Plus: Google fixes dozens of Android bugs, Microsoft rolls out nearly 50 patches, Mozilla squashes 15 Firefox flaws, and more.

Later in January, Google released Chrome 121 to the stable channel, fixing 17 security issues, three of which are rated as having a high impact. These include CVE-2024-0807, a use-after-free flaw in WebAudio, and CVE-2024-0812, an inappropriate implementation vulnerability in accessibility. The final high-impact vulnerability is CVE-2024-0808, an integer underflow in WebUI.

Obviously, these updates are important, so check and apply them as soon as you can.

Microsoft

Microsoft’s January Patch Tuesday squashes nearly 50 bugs in its popular software, including 12 remote code execution (RCE) flaws.

No security holes included in this month’s set of updates are known to have been used in attacks, but notable flaws include CVE-2024-20677, a bug in Microsoft Office that could allow attackers to create malicious documents with embedded FBX 3D model files to execute code.

To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it, Microsoft said.

Meanwhile, CVE-2024-20674 is a Windows Kerberos security feature bypass vulnerability rated as critical with a CVSS score of 8.8. In one scenario for this vulnerability, the attacker could convince a victim to connect to an attacker-controlled malicious application, Microsoft said. “Upon connecting, the malicious server could compromise the protocol,” the software giant added.

Mozilla Firefox

Hot on the heels of its market-dominant competitor Chrome, Mozilla’s Firefox has patched 15 security flaws in its latest update. Five of the bugs are rated as having a high severity, including CVE-2024-0741, an out-of-bounds write issue in Angle that could allow an attacker to corrupt memory, leading to an exploitable crash.

An unchecked return value in TLS handshake code tracked as CVE-2024-0743 could also cause an exploitable crash.

CVE-2024-0755 covers memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

Cisco

Enterprise software giant Cisco has patched a vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products that could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

Tracked as CVE-2024-20253 and with a whopping CVSS score of 9.9, Cisco said an attacker could exploit the vulnerability by sending a crafted message to a listening port of an affected device.

“A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user,” Cisco said. “With access to the underlying operating system, the attacker could also establish root access on the affected device,” it warned.

SAP

SAP has issued 10 new security fixes as part of its January Security Patch Day, which includes several issues with a CVSS score of 9.1. CVE-2023-49583 is an escalation-of-privilege issue in applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack, and SAP Web IDE for SAP HANA.

Meanwhile, CVE-2023-50422 and CVE-2023-49583 are escalation-of-privilege issues in SAP Edge Integration Cell.

Another notable flaw is CVE-2024-21737, a code injection vulnerability in SAP Application Interface Framework, which has a CVSS score of 8.4. “A vulnerable function module of the application allows an attacker to traverse through various layers and execute OS commands directly,” security firm Onapsis said. “Successful exploits can cause considerable impact on confidentiality, integrity, and availability of the application.”

Apple and Google Just Patched Their First Zero-Day Flaws of the Year

Aerial drones have changed the war in Ukraine. Now, both Russia’s and Ukraine’s militaries are deploying more unmanned ground robots—and the two are colliding.

Near the Ukrainian city of Avdiivka, a boxy robot zips along the rocky, cracked road. Snaking from side to side, the robot—a four-wheeled machine, around knee height—carries cargo and ammunition for Russian troops. However, it’s being watched. Hovering above the road, tracking the movements of the robot, is a Ukrainian drone. Suddenly, another drone smashes into the robot, blowing it to pieces.

The attack, which happened in early December and was claimed by the Ukrainian military’s 110th Mechanized Brigade, is one of a small but growing number of incidents where unsophisticated robots have been used against other robots in Russia’s war in Ukraine. Aerial drones have been used to surveil or attack ground robots, soldiers have attached weapons to land-based robots, and other small unmanned bots are being fitted with jamming technology to knock drones from the sky.

Since Russia’s full-scale invasion in February 2022, small aerial drones have played an outsize role in the war in Ukraine—with thousands of drones being used to monitor the battlefield, watch enemy movements, and carry explosives. Videos produced by Ukrainian and Russian soldiers show the drones, which are often first-person view (FPV) drones, being used to attack tanks and troops. As the war has raged on, another kind of robot has increasingly appeared in recent months: the unmanned ground vehicle, or UGV.

“There’s lots of unmanned ground vehicle development happening,” says Samuel Bendett, a Russia analyst at the think tank Center for Naval Analyses who tracks military drone and robotics technology use. Most of the UGVs being developed or used are small robots, Bendett says, as larger vehicles will be tracked, observed, and attacked with FPV and other aerial drones. “The Ukrainian battlefield is saturated with aerial sensors that basically track and attack anything that moves,” he says. That includes other robots.

The UGVs being developed within the war are typically four- or six-wheeled machines that can be kitted out for multiple purposes. There are logistics robots, which can carry supplies to the front lines; evacuation robots that carry injured people; and robots linked to combat such as those that can place or destroy landmines and have explosives or weapons attached. These robots are largely remote-controlled by humans—there’s little autonomy—and operate over ranges of a few kilometers.

UGVs themselves are not new. Some of the earliest UGVs were created in World War II and used as explosive devices, while they have also appeared in other conflicts. Most Russian UGV developments so far have been homemade or DIY, Bendett says, with troops or volunteers creating robots for specific tasks or needs. Ukraine has, to date, put more military effort into developing ground robots, with the government stating its ambition to build an “army of robots.”

Videos from within Ukraine, first shared on Telegram channels and reviewed by analysts such as Bendett, show a Russian drone monitoring a Ukrainian UGV as it trundles along laying mines. In another video, a small six-wheeled robot approaches a downed drone, lifting up its wings, before troops approach it. A third shows drones trying to destroy UGVs moving along the ground. In one demonstration, a person is dragged behind a UGV along the ground. Earlier in January, Mykhailo Fedorov, Ukraine’s deputy prime minister, announced a UGV with an “automated turret” that, he said, can also transport ammunition and provisions to fighters.

