The best end-to-end encrypted messaging app has a host of security features. Here are the ones you should care about.

In times of uncertainty, people rightly often turn to the encrypted messaging app Signal. Whether it’s to protect sensitive conversations amid social unrest or to keep your communications private after the fall of _Roe v. Wade_, Signal represents most people’s best way to communicate safely. And thanks in part to a $50 million infusion in 2018 from Brian Acton, the former WhatsApp CEO and current interim Signal Foundation CEO, the once niche app is more accessible than ever.

Signal’s popularity often spikes in times of strife or when alternatives seem more precarious. In May 2020, as police brutality protests swept US cities, daily Signal downloads nearly tripled from their average, according to analytics company Apptopia. It saw another surge in January 2021 after WhatsApp, which end-to-end encrypts personal chats using the Signal Protocol, botched the messaging around a privacy policy update. Apptopia now estimates Signal has more than 600 million active monthly users. All of those people can take advantage of end-to-end encryption, which means that no one—not the government, their phone company, or Signal itself—can read the contents of messages as they pass between devices.

Signal is not the only messaging app to offer end-to-end encryption; iMessage has it, as do stand-alone apps like Telegram. But Signal stands apart, both for its rich features and the fact that its code has been open source for years, meaning cryptographers have had plenty of opportunities to poke and prod it for flaws.

WIRED has long encouraged readers to adopt Signal. Here, we’re offering tips on how to get the most out of it once you do.

_Updated August 2022: Signal has added a few new features since we first ran this story, which are now reflected below._

Know Its Limits

For those who are new to encrypted messaging, the most important thing to remember is that it’s not magic. Having Signal on your phone does not make you invincible. Nearly 2,000 users found that out the hard way this month. Signal uses communications firm Twilio to verify users’ phone numbers and send out device registration codes via SMS messages. So when attackers successfully breached Twilio through a recent phishing campaign, they were able to access those SMS codes for some 1,900 Signal accounts and potentially register a victim’s phone number with their own device.

Signal says all affected users “can rest assured that their message history, contact lists, profile information, whom they’d blocked, and other personal data remain private and secure and were not affected.” But the attackers were able to take over at least one account and pose as that person on Signal. It’s a potent reminder that even an app that’s designed around security can have weak spots.

Most importantly, remember that if you’re messaging with someone who doesn’t have Signal installed, nothing’s encrypted. It only works for Signal-to-Signal communications. And make sure you have a strong password on your phone in the first place, since anyone who has physical access to your device can still read your messages.

Signal also has a desktop app, which should be plenty secure for the vast majority of people; just be aware that desktop environments face a litany of threats. And using Signal on multiple devices means more places your messages can be compromised or stolen.

Get Set Up Safely

When you join, Signal requires you to provide a phone number that essentially serves as your user name. This doesn’t mean you have to use your actual phone number, though. To avoid giving it up, use a Google Voice number instead.

To do so, head to Google Voice in your browser, log in with a Google account, and select a new phone number. Google will ask you to verify it by providing your actual phone number, where it’ll send a code that will let you complete your registration. You can now use that Google Voice number for your Signal account, keeping it separate from your main line. (Heads up: If you don't place a call or receive a single text to your Google Voice number every six months, Google will reclaim that number. If that happens, you can get it back within 45 days. So make sure to shoot your Google Voice number a text at least once every few months.)

You should feel comfortable letting Signal access your device’s contacts; it stores that information on your phone, not in the cloud. The app does periodically send truncated, hashed phone numbers back to Signal’s servers, which is how it checks if any of your contacts are also using it, but the company also says it discards that information “immediately.” That way, the app can alert you when one of your contacts signs up for Signal; if you’d rather not get those updates, tap **Settings**, then **Notifications**, and toggle off **Contact Joined Signal**.

(Note: Android users can access Signal’s **Settings** menu either by tapping their profile icon or selecting the menu under the three dots in the upper-right corner, then tapping **Settings**. iOS users will need to tap their profile icon and then Settings to access the full menu.)

On Android, you can make Signal your default messaging app by going to **Settings** > **Apps & notifications** > **Advanced** > **Default Apps** > **SMS app**, and picking **Signal**. Just remember that not everyone you text has it installed and that an iOS user you’re texting with might check their Signal app less often than they do iMessage. (iOS still doesn’t let you change the default messaging app, sorry!)

One of the most critical settings to enable is profile PINs, which will make it easier for you to keep your account data even when you transfer devices and to protect your contact lists, profile information, settings, and more. You can set one up when you join or head to **Privacy** > **Signal PIN** in your app settings to set or change yours anytime. The introduction of PINs was controversial among cryptography hard-liners, who questioned whether the so-called Secure Value Recovery they were tied to introduced potential vulnerabilities. It didn’t help that Signal had at first made the PINs mandatory. You can opt out now by going to the **Create PIN** screen and tapping **Select more**, then **Disable PIN**. Just remember that if you do so, you won’t be able to bring your contacts with you to a new device, and sensitive account information may be more vulnerable.

Lastly, once you have your PIN set up, enable **Registration Lock** by going to **Settings** > **Account** and toggling on **Registration Lock**. With this feature enabled, attackers won’t be able to take over your account and register it to a new device in the way they did through the Twilio hack mentioned above.

Protect Your Screen

It’s important to make sure that what happens in Signal stays in Signal. This means keeping people from seeing what you’re doing there from a lock screen or when switching apps. There’s not much point in having an app for sensitive messages if they just pop up on your display whenever you receive one.

To turn off Signal lock screen notifications on iOS, go to your phone’s **Settings** > **Notifications**, then scroll down and tap **Signal** > **Show Previews** > **Never**. On Android, the process is similar. From your home screen, head to **Settings**, then **Apps & Notifications**, where you can turn off all notifications. If you need more granular control, you can find that in the Signal app itself, where the steps are the same no matter what platform you’re on. Tap your profile, then **Notifications**, then **Show**, where you can choose whether to display the name, content, and actions for an incoming text; just the name; or nothing at all. You can also mute notifications for a specific conversation for a set amount of time by tapping on a message thread, then the contact header, and then **Mute**. You can silence a contact’s notifications for an hour, a day, a week, or a year.

