The State Department organization has called for people to share details about five key members of the hacking group.

Since the Conti ransomware strain emerged in 2020, its operators have caused havoc around the world. They have used it to cripple hospitals, attack governments, and extort countless businesses. These criminal hackers have targeted more than 1,000 organizations, earning over $180 million last year alone. Now, the US government is upping its fight against the group, identifying members of the gang for the first time and aiming to expose their potential ties to the Russian state.

Today, the Rewards for Justice mission, an organization within the US State Department that handles national security rewards, is announcing new bounties of up to $10 million for anyone who provides useful information about individual members of Conti. Specifically, the agency has called for people to share details about five key members of the Conti group: actors using the handles Professor, Reshaev, Tramp, Dandis, and Target.

Rewards for Justice has also published an alleged photo of the person believed to be Target. In the picture, a middle-aged man is wearing a hat with ear flaps, a black T-shirt, and a dark-colored jacket. It is one of the first times that the potential real-world identity of a member of the Conti gang has been publicly exposed.

Illustration: Rewards for Justice/US Department of State

“Today marks the first time that the US government has publicly identified a Conti operative,” says a State Department official who asked not to be named and did not provide any more information about Target’s identity beyond the picture. “That photo is the first time the US government has ever identified a malicious actor associated with Conti,” they say, adding they are looking for information ranging from names of the individuals to their physical locations to their vacation and travel plans. (Many cybercriminals based in Russia will not travel abroad due to fears of arrest.)

The move from the State Department signifies Conti’s uniquely dangerous role in the world of ransomware. Often known as Wizard Spider, or part of the wider Trickbot cybercrime syndicate, the group is run and organized like any small- or medium-sized business. Earlier this year, Conti’s innermost secrets were exposed by a Ukrainian cybersecurity researcher who published 60,000 of its internal messages after Conti backed Vladimir Putin’s full-scale invasion of Ukraine. The leaked information has been dubbed the Conti Files.

Conti and the wider Trickbot group are thought to have more than 100 different members, each working within individual departments. According to their leaked chats, they ask for holiday time off, are paid regularly, and are professional in their approach to extorting victims. The leaks even showed that the group has tried to develop a cryptocurrency payments platform. When Conti attacked the Costa Rican government earlier this year—disrupting more than 30,000 medical appointments—a separate $10 million reward was issued.

The Rewards for Justice program is separate from other rewards programs across the US and focuses on national security issues, such as foreign election interference and North Korean hacking groups. “\[Conti\] is viewed as a national security threat because we believe, and we are seeking more information to confirm, that they are associated with a foreign government,” the state department official says. “They have been involved in malicious cyberactivity against our critical infrastructure. We view them as a national security threat.”

Many members of Conti are believed to be based in Russia or surrounding regions. For years, the Kremlin has largely turned a blind eye to cybercriminals based in the country, making it a home base for several ransomware groups. The leaked Conti Files revealed that some high-level members of the gang appear to have connections to the Russian state and security services. Members of the group have chatted about working on “political” subjects and knowing members of the Russian hacking group Cozy Bear, also known as Advanced Persistent Threat 29.

“Conti has publicly acknowledged its connection with foreign governments, specifically its support of the Russian government,” says US Air Force major Katrina Cheesman, a spokesperson for the Cyber National Mission Force. “Based on its ties to Conti and other indicators, it is assessed that the leadership of the organized crime group known as Wizard Spider likely have a connection to government entities inside of Russia,” Cheesman adds.

Since the Conti Files were leaked in early March, multiple cybersecurity firms have pored over the documents. It is believed that Professor, who is included in the reward program’s call for information and is also involved in Trickbot, oversees much of the ransomware deployment and is a “significant player” in the operation, according to security experts. In other cases, several online monikers used by actors of the Conti group may, in fact, refer to the same person.

Aside from the Conti Files, there have been other leaks from the wider cybercrime syndicate. Earlier this year, a Twitter account called Trickleaks started posting the alleged names and personal details of Trickbot members. The doxxing, which has not been independently verified but is believed to be at least partly accurate, shows photos of alleged members and their social media accounts, passport details, and more.

Jeremy Kennelly, a senior manager in financial crime analysis at cybersecurity firm Mandiant, says that continued action against Conti and Trickbot is “critical” in helping prevent ransomware groups from making money and attacking businesses. “Stripping anonymity from key players, offering bounties, seizing illicit funds, and making public declarations of intent are important actions that may help to increase the real and perceived risks of engaging in ransomware operations and may ultimately lead to a chilling effect among some criminal actors and/or organizations,” Kennelly says.

The Rewards for Justice officials say that they will be publishing their call for information about the Conti members in multiple languages and urge people to get in touch via a Tor link. All of the tips they receive will be verified, and any lead must pass multiple steps before a payment is made. They say it is theoretically possible that multiple $10 million rewards could be issued. The officials are specifically targeting Russian-language online spaces, saying the reward details will be posted to Russian social network VK and also hacking forums.

In recent weeks, Conti’s activities have dwindled, as it is believed the group is attempting to rebrand following the leak of its internal chats. However, many of the members are still thought to be active and involved in other cybercrime efforts. These kinds of ransomware attacks can have a huge impact on businesses and wider society.

“While these are not state-sponsored groups, they routinely carry out attacks as impactful as any nation-state group, and they need to be treated as such,” says Allan Liska, an analyst for the security firm Recorded Future who specializes in ransomware. “This likely won’t lead to the arrest of members of Conti, unless any of them are dumb enough to step foot outside of Russia. The intelligence that might be gathered through this reward could prove to be invaluable.”

The US Offers a $10M Bounty for Intel on Conti Ransomware Gang

The Zero Day Initiative has found a concerning uptick in security updates that fail to fix vulnerabilities.

The whole purpose of vulnerability disclosure is to notify software developers about flaws in their code so they can create fixes, or patches, and improve the security of their products. But after 17 years and more than 10,000 vulnerability disclosures, the Zero Day Initiative is calling out a “disturbing trend” at the Black Hat security conference in Las Vegas today and announcing a plan to apply some counterpressure.

