Plus: An unsecured database exposed face recognition data in China, ‘Cuba’ ransomware knocks out Montenegro, and more.

As summer winds down, researchers warned this week about systemic vulnerabilities in mobile app infrastructure, as well as a new iOS security flaw and one in TikTok. And new findings about ways to exploit Microsoft’s Power Automate tool in Windows 11 show how it can be used to distribute malware, from ransomware to keyloggers and beyond.

The anti-Putin media network February Morning, which runs on the communication app Telegram, has taken on a crucial role in the underground resistance to the Kremlin. Meanwhile, the “California Age-Appropriate Design Code” passed the California legislature this week with major potential implications for the online privacy of kids and everyone.

Plus, if you’re ready to take a more radical step to protect your privacy on mobile, and feel like a badass while doing it, we’ve got a guide to setting up and using burner phones.

But wait, there’s more! Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

The data broker Fog Data Science has been selling access to what it claims are billions of location data points from over 250 million smartphones to local, state, and federal law enforcement agencies around the US. The data comes from tech companies and cell phone towers and is collected in the Fog Reveal tool from thousands of iOS and Android apps. Crucially, access to the service is cheap, often costing local police departments less than $10,000 per year, and investigations by the Associated Press and Electronic Frontier Foundation found that law enforcement sometimes pulls location data without a warrant. The EFF conducted its investigation through more than 100 public records requests filed over several months. “Troublingly, those records show that Fog and some law enforcement did not believe Fog’s surveillance implicated people’s Fourth Amendment rights and required authorities to get a warrant,” the EFF wrote.

An unprotected database containing information on millions of faces and license plates was exposed and publicly accessible in the cloud for months until it was finally protected in mid-August. TechCrunch linked the data to Xinai Electronics, a tech company based in Hangzhou in eastern China. The company develops authentication systems for accessing spaces like parking garages, construction sites, schools, offices, or vehicles. It also touts additional services related to payroll, employee attendance and performance tracking, and license plate recognition. The company has a massive network of cameras deployed across China that record face and license plate data. Security researcher Anurag Sen alerted TechCrunch to the unprotected database, which also exposed names, ages, and resident ID numbers in face data. The exposure comes just months after an enormous database from the Shanghai police leaked online. 

Montenegro authorities said on Wednesday that a gang called “Cuba” targeted its government networks with a ransomware attack last week. The gang also claimed responsibility for the attack on a dark-web site. Montenegro’s National Security Agency (ANB) said the group is linked to Russia. The attackers reportedly deployed a malware strain dubbed “Zerodate” and infected 150 computers in 10 Montenegrin government agencies. It is unclear whether the attackers exfiltrated data as part of the hack. The United States Federal Bureau of Investigation is sending investigators to Montenegro to aid in analyzing the attack.

On Monday, the US Federal Trade Commission announced it is suing the data broker Kochava for selling geolocation data harvested from apps on “hundreds of millions of mobile devices.” The data could be used, the FTC said, to track people’s movements and reveal information about where they go, including showing visits to sensitive locations. “Kochava’s data can reveal people’s visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities,” the agency wrote. “The FTC alleges that by selling data tracking people, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence.” The lawsuit aims to stop Kochava from selling sensitive location data, and the agency is requesting that the company delete what it already has.

In August, the prolific ransomware gang Cl0p hacked South Staff Water, a water supply company in the UK. The gang said it even had access to SSW’s industrial control network, which handles things like water flow. The hackers published screenshots allegedly showing their access to water supply control panels. Experts told Motherboard that it appears the hackers really could have meddled with the water supply, underscoring the risks when critical infrastructure networks aren’t adequately siloed from regular business networks. “Yes, there was access, but we made only screenshots,” Cl0p told Motherboard. “We do not harm people and treat critical infrastructure with respect. … We didn’t really go into it because we didn’t want to harm anyone.” SSW said in a statement, “This incident has not affected our ability to supply safe water.”

Police Across US Bypass Warrants With Mass Location-Tracking Tool

Microsoft disclosed the flaw in the Android app’s deep link verification process, which has since been fixed.

Microsoft said on August 31 that it recently identified a vulnerability in TikTok's Android app that could allow attackers to hijack accounts when users did nothing more than click on a single errant link. The software maker said it notified TikTok of the vulnerability in February and that the China-based social media company has since fixed the flaw, which is tracked as CVE-2022-28799.

The vulnerability resided in how the app verified what’s known as deep links, which are Android-specific hyperlinks for accessing individual components within a mobile app. Deep links must be declared in an app’s manifest for use outside of the app—so, for example, someone who clicks on a TikTok link in a browser has the content automatically opened in the TikTok app.

An app can also cryptographically declare the validity of a URL domain. TikTok on Android, for instance, declares the domain m.tiktok.com. Normally, the TikTok app will allow content from tiktok.com to be loaded into its WebView component but forbid WebView from loading content from other domains.

“The vulnerability allowed the app’s deep link verification to be bypassed,” the researchers wrote. “Attackers could force the app to load an arbitrary URL to the app’s WebView, allowing the URL to then access the WebView’s attached JavaScript bridges and grant functionality to attackers.”

The researchers went on to create a proof-of-concept exploit that did just that. It involved sending a targeted TikTok user a malicious link that, when clicked, obtained the authentication tokens that TikTok servers require for users to prove ownership of their account. The link also changed the targeted user’s profile bio to display the text "!! SECURITY BREACH !!"

“Once the attacker’s specially crafted malicious link is clicked by the targeted TikTok user, the attacker’s server, https://www.attacker\[.\]com/poc, is granted full access to the JavaScript bridge and can invoke any exposed functionality,” the researchers wrote. “The attacker’s server returns an HTML page containing JavaScript code to send video upload tokens back to the attacker as well as change the user’s profile biography.”

Microsoft said it has no evidence the vulnerability was actively exploited in the wild.

