Safety Check and Lockdown Mode give people in vulnerable situations ways to quarantine themselves from acute risks.

Apple has long said that it offers software that is secure and private enough for all users by default, without special tiers or paid services. As digital threats to its users expand, though, the company has had to evolve this philosophy. And today's release of iOS 16 comes with two new features meant to help protect people facing very specific crises in their lives.

Safety Check and Lockdown Mode are very different tools, but Apple has built them both into its latest mobile operating system release as lifelines for digital worst-case scenarios. 

Apple designed Safety Check as a feature for users who are at risk for, or currently experiencing, domestic abuse. The tool centralizes a number of controls in one place to make it easier for users to manage and revoke access to their location data and reset privacy-related permissions. Lockdown Mode, on the other hand, is meant for users who potentially face targeted spyware attacks and aggressive state-backed hacking. The feature comprehensively restricts any nonessential iOS features so there are as few potential points of entry to a device as possible. As more governments and repressive entities around the world have begun purchasing powerful commodity spyware to target individuals of particular importance or interest, iOS's general security defenses haven't been able to keep pace with these specialized threats.

“I do think that things like Lockdown Mode and Safety Check are good,” says Thomas Reed, director of Mac and mobile platforms at the antivirus maker Malwarebytes. “People criticize Apple for not opening up iOS enough, and those folks would say this is just a token effort to silence critics. I don’t agree, though. For the nation-state-type stuff and risks users may be facing from people close to them, I think these new features will absolutely help within the paradigm of Apple’s current security model.”

Many mobile security researchers, including Reed, see major tradeoffs in Apple's philosophical approach to securing iOS. The mobile operating system is extremely locked down and can't be monitored for suspicious activity the way other operating systems can be. The benefit of this is that attackers are boxed out in the same way defenders are, but when hackers find and exploit a vulnerability, they can do it without being seen. Given this premise, the creation of purpose-built protective tools like Safety Check and Lockdown Mode is not just a logical progression but a necessary one.

“The more Apple locks down iOS to improve end user security, the harder it becomes for the security research community to investigate and identify vulnerabilities,” says Amanda Gorton, CEO of the of the mobile virtualization company Corellium. “I think it's commendable that Apple is taking measures to address security threats that are only ever likely to impact a tiny fraction of its user base.”

For iOS users dealing with harassment or abuse at home, Safety Check offers a few options to take back some digital control. For a user who has concerns and wants to rein in the access other people may have to their location information and other data, Safety Check offers a tool called Manage Sharing & Access. This tool details the people and apps that have access to different information, like who is connected through Find My Friends or which apps can use a device's microphone. It also includes walkthroughs so users can review their security settings. The Emergency Reset feature, meanwhile, is like a panic button if you think someone has gotten access to your device and set it so you are easier to track and surveil. Emergency Reset can revoke all access at once, resetting privacy permissions, signing you out of iCloud on all other devices, and limiting where your account can send and receive texts through Messages.

Apple says that “Safety Check can be helpful to users whose personal safety is at risk from domestic or intimate partner violence by quickly removing all access they’ve granted to others." 

To access the features, go to **Settings**, then **Privacy & Security**, and then **Safety Check**. 

Lockdown Mode is different in the sense that it is almost a parallel universe that users can move their iPhones into where luxuries like link previews in Messages, shared albums in Photos, and FaceTime calls from phone numbers and accounts you haven't called before are all blocked. In exchange, the goal is to make it much more difficult for commercial spyware vendors to discover and take advantage of complex exploit chains that combine vulnerabilities in multiple iOS features to take control of devices.

“While the vast majority of users will never be the victims of highly targeted cyberattacks, we will work tirelessly to protect the small number of users who are,” Apple’s head of security engineering and architecture, Ivan Krstić, said when the feature was announced in July. “That includes continuing to design defenses specifically for these users.”

Turn on Lockdown Mode in iOS 16 by going to **Settings**, then **Privacy and Security**, then **Lockdown Mode**.

Though Apple doesn't intend either feature to become a hot trend for most users, the fact is that the tools may find audiences and use cases beyond their intended populations. And when it comes to Lockdown Mode, in particular, one can only imagine what strategies researchers and attackers alike may develop to attack even this most hardened version of commercial iOS. But both features offer new and expanded opportunities for users to make it more difficult for adversaries of all sorts to achieve the level of access they seek. And both make it easier for Apple to fix new vulnerabilities and workarounds that arise more easily. Rather than having to make substantial changes, Apple can simply refine Safety Check and Lockdown Mode to address the latest concern.

“There’s been some debate about whether Lockdown Mode will actually prevent spyware attacks like infections from NSO Group's Pegasus,” Malwarebytes Reed says. “It’s possible it won’t prevent all possible means of infection, but it reduces the attack surfaces and makes it harder for attackers. As much as I’d personally like to be able to have greater visibility into iOS, I think Apple’s doing the right thing."

Apple's App Store, though, is one domain that Lockdown Mode and Safety Check don’t address. Researchers have found malicious apps that got approved for the App Store in the past, and as other avenues are closed off to attackers, they may increasingly refine their techniques for developing stealthily malicious apps in an attempt to make up ground. 