ZDI, which has been owned by the security firm Trend Micro since 2015, is a program that buys vulnerability findings from researchers and handles disclosure to vendors. In exchange, Trend Micro, which makes an antivirus tool and other defense products, gets a wealth of information and telemetry that it can use to track research and hopefully protect its customers. The group estimates that it has handled roughly 1,700 disclosures so far this year. But ZDI says that from its bird’s eye view, the quality of vendor patches overall has been slipping in recent years. 

More and more often, the group buys a bug from a researcher, it gets patched, and soon afterward ZDI is buying another report about how to bypass the patch, sometimes with multiple rounds of patching and circumvention. ZDI also says it has noticed a worrying trend of companies disclosing less specific information about vulnerabilities in their public security alerts, making it more difficult for users around the world to assess how serious a vulnerability is and formulate patch prioritization—a real concern for big institutions and critical infrastructure.

 “Over the last few years, we’ve really noticed that the quality of security patches has noticeably declined,” says ZDI member Dustin Childs. “There’s no accountability for having incomplete or faulty patches.”

ZDI researchers say that bad patches happen for a variety of reasons. Figuring out how to fix software flaws can be a nuanced and delicate process, and sometimes companies lack the expertise or haven’t made the investment to generate elegant solutions to these important problems. Organizations may be rushing to close bug reports and clear their slate and may not take the time needed to conduct “root cause” or “variant" analysis and assess underlying issues so deeper problems can be comprehensively fixed.

Regardless of the reason, bad patches are a real concern. At the end of June, Google’s Project Zero bug-hunting team reported that of the novel vulnerabilities being exploited in the wild it has tracked so far in 2022, at least half are variants of previously patched flaws.

“A combination of things over time has led us to believe that we actually have a more serious problem than most people understand,” says Brian Gorenc, who runs ZDI. 

Like other organizations heavily involved in disclosure, including Project Zero, ZDI gives developers a deadline for how long they have to issue a patch before details about the vulnerability in question get published publicly. ZDI’s standard deadline is 120 days from disclosure. But in reaction to the epidemic of bad patches, today the group is announcing a new set of deadlines for bugs that have been previously patched. 

Depending on the severity of the flaw, how easy it is to bypass the patch, and how likely ZDI thinks it is that the vulnerability will be exploited by attackers, the group will now set deadlines of 30 days for critical flaws, 60 days for bugs where the existing patch provides some protection, and 90 days for all other cases. The move follows a tradition of using public disclosure as an important point of leverage—one of the few that security proponents have—to spur necessary improvements in how developers handle high-stakes software flaws that potentially impact users around the world.

“The weaponization of failed patches in various vulnerabilities is absolutely being used in the wild right now,” ZDI’s Childs says. “It’s a real problem that has real consequences to the user, and we’re trying to incentivize vendors to get it right the first time.”

Sloppy Software Patches Are a ‘Disturbing Trend’

The company says an expansion of privacy features in Messenger is unrelated to a high-profile Nebraska abortion case.

A Nebraska woman and her 17-year-old daughter are facing felony and misdemeanor charges related to allegedly performing an abortion after 20 weeks, which has long been illegal in the state, and concealing a body. Reports from _The Lincoln Journal Star_ and _Motherboard_ revealed this week that law enforcement collected evidence for the charges in part by soliciting data from Meta with a warrant that ordered the company to hand over records from the 17-year-old's Messenger chat histories. While Meta was complying with a lawful court order, the company would not have been able to produce the chats had the participants been using end-to-end encryption, a feature Meta has long promised to turn on for all users by default.

Meanwhile, in a move that Meta says is totally unrelated, the social media giant announced this morning that it is testing expansions of end-to-end encrypted messaging on Messenger.

The company has been promising full-scale default deployment of the privacy feature since 2016. CEO Mark Zuckerberg even committed in 2019 to implement end-to-end encryption across all of its chat apps. But the company has faced technical and political challenges that have delayed the full rollout year after year, forcing Meta to fall back on gradual, incremental steps instead. The social giant currently says that it is driving toward a “global rollout of default end-to-end encryption for personal messages and calls in 2023."

For now, though, the company continued the slow march today, saying that it is testing a group of new encryption-related features and initiatives. This week, Meta will expand the number of chats between certain people that automatically have end-to-end encryption turned on. This means those users won't have to opt-in to enable the protection. Similarly, the company says that it will “soon” broaden the number of users who can opt into end-to-end encryption on Instagram Direct Messenger. 

Beginning this week, Meta is also testing a “secure storage” feature for end-to-end encrypted chats, so users can back up their messages in case they lose a device or get a new one and want to restore their chat history. The company says this secure backup feature will be the default for end-to-end encrypted chats on Messenger with the option to lock the backups with a PIN or a generated code. Users will also be able to opt-out of the backups and turn the feature off.

When asked directly whether the timing of the announcement was related to revelations about the Nebraska case, Meta spokesperson Alex Dziedzan told WIRED, “This is not a response to any law enforcement requests.” He added, “We've had this date in the diary for months, but the short notice is because Messenger product teams have been finalizing the tests that are going live. These tests will start \[Thursday\]. We want people to hear about these tests from us before they see changes in the app.”

Dziedzan also cited a talk Meta engineers are giving at the Crypto academic cryptography conference in Santa Barbara this weekend as a reason for the timing.  

Meta said in a statement on Tuesday that it received warrants related to the Nebraska case on June 7, before the United States Supreme Court released its decision in the _Dobbs v. Jackson_ reproductive rights case. The company added that the warrants it received did not mention abortion and that they came with non-disclosure orders that have since been lifted.

For privacy advocates, though, the Nebraska case clearly illustrates the value and the stakes of deploying default end-to-end encryption.

“Having end-to-end encrypted communications by default has never been more important,” says Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory. “Making it work for billions of people across multiple services is a daunting challenge, and Meta has to proceed carefully to make sure they get it right. But from the war in Ukraine to a teenage girl in Nebraska who needed abortion care, we’ve seen how strong encryption—or the lack thereof—can make a huge difference in the lives of real people.”

