Plus: Mozilla fixes two high-severity bugs in Firefox, Citrix fixes a flaw that was used to attack a US-based critical infrastructure organization, and Oracle patches over 500 vulnerabilities.

CVE-2023-26083 is an issue in Arm Mali GPU driver for Bifrost, Avalon, and Valhall chips, rated as having a moderate impact. The vulnerability was used to deliver spyware to Samsung devices in December 2022.

CVE-2021-29256 is a high-severity flaw that also impacts Bifrost and Midgard Arm Mali GPU kernel drivers.

The Android updates have already reached Google’s Pixel devices and some of Samsung’s Galaxy range. Given the severity of this month’s bugs, it’s a good idea to check whether the update is available and install it now.

Google Chrome 115

Google has issued the Chrome 115 update for its popular browser, fixing 20 security vulnerabilities, four of which are rated as having a high impact. CVE-2023-3727 and CVE-2023-3728 are use-after-free bugs in WebRTC. The third flaw rated as having a high severity is CVE-2023-3730, a use-after-free vulnerability in Tab Groups, while CVE-2023-3732 is an out-of-bounds memory access bug in Mojo.

Six of the flaws are listed as having a medium severity, and none of the vulnerabilities are known to have been used in real-life attacks. Even so, Chrome is a highly targeted platform, so check your system for updates.

Firefox 115

Hot on the heels of Chrome 115, rival browser Mozilla has released Firefox 115, fixing several flaws it rates as having high severity. Among these are two use-after-free bugs tracked as CVE-2023-37201 and CVE-2023-37202.

The privacy-conscious browser maker also fixed two memory safety bugs tracked as CVE-2023-37212 and CVE-2023-37211. The memory safety flaws are present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12, Mozilla said in an advisory, adding: “Some of these bugs showed evidence of memory corruption, and we presume that with enough effort some of these could have been exploited to run arbitrary code.”

Citrix

Enterprise software giant Citrix has issued an update warning after fixing multiple flaws in its NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) tools, one of which has already been used in attacks.

Tracked as CVE-2023-3519, the already exploited flaw is an unauthenticated remote code execution vulnerability in NetScaler ADC and NetScaler Gateway that’s so severe it’s been given a CVSS score of 9.8. “Exploits of CVE-2023-3519 on unmitigated appliances have been observed,” Citrix said. “Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.”

The flaw was also the subject of an advisory from the US Cybersecurity and Infrastructure Security Agency (CISA), which warned that the bug was used in attacks on a critical infrastructure organization in June.

SAP

SAP, another enterprise software firm, has issued its July Security Patch Day, including 16 security fixes. The most severe flaw is CVE-2023-36922, an OS command injection vulnerability with a CVSS score of 9.1.

The bug allows an authenticated attacker to “inject an arbitrary operating system command into a vulnerable transaction and program,” security firm Onapsis said. “Patching is strongly recommended, since a successful exploit of this vulnerability has a high impact on confidentiality, integrity, and availability of the affected SAP system,” it warned.

Meanwhile, CVE-2023-33989 is a directory traversal vulnerability in SAP NetWeaver with a CVSS score of 8.7, and CVE-2023-33987 is a request smuggling and request concatenation vulnerability in SAP Web Dispatcher with a CVSS score of 8.6.

Oracle

Software company Oracle has released its July Critical Patch Update Advisory, fixing 508 vulnerabilities in its products. Among the fixes are 77 new security patches for Oracle Communications. Oracle warned that 57 of these vulnerabilities could be remotely exploited over a network without user credentials. One of the worst flaws is CVE-2023-20862, which has been given a CVSS score of 9.8.

Meanwhile, 147 of the Oracle patches were for Financial Services, and Fusion Middleware received 60 fixes.

Oracle said it continues to receive reports of attempts to exploit vulnerabilities it has already patched. In some cases, attackers were successful because targeted customers had failed to apply available Oracle patches, it said. “Oracle, therefore, strongly recommends that customers remain on actively supported versions and apply Critical Patch Update security patches without delay.”

Apple iOS, Google Android Patch Zero-Days in July Security Updates

Plus: Russia tightens social media censorship, new cyberattack reporting rules for US companies, and Google Street View returns to Germany.

Code used to encrypt sensitive radio communications around the world for years had major flaws that could be exploited by attackers, according to new research. Among the flaws: a secret backdoor.

A group of researchers from the Netherlands discovered multiple vulnerabilities in encryption algorithms used in the European radio standard TETRA, which is used in radio communications by police, critical infrastructure workers, mass transit and freight trains, and major government bodies. While the TETRA standard is public, the ciphers used to encrypt the communications were kept secret. One of the algorithms, known as TEA1, had a feature that reduces its 80-bit encryption down to just 32 bits—a backdoor, the researchers say, that made it vulnerable to eavesdropping and potentially other attacks.

The body that develops and maintains TETRA—the European Telecommunications Standards Institute—rejects the “backdoor” label, saying that the weakened encryption was implemented to abide by encryption export controls in place when it was released in the 1990s. Regardless of what you call it, ETSI has released a replacement for the TEA1 algorithm and fixed another major flaw that made communications vulnerable to interception.

In the world of AI-fueled chatbots, security researchers warn that third-party plug-ins for ChatGPT’s paid version could add a layer of risk to users’ data and potentially be abused by attackers. OpenAI, the creator of ChatGPT, says it maintains high security standards for the plug-ins listed on its website. But ultimately, the choice to use a plug-in largely depends on whether you trust the developer who made it.

Even if you trust someone online, however, there’s no guarantee that they are who you think they are. This week, we detailed the saga of a Twitter user who thought he was buying a Macbook from someone he knew but ended up sending $1,000 to a scammer who used a hacked Twitter account to pull off the swindle. Threat researchers got involved and ultimately traced the scammers’ real-life identities, then handed over what they found to police.

Finally, in Washington, DC, the National Security Agency has been quietly pushing members of the US Congress to abandon an amendment to the “must-pass” National Defense Authorization Act (NDAA) that would prevent military intelligence agencies like the NSA for buying commercially available data on US citizens. Even if the NSA’s lobbying is successful, it may be forced to keep up the fight as separate legislation is making its way through Congress that would ban the purchase of sensitive data far more broadly than the NDAA amendment.

But that’s not all. Each week, we round up security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Despite being released in 2009, the classic title _Call of Duty: Modern Warfare 2_ is still popular with a dedicated group of fans. Hundreds are still playing the game online. But on July 26, Activision, the game's creator, announced it had taken the game on Steam offline while it was investigating “reports of an issue.” No further details were provided about the problem or why the game was pulled.

A report from TechCrunch sheds some possible light on the “issue.” _Call of Duty_ players on the old game are being hit with malware that automatically spreads through multiplayer lobbies, according to the publication. Gamers appear to have posted about the malware, finding links to it on online code repositories, and claim it spreads through lobbies from one infected player to another. One anonymous source from the gaming industry said the malware appeared to be a worm.

According to TechCrunch it is unclear why the malware is spreading or what exactly the impact is on gamers. Valve, the owner of Steam, did not comment on the issue, according to the news website.

Public companies in the United States will soon have to report data breaches and hacking incidents four days after they deem an incident to have a “material” impact on their business. On Wednesday, the US Securities and Exchange Commission voted to introduce the regulations that require firms to disclose cyberattacks once they have determined it will disrupt its operations or finances. The disclosures must detail the "nature, scope, and timing" of the attack, as well as the potential impact it will have on the firm.

Former SEC rules required companies to disclose cyber incidents but did not impose any strict timeline on doing so. This can lead to firms waiting weeks or months to notify customers and lawmakers about data breaches and cyberattacks. A separate part of the new SEC rules also requires companies to detail their processes for "assessing, identifying, and managing material risks," heaping extra public accountability on firms to make sure they're taking security issues seriously. The rules will go into effect by no later than December.

Since Vladimir Putin started his full-scale invasion of Ukraine in February 2022, Russia's internet censorship has become even more expansive. A new report this week from researchers at Citizen Lab, a research facility at the University of Toronto, shows how the country's censors have clamped down on the social network VK, which is similar to Facebook. Russia's government has been ordering VK to remove posts, videos, and accounts almost every day since the start of the war, the researchers found after reviewing court orders issued by the government.