“The specific elements of Lockdown Mode give us insight into what Apple sees as the most common attack vectors on an iPhone today,” Corellium's Gorton says. But “Lockdown Mode doesn't seem to restrict access to third-party apps. It's possible that as Apple limits the attack surface for native features, the attack focus may increasingly shift to apps from the App Store. That could be problematic for a couple of reasons. One, we know these these apps undergo relatively limited review before making it to the App Store. And two, this would increase the burden of security mitigations on third-party developers, but the locked-down nature of iOS makes it increasingly difficult for app developers to adequately test the security of their own apps.”

Apple's changing philosophy on specialized security and privacy protections is a welcome step, but it may apply its own evolutionary pressures to the iOS security field that move attackers' focus without dampening their zeal.

iOS 16 Has Two New Security Features for Worst-Case Scenarios

Plus: Albania cuts ties with Iran, claims of a TikTok data breach that didn’t happen, and much more.

Russia’s full-scale invasion of Ukraine hasn’t gone to Vladimir Putin’s plan: Its troops have suffered devastating losses, failed to capture key Ukrainian cities, and been pushed back toward Russia. However, domestically, the Kremlin has succeeded in further suppressing its citizens—including blocking independent news media and other access to impartial information. Now, a new tool lets people in Russia access websites the Kremlin has blocked, giving them access to news that’s not dictated by the state’s propaganda machine.

The Biden administration is reportedly readying itself to take action against TikTok, following years of suggestions that the Chinese-owned app is a threat to national security. This week we looked at the problem with TikTok: that lawmakers can’t decide on what threat, if any, the app really poses.

Elsewhere, Apple revealed the new iPhone 14. Alongside this, it announced that iOS 16 will be available for people to download from September 12. This means Apple’s new passkey technology, which eliminates the need for passwords, will be available to millions of people. Here’s everything you need to know about Apple’s passkeys.

But wait, there’s more! Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

With more than 400,000 students ranging from kindergarten to 12th grade, the Los Angeles Unified School District is one of the largest school districts in the US. On September 6, the district became the latest to be targeted by ransomware. In a statement published online, the district’s administrators said it had detected “unusual activity” within its networks, saying it had been targeted by ransomware; despite the attack, students have been able to attend school.

The attack prompted a large response from officials, with the FBI and Department of Homeland Security assisting local law enforcement. Students and staff have lost access to their email systems, local reports say. It is also unclear, according to reports, whether students' information, including disciplinary records and assessments, was accessed by the attackers. The school district says that students and employees must reset their passwords to their school accounts while physically attending school district sites. “The District has staggered password reset access to minimize congestion from simultaneous users accessing the website,” officials said in a statement.

The Vice Society ransomware group has claimed responsibility for the attack. Following the incident, the Cybersecurity and Infrastructure Security Agency (CISA) and other partners published a warning about Vice Society, saying it has been “disproportionately targeting the education sector.” The Los Angeles attack is the latest against educational institutions: According to a report by security firm Sophos based on a survey of 499 respondents, 56 percent of lower education and 64 percent of higher education organizations were hit by ransomware in the past year, a “considerable increase” from the previous year.

Back in July, the government websites of Albania were knocked offline. Last month, security company Mandiant researchers revealed that Iranian hackers, working on behalf of Tehran, were likely to be behind the attacks, which took out public services for hours. “These are disruptive attacks, which affect the lives of everyday Albanians who live within the NATO alliance,” John Hultquist, Mandiant’s vice president of intelligence, told WIRED when it published its findings.

This week, the government of Albanian took the unprecedented step to cut diplomatic ties with Iran, accusing it of launching the cyberattack. The country also ordered Iranian embassy staff to leave the country. “The deep investigation put at our disposal undeniable evidence that the cyberattack against our country was orchestrated and sponsored by the Islamic Republic of Iran which had involved four groups for the attack on Albania,” prime minister Edi Rama said in a statement. (Microsoft conducted the investigation for the Albanian government.)

Hackers Target Los Angeles School District With Ransomware

Samizdat Online syndicates banned news sites by hosting them on uncensored domains—allowing people to access independent reporting.

When censors at Belarus’ Ministry of Information announced they were going to block the website of lifestyle publication _KYKY_ in the summer of 2020, everything changed for its team of journalists and editors. Many of its team members fled the country, fearing widespread crackdowns and arrests, says Sasha Romanova, a director at _KYKY_. When censors finally blocked the website in December 2020, the impact was immediate. “Before blocking, we had almost 5 million visits monthly,” Romanova says. The number of visitors dropped off a cliff.

Then the magazine started fighting back. With readers in Belarus unable to access _KYKY_’s website, it started registering new, unblocked domains and hosting the articles on them. “We started to buy domains with silly names,” Romanova explains. The domains—such as massandry.net and netetabletki.rip—allowed people to read independent media, and simultaneously were named to mock Alexander Lukashenko’s government.

Every week, Romanova says, _KYKY_ would buy a new domain and wait until censors found it and blocked it. “They’re so ancient and bureaucratic, our domain name was living for a week,” Romanova says. After around two months, Romanova says, continually moving to new domains became expensive and untenable.

However, since around June this year, much of _KYKY_’s readership has returned as a result of a new anti-censorship tool that supercharges the process of registering unblocked domains and automatically syndicating news articles. The project, called Samizdat Online, makes blocked websites visible to people and doesn’t need any technical knowledge to use.

Yevgeny Simkin, the cofounder of Samizdat Online and founder of a software engineering firm, says it is designed to help people in Russia and other oppressed countries access uncensored news and information. “Putin’s propaganda operation is probably singly the only competent thing that they have,” says Simkin, who left Soviet Russia when he was a child and started the project after Russian troops invaded Ukraine in February. “At least at this stage, undermining that is technologically not all that complicated.”