If you’re on Android and want to enable Signal notifications, you may want to disable smart replies by going to **Settings** > **Apps & Notifications** > **Notifications** > **Advanced** and making sure “**Suggested actions and replies**” are turned off. Google says it keeps smart replies private by processing them locally on your device, but the safest bet is to limit Signal’s interactions with the rest of the operating system.

Signal also has a Screen Lock feature that requires your password—or FaceID or TouchID, whatever you use to get into your phone—to view the app’s contents. Within the Signal app on either platform, tap your profile, then **Privacy**, then toggle the **Screen Lock** option to on. Android gives you a little more granularity, with a **Screen Lock Inactivity Timeout** option that lets you set the feature to kick in after a certain amount of time. 

You’ll also want to enable **Screen Security**, which keeps Signal contents from showing up in your app switcher. On Android, select your profile, then **Privacy**, and switch on **Screen Security**. If you use iOS, go to your profile, tap **Settings** > **Privacy**, and enable **Hide Screen in App Switcher**.

Make Messages Disappear

While you can always delete messages manually along the way, that action only applies to your own phone. The people you’re chatting with still have it on their devices. To ensure that the conversation is deleted on both ends of a thread, you should embrace “disappearing messages” instead.

Signal now allows you to enable disappearing messages on all new chats by default, which we highly recommend. Go to **Settings** > **Privacy** > **Default Timer for New Chats**, and select the length of time you want your messages to disappear by default. You can choose preset options ranging from 30 seconds to four weeks, or set whatever custom time you like. Note that enabling this setting only applies to new chats and won’t override the settings for chats you were in before turning it on.

You can also tweak your disappearing message settings for individual chats. From within a chat, tap on the name of your contact. Toggle over **Disappearing Messages** and set the amount of time you want them to be live before they vanish. A timer icon will show up in your thread; either of you can change the disappearing time by tapping on it and adjusting it as needed. That’s also how you can disable disappearing messages altogether within a particular chat.

It’s a handy feature, but a quick reminder that people can still screenshot your conversations to keep a record, so don’t assume they’re gone forever—especially if you don’t trust whoever’s on the other end of the line.

Place an Encrypted Call

Signal’s not just for messages; you can make end-to-end encrypted voice and video calls from the app as well. To do so, just tap the pencil icon within the app like you would to start a chat. Pick a contact, then select either the video icon or phone icon, depending on which type of call you’d like to make.

Signal also now allows group video calls. If you already have a group created, tap on the chat, then select the video icon. If you want to create a new group, select the **pencil icon** > **New Group**, select the contacts you’d like to include, and tap **Next**. Give your group a name, and hit **Create**. Then tap the video icon.

An important note here: If you do make calls from Signal on iOS, make sure to first head to **Privacy** within the app and toggle off **Show Calls in Recents**. Otherwise, your Signal call history will sync with iCloud, creating an unnecessary record of your conversation. And if you’re extra cautious, go to **Settings** > **Privacy** and toggle on **Always Relay Calls**; that’ll route your calls through Signal’s servers and hide your IP address in the process.

Send Photos and Videos

As with other messaging apps, you can use Signal to send photos and videos—with a privacy-friendly media feature that sets it apart.

First things first: If you take a photo from within Signal—just tap the camera icon either from your contact list or within a chat—it doesn’t automatically save to your camera roll, which means it doesn’t get backed up to your cloud photo library. That’s good! The fewer ways you can accidentally leave a trail, the better. If you want to keep an image for posterity, you can tap the save icon in the upper right corner. Otherwise, just send it and move on.

You can also make sure that your photo and video don’t stay on the recipient’s device long. Before you hit send, note the infinity icon next to the chat bubble. That means the media you’re about to share can be viewed indefinitely. Tap it once, though, and it’ll switch to a **1x**, meaning that the photo or video will disappear from the conversation as soon as it’s been viewed. A record will remain in the thread that media was shared, but the image itself will no longer be visible.

Extra Measures

This list is not 100 percent comprehensive. Some features are too minor to mention; others are intended for niche use cases. But there are a few other stray tips that might be helpful to know as you get used to using Signal.

**Read Receipts:** Some people feel strongly about these! If you’re one of them, head to **Settings** > **Privacy** and toggle them off when you’re in the app.

**Stickers:** As part of its long-term quest to find broad appeal, Signal recently added a limited selection of stickers to liven up your secret chats. (Incorporating them required some tricky encryption itself.) Just tap the sticker icon in the chat compose window to peruse your options.

**Emoji Reactions:** Similarly, Signal finally expanded its emoji reaction options in June 2020. From seven basic choices, the app broadened the palette to a full range of faces, animals, foods, buildings, and yes, smiling poop. To add a reaction, just hold down on the response, then tap the three horizontal dots to access the full keyboard.

**Block Party:** Block! Block! Block! Block! To shut down unwanted conversations, either tap on the user’s name from within a chat and toggle over **Block This User**, or strike preemptively by tapping your profile icon, then **Privacy** > **Blocked** > **Add Blocked User**, and then the party you don’t want to hear from.

**Message Requests:** As of August 2020, you can also approve or block other Signal users when they first reach out to you, without their knowing that you’ve seen their incoming message or call. If you do block someone, they won’t get any indication other than remaining in limbo. And the feature also blocks strangers from adding you to group chats, a popular spammer tactic. It’s similar to what you’ve likely already experienced in Facebook Messenger or Twitter direct messages and will be increasingly useful as Signal’s user base expands.

**Private Type:** On Android, third-party keyboard apps can retain a record of what you type and swipe; not ideal when you’re trying to send private messages. Under **Privacy**, go ahead and toggle on **Incognito Keyboard** to keep them in the dark.

**Change your number:** If you get a new phone number or want to change the number you use with your Signal account, the app now allows you to do so without losing everything. The feature doesn’t work in all situations or with every version of the app or operating system, so check the details here.

That should be enough to get you started! Just remember, as you get used to the advanced settings and figure out what combination of disappearing messages and screen locking works for you, that you’ve already taken the most important step of all: downloading Signal in the first place.