There's been a thirtyfold increase in censorship since the start of the war, Citizen Lab researchers found. In total, 94,942 videos, 1,569 community accounts, and 787 personal accounts are blocked in Russia, which has clamped down on independent media and blocked social media such as Facebook and YouTube as it looks to control the information people read and access within its borders.

At the end of May, Progress Software, the owner of the file transfer service MOVEit, released a patch for a vulnerability being exploited by the Russia-based ransomware gang Clop. The vulnerability allowed the cybercriminals to access MOVEit and steal data—with the attack impacting both direct users of the sharing service and some companies’ suppliers and vendors.

Analysis of state breach notification, SEC filings, Clop's website, and public disclosures by cybersecurity firm Emisoft shows that, as of July 27, there are 518 reported victims. This includes more than 100 schools. And around 30 million individuals have had their data impacted, Emisoft says. Each day, the list of victims coming forward increases. Some of the most recent include Flutter, the owner of Poker Stars; Deloitte; Chuck E. Cheese; and US government service provider Maximus. More disclosures are expected.

More than a decade ago, Google faced a privacy backlash in Germany over its Google Street View cars taking pictures of people's homes and illegally collecting data from people's unsecured Wi-Fi networks. After 250,000 Germans told Google to blur pictures of their homes, and legal challenges, the company in 2011 stopped updating pictures of 20 major cities. That changed this week when Google announced that cars had been back in German cities since June and it is updating its images once again. “Times have changed,” Lena Heuermann, a Google spokesperson said, citing its own survey that 91 percent of respondents said they wanted Street View back in Germany. Hamburg's data protection regulator said that Google publishing pictures it takes in public is legal and that people can request their homes be blurred.

‘Call of Duty: Modern Warfare 2’ Players Hit With Worm Malware

The National Security Agency has urged top lawmakers to resist demands that it obtain warrants for sensitive data sold by data brokers.

An effort by United States lawmakers to prevent government agencies from domestically tracking citizens without a search warrant is facing opposition internally from one of its largest intelligence services.

Republican and Democratic aides familiar with ongoing defense-spending negotiations in Congress say officials at the National Security Agency (NSA) have approached lawmakers charged with its oversight about opposing an amendment that would prevent it from paying companies for location data instead of obtaining a warrant in court.

Introduced by US representatives Warren Davidson and Sara Jacobs, the amendment, first reported by WIRED, would prohibit US military agencies from “purchasing data that would otherwise require a warrant, court order, or subpoena” to obtain. The ban would cover more than half of the US intelligence community, including the NSA, the Defense Intelligence Agency, and the newly formed National Space Intelligence Center, among others.

The House approved the amendment in a floor vote over a week ago during its annual consideration of the National Defense Authorization Act, a “must-pass” bill outlining how the Pentagon will spend next year’s $886 billion budget. Negotiations over which policies will be included in the Senate’s version of the bill are ongoing.

In a separate but related push last week, members of the House Judiciary Committee voted unanimously to advance legislation that would extend similar restrictions against the purchase of Americans’ data across all sectors of government, including state and local law enforcement. Known as the “Fourth Amendment Is Not For Sale Act,” the bill will soon be reintroduced in the Senate as well by one of its original 2021 authors, Ron Wyden, the senator’s office confirmed.

“Americans of all political stripes know their Constitutional rights shouldn’t disappear in the digital age," Wyden says, adding that there is a “deep well of support” for enshrining protections against commercial data grabs by the government “into black-letter law.” 

The extent to which the NSA in particular uses data brokers to obtain location and web-browsing data is unclear, though the agency has previously acknowledged using data from “commercial” sources in connection with cyber defense. Regardless, the NSA’s lawyers have authored extensive guidelines for acquiring commercially available data, particularly when it belongs to US companies or individuals. Some of the rules prescribed by the agency’s lawyers remain classified.

The NSA did not respond to multiple requests for comment.

A government report declassified by the Office of the Director of National Intelligence last month revealed that US intelligence agencies were avoiding judicial review by purchasing a “large amount” of “sensitive and intimate information” about Americans, including data that can be used to trace people’s whereabouts over extended periods of time. The sensitivity of the data is such that “in the wrong hands,” the report says, it could be used to “facilitate blackmail,” among other undesirable outcomes. The report also acknowledges that some of the data being procured is protected under the US Constitution’s Fourth Amendment, meaning the courts have ruled that government should be required to convince a judge the data is linked to an actual crime.

The US Supreme Court has previously ordered the government to obtain search warrants before seeking information that may “chronicle a person’s past movements through the record of his cell phone signals.” In the landmark _Carpenter v. United States_ decision, the court found that advancements in wireless technology had effectively outpaced people’s ability to reasonably appreciate the extent to which their private lives are exposed.

A prior ruling had held that Americans could not reasonably expect privacy in all cases while also voluntarily providing companies with stores of information about themselves. But in 2018 the court refused to extend that thinking to what it called a “new phenomenon”: wireless data that may be “effortlessly compiled” and the emergence of technologies capable of granting the government what it called “near perfect surveillance.” Because this historical data can effectively be used to “travel back in time to retrace a person’s whereabouts,” the court said, it raises “even greater privacy concerns” than devices that can merely pinpoint a person’s location in real time.

Crucially, the court also held that merely agreeing to let data be used “for commercial purposes” does not automatically abrogate people’s “anticipation of privacy” for their physical location. Rather than apply this view to location data universally, however, the government has allowed defense and intelligence agencies to assume a contradictory view, as their activities were not a factor in _Carpenter_’s law enforcement-focused ruling.

A growing number of American lawmakers have argued in recent weeks that the US intelligence community is itself more or less facilitating the erosion of that privacy expectation—that location data is protected from unreasonable government intrusion—mainly by ensuring it isn’t.

Andy Biggs, who chairs a subcommittee on federal government surveillance in the House of Representatives, says the federal government has “inappropriately collected and used Americans’ private information” for years. A whole range of agencies, including the Federal Bureau of Investigation and the Drug Enforcement Agency, have been exploiting “legal loopholes,” he says, to avoid oversight while amassing “endless amounts of data.”

A senior advisory group to the director of national intelligence, Avril Haines, the government’s top spy, stated in the report declassified last month that intelligence agencies were continuing to consider information “nonsensitive” merely because it had been commercially obtained. This outlook ignores “profound changes in the scope and sensitivity” of such information, the advisors warned, saying technological advancements had “undermined the historical policy rationale” for arguing that information that is bought may be freely used “without significantly affecting the privacy and civil liberties of US persons.”

Haines’ office did not respond to multiple requests for comment. In a statement last month, the director said she was working to implement key recommendations from her advisors and believed that Americans should be given “some sense” of the policies affecting the collection of their personal data. Much of the framework for dealing with commercial purchases by the intelligence community would be disclosed publicly when it is eventually finalized, she said.

The practice of paying businesses to spy on US citizens is one of several concerns lawmakers say they’ll be exploring this fall during what’s slated to be a long and heated debate over one of the government’s most powerful surveillance tools: Section 702 of the Foreign Intelligence Surveillance Act.

The Mozilla Foundation joined the chorus of civil society groups calling for reforms of the 702 program today, saying FISA’s current process is “overbroad” and “restricted only by weak legislation and executive orders that, experience has shown, do not create real accountability.”

The NSA Is Lobbying Congress to Save a Phone Surveillance 'Loophole'

After scammers duped a friend with a hacked Twitter account and a “deal” on a MacBook, I enlisted the help of a fellow threat researcher to trace the criminals’ offline identities.

Embarrassed, angry, victimized. That's just a few of the words my friend uses to describe his recent run-in with a cybercriminal that used a hacked Twitter account to scam people out of hundreds of dollars. Twitter, meanwhile, ignored his pleas for help. That’s when I got involved.

After Tim Utzig lost $1,000 to a fraudster who tricked him using a hacked Twitter account, I asked an expert in social engineering and hunting scammers to help. Ultimately, we tracked down the suspected culprits and identified a network of apparent scammers and money mules expertly swindling people out of their savings. This scamming saga shows how fraudsters use social media, build a network of people to operate different payment accounts, and apply effective techniques to bilk their victims.