Robots Are Fighting Robots in Russia's War in Ukraine

Members of Congress say the DOJ is funding the use of AI tools that further discriminatory policing practices. They're demanding higher standards for federal grants.

The United States Department of Justice has failed to convince a group of US lawmakers that state and local police agencies aren't awarded federal grants to buy AI-based “policing” tools known to be inaccurate, if not prone to exacerbating biases long observed in US police forces.

Seven members of Congress wrote in a letter to the DOJ, first obtained by WIRED, that the information they pried loose from the agency had only served to inflame their concerns about the DOJ’s police grant program. Nothing in its responses so far, the lawmakers said, indicates the government has bothered to investigate whether departments awarded grants bought discriminatory policing software.

“We urge you to halt all Department of Justice grants for predictive policing systems until the DOJ can ensure that grant recipients will not use such systems in ways that have a discriminatory impact,” the letter reads. The Justice Department previously acknowledged that it had not kept track of whether police departments were using the funding, awarded under the Edward Byrne Memorial Justice Assistance Grant Program, to purchase so-called predictive policing tools.

Led by Senator Ron Wyden, a Democrat of Oregon, the lawmakers say the DOJ is required by law to “periodically review” whether grant recipients comply with Title VI of the nation’s Civil Rights Act. The DOJ is patently forbidden, they explain, from funding programs shown to discriminate on the basis of race, ethnicity, or national origin, whether that outcome is intentional or not.

Independent investigations in the press have found that popular “predictive” policing tools trained on historical crime data often replicate long-held biases, offering law enforcement, at best, a veneer of scientific legitimacy while perpetuating the over-policing of predominantly Black and Latino neighborhoods. An October headline from The Markup states bluntly: “Predictive Policing Software Terrible At Predicting Crimes.” The story recounts how researchers at the publication recently examined 23,631 police crime predictions—and found them accurate roughly 1 percent of the time.

“Predictive policing systems rely on historical data distorted by falsified crime reports and disproportionate arrests of people of color,” Wyden and the other lawmakers wrote, predicting—as many researchers have—that the technology serves only to create “dangerous” feedback loops. The statement notes that “biased predictions are used to justify disproportionate stops and arrests in minority neighborhoods,” further biasing statistics on where crimes occur.

Senators Jeffrey Merkley, Ed Markey, Alex Padilla, Peter Welch, and John Fetterman also cosigned the letter, as did Representative Yvette Clarke.

The lawmakers have requested that an upcoming presidential report on policing and artificial intelligence investigate the use of predictive policing tools in the US. “The report should assess the accuracy and precision of predictive policing models across protected classes, their interpretability, and their validity,” to include, they added, “any limits on assessing their risks posed by a lack of transparency from the companies developing them.”

Should the DOJ wish to continue funding the technology after this assessment, the lawmakers say, it should at least establish “evidence standards” to determine which predictive models are discriminatory—and then reject funding for all those that fail to live up to them.

US Lawmakers Tell DOJ to Quit Blindly Funding ‘Predictive’ Police Tools

Plus: North Korean hackers get into generative AI, a phone surveillance tool that can monitor billions of devices gets exposed, and ambient light sensors pose a new privacy risk.

Police took a digital rendering of a suspect's face, generated using DNA evidence, and ran it through a facial recognition system in a troubling incident reported for the first time by WIRED this week. The tactic came to light in a trove of hacked police records published by the transparency collective Distributed Denial of Secrets. Meanwhile, information about United States intelligence agencies purchasing Americans' phone location data and internet metadata without a warrant was revealed this week only after US senator Ron Wyden blocked the appointment of a new NSA director until the information was made public. And a California teen who allegedly used the handle Torswats to carry out hundreds of swatting attacks across the US is being extradited to Florida to face felony charges.

The infamous spyware developer NSO Group, creator of the Pegasus spyware, has been quietly planning a comeback, which involves investing millions of dollars lobbying in Washington while exploiting the Israel-Hamas war to stoke global security fears and position its products as a necessity. Breaches of Microsoft and Hewlett-Packard Enterprise, disclosed in recent days, have pushed the espionage operations of the well-known Russia-backed hacking group Midnight Blizzard back into the spotlight. And Amazon-owned Ring said this week that it is shutting down a feature of its controversial Neighbors app that gave law enforcement a free pass to request footage from users without a warrant.

WIRED had a deep dive this week into the Israel-linked hacking group known as Predatory Sparrow and its notably aggressive offensive cyberattacks, particularly against Iranian targets, which have included crippling thousands of gas stations and setting a steel mill on fire. With so much going on, we've got the perfect quick weekend project for iOS users who want to feel more digitally secure: Make sure you've upgraded your iPhone to iOS 17.3 and then turn on Apple's new Stolen Device Protection feature, which could block thieves from taking over your accounts.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

After first disclosing a breach in October, the ancestry and genetics company 23andMe said in December that personal data from 6.9 million users was impacted in the incident stemming from attackers compromising roughly 14,000 user accounts. These accounts then gave attackers access to information voluntarily shared by users in a social feature the company calls DNA Relatives. 23andMe has blamed users for the account intrusions, saying that they only occurred because victims set weak or reused passwords on their accounts. But a state-mandated filing in California about the incident reveals that the attackers started compromising customers’ accounts in April and continued through much of September without the company ever detecting suspicious activity—and that someone was trying to guess and brute-force users' passwords.