Around the world, countries that block websites frequently do so using DNS blocking, which essentially means that websites can’t be accessed by typing their domain names. Samizdat Online, which was first covered by Business Insider, works by syndicating stories from news websites to new domains. “We create and register these random-looking domains in large numbers,” Simkin says. Samizdat Online calls them SOS-Links.

The organization has permission from more than a dozen blocked publications in Russia and Belarus to syndicate their content. Its homepage currently lists websites that it is syndicating, but from next week on will appear as a more traditional news site, suggesting articles from publications it syndicates and providing shareable SOS-Links to their websites.

Every time you access the website of _The_ _Moscow Times_ using Samizdat Online, for instance, it will show on a different domain. When I open the homepage, I am shown it on the domain: sfzgohtwrm.net/. The rest of the URL after the slash is made up of a long string of characters and letters, which encode data about the page you’re visiting, such as the CSS needed to display the website correctly. When I click an article at the top of the homepage, I am taken to the domain raul.help/ (again, followed by encoded data). Another click takes me to the domain: uvsoxmqdcu.net/.

This Clever Anti-Censorship Tool Lets Russians Read Blocked News

With iOS 16 and macOS Ventura, Apple is introducing passkeys—a more convenient and secure alternative to passwords.

For years, we’ve been promised the end of password-based logins. Now the reality of a passwordless future is taking a big leap forward, with the ability to ditch passwords being rolled out for millions of people. When Apple launches iOS 16 on September 12 and macOS Ventura next month, the software will include its password replacement, known as passkeys, for iPhones, iPads, and Macs.

Passkeys allow you to log in to apps and websites, or create new accounts, without having to create, memorize, or store a password. This passkey, which is made up of a cryptographic key pair, replaces your traditional password and is synced across iCloud’s Keychain. It has the potential to eliminate passwords and improve your online security, replacing the insecure passwords and bad habits you probably have now.

Apple’s rollout of passkeys is one of the largest implementations of password-free technology to date and builds on years of work by the FIDO Alliance, an industry group made up of tech’s biggest companies. Apple’s passkeys are its version of the standards created by the FIDO Alliance, meaning they will eventually work with Google, Microsoft, Meta, and Amazon’s systems.

What Is a Passkey?

Using a passkey is similar to using a password. On Apple’s devices, it’s built into the traditional password boxes that websites and apps use to get you to log in. Passkeys act as a unique digital key and can be created for each app or website you use. (The word “passkey” is also being used by Google and Microsoft, with FIDO calling them “multi-device FIDO credentials.”)

If you are new to an app or a website, there’s the potential that you can create a passkey instead of a password from the start. But for services where you already have an account, it’s likely you will need to log in to that existing account using your password and then create a passkey.

Apple’s demonstrations of the technology show a prompt appearing on your devices during the sign-in or account-creation phase. This box will ask whether you would like to “save a passkey” for the account you are using. At this stage, your device will prompt you to use Face ID, Touch ID, or another authentication method to create the passkey.

Once created, the passkey can be stored in iCloud’s Keychain and synced across multiple devices—meaning your passkeys will be available on your iPad and MacBook without any extra work. Passkeys work in Apple’s Safari web browser as well as on its devices. They can also be shared with nearby Apple devices using AirDrop.

As Apple’s passkeys are based on the wider passwordless standards created by the FIDO Alliance, there’s the potential that they can be stored elsewhere, too. For instance, password manager Dashlane has already announced its support for passkeys, claiming it is an “independent and universal solution agnostic of the device or platform.”

While Apple is launching passkeys with iOS 16 and macOS Ventura, there are several caveats to its rollout. First, you need to update your devices to the new operating system. Second is that apps and websites need to support the use of passkeys—they can do this by using the FIDO standards. Ahead of Apple’s updates, it isn’t clear which apps or websites are already supporting passkeys, although Apple first previewed the technology to developers at its developer conference in 2021.

How Do Apple’s Passkeys Work?

Under the hood, Apple’s passkeys are based on the Web Authentication API (WebAuthn), which was developed by the FIDO Alliance and World Wide Web Consortium (WC3). The passkeys themselves use public key cryptography to protect your accounts. As a result, a passkey isn’t something that can (easily) be typed.

When you create a passkey, a pair of related digital keys are created by your system. “These keys are generated by your devices, securely and uniquely, for every account,” Garrett Davidson, an engineer on Apple’s authentication experience team, said in a video about passkeys. One of these keys is public and stored on Apple’s servers, while the other key is a secret key and stays on your device at all times. “The server never learns what your private key is, and your devices keep it safe,” Davidson said.

Apple’s Killing the Password. Here’s Everything You Need to Know

US lawmakers keep warning about the popular app. But until they can explain what makes it uniquely dangerous, it’s difficult to tailor a resolution.

Amid a flurry of talking points and takedowns as the United States midterm elections loom, lawmakers and regulators have reheated claims about TikTok, a social media app they say poses a threat to personal privacy and US national security. Now, the Biden administration is reportedly readying its own action. But the exact scope of the problem and goals remain fuzzy. Owned by the Chinese tech giant Bytedance, TikTok has more than a billion users, including an estimated 135 million in the US, and some lawmakers, including former president Donald Trump, have warned over the past two years that the Chinese government could use the app to collect data on Americans or launch influence operations through the platform.

