An explosion of interest in OpenAI’s sophisticated chatbot means a proliferation of “fleeceware” apps that trick users with sneaky in-app subscriptions.

Any major trend or world event, from the coronavirus pandemic to the cryptocurrency frenzy, will quickly be used as fodder in digital phishing attacks and other online scams. In recent months, it has become clear that the same would happen for large language models and generative AI. Today, researchers from the security firm Sophos are warning that the latest incarnation of this is showing up in Google Play and Apple’s App Store, where scammy apps are pretending to offer access to OpenAI’s chatbot service ChatGPT through free trials that eventually start charging subscription fees.

There are paid versions of OpenAI’s GPT and ChatGPT for regular users and developers, but anyone can try the AI chatbot for free on the company’s website. The scam apps take advantage of people who have heard about this new technology—and perhaps the frenzy of people clamoring to use it—but don’t have much additional context for how to try it themselves. The researchers first learned about the scam apps after seeing ads for them in news apps and on social networks, but users may also encounter them by searching in Google Play and the App Store.

“I saw multiple ads for these types of apps on social media platforms where it’s cheap to advertise, and sometimes they use tactics like typos in the name—calling the app ‘Chat GBT’ or others—to screen out people who might be a bit more savvy,” says Sean Gallagher, a senior threat researcher at Sophos. “They’re trying to screen out people who would do the free trial and then cancel it because it’s crap. They want the people who are not focused enough to know how to unsubscribe.”

Such scams are known as fleeceware. And these apps, which hook victims into paying a regular weekly or monthly fee, are difficult to stamp out, because they typically don't exhibit the technically invasive and malicious behavior that would get more explicit malware booted. When scammers submit their apps to Apple and Google for review, the researchers note, they may not include all of the details on the subscription pricing and when users will have to pay to continue receiving functionality. Later, they can revise their demands without changing anything about how the app is engineered.

Google and Apple provide mechanisms for developers to offer in-app purchases, both one-time fees and recurring charges. And these companies get a cut every time apps in their app stores collect payments from users.

In the case of the Android app Open Chat GBT, users could download the app for free but were quickly confronted with huge quantities of ads and could try the chatbot only three times before losing access to its functionality and receiving a prompt to subscribe. By default, users could sign up for a three-day free trial to continue using the app, which would then become a monthly $10 subscription. Open Chat GBT also offered a $30 annual subscription. The researchers found a very similar app with a different name by the same developer for iOS in the App Store.

The Sophos researchers note that Apple and Google took down some of the fake AI chatbot apps they were looking at before disclosure. There were others, though, that remained available after the researchers flagged them to Google and Apple. Both companies acknowledged receipt of the submissions, and Google took down one more app. Google and Apple did not immediately respond to requests for comment about the findings.

The researchers say they suspect that some of the apps use OpenAI’s ChatGPT 3 application programming interface to generate content for users while others use lower-quality chatbot functionalities. And instead of limiting the user to a small number of queries, some of the apps would truncate responses and give users only a snippet until they started a subscription.

Gallagher says that one of the biggest problems with fleeceware is that users don't always know how to manage their subscriptions and don't realize that even when they delete an app, their recurring payments will continue to be active with the service.

“We define fleeceware as something that charges an extraordinary amount of money for a feature that is available freely or at very low cost elsewhere,” he says. “And it’s effective, because even I sometimes wonder, why am I getting charged this much by Apple every month? And it's like, OK, there’s the shared family storage, there's AppleCare for my phone, there’s Duolingo. You have to be very careful—you have to actively manage subscriptions to apps.”

ChatGPT Scams Are Infiltrating Apple's App Store and Google Play

The Meta-owned app offers end-to-end encryption of texts, images, and more by default—but its settings aren't as private as they could be.

In the summer of 2016, WhatsApp made an unprecedented change. The Meta-owned company turned on end-to-end encryption by default for all of the billion-plus people using it—becoming, in the process, the world's largest encrypted messenger. Since then, that number has topped 2 billion.

Being end-to-end encrypted by default means nobody at Meta can read, or mine data from, the content of the messages you send. All texts, photos, videos, voice messages, documents, status updates, and calls are encrypted on WhatsApp, and only the people you send them to can access them. Devices decoding encrypted content must verify and exchange security codes as messages are transferred.

The encryption that WhatsApp uses was originally developed by Open Whisper Systems, the group behind the encrypted messaging app rival Signal. In recent years, WhatsApp has introduced additional privacy and security features you can turn on. But even though WhatsApp’s end-to-end encryption does protect your communications, that doesn’t mean the service is as private as it could be by default. In fact, when it comes to WhatsApp versus Signal, we recommend the latter for people wanting the maximum security and privacy options.

However, with more than a third of the world using WhatsApp, its popularity is unrivaled, and you may not be able to drag all of your friends, family, and groups across to Signal. If that milestone is still some way off, here are some tips to make WhatsApp as private as possible.