North Korea has been using generative artificial intelligence tools “to search for hacking targets and search for technologies needed for hacking,” according to a senior official at South Korea's National Intelligence Service who spoke to reporters on Wednesday under the condition of anonymity. The official said that Pyongyang has not yet begun incorporating generative AI into active offensive hacking operations but that South Korean officials are monitoring the situation closely. More broadly, researchers say they are alarmed by North Korea's development and use of AI tools for multiple applications.

The digital ad industry is notorious for enabling the monitoring and tracking of users across the web. New findings from 404 Media highlight a particularly insidious service, Patternz, that draws data from ads in hundreds of thousands of popular, mainstream apps to reportedly fuel a global surveillance dragnet. The tool and its visibility have been marketed to governments around the world to integrate with other intelligence agency surveillance capabilities. “The pipeline involves smaller, obscure advertising firms and advertising industry giants like Google. In response to queries from 404 Media, Google and PubMatic, another ad firm, have already cut-off a company linked to the surveillance firm,” 404's Joseph Cox wrote.

Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory have devised an algorithm that could be used to convert data from smart devices' ambient light sensors into an image of the scene in front of the device. A tool like this could be used to turn a smart home gadget or mobile device into a surveillance tool. Ambient light sensors measure light in an environment and automatically adjust a screen's brightness to make it more usable in different conditions. But because ambient light data isn't considered to be sensitive, these sensors automatically have certain permissions in an operating system and generally don't require specific approval from a user to be used by an app. As a result, the researchers point out that bad actors could potentially abuse the readings from these sensors without users having recourse to block the information stream.

23andMe Failed to Detect Account Intrusions for Months

A California teenager who allegedly used the handle Torswats to carry out a nationwide swatting campaign is being extradited to Florida to face felony charges, WIRED has learned.

For more than a year, the United States Federal Bureau of Investigation has been hunting the person whom experts say is one of the most prolific swatters in American history. Law enforcement now believes they have finally arrested the person responsible.

A 17-year-old from California is allegedly the swatter known as Torswats, according to sources familiar with the investigation. The teenager is currently in custody and awaiting extradition from California to Seminole County, Florida. The Florida State Attorney’s Office tells WIRED that he faces four felony counts.

Seminole County, located in central Florida, had two high-profile swatting incidents within the last 12 months, including one targeting a mosque and another targeting a courthouse. Todd Brown, a spokesperson for Florida’s Office of the State Attorney in the 18th Circuit, confirmed the charges against the teen and his extradition. Brown says he will be prosecuted as an adult under Florida law. WIRED is withholding the 17-year-old’s name because he is a minor.

The teenager’s arrest comes in the midst of a nationwide swatting surge. Swatting attacks typically involve someone calling in fake attacks to 911 in an attempt to solicit an overwhelming police response. Since Christmas, swatters have targeted the homes of prominent politicians from both parties, judges handling cases involving former US president Donald Trump, and the director of the US Cybersecurity and Infrastructure Security Agency.

Prior to these high-profile swats, a relentless campaign from different, potentially foreign, swatting groups targeted hundreds of schools and universities around the US over the past year and a half. Last May, an officer in Danvers, Massachusetts, accidentally fired his service weapon while responding to a school swat. In February, an officer in Saginaw Township, Michigan, rammed his vehicle through the school’s locked door to get inside the building following a swatting call.

According to the Florida State Attorney’s Office, the charges against the California teenager include making false reports concerning the planting of a bomb or the use of firearms, causing a law enforcement response. All charges are described as related to acts of terrorism and showing prejudice based on race, color, ancestry, ethnicity, or religion.

In private Telegram chats witnessed by WIRED over the past year, a person operating the Torswats handle claimed responsibility for hundreds of false reports of bomb threats and active shootings called into schools, politicians’ homes, courthouses, and religious institutions around the US.

Brad “Cafrozed” Dennis, a private investigator who works for high-profile Twitch streamers who've been swatted, has been hunting Torswats for nearly two years and actively helping the FBI’s investigation. “It’s a beautiful day,” Dennis says. “I am very relieved Tor will no longer be able to conduct his reign of terror on our schools and public officials just doing their jobs.”

According to records shared with WIRED, Dennis engaged someone using the Torswats handle on a peer-to-peer chatting service called Tox under the guise of ordering a swat in December 2022. By recording his network traffic, the investigator surreptitiously captured the swatter’s IP address along with a username that at the time was unknown to law enforcement. According to Dennis, in January 2023, he handed the evidence to the FBI special agents in charge of Torswats’ case. In emails shared with WIRED, the FBI told Dennis this information was used in subpoenas sent to YouTube and Discord. Court records related to the case against the California teen have not yet been made public.

Police Arrest Teen Said to Be Linked to Hundreds of Swatting Attacks

US spy agencies purchased Americans’ phone location data and internet metadata without a warrant but only admitted it after a US senator blocked the appointment of a new NSA director.

United States officials fought to conceal details of arrangements between US spy agencies and private companies tracking the whereabouts of Americans via their cell phones. Obtaining location data from US phones normally requires a warrant, but police and intelligence agencies routinely pay companies instead for the data, effectively circumventing the courts.

Ron Wyden, the US senator from Oregon, informed the nation’s intelligence chief, Avril Haines, on Thursday that the Pentagon only agreed to release details about the data purchases, which had always been unclassified, after Wyden hindered the Senate's efforts to appoint a new director of the National Security Agency. “The secrecy around data purchases was amplified,” Wyden wrote, “because intelligence agencies have sought to keep the American people in the dark."

Wyden's office says it’s been investigating sales of location data to the government for years, uncovering multiple ties between the Department of Defense and what the senator refers to as “shady companies" committing “flagrant violations” of people's privacy. The companies' practices are “not just unethical, but illegal,” he says.

Pentagon offices known to have purchased location data from these companies include the Defense Intelligence Agency and the NSA, among others. Wyden's letter, first reported by _The New York Times_, indicates that the NSA is also “buying Americans' domestic internet metadata.”