It also shows the additional challenges that blind users like Utzig face on the internet and how they are at higher risk of exploitation by indiscriminate online criminals.

Inaccessible and Unacceptable

On May 23, Utzig realized he’d been scammed. He was gearing up for a journalism master’s program at the City University of London and happened to be in the market for a new laptop. By coincidence, someone using the Twitter account of longtime Baltimore sports reporter Roch Kubatko tweeted that they had a new Apple laptop for sale. Utzig trusted Kubatko, whom he’d previously met, and the tweet seemed innocent—and arrived at the perfect moment. So Utzig responded to the tweet with a DM.

Utzig uses a screen reader to navigate the internet and social media apps, including Twitter. A sighted person may have observed oddities in the initial tweet and profile, but the screen reader did nothing to alert Utzig about a key fact: Kubatko’s Twitter account had been hacked, and the person he was talking to wasn’t Kubatko.

“I feel like people with disabilities as a whole are more susceptible to online fraud—screen readers are just one of the methods used by a population who are visually impaired or blind to assist in using technology,” Utzig says. “You’re going to miss certain visual cues that might signify fraud, such as someone changing their profile picture to something different, and the screen reader won’t pick up on it.”

Screen readers also often don’t vocalize misspellings, inaudible grammatical errors, or typography such as fully capitalized words that a sighted person may see as suspicious. And the alternative text on image descriptions, which are manually applied by the individual sharing the content, is the only way a screen reader can describe an image.

Then there’s Twitter itself. Check marks are now effectively useless, especially if you’re blind. Since Twitter changed its verification system under Elon Musk’s ownership, the blue tick that used to be a reliable sign of identity can now be obtained by pretty much anyone. A screen reader will call the Twitter Blue check mark “verified” as before, but the blind user can no longer rely on it as much as they once did.

Recent moves by Twitter concern accessibility advocates. Last year, Twitter laid off its accessibility team, which was responsible for ensuring the platform was usable for people with disabilities, and restrictions on Twitter’s API broke some tools and resources used by blind people. These changes prompted the National Federation of the Blind to move away from Twitter and create a Mastodon server, which the group says is more friendly and accessible for blind users.

“You have people with disabilities scammed, and yet you laid off your whole accessibility team,” Utzig says. “It takes a team to maintain a safe and accessible platform for people with disabilities to use it.”

Then, to top it all off, Twitter is now rebranding as X, with the goal of creating an “everything app” that will apparently also process payments and serve as a “bank.” This, despite the fact that just two months before the X rebranding, the very same platform was being used to swindle people out of their hard-earned cash.

A $1,000 Loss

Courtesy of “Steve”

After a short conversation with not-Kubatko, the person controlling the account asked him for his phone number to send a payment request via Apple Pay. When Utzig followed up after making a payment, he realized the phone number had blocked his number.

Utzig quickly realized he had just paid $1,000 to a criminal. He then reported the account to Twitter. The company did not respond to his requests for help, and the account remained active for days after it was reported as hacked.

Utzig turned to the media for help and reached out to a local reporter. When a local Maryland news station contacted Twitter for comment, the company responded with the poop emoji, the response that press requests have been receiving since March 2023. Utzig says that response made the situation feel so much worse—not only had he lost a lot of money, but the platform he used and loved didn’t care at all about the serious personal and financial impact on its users who were victims of crime.

In the eight months since Musk bought Twitter in October 2022, the platform has increasingly been home to fraudulent accounts. Users across the site have reported a massive uptick in spammers and scammers tweeting, replying to users, and messaging them directly. There have also been multiple reported instances of hacked, high-profile accounts distributing fraudulent content.

Utzig says his DMs are filled with sketchy accounts either sending spam directly or trying to engage in conversation. The social engineering expert I contacted, who asked to use a pseudonym because they carried out this investigation outside their normal work duties, operates several Twitter accounts both for research and personal use. He—let’s call him Steve—says that in the past few months, the number of malicious accounts he observes on the platform has skyrocketed, especially accounts likely associated with pig butchering. This social engineering threat, which is used to drain people’s bank accounts through bogus investment advice, typically originates on social networks and messaging apps and was recently identified by the US Federal Bureau of Investigation as the most costly online threat, with users reporting billions of dollars in losses in 2022.

Social media fraud is part of an ecosystem of online crime that relies on social engineering and trust between users. There are many different kinds of fraud originating on social media, including pig butchering and other financial or cryptocurrency scams, romance scams, and consumer fraud like the kind Utzig experienced.

The attack that hit Kubatko appears similar to a series of related hacks that took over accounts of high-profile Twitter users, and which has been ongoing since at least January of this year. The scammers all used similar language and photos about offering laptops for sale. It is not clear whether the hacked accounts and related scams are all operated by the same people. A search of the language used in the tweet suggests the scammers are still active on the platform. Kubatko, who did not respond to WIRED's request for comment, eventually got his Twitter account back and apologized to Utzig when he learned of the financial loss.

Different scams require different levels of sophistication; for example, hacking Twitter accounts of high-profile users, many of whom may use multi-factor authentication, is typically more difficult than using said accounts to scam users. It is possible the individuals who swindled Utzig are not the ones who initially hacked Kubatko’s account, but they may have purchased access from the original hacker to use as their scamming platform.

Trap and Trace

Steve was enraged that Utzig had been swindled, and offered to help. But all we had was a phone number. So he contacted the number and told the person on the other end that he was interested in buying laptops. Immediately, he received a text from a _different_ number: “Are you looking for laptops?”

Throughout the conversation, Steve said he was willing to pay via Bitcoin, Cash App, or Zelle. Bitcoin wallet information is useful because all transactions are stored on the blockchain, and you can use it to “follow the money” and identify how much money accounts have made. It’s also possible to cross-reference blockchain accounts with other data sets such as open-source reporting or private threat data to identify related fraudulent activity. Cash App and PayPal are also useful data points because users must provide a lot of personal information including phone numbers, email addresses, usernames, and possibly bank accounts. And Zelle is tied to a bank account, making the information very useful to fraud investigators.

Typically, Steve is able to get at least one of these accounts from the threat actors he interacts with—in this case, we got three.

By claiming he didn’t have enough money in one of his accounts, and that another was not working, Steve got the scammers to send him links to multiple payment accounts. The accounts all had different usernames, suggesting they belonged to different people. In fact, Steve was able to link the usernames and phone numbers from the payment apps to three different people and their suspected real names. He found LinkedIn profiles; Twitter, Facebook, TikTok, Snap, and Instagram accounts; Poshmark accounts; dating profiles; a Soundcloud; and personal websites. By pivoting on this data and information provided on their various social and public profiles, Steve was then able to link the individuals to physical addresses in the eastern US.

Steve also sent the scammers Grabify links to see whether we could collect more data on the users. Grabify is used to identify technical characteristics belonging to a user, such as IP addresses, location data, and “user agents” that indicate what type of device they’re clicking from. In this case, one recipient clicked, and we could see they were using an iPhone on the AT&T network and were apparently located in Ohio, providing a possible estimate of where the user was when they clicked the link.

Based on the conversations with the people associated with the various phone numbers and payment accounts, Steve identified at least four individuals involved in this scam ring.

At least one person—Utzig’s original scammer—is the suspected organizer of the fraud, with at least one person who appears to work directly with him, according to Steve’s findings. After Steve received a message from the new, unknown number, he asked the original scammer who this person was. That phone number claimed it was a “business partner.” It had initially been possible there was one person using two different phone numbers involved in the scam. But based on subsequent investigations and conversations with both, Steve identified two likely separate individuals belonging to those numbers.

The “business partner” sent Steve a Cash App screenshot asking for payment that contained a username, which Steve found associated with multiple social media accounts that included photos. One appeared to have a real name attached.

When Steve said he didn’t have enough money in his Cash account, the business partner sent a link to a PayPal account, which used the apparent first and last name of a different real person. The real name and username were linked to multiple social media accounts that all used photos of what appeared to be the same person. Finally, Steve told the business partner his PayPal was not working, and received a name and phone number allegedly belonging to someone’s Zelle account. The business partner claimed this was an “assistant.” By using the details provided, Steve identified yet another individual and their apparent real name who appeared to reside in the same area as our scammers.