_This story originally appeared on_ _Ars Technica__._

TikTok Users Were Vulnerable to a Single-Click Attack

Hackers can use Microsoft’s Power Automate to push out ransomware and key loggers—if they get machine access first.

Automating mundane work tasks has become easier over the past few years. Using drag-and-drop automation software, you can track your working hours in a spreadsheet or automatically create a to-do list item when someone mentions you in an email. The tools can make your life easier, but they carry risks.

One security researcher has found a way to hijack Microsoft’s software automation tool to send ransomware to connected machines and steal data from devices. The attack uses the automation tool as it was designed, but instead of sending legitimate actions, it can be used to deploy malware, says Michael Bargury, the cofounder and CTO of security firm Zenity, which is behind the work.

“My research showed that you can very easily, as an attacker, take advantage of all of this infrastructure to do exactly what it is supposed to do,” Bargury says. “You \[then\] use it to run your own payloads instead of the enterprise payloads.” The researcher documented his work at the DefCon hacker conference last month and has since released the code.

The attack is based on Microsoft’s Power Automate, an automation tool that was built into Windows 11. Power Automate uses a form of robotic process automation, also known as RPA, in which a computer mimics a human’s actions to complete tasks. If you want to get a notification each time an RSS feed is updated, you can build a custom RPA process to make that happen. Thousands of these automations exist, and Microsoft’s software can link up Outlook, Teams, Dropbox, and other apps.

The software is part of a broader low-code/no-code movement that aims to create tools people can use to create things without having any coding knowledge. “Every business user now has the power that the developer used to have,” Bargury says. His company exists to help secure low-code/no-code apps.

Bargury’s research starts from a position in which a hacker has already gained access to someone’s computer—whether through phishing or an insider threat. (While computers within businesses are frequently insecure—from a lack of patching and updates, for example—starting at this point means an attacker would have already gotten into a corporate network.)

Once an attacker has access to a computer, they need to take a few additional steps to abuse the RPA setup, but these are relatively simple. “There’s not a lot of hacking here,” says Bargury, who dubbed the whole process Power Pwn and is documenting it on GitHub.

First, an attacker needs to set up a Microsoft cloud account, known as a tenant, and set it to have admin controls over any machines that are assigned to it. This essentially allows the malicious account to run RPA processes on an end user’s device. On the previously compromised machine, all a hack has to do now is assign it to the new admin account—this is done using a simple command line, called silent registration.

“Once you do that, you will get a URL that would allow you, as an attacker, to send payloads to the machine,” Bargury says. Ahead of his DefCon talk, he created multiple demos showing how it is possible to use Power Automate to push out ransomware to impacted machines. Other demos show how an attacker can steal authentication tokens from a machine. “You can exfiltrate data outside of the corporate networks through this trusted tunnel, you can build keyloggers, you can take information from the clipboard, you can control the browser,” Bargury says.

A Windows 11 Automation Tool Can Easily Be Hijacked

The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children.

No one would describe the internet as “kid-friendly.” Parents fret over how to keep their kids safe from the internet’s myriad dangers, from bullies to predators to surreptitious surveillance. A new California bill is poised to remove some of the burden from parents—and force tech companies to take more responsibility to protect kids online.

This week, the California legislature voted unanimously to pass the California Age-Appropriate Design Code Act. Once Governor Gavin Newsom signs the bill into law, the code will require sites and apps that serve users under 18 to “consider the best interests of children when designing, developing, and providing” their products. The ADCA could be the United States’ biggest step toward comprehensive online protections for kid users yet.

The ADCA comes amid growing scrutiny of the time kids spend online, what kind of data is collected about them, and how all that screen time might cause harm. Buffy Wicks, a Democrat spearheading the bill and parent of two young children, says the bill isn’t meant to clamp down on young people’s internet experience. “I am raising digital natives and children who are comfortable being online,” she says. “I feel it’s our moral obligation to keep them safe as they learn and grow.” Tech companies, on the other hand, are not financially incentivized to design a healthy, data-protective internet for kids.

The ADCA’s main pillars regulate the privacy policies of any company whose web products serve users under 18. These companies would be required to offer a high level of privacy for child users by default. If parents, say, don’t want their children to receive messages from a stranger over a social media platform, they shouldn’t have to click around for a tiny “settings” tab; that option should already be turned on. It also aims to give kids more digital agency over their internet exploration. Companies would be required to offer transparent information on their privacy policy in kid-friendly language and allow kids to log their privacy concerns with the company.

If enacted, the law would also impose stricter rules around what companies can and can’t do with kids’ personal information. Under the legislation, companies wouldn’t be able to collect or share data beyond what’s strictly necessary for the site to function. They would have to complete a “Data Protection Impact Assessment,” a survey that would basically force them to detail how kids’ data will be used. They would also have to disclose whether the product uses addictive design mechanisms, like autoplay or gamified nudges that reward spending more time on an app.

Most notably, the bill would apply to sites and apps that aren’t specifically directed at children, but are “likely to be accessed by” them. That means the regulatory controls will extend beyond the usual suspects of mobile games or teen social media hubs. The rules could apply to, among other sites, Google Search, retail sites, and news websites like this one. If a company violates the ADCA, they have 90 days to come up with a fix, or the California Attorney General’s office could exact a fine of up to $7,500 per affected child.

Supporters say that the ADCA would compel tech firms to proactively design products that protect children, rather than reacting to harms they’ve already inflicted. “It’s not meant to fix a problem after the fact,” says Nicole Gill, cofounder and executive director of the nonprofit Accountable Tech. “It’s meant to encourage design that is safe and healthy and fosters a safe experience online for kids.” Accountable Tech supports the bill, along with organizations like Common Sense, Fairplay, and the American Academy of Pediatrics, California.