Wyden's disclosure comes amid a fight in the US House of Representatives over efforts to outlaw the purchases entirely. Last month, members of the House Judiciary Committee attached legislation doing so, known as the _Fourth Amendment Is Not For Sale Act_, to a bill reauthorizing a contentious surveillance program known as Section 702.

The bill, originally coauthored by Wyden, nearly received a vote last month during a showdown with rival legislation introduced by the House Intelligence Committee that does not seek to ban the purchases. Congressional sources tell WIRED the vote was called off at the last minute after Biden administration officials and members of the intelligence committee staged a campaign against the privacy-enhancing measures.

Intelligence officials in the House held separate meetings with members and their aides aiming to discourage support for the judiciary bill—the _Protect Liberty Act_—alleging that new warrant requirements would be overly burdensome for law enforcement, despite a slew of exemptions for cyberwarfare, terrorism, and espionage threats.

Six sources who attended the meetings told WIRED that intelligence committee members used images of Hamas militants in presentations to drive home its argument for relaxing limits on domestic surveillance. The message, Republican aides said, was, “it could happen here.” Three Democrats who attended meetings with representatives from the FBI, CIA, and NSA, among other agencies, described the presentation as a “scare tactic.”

The home surveillance debate, which has exploded in recent months, hampering the passing of routine legislation, has largely focused on Section 702, an authority under which the government monitors the calls, texts, and emails of foreign nationals. Section 702 is set to expire in under four months.

Both the _Protect Liberty Act_ and its intelligence committee rival—the _FISA Reform and Reauthorization Act_—aim to reauthorize Section 702 into the future. In how that's accomplished the bills are radically different. With access by the FBI to foreign intelligence for domestic investigations being the biggest point of contention, federal lawmakers can now effectively be divided into two factions: people who support surveillance warrants and people who don't.

The pro-warrant _Protect Liberty Ac_t could receive a vote as early as next month, with its provisions banning the government from buying data as a means of evading warrant requirements. Republicans on the Hill say they can't be sure whether House Speaker Mike Johnson will allow a vote, however, due to the intense amount of pressure he faces from the intelligence system.

“There is a lot of baloney going around about surveillance reform," Wyden says. “Probably because some surveillance supporters are worried they won’t win an honest debate.”

The Pentagon Tried to Hide That It Bought Americans’ Data Without a Warrant

Newly disclosed breaches of Microsoft and Hewlett-Packard Enterprise highlight the persistent threat posed by Midnight Blizzard, a notorious Russian cyber-espionage group.

Microsoft and Hewlett-Packard Enterprise (HPE) both recently disclosed that they suffered corporate email breaches at the hands of Russia's “Midnight Blizzard” hackers.

The group, which is tied to the Kremlin's SVR foreign intelligence, is specifically linked to SVR's APT 29 Cozy Bear, the gang that meddled in the United States 2016 presidential election, has conducted aggressive government and corporate espionage around the world for years, and was behind the infamous 2021 SolarWinds supply chain attack. While both HP's and Microsoft's breaches came to light within days of each other, the situation mainly illustrates the ongoing reality of Midnight Blizzard's international espionage activities and the lengths it will go to to find weaknesses in organizations' digital defenses.

“We shouldn't be surprised that Russian intelligence-backed threat actors, and SVR in particular, are targeting tech companies like Microsoft and HPE. With organizations that size, it would be a much bigger surprise to learn they weren't,” says Jake Williams, a former US National Security Agency hacker and current faculty member at the Institute for Applied Network Security.

HP Enterprise said in a US Securities and Exchange Commission submission posted on Wednesday that Midnight Blizzard gained access to its “cloud-based email environment” last year. The company first learned about the situation on December 12, 2023, but said that the attack began in May 2023. Hackers “accessed and exfiltrated data … from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions,” the company wrote in the SEC filing. HP Enterprise said the breach likely came about as the result of another incident, discovered in June 2023, in which Midnight Blizzard also accessed and exfiltrated company “SharePoint” files beginning as early as May 2023. SharePoint is a much-targeted cloud collaboration platform made by Microsoft that integrates with Microsoft 365.

“The accessed data is limited to information contained in the HPE users’ email boxes,” HP Enterprise spokesperson Adam Bauer told WIRED in a statement. “We continue to investigate and analyze these mailboxes to identify information that could have been accessed and will make appropriate notifications as required.”

Meanwhile, Microsoft said on Friday that it detected a system intrusion on January 12 tied to a November 2023 breach. The attackers targeted and compromised some historic Microsoft system test accounts that then allowed them to access “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” From there the group was able to exfiltrate “some emails and attached documents.” Microsoft noted in its disclosure that the attackers appeared to be seeking information about Microsoft's investigations and knowledge of Midnight Blizzard itself.

“The attack was not the result of a vulnerability in Microsoft products or services. To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems,” the company wrote in its disclosure. “This attack does highlight the continued risk posed to all organizations from well-resourced nation-state threat actors like Midnight Blizzard.”

In an August 2022 report from the threat intelligence firm Mandiant, incident response leader Doug Bienstock wrote that the firm “continues to identify APT29 operations targeting the United States' (US) interests, and those of NATO and partner countries.” He noted that even though the hacking group is widely known, it has continued to be “extremely prolific” and returns to target certain victims multiple times over months or even years. “This persistence and aggressiveness are indicative of sustained interest in this information and strict tasking by the Russian Government,” Bienstock wrote, adding, “Mandiant has observed APT29 continue to demonstrate exceptional operational security and advanced tactics targeting Microsoft 365.”

While Midnight Blizzard is far from a new threat, researchers point out that it's always productive to have renewed attention on the issue of persistent state-backed espionage. Williams, of the Institute for Applied Network Security, also highlights the hackers' counterintelligence goals in the recent Microsoft breach—that Midnight Blizzard appeared to be specifically interested in learning what company executives know about their group and methods.