It is unclear whether the individuals belonging to the Zelle and PayPal accounts knew about the laptop scam or whether they were just “money mules.” These are accounts that receive money from victims and then funnel it to other accounts belonging to the original scammers. Sometimes money mules are unaware they are moving stolen money and may be unwitting participants in the fraud. Indeed, sometimes money mules are recruited by scammers under the guise of legitimate employment.

Our investigation resulted in us identifying three payment accounts that were at least associated with the laptop scam, dozens of social media profiles potentially belonging to people involved, and three phone numbers with two different area codes belonging to the same state. While this data could end up being useful to a law enforcement fraud investigation, Steve’s open source intelligence gathering serves as a stark reminder of how easily our digital footprints can be traced back to our real-life existence.

A Drop in the Bucket

Local police and the FBI all encourage users to report when they have been victims of online fraud, but victims rarely get the support they need. Utzig filed a police report with the Washington, DC, Metropolitan Police Department, and we reported it to the FBI via the bureau’s Internet Crime Complaint Center. He also contacted his bank and Apple. Unfortunately, using payment apps is the same as sending someone cash. At this point, there is really nothing more Utzig can do—and it’s likely his complaint will just become a drop in a sea of hundreds of thousands of internet crimes reported each year, many of which don’t get any follow-up.

We provided the police with details of our own investigation and reported high-confidence malicious payment accounts to the payment platforms to remove them for fraud. As private citizens, we’ve done all we can, but we hope our investigations can help prevent further exploitation by these threat actors.

While fraud takes place on pretty much every social media platform, Twitter appears to be hosting more hostile accounts now than it had been prior to the sale last year. And not just from scammers. The company fired much of its Trust and Safety staff in December 2022, and in June, Twitter’s recently appointed head of Trust and Safety exited the company. Without the personnel operating the technical guardrails to prevent widespread harassment, exploitation, and cybercrime, such tactics will likely be allowed to proliferate, making the platform less safe. All this as Musk wants Twitter (sorry, I’m not calling it X) to effectively become a financial institution, which requires more user trust than it has ever enjoyed.

Users should be aware of the hallmarks of fraudulent behavior on social media, like receiving messages from strangers, receiving offers to purchase goods and services, and being asked to switch platforms in the middle of a conversation. However, in Utzig’s case, the social platforms themselves could learn a thing or two. Without improvements in screen reading technology and accessibility in general, platforms are enabling exploitation of their more vulnerable users.

Working with my friend to help him report this crime also reminded me that security practitioners often forget there are real human beings on the receiving end of cybercrime, and the emotional and mental toll of being a victim can be huge.

“Billions of dollars in losses” sounds bad. Your friend losing a lot of their savings and feeling violated and betrayed by platforms and people he trusted feels a lot worse.

Twitter Scammers Stole $1,000 From My Friend—So I Hunted Them Down

Third-party plugins boost ChatGPT’s capabilities. But security researchers say they add an extra layer of risk.

Over the past eight months, ChatGPT has impressed millions of people with its ability to generate realistic-looking text, writing everything from stories to code. But the chatbot, developed by OpenAI, is still relatively limited in what it can do.

The large language model (LLM) takes "prompts" from users that it uses to generate ostensibly related text. These responses are created partly from data scraped from the internet in September 2021, and it doesn't pull in new data from the web. Enter plugins, which add functionality but are available only to people who pay for access to GPT-4, the updated version of OpenAI's model.

Since OpenAI launched plugins for ChatGPT in March, developers have raced to create and publish plugins that allow the chatbot to do a lot more. Existing plugins let you search for flights and plan trips, and make it so ChatGPT can access and analyze text on websites, in documents, and on videos. Other plugins are more niche, promising you the ability to chat with the Tesla owner’s manual or search through British political speeches. There are currently more than 100 pages of plugins listed on ChatGPT’s plugin store.

But amid the explosion of these extensions, security researchers say there are some problems with the way that plugins operate, which can put people’s data at risk or potentially be abused by malicious hackers.

Johann Rehberger, a red team director at Electronic Arts and security researcher, has been documenting issues with ChatGPT’s plugins in his spare time. The researcher has documented how ChatGPT plugins could be used to steal someone’s chat history, obtain personal information, and allow code to be remotely executed on someone’s machine. He has mostly been focusing on plugins that use OAuth, a web standard that allows you to share data across online accounts. Rehberger says he has been in touch privately with around a half-dozen plugin developers to raise issues, and has contacted OpenAI a handful of times.

“ChatGPT cannot trust the plugin,” Rehberger says. “It fundamentally cannot trust what comes back from the plugin because it could be anything.” A malicious website or document could, through the use of a plugin, attempt to run a prompt injection attack against the large language model (LLM). Or it could insert malicious payloads, Rehberger says.

Data could also potentially be stolen through cross plugin request forgery, the researcher says. A website could include a prompt injection that makes ChatGPT open another plugin and perform extra actions, which he has shown through a proof of concept. Researchers call this “chaining,” where one plugin calls another one to operate. “There are no real security boundaries” within ChatGPT plugins, Rehberger says. “It is not very well defined, what the security and trust, what the actual responsibilities \[are\] of each stakeholder.”

Since they launched in March, ChatGPT’s plugins have been in beta—essentially an early experimental version. When using plugins on ChatGPT, the system warns that people should trust a plugin before they use it, and that for the plugin to work ChatGPT may need to send your conversation and other data to the plugin.

Niko Felix, a spokesperson for OpenAI, says the company is working to improve ChatGPT against “exploits” that can lead to its system being abused. It currently reviews plugins before they are included in its store. In a blog post in June, the company said it has seen research showing how “untrusted data from a tool’s output can instruct the model to perform unintended actions.” And that it encourages developers to make people click confirmation buttons before actions with “real-world impact,” such as sending an email, are done by ChatGPT.

ChatGPT Plugins Pose Security Risks

A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty.

For more than 25 years, a technology used for critical data and voice radio communications around the world has been shrouded in secrecy to prevent anyone from closely scrutinizing its security properties for vulnerabilities. But now it’s finally getting a public airing thanks to a small group of researchers in the Netherlands who got their hands on its viscera and found serious flaws, including a deliberate backdoor.

The backdoor, known for years by vendors that sold the technology but not necessarily by customers, exists in an encryption algorithm baked into radios sold for commercial use in critical infrastructure. It’s used to transmit encrypted data and commands in pipelines, railways, the electric grid, mass transit, and freight trains. It would allow someone to snoop on communications to learn how a system works, then potentially send commands to the radios that could trigger blackouts, halt gas pipeline flows, or re-route trains.

Researchers found a second vulnerability in a different part of the same radio technology that is used in more specialized systems sold exclusively to police forces, prison personnel, military, intelligence agencies, and emergency services, such as the C2000 communication system used by Dutch police, fire brigades, ambulance services, and Ministry of Defense for mission-critical voice and data communications. The flaw would let someone decrypt encrypted voice and data communications and send fraudulent messages to spread misinformation or redirect personnel and forces during critical times.

Three Dutch security analysts discovered the vulnerabilities—five in total—in a European radio standard called TETRA (Terrestrial Trunked Radio), which is used in radios made by Motorola, Damm, Hytera, and others. The standard has been used in radios since the ’90s, but the flaws remained unknown because encryption algorithms used in TETRA were kept secret until now.

The technology is not widely used in the US, where other radio standards are more commonly deployed. But Caleb Mathis, a consultant with Ampere Industrial Security, conducted open source research for WIRED and uncovered contracts, press releases, and other documentation showing TETRA-based radios are used in at least two dozen critical infrastructures in the US. Because TETRA is embedded in radios supplied through resellers and system integrators like PowerTrunk, it’s difficult to identify who might be using them and for what. But Mathis helped WIRED identify several electric utilities, a state border control agency, an oil refinery, chemical plants, a major mass transit system on the East Coast, three international airports that use them for communications among security and ground crew personnel, and a US Army training base.

Carlo Meijer, Wouter Bokslag, and Jos Wetzels of Midnight Blue in the Netherlands discovered the TETRA vulnerabilities–which they’re calling TETRA:Burst–in 2021 but agreed not to disclose them publicly until radio manufacturers could create patches and mitigations. Not all of the issues can be fixed with a patch, however, and it’s not clear which manufacturers have prepared them for customers. Motorola—one of the largest radio vendors—didn’t respond to repeated inquiries from WIRED.

