearly every VPN service website I visited had some kind of red banner claiming I was “not protected,” even when I was using a VPN at the time. The problem is that I wasn't using _their_ VPN. More honest VPN providers, like Mullvad, tell you what's actually happening: “You're not protected _by Mullvad_.” Kudos to Mullvad for not using fear to sell subscriptions.

Either way, the important thing to remember is that using a VPN does not make you anonymous. While VPNs may not be able to do much to protect your privacy, they are an essential tool when it comes to protecting you from snoops trying to gather your unencrypted data sent over insecure networks.

The Best VPNs to Protect Yourself Online

UN countries are preparing to pick a new head of the International Telecommunications Union. Who wins could shape the open web's future.

This week in Romania, a US State Department candidate is facing a Russian challenger in an election for the leadership of one of the most important international technology bodies in the world.

Who wins could determine whether the internet remains a relatively decentralized and open platform—or begins to centralize into the hands of nation-states and state-run companies that may want great control over what their citizens see and do online. Yet, with just days to go before the vote, the race for secretary-general of the International Telecommunications Union (ITU) has garnered painfully little attention.

It’s a two-person race: On one side is the American, Doreen Bogdan-Martin, a former Commerce Department expert on telecommunications who joined the ITU in the 1990s. She’s squaring off against Rashid Ismailov, the former deputy minister for Russia’s telecommunications ministry.

According to their election platforms, Bogdan-Martin and Ismailov signal the same core objective: connecting every person in the world to the internet and cellphone service by 2030. The two candidates, however, represent fundamentally different visions for the future of the internet. Bodgan-Martin’s campaign has focused on her track record of navigating the complex machinery of the United Nations body. Ismailov, meanwhile, has promised a “humanization” of telecommunications infrastructure—and has invoked his candidacy as a way to reject American “dominance” online.

If the wrong candidate wins, says Göran Marby, head of Internet Corporation for Assigned Names and Numbers (Icann), the stakes couldn’t be higher: “People around the world might not be able to connect to one single interoperable internet.”

Today, the ITU technically sits under the auspices of the United Nations. But it predates the world’s major deliberative body by about 80 years.

Originally established to do things like standardize the Morse code alphabet and codify the standard distress call, the ITU is today responsible for creating standards and interoperability between an array of services and technologies and expanding access to modern communications platforms.

Maintaining interoperability is an unsung but critical job. The ITU needs to ensure that all countries can agree on allocating space on the radio frequency spectrum, and it assigns orbital slots to various communication satellites, amongst other tasks. For example, the ITU is the reason a Japanese cellphone can still work in Dakar, and vice versa.

Unlike other UN bodies, the ITU is not merely the purview of nation-states: Its members include 190 nation-states, as well as 900 corporations, research bodies, and NGOs. (Only nations can vote in leadership elections, however.) For the past eight years, the organization has been led by Secretary-General Zhao Houlin, who had been rising in the ranks of the sprawling ITU bureaucracy since he left the Chinese telecommunications ministry in 1986.

Kristen Cordell, an adjunct fellow at the Center for Strategic and International Studies (CSIS), has called the ITU “the most important UN agency you have never heard of.” Decisions made at the international body, she argued, “have a tremendous impact on the everyday lives of Americans.”

Authoritarian states like China, Cordell wrote, “have increased their interest and activism in the ITU, leading to concerns that their outsized influence in standards setting may lead to the bifurcation of the internet.” Houlin’s time at the helm of the organization, according to Cordell, has been marked by “highly favorable comments and decisions in support of Chinese companies.” Those companies have, in turn, ramped up their involvement in the ITU. Huawei alone has submitted some 2,000 new standards proposals to the organization, according to Cordell.

In 2019, Houlin signed a memorandum of understanding between the ITU and the Export-Import Bank of China to expand internet access through the Global South under China’s signature Belt and Road Initiative. The initiative has been criticized as a form of neocolonialism: hooking up countries, particularly in Africa, to high-interest loans that leave them beholden to Chinese investment.

Proposals from Chinese state enterprises and from Beijing itself suggest, in their words, a “New IP” and are purportedly a response to a lack of innovation in how data is processed at the lowest levels of the internet. China has suggested that tagging data packets by their intended purpose could improve data routing and reduce latency. Beijing, in ITU proposals, offers altruistic examples, like prioritizing streaming data associated with virtual surgeries.