_Updated May 2023: WhatsApp has introduced new privacy features since this story was first published in 2020. These changes are reflected below._

Understand What Data WhatsApp Collects

WhatsApp can collect a lot more information about you than you might think. Much of what it collects is similar to many other apps and can be found in its privacy policies. There are separate privacy policies for the US, Europe, and the UK. There are some differences in what WhatsApp collects, based on Europe’s privacy rules. But the app is also part of Meta’s machine, which also includes Facebook and Instagram, and some information is shared with the parent company. The association alone can put people off using WhatsApp.

The data WhatsApp has about you can come from multiple different sources: the information you provide (such as your phone number to sign up, or your location when you give it permission to share it with a friend), information that is collected automatically (for instance, when you’re online, or when you made a phone call), and information that others share about you (if a friend uploads your phone number, for example).

Automatically collected, WhatsApp says, is information about how you use its services, how often and for how long you are on WhatsApp, and the features you use—including “group name, group picture, group description,” your profile photo, “about information,” and when you were last online. (Some of this information is used for safety features.) On top of that, WhatsApp may also collect information about your phone’s battery level, signal strength, and mobile operator.

In the US, WhatsApp shares your phone number, phone information, IP address, and more with Meta’s other companies, although it says it does not “keep logs of who everyone’s messaging or calling” and doesn’t share contacts with Meta. In Europe, WhatsApp details how it works with Meta’s other companies and the information that is shared more explicitly. However, it’s worth stressing that the content of the messages you send isn’t shared, as Meta doesn’t have access to them due to WhatsApp’s end-to-end encryption.

Location information, when you turn it on, is also collected, and there are cookies that track your activity within the desktop and web versions of the app.

Use Encrypted-to-End Encrypted Backups

WhatsApp allows you to back up your chats and data as a way to move all your information to a new phone. These backups work by storing your data in Google Drive or Apple’s iCloud, depending on which operating system you use. Backups can be handy if you’re moving to a new phone or lose your old device.

If you’re going to use WhatsApp’s backups, you should use the version that is end-to-end encrypted. The company introduced these in 2021 after years of the option being unavailable. In WhatsApp, go to **Settings, Chats, Chat Backup**, and then once you have turned backups on, tap on **End-to-end Encrypted Backup** and toggle the option on. This backup requires a separate password, which you should ideally create and store in a password manager. If you lose this password, you won’t be able to get into your encrypted backup.

Turn On Two-Factor Authentication

You should be using two-factor authentication as much as possible—it’s even more important on accounts that hold your sensitive personal information, such as photos and messages. The security method involves adding an extra step to the process when you log in to an account. In most cases, this involves using a security code generated by an app, a code sent via SMS, or a physical security key. (The last of these is the most secure way to protect your accounts with two-factor authentication—and SMS is arguably the least secure of the three options.)

Using WhatsApp is different from logging in to your email. It’s likely that you’ll access the app multiple times a day—on average, I open the app between 50 and 80 times per day. Entering a security code every time this happens would be impractical and frustrating. So instead, WhatsApp’s two-factor authentication, which can be turned on through the **Settings** menu and then by tapping on **Account**, uses a PIN.

WhatsApp will semi-regularly ask you to reenter the six-digit PIN you create to access the app. It doesn’t say how often these prompts happen, but they’re irregular enough not to be a barrier to using the app. The PIN will also be required anytime there is an attempt to add your number to a new phone or device. When you’re setting the PIN, there’s also the option to add an email address that can be used to reset the code if you forget it.

Use Disappearing Messages

Your messages don’t have to live forever. It’s possible to turn on disappearing messages for when you want additional privacy or just don’t need to keep what you’re sent for years. There are two ways within WhatsApp to use self-destructing messages: for every new chat you have, or on an individual conversation basis. 

To run on disappearing messages by default for new conversations, go to **Settings**, **Privacy**, **Default Message Timer**, and pick how long you want messages to last for. There are three options if you turn the setting on: 24 hours, 7 days, or 90 days. For an existing individual conversation or group chat, **open that chat**, **tap the person’s name** at the top of the screen, select **Disappearing Messages,** and then pick 24 hours, 7 days, 90 days, or Off. You may then have to tap to confirm this.

While turning on disappearing messages will give you some more privacy, it’s worth remembering that whoever you message could still screenshot or take a photograph of what’s on the screen.

In addition to disappearing messages, you can also set photos and views to View Once. This—rather unsurprisingly—behaves exactly how it is described: The message can only opened one time and you can't go back to it once it's closed. When sending a photo or video, tap the icon that is contained within a partial circle. If you send a one-time image or video, people cannot screenshot it.

Lock Down WhatsApp Messages

There are inevitably times when you need to hand your phone to someone else—so your children can play games, for instance, or to show a friend a photo. WhatsApp has two features that can help protect your message if your phone falls into someone else’s hands. First, you can turn on Screen Lock, which keeps the app locked unless you open it with Apple’s Face ID or other biometrics on Android devices. To turn it on, go to **Settings**, **Privacy**, and select **Screen Lock**. You’ll need to set up the biometric options before you turn the app lock on.