The Dutch National Cyber Security Centre assumed the responsibility of notifying radio vendors and computer emergency response teams around the world about the problems, and of coordinating a timeframe for when the researchers should publicly disclose the issues.

In a brief email, NCSC spokesperson Miral Scheffer called TETRA “a crucial foundation for mission-critical communication in the Netherlands and around the world” and emphasized the need for such communications to always be reliable and secure, “especially during crisis situations.” She confirmed the vulnerabilities would let an attacker in the vicinity of impacted radios “intercept, manipulate or disturb” communications and said the NCSC had informed various organizations and governments, including Germany, Denmark, Belgium, and England, advising them how to proceed. A spokesperson for DHS’s Cybersecurity and Infrastructure Security Agency said they are aware of the vulnerabilities but wouldn’t comment further.

The researchers say anyone using radio technologies should check with their manufacturer to determine if their devices are using TETRA and what fixes or mitigations are available.

The researchers plan to present their findings next month at the BlackHat security conference in Las Vegas, when they will release detailed technical analysis as well as the secret TETRA encryption algorithms that have been unavailable to the public until now. They hope others with more expertise will dig into the algorithms to see if they can find other issues.

TETRA was developed in the ’90s by the European Telecommunications Standards Institute, or ETSI. The standard includes four encryption algorithms—TEA1, TEA2, TEA3, and TEA4—that can be used by radio manufacturers in different products, depending on their intended use and customer. TEA1 is for commercial uses; for radios used in critical infrastructure in Europe and the rest of the world, though, it is also designed for use by public safety agencies and military, according to an ETSI document, and the researchers found police agencies that use it.

TEA2 is restricted for use in Europe by police, emergency services, military, and intelligence agencies. TEA3 is available for police and emergency services outside Europe—in countries deemed “friendly” to the EU, such as Mexico and India; those not considered friendly—such as Iran—only had the option to use TEA1. TEA4, another commercial algorithm, is hardly used, the researchers say.

The vast majority of police forces around the world, aside from the US, use TETRA-based radio technology, the researchers found, after conducting open source research. TETRA is used by police forces in Belgium and the Scandinavian countries, East European countries like Serbia, Moldova, Bulgaria, and Macedonia, as well as in the Middle East in Iran, Iraq, Lebanon, and Syria.

Additionally, the Ministries of Defense in Bulgaria, Kazakhstan, and Syria use it. The Polish military counterintelligence agency uses it, as does the Finnish defense forces, and Lebanon and Saudi Arabia’s intelligence service, to name just a few.

Critical infrastructure in the US and other countries use TETRA for machine-to-machine communication in SCADA and other industrial control system settings—especially in widely distributed pipelines, railways, and electric grids, where wired and cellular communications may not be available.

Although the standard itself is publicly available for review, the encryption algorithms are only available with a signed NDA to trusted parties, such as radio manufacturers. The vendors have to include protections in their products to make it difficult for anyone to extract the algorithms and analyze them.

To obtain the algorithms, the researchers purchased an off-the-shelf Motorola MTM5400 radio and spent four months locating and extracting the algorithms from the secure enclave in the radio’s firmware. They had to use a number of zero-day exploits to defeat Motorola protections, which they reported to Motorola to fix. Once they reverse-engineered the algorithms, the first vulnerability they found was the backdoor in TEA1.

All four TETRA encryption algorithms use 80-bit keys, which, even more than two decades after their release, still provides sufficient security to prevent someone from cracking them, the researchers say. But TEA1 has a feature that reduces its key to just 32 bits—less than half the key’s length. The researchers were able to crack it in less than a minute using a standard laptop and just four ciphertexts.

Brian Murgatroyd, chair of the technical body at ETSI responsible for the TETRA standard, objects to calling this a backdoor. He says when they developed the standard, they needed an algorithm for commercial use that could meet export requirements to be used outside Europe, and that in 1995 a 32-bit key still provided security, though he acknowledges that with today’s computing power that’s not the case.

Matthew Green, a Johns Hopkins University cryptographer and professor, calls the weakened key a “disaster.”

"I wouldn’t say it’s equivalent to using no encryption, but it’s really, really bad,” he says.

Gregor Leander, a professor of computer science and cryptographer with a security research team known as CASA at Ruhr University Bochum in Germany, says it would be “stupid” for critical infrastructure to use TEA1, especially without adding end-to-end encryption on top of it. “Nobody should rely on this,” he says.

Murgatroyd insists the most anyone can do with the backdoor is decrypt and eavesdrop on data and conversations. TETRA has strong authentication, he says, that would prevent anyone from injecting false communication.

“That’s not true,” says Wetzels. TETRA only requires that devices authenticate themselves to the network, but data and voice communications between radios are not digitally signed or otherwise authenticated. The radios and base stations trust that any device that has the proper encryption key is authenticated, so someone who can crack the key as the researchers did can encrypt their own messages with it and send them to base stations and other radios.

While the TEA1 weakness has been withheld from the public, it’s apparently widely known in the industry and governments. In a 2006 US State Department cable leaked to Wikileaks, the US embassy in Rome describes an Italian radio manufacturer asking about exporting TETRA radio systems to municipal police forces in Iran. The US pushed back on the plan, so the company representative reminded the US that encryption in the TETRA-based radio system they planned to sell to Iran is “less than 40-bits,” implying that the US shouldn’t object to the sale because the system isn’t using a strong key.

The second major vulnerability the researchers found isn’t in one of the secret algorithms, but it affects all of them. The issue lies in the standard itself and how TETRA handles time syncing and keystream generation.

When a TETRA radio contacts a base station, they initiate communication with a time sync. The network broadcasts the time, and the radio establishes that it’s in sync. Then they both generate the same keystream, which is tied to that timestamp, to encrypt the subsequent communication.

“The problem is that the network broadcasts the time in packets that are unauthenticated and unencrypted,” says Wetzels.

As a result, an attacker can use a simple device to intercept and collect encrypted communication passing between a radio and base station, while noting the timestamp that initiated the communication. Then he can use a rogue base station to contact the same radio or a different one in the same network and broadcast the time that matches the time associated with the intercepted communication. The radio is dumb and believes the correct time is whatever a base station says it is. So it will generate the keystream that was used at that time to encrypt the communication the attacker collected. The attacker recovers that keystream and can use it to decrypt the communication collected earlier.

To inject false messages, he would use his base station to tell a radio that the time is tomorrow noon and ask the radio to generate the keystream associated with that future time. Once the attacker has it, he can use the keystream to encrypt his rogue messages, and the next day at noon send them to a target radio using the correct keystream for that time.

Wetzels imagines Mexican drug cartels could use this to intercept police communications to eavesdrop on investigations and operations or deceive police with false messages sent to radios. The attacker needs to be near a target radio, but the proximity is only dependent on the strength of the rogue base station’s signal and the terrain.

“You can do this within a distance of tens of meters,” he says. The rogue base station would cost $5,000 or less to build.

ETSI’s Murgatroyd downplays the attack saying TETRA’s strong authentication requirements would prevent a non-authenticated base station from injecting messages. Wetzel disagrees, saying TETRA only requires devices to authenticate to the network, not to each other.

The researchers didn’t find any weaknesses in the TEA2 algorithm used by police, military, and emergency services in Europe, but they did initially think they found another backdoor in TEA3. Given that TEA3 is the exportable version of TEA2, there was good reason to believe it might also have a backdoor to meet export requirements.

They thought they found something suspicious in a substitution box, or S-box, used in the algorithm, which contains a bad property they say would “never appear in serious cryptography.” The researchers didn’t have sufficient skill to examine it to determine if it was exploitable. But Leander’s team did examine it and he says it’s not.

“In many ciphers if you used such a box it would break the cipher very badly,“ he says. “But the way it’s used in TEA3, we couldn’t see that this is exploitable.” This doesn’t mean someone else might not find something in it he says, but he’d “be very surprised if it leads to an attack that’s practical.”