Meta Just Happens to Expand Messenger's End-to-End Encryption

The Raspberry Pi-powered device can scan for phones around you. If it keeps spotting the same one, it’ll send you an alert.

Matt Edmondson, a federal agent with the Department of Homeland Security for the last 21 years, got a call for help last year. A friend working in another part of government—he won’t say which one—was worried that someone might have been tailing them when they were meeting a confidential informant who had links to a terrorist organization. If they were being followed, their source’s cover may have been blown. “It was literally a matter of life and death,” Edmondson says.

“If you’re trying to tell whether you’re being followed, there are surveillance detection routes,” Edmondson says. If you’re driving, you can change lanes on a freeway, perform a U-turn, or change your route. Each can help determine whether a car is following you. But it didn’t feel like enough, Edmondson says. “He had those skills, but he was just looking for an electronic supplement,” Edmondson explains. “He was worried about the safety of the confidential informant.”

After not finding any existing tools that could help, Edmondson, a hacker and digital forensics expert, decided to build his own anti-tracking tool. The Raspberry Pi-powered system, which can be carried around or sit in a car, scans for nearby devices and alerts you if the same phone is detected multiple times within the past 20 minutes. In theory it can alert you if a car is tailing you. Edmondson built the system using parts that cost around $200 in total, and will present the research project at the Black Hat security conference in Las Vegas this week. He’s also open-sourced its underlying code.

The anti-tracking tool is made up of a Raspberry Pi, wireless signal detectors, and a battery pack.

Photograph: Matt Edmondson

In recent years there’s been an explosion in the number of ways people can be tracked by domestic abusers, stalkers, or those in the murky world of government-backed espionage. Tracking can either be software- or hardware-based. Stalkerware and spyware that can be installed directly on people’s phones can give attackers access to all your location data, messages, photos, videos, and more, while physical trackers—such as Apple’s AirTags—have been used to track where people are in real time. (In response to criticism, Apple has added some anti-tracking tools to AirTags.)

A quick search online reveals plenty of tracking tools, which are easy to buy. “There’s so much out there to spy on people, and so little to help people who are wondering whether they're being spied on,” Edmondson says.

The homemade system works by scanning for wireless devices around it and then checking its logs to see whether they also were present within the past 20 minutes. It was designed to be used while people are on the move rather than sitting in, say, a coffee shop, where it would pick up too many false readings.

The anti-tracking tool, which can sit inside a shoebox-sized case, is made up of a few components. A Raspberry Pi 3 runs its software, a Wi-Fi card looks for nearby devices, a small waterproof case protects it, and a portable charger powers the system. A touchscreen shows the alerts the device produces. Each alert may be a sign that you are being tailed.

The device runs Kismet, which is a wireless network detector, and is able to detect smartphones and tablets around it that are looking for Wi-Fi or Bluetooth connections. The phones we use are constantly looking for wireless networks around them, including networks they’ve connected to before as well as new networks.

Edmondson says Kismet makes a record of the first time it sees a device and then the most recent time it was detected. But to make the anti-tracking system work, he had to write code in Python to create lists of what Kismet detects over time. There are lists for devices spotted in the past five to 10 minutes, 10 to 15 minutes, and 15 to 20 minutes. If a device appears twice, an alert flashes up on the screen. The system can show a phone’s MAC address, although this is not much use if it’s been randomized. It can also record the names of Wi-Fi networks that devices around it are looking for—a phone that’s trying to connect to a Wi-Fi network called Langley may give some clues about its owner. “If you have a device on you, I should see it,” he says. In an example, he showed WIRED that a device was looking for a network called SAMSUNGSMART.

To stop the system from detecting your own phone or those of other people traveling with you, it has an “ignore” list. By tapping one of the device’s onscreen buttons, it’s possible to “ignore everything that it has already seen.” Edmondson says that in the future, the device could be modified to send a text alert instead of showing them on the screen. He is also interested in adding the capability to detect tire-pressure monitoring systems that could show recurring nearby vehicles. A GPS unit could also be added so you can see where you were when you were being tracked, he says.

“It’s purely designed to try to tell you that you’re seeing something now that you were also seeing a few minutes ago,” Edmondson says. “This isn’t designed to follow people in any way, shape, or form.” The hacker says he lives near the desert, so he tested the system in his car while driving around places where nobody else was, carrying multiple phones with him that could be detected by the tool. Edmondson says he believes the tool can be effective, since even spies working for a government still carry devices.“You still have your phone in your pocket,” he says. “You still have your phone on the seat sitting next to you, or in the center console.”

Edmondson has no plans to make the device into a commercial product, but he says the design could easily be copied and reused by anyone with some technical knowledge. Many of the parts involved are easy to obtain or may be lying around the homes of people in tech communities.

Ultimately, he says, the tech community needs to take tech-enabled tracking and surveillance more seriously. “It was really kind of disheartening and depressing to look at the ratio of tools to spy on people versus tools to help you not get spied on,” he says, adding that a person close to him has been the victim of a stalker in the past. In the case of his clandestine friend in another government department, the anti-tracking device was useful. “It was really designed to help someone who came to me asking for help,” he says. Fortunately for Edmondson’s friend (and his source), they used it in the real world, and the device didn’t find anyone following them.

This Anti-Tracking Tool Checks If You’re Being Followed

Before the flagship phone ever landed in users’ hands, the security team thoroughly hacked it by finding bugs and developing exploits.

When Google launched the Pixel 6 and 6 Pro in October 2021, key features included its custom Tensor system-on-a-chip processor and the security benefits of its onboard Titan M2 security chip. But with so much new equipment launching at once, the company needed to be extra careful that nothing was overlooked or went wrong. At the Black Hat security conference in Las Vegas today, members of the Android red team are recounting their mission to hack and break as much as they could in the Pixel 6 firmware before launch—a task they accomplished. 