The status quo for kid safety on the internet is universally disappointing. A recent study by software company Pixalate found that thousands of kid-directed apps transmit users’ GPS data and residential IP addresses to ad companies. The habit-forming nature of social media apps has raised concerns about the relationship between social media and teens’ mental health. The primary law governing kids’ privacy online is COPPA, the federal Children’s Online Privacy Protection Rule. But COPPA, which Congress has updated only a handful of times since 1998, has a limited reach: It applies only to sites and apps directed to children under the age of 13. The ADCA, which applies both to anyone under 18 _and_ to online products that are “likely to be accessed by children” but may not be specifically directed to children, would be far more expansive.

Some of the bill’s critics argue that the ADCA’s scope is overinclusive. Opponents include the video game trade group Entertainment Software Association and Technet, a group whose members include Google, Meta, and Snap. The News/Media Alliance has also lobbied against the bill, citing concerns that it would raise the cost of publishing news online. (Condé Nast, WIRED’s parent company, is a member, and its CEO sits on News/Media Alliance’s board.)

The bill outlines several indicators for what might constitute a site’s “likelihood” of being accessed by children, including some clear-cut indicators, such as whether a site features advertisements targeted to kids. But other indicators are ambiguous, like whether a site is “routinely assessed by a significant number of children.” (How often is “routine,” and what number is “significant”?)

Critics have particularly seized on the ADCA’s requirement that companies “estimate the age of child users with a reasonable level of certainty.” The bill itself does not lay out how companies ought to estimate the age of child users. So how could that work? Will online services start asking users to furnish driver's licenses or credit cards, as some critics have stated? Doesn’t estimating age invite _more_ data collection, not less?

Supporters of the bill say that age estimation methods don’t have to be invasive. A report from the 5Rights Foundation, which sponsored both the California and UK Design Codes, suggests that users could, for example, self-report birthdays, use a third-party age assurance provider, or complete a “capacity test” (solving a puzzle that helps indicate an age range). Companies that absolutely need to verify that their users are adults, like dating sites, would ask for hard identifiers like driver's licenses. Under the ADCA, companies will also be allowed to build a profile of all users’ online activity or keep the online profiles of users they already have—but these data profiles can be used only to estimate a user’s age. The age estimation profile cannot be kept longer than necessary or used in any other way. But it’s unclear how regulators would enforce these aspects of the statute.

The ADCA does include a carve-out, stipulating that if a site or app affords a high level of data protections (e.g., it doesn’t sell user data, doesn’t use targeted ads), it doesn’t need an age-estimation mechanism at all.

Let’s say there’s a website called Fake-website.com. If Fake-website.com is found to have a “significant” number of routine visitors who are teenagers, then it would be subject to regulatory control under the ADCA. At this point, Fake-website.com has two options: If it uses targeted ads or sells users data, then it would have to install an age estimation mechanism, like a prompt for users to enter their birthday, so that it does not offer targeted ads to users who identify themselves as under 18. Fake-website.com then can’t use the user data point (their birthday) in any other way, and must delete it as soon as possible. If it does not use targeted ads or sell users’ data, then there’s nothing more to be done. Supporters say that the relevant clause (”apply the privacy and data protections afforded to all children to all consumers”) is the heart of the bill, and the mechanism by which the ADCA could actually incentivize making the internet safer for all users.

That is, if it can be enforced. Others worry that the bill’s ambiguities, including the age estimation clause, are too vague to be implemented at all. “My guess is it will probably just be ignored by tech companies,” says Justin Brookman, the director of technology policy at nonprofit Consumer Reports. “It feels like sloppy policymaking.”

Supporters, however, say that the ambiguity is purposeful. The law will create a new regulatory agency tasked with hammering out the bill’s specifics, including the age-estimation requirement. It’s meant to work with companies on a case-by-case basis to determine how they might comply with the law, which would go into effect in July 2024.

The ADCA is not without precedent—the bill is modeled after similar UK legislation that went into effect in 2021. It’s unclear whether the UK Design Code has had much impact. It has yet to be enforced, despite being enforceable for a year. The country’s information commissioner, John Edwards, told Bloomberg that his office is “looking into how over 50 different online services are complying with the code.”

While Governor Newsom has not yet given a public stance on the ADCA, he’s expected to sign it, which he must do by the end of September. Once enacted, the bill could have further-reaching consequences than just the kids of California. Although the law is enforceable only for users and businesses based in California, companies might opt to offer higher data privacy protections for all kids, rather than geofencing protections for California. For example, when Europe passed GDPR, Microsoft chose to extend GDPR’s protections to all users.

As Wicks put it in a press conference on Tuesday: “It is my absolute hope that if this bill gets signed into law, it will become, effectively, the law of the land.”

The US May Soon Learn What a ‘Kid-Friendly’ Internet Looks Like

Researchers found that mobile applications contain keys that could provide access to both user information and private files from unconnected apps.

As with any piece of software, mobile apps can create an array of security issues and exposures, from rogue programs that are intentionally malicious to apps that contain an obscure but significant flaw. Now, new research is shedding light on systemic oversights in mobile app cloud infrastructure that are all too common and create the risk that users' data could leak where it shouldn't or be compromised.

Researchers from Broadcom's Symantec Threat Hunter team published findings on Thursday about the prevalence of hard-coded authentication credentials lurking in the cloud services that underlie hundreds of mainstream apps. These login credentials are often meant to give the app access to a single file or service, like a mechanism for an app to display public images from a company's website or run text through a translation service at a user's request. But in practice, the researchers found, these same credentials often grant access to all files stored in a cloud service, like company data, database backups, and system control components. And when multiple apps have been created by the same third-party development firm or incorporate the same publicly available software development kits (SDKs), these static authentication tokens may even grant access to the infrastructure and user data of multiple, unconnected apps.

All of this means that if an attacker discovered these access tokens, they could potentially unlock massive and disparate troves of sensitive data all by finding one key under one doormat.

“The cloud is still kind of a new frontier. And sometimes when you hear about the practices being used, you realize that a lot of organizations may not be where they are with security on other fronts,” says Symantec's Dick O’Brien. “It’s hard to say whether it’s people cutting corners or whether it’s just an ignorance of what you’re exposing by putting those credentials out there, but it’s certainly obvious that data isn’t being ring-fenced anywhere near the way it should be."