How to Use Signal Encrypted Messaging

The Freedom of Information Act helps Americans learn what the government is up to. The Poseys exploited it—and became unlikely defenders of transparency.

The Family That Mined the Pentagon's Data for Profit

Google’s new mobile operating system has arrived. Take back some control with these privacy and security tips.

It's late summer in the northern hemisphere, which means new phone operating systems are coming. In a few weeks, Apple will release iOS 16 to millions of iPhones and iPads around the world. Google, meanwhile, has already made the latest version of Android available—on some phones you can now download Android 13.

The newest version of the Android operating system is more “evolution than revolution,” with the majority of changes smaller than in previous iterations. But Android’s security team is trying to simplify people’s privacy options throughout Android 13. This version of the OS involves changes under the hood for app developers and some streamlined security options for users.

You probably don’t spend a lot of time thinking about the privacy and security settings on your phone. However, whenever you download a new operating system, it’s worth spending a few minutes scrolling and tapping through all the options you haven’t touched in the past 12 months. Here’s what you should take a look at on Android 13.

Clamp Down on App Permissions

In Android 12, Google introduced “nearby device” permissions. This was designed to stop your headphones app from requesting your precise location when it was trying to wirelessly connect to your headphones. Android 13 expands on these controls to stop apps from using Wi-Fi permissions to collect your location data. In their code, app developers have to specify that they will never use Wi-Fi APIs to access location information.

Android’s **Privacy dashboard** has also been updated. The dashboard, which can be accessed through **Settings >** **Privacy**, shows the permissions you have given apps to use—this includes the apps that can access your camera, contacts, and multiple other sensors and types of data. It will now show which apps have used each permission over the past seven days, rather than just 24 hours.

Some of the privacy changes in Android 13 don’t require you to do anything, but it is worth knowing about them anyway. For instance, the OS will start deleting your clipboard history automatically after a short period of time so that apps don’t snoop on the information you previously copied. Also, from now on, apps that use Google’s advertising ID, which is a unique code assigned to your device, must declare the ad ID permission in their documentation. “If your app does not declare this permission when targeting Android 13 or higher, the advertising ID is automatically removed and replaced with a string of zeroes,” Google says.

Photo Picker

When you want to use a photo you’ve taken in another app—for instance, as a Twitter profile photo or to share images with friends—your device uses Photo Picker. This loads up a screen that includes the photos on your device and gives you the option to use them in the app you’re in. The new privacy changes in Android 13 mean you won’t automatically give an app access to all your photos and videos. Instead, the photo picker will now only give the app access to the photos you allow it.

In addition, Android’s developer pages state that if apps want to use images, audio, or video that other apps have created, they must explicitly say the type of files they want access to and give you clear prompts that this will happen.

More Notification Control

Few things are more infuriating than apps that send a constant barrage of notifications. And there are some notifications you may not want appearing on your screen for anyone nearby to see. While it has been possible to control app notifications for some time, Android 13 is making it easier to do so from the outset. Now, when you open up an app for the first time or use it for the first time in a while, you’ll be asked if you want it to send you notifications. Spammy notifications, be gone.

Other Security and Privacy Options

While you’re thinking about your phone’s privacy settings, it’s worth taking some time to flick through your device’s other options to boost your overall protection. It’s possible there are previous changes that you’ve missed. The vast majority of the settings below can be changed by visiting **Settings** on your Android and then following the specific options.

In the **Security** section, Android provides you with an overview of your device’s status. It will show you when the last security update was applied, let you set a screen lock and fingerprint or biometric unlocking (if your device supports them), and let you go through Google’s wider security checkup that looks at the current state of your accounts. (Later this year, Android will introduce a new **Security & privacy** option that will put all of these settings in one place.)

In the **Privacy** menu, there are a few things you should change. The **Privacy dashboard**, as described above, will show you which apps have used which sensors and data on your phone in the past seven days. After looking at this, you should tap on **Permission manager**, where you’ll be presented with all the sensors and types of data that your phone can give to apps. These range from your location and camera access to your calendar and files. You should look through each of the permissions and decide if an app really needs access to them to function.

Next in **Privacy**, you should open **Google location history** and **Activity controls**. Both of these options are linked to your wider Google account(s), but the settings here allow you to control what data Google keeps about you—it’s a lot. Using these options, you can wipe your web and activity data, the locations Google keeps on your movements, and details such as YouTube search history.

Then head to **Privacy** and **Ads**. Here you can use **Reset advertising ID** to change the ID Google has assigned to your phone. This advertising ID is used by apps and advertisers across the web to track your interests and show you potentially creepy personalized advertising. As well as resetting your ad ID, there’s an option to **Delete advertising ID**, meaning “apps can no longer use this advertising ID to show you personalized ads.”

Finally, while you’re thinking about your digital privacy and security, you should make sure you are using a password manager to protect your online life and using multi-factor authentication wherever possible.

The Android 13 Privacy Settings You Should Update Now

Keep private photos, videos, and documents away from prying eyes.

The lock screen on your smartphone is an essential barrier to anyone looking to gain access to the device: It stops people from getting at your data, your social media accounts, your banking apps, and everything else.

However, you may well want to add a second barrier to entry for anyone who gets past your lock screen—whether it’s friends or relatives who have borrowed your phone, or someone more sinister who’s managed to work out how to bypass the lock screen.

In those situations, a secure folder can protect your most important files—such as photos or documents—from prying eyes, requiring another authentication method such as a PIN code or a recognized fingerprint before it will open up.

There are options built into Android and iOS, as well as third-party apps you can turn to if you want to set up a secure folder of some sort on your smartphone.

If You’re Using an Android Phone

The good news if you’re using a midrange or premium Samsung Galaxy handset is that there’s a Secure Folder feature built in. To enable it, go to Settings and choose **Biometrics and Security**, then **Secure Folder**: You’ll be prompted to create a Samsung account or sign into an existing one, and then you’ll be able to choose your lock method. You can protect the folder with a pattern, PIN, password, or fingerprint scan.

The Secure Folder appears on the home screen by default, though you can hide it through the same **Secure Folder** menu in Settings—no one else will be able to get into that folder without the login method you’ve specified. When you’re in the Secure Folder, you can add files by tapping the **+** (plus) button.