Critics, however, say the issues diagnosed by China are already being addressed and that such a proposal would likely worsen these fundamental problems, not improve them. The Internet Society, a US-based nonprofit that promotes internet openness, derided the proposal as one likely to make those identified problems worse and said it ignores progress in making the patchwork of different systems and operators play well with each other. “Creating overlapping work is duplicative and costly. In the end, it does not enhance interoperability,” wrote Internet Society analysts Hascall Sharp and Olaf Kolkman.

Many see an ulterior motive. This new balkanized internet “would lack free and open standards and be primed for manipulation by autocrats that seek to limit civil liberties and human rights,” Cordell argues.

“The internet, at its lowest level, should be data-agnostic,” says Mallory Knodel, chief technology officer at the Center for Democracy & Technology. There is “less information control if the data is agnostic,” she says.

“New IP would centralize control over the network into the hands of telecoms operators, all of which are either state-run or state-controlled in China,” reads a 2020 report from Oxford Information Labs, prepared for NATO and obtained by _Infosecurity Magazine_. “So, internet infrastructure would become an arm of the Chinese state.”

Members of the ITU have largely shot down these proposals for New IP. But that doesn’t mean China is giving up.

Fiona Alexander, a cofounder of Salt Point Strategies who is also part of the American delegation to the ITU, points out that there is a “sleight of hand” going on with some of the authoritarian regimes as they advance proposals like New IP—most recently, China has rebranded that proposal to the innocuous-sounding “IPV6+.”

China has acknowledged that increased central control is, in its view, an upside of these proposals. “States have the right to make ICT-related \[information and communications technology\] public policies consistent with national circumstances to manage their own ICT affairs and protect their citizens’ legitimate interests in cyberspace,” reads a set of 2019 submissions written by Beijing.

This kind of work is, traditionally, not the purview of the ITU. Nongovernmental groups, like Icann and the Internet Engineering Task Force (IETF), tend to be more directly responsible for managing the actual protocols that govern the internet.

The Russian candidate to replace him, Ismailov, is no stranger to China’s international policy: He spent three years as a regional vice president at Huawei. From there, Ismailov rose through the ranks of the Russian Ministry of Telecom and Mass Communications before joining Nokia and later Russian telecommunications firm PJSC VimpelCom.

Beijing and Moscow have made no secret of the fact that they’re on the same page at the ITU.

A 2021 pact between Beijing and Moscow committed both countries to flexing their muscle when it comes to international technology governance, with an eye to “preserving the sovereign right of States to regulate the national segment of the Internet.”

“Russia and China emphasize the need to enhance the role of the International Telecommunication Union and strengthen the representation of the two countries in its governing bodies,” the agreement concludes.

Ismailov has been transparent that his view of the organization stands in stark contrast to that of his American competitor.

“Americans are, perhaps, allergic to everyone who has anything to do with Huawei,” Ismailov said in his official, 30-minute campaign video. “I don’t understand why this has happened.” He added that the “demonization” of the Chinese company was done, in his view, “out of fear of competition.”

While Ismailov said he would “strive to avoid this politicization” of the organization, he also pledged to defend Russia against consequences levied for its war in Ukraine.

“I want to make sure that the organization focuses more on its actual objectives—frequencies standardization, etc,” he said, through a translator, in his campaign video. “Of course this won’t be totally possible because technology is now an integral part of our everyday life, including geopolitics. We are seeing this with the sanctions that are being imposed. Russia is being pressured in all international organizations—some want to strip it of its voting rights, others want to expel Russia.”

In a press conference in May, Ukraine’s head of the State Special Communications Service, Yurii Shchyhol, said his country had moved to sanction Russia at the ITU as a denouncement of its invasion of Ukraine—what Ismailov euphemistically refers to as a “special military operation.”

If she wins, Bodgan-Martin will be the first woman to lead the ITU—she will also be the first American to lead the organization since 1965. While the State Department says Bodgan-Martin’s candidacy is a matter of having “the right candidate at the right time,” her bid for the job is no accident.

Houlin’s first candidacy for the secretary-general position, in 2014, went unopposed. In 2017, the Trump administration unveiled its National Security Strategy: a hodgepodge of tactics to counter China’s rising influence in the world. In it, the White House identified the protection of a free and open internet as a top priority and set “active engagement in key organizations” as necessary measures, mentioning the ITU by name.