The researchers found 1,859 publicly available apps on both Android and iOS that contained hard-coded Amazon Web Services credentials. The vast majority were iOS apps, a discrepancy Symantec says it has tracked for years but hasn't fully explained. The credentials present in more than three-quarters of the apps granted access to private cloud services, and nearly half of those additionally gave access to private files. Fifty-three percent of the apps contained access tokens that were also found in other, often totally unrelated, apps.

“Initially it was very surprising, but this is a systemic thing,” O’Brien says. “People need to do a complete audit of what they’re using and realize that there are multiple layers there. The practice of implementing hard coded access keys is not great. Temporary credentials that expire after a short period of time are probably the way to go, and also there needs to be greater awareness that you need to silo information.” 

Symantec says it has notified the developers of the apps where it sees the most pressing issues and hopes to raise awareness about how insecure development practices and shared resources can create exposures without careful consideration and segmentation. 

In one case, the researchers realized that several mainstream iOS banking apps were all using the same third-party AI digital identity software development kit that exposed cloud credentials of the shared service. While none of the banking apps themselves created the SDK, the credentials exposed its server structure and infrastructure blueprints, source code, and the AI models underlying the identity service. And more than 300,000 biometric fingerprint files from users of five of the mobile banking apps were leaking and potentially exposed.

In another case, the researchers noticed what it calls a large hospitality and entertainment company working with a technology company on sports betting apps. In total, hard-coded credentials gave infrastructure access to 16 online gambling apps, exposing their cloud services and even granting root access to take control of this backend platform. 

Symantec's O’Brien emphasizes that while the company isn't naming the impacted apps, it hopes the findings will raise awareness about these common pitfalls and their potentially outsize impact on users. “The things we found—it illustrates the significance of what we’re dealing with here,” he says.

Careless Errors in Hundreds of Apps Could Expose Troves of Data

Prepaid phones are looking good as privacy worries peak.

Even if surveillance overreach (abortion bounty-hunting, police use of face recognition) doesn't make you want to ditch your smartphone for something less connected, you could still consider a burner phone, a practically disposable prepaid mobile device that's not under contract with a wireless carrier.

Yep, prepaid cell phones that were popularized by brands like Boost Mobile and Cricket in the mid-aughts, and in pop culture by their frequent use in TV's _The Wire__,_ are still around. In fact, tens of millions of customers still go for burner phones, whether they're flip phones or smartphones on Android or iOS from providers such as Verizon-owned TracFone, Simple Mobile, or Total Wireless.

What's the appeal? The idea is that a cheap phone with prepaid calling minutes and data is disposable, free of any contract commitment, and more private. For someone who uses a cell phone or data plan infrequently, it could be much cheaper than a typical mobile phone plan.

Prabhat Agarwal, senior director of research and trends at the Consumer Electronics Association, says that while wireless companies steer customers to post-paid plans with higher-margin 5G data plans and longer commitments, prepaid phones “are not going away anytime soon. There's a lot of groups for which prepaid makes a lot of sense,” he explains.

If you pay cash for the hardware and the service, you are theoretically untethered from being traced to the phone with your bank account, credit card, or home address. Of course, that anonymity vanishes the moment you start using a burner phone to log in to your Facebook account or you commit a crime serious enough to warrant the authorities investigating who used a burner phone to, say, plan an _Ocean's 11_\-style casino heist.

Going off-grid isn't the only reason to get a prepaid phone, though. Maybe you want a dedicated second phone for a side hustle like Lyft driving that doesn't get used all the time, since it won't be subject to use-it-or-lose-it monthly fees. You might be someone who wants to keep your online dating or personal email completely separate from the premium smartphone you use for work. Or you could use a cheap, locked-down phone that allows your kids to call friends and grandparents and play games. A cheap prepaid device won't cause as much stress if the screen gets cracked or the handset ends up in the toilet.

In all these cases, a burner phone can allow you to be accessible by phone but with a different phone number than your main one. If you value keeping your main cell number nonpublic, but you still need to be reachable to a large number of people, a prepaid phone may be simpler than getting a second line or using a service like Google Voice.

How to Choose a Burner Phone

If that sounds interesting, the first thing you need to decide is _how_ _much_ burner phone you actually need. If it's just for phone calls and light data communication, you could go retro with a flip phone and hope you remember how to use T9 texting.

Especially for smartphones, depending on the model, there might be limited built-in memory for apps, video, and other data. You may also need to supply your own SIM and SD cards to use the mobile network and expand the phone's memory. Make sure you remove both of those cards before you get rid of the phone, or at least wipe the memory on the SD card first.

Expect to pay anywhere from $20 for a cheap flip phone to $300 or more for something like a fully loaded prepaid iPhone 11. If being untrackable is your primary goal, paying with a credit card or online account might defeat the purpose. Go to a store. Pay cash or use a gift card. Burn the receipt, or, better yet, don't ask for one.

Prepaid phone plans that include voice, text, and data might be sold in time increments from a month at a time up to a year. Some may offer “unlimited” usage, but be sure to read the fine print on what that actually means. One thing to watch out for, Agarwal says, is that some prepaid data plans have much lower data allotments and may throttle the speed of the network even before you hit your data limit. You should also be aware of what wireless network the prepaid provider uses. For instance, Cricket uses AT&T's mobile network, and TracFone is on Verizon's. That matters less for privacy, but more for understanding where you’ll have service and what speed of wireless service will be available.

If you don't want new hardware in your life, you could look for a software solution such as the aptly named Burner app, available for iOS and Android that promises to give you a second phone line and more privacy for $3.99 to $4.99 a month, depending on your plan.

How to Use a Burner Phone

First, as with any device, you'll need to activate the phone. (There's usually easy-to-follow instructions in the phone packaging.) You can keep buying additional data and voice minutes with prepaid cards you buy in stores or online.