The Android red team, which primarily vets Pixel products, caught a number of important flaws while attempting to attack the Pixel 6. One was a vulnerability in the boot loader, the first piece of code that runs when a device boots up. Attackers could have exploited the flaw to gain deep device control. It was particularly significant because the exploit could persist even after the device was rebooted, a coveted attack capability. Separately, the red teamers also developed an exploit chain using a group of four vulnerabilities to defeat the Titan M2, a crucial finding, given that the security chip needs to be trustworthy to act as a sort of sentry and validator within the phone.

“This is the first proof of concept ever to be publicly talked about getting end-to-end code execution on the M2 Titan chip,” Farzan Karimi, one of the red team leads, told WIRED ahead of the talk. “Four vulnerabilities were chained to create this, and not all of them were critical on their own. It was a mixture of highs and moderate severity that when you chain them together creates this impact. The Pixel developers wanted a red team to focus these types of efforts on them, and they were able to patch the exploits in this chain prior to release.”

The researchers say that the Android red team prioritizes not just finding vulnerabilities but spending time developing real exploits for the bugs. This creates a better understanding of how exploitable, and therefore critical, different flaws really are and sheds light on the range of possible attack paths so the Pixel team can develop comprehensive and resilient fixes.

Like other top red teams, the Android group uses an array of approaches to hunt for bugs. Tactics include manual code review and static analysis, automated methods for mapping how a codebase functions, and looking for potential problems in how the system is set up and how different components interact. The team also invests significantly in developing tailored “fuzzers” that it can then hand off to teams across Android to catch more bugs while development is first going on.

“A fuzzer is basically a tool that throws malformed data and junk at a service to get it to crash or reveal some security vulnerability,” Karimi says. “So we build these fuzzers and hand them off so other teams can continuously run them throughout the year. It’s a really nice thing that our red team has accomplished outside of finding bugs. We’re really institutionalizing fuzzing.”

The idea across Android, in general, is to bake security assessments and improvements into the development process as early as possible to avoid costly mistakes later. In the Black Hat talk, the researchers will also be highlighting some of the types of bugs they are most focused on looking for to try to stay ahead of trends in attacker exploitation.

For example, the researchers have been hunting for vulnerabilities in the cellular communication tech that’s baked into Pixels and every smartphone. “We’re actively invested in that area, and what I can say is that it’s 100 percent worth the effort,” Karimi says. And he adds that the biggest type of vulnerability the group has its eye on right now is “race condition” bugs, in which attackers take advantage of the sequence or timing of an uncontrollable event and inject themselves into a software interaction at the opportune time to gain unintended system access.

“Imagine you’re setting up a profile on a … smartwatch,” Karimi says. “Maybe the system tries to run commands and the attacker injects their own commands during that process to submit or execute malicious code that they control. We’re thinking about unique ways to tackle this.”

In part, the red team’s job is to set priorities and bet on the right security horses to protect Pixel users around the world.

“Pixel 6 was a complete transformation of prior generation phones, and it was our job to red team it and secure it,” Karimi says. “We were looking at all this attack surface and testing what we felt is at most risk within about a year and half of time. There are 100 things you have to look at, and they’re all high priority. So you have to be selective about what’s the lowest level of effort for an attacker to abuse and start with that.”

Google's Android Red Team Had a Full Pixel 6 Pwn Before Launch

Ten years after it was first unveiled, the powerful firmware analysis platform Ofrak is now available to anyone.

At the 2012 DefCon security conference in Las Vegas, Ang Cui, an embedded device security researcher, previewed a tool for analyzing firmware, the foundational software that underpins any computer and coordinates between hardware and software. The tool was specifically designed to elucidate internet-of-things (IoT) device firmware and the compiled “binaries” running on anything from a home printer to an industrial door controller. Dubbed FRAK, the Firmware Reverse Analysis Console aimed to reduce overhead so security researchers could make progress assessing the vast and ever-growing population of buggy and vulnerable embedded devices rather than getting bogged down in tedious reverse engineering prep work. Cui promised that the tool would soon be open source and available for anyone to use.

“This is really useful if you want to understand how a mysterious embedded device works, whether there are vulnerabilities inside, and how you can protect these embedded devices against exploitation,” Cui explained in 2012. “FRAK will be open source very soon, so we’re working hard to get that out there. I want to do one more pass, internal code review before you guys see my dirty laundry.”

He was nothing if not thorough. A decade later, Cui and his company, Red Balloon Security, are launching Ofrak, or OpenFRAK, at DefCon in Las Vegas this week.

“In 2012 I thought, here’s a framework that would help researchers move embedded security forward. And I went on stage and said, I think the community should have it. And I got a number of emails from a number of lawyers,” Cui told WIRED ahead of the release. “Embedded security is a space that we absolutely need to have more good eyes and brains on. We needed it 10 years ago, and we finally found a way to give this capability out. So here it is.”

Though it hadn’t yet fulfilled its destiny as a publicly available tool, FRAK hasn’t been languishing all these years either. Red Balloon Security continued refining and expanding the platform for internal use in its work with both IoT device makers and customers who need a high level of security from the embedded devices they buy and deploy. Jacob Strieb, a software engineer at Red Balloon, says the company always used FRAK in its workflow, but that Ofrak is an overhauled and streamlined version that Red Balloon itself has switched to.

Cui’s 2012 demo of FRAK raised some hackles because the concept included tailored firmware unpackers for specific vendors’ products. Today, Ofrak is simply a general tool that doesn’t wade into potential trade secrets or intellectual property concerns. Like other reverse engineering platforms, including the NSA’s open source Ghidra tool, the stalwart disassembler IDA, or the firmware analysis tool Binwalk, Ofrak is a neutral investigative framework. And Red Balloon’s new offering is designed to integrate with these other platforms for easier collaboration among multiple people.

“What makes it unique is it’s designed to provide a common interface for other tools, so the benefit is that you can use all different tools depending on what you have at your disposal or what works best for a certain project,” Strieb says.