With regard to fixes for the other problems the researchers found, Murgatroyd says ETSI fixed the keystream/timestamp issue in a revised TETRA standard published last October, and they created three additional algorithms for vendors to use, including one that replaces TEA1. Vendors have created firmware updates that fix the keystream/timestamp issue. But the problem with TEA1 cannot be fixed with an update. The only solution for that is to use another algorithm—not an easy thing to switch—or to add end-to-end encryption on top of TETRA, something Wetzels says is impractical. It’s very expensive since the encryption has to be applied to every device, it requires some downtime to do the upgrade—something not always feasible for critical infrastructure—and can create incompatibility issues with other components.

As for asking their vendor to switch out TEA1 for one of the new algorithms meant to replace it, Wetzels says this is problematic as well, since ETSI plans to keep those algorithms secret, like the others, asking users to trust again that the algorithms have no critical weakness.

“There’s a very high chance that \[the replacement algorithm for TEA1\] will be weakened” as well, he says.

The researchers don’t know if the vulnerabilities they found are being actively exploited. But they did find evidence in the Edward Snowden leaks that indicate the US National Security Agency (NSA) and UK’s GCHQ intelligence agency targeted TETRA for eavesdropping in the past. One document discusses an NSA and Australian Signals Directorate project to collect Malaysian police communications during a climate change conference in Bali in 2007 and mentions that they obtained some TETRA collections on Indonesian security forces' communications.

Another Snowden leak describes GCHQ, possibly with NSA assistance, collecting TETRA communications in Argentina in 2010 when tensions rose between it and the UK over oil exploration rights in a deep-sea oil field off the coast of the Falkland Islands. It describes an operation to collect high-priority military and leadership communications of Argentina and reveals that the project resulted in successful TETRA collections.

“This doesn’t indicate they exploited these vulnerabilities that we found,” Wetzels says. “But it does show … that state-sponsored actors are actively looking at and collecting these TETRA networks, even in the early 2000s.”

TETRA Radio Code Encryption Has a Flaw: A Backdoor

Plus: Microsoft expands access to premium security features, AI child sexual abuse material is on the rise, and Netflix’s password crackdown has its intended effect.

Microsoft wrote last week that its “investigations have not detected any other use of this pattern by other actors and Microsoft has taken steps to block related abuse.” But if the stolen signing key could have been used to breach other services, even if it wasn’t used this way in the recent incident, the finding has significant implications for the security of Microsoft’s cloud services and other platforms.

The attack “seems to have a broader scope than originally assumed,” the Wiz researchers wrote. They added , “This isn't a Microsoft-specific issue—if a signing key for Google, Facebook, Okta, or any other major identity provider leaks, the implications are hard to comprehend.”

Microsoft’s products are ubiquitous worldwide, though, and Wiz’s Luttwak emphasizes that the incident should serve as an important warning.

“There are still questions that only Microsoft can answer. For example, when was the key compromised? And how?” he says. “Once we know that, the next question is, do we know it’s the only key that they had compromised?

In response to China’s attack on US government cloud email accounts from Microsoft—a campaign that US officials have described publicly as espionage—Microsoft announced this past week that it will make more of its cloud logging services free to all customers. Previously, customers had to pay for a license to Microsoft's Purview Audit (Premium) offering to log the data.

The US Cybersecurity and Infrastructure Security Agency’s executive assistant director for cybersecurity, Eric Goldstein, wrote in a blog post also published this past week that “asking organizations to pay more for necessary logging is a recipe for inadequate visibility into investigating cybersecurity incidents and may allow adversaries to have dangerous levels of success in targeting American organizations.”

Since OpenAI revealed ChatGPT to the world last November, the potential of generative AI has been thrust into the mainstream. But it isn't just text that can be created, and many of the emerging harms of the technology are only starting to be realized. This week, UK-based child safety charity the Internet Watch Foundation (IWF), which scours the web for child sexual abuse images and videos and removes them, revealed it is increasingly finding AI-generated abuse images online.

In June, the charity started logging AI images for the first time—saying it found seven URLs sharing dozens of images. These included AI generations of girls around 5 years old posing naked in sexual positions, according to the BBC. Other images were even more graphic. While generated content only represents a fraction of the child sexual abuse material available online overall, its existence is worrying experts. The IWF says it found guides on how people could create lifelike images of children using AI and that the creation of the images, which is illegal in many countries, is likely to normalize and encourage predatory behaviors toward children.

After threatening to roll out global password-sharing crackdowns for years, Netflix launched the initiatives in the US and UK at the end of May. And the effort seems to be going as planned. In earnings reported on Thursday, the company said that it added 5.9 million new subscribers in the past three months, a jump nearly three times higher than analysts predicted. Streaming subscribers have grown accustomed to sharing passwords and balked at Netflix’s strict new rules, which were prompted by stagnating new subscriber signups. But ultimately, at least a portion of account-sharers seem to have bit the bullet and started paying on their own.

China’s Breach of Microsoft Cloud Email May Expose Deeper Problems

A landmark $13 million settlement with the City of New York is the latest in a string of legal wins for protesters who were helped by a video-analysis tool that smashes the “bad apple” myth.

Beaten, blinded by pepper spray, corralled like animals, and indiscriminately arrested for marching against police violence and racial injustice. Such was the fate hundreds of people suffered at the hands of New York Police Department (NYPD) officers in late May and early June of 2020, as thousands of people across the United States protested the murder of George Floyd by a Minneapolis police officer.

Three years later, a class action lawsuit has resulted in the City of New York agreeing to pay $9,950 each to some 1,380 protesters as part of a settlement. Costing taxpayers more than $13 million, it’s the largest amount paid to protesters in US history, according to the legal team behind the class action suit.

Lawyers secured the settlement with the aid of a little-known tool that helped them quickly categorize and analyze terabytes of video footage from police body cams, helicopter surveillance, and social media. “We had multiple weeks of protests. We had protests spanning the city of New York. We had thousands of arrests,” says David Rankin, a partner at the law firm Beldock, Levine & Hoffman who was part of the protesters’ legal team. “We had tens of thousands of hours of body cam footage, we had text messages, we had emails, we had just an absolute truckload of data to get through.”

The path through all this data was carved by Codec, a video categorization tool developed by the civil liberties-focused design agency SITU Research. Launched in June 2022, the tool is proving essential in legal battles around the world, where hours of disparate video footage can reveal orchestrated, state-backed violence against protesters.

Clip by Clip

Dozens of videos shared with WIRED show how the legal team built their case. Using this data, which also included geospatial information, time stamps, and the category of the alleged misconduct, we were able to build a map that allows anyone to watch the police incidents that were central to the lawsuit. Each dot represents an incident the legal team characterized as police misconduct. Of the 72 videos the legal team flagged as most pertinent to their case, the map includes 47 videos recorded by police body cams or surveillance cameras. The locations of the remaining 25 videos, which appear to have been taken from social media and other sources, are also pinpointed on the map. In total, the legal team analyzed more than 6,300 videos. 

Some of the videos on the map contain graphic violence, and viewer discretion is advised. Videos will autoplay with the sound on.

Video evidence was obtained from various sources, including police body cameras and helicopters. SITU Research geolocated the data and provided it to WIRED.

Among the videos we reviewed, an NYPD officer can be seen running down the sidewalk while pepper-spraying a person who’s standing against a building, entirely out of the officer’s way. In another video, an officer hits a protester with a car door while driving down the street. Another video shows a group of officers interlocking arms as one of them says, “Just like we fucking practiced.” The officers then charge a group of protesters before singling out a person on the sidewalk and beating them with batons. Taken together, the footage demonstrates widespread, systematic police misconduct during protests that spanned from May 28 to June 4, 2020, across multiple neighborhoods in New York City, according to the lawsuit.

While looting and vandalism took place in several neighborhoods during the protests, the demonstrations were largely peaceful. The defendants in the lawsuit have not admitted wrongdoing as part of the settlement, and city attorneys deny an orchestrated effort to violate protesters’ rights. Reached for comment, the NYPD referred WIRED to the city’s Law Department, which has not yet responded to a request for comment.

Remy Green, a partner at Cohen & Green and a member of the protesters’ legal team, says the use of police body cameras, which have been touted as a step in the right direction for civil liberties, has become “a kind of band-aid solution to police brutality.” A single video can only reveal so much, Green says, and police departments can use this limitation to obfuscate what really happened. Protests that are met with an extreme police response require a zoomed-out vantage point, which is what Codec allowed the legal team to create. “It gives you a much more comprehensive look at the activities that occurred,” says Green.