Depending on the phone, you might have access to apps you're already familiar with that offer good privacy and encryption options, such as Telegram or Signal. You could also use VPN apps to further anonymize your online activity.

However, you should understand that no matter how careful you are to protect your privacy, any login to a website from a burner phone or even hopping onto a Wi-Fi network could expose your location data and other private information. The Intercept has a good video guide geared toward protestors with tips to keep some of that data private.

Once you're done with a burner phone, you can erase the data on it with a factory reset (don't forget to wipe the SD card if one is in use). Then stash it away, throw it away, or resell it on the secondary market to a site such as Gazelle or Swappa. You may even be able to trade it in with a wireless carrier.

You’re Not Stringer Bell, but You May Still Need a Burner Phone

Plus: Chrome patches another zero-day flaw, Microsoft closes up 100 vulnerabilities, Android gets a significant patch, and more.

August was a bumper month for security patches, with Apple, Google, and Microsoft among the firms issuing emergency fixes for already exploited vulnerabilities. The month also saw some big fixes arriving from the likes of VMWare, Cisco, IBM, and Zimbra.

Here’s everything you need to know about the important security fixes issued in August.

Apple iOS 15.6.1

After a two-month patch hiatus, followed by multiple fixes in July, Apple released an emergency security update in August with iOS 15.6.1. The iOS update fixed two flaws, both of which were being used by attackers in the wild.

It is thought that the vulnerabilities in WebKit (CVE-2022-32893) and the Kernel (CVE-2022-32894) were being chained together in attacks, with serious consequences. A successful attack could allow an adversary to take control of your iPhone and access your sensitive files and banking details.

Combining the two flaws “typically provides all the functionality needed to mount a device jailbreak,” bypassing almost all Apple-imposed security restrictions, Paul Ducklin, a principal research scientist at Sophos, wrote in a blog analyzing the vulnerabilities. This would potentially allow adversaries to “install background spyware and keep you under comprehensive surveillance,” Ducklin explained.

Apple always avoids giving out details about vulnerabilities until most people have updated, so it’s hard to know who the attack targets were. To ensure you are safe, you should update your devices to iOS 15.6.1 without delay.

Apple also released iPadOS 15.6.1, watchOS 8.7.1, and macOS Monterey 12.5.1, all of which you should update at the next opportunity.

Google Chrome

Google released a security update in August to fix its fifth zero-day flaw this year. In an advisory, Google listed 11 vulnerabilities fixed in August. The patches include a use-after-free flaw in FedCM—tracked as CVE-2022-2852 and rated as critical—as well as six highly rated issues and three classed as having a medium impact. One of the highly rated vulnerabilities has been exploited by attackers, CVE-2022-2856.

Google hasn’t provided any detail about the exploited flaw, but since attackers have gotten ahold of the details, it’s a good idea to update Chrome now.

Earlier in August, Google released Chrome 104, fixing 27 vulnerabilities, seven of which were rated as having a high impact.

Google Android

The August Android security patch was a hefty one, with dozens of fixes for serious vulnerabilities, including a flaw in the framework that could lead to local privilege escalation with no additional privileges needed. Meanwhile, an issue in the media framework could lead to remote information disclosure, and a flaw in the system could lead to remote code execution over Bluetooth. A vulnerability in kernel components could also lead to local escalation of privileges.

The Android security patch was late in August, but it’s now available on such devices as Google’s Pixel range, the Nokia T20, and Samsung Galaxy devices (including the Galaxy S series, Galaxy Note series, Galaxy Fold series, and Galaxy Flip series).

Microsoft

Microsoft’s August Patch Tuesday fixed over 100 security flaws, of which 17 are rated as critical. Among the fixes was a patch for an already exploited flaw tracked as CVE-2022-34713, also known as DogWalk.

The remote code execution (RCE) flaw in the Windows Support Diagnostic Tool (MDST) is rated as having a high impact because exploiting it can result in a system compromise. The vulnerability, which affects all users of Windows and Windows Server, was first exposed over two years ago in January 2020, but Microsoft didn’t consider it a security issue at the time.

VMWare

VMWare fixed a bunch of flaws in August, including a critical authentication bypass bug tracked as CVE-2022-31656. On releasing the patch, the software firm warned that public exploit code is available.

VMWare also fixed an RCE vulnerability in VMware Workspace ONE Access, Identity Manager, and Aria Automation (formerly vRealize Automation), tracked as CVE-2022-31658 with a CVSS score of eight. Meanwhile, a SQL injection RCE vulnerability found in VMware Workspace ONE Access and Identity Manager also got a CVSS score of eight. Both require an attacker to have administrator and network access before they can trigger remote code execution.

Apple Fixed a Serious iOS Security Flaw—Have You Updated Yet?

In the last two weeks of the war, an ad hoc team armed with group chats, QR codes, and satellite maps launched a mad dash to save imperiled Afghan allies.

Inside the Shadow Evacuation of Kabul

Anti-Putin media network February Morning has become a central player in the underground fight against the Kremlin.

On the evening of August 20, Russian TV pundit and conspiracy theorist Darya Dugina was killed on the outskirts of Moscow when a powerful explosion ripped apart her Toyota Land Cruiser. Dugina was a vocal supporter of Russia's invasion of Ukraine and the daughter of fascist philosopher and writer Alexander Dugin, nicknamed “Putin’s brain” thanks to his perceived ties to Russian president Vladimir Putin. According to Russian authorities, a remote-controlled “explosive device,” presumably installed in her car, went off at around 9 pm local time.

News of Dugina’s assassination spread like wildfire through social media, most notably on the instant messaging service Telegram, where it was shared approvingly by a vast network of Russian and Ukrainian channels. But in the hours that followed, it became clear that one channel, operated by the media outlet Utro Fevralya, or February Morning, is more than just a place to share the news. It aims to play a key role in the story.