The platform is also unusual for offering advanced, automated repacking mechanisms for firmware binaries. Most reverse engineering tools aid in unpacking but lack extensive repacking capabilities, because even small modifications you make to firmware can incidentally break functionality or change how the program behaves. Repacking was always a core part of how Cui conceived FRAK, though, and Red Balloon has continued to improve it over the years for the company’s own work.

When Cui gave his original FRAK presentation, the project already had support from a now-concluded Defense Advanced Research Projects Agency program. Known as Cyber Fast Track, the DARPA initiative was run by security researcher Peiter Zatko, better known as Mudge.

“The proposal was compelling enough for me to fund it in April 2012, and I worked extremely hard to ensure I was a good steward of such funding,” Mudge says. “This is a valuable tool that significantly facilitated security researchers’ work in the field of applied embedded security. I am very happy to see more of this project being made available to such a wide audience through open source.”

After the end of Cyber Fast Track in 2013, Ofrak continued to receive partial support from DARPA’s Assured Micropatching program.

“Oftentimes, it’s cost prohibitive for organizations to hire reverse engineers with specialized skills to patch embedded devices,” says Sergey Bratus, a DARPA program manager. “A key goal of the AMP program is to make this capability readily available through automation. Automating the application of a fix turns out to be a hard computer science problem with fundamental research challenges. These challenges must be supported with new classes of modular, community-building, research-enabling tools such as Ofrak.”

In other words, Ofrak is not only useful for independent researchers who want to penetrate the black box of embedded devices. It can also help manufacturers assess their own products and play a role in patch development and distribution, a longtime challenge and frequent debacle in IoT.

Red Balloon’s Strieb says the company hopes Ofrak will be widely adopted and that people will develop add-on modules for community use. Red Balloon plans to maintain the tool long-term, and says it is fully committed to keeping licenses for personal use and research free in perpetuity. 

For Cui, it all fits into his original FRAK vision from 10 years ago.

“If more people looked inside the things and realized they could change the things, we would have more secure embedded devices,” he says. “So please take Ofrak, realize you have the power to reason about and change the code running on these devices, and then there’s a whole world of things you can create that are better than what we have now.”

A Long-Awaited IoT Reverse Engineering Tool Is Finally Here

It cost a researcher only $25 worth of parts to create a tool that allows custom code to run on the satellite dishes.

Since 2018, Elon Musk’s Starlink has launched more than 3,000 small satellites into orbit. This satellite network beams internet connections to hard-to-reach locations on Earth and has been a vital source of connectivity during Russia’s war in Ukraine. Thousands more satellites are planned for launch as the industry booms. Now, like any emerging technology, those satellite components are being hacked.

Today, Lennert Wouters, a security researcher at the Belgian university KU Leuven, will reveal one of the first security breakdowns of Starlink’s user terminals, the satellite dishes (dubbed Dishy McFlatface) that are positioned on people’s homes and buildings. At the Black Hat security conference in Las Vegas, Wouters will detail how a series of hardware vulnerabilities allow attackers to access the Starlink system and run custom code on the devices.

To access the satellite dish’s software, Wouters physically stripped down a dish he purchased and created a custom hacking tool that can be attached to the Starlink dish. The hacking tool, a custom circuit board known as a modchip, uses off-the-shelf parts that cost around $25. Once attached to the Starlink dish, the homemade printed circuit board (PCB) is able to launch a fault injection attack—temporarily shorting the system—to help bypass Starlink’s security protections. This “glitch” allows Wouters to get into previously locked parts of the Starlink system.

Wouters is now making his hacking tool open source on GitHub, including some of the details needed to launch the attack. “As an attacker, let’s say you wanted to attack the satellite itself,” Wouters explains, “You could try to build your own system that allows you to talk to the satellite, but that’s quite difficult. So if you want to attack the satellites, you would like to go through the user terminal as that likely makes your life easier.”

The researcher notified Starlink of the flaws last year and the company paid Wouters through its bug bounty scheme for identifying the vulnerabilities. Wouters says that while SpaceX has issued an update to make the attack harder (he changed the modchip in response), the underlying issue can’t be fixed unless the company creates a new version of the main chip. All existing user terminals are vulnerable, Wouters says.

Starlink says it plans to release a “public update” following Wouters’ presentation at Black Hat this afternoon, but declined to share any details about that update with WIRED prior to publication.

Starlink’s internet system is made up of three major parts. First, there are the satellites that move in low Earth orbit, around 340 miles above the surface, and beam down connections to the surface. The satellites communicate with two systems on Earth: gateways that send internet connections up to the satellites, and the Dishy McFlatface dishes people can buy. Wouters’ research focuses on these user terminals, which originally were round, but newer models are rectangular.

There have been multiple teardowns of Starlink’s user terminals since the company started selling them. Engineers on YouTube have opened up their terminals, exposing their components and how they work. Others discuss the technical specs on Reddit. However, Wouters, who previously created hardware that can unlock a Tesla in 90 seconds, looked at the security of the terminal and its chips. “The user terminal was definitely designed by capable people,” Wouters says.

His attacks against the user terminal involved multiple stages and technical measures before he finally created the now open source circuit board that can be used to glitch the dish. Broadly, the attack using the custom circuit board works by bypassing signature verification security checks, which look to prove that the system is launching correctly and hasn’t been tampered with. “We’re using this to accurately time when to inject the glitch,” Wouters says.

Starting in May 2021, Wouters began testing the Starlink system, getting 268-Mbps download speeds and 49-Mbps upload speeds on his university building’s roof. Then it was time to open the device up. Using a combination of a “heat gun, prying tools, isopropyl alcohol, and a lot of patience,” he was able to remove the large metal cover from the dish and access its internal components.

Photograph: Lennert Wouters

Under the 59-cm diameter hood is a large PCB that houses a system-on-chip, including a custom quad-core ARM Cortex-A53 processor, the architecture of which isn’t publicly documented, making it harder to hack. Among other items on the board are radio frequency equipment, power over ethernet systems, and a GPS receiver. Opening up the dish allowed Wouters to understand how it boots up and download its firmware.