Hard Pivot

The idea of using Codec in the lawsuit came from a related case settled earlier this year. Here, Human Rights Watch worked with SITU Research to analyze video footage of protests in the Mott Haven neighborhood of the Bronx, one of New York City’s five boroughs. Their work proved that the NYPD used an anti-protest tactic called “kettling”—trapping a group of people so they can’t escape—just prior to a government-mandated curfew, thus ensuring that they were in violation of the order. In March, a lawsuit against the city over the NYPD’s use of kettling ended in a $21,500 payout to each of more than 300 Mott Haven protesters, which is estimated to be the highest per-person settlement for a mass arrest in US history. The NYPD said in a statement following the settlement that it has since “re-envisioned” its “policies and training for policing large-scale demonstrations.”

Having seen the forensic video investigation SITU’s work on the Mott Haven protests produced, Rankin asked for help conducting a similar investigation. But this time it wouldn’t focus on police conduct during a single protest in one neighborhood, but rather protests across New York City.

Now an open source tool that’s free to use, Codec was first built for internal use only, according to Brad Samuels, a founding partner of SITU who oversees its research division. Codec categorizes video files using a range of criteria, including the location where a video was taken and the time and date it was recorded. Analysts can add their own parameters, such as whether a video shows police use of pepper spray, which enables them to more easily pinpoint clips that are relevant to an investigation.

Early on, the SITU team focused on international incidents, such as the 2014 Maidan Revolution in Ukraine and a 2019 uprising in Iraq in which security forces fired military-grade tear gas canisters directly at protesters’ heads. After the murder of George Floyd in May 2020, the US-based SITU team “pivoted hard” to investigate domestic incidents. The agency’s focus on the 2020 Black Lives Matter protests that followed resulted in investigations into police misconduct in Portland, Oregon, and Charlotte, North Carolina. Investigations in Mott Haven and across New York City are the latest to join that list.

The legal team behind the New York City-wide lawsuit, which operated through the National Lawyers Guild, a civil rights-focused nonprofit, obtained thousands of videos from the NYPD, the city, and social media feeds, most of which were unpublished until this week. Using Codec, analysts pinpointed four broad categories of what the legal team characterized as police misconduct: improper arrests, improper use of pepper spray, improper baton strikes, and excessive force.

While Codec greatly enhanced the legal team’s ability to analyze thousands of videos, it still took “a lot of human hours” to make the data usable and identify specific moments that were useful for their case, Rankin says. This included identifying the location of specific police interactions, categorizing the alleged misconduct, and adding accurate time stamps—all of which require ample hours of human work to complete, even with Codec’s help.

In future cases that require high-volume video analysis, however, that job may become easier. Samuels says the SITU team is currently working to add layers of machine learning and computer vision to Codec. He hopes that by next year the system can be tasked with, for example, detecting batons in footage—something that is currently done manually.

Widespread protests like those that took place in 2020 don’t often happen in the US. And Rankin points out that cases like the one settled this week are rare. But Green says they’re not nearly rare enough. “Our role as civil rights attorneys, I like to think, is to attempt to put ourselves out of a job,” Green says. “This settlement marks a high-water mark in terms of financial accountability, but I don’t see myself losing my job anytime soon.”

_Map creation and additional data work by Danielle Carrick_

NYPD Body Cam Data Shows the Scale of Violence Against Protesters

German researchers gained rare access to three satellites and found that they're years behind normal cybersecurity standards.

Hundreds of miles above Earth, thousands of satellites are orbiting the planet to keep the world running smoothly. Timing systems, GPS, and communications technologies are all powered by satellites. But for years, security researchers have warned that more needs to be done to secure the satellites against cyberattacks.

A new analysis from a group of German academics provides a rare glimpse into some of the security weaknesses in satellites currently circling the Earth. The researchers, from the Ruhr University Bochum and the Cispa Helmholtz Center for Information Security, have examined the software used by three small satellites and found that the systems lack some basic protections.

The satellites inspected by the researchers, according to an academic paper, contain “simple” vulnerabilities in their firmware and show “that little security research from the last decade has reached the space domain.” Among the problems are a lack of protection for who can communicate with the satellite systems and a failure to include encryption. Theoretically, the researchers say, the kinds of issues they discovered could allow an attacker to take control of a satellite and crash it into other objects.

There are multiple kinds of satellites in use today, ranging in size and purpose. Satellites created by commercial companies can be found photographing the Earth and providing navigation data. Military satellites are cloaked in secrecy and often used for spying. There are also research satellites, which are run by space agencies and universities.

Johannes Willbold, a PhD student at Ruhr University Bochum and the lead researcher behind the security analysis, says the current state of satellite security can be classed as “security by obscurity.” In other words: Little is known about how well they are protected. Willbold says the research team approached multiple organizations with satellites in space to ask if they could inspect their firmware, and the vast majority refused or didn’t reply—he praises the openness of the three that worked with his team.

The three satellites the team focused on are used for research, fly in low Earth orbit, and are largely operated by universities. The reserachers inspected the firmware of ESTCube-1, an Estonian cube satellite that launched in 2013; the European Space Agency’s OPS-SAT, which is an open research platform; and the Flying Laptop, a mini satellite created by Stuttgart University and defense firm Airbus.

The researchers’ analysis says they found six kinds of security vulnerabilities across all three satellites and 13 vulnerabilities in total. Among these vulnerabilities were “unprotected telecommand interfaces,” which satellite operators on the ground use to communicate with the vehicles when they are in orbit. “Oftentimes, they lack access protection in the first place,” says Willbold, who is also presenting the research at the Black Hat security conference in Las Vegas next month. “They’re essentially not checking anything.”

As well as the vulnerabilities within the satellites’ software, Willbold says, the team found an issue in a code library that appears to be used by multiple satellites. The research details a stack-based buffer overflow vulnerability in software developed by nanosatellite manufacturer GomSpace. The source of the problem, the research says, is within a library that was last updated in 2014. Willbold says GomSpace acknowledged the findings when the researchers reported the issue. GomSpace did not respond to WIRED’s request for comment.

The creators of the satellites examined by the researchers told WIRED that providing their firmware to the researchers was beneficial and that they will take the findings on board for future spacecraft. Simon Plum, head of the Mission Operations Department at the European Space Agency (ESA), says a different level of security is applied to OPS-SAT than to other missions, as it is a “space laboratory.” However, Plum says ESA is reviewing the findings and has made at least one change to the satellite already. “We want to protect space systems from cyber threats and develop culture and common knowledge of resilience in the field of space cybersecurity,” Plum says.

Andris Slavinskis, an associate professor at the University of Tartu in Estonia who works on the ESTCube project, says the findings are “important and relevant” and that the ESTCube-1 system was “developed and launched during the Wild West times of the cubesat world.” A second version of the satellite, ESTCube-2, is set to launch this year. Meanwhile, Sabine Klinkner, a professor of satellite technology at Stuttgart University, which partly developed the Flying Laptop, says the “weaknesses” the researchers found are a result of trade-offs around functionality and access to the satellite.

“As with many university satellites, our threat model weighted the small incentives to attack an academic satellite against the still not completely trivial challenges in establishing a link and sending valid commands to the satellite,” Klinkner says. No malicious connections to the satellite have been spotted, Klinkner adds. And she says future missions will have increased cybersecurity measures to protect against threats.

Despite the satellite security analysis mostly focusing on research and academic satellites, it highlights wider security issues around satellites that experts have been concerned about for years. Gregory Falco, an assistant professor at Johns Hopkins University who focuses on space cybersecurity, says it is rare for researchers to be able to get their hands on satellite firmware and publish research on it. There’s “almost nothing” publicly available that’s similar to the type of analysis the German team completed, Falco says.

The warnings about space systems aren’t new. Researchers have long said more needs to be done to protect space systems from attack and to improve how they are created. Falco says that space firmware and software development is a “nightmare” for two reasons. First, legacy software is often used in development and is rarely updated, Flaco says. “The other reason why is because space systems are not built by software developers. They are built by aerospace engineers, for the most part.” The German researchers also surveyed 19 satellite industry professionals about the levels of security in their systems. “We focused on providing a functioning system instead of a secure one,” one of those surveyed said, according to the academic paper.