Yet at the 2018 ITU Plenipotentiary Conference, Houlin again ran unopposed—his re-election bid was supported by 176 of the 178 countries present.

Ahead of the vote on September 29, at this year’s conference in Bucharest, the United States seems to be taking the race seriously. Members from the American delegation, as well as a senior official at the State Department who spoke on the condition of anonymity, said Bodgan-Martin has been campaigning intensely. A litany of photos posted to Twitter, and a surprisingly active hashtag, show her meeting with technical and civil society groups around the world.

In February, the United States appointed Ambassador Erica Barks-Ruggles as their representative responsible for the ITU conference—with marching orders to get Bogdan-Martin elected. She appeared before a House foreign affairs subcommittee late last year to underscore the fact that the United States’ focus on the ITU election, amongst others, meant “countering the efforts of countries such as the People’s Republic of China and Russia to reshape and undermine international law, institutions, and standards.” President Joe Biden has also released a statement endorsing Bogdan-Martin.

“What we’re really hearing from countries around the world,” the official says, is that connecting the roughly 3 billion people on the planet with no access to the internet is a top priority—closing the so-called digital divide. “We learned during Covid the stark digital divide that’s out there, and they want it closed as soon as possible,” the official said.

On that, they said, Bogdan-Martin “is focused like a laser.”

Ismailov, meanwhile, is trying to turn the race into a referendum on America.

“You can clearly see the two camps humankind is divided into: developing countries and the West,” he says in his campaign video. He set up the United States, and the West more broadly, as a monopolistic entity with respect to the internet.

“They encouraged extremist resources on their platforms at the same time they eradicated anyone who goes against their agenda,” Ismailov adds, citing Donald Trump’s Twitter ban as a prime example. In the friendly interview, Ismailov was asked about Russian media, such as RT, being taken offline in the United States and Europe. Ismailov likened it to “cancel culture.”

Ismailov drew a stark comparison: The Soviet Union’s development of nuclear weapons, followed by China, “offset everyone’s ambitions and made the perception of risk very tangible.” There had not been the same nuclear arms race in the telecommunications space, he says.

It’s a message that could just work, but the Americans are paying it no mind. “He’s focusing on a very negative vision, moaning about things,” the official says of Ismailov. “Let him do that.”

The State Department official spoke on background, and the department declined to make Bogdan-Martin available for an interview. A request to the Russian mission in Geneva, where the ITU is located, went unanswered.

While there was some quiet optimism about Bodgan-Martin’s chances, none of the experts and delegates to the ITU who spoke with WIRED were willing to predict her victory. Even though Russia has lost a number of major votes at the UN in recent months, the race for secretary-general is—unlike many other votes at the international body—a secret ballot, leaving room for horse-trading.

Some of Russia’s appeal is macro: The Beijing and Russia compact is undoubtedly attractive to less democratic countries that want to be free to regulate and restrict the internet as they see fit. Ismailov might also be attractive for other reasons. Earlier this year, Russian satellite operator Intersputnik announced that the country would be sponsoring a 200-seat cafeteria at the ITU’s new Geneva headquarters.

The top-tier race isn’t the only one that matters, however. At their annual meeting later this month, the ITU members will also select a number of senior functionaries, elect the make-up of regulatory boards, and choose a new council. All of those races have the potential to determine the way the ITU approaches these core questions over the next four years.

The secretary-general race will, however, signal what direction the organization is headed. Göran Marby, CEO of Icann—a core administrator of the technical infrastructure of the internet—would not officially endorse Bodgan-Martin, but he told the organization’s annual meeting last week that voting for Ismailov would mean “people around the world might not be able to connect to one single interoperable internet.”

Marby said he was remaining neutral, but added: “We vividly oppose one of the platforms, that the Russian potential secretary-general stands for.”

In an email statement, a spokesperson for Marby told WIRED that Ismailov’s candidacy threatens to further centralize control within the ITU, taking those authorities away from stakeholder groups like Icann.

“Technically, this is not possible,” they wrote. “The internet operates based on a system of voluntary standards, best practices, cooperation, and trust.” This cooperative model, they added, “is a model that works. The internet has operated without fail for nearly 40 years.”

While reiterating their neutrality in the race, the spokesperson added that “if the functions of Icann were moved to the ITU, the risk of internet fragmentation would be very real, and the interoperability of the internet would be jeopardized.”

Source

Wired