To design the modchip, Wouters scanned the Starlink dish and created the design to fit over the existing Starlink board. The modchip requires soldering to the existing Starlink PCB and connecting it using a few wires. The modchip itself is made up of a Raspberry Pi microcontroller, flash storage, electronic switches, and a voltage regulator. When creating the user terminal’s board, Starlink engineers printed “Made on Earth by humans” across it. Wouters’ modchip reads: “Glitched on Earth by humans.”

To get access to the dish’s software, Wouters used his custom system to bypass security protections by using the voltage fault injection attack. When the Starlink dish is turning on, it uses a series of different bootloader stages. Wouters’ attack runs the glitch against the first bootloader, known as the ROM bootloader, which is burned onto the system-on-chip and can’t be updated. The attack then deploys patched firmware on later bootloaders, which allows him to take control of the dish.

“From a high-level view, there are two obvious things that you could try to attack: the signature verification or the hash verification,” Wouters says. The glitch works against the signature verification process. “Normally you want to avoid shorts,” he says. “In this case we do it on purpose.”

Initially, Wouters attempted to glitch the chip at the end of its boot cycle—when the Linux operating system has fully loaded—but ultimately found it easier to cause the glitch at the start of the boot. This way was more reliable, Wouters says. To get the glitch to work, he says, he had to stop decoupling capacitors, which are used to smooth out the power supply, from operating. Essentially, the attack disables the decoupling capacitors, runs the glitch to bypass the security protections, and then enables the decoupling capacitors.

This process allows the researcher to run a patched version of Starlink’s firmware during the boot cycle and ultimately allows access to its underlying systems. In response to the research, Wouters says, Starlink offered him researcher-level access to the device’s software, although he says he declined as he had gone too deep with the work and wanted to build the modchip. (During testing, he hung the modified dish out of this research lab’s window and used a plastic bag as a makeshift waterproofing system.)

Starlink also issued a firmware update, Wouters says, that makes the attack harder, but not impossible, to execute. Anyone wanting to break into the dish in this way would have to put a lot of time and effort into doing so. While the attack isn’t as devastating as being able to take down satellite systems or connectivity, Wouters says it can be used to learn more about how the Starlink network operates.

“What I am working on now is communicating with the backend servers,” Wouters explains. Despite making the details of the modchip available for download on Github, Wouters does not have any plans to sell finished modchips, nor is he providing people with patched user terminal firmware or the exact details of the glitch he used.

As an increasing amount of satellites are launched—Amazon, OneWeb, Boeing, Telesat, and SpaceX are creating their own constellations—their security will come under greater scrutiny. In addition to providing homes with internet connections, the systems can also help to get ships online, and play a role in critical infrastructure. Malicious hackers have already shown that satellite internet systems are a target. As Russian troops invaded Ukraine, alleged Russian military hackers targeted the Via-Sat satellite system, deploying wiper malware that bricked people’s routers and knocked them offline. Around 30,000 internet connections in Europe were disrupted, including more than 5,000 wind turbines.

“I think it’s important to assess how secure these systems are because they are critical infrastructure,” Wouters says. “I don’t think it's very far-fetched that certain people would try to do this type of attack because it is quite easy to get access to a dish like this.”

_Update 5 pm ET August 10, 2022:_ After Wouters’ conference talk, Starlink published a six-page PDF explaining how it secures its systems. “We find the attack to be technically impressive, and is the first attack of its kind that we are aware of in our system,” the paper says. “We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of ‘least privilege’ to constrain the effects in the broader system.”

Starlink reiterates that the attack needs physical access to a user terminal and emphasizes its secure boot system, which was compromised by the glitching process, is only impacted on that one device. Wider parts of the overall Starlink system are not impacted. “Normal Starlink users do not need to be worried about this attack affecting them, or take any action in response,” Starlink says.

The Hacking of Starlink Terminals Has Begun

New research found troubling vulnerabilities in the 5G platforms carriers offer to wrangle embedded device data.

True 5G wireless data, with its ultrafast speeds and enhanced security protections, has been slow to roll out around the world. As the mobile technology proliferates—combining expanded speed and bandwidth with low latency connections—one of its most touted features is starting to come into focus. But the upgrade comes with its own raft of potential security exposures.

A massive new population of 5G-capable devices, from smart city sensors to agriculture robots and beyond, are gaining the ability to connect to the internet in places where Wi-Fi isn't practical or available. Individuals may even elect to trade their fiber optic internet connection for a home 5G receiver. New research that will be presented on Wednesday at the Black Hat security conference in Las Vegas, though, warns that the interfaces carriers have set up to manage internet of things data are riddled with security vulnerabilities they fear will dog the industry long term.

After years of examining potential security and privacy issues in mobile data radio frequency standards, Technical University of Berlin researcher Altaf Shaik says he was curious to investigate the application programming interfaces (APIs) carriers are offering to make IoT data accessible to developers. These are the conduits applications can use to pull, say, real-time bus tracking data or information about stock in a warehouse. Such APIs are ubiquitous in web services, but Shaik points out that they haven't been widely used in core telecommunications offerings. Looking at the 5G IoT APIs of 10 mobile carriers around the world, Shaik and his colleague Shinjo Park found common, widely-known API vulnerabilities in all of them, and some could be exploited to gain authorized access to data or even direct access to IoT devices on the network.

“There's a big knowledge gap, this is the beginning of a new type of attack in telecom,” Shaik told WIRED ahead of his presentation. “There's a whole platform where you get access to the APIs, there’s documentation, everything, and it's called something like ‘IoT service platform.’ Every operator in every country is going to be selling them if they're not already, and there are virtual operators and subcontracts, too, so there will be a ton of companies offering this kind of platform.”

The designs of IoT service platforms aren’t specified in the 5G standard and are up to each carrier and company to create and deploy. That means there's widespread variation in their quality and implementation. In addition to 5G, upgraded 4G networks can also support some IoT expansion, widening the number of carriers that may offer IoT service platforms and the APIs that feed them.