The US military banned its members from using TikTok on government devices or at all in late 2019 and early 2020, as did the Transportation Security Administration and some other federal agencies. Just last month, the chief administrative officer for the US House of Representatives warned lawmakers against installing TikTok due to the data it can collect. This followed a June 17 BuzzFeed News report, which found that ByteDance employees can and do gain access to US TikTok users' data in some situations. But for the general public, warnings from legislators and regulators this summer have continued to be vague and amorphous, underscoring broader ambiguity about where lawmakers' precise concerns lie. 

With so many users, TikTok is clearly a potentially rich source of personal data and could be exploited in the way other social platforms have been to spread disinformation or promote influence operations. But the reason TikTok has been singled out is less clear. Huge quantities of sensitive data about people living in the US are already available in various forms for purchase or the taking through other public social media platforms, the digital marketing industry, data brokers, and leaked stolen data troves. And long before the rise of TikTok, China was already notorious on the global stage for stealing massive quantities of data about Americans and others from governments and companies around the world. So, is it protectionism? Xenophobia? Special insight into US national security?

A report published by Semafor on Friday indicates that the Biden administration is preparing a series of executive orders to address TikTok and the Chinese tech sector's access to Americans' data more broadly. The report says the White House's actions could significantly curtail US investment in China, while other potential measures may limit what technology can be sold to Chinese clients and specifically limit the data Chinese tech companies can collect about US citizens.

Such steps would be less dramatic than the approach to TikTok taken by Biden's predecessor but would have a larger scope and wider set of potential ramifications. In the waning months of the Trump administration, the White House attempted to block TikTok from US app stores if ByteDance didn't sell the company to a US-based firm. Though the move failed, TikTok took steps to silo itself from its Chinese owners and announced in June that all US user traffic would be routed in the US. The company is still working on deleting all user data from its own servers in favor of processing everything in Oracle's cloud. The company stores data backups in the US and Singapore.

“The thing about TikTok is that a lot of people use it!” says Rui Zhong, a researcher at the Kissinger Institute on China and the United States. “The Trump administration also tried to ban WeChat, which is not just a communication platform but a technology platform that vacuums up reams of your data—more so than TikTok. But WeChat is almost exclusively used in the US by the Chinese diaspora, whereas TikTok is just broadly popular with Americans.”

She adds that while, from a US national security perspective, the existential threats are worth acknowledging, there wasn't enough information available about concrete concerns when the TikTok ban was on the table a couple of years ago or in remarks this summer. US officials still don't seem, at least publicly, to have a smoking gun illustrating the urgency of the threat. “It needed a better case built around it, and at the time in 2019 they just didn’t seem to have that case,” Zhong says. “Whether they will have something they can show Americans in the future or not, I can’t say.”

On June 24, days after the BuzzFeed report, a group of Republican senators led by Tom Cotton of Arkansas sent a letter to Treasury Secretary Janet Yellen “to inquire about the Biden administration’s delayed response to the national security and privacy risks posed by TikTok.” On June 28, a different group of nine Republican senators sent a letter to TikTok's CEO, Shou Zi Chew, laying out questions about the company's data management practices and relationship with ByteDance given that the company has always maintained that they will not share US user data with the Chinese government. On July 5, a bipartisan duo from the Senate Select Committee on Intelligence—democrat Mark Warner of Virginia and Republican Marco Rubio of Florida—sent a letter to the Federal Trade Commission urging the agency to investigate TikTok and ByteDance for “repeated misrepresentations by TikTok concerning its data security, data processing, and corporate governance practices.”

In a series of responses this summer both to lawmakers and the public, TikTok has staunchly maintained that it does not and would never share US user data with the Chinese government, and that it is a separate US-based entity subject to US laws. The company does not report publicly on government data requests, but it does publish a twice-annual report about government requests to remove content from the service. The latter report indicates that the company has never fulfilled a removal request from China.

The bottom line, though, is that TikTok is owned by ByteDance. And some ByteDance employees can access TikTok user data. Does that mean the ruling Chinese Communist Party (CCP) can get that data too? In his June 30 response to the nine Republican senators, TikTok's Chew said, “Employees outside the US, including China-based employees, can have access to TikTok US user data subject to a series of robust cybersecurity controls and authorization approval protocols overseen by our US-based security team.” He described at length the layers of classification and restriction that protect user data from being accessed casually or without oversight. Chew and TikTok have long maintained that it they “have not provided US user data to the CCP, nor would we if asked.” When WIRED asked TikTok how this squares with the reality that ByteDance has access and could be compelled to exercise it under Chinese law, spokesperson Maureen Shanahan said, “TikTok is provided in the United States by TikTok Inc., which is incorporated in California and subject to US laws and regulations.”

Still, it is unclear whether TikTok poses a unique and specific threat to US national security or if it is simply a convenient proxy through which lawmakers are grappling with larger issues of data security and privacy, disinformation, content moderation, and influence in a globalized tech market. Similarly, the Chinese telecom giant Huawei faced controversy over whether the US should incorporate Chinese-made hardware into domestic 5G infrastructure, which was ultimately banned.