"I'm not surprised that the threat actors were observed looking for what information Microsoft had on them,” Williams says. “But it's a great piece of evidence to remind us that threat actors are regularly monitoring our own investigative efforts as defenders.”

Big-Name Targets Push Midnight Blizzard Hacking Spree Back Into the Limelight

From repeatedly crippling thousands of gas stations to setting a steel mill on fire, Predatory Sparrow’s offensive hacking has now targeted Iranians with some of history's most aggressive cyberattacks.

About eight minutes after 3 am on June 27, 2022, inside the Khouzestan steel mill near Iran's western coastline on the Persian Gulf, a massive lid lowered onto a vat of glowing, molten metal. Based on footage from a surveillance camera inside the plant, the giant vessel was several times taller than the two workers in gray uniforms and hardhats standing nearby, likely large enough to carry well over a hundred tons of liquid steel heated to several thousand degrees Fahrenheit.

In the video, the two workers walk out of frame. The clip jump-cuts forward 10 minutes. Then suddenly, the giant ladle is moving, swinging steadily toward the camera. A fraction of a second later, burning embers fly in all directions, fire and smoke fill the factory, and incandescent, liquid steel can be seen pouring freely out of the bottom of the vat onto the plant floor.

Written across the bottom of the video is a kind of disclaimer from Predatory Sparrow, the group of hackers who took credit for this cyber-induced mayhem and posted the video clip to their channel on the messaging service Telegram: “As you can see in this video,” it reads, “this cyberattack has been carried out carefully so to protect innocent individuals.”

A close watch of the video, in fact, reveals something like the opposite: Eight seconds after the steel mill catastrophe begins, two workers can be seen running out from underneath the ladle assembly, through the shower of embers, just feet away from the torrent of flaming liquid metal. “If they were closer to the ladle egress point, they would have been cooked,” says Paul Smith, the chief technology officer of industrial-focused cybersecurity firm SCADAfence, who analyzed the attack. “Imagine getting hit by 1,300-degrees-Celsius molten steel. That's instant death.”

A clip from a video posted by Predatory Sparrow hacker group showing the effects of its cyberattack on Khouzestan steel mill in Iran. Although the group claims in the video’s text to have taken care to protect “innocent individuals,” two steelworkers can be seen (circled in red) narrowly escaping the spill of molten metal and the resulting fire that the hackers triggered.

Predatory Sparrow via Telegram

The Khouzestan steel mill sabotage represents one of only a handful of examples in history of a cyberattack with physically destructive effects. But for Predatory Sparrow, it was just a part of a years-long career of digital intrusions that includes several of the most aggressive offensive hacking incidents ever documented. In the years before and after that attack—which targeted three Iranian steelworks, though only one intrusion successfully caused physical destruction—Predatory Sparrow crippled the country's railway system computers and disrupted payment systems across the majority of Iran's gas station pumps not once but twice, including in an attack last month that once again disabled point-of-sale systems at more than 4,000 gas stations, creating a nationwide fuel shortage.

In fact, Predatory Sparrow, which typically refers to itself in public statements by the Farsi translation of its name, Gonjeshke Darande, has been tightly focused on Iran for years, long before Israel's war with Hamas further raised tensions between the two countries. Very often the hackers target the Iranian civilian population with disruptive attacks that follow Iran's own acts of aggression through hacking or military proxies. The latest gas station attack, for instance, came after Iran-linked hackers compromised Israeli-made equipment at water utilities around the world and Iran-backed Houthi rebels launched missiles at Israel and attacked shipping vessels in the Red Sea. “Khamenei!” Predatory Sparrow wrote in Farsi on its Twitter feed, addressing Iran's supreme leader. “We will react against your evil provocations in the region.”

While Predatory Sparrow maintains the veneer of a hacktivist group—often affecting the guise of one that is itself Iranian—its technical sophistication hints at likely involvement from a government or military. US defense sources speaking to _The New York Times_ in 2021 linked the hackers to Israel. Yet some cybersecurity analysts who track the group say that even as it carries out attacks that fit most definitions of cyberwar, one of its hallmarks is restraint—limiting the damage it could cause while demonstrating it could have achieved more. Attempting to achieve an _appearance_ of restraint, at least, might be more accurate: The physical endangerment of at least two Khouzestan staffers in its steel mill attack represents a glaring exception to its claims of safety.

Predatory Sparrow is distinguished most of all by its apparent interest in sending a specific geopolitical message with its attacks, says Juan Andres Guerrero-Saade, an analyst at cybersecurity firm SentinelOne who has tracked the group for years. Those messages are all variations on a theme: If you attack Israel or its allies, we have the ability to deeply disrupt your civilization. “They're showing that they can reach out and touch Iran in meaningful ways,” Guerrero-Saade says. “They're saying, ‘You can prop up the Houthis and Hamas and Hezbollah in these proxy wars. But we, Predatory Sparrow, can dismantle your country piece by piece without having to move from where we are.’”

Here's a brief history of Predatory's short but distinguished track record of hyper-disruptive cyberattacks.

2021: Train Chaos

In early July of 2021, computers showing schedules across Iran's national railway system began to display messages in Farsi declaring the message “long delay because of cyberattack,” or simply “canceled,” along with the phone number of the office of Iran's Supreme Leader Ali Khamenei, as if to suggest that Iranians call the number for updates or to complain. SentinelOne's Guerrero-Saade analyzed the malware used in the attack, which he dubbed Meteor Express, and found that the hackers had deployed a three-stage wiping program that destroyed computers' file systems, locked out users, and then wiped the master boot record that machines use to locate their operating system when they start up. Iran's Fars radio station reported that the result of the cyberattack was “unprecedented chaos,” but it later deleted that statement.