The researchers bought IoT plans on the 10 carriers they analyzed and got special data-only SIM cards for their networks of IoT devices. This way they had the same access to the platforms as any other customer in the ecosystem. They found that basic flaws in how the APIs were set up, like weak authentication or missing access controls, could reveal SIM card identifiers, SIM card secret keys, the identity of who purchased which SIM card, and their billing information. And in some cases, the researchers could even access large streams of other users' data or even identify and access their IoT devices by sending or replaying commands that they shouldn’t have been able to control.

The researchers went through disclosure processes with the 10 carriers they tested and said that the majority of vulnerabilities they found so far are being fixed. Shaik notes that the quality of security protections on the IoT service platforms varied widely, with some appearing more mature while others were “still sticking to the same old, bad security policies and principles.” He adds that the group isn't publicly naming the carriers they looked at in this work because of concerns about how widespread the issues might be. Seven of the carriers are based in Europe, two are in the United States, and one is in Asia.

“We found vulnerabilities that could be exploited to access other devices even though they don’t belong to us, just by being on the platform,” Shaik says. “Or we could talk to other IoT devices and send messages, extract information. It’s a big issue.”

Shaik emphasizes that he and his colleagues didn’t hack any other customers or do anything improper once they discovered the different flaws. But he points out that none of the carriers detected the researchers’ probing, which in itself indicates a lack of monitoring and safeguards, he says.

The findings are just a first step, but they underscore the challenges of securing massive new ecosystems as the full breadth and scale of 5G starts to appear on the horizon.

One of 5G's Biggest Features Is a Security Minefield

The fact that a search of Donald Trump's Florida home was even necessary says a lot.

Very few people ever find themselves on the receiving end of an FBI search warrant—even fewer end up escaping criminal charges.

The fact that Donald Trump now ranks among the former provides the strongest indication yet that he may soon face the latter.

Monday’s search of the former president’s Mar-a-Lago property in Florida was surely one of the most significant, sensitive, and politically explosive actions the US Justice Department and FBI have ever taken. It’s one of a tiny handful of times the DOJ has ever investigated a president. And it’s an action that likely indicates the FBI and prosecutors had specific knowledge of both a definable crime and the evidence to back it up.

The actual search warrant, which would list specific crimes being investigated, has not been released yet. According to Monday night news reports, however, the search focused on questions about a number of boxes of classified documents that Trump took from the White House to his Florida mansion after leaving the presidency.

While it may take months to learn more about the underlying investigation, the fact that the FBI launched such a high-profile search already tells us a great deal about the state of the Justice Department’s case.

Here are the five big takeaways.

Probable Cause Was Clear

Federal search warrants aren’t designed to be fishing expeditions. The FBI’s legally authorized search of a former president’s primary residence would have been approved and monitored at the highest level of both the FBI and the Justice Department, likely including both the deputy attorney general and the attorney general. It’s hard to imagine how high the bar of probable cause must have been for the Bureau to initiate such a politically sensitive search. Ironically, the scandals the FBI has weathered from past Trump investigations likely made the bar for probable cause and sign-off by the department’s upper levels even higher.

One of the biggest scandals the FBI and Justice Department have endured in recent years was the sloppy (and ultimately illegal) paperwork surrounding a FISA warrant filed amid the 2016 presidential campaign that targeted Trump aide Carter Page. Two of the four warrants used in that case were later declared invalid, and an FBI lawyer pleaded guilty to falsifying part of the underlying evidence and probable cause paperwork. A nearly 500-page inspector general report eviscerated the Bureau’s handling of the FISA warrants, which were long thought to be one of the most thorough and careful of court filings and are supposed to be backstopped by careful evidence reviews known as the “Woods procedures.” As it turned out, the FBI had omitted key questions about the underlying evidence from the Page warrant application and offered misleading characterizations about other pieces of evidence.

That scandal led to internal FBI and Justice Department reforms that would have made the Mar-a-Lago search warrant subject to even closer scrutiny—and ensured that the bar for probable cause would have been so high, the evidence so crystal clear, that it’s likely the Justice Department already feels it has enough information to bring criminal charges.

A Judge Signed Off on the Search

A legally authorized search warrant is an important part of the US Constitution’s system of checks and balances. It requires the assent of two of the three branches of government, whereby the executive branch (the DOJ and the FBI) gets the sign-off from the judicial branch. In the case of the Trump property search, once agents and prosecutors assembled their evidence, an independent federal magistrate judge needed to agree that a crime was likely committed and that there was specific evidence at Mar-a-Lago that would have bearing on the crime.

Notably, this is at least the second time this year that a federal judge has agreed Trump was at least adjacent to a crime. As the January 6 congressional committee has repeatedly pointed out, a federal judge agreed with its assessment this spring that Trump “more likely than not” committed a crime amid his efforts to overturn the 2020 elections.

This Isn’t Just About Trump Taking Classified Docs

One of the most important questions in an investigation is about establishing motive, summed up by the Latin phrase _cui bono_, or _Who benefits?_ Sure, Trump taking home classified documents is technically a crime. But as national security reporter Zach Dorfman points out, it’s hardly a serious enough offense to spur the FBI to raid the home of a former president.

The entire security classification system exists to serve the presidency. The president is the one official in the US government with the ability to unilaterally declassify any piece of information. (Trump famously exercised this power while in office by tweeting a highly classified satellite photo of an Iranian facility). Plus, while classified documents theoretically include highly sensitive information that would damage national security if released, the reality is that many classified documents aren’t that sensitive.

Big Takeaways From the FBI's Mar-a-Lago Raid

Regulators are close to stopping Meta from sending EU data to the US, bringing a years-long privacy battle to a head.

Facebook faces trouble in Europe—and Meta wants you to know about it. Every three months since June 2018, the company has used its financial results to warn that it could be forced to stop running Facebook and Instagram across the continent—potentially pulling its apps from millions of people and thousands of businesses—if it can’t send data between the EU and the US.

Whether Meta’s bluffing will become clear soon enough.