“There are definitely signs that Chinese influence efforts are likely to grow, linked to the Chinese government’s strategy more broadly of digital authoritarianism,” says Kian Vesteinsson, a research analyst for the nonprofit digital rights think tank Freedom House. “But it’s important for us to acknowledge that the US government has its own shadowy national security surveillance authorities. And in recent years, US government agencies have monitored social media accounts of people coordinating protests in the US and done things like searched electronic devices throughout the country and at the border. These sorts of tactics undermine the idea that this is only a foreign threat.”

Then there's the power imbalance TikTok may create. One thing about TikTok, in particular, is that its popularity and proliferation within the US could make it a one-stop shop for the Chinese government to mine the data of US users and launch influence operations in the US. Meanwhile, the US government may feel that it lacks a comparable mechanism through which it can so directly pull Chinese user data and work to sway public opinion in China.

“Let's assume for a second that US intelligence has access to WeChat. They would have to fight hard for that access, and it would constantly be at risk of discovery and neutralization. China, on the other hand, doesn't have to fight for access to TikTok; they have it by statutory authority,” says Jake Williams, director of cyber-threat intelligence at the security firm Scythe and a former National Security Agency hacker. “By itself, I don't think that the TikTok app on people's devices is a significant threat, but the potential for Chinese data collection across the platform is a larger concern, especially when combined with other data already acquired by Chinese state actors.”

Given its immense popularity, its ownership, and the fact that the bulk of TikTok activity is public by nature, there is no clear technical solution to boxing China out of the service. The question is whether the US government wants to devise a business solution or incentivize development of an appealing alternative platform. Still, privacy violations, security concerns, and foreign influence operations against US residents through social media are problems the US government has yet to solve. And neither technology bans nor countersurveillance will make them go away.

“One thing that we really should escalate here is that the US should be leading by example,” Freedom House's Vesteinsson says. “When we talk about expanding the US government’s surveillance powers, that sets a really bad example for governments around the world.”

It’s Time to Get Real About TikTok’s Risks

Plus: An unsecured database exposed face recognition data in China, ‘Cuba’ ransomware knocks out Montenegro, and more.

As summer winds down, researchers warned this week about systemic vulnerabilities in mobile app infrastructure, as well as a new iOS security flaw and one in TikTok. And new findings about ways to exploit Microsoft’s Power Automate tool in Windows 11 show how it can be used to distribute malware, from ransomware to keyloggers and beyond.

The anti-Putin media network February Morning, which runs on the communication app Telegram, has taken on a crucial role in the underground resistance to the Kremlin. Meanwhile, the “California Age-Appropriate Design Code” passed the California legislature this week with major potential implications for the online privacy of kids and everyone.

Plus, if you’re ready to take a more radical step to protect your privacy on mobile, and feel like a badass while doing it, we’ve got a guide to setting up and using burner phones.

But wait, there’s more! Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

The data broker Fog Data Science has been selling access to what it claims are billions of location data points from over 250 million smartphones to local, state, and federal law enforcement agencies around the US. The data comes from tech companies and cell phone towers and is collected in the Fog Reveal tool from thousands of iOS and Android apps. Crucially, access to the service is cheap, often costing local police departments less than $10,000 per year, and investigations by the Associated Press and Electronic Frontier Foundation found that law enforcement sometimes pulls location data without a warrant. The EFF conducted its investigation through more than 100 public records requests filed over several months. “Troublingly, those records show that Fog and some law enforcement did not believe Fog’s surveillance implicated people’s Fourth Amendment rights and required authorities to get a warrant,” the EFF wrote.

An unprotected database containing information on millions of faces and license plates was exposed and publicly accessible in the cloud for months until it was finally protected in mid-August. TechCrunch linked the data to Xinai Electronics, a tech company based in Hangzhou in eastern China. The company develops authentication systems for accessing spaces like parking garages, construction sites, schools, offices, or vehicles. It also touts additional services related to payroll, employee attendance and performance tracking, and license plate recognition. The company has a massive network of cameras deployed across China that record face and license plate data. Security researcher Anurag Sen alerted TechCrunch to the unprotected database, which also exposed names, ages, and resident ID numbers in face data. The exposure comes just months after an enormous database from the Shanghai police leaked online. 

Montenegro authorities said on Wednesday that a gang called “Cuba” targeted its government networks with a ransomware attack last week. The gang also claimed responsibility for the attack on a dark-web site. Montenegro’s National Security Agency (ANB) said the group is linked to Russia. The attackers reportedly deployed a malware strain dubbed “Zerodate” and infected 150 computers in 10 Montenegrin government agencies. It is unclear whether the attackers exfiltrated data as part of the hack. The United States Federal Bureau of Investigation is sending investigators to Montenegro to aid in analyzing the attack.

On Monday, the US Federal Trade Commission announced it is suing the data broker Kochava for selling geolocation data harvested from apps on “hundreds of millions of mobile devices.” The data could be used, the FTC said, to track people’s movements and reveal information about where they go, including showing visits to sensitive locations. “Kochava’s data can reveal people’s visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities,” the agency wrote. “The FTC alleges that by selling data tracking people, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence.” The lawsuit aims to stop Kochava from selling sensitive location data, and the agency is requesting that the company delete what it already has.

In August, the prolific ransomware gang Cl0p hacked South Staff Water, a water supply company in the UK. The gang said it even had access to SSW’s industrial control network, which handles things like water flow. The hackers published screenshots allegedly showing their access to water supply control panels. Experts told Motherboard that it appears the hackers really could have meddled with the water supply, underscoring the risks when critical infrastructure networks aren’t adequately siloed from regular business networks. “Yes, there was access, but we made only screenshots,” Cl0p told Motherboard. “We do not harm people and treat critical infrastructure with respect. … We didn’t really go into it because we didn’t want to harm anyone.” SSW said in a statement, “This incident has not affected our ability to supply safe water.”