Around the same time, computers across the network of Iran's Ministry of Roads and Urban Development were hit with the wiper tool, too. Analysis of the wiper malware by Israeli security firm CheckPoint revealed that the hackers had likely used different versions of the same tools years earlier while breaking into Iran-linked targets in Syria, in those cases under the guise of a hacker group named for the Hindu god of storms, Indra.

“Our goal of this cyber attack while maintaining the safety of our countrymen is to express our disgust with the abuse and cruelty that the government ministries and organizations allow to the nation,” Predatory Sparrow wrote in a post in Farsi on its Telegram channel, suggesting that it was posing as an Iranian hacktivist group as it claimed credit for the attacks.

2021: Gas Station Paralysis

Just a few months later, on October 26, 2021, Predatory Sparrow struck again. This time, it targeted point-of-sale systems at more than 4,000 gas stations across Iran—the majority of all fuel pumps in the country—taking down the system used to accept payment by gasoline subsidy cards distributed to Iranian citizens. Hamid Kashfi, an Iranian emigré and founder of the cybersecurity firm DarkCell, analyzed the attack but only published his detailed findings last month. He notes that the attack's timing came exactly two years after the Iranian government attempted to reduce fuel subsidies, triggering riots across the country. Echoing the railway attack, the hackers displayed a message on fuel pump screens with the Supreme Leader's phone number, as if to blame Iran's government for this gas disruption, too. “If you look at it from a holistic view, it looks like an attempt to trigger riots again in the country,” Kashfi says, “to increase the gap between the government and the people and cause more tension.”

The attack immediately led to long lines at gas stations across Iran that lasted days. But Kashfi argues that the gas station attack, despite its enormous effects, represents one where Predatory Sparrow demonstrated actual restraint. He inferred, based on detailed data uploaded by Iranian incident responders to the malware repository VirusTotal, that the hackers had enough access to the gas stations' payment infrastructure to have destroyed the entire system, forcing manual reinstallation of software at gas stations or even reissuing of subsidy cards. Instead, they merely wiped the point-of-sale systems in a way that would allow relatively quick recovery.

Predatory Sparrow even went so far as to claim on its Telegram account that it had emailed the vendor for the point-of-sale systems, Ingenico, to warn the company about an unpatched vulnerability in its software that could have been used to cause more permanent disruption to the payment system. (Curiously, an Ingenico spokesperson tells WIRED its security team never received any such email.)

Predatory Sparrow also wrote on Telegram that it had sent text messages to Iran's civilian emergency services, posting screenshots of its warnings to those emergency services to fuel up their vehicles prior to the attack. “You don't see that often, right?” Kashfi says. “They chose to do very clean, controlled damage.”

2022: Steel Mill Meltdown

In June of 2022, Predatory Sparrow carried out one of the most brazen acts of cybersabotage in history, triggering the spillage of molten steel at Iran's Khouzestan steel mill that caused a fire in the facility.

To prove that it had carried out the attack and had not merely claimed credit for an unrelated industrial accident, the hackers posted a screenshot to Telegram of the so-called human-machine interface, or HMI software, that the steelworks used to control its equipment. Paul Smith, the SCADAfence CTO who investigated the incident, quickly found a page on the website of the Iranian IT firm Irisa that listed the Khouzestan steel mill as one of its projects, matching the Irisa logo on the HMI screenshot.

Smith says he also found that both the HMI software and the surveillance camera that Predatory Sparrow used to record a video of its attack were connected to the internet and discoverable on Shodan, a search engine that catalogs vulnerable internet-of-things devices. Smith, who has a background working in steel mills, theorizes that the attack's damage was caused when the hackers used their access to the HMI to bypass a “degassing” step in the steel refining process that removes gases trapped in molten steel, which can otherwise cause explosions. He speculates that it was exactly that sort of explosion of gases trapped in the molten steel that caused the ladle to move and pour its contents on the factory floor.

A still from Predatory Sparrow’s video shows the Khouzestan steel mill prior to the hackers’ cyberattack…

Predatory Sparrow via Telegram

..then after the attack begins, as embers, fire and smoke fill the factory…

Predatory Sparrow via Telegram

…caused by a spill of burning liquid steel onto the factory floor, visible here.

Predatory Sparrow via Telegram

Predatory Sparrow touted in its video, which it posted to Telegram, that it had carried out the attack “carefully so to protect innocent individuals,” suggesting that it had monitored the surveillance footage to make sure no humans were in danger. Smith doesn't buy that claim. Even beyond the two Iranian steelworkers forced to run through flying embers, feet away from burning liquid metal, he argues that the viewer can't see who else might have been in harm's way. “You don't know if anyone was hurt,” Smith says.

The Khouzestan steel mill was just one of three steel facilities that Predatory Sparrow breached in its intrusions, though those operations weren't solely targeted at physical sabotage. A week later, the group also began to post tens of thousands of stolen emails from the three steel facilities—all of which faced Western sanctions—designed to demonstrate their ties to the Iranian military.

2023: Gas Station Paralysis, Redux

With tensions rising across the Middle East following Hamas' October 7 attacks in southern Israel and Israel's overwhelming military response in the Gaza Strip, perhaps it was inevitable that Predatory Sparrow would play a role in that burgeoning conflict. As Iran-backed Houthi rebels began to blockade shipping in the Red Sea—and as an Iran-linked hacker group calling itself CyberAveng3rs hacked water utilities across the US with anti-Israel messages—the group staged a December 18 rerun of its 2021 gas station attack, crippling point-of-sale systems at pumps at the majority of the country's filling stations.