You can also lock down individual chats on your phone. This means that to send messages to locked chats, you’ll need to use your phone’s passcode, or your face or fingerprint to open up the chats and even see notifications from them. To turn it on, tap **on a chat** and the person’s name, go to **Chat lock**, and select the option to **lock the chat**. This will move the chat into a new folder that can be accessed by **swiping down on the Chats tab**.

If you’re going for the most private approach, it’s also worth considering that any message that pops up could reveal private information. New message notifications can include the entire message or just some of its content when they flash up on your screen. If these notifications also sit unread, anyone picking up your device may be able to read them without having to unlock the phone. These options can be tweaked in **Settings**, **Notifications**, and **Show Preview.**

Stop People From Seeing Your Personal Info

While WhatsApp’s end-to-end encryption stops law enforcement, internet providers, and even Meta from seeing what you are sending, there are still some additional steps you can take to increase your privacy on your phone and reduce the chances of your number being targeted by spammers or scammers. Because WhatsApp is so popular, it’s regularly the target of social engineering attacks, devised to steal your personal information. 

The ways to limit the ways people can interact with your account are all found through **Settings**, followed by tapping on **Privacy**. At the most simple, you can tap to turn off read receipts, the two blue ticks that show when someone has seen your message. 

More effective are the steps that stop people from adding you to groups. Under the **Groups** setting, there is the option to limit who can add you to a group. By default, this is set as “everyone.” However, it can be changed to **My Contacts**, or **My Contacts Except…**, allowing some exceptions. Deciding to limit who can add you to groups doesn’t mean that you can’t join groups when people aren’t in your contacts. Instead, people wanting to add you to groups can request to do so via a separate message.

Within **Privacy,** you can also turn off who can see when you last looked at WhatsApp and when you were last online, who can see your profile photo, the About section, and WhatsApp Status. While in the privacy settings, you should also check whether you are sharing your live location with anyone.

Switch to Signal

If you’re looking for more privacy, switching messaging apps is a big upheaval but could be worth the time and effort. As mentioned earlier, our preference for combining end-to-end encryption with greater levels of privacy is Signal. A full rundown of its privacy options is here.

WhatsApp 2023: New Privacy Features, Settings, and More

The families of victims of a mass shooting in Buffalo are challenging the platforms they believe led the attacker to carry out a racist massacre.

Elmore says the goal is to force reform.

“We can’t bring the victims of this lawsuit back, but we can make sure that no other families have to file this kind of lawsuit,” he says. No families deserve to be members of this unenviable club, Elmore says.

The lawsuit essentially takes aim at the full journey that brought Gendron from being a regular American teen to becoming a violent white supremacist—one equipped with the means and intention of massacring as many Black people as possible. They point to platforms like Facebook and Snapchat as the first part of that process.

“Gendron’s radicalization on social media was neither a coincidence nor an accident,” the complaint alleges. “It was the foreseeable consequence of the defendant social media companies’ conscious decision to design, program, and operate platforms and tools that maximize user engagement (and corresponding advertising revenue) at the expense of public safety.”

The lawsuit claims that the white supremacist ideology that captured Gendron, particularly the “great replacement theory”—which imagines an international plot to weaken the political power of white people—is a “product of social media.” While it may have been conjured up by a French author and promoted by hardened neo-Nazis, the lawsuit claims that “replacement theory proponents rely heavily on social media—and the tools and features the Social Media Defendants utilize to increase their own engagement—to promote racist ideology to young and impressionable adherents.”

Exposure to this kind of hate propaganda as a teenager, mixed with the addictive nature of social media, fundamentally altered Grendron’s brain chemistry, Elmore argues in his filings.

Social media platforms maximized user engagement “not by showing them content they request or want to see, but rather, by showing them and otherwise recommending content from which they cannot look away,” the complaint continues. “Taking full advantage of the incomplete development of Gendron’s frontal lobe, Instagram, YouTube, and Snapchat maintained his product engagement by targeting him with increasingly extreme and violent content and connections which, upon information and belief, promoted racism, antisemitism, and gun violence.”

This is not a bug, Elmore argues. “These products were functioning as designed and intended.”

These platforms pointed Gendron to the next step in his radicalization: 4chan.

While there is no algorithm on the notorious image board, there was a waiting “community of fellow racists urging him to move forward,” the lawsuit alleges. What’s more, Gendron was a frequent user of /k/, the weapons board. That community, and similar ones on Discord, helped him prepare for the attack and increase his chances of succeeding.

The lawsuit singles out 4chan financial backer Good Smile, a major Japanese toy company that in 2015 invested $2.4 million for a 30 percent share in the site, according to documents WIRED obtained. Pointing to reporting from WIRED and a lawsuit filed by former employees of the