Police Across US Bypass Warrants With Mass Location-Tracking Tool

Microsoft disclosed the flaw in the Android app’s deep link verification process, which has since been fixed.

Microsoft said on August 31 that it recently identified a vulnerability in TikTok's Android app that could allow attackers to hijack accounts when users did nothing more than click on a single errant link. The software maker said it notified TikTok of the vulnerability in February and that the China-based social media company has since fixed the flaw, which is tracked as CVE-2022-28799.

The vulnerability resided in how the app verified what’s known as deep links, which are Android-specific hyperlinks for accessing individual components within a mobile app. Deep links must be declared in an app’s manifest for use outside of the app—so, for example, someone who clicks on a TikTok link in a browser has the content automatically opened in the TikTok app.

An app can also cryptographically declare the validity of a URL domain. TikTok on Android, for instance, declares the domain m.tiktok.com. Normally, the TikTok app will allow content from tiktok.com to be loaded into its WebView component but forbid WebView from loading content from other domains.

“The vulnerability allowed the app’s deep link verification to be bypassed,” the researchers wrote. “Attackers could force the app to load an arbitrary URL to the app’s WebView, allowing the URL to then access the WebView’s attached JavaScript bridges and grant functionality to attackers.”

The researchers went on to create a proof-of-concept exploit that did just that. It involved sending a targeted TikTok user a malicious link that, when clicked, obtained the authentication tokens that TikTok servers require for users to prove ownership of their account. The link also changed the targeted user’s profile bio to display the text "!! SECURITY BREACH !!"

“Once the attacker’s specially crafted malicious link is clicked by the targeted TikTok user, the attacker’s server, https://www.attacker\[.\]com/poc, is granted full access to the JavaScript bridge and can invoke any exposed functionality,” the researchers wrote. “The attacker’s server returns an HTML page containing JavaScript code to send video upload tokens back to the attacker as well as change the user’s profile biography.”

Microsoft said it has no evidence the vulnerability was actively exploited in the wild.

_This story originally appeared on_ _Ars Technica__._

TikTok Users Were Vulnerable to a Single-Click Attack

Hackers can use Microsoft’s Power Automate to push out ransomware and key loggers—if they get machine access first.

Automating mundane work tasks has become easier over the past few years. Using drag-and-drop automation software, you can track your working hours in a spreadsheet or automatically create a to-do list item when someone mentions you in an email. The tools can make your life easier, but they carry risks.

One security researcher has found a way to hijack Microsoft’s software automation tool to send ransomware to connected machines and steal data from devices. The attack uses the automation tool as it was designed, but instead of sending legitimate actions, it can be used to deploy malware, says Michael Bargury, the cofounder and CTO of security firm Zenity, which is behind the work.

“My research showed that you can very easily, as an attacker, take advantage of all of this infrastructure to do exactly what it is supposed to do,” Bargury says. “You \[then\] use it to run your own payloads instead of the enterprise payloads.” The researcher documented his work at the DefCon hacker conference last month and has since released the code.

The attack is based on Microsoft’s Power Automate, an automation tool that was built into Windows 11. Power Automate uses a form of robotic process automation, also known as RPA, in which a computer mimics a human’s actions to complete tasks. If you want to get a notification each time an RSS feed is updated, you can build a custom RPA process to make that happen. Thousands of these automations exist, and Microsoft’s software can link up Outlook, Teams, Dropbox, and other apps.

The software is part of a broader low-code/no-code movement that aims to create tools people can use to create things without having any coding knowledge. “Every business user now has the power that the developer used to have,” Bargury says. His company exists to help secure low-code/no-code apps.

Bargury’s research starts from a position in which a hacker has already gained access to someone’s computer—whether through phishing or an insider threat. (While computers within businesses are frequently insecure—from a lack of patching and updates, for example—starting at this point means an attacker would have already gotten into a corporate network.)

Once an attacker has access to a computer, they need to take a few additional steps to abuse the RPA setup, but these are relatively simple. “There’s not a lot of hacking here,” says Bargury, who dubbed the whole process Power Pwn and is documenting it on GitHub.

First, an attacker needs to set up a Microsoft cloud account, known as a tenant, and set it to have admin controls over any machines that are assigned to it. This essentially allows the malicious account to run RPA processes on an end user’s device. On the previously compromised machine, all a hack has to do now is assign it to the new admin account—this is done using a simple command line, called silent registration.

“Once you do that, you will get a URL that would allow you, as an attacker, to send payloads to the machine,” Bargury says. Ahead of his DefCon talk, he created multiple demos showing how it is possible to use Power Automate to push out ransomware to impacted machines. Other demos show how an attacker can steal authentication tokens from a machine. “You can exfiltrate data outside of the corporate networks through this trusted tunnel, you can build keyloggers, you can take information from the clipboard, you can control the browser,” Bargury says.

A Windows 11 Automation Tool Can Easily Be Hijacked

The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children.

No one would describe the internet as “kid-friendly.” Parents fret over how to keep their kids safe from the internet’s myriad dangers, from bullies to predators to surreptitious surveillance. A new California bill is poised to remove some of the burden from parents—and force tech companies to take more responsibility to protect kids online.