Data regulators are on the verge of making a historic ruling in a years-long case, and they are expected to say Facebook’s data transfers across the Atlantic should be blocked. For years, Meta has fought against European privacy activists over how data is sent to the US, with courts ruling multiple times that European data isn’t properly protected and can potentially be snooped on by the NSA and other US intelligence agencies.

While the case focuses on Meta, it has widespread ramifications, potentially impacting thousands of businesses across Europe that rely upon the services of Google, Amazon, Microsoft, and more. At the same time, US and European negotiators are scrambling to finalize a long-awaited new data-sharing deal that will limit what information US intelligence agencies can get their hands on. If negotiators can’t get it right, people’s privacy will remain at risk and billions of dollars of trade will be put in jeopardy.

At the start of July, the Irish Data Protection Commission, Facebook’s main data regulator in Europe, issued a draft decision that would block Meta from sending data across the Atlantic. While the specifics of that draft decision aren’t known, if it is enacted, it could create a Facebook blackout across Europe.

Under the GDPR, Europe’s data law, countries across the continent get 30 days to scrutinize Ireland’s Meta decision and respond with any potential changes or complaints. That time is now up. A spokesperson for the Irish regulator says “some” objections have been received from a “small” number of other countries and it is working to address these. Experts say these are likely to be minor points of law, rather than overturning the entire decision.

So, how likely is it that Meta will actually pull its services from Europe? In reality, the chances are probably pretty slim. Meta has said it has “no desire” to leave the continent, going as far as publishing a blog post titled “Meta Is Absolutely Not Threatening to Leave Europe.” Europe’s 30-plus countries are a large market for Meta, and stopping services, even temporarily, could be costly. (A close comparison is when the company briefly banned news posts in Australia in early 2021, following a row with publishers.) While Meta may not leave Europe, it may have to make changes to how it stores and transfers data once the final decision from the Irish regulator is published, although there is no set timeline. It may also face a fine.

“My guess is that Meta is going to have to look at some form of geo-siloing if they want to continue to operate in the EU,” says Calli Schroeder, global privacy counsel at the Electronic Privacy Information Center, a nonprofit digital rights research organization. Schroeder, who previously worked with companies on international data transfers, says this approach could mean Meta would have to create its own servers and data centers in the EU that aren’t connected to its broader databases.

Harshvardhan Pandit, a computer science research fellow at Trinity College Dublin who is researching the GDPR, says that as data authorities are still considering Meta’s case and a final decision hasn’t been published yet, they could include several caveats or steps that Meta should take to fall in line. For instance, one recent data protection decision in Europe gave a six-month period for a company to make changes to its business.

“I think the most pragmatic solution would be for them to create the European infrastructure, like Google or Amazon, which have quite a few data centers here,” Pandit says, adding that Meta could also introduce more encryption to how it stores data and maximize how much it keeps in the EU. All these measures would be costly, though. Jack Gilbert, director and associate general counsel at Meta, says that the issue “is in the process of being resolved.” Facebook did not respond specifically to questions about its plan to respond to the Irish decision.

European officials have twice ruled that systems put in place to share data between the EU and US don’t properly protect people’s data—the complaints have been ongoing since the early 2010s. European courts ruled that international data-sharing agreements weren’t up to scratch first in 2015 and then again in July 2020, when the Privacy Shield agreement was ruled illegal.

“All that the EU is asking for when organizations transfer data to other countries is to protect that data in line with the GDPR,” says Nader Henein, a research vice president specializing in privacy and data protection at Gartner. “The issue is that laws in the US that protect the data of ‘nonresident aliens’ are woefully insufficient and make it very difficult for organizations like Facebook to comply with local law and the GDPR.”

While Meta is the focus of the most high-profile complaint, it isn’t the only company impacted by a lack of clarity on how companies in Europe can send data to the US. “The data transfer issue is not Meta-specific,” David Wehner, Meta’s chief strategy officer, said in a July earnings call. “It relates to how in general data is transferred for all US and EU companies back and forth to the US.”

The impacts of the July 2020 decision to get rid of Privacy Shield are now being felt. Since January of this year, multiple European data regulators have ruled that using Google Analytics, the company’s traffic-monitoring service for websites, falls foul of the GDPR. Danish authorities went even further: Schools can’t use Chromebooks without restrictions being put in place. “There is a ton of legal uncertainty, and there is a significant compliance risk,” says Gabriela Zanfir-Fortuna, vice president of global privacy at Future of Privacy Forum, a nonprofit think tank.

Politicians are well aware of the problems. In March, US president Joe Biden and European Commission president Ursula von der Leyen announced a new Trans-Atlantic Data Privacy Framework, which will change the way data is sent between the EU and US. The deal, which will be introduced by executive order, will limit what data US intelligence agencies can access and will create a new system where Europeans can complain if they think they’ve been illegally spied upon by US agencies.

However, since the deal was announced, no specifics—including any legal texts—have been published. In June, officials said the deal could be published in the coming weeks, but so far, there has been little public progress. The US Department of Commerce says discussions are still taking place, including a meeting between both sides last week. (A European Commission spokesperson says work on the new agreement is ongoing, but they do not have a timeline that can be shared.) The longer the negotiations take, the more blocking orders will drop. “Obviously, if that framework is not complete, we would be in jeopardy of being able to transfer data,” Facebook’s Wehner said earlier this year.

The deal is likely to take a while yet. “Realistically, at this point, we're looking at a potential adequacy decision for this Trans-Atlantic data transfers framework sometime next year—maybe the first quarter of next year,” Zanfir-Fortuna says. Once the details have been published, EU officials will spend months scrutinizing the specifics to see if they fall in line with court orders.

And they won’t be the only ones pouring over it. Privacy activists and lawyers will also be looking at the agreement and could launch further legal challenges if they find that data moving from Europe to the US still isn’t protected strongly enough. “The continued challenges are not unwarranted, particularly considering the Snowden revelations and the prevalence of Big Tech firms coming out of the US,” Schroeder says. “As a whole, America really needs to make sure we rise to the challenge of showing that we can be good stewards of the industry that we're trying to be leaders in.”

Source

Wired