Juliana Suess, a research analyst and policy lead on space security at the defense think tank Royal United Services Institute, explains that there are multiple ways satellite systems can be attacked, beyond software and firmware vulnerabilities. These include jamming and spoofing attacks, which interfere with the signals being transmitted to and from satellites. “You don't need to be a space power to do it,” Suess says. Last year, security researchers with permission demonstrated how a decommissioned satellite could be used to broadcast rogue TV signals. And in October 2007 and July 2008, Chinese hackers were blamed for disrupting two US satellites.

Suess believes the cyberattack against the Viasat satellite system at the start of Russia’s full-scale invasion of Ukraine last year has acted as a further wake-up call to the space industry. In the early hours of February 24, 2022, when Russian troops first moved into Ukrainian land, a cyberattack interrupted thousands of modems from the satellite internet system. The attack knocked connections offline around the world, including German wind farms. The EU, UK, and US have linked the attack to Russia, and it has prompted the US National Security Agency to speak out about satellite security.

As experts continue to sound the alarm around space cybersecurity issues, the commercial space sector is going through a boom. SpaceX and other companies are racing to put thousands of satellites into orbit to provide internet connections, and it has become cheaper for satellites to photograph Earth from space. Alongside big firms, there’s a smaller array of companies building components and parts to be included in spacecraft. This supply chain poses extra security risks.

“They absolutely are not prioritizing security,” Falco says. “They probably don’t have any people who know anything about it on their staff.” In June of this year, the Institute of Electrical and Electronics Engineers Standards Association announced a new effort, which Falco is chairing, to introduce common practices and requirements for cybersecurity across the space industry. “There’s so much money that’s going into developing commercially led space systems, commercial entities need to have some guidance,” Falco says.

Satellites Are Rife With Basic Security Flaws

A bill to prevent cops and spies from buying Americans’ data instead of getting a warrant has a fighting chance in the US Congress as lawmakers team up against surveillance overreach.

United States lawmakers are moving with uncommon speed to close a loophole in federal law that police and intelligence agencies use to collect sensitive information on US citizens—up to and including their physical whereabouts—all without the need for a warrant.

The Federal Bureau of Investigation (FBI) and the Defense Intelligence Agency are among several government entities known to have solicited private data brokers to access information for which a court order is generally required. A growing number of lawmakers have come to view the practice as an end run around the US Constitution’s Fourth Amendment guarantees against unreasonable government searches and seizures. 

“This unconstitutional mass government surveillance must end,” Warren Davidson, Republican congressman from Ohio, says. 

Members of the House Judiciary Committee, led by Ohio’s Jim Jordan, a Republican, will hold a markup hearing tomorrow to consider a Davidson bill aimed at restricting purchases of Americans’ data without a subpoena, court order, or warrant. If passed into law, the legislation's restrictions would apply to federal agencies as well as state and local police departments. Known as the Fourth Amendment Is Not For Sale Act, the bill is cosponsored by four Republicans and four Democrats, including the committee’s ranking member, Jerry Nadler,  a Democrat, who first introduced it alongside California Democrat Zoe Lofgren in 2021. 

Notably, the bill's protections extend to data obtained from a person's account or device even if hacked by a third party, or when disclosure is referenced by a company's terms of service. The bill's sponsors note this would effectively prohibit the government from doing business with companies such as Clearview AI, which has admitted to scraping billions of photos from social media to fuel a facial recognition tool that's been widely tested by local police departments.

“The principle here is simple,” Nadler said when the legislation was first introduced two years ago. “The government should not be allowed to purchase its way around the rules Congress has enacted to protect the privacy of American citizens.”

In addition to Davidson, Nadler, and Lofgren, the bill is cosponsored by Republicans Andy Biggs, Ken Buck, and Thomas Massie, joining two other Democrats, Pramila Jayapal and Sara Jacobs.

An aide to Jim Jordan, the Judiciary Committee's Republican chairman, signaled that he would likewise support the bill, highlighting the degree to which domestic surveillance fears have risen to supersede fractious politics. The bill had been previously introduced by a bipartisan group of senators in 2021 and had acquired more than 20 cosponsors, including Chuck Schumer, the Senate majority leader. However, the legislation ultimately failed to make much headway in Congress.

A report declassified last month by the nation’s top intelligence official, Avril Haines, stated that a “large amount” of “sensitive and intimate information” has been purchased by the intelligence community, including information that the US Supreme Court has previously ruled is protected by the Fourth Amendment. Senior congressional sources say many lawmakers were taken aback by the apparent breadth of the collection and of the warnings in the report about its potential to “facilitate blackmail, stalking, harassment, and public shaming.” 

Other lawmakers are alarmed by the FBI’s disclosure of having purchased location information derived from people’s cell phones. During a hearing in March, the FBI director, Christopher Wray, told senators that the bureau had “previously—as in the past—purchased some such information for a specific national security pilot project.”

Americans have a reasonable expectation of privacy, the US Supreme Court says, when it comes to certain digital information, including that which could reveal “the whole of their physical movements.” Such data—which the court describes as “detailed, encyclopedic, and effortlessly compiled”—need not be GPS-precise merely to justify a warrant. Nevertheless, the government has widely adopted the view that the Fourth Amendment does not apply when that same data is available to it commercially. 

When provided, the government's reasoning typically hinges on analysis of the landmark 2018 _Carpenter v. United States_ decision, in which the Supreme Court ruled that the government’s warrantless acquisition of cellular records, which can be used to track a person’s movements, had violated the rights of a 32-year-old man who'd been convicted of carrying out a string of robberies.

In its 5–4 opinion, the court refers to police demanding or “compelling” access to data, something that literal interpreters of the law say places commercial arrangements with data brokers squarely outside the scope of the court opinion. What's more, government lawyers have pointed to acknowledgment from the court that the debate over _Carpenter_ did not consider “collection techniques involving foreign affairs or national security.”

The Supreme Court has erstwhile framed the Fourth Amendment as a means to “plac\[ing\] obstacles in the way of a too permeating police surveillance,” something that the Constitution’s authors deemed a “greater danger to a free people than the escape of some criminals from punishment.” Oft-cited by the court is a passage by a 19th-century American jurist: “Of all the rights of the citizen, few are of greater importance or more essential to his peace and happiness than the right of personal security, and that involves not merely protection of his person from assault, but exemption of his private affairs, books, and papers, from the inspection and scrutiny of others. Without the enjoyment of this right, all others would lose half their value.”

What rules or guidelines do exist within the intelligence community for purchasing commercial data often justify the activity by deeming the information “publicly available,” pointing to the fact that it may be open for purchase by not only private companies but foreign governments as well. While true and worrying, that is also irrelevant, says Bob Goodlatte, the former chairman of the House Judiciary Committee who now works as a senior policy adviser for the Project for Privacy & Surveillance Accountability, a pro-privacy group.

“None of those other entities can arrest you, can charge you with a crime, try you, sentence you, imprison you, restrain you, enjoin you, fine you, tax you,” Goodlatte says. “All of those are powers of government, and any American should be concerned about the ease with which the federal government can gather information about people.”

Sean Vitka, a senior attorney at the nonprofit Demand Progress, whose slate of issues encompasses privacy and national security reforms, says domestic surveillance was proving to be one of the most bipartisan issues today in Congress, pointing not only to tomorrow’s markup hearing but a concurrent battle being fought over similar purchases by the US military. The House of Representatives last week voted to support an amendment to a defense spending bill requiring a warrant for all data typically protected by the Fourth Amendment, regardless of whether it's for sale. (The amendment was narrowed earlier in the week to exclude non-military agencies, including state and local police departments, which do not fall under the committee of jurisdiction's purview.)

The defense measure, and even the Fourth Amendment Is Not For Sale Act, is a mere prelude to a much bigger fight coming this fall over what's considered the “crown jewel” of the US intelligence community: Section 702 of the Foreign Intelligence Surveillance Act. 

“We are now seeing momentous alignment of powerful political actors in favor of enacting major privacy protections for people in the United States,” says Vitka, “on the eve of the biggest fight over warrantless surveillance in generations.”

Source

Wired