Samsung makes its own Secure Folder app.

Samsung via David Nield

Another way to get files into your Secure Folder is from the apps they're already in. In the Samsung Gallery app, for example, you can select one or more images, tap the **More** button in the lower right corner, then pick **Move to Secure Folder**. If you need to delete your Secure Folder, go back to the **Secure Folder** menu in Settings.

Other options on Android are available, but the best one depends on what you want to protect. If you want to lock away sensitive photos and videos in Google Photos, for example, the feature is built right in: From the app, pick **Library**, **Utilities**, then **Get Started** under **Locked Folder**. Follow the instructions, which will involve entering your screen lock code.

Images and videos in the Locked Folder won’t show up in searches or on other screens, and aren’t backed up to the cloud. You can send files straight there from the Google Camera app (gallery icon top right, then **Locked Folder**) or from the photo gallery in Google Photos (select your items, tap **More**, then **Move to Locked Folder**).

Google Photos comes with a Locked Folder feature.

Google via David Nield

If none of those options cover your needs, there are plenty of third-party options available, as you would expect. For example, OneDrive for Android has a Personal Vault space that needs an extra level of authentication to access, though you’ll need to pay Microsoft for some cloud storage space if you want to save more than three files in it.

There’s also the free Norton App Lock, which takes a slightly different approach. It lets you lock away entire apps behind a passcode—not only protecting your files from unwanted access but locking away entire apps. It’s also a handy app to have around if you’re regularly lending your phone to other people and want to control which parts of the device they have access to.

If You’re Using an iPhone

The iPhone doesn’t have any kind of secure-folder functionality integrated into its iOS software, but there is a Hidden folder inside the Photos app that you can move private photos and videos to. Select any item in one of the Photos app galleries, tap on the **Share** button (the arrow pointing out of a square), and choose **Hide** to do just that.

At the time of writing, this isn’t really all that effective a protection method, because anyone can just go to **Albums** and **Hidden** to see what you’ve put there. However, with the arrival of iOS 16 (which we’re expecting in September 2022 or thereabouts), this folder will need to be unlocked with a passcode, Touch ID, or Face ID.

The iOS Notes app works in a similar way to a secure folder.

Apple via David Nield

Another option is to use the Notes app, which lets you lock individual notes with text, images, and videos inside them. First, go to Settings on iOS, then choose **Notes** and **Password** to set a password specifically for the Notes app. Once that’s done, you can lock a note and put it behind the password you’ve configured by opening the note, tapping the three dots at the top, then choosing **Lock**.

Other than that, you’re relying on a third-party app to do the job for you—and you can try OneDrive, as we mentioned in the Android section. The Personal Vault section comes with another layer of security on top, so even if someone gets into the OneDrive app, they won’t be able to access that folder in particular without extra authentication.

Folder Lock is straightforward enough, giving you a sealed-off section of your iPhone that no one else can get inside without the right credentials—you can save notes, videos, images, documents, and audio files, though some of the more advanced features require a $4 upgrade fee.

MaxVault is one of the third-party apps on iOS you can try.

MaxVault via David Nield

Best Secret Folder is perhaps even simpler to use, and gives you a password-protected place to lock away photos and videos that you don’t want anyone else to see. You get a decent number of options for organizing said photos and videos, and you can even check on failed login attempts should you suspect that someone is trying to get at your files without your permission. It’s free to try, with various paid options for removing ads and unlocking additional features.

Lastly, MaxVault is also worth a look. You can keep a wealth of data in your PIN-protected MaxVault folder, including photos, videos, documents, and passwords—and getting items into your folder only takes a couple of taps. There’s even a privacy-focused web browser included that you can make use of, and it also alerts you if someone else tries to get at your data. Some of the features require a premium upgrade, which will cost you $4 a month.

How to Create a Secure Folder on Your Phone

A hacker has formulated an exploit that provides root access to two popular models of the company’s farm equipment.

farmers around the world have turned to tractor hacking so they can bypass the digital locks that manufacturers impose on their vehicles. Like insulin pump “looping” and iPhone jailbreaking, this allows farmers to modify and repair the expensive equipment that’s vital to their work, the way they could with analog tractors. At the DefCon security conference in Las Vegas on Saturday, the hacker known as Sick Codes is presenting a new jailbreak for John Deere & Co. tractors that allows him to take control of multiple models through their touchscreens.

The finding underscores the security implications of the right-to-repair movement. The tractor exploitation that Sick Codes uncovered isn't a remote attack, but the vulnerabilities involved represent fundamental insecurities in the devices that could be exploited by malicious actors or potentially chained with other vulnerabilities. Securing the agriculture industry and food supply chain is crucial, as incidents like the 2021 JBS Meat ransomware attack have shown. At the same time, though, vulnerabilities like the ones that Sick Codes found help farmers do what they need to do with their own equipment.

John Deere did not respond to WIRED's request for comment about the research. 

Sick Codes, an Australian who lives in Asia, presented at DefCon in 2021 about tractor application programming interfaces and operating system bugs. After he made his research public, tractor companies, including John Deere, started fixing some of the flaws. “The right-to-repair side was a little bit opposed to what I was trying to do,” he tells WIRED. “I heard from some farmers; one guy emailed me and was like ‘You’re fucking up all of our stuff!’ So I figured I would put my money where my mouth is and actually prove to farmers that they can root the devices."

This year, Sick Codes says that while he is primarily concerned about world food security and the exposure that comes from vulnerable farming equipment, he also sees important value in letting farmers fully control their own equipment. “Liberate the tractors!” he says.

After years of controversy in the US over the “right to repair” the equipment one purchases, the movement seems to have reached a turning point. The White House issued an executive order last year directing the Federal Trade Commission to increase enforcement efforts over practices like voiding warranties for outside repair. That, combined with New York state passing its own right-to-repair law and creative activist pressure, has generated unprecedented momentum for the movement. 