This week, the California legislature voted unanimously to pass the California Age-Appropriate Design Code Act. Once Governor Gavin Newsom signs the bill into law, the code will require sites and apps that serve users under 18 to “consider the best interests of children when designing, developing, and providing” their products. The ADCA could be the United States’ biggest step toward comprehensive online protections for kid users yet.

The ADCA comes amid growing scrutiny of the time kids spend online, what kind of data is collected about them, and how all that screen time might cause harm. Buffy Wicks, a Democrat spearheading the bill and parent of two young children, says the bill isn’t meant to clamp down on young people’s internet experience. “I am raising digital natives and children who are comfortable being online,” she says. “I feel it’s our moral obligation to keep them safe as they learn and grow.” Tech companies, on the other hand, are not financially incentivized to design a healthy, data-protective internet for kids.

The ADCA’s main pillars regulate the privacy policies of any company whose web products serve users under 18. These companies would be required to offer a high level of privacy for child users by default. If parents, say, don’t want their children to receive messages from a stranger over a social media platform, they shouldn’t have to click around for a tiny “settings” tab; that option should already be turned on. It also aims to give kids more digital agency over their internet exploration. Companies would be required to offer transparent information on their privacy policy in kid-friendly language and allow kids to log their privacy concerns with the company.

If enacted, the law would also impose stricter rules around what companies can and can’t do with kids’ personal information. Under the legislation, companies wouldn’t be able to collect or share data beyond what’s strictly necessary for the site to function. They would have to complete a “Data Protection Impact Assessment,” a survey that would basically force them to detail how kids’ data will be used. They would also have to disclose whether the product uses addictive design mechanisms, like autoplay or gamified nudges that reward spending more time on an app.

Most notably, the bill would apply to sites and apps that aren’t specifically directed at children, but are “likely to be accessed by” them. That means the regulatory controls will extend beyond the usual suspects of mobile games or teen social media hubs. The rules could apply to, among other sites, Google Search, retail sites, and news websites like this one. If a company violates the ADCA, they have 90 days to come up with a fix, or the California Attorney General’s office could exact a fine of up to $7,500 per affected child.

Supporters say that the ADCA would compel tech firms to proactively design products that protect children, rather than reacting to harms they’ve already inflicted. “It’s not meant to fix a problem after the fact,” says Nicole Gill, cofounder and executive director of the nonprofit Accountable Tech. “It’s meant to encourage design that is safe and healthy and fosters a safe experience online for kids.” Accountable Tech supports the bill, along with organizations like Common Sense, Fairplay, and the American Academy of Pediatrics, California.

The status quo for kid safety on the internet is universally disappointing. A recent study by software company Pixalate found that thousands of kid-directed apps transmit users’ GPS data and residential IP addresses to ad companies. The habit-forming nature of social media apps has raised concerns about the relationship between social media and teens’ mental health. The primary law governing kids’ privacy online is COPPA, the federal Children’s Online Privacy Protection Rule. But COPPA, which Congress has updated only a handful of times since 1998, has a limited reach: It applies only to sites and apps directed to children under the age of 13. The ADCA, which applies both to anyone under 18 _and_ to online products that are “likely to be accessed by children” but may not be specifically directed to children, would be far more expansive.

Some of the bill’s critics argue that the ADCA’s scope is overinclusive. Opponents include the video game trade group Entertainment Software Association and Technet, a group whose members include Google, Meta, and Snap. The News/Media Alliance has also lobbied against the bill, citing concerns that it would raise the cost of publishing news online. (Condé Nast, WIRED’s parent company, is a member, and its CEO sits on News/Media Alliance’s board.)

The bill outlines several indicators for what might constitute a site’s “likelihood” of being accessed by children, including some clear-cut indicators, such as whether a site features advertisements targeted to kids. But other indicators are ambiguous, like whether a site is “routinely assessed by a significant number of children.” (How often is “routine,” and what number is “significant”?)

Critics have particularly seized on the ADCA’s requirement that companies “estimate the age of child users with a reasonable level of certainty.” The bill itself does not lay out how companies ought to estimate the age of child users. So how could that work? Will online services start asking users to furnish driver's licenses or credit cards, as some critics have stated? Doesn’t estimating age invite _more_ data collection, not less?

Supporters of the bill say that age estimation methods don’t have to be invasive. A report from the 5Rights Foundation, which sponsored both the California and UK Design Codes, suggests that users could, for example, self-report birthdays, use a third-party age assurance provider, or complete a “capacity test” (solving a puzzle that helps indicate an age range). Companies that absolutely need to verify that their users are adults, like dating sites, would ask for hard identifiers like driver's licenses. Under the ADCA, companies will also be allowed to build a profile of all users’ online activity or keep the online profiles of users they already have—but these data profiles can be used only to estimate a user’s age. The age estimation profile cannot be kept longer than necessary or used in any other way. But it’s unclear how regulators would enforce these aspects of the statute.

The ADCA does include a carve-out, stipulating that if a site or app affords a high level of data protections (e.g., it doesn’t sell user data, doesn’t use targeted ads), it doesn’t need an age-estimation mechanism at all.