Created by exiled former Russian MP and dissident Ilya Ponomarev, February Morning was the first to report on a group claiming responsibility for Dugina’s death. Ponomarev himself took to YouTube, where February Morning airs its shows, claiming that the perpetrators were a little-known Russian resistance group called the National Republican Army. According to Ponomarev, an all-out war against “Putinism” had just begun.

While the National Republican Army’s involvement remains unconfirmed, Ponomarev’s announcement crystallized February Morning’s role as the center of gravity of a growing guerilla movement to spark revolution in Russia. The movement’s ecosystem includes activists and saboteurs of all types, from anarchists to fascists, connected through a network of Telegram channels and a singular goal: overthrowing Vladimir Putin.

Making History

On a sun-drenched balcony overlooking a busy street in downtown Kyiv, 48-year-old Evgeni Lesnoy smokes a final cigarette before going back on the air. The seasoned journalist is one of the faces of February Morning, which he joined shortly after its creation following Russia’s invasion of Ukraine in the early hours of February 24. “Because of my friends and relatives who stayed in Russia, I had been closely following the events there prior to February 24,” Lesnoy says in Russian. After his outspoken condemnation of the war in Donbas and the annexation of Crimea cost him his friends and, ultimately, his job, the journalist left Russia for Ukraine in 2015 and has been living with his husband in Kyiv ever since.

“When I was told that this project existed, I figured that this is where I needed to be,” he says, gesturing towards the TV studio in the next room. “Because I understand the context of what is happening inside Russia: I was born there, and I understand how people there think.”

Ponomarev, February Morning’s founder, is the only member of the Russian Duma to have voted against the 2014 annexation of Crimea. After the vote, he became persona non grata in Putin’s Russia, so he and his family fled to Ukraine’s capital city and started a new life. “For quite a long time, I had wanted to create a media aimed at a Russian audience, and that would broadcast from Kyiv,” he tells WIRED over Signal. “I tried to raise money for what I thought would be a Russian-language Al-Jazeera for maybe a year._”_ The venture was unsuccessful. But when Russian tanks crossed into Ukraine, the former MP and father of two joined the Territorial Defense in Kyiv, and the project took on new urgency. “After the first couple of days, many of my friends started telling me that now might be the time to revisit the idea of a media targeting Russians.”

The living room of the 18th-century apartment in which February Morning has taken residence is home to its television studio with a semicircular stage lit with a bluish light. Two screens broadcast in the background. When presenting the day’s show, Lesnoy sits before a small table draped with a white and blue tricolor flag—the symbol of the Russian opposition to the invasion—and that of Ukraine.

Broadcast on YouTube, the professionally produced daily programs try to counter the official Russian narrative surrounding the war, reporting on the atrocities committed by the “occupiers” against the Ukrainian population. “Putin’s supporters and apologists have big media organizations and prime-time news shows,'' says Lesnoy. “We want to give a voice to those who oppose the war.”

Which is what Ponomarev did on August 21, when he claimed on air that the National Republican Army assassinated Dugina—an act he described as “legitimate.” He also read the group’s purported manifesto, which called on all Russians to join the ranks of the National Republican Army and vow to destroy all those who have “usurped their power.”

February Morning’s insights into the domestic resistance movement in Russia stem from its 27 regional outlets, each with its own Telegram channel where activists and journalists mingle to gather and share news of anti-Putin actions. A binational team of around 70 journalists, technicians, and activists operates covertly in the far-flung regions of Russia and in Kyiv. In addition to its studio in Ukraine’s capital, the network brazenly broadcasts from Moscow. “I don't know how long the studio there will be able to operate, but even if the FSB shows up at the door and shuts us down, there will be another one,” says Ponomarev.

Whereas most media outlets only report the story, February Morning intends to be part of it. “We are referring to ourselves as the Russian ‘NEXTA,’ the Belarusian resource that played a key role in the protests two years ago following the reelection of Alexander Lukashenko,” says Ponomarev, referring to Belarus’ autocratic leader. “We want to be the resource that will play a critical role in the future revolutionary changes in the country.”

To this end, Ponomarev and his team have set up a Telegram channel known as Rospartizan, which has become an aggregator for information pertaining to the resistance to Putin and the war in Ukraine as well as a key recruitment tool. Every day, Rospartizan relays the latest developments across Russia, from the torching of a military recruitment office to the unfurling of an antiwar banner in front of the Russian Ministry of Defense building in Moscow.

According to Ponomarev, representatives of the National Republican Army first made contact with him through Rospartizan, a testament to the channel’s growing notoriety. “We are providing, in my opinion, the most comprehensive news stream on what is going on in Russian regions, in terms of acts of sabotage and the actual resistance,” says Ponomarev. The National Republican Army’s manifesto concludes, “stay in contact with us through the Rospartizan Telegram channel.”

With more than 26,000 followers, Rospartizan embraces anyone who’s anti-Putin, no matter their political ideology—a feature, not a bug, according to Ponomarev, a former Communist Party member and self-described “social globalist.”

“I am right now not only reaching out, but very actively interacting with not only my friends on the left side of the political spectrum,” he says, “but also with people on the far-right, who we are usually fighting with.”

The Enemy of My Enemy

Roman Popkov, the former head of the Moscow branch of the National-Bolshevik party, falls into that far-right camp. Popkov used to be a member of the influential Russian National Unity, a now-defunct neo-Nazi group responsible for a string of racist crimes, before joining the political party founded by controversial Russian writer, poet, and dissident Eduard Limonov, who sought to unite far-left and far-right radicals on the same platform.

In 2006, after years of harassment by Russian security forces, Popkov was arrested and spent more than two years in pretrial detention in the infamous Butyrka prison. The European Court of Human Rights ruled that his detention was illegal, and his arrest is widely considered to have been motivated by his political activism.

Popkov, now residing in Ukraine, works as a journalist for a number of independent media outlets, and is the head of a recently launched media project called Poslezavtra, or “The Day After Tomorrow.” An “old friend” of Ponomarev, Popkov has featured extensively on February Morning’s shows and took part in the broadcast that followed Dugina’s assassination.