Facing mounting pressure, John Deere announced in March that it would make more of its repair software available to equipment owners. The company also said at the time that it will release an “enhanced customer solution” next year so customers and mechanics can download and apply official software updates for Deere equipment themselves, rather than having John Deere unilaterally apply the patches remotely or force farmers to bring products to authorized dealerships.

“Farmers prefer the older equipment simply because they want reliability. They don’t want stuff to go wrong at the most important part of the year when they have to pull stuff out of the ground,” Sick Codes says. “So that's what we should all want too. We want farmers to be able to repair their stuff for when things go wrong, and now that means being able to repair or make decisions about the software in their tractors.”

To develop his jailbreak, Sick Codes got his hands on numerous generations of John Deere tractor control touchscreen consoles. But ultimately he focused on a few models, including the widely deployed 2630 and 4240 models, for the exploit he is presenting. It took experimentation on a number of touchscreen circuit boards over many months to find bypasses to John Deere's dealer authentication requirements, but eventually Sick Codes was able to game a reboot check to restore the device as if it were being accessed by a certified dealer. 

He found that when the system thought it was in such an environment, it would offer more than 1.5 GB worth of logs that were meant to help authorized service providers diagnose problems. The logs also revealed the path to another potential timing attack that might grant deeper access. Sick Codes soldered controllers directly onto the circuit board and eventually got his attack to bypass the system's protections. 

“I launched the attack, and two minutes later a terminal pops up,” Sick Codes says of the program used to access a computer's command-line interface. “I had root access, which is rare in Deere land.”

The approach requires physical access to the circuit board, but Sick Codes says it would be possible to develop a tool based on the vulnerabilities to more easily execute the jailbreak. Mostly he says he is curious to see how John Deere will react. He's unsure how comprehensively the company can patch the flaws without implementing full disk encryption, an addition that would mean a significant system overhaul in new tractor designs and likely wouldn't be deployed in existing equipment.

The first priority? Running custom farm-themed _Doom_ on the tractor, of course.

A New Tractor Jailbreak Rides the Right-to-Repair Wave

The Veterans Affairs’ VistA software has a vulnerability that could let an attacker “masquerade as a doctor,” a security researcher warns.

the U.S. Department of Veterans Affairs runs some interesting technology programs, but it's not known for being a flexible or nimble organization. And when it comes to electronic medical records, the VA has had a slow but high-stakes drama playing out for years. 

The department's records platform, VistA, first instituted in the late 1970s, is lauded as effective, reliable, and even innovative, but decades of underinvestment have eroded the platform. Multiple times throughout the 2010s, the VA has said it will replace VistA (short for Veterans Information Systems and Technology Architecture) with a commercial product, and the latest iteration of this effort is currently ongoing. In the meantime, however, security researchers are finding real security issues in VistA that could affect patient care. They want to disclose them to the VA and get the issues fixed, but they haven't found a way to do it because VistA itself is on death row.

At the DefCon security conference in Las Vegas on Saturday, Zachary Minneker, a security researcher with a background in health care IT, presented findings about a worrying weakness in how VistA encrypts internal credentials. Without an additional layer of network encryption (like TLS, which is now ubiquitous across the web), Minneker found that the home-brewed encryption developed for VistA in the 1990s to protect the connection between the network server and individual computers can be easily defeated. In practice, this could allow an attacker on a hospital's network to impersonate a health care provider within VistA, and possibly modify patient records, submit diagnoses, or even theoretically prescribe medications.

“If you were adjacent on the network without TLS, you could crack passwords, replace packets, make modifications to the database. In the worst-case scenario, you'd essentially be able to masquerade as a doctor,” Minneker tells WIRED. “This is just not a good access control mechanism for an electronic medical record system in the modern era.”

Minneker, who is a security engineer at the software-focused firm Security Innovation, only briefly discussed the findings during his DefCon talk, which was mostly focused on a broader security assessment of VistA and the database programming language MUMPS that underlies it. He has been attempting to share the finding with the VA since January through the department's vulnerability disclosure program and Bugcrowd third-party disclosure option. But VistA is out of scope for both programs. 

This may be because the VA is currently attempting to phase out VistA using a new medical records system designed by Cerner Corporation. In June, the VA announced that it would delay a general rollout of the $10 billion Cerner system until 2023, because pilot deployments have been plagued by outages and have led to almost 150 cases in which patients could potentially have been harmed. 

The VA did not return WIRED's multiple requests for comment about Minneker's findings or the broader situation with disclosing vulnerabilities in VistA. In the meantime, though, VistA is not only deployed across the VA health care system, it is also used elsewhere.

“There are all sorts of problems with the VA, but everybody loves VistA. It's one of the best EMRs in the world. It’s extremely flexible, whereas most EMRs are totally inflexible,” Minneker says. “And there are other hospitals that are running VistA that are not VA-related.”

Minneker did his assessment of VistA using an automated software-testing technique known as fuzzing, as well as manual code review. He was able to assess VistA's source code because the VA regularly posts a “Freedom of Information Act” version that includes all patches released for VistA.

Other researchers have attempted to raise awareness about the importance of securing MUMPS and VistA by investing more in the technology instead of less. At the open source software conference OSCON in 2010, health-care data researcher Fred Trotter argued that VistA shouldn't be written off, given its value.

“One of the things that really frustrates me with criticisms of MUMPS and VistA is, ‘It’s old software,’” Trotter said. “This is confusing to me because it’s not like an old dog. That dog won’t hunt anymore because it’s too old. Well, if software is merely old but still works really well, we have a name for that: It’s ‘stable.’”

The question for Minneker now is whether his presentation will spur public discussion about VistA security and illustrate the need to continue supporting and defending the massive system as long as it is in use.

“VistA is phenomenal, and it could be used more broadly instead of being decommissioned—it’s a beautiful dream,” Minneker says. “I just couldn't in good conscience be quiet about this problem.”

Flaw in the VA Medical Records Platform May Put Patients at Risk

Plus: Cisco gets hit by ransomware, Twilio gets phished, a new way to fight email spammers, and much more.

We’ve also looked at how new data rulings in Europe could stop Meta from sending data from the EU to the US, potentially prompting app blackouts across the continent. However, the decisions also have a wider impact: reforming US surveillance laws.