While technical details of this latest attack are still scant, DarkCell's Hamid Kashfi says it appears to follow the same playbook as the 2021 hacking incident, albeit likely exploiting different security vulnerabilities in the equipment. Again, Predatory Sparrow posted messages it claimed to have sent to Iranian emergency services ahead of the disruption, in an attempt to limit harm. “As in our previous operations, this cyberattack was conducted in a controlled manner while taking measures to limit potential damage to emergency services,” reads a message from the group on Telegram.

Yet again, Predatory Sparrow also made clear its hacking was intended to carry a message. “This cyberattack comes in response to the aggression of the Islamic Republic and its proxies in the region,” another of the group’s messages reads. “Khamenei, playing with fire has a price.”

SentinelOne’s Guerrero-Saade argues that actions like the gas station cyberattacks suggest that Predatory Sparrow may be the first effective example of what cyber policy wonks refer to as “signaling”—using cyberattack capabilities to send messages designed to deter an adversary's behavior. That's because, he says, the group has combined a relatively restrained and discriminating approach to its politically motivated hacking with a clear demonstration of willingness to use its capabilities for broad effects—a willingness, he points out, that the United States’ hacking agencies, like the National Security Agency and Cyber Command, have often lacked.

“There’s no such thing as effective signaling if you can’t show credibly to the other person that not only do you _have_ the capability, but that you’re willing to use it,” Guerrero-Saade says.

Some cybersecurity researchers point to Predatory Sparrow, too, as a model of more responsible cyberwarfare, with a more careful regard for civilians. In the wake of the Israeli military’s killing of tens of thousands of Palestinian civilians and the displacement of millions more in its response to Hamas' October 7 massacre, however, any suggestion of restraint or discrimination from a hacker group that likely has Israeli government ties warrants skepticism.

Guerrero-Saade himself admits that the steel mill attack video, and in particular the two Iranian staffers’ apparent close call with death captured in it, raises questions of the cost of Predatory Sparrow’s “careful” style of attack.

“Is it perfect? Is it without casualties or concerns? Not at all,” Guerrero-Saade says. “I’m not saying I support it. But I am fascinated by it.”

How a Group of Israel-Linked Hackers Has Pushed the Limits of Cyberwar

The Amazon-owned home surveillance company says it is shuttering a feature in its Neighbors app that allows police to request footage from users. But it’s not shutting out the cops entirely.

Reached for comment, Markey’s office directed WIRED to the senator’s statement posted to X, in which he called the shuttering of the RFA tool “good.”

“I’ve been sounding the alarm for years on Amazon Ring’s privacy and security failures,” Markey added. “We cannot allow Americans' home security systems to become surveillance tools for law enforcement. We have to prevent Big Tech's web of surveillance systems from growing.”

Evan Greer, director of civil liberties advocacy group Fight for the Future and a vocal critic of Ring, called the company's decision today an “unequivocal victory” for those who have campaigned against the company’s surveillance network, but added in their statement that the move “only scratches the surface of addressing the harm done by Ring's dystopian business model.”

“We need laws. Local, state, and federal elected officials should ban these types of private surveillance partnerships entirely, and should impose strict limits on where homeowners and businesses can place cameras to ensure they are not violating their neighbors’ privacy and rights,” Greer said.

Ring’s Yarger tells WIRED that the decision to shut down the RFA tool was “purely internal” and cited that the company recently hired a new CEO, Liz Hamren, who took over in March 2023. “As you may know, we have a new Ring CEO and leader,” Yarger says. “As we look to the future of Neighbors, we’re focusing our resources on delivering new product and app experiences that we feel are a better fit with Ring’s vision and can better empower our customers to connect with each other, and stay informed by local government and public safety agencies.”

This shift, according to the company’s announcement today, includes the launch of “Ring Moments,” which encourages users to share content that inspires “joy and hope,” such as a video of a bear in a swimming pool or neighbors helping each other shovel snow.

For Ring users still concerned about police overreach, EFF’s Guariglia notes that there are several actions you can take, including enabling end-to-end encryption on your devices. “Be mindful of what your camera is pointed at and what video and audio it may collect from yourself, your family, and your neighbors,” he tells WIRED. “If possible, try to clear your camera’s recorded video/audio as often as is feasible. And most importantly, if police come and ask for your footage, request that they get a warrant.”

Ring Will Stop Giving Cops a Free Pass on Warrantless Video Requests

NSO Group, creator of the infamous Pegasus spyware, is spending millions on lobbying in Washington while taking advantage of the crisis in Gaza to paint itself as essential for global security.

On New Year’s Eve, NSO Group—the Israel-based company behind the Pegasus spyware, one of the world’s most sophisticated cyberweapons—quietly released a new transparency report.

The 27-page document is carefully worded—even apologetic—and is intended to demonstrate resilience, progress, and responsibility to further strengthen the company’s human rights compliance program. It claims the company has “opened 19 investigations into allegations of potential product misuse,” which resulted in the “suspension or termination” of six customer accounts. The document even has a dedicated section on journalists, a significant group among as many as 50,000 people worldwide who’ve been targeted by Pegasus, a list that also includes activists, heads of state, and other public figures in more than 50 countries.

NSO Group’s new transparency report—its first in more than two years—arrives amid an apparent push by the spyware vendor to revamp its tarnished image and reverse US regulations that have damaged its business. To achieve its goal, the cyber-intelligence firm is conducting a multimillion-dollar lobbying campaign that attempts to position the company’s spyware as essential for global security.

While an NSO spokesperson tells WIRED that the report “underscores the company’s ongoing commitment to human rights and adherence to ethical standards, while enabling its clients to keep the public safe,” those who have investigated the company’s practices express skepticism about its claims.

“It’s not a transparency report in any meaningful way,” says David Kaye, a University of California, Irvine law professor who has scrutinized the company’s policies as the United Nations special rapporteur on the promotion and protection of the right to freedom of opinion and expression. “It mainly repackages preexisting defenses and statements that NSO Group has put forward to promote its work and brand itself within the commercial spyware sector.”