“We are covering direct actions targeting the military and the apparatus of political repression of Putin's regime,'' Popkov says over the phone. “First of all, we are trying to inspire people, to get them to act, and second, we inform and report on what is being done.”

Like Ponomarev, Popkov stresses that activists’ ideologies are not as important as a willingness to defy Putin’s regime and to oppose the war in Ukraine.

“Our collective unites people opposed to Putin's regime, with different political views and ideologies,” says Popkov. “At the moment, it's not that important if one is an anarchist, a nationalist, or a liberal as, since Russia is not a democracy, we have no representation in parliament, and can't vote for our candidates.”

According to Popkov, acts of sabotage in Russia are mostly the work of small-scale far-right and far-left groups, the most famous of those being the Anarcho-Communist Combat Organization, or BO-AK. The organization rose to prominence after it sabotaged the railway leading to a Russian military arsenal in the small town of Kirzach, 100 km east of Moscow. The group shared photos of the sabotage on their own Telegram channel, which quickly spread to other anti-Putin channels, including Rospartizan, and was soon featured on February Morning’s broadcast.

Yet even the staunch anarchists of the BO-AK acknowledge the need to reach out to the other side of the political spectrum. “Most of our contacts are from our ideological camp, but not all,” an anonymous representative of the group tells WIRED. “We believe that alliances with different forces are necessary in our struggle.”

The anarchists of the BO-AK consider direct actions and acts of sabotage as the best way to kickstart the social revolution, a view shared by many members of Rospartizan. In addition to two sabotage operations targeting military railways, the BO-AK claims to have set fire to a cell phone tower in the Belgorod region “in order to damage Putin’s army communications in Ukraine.”

“Only those who can back it with their actions can call themselves the opposition,” an anonymous contributor to Rospartizan says over Telegram, “be them a Molotov cocktail thrown at a military recruitment office, a wire strung across train tracks, or a gas canister taken to the car of a regime collaborator.”

Dangerous Cocktails

Inspired by the Belarusian resistance to Lukashenko and the protestors’ innovative use of Telegram, Popkov, Ponomarev, and activists like the anarchists of BO-AK have turned to social media to organize, recruit, and incite people to act against the war and Putin’s increasingly authoritarian regime.

“Telegram is a less censored, more intelligent, and politicized social network. A large part of our immediate target audience is present here—people who are potentially interested in radical politics,_”_ says the BO-AK. “This is where lies the usefulness of social networks for campaigning and education—they are an excellent channel for broadcasting and communicating.”

Antiwar activists in Ukraine and in Russia have taken full advantage of the relative anonymity Telegram provides. A website known as Ostanovi Vagony, or “Stop the Wagon,” and its associated Telegram channel aim to educate Russian would-be partisans on the safest, most effective ways to sabotage the railway system. Meanwhile, a Telegram channel created in late May called Gromko (“loud” in Russian) creates sleek infographics explaining how to make a Molotov cocktail—described as the best way to disable the car of a Putin sympathizer—or how to deface the regime’s propaganda posters.

This material is regularly shared by Ponomarev's Rospartizan, which has become a central conduit for guerrilla efforts to rally new recruits, spread information and news, and, purportedly, to facilitate the assassination of a high-profile regime collaborator. In an interview with Russian independent media Meduza, Ponomarev claimed to have known in advance that “something was going to happen” ahead of Dugina’s assassination. He further claimed that he helped the National Republican Army exfiltrate Natalya Volk, the woman whom Russian security services named as the main suspect in her death: “Sometimes people need to be saved from FSB persecution, they need to be pulled out of Russia—we pull them out.”

Telegram did not respond to WIRED's request for comment.

While unconfirmed, the number of acts of sabotage targeting military and state infrastructure in Russia appears to grow weekly. According to Russian independent media Insider, there have been more than 20 attacks on military registration and enlistment offices in Russia (which were reported by the media and Telegram channels), most of which were arson. “There were no similar incidents last year,” notes Insider journalist Alisa Zemlyanskaya, writing under a pseudonym. Meanwhile, an estimated 63 freight trains derailed in Russia between March and June, a significant increase compared to the same period last year.

Russian authorities, eager to downplay the significance of the apparent sabotage efforts, have blamed those incidents on the poor condition of the railway system. The scale of guerrilla attacks on Russian entities remains, therefore, difficult to assess.

“When it comes to railway sabotage especially, it's difficult, or even impossible, to tell if it’s sabotage, or if it’s an accident due to a technical problem, or to the incompetence of the authorities,” says Popkov.

According to the BO-AK—whose members signed the sabotaged section of rail in Kirzach with the name of their group and the link to its Telegram channel—“that’s because many guerrilla groups do not leave any message or position themselves in the media in any way.”

“In any case, every week there are several reports of railway sabotage, the destruction of power lines, and other acts of resistance,” says the group. “This suggests that the guerrilla movement is not a mass movement, but a fairly large-scale one.”

Russian security services are quick to blame infiltrated Ukrainian saboteurs for these attacks. Regardless of who’s behind them, acts of sabotage continue unabated: On August 17, yet another freight train derailed near Mogilev, in Belarus, while last Wednesday, a man threw two Molotov cocktails at the regional administration building in Oryol, in western Russia.

Fire-bombing a car or derailing a Russian train can, of course, carry significant penalties. But even less extreme activities are dangerous, especially in light of a slew of new repressive Russian laws. In July, lawmakers updated Russia’s Criminal Code to crack down on working with “foreign states and organizations,” public activities “directed against the security of the state,” and the production and public display of “Nazi paraphernalia or symbols.” Because Putin has repeatedly claimed, baselessly, that Ukraine was run by a clique of drug addicts and Nazis and cited “denazification” as one of the primary motivators of his invasion, this last amendment could potentially land an antiwar protestor waving a Ukrainian flag in prison.

According to Russian independent media OVD-Info, authorities in Russia detained some 16,500 people between February and July for having taken part in protests or actions against the war.