Also this week, a new phone carrier launched and it has a specific goal: protecting your privacy. The Pretty Good Phone Privacy or PGPP service, by Invisv, separates phone users from the identifiers linked to your device, meaning it can’t track your mobile browsing or link you to a location. The service helps to deal with a huge number of privacy problems. And if you want to enhance your security even more, here’s how to use Apple’s new Lockdown Mode in iOS 16.

But that’s not all. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

The Federal Trade Commission this week announced it has begun the process for writing new rules around data privacy in the United States. In a statement, FTC chair Lina Khan pressed the need for strong privacy rules that rein in the “surveillance economy” that she says is opaque, manipulative, and responsible for “exacerbating … inbalances of power.” Anyone can submit rules for the agency to consider between now and mid-October. And the FTC will hold a public “virtual event” on the issue on September 8.

Communications company Twilio said this week that “sophisticated” attackers successfully waged a phishing campaign that targeted its employees. The attackers sent text messages with malicious links and included words like “Okta,” the identity management platform that itself suffered a hack by the Lapsus$ hacker group earlier this year. Twilio later said that the scheme allowed the attackers to access the data of 125 customers. But the campaign didn’t stop there: Cloudflare later disclosed that it, too, was targeted by the attackers—although they were stopped by the company’s hardware-based multifactor authentication tools. As always, be careful what you click.

Elsewhere, enterprise technology giant Cisco disclosed that it became the victim of a ransomware attack. According to Talos, the company’s cybersecurity division, an attacker compromised an employee’s credentials after gaining access to a personal Google account, where they were able to access credentials synced from the browser. The attacker, identified as part of the Yanluowang ransomware gang, then “conducted a series of sophisticated voice phishing attacks” in an attempt to trick the victim into accepting a multifactor authentication request, which was ultimately successful. Cisco says the attacker was unable to gain access to critical internal systems and was eventually removed. However, the attacker claims to have stolen more than 3,000 files totaling 2.75 GB of data.

Meta’s WhatsApp is the world’s biggest end-to-end encrypted messaging service. While it may not be the best encrypted messenger—you’ll want to use Signal for the most protection—the app prevents billions of texts, photos, and calls from being snooped on. WhatsApp is now introducing some extra features to help improve people’s privacy on its app.

Later this month, you’ll be able to leave a WhatsApp group without notifying every member that you’ve left. (Only the group admins will be alerted). WhatsApp will also allow you to select who can and can’t see your “online” status. And finally, the company is also testing a feature that allows you to block screenshots on photos or videos sent using its “view once” feature, which destroys messages when they’ve been seen. Here are some other ways to boost your privacy on WhatsApp.

And finally, security researcher Troy Hunt is perhaps best known for his Have I Been Pwned website, which allows you to check whether your email address or phone number has been included in any of 622 website data breaches, totaling 11,895,990,533 accounts. (Spoiler: It probably has.) Hunt’s latest project is taking revenge on email spammers. He’s created a system, dubbed Password Purgatory, that encourages spammers emailing him to create an account on his website so they can work together to “truly empower real-time experiences.”

The catch? It’s not possible to meet all the password requirements. Each time a spammer tries to create an account, they’re told to jump through more hoops to create a proper password. For instance: “Password must end with dog” or “Password must not end in ‘!’” One spammer spent 14 minutes trying to create an account, attempting 34 passwords, before finally giving up with: catCatdog1dogPeterdogbobcatdoglisadog.

The Feds Gear Up for a Privacy Crackdown

An injection flaw allowed a researcher to access all files on a Mac. Apple issued a fix, but some machines may still be vulnerable.

Every time you shut down your Mac, a pop-up appears: “Are you sure you want to shut down your computer now?” Nestled under the prompt is another option most of us likely overlook: the choice to reopen the apps and windows you have open now when your machine is turned back on. Researchers have now found a way to exploit a vulnerability in this “saved state” feature—and it can be used to break the key layers of Apple’s security protections.

The vulnerability, which is susceptible to a process injection attack to break macOS security, could allow an attacker to read every file on a Mac or take control of the webcam, says Thijs Alkemade, a security researcher at Netherlands-based cybersecurity firm Computest who found the flaw. “It's basically one vulnerability that could be applied to three different locations,” he says.

After deploying the initial attack against the saved state feature, Alkemade was able to move through other parts of the Apple ecosystem: first escaping the macOS sandbox, which is designed to limit successful hacks to one app, and then bypassing the System Integrity Protection (SIP), a key defense designed to stop authorized code from accessing sensitive files on a Mac.

Alkemade—who is presenting the work at the Black Hat conference in Las Vegas this week—first found the vulnerability in December 2020 and reported the issue to Apple through its bug bounty scheme. He was paid a “pretty nice” reward for the research, he says, although he refuses to detail how much. Since then Apple has issued two updates to fix the flaw, first in April 2021 and again in October 2021.

When asked about the flaw, Apple said it did not have any comment prior to Alkemade’s presentation. The company’s two public updates about the vulnerability are light on detail, but they say the issues could allow malicious apps to leak sensitive user information and escalate privileges for an attacker to move through a system.

Apple’s changes can also be seen in Xcode, the company’s development workspace for app creators, a blog post describing the attack from Alkemade says. The researcher says that while Apple fixed the issue for Macs running the Monterey operating system, which was released in October 2021, the previous versions of macOS are still vulnerable to the attack.

There are multiple steps to successfully launching the attack, but fundamentally they come back to the initial process injection vulnerability. Process injection attacks allow hackers to inject code into a device and run code in a way that’s different to what was originally intended.

The attacks are not uncommon. “It's quite often possible to find the process injection vulnerability in a specific application,” Alkemade says. “But to have one that’s so universally applicable is a very rare find,” he says.

The vulnerability Alkemade found is in a “serialized” object in the saved state system, which saves the apps and windows you have open when you shut down a Mac. This saved state system can also run while a Mac is in use, in a process called App Nap.

When an application is launched, Alkemade says, it reads some files and tries to load them using an insecure version of the “serialized” object. “In all of Apple’s operating systems, these serialized objects are used all over the place, often for inter-process exchange of data,” the researcher writes in the blog post describing the attack. “The way the attack works is that you can create those files at the place another application will load them from,” Alkemade says. Essentially, a malicious “serialized object” is created and can make the system behave in ways it is not supposed to.