NSO Group has only published one other transparency report, in June 2021, which civil society largely regarded as a missed opportunity to provide meaningful information about the alarming human rights impacts of its products. The latest transparency report arrives after several bumpy years for the company. In the aftermath of the 2021 Pegasus revelations, the United States government placed the spyware vendor on an Entity List in November 2021, meaning it cannot receive American investment without specific government approval. Subsequently, the company reportedly went into financial freefall, narrowly avoiding defaulting on $500 million in debt. According to Bloomberg, NSO management considered selling the business.

In August 2022, then CEO Shalev Hulio stepped down, naming COO Yaron Shohat as a successor while laying off 100 employees. Following a forced restructuring by its lenders, cofounder Omri Lavie emerged—via the Luxembourg-based Dufresne Holdings—as NSO’s new owner in May 2023. Amid this upheaval, US president Joe Biden issued an executive order, in March 2023, that prohibits federal departments and agencies from using commercial spyware. In June 2023, the White House issued a warning to US firms interested in acquiring NSO assets on the grounds that doing so could pose a counterintelligence threat to the US government.

Then Hamas attacked Israel. Since then, NSO has been in a position to tangibly demonstrate the value of tools like Pegasus in conflict situations. According to press reports, the cyber-intelligence firm has volunteered—along with Candiru, an NSO competitor that’s also blacklisted by the US—to help Israel’s security services track people kidnapped by Hamas.

“People from the government—both in Israel and outside of Israel—now understand much better why they are needed,” an insider with direct overview of NSO’s operations reportedly told Axios in November.

By seizing that opportunity, NSO appears to be trying to rebrand itself as being on the side of the “good guys,” make inroads with the Biden administration, and ultimately reverse the ban on its products. To succeed in its image-rehabilitation efforts, the spyware vendor has enlisted multiple public affairs consultancies and law firms, including government relations firm Chartwell Strategy Group and law firms Paul Hastings LLP, Steptoe, and Pillsbury Winthrop Shaw Pittman, according to lobbying disclosure documents. In the past three years, NSO had also enlisted the services of Bluelight Strategies and Cherie Blair’s Omnia Strategy in the UK.

“NSO Group engaged multiple firms, which is not uncommon but can be a reflection of the complexity of its influence efforts,” says Anna Massoglia, a researcher at the nonprofit OpenSecrets, which tracks US political spending. According to an OpenSecrets analysis of Lobbying Disclosure Act and Foreign Agents Registration Act filings, NSO has spent a total of $3.1 million in lobbying Washington since 2020. Of that, at least $897,000 was spent in 2023 alone, with payments for the final months of the year still being reported.

The lobbying efforts have primarily focussed on pro-Israel Republicans—but not exclusively. “Foreign agents working for NSO Group have also recently reported contacting officials at the Executive Office of the President and Congress as part of these efforts,” says Massoglia.

On November 7, Paul Hastings LLP sent a letter on behalf of NSO to request an urgent meeting with US secretary of state Antony Blinken and other State Department officials, emphasizing that “the ongoing security situation in Israel and the Middle East—and worldwide—once again highlight the necessity and urgency of employing cyber intelligence technology.”

So far, NSO’s efforts to fall back into Washington’s good graces appear to have had little effect. “Despite their pressure, these campaigns have only had varying influence,” says Steven Feldstein, a senior fellow at the Carnegie Endowment for International Peace. “The harms from spyware are well known, and there are only so many ways companies can spin the benefits of software that is inherently intrusive and rights-violating.”

According to a senior Biden administration official who spoke to Politico in November, any changes to the US government’s sanction policy on NSO Group are unlikely. “Without a change to this rule, NSO’s future \[US\] market potential is very, very constrained,” says Feldstein. Still, NSO needs to invest in lobbying, public relations, and transparency exercises to carry on doing business globally.

“NSO’s business model depends on chasing new customers and proliferating spyware for profit. That’s the growth model, and it will inevitably put spyware in the hands of abusers. And they show no signs of abandoning it,” says John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab who has been instrumental in exposing NSO Group’s products. “By the way, the last time NSO published a transparency report, it was followed by years of abuse scandals.”

While in the US, the Entity List “has sent shivers to larger spyware companies regarding potential consequences for bad behavior,” Feldstein says that there are ways to get around it, such as by working exports through Europe and other countries with more lax export control rules. For example, Cyprus is the only member of the EU that does not participate in the Wassenaar Arrangement, a multilateral export control regime signed by 42 countries that aims to control the sale of arms and technologies including spyware.

Weak legislation at the EU level also allows spyware to spread. The European Media Freedom Act (EMFA), which passed a preliminary vote in December, clearly states that EU member states may deploy spyware under certain conditions. Digital rights defenders have stressed that the retention of the national security exemption in the provisional agreement text enables EU governments to potentially deploy spyware against journalists outside the protective framework of EU law.

“EMFA is not perfect, but it at least tries to limit the deployment of such tools,” EU lawmaker Hannah Neumann tells WIRED. She adds that many members of the European Parliament’s inquiry committee on spyware, of which she was also part, “were frustrated” that the European Commission has not put forward a legislative proposal on how to fix loopholes.

Worth an estimated $12 billion as of 2022, the global spyware industry is likely to continue to do everything it can to stay in business. “As pressure has grown to curtail spyware companies, this has caused them to push even harder to maintain their markets,” says Carnegie’s Feldstein.

Even if high-profile firms like NSO Group were put out of business—admittedly an unlikely outcome—this would still not shut down the spyware market. Feldstein believes that this would instead hasten decentralization and increase opportunities for boutique firms to fill in the gap. “As long as the demand and money are there,” he says, “firms will seek these contracts.”

Source

Wired