Activists and dissidents both in Russia and abroad expose themselves to retaliation from Putin’s regime—a fact that they are acutely aware of. “I'm a reasonable person, I don’t think I'm invulnerable or immortal,” Ponomarev says. “So I do understand that there are issues with security and everything. But I have done a lot of effort to protect myself and the place where I live, as well as the way I move across the city.” Those concerns have been heightened following Dugina’s assassination and Ponomarev’s subsequent declarations. On August 21, a member of the Russian government proposed a contest for the best video or photo of the dissident politician “crawling on broken legs and apologizing while spitting his teeth.”

“I’m not going to pretend that I am not scared at all,” says February Morning’s Lesnoy after his last interview of the day had ended. “But I live in Ukraine, where Putin is waging war. Everybody here is at risk.”

When asked about their motivation for joining the resistance and potentially exposing themselves to repression, an anonymous contributor to Rospartizan summed it up simply: “Let us use the platitude, ‘who else if not us?’”

The Telegram-Powered News Outlet Waging Guerrilla War on Russia

Plus: An Iranian hacking tool steals inboxes, LastPass gets hacked, and a deepfake scammer targets the crypto world.

This week, former Twitter chief security officer Peiter “Mudge” Zatko filed an explosive whistleblower complaint against the company. The allegations, which Twitter contests, claim the social media firm has multiple security flaws that it hasn’t taken seriously. Zatko alleges Twitter put an Indian government agent on its payroll and failed to patch servers and company laptops. Among the claims, however, one stands out: the suggestion that Twitter engineers could access live software and had virtually untracked access to its system.

In a privacy win for students across the US, an Ohio judge has ruled that it is unconstitutional to scan students’ homes while they are taking remote tests. We also detailed the privacy flaw that is threatening US democracy—a lack of federal privacy protections means mass surveillance systems could be used against citizens in new ways.

Elsewhere, as Russia’s full-scale invasion of Ukraine passes six months, military forces are increasingly turning to open source data to back their efforts. Police in India are using facial recognition with very low accuracy rates—the technology is being widely used in Delhi but could be throwing up plenty of false positives. And we dived deeply (perhaps too deeply) into how four high school students hacked 500 of their schools’ cameras, across six locations, and rickrolled thousands of students and teachers. It’s one elaborate graduation prank.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Since Russia-backed trolls flooded Facebook and Twitter with disinformation around the 2016 US elections, the social media firms have improved their ability to bust disinformation networks. The companies frequently take down propaganda accounts linked to authoritarian states, such as Iran, Russia, and China. But it’s rare that Western disinformation efforts are discovered and exposed. This week, the Stanford Internet Observatory and social media analysis firm Graphika detailed a five-year operation that was pushing pro-Western narratives. (The research follows Twitter, Facebook, and Instagram as they remove a series of accounts from their platforms for “coordinated inauthentic behavior.”)

The propaganda accounts used memes, fake news websites, online petitions, and various hashtags in an attempt to push pro-Western views and were linked to both overt and covert influence operations. The accounts, some of which appear to use AI-generated profile pictures, targeted internet users in Russia, China, and Iran, among other countries. The researchers say the accounts “heavily criticized” Russia following its full-scale invasion of Ukraine in February and also “promoted anti-extremism messaging.” Twitter said the activity it saw is likely to have originated in the US and the UK, while Meta said it was the US.

Many of the techniques used by the online influence operation appear to mimic those the Russia-backed accounts used in the buildup to the 2016 elections. It’s likely, however, that the Western influence operations weren’t that successful. “The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19 percent of the covert assets we identified had more than 1,000 followers,” the researchers say.

In recent years, Charming Kitten, a hacking group linked to Iran, has been known for its “aggressive, targeted phishing campaigns.” These phishing efforts aim to gather the usernames and passwords of people’s online accounts. This week, Google’s Threat Analysis Group (TAG) detailed a new hacking tool Charming Kitten is using that’s capable of downloading people’s entire email inboxes. Dubbed Hyperscrape, the tool can steal people’s details from Gmail, Yahoo, and Microsoft Outlook. “The attacker runs Hyperscrape on their own machine to download victims’ inboxes using previously acquired credentials,” TAG says in a blog post. The tool can also open new emails, download their contents, and then mark them as unread, so as not to raise suspicions. So far, Google says it has seen the tool used against fewer than two dozen accounts belonging to people based in Iran.

Password management company LastPass says it has been hacked. “Two weeks ago, we detected some unusual activity within portions of the LastPass development environment,” the company wrote in a statement this week. LastPass says an “unauthorized party” was able to gain access to its development environment through a compromised developer account. While the hacker (or hackers) were within LastPass’s systems, they took some of its source code and “proprietary LastPass technical information,” the company says in its statement. It has not detailed which elements of its source code were taken, making it difficult to assess the seriousness of the breach. However, the company does say that customer passwords and data have not been accessed—there’s nothing LastPass users need to do in response to the hack. Despite this, the indictment is still likely to be a headache for the LastPass technical teams. (It’s not the first time LastPass has been targeted by hackers either.)

The chief communications officer of crypto exchange Binance claims scammers created a deepfake version of him and tricked people into attending business meetings on Zoom calls with his fake. In a blog post on the company’s website, Binance’s Patrick Hillmann said that several people had messaged him for his time. “It turns out that a sophisticated hacking team used previous news interviews and TV appearances over the years to create a ‘deepfake’ of me,” Hillmann wrote, adding that the alleged deepfake was “refined enough to fool several highly intelligent crypto community members.” Neither Hillmann nor Binance has posted any images showing the claimed deepfake. Since deepfakes first emerged in 2017, there have been relatively few incidents of faked video or audio scams impersonating people. (The vast majority of deepfakes have been used to create nonconsensual pornographic images). However, recent reports say deepfake scams are on the rise, and in March of last year the FBI warned that it anticipated a rise in malicious deepfakes within the next 12 to 18 months.

Source

Wired