From here, Alkemade was able to escape the Mac app sandbox using the vulnerability—this was the first flaw that Apple fixed. By injecting the code into another application, it was possible to extend what the attack could do. Finally, Alkemade was able to bypass the System Integrity Protection that’s supposed to stop unauthorized code from reading or changing sensitive files. “I could basically read all of the files on the disk and also modify certain system files,” he says.

There is no evidence to date that the vulnerability has been exploited in the real world. However, the flaw shows how, in some instances, it may be possible for attackers to move through an entire operating system, increasingly being able to access more data. In the description for his talk, Alkemade says that as local security on macOS moves more toward an iOS model, this highlights that multiple parts of the system need to be reexamined.

A Single Flaw Broke Every Layer of Security in MacOS

The popular video meeting app makes it easy to keep the software up to date—but it also introduced vulnerabilities.

Many of us have been there: You fire up the Zoom app as you rush to join a meeting you’re already late for, and you’re hit with a prompt to download updates. If something like this has happened to you, you’re enrolled in Zoom's automatic update feature. 

Launched in its current form in November 2021 for Zoom’s Windows and Mac desktop apps, the feature aims to help users keep up with software patches. You enter your system password when you initially set up the feature, granting Zoom permission to install patches, then you never have to enter it again. Easy. But after noticing the feature, longtime Mac security researcher Patrick Wardle wondered whether it was a little too easy.

At the DefCon security conference in Las Vegas today, Wardle presented two vulnerabilities he found in the automatic update feature’s validation checks for the updates. For an attacker who already had access to a target Mac, the vulnerabilities could have been chained and exploited to grant the attacker total control of a victim’s machine. Zoom has already released fixes for both vulnerabilities, but onstage on Friday, Wardle announced the discovery of an additional vulnerability, one he hasn’t yet disclosed to Zoom, that reopens the attack vector.

“I was curious about exactly how they were setting this up. And when I took a look, it seemed on first pass that they were doing things securely—they had the right ideas,” Wardle told WIRED ahead of his talk. “But when I looked closer, the quality of the code was more suspect, and it appeared that no one was auditing it deeply enough.”

To automatically install updates after the user enters their password once, Zoom installs a standard macOS helper tool that Wardle says is widely used in development. The company set up the mechanism so only the Zoom application could talk to the helper. This way, no one else could connect and mess with things. The feature was also set up to run a signature check to confirm the integrity of the updates being delivered, and it specifically checked that the software was a new version of Zoom, so hackers couldn’t launch a “downgrade attack” by tricking the app into installing an old and vulnerable version of Zoom.

The first vulnerability Wardle found, though, was in the cryptographic signature check. (It’s a sort of wax-seal check to confirm the integrity and provenance of software.) Wardle knew from past research and his own software development that it can be difficult to truly validate signatures in the types of conditions Zoom had set up. Ultimately, he realized that Zoom’s check could be defeated. Imagine that you carefully sign a legal document and then put the piece of paper facedown on a table next to a birthday card that you signed more casually for your sister. Zoom’s signature check was essentially looking at everything on the table and accepting the random birthday card signature instead of actually checking whether the signature was in the right place on the right document. In other words, Wardle found that he could change the name of the software he was trying to sneak through to contain the markers Zoom was broadly looking for and get the malicious package past Zoom’s signature check.

“All you do is name your package in a certain way, and then you can fully bypass their cryptographic checks,” Wardle says.

In the second vulnerability Wardle found that, while Zoom had created a check to confirm that an update being delivered was a new version, he could get around this if he offered software that had passed the signature check directly to a flaw in how the updater app received software to distribute. Wardle found that using a Zoom tool known as updater.app, which facilitates Zoom’s actual update distribution, he could trick the distributor into accepting an old, vulnerable version of Zoom instead, after which an attacker could exploit old flaws to get full control.

“We have already resolved these security issues,” a Zoom spokesperson told WIRED in a statement. “As always, we recommend users keep up to date with the latest version of Zoom … Zoom also offers automatic updates to help users stay on the latest version.”

During his talk at DefCon, though, Wardle announced another Mac vulnerability he discovered in the installer itself. Zoom now conducts its signature check securely, and the company plugged the downgrade attack opportunity. But Wardle noticed that there is a moment after the installer verifies the software package—but before the package installs it—when an attacker could inject their own malicious software into the Zoom update, retaining all the privileges and checks that the update already has. Under normal circumstances, an attacker would be able to grab this opportunity only when a user is installing a Zoom update anyway, but Wardle found a way to trick Zoom into reinstalling its own current version. The attacker can then have as many opportunities as they want to attempt to insert their malicious code and gain the Zoom automatic update installer’s root access to the victim device.

“The main reason I looked at this is that Zoom is running on my own computer,” Wardle says. “There’s always a potential tradeoff between usability and security, and it’s important for users to install updates for sure. But if it’s opening this broad attack surface that could be exploited, that’s less than ideal.”

To exploit any of these flaws, an attacker would need to already have an initial foothold in a target’s device, so you’re not in imminent danger of having your Zoom remotely attacked. But Wardle’s findings are an important reminder to keep updating—automatically or not.

Zoom’s Auto-Update Feature Came With Hidden Risks on Mac

FBI agents reportedly searched Mar-a-Lago for “nuclear documents.” That can fall into one of these four categories.

Yesterday evening, _the_ _Washington Post_ broke the blockbuster news that FBI agents who searched former President Trump’s Mar-a-Lago residence on Monday were looking for “nuclear documents,” a phrase that immediately set off alarms inside national security circles. The nation’s nuclear systems and plans are considered among the most sensitive and most narrowly known secrets.

Trump denied the report, calling the “nuclear weapons issue” a “hoax.” But assuming the _Post_’s reporting is correct, what could such a vague phrase as “nuclear documents” mean, and what could we learn about such a category?