Let’s say there’s a website called Fake-website.com. If Fake-website.com is found to have a “significant” number of routine visitors who are teenagers, then it would be subject to regulatory control under the ADCA. At this point, Fake-website.com has two options: If it uses targeted ads or sells users data, then it would have to install an age estimation mechanism, like a prompt for users to enter their birthday, so that it does not offer targeted ads to users who identify themselves as under 18. Fake-website.com then can’t use the user data point (their birthday) in any other way, and must delete it as soon as possible. If it does not use targeted ads or sell users’ data, then there’s nothing more to be done. Supporters say that the relevant clause (”apply the privacy and data protections afforded to all children to all consumers”) is the heart of the bill, and the mechanism by which the ADCA could actually incentivize making the internet safer for all users.

That is, if it can be enforced. Others worry that the bill’s ambiguities, including the age estimation clause, are too vague to be implemented at all. “My guess is it will probably just be ignored by tech companies,” says Justin Brookman, the director of technology policy at nonprofit Consumer Reports. “It feels like sloppy policymaking.”

Supporters, however, say that the ambiguity is purposeful. The law will create a new regulatory agency tasked with hammering out the bill’s specifics, including the age-estimation requirement. It’s meant to work with companies on a case-by-case basis to determine how they might comply with the law, which would go into effect in July 2024.

The ADCA is not without precedent—the bill is modeled after similar UK legislation that went into effect in 2021. It’s unclear whether the UK Design Code has had much impact. It has yet to be enforced, despite being enforceable for a year. The country’s information commissioner, John Edwards, told Bloomberg that his office is “looking into how over 50 different online services are complying with the code.”

While Governor Newsom has not yet given a public stance on the ADCA, he’s expected to sign it, which he must do by the end of September. Once enacted, the bill could have further-reaching consequences than just the kids of California. Although the law is enforceable only for users and businesses based in California, companies might opt to offer higher data privacy protections for all kids, rather than geofencing protections for California. For example, when Europe passed GDPR, Microsoft chose to extend GDPR’s protections to all users.

As Wicks put it in a press conference on Tuesday: “It is my absolute hope that if this bill gets signed into law, it will become, effectively, the law of the land.”

The US May Soon Learn What a ‘Kid-Friendly’ Internet Looks Like

Researchers found that mobile applications contain keys that could provide access to both user information and private files from unconnected apps.

As with any piece of software, mobile apps can create an array of security issues and exposures, from rogue programs that are intentionally malicious to apps that contain an obscure but significant flaw. Now, new research is shedding light on systemic oversights in mobile app cloud infrastructure that are all too common and create the risk that users' data could leak where it shouldn't or be compromised.

Researchers from Broadcom's Symantec Threat Hunter team published findings on Thursday about the prevalence of hard-coded authentication credentials lurking in the cloud services that underlie hundreds of mainstream apps. These login credentials are often meant to give the app access to a single file or service, like a mechanism for an app to display public images from a company's website or run text through a translation service at a user's request. But in practice, the researchers found, these same credentials often grant access to all files stored in a cloud service, like company data, database backups, and system control components. And when multiple apps have been created by the same third-party development firm or incorporate the same publicly available software development kits (SDKs), these static authentication tokens may even grant access to the infrastructure and user data of multiple, unconnected apps.

All of this means that if an attacker discovered these access tokens, they could potentially unlock massive and disparate troves of sensitive data all by finding one key under one doormat.

“The cloud is still kind of a new frontier. And sometimes when you hear about the practices being used, you realize that a lot of organizations may not be where they are with security on other fronts,” says Symantec's Dick O’Brien. “It’s hard to say whether it’s people cutting corners or whether it’s just an ignorance of what you’re exposing by putting those credentials out there, but it’s certainly obvious that data isn’t being ring-fenced anywhere near the way it should be."

The researchers found 1,859 publicly available apps on both Android and iOS that contained hard-coded Amazon Web Services credentials. The vast majority were iOS apps, a discrepancy Symantec says it has tracked for years but hasn't fully explained. The credentials present in more than three-quarters of the apps granted access to private cloud services, and nearly half of those additionally gave access to private files. Fifty-three percent of the apps contained access tokens that were also found in other, often totally unrelated, apps.

“Initially it was very surprising, but this is a systemic thing,” O’Brien says. “People need to do a complete audit of what they’re using and realize that there are multiple layers there. The practice of implementing hard coded access keys is not great. Temporary credentials that expire after a short period of time are probably the way to go, and also there needs to be greater awareness that you need to silo information.” 

Symantec says it has notified the developers of the apps where it sees the most pressing issues and hopes to raise awareness about how insecure development practices and shared resources can create exposures without careful consideration and segmentation. 

In one case, the researchers realized that several mainstream iOS banking apps were all using the same third-party AI digital identity software development kit that exposed cloud credentials of the shared service. While none of the banking apps themselves created the SDK, the credentials exposed its server structure and infrastructure blueprints, source code, and the AI models underlying the identity service. And more than 300,000 biometric fingerprint files from users of five of the mobile banking apps were leaking and potentially exposed.

In another case, the researchers noticed what it calls a large hospitality and entertainment company working with a technology company on sports betting apps. In total, hard-coded credentials gave infrastructure access to 16 online gambling apps, exposing their cloud services and even granting root access to take control of this backend platform. 

Symantec's O’Brien emphasizes that while the company isn't naming the impacted apps, it hopes the findings will raise awareness about these common pitfalls and their potentially outsize impact on users. “The things we found—it illustrates the significance of what we’re dealing with here,” he says.

Source

Wired