Broadly speaking, the US intelligence and defense communities would possess four different categories of files that might be considered “nuclear documents”: nuclear weapon science and design; other countries’ nuclear plans, including the nuclear systems and command of allied nations (UK, France) and adversaries (Russia, China, North Korea, Iran), as well as countries whose nuclear programs exist in a more gray zone (Israel, India, Pakistan); details on the United States’ own nuclear weapons and deployments; and details on US nuclear command & control procedures, known in Pentagon parlance as NC2.

Each category of these documents would carry with it some unique classification peculiarities. And all of them exist at the so-called Above Top Secret level, because a simple Top Secret clearance on its own isn’t enough to access the files.

Security classification procedures really began only in the 20th century, and were codified during the Cold War into three standard levels of classification: Confidential, Secret, and Top Secret, each carrying with it increased levels of control, storage, and more intensive background checks.

Under US law, Top Secret is specifically used to denote “national security information or material which requires the highest degree of protection” and information where, if disclosed, “could reasonably be expected to cause exceptionally grave damage” to national security. Day-to-day, almost anything interesting that the US intelligence or military does exists at that “Top Secret” level. Many US intelligence and military personnel will joke that “confidential” and “secret” information is rarely much more interesting or informed than reading the day’s newspapers.

The wide tranche of operations and intelligence that technically counts as Top Secret means that nearly all sensitive positions in the US government—including FBI agents, many military personnel, and most intelligence officers and analysts—come with a Top Secret clearance and background check standard. All told, according to research conducted by _The Washington Post_ in the wake of 9/11, nearly a million Americans possess Top Secret clearances.

We’ve known since February that Donald Trump apparently took numerous documents from the White House, including documents classified at the Top Secret level. But the reporting this week has added two new wrinkles, both of which hint that the stuff hidden in Mar-a-Lago was even more sensitive.

That’s because virtually all the truly interesting secrets inside the US government aren’t just Top Secret, but come with additional levels of security clearance and special “need to know” access that restrict them even more tightly.

Nuclear science and design files, for instance, are uniquely classified as “Restricted Data.” These files are historically accessed through what’s known as a Q Clearance, a special background check and access protocol. (And yes, the Q Clearance is the “Q” in QAnon, a reference to that anonymous figure’s supposed clearance inside the US government.)

The Restricted Data designation was created by the Atomic Energy Act at the dawn of the Cold War and is now run by the Department of Energy, which oversees the nation’s nuclear weapon stockpiles and development. As nuclear historian Alex Wellerstein explained on Twitter today, the goal was to build a classification outside of the defense establishment that would allow scientific knowledge more flexibility than simply military applications.

“TS/RD” files are what’s known as “born classified,” in that, unlike other classified intelligence or scientific work, they are presumed to be highly classified from the moment of their creation. Effectively, rather than opting into classification, nuclear design and science have to opt out.

Meanwhile, NC2 documents—think documents relating to how the presidential nuclear football operates or how nuclear launch procedures would unfold—have historically had their own classification known as Extremely Sensitive Information (ESI), which again requires special access rights.

Some of the reporting around the Mar-a-Lago search, by ABC News’s Jonathan Karl and others, says that the FBI raid also pertained to what are known as Special Access Programs (SAPs), another unique classification category that usually deals with the most sensitive covert operations and technical capabilities of intelligence and defense systems. (The intelligence community has its own equivalent of the military’s SAPs, which are known as CAPs, or Controlled Access Programs.)

SAPs require someone to be “read into” the program specifically—meaning, they need to have a specific “need to know,” and the documents are carefully tracked to see who has read them and where they’re stored. Usually, individuals are “read into” an SAP in what amounts to a mini-ceremony of sorts, one that involves meeting with a specially cleared security officer and signing a specific nondisclosure agreement for that SAP. Over the course of an official’s career, the SAPs that they’re allowed access to are carefully tracked.

Beyond SAPs, which focus on capabilities, there’s another category of classified information known as SCI, “Sensitive Compartmented Information.” This designation is usually used for protecting what intelligence officials call “sources and methods.” Those could include the identity of a highly placed asset in a foreign government, for instance, or how the NSA has managed to technically penetrate a foreign military’s communication networks. According to _Newsweek_’s William Arkin, at least some of the documents sought in the FBI search related to “sources and methods.” And _The Wall Street Journal_ reported this afternoon that a list of items removed from Mar-a-Lago includes “various classified/TS/SCI documents.”

SAPs and SCI are known by their own codenames. For example, the long-standing classification for our satellite reconnaissance was TALENT KEYHOLE, so documents protected by it were labeled “TS/SCI TALENT KEYHOLE.” (FBI Director Christopher Wray, who presumably was part of the team that signed off on this week’s Mar-a-Lago search, was a bit player in the Bush administration showdown over one of the best known and most infamous recent SAPs, STELLAR WIND, an NSA wiretapping program created after 9/11.)

Interestingly, for the purposes of the Mar-a-Lago search, SAPs can also protect nuclear research and development as well as the highly secret and protected presidential and military NC2 communication systems, which are known by their own special clearance, YANKEE WHITE.

There are additional levels of document classification restriction the US government uses to show what can be shared with whom: ORCON, which means Originator Controlled, prohibits information from being shared outside of the department or agency where that document was created; NOFORN prohibits information from being shared with any foreign officials; and REL TO FVEY means that the information can be released to countries and officials that are part of the Five Eyes intelligence alliance along with the US: the UK, Canada, New Zealand, and Australia.

Almost regardless of the specifics, any of these “nuclear” categories—SCI, SAP, ESI, RD—denote and protect the most sensitive documents in the entire US government, and penalties for even an inadvertent security breach can be harsh.

Classified documents—and even just conversations about classified information—are never supposed to leave the special reading and conference rooms designed by the US government, known as SCIFs, or Sensitive Compartmented Information Facilities, which are sealed, windowless, specially built, and shielded to be impenetrable to electronic eavesdropping. (The US government even has special Airstream trailers modified to be portable SCIFs for Defense Department VIPs that travel aboard military cargo planes. And when high-level officials like the president travel, security officials build portable SCIFs inside hotel rooms.)

The Justice Department regularly prosecutes those who mishandle or incorrectly take classified documents out of such secure facilities.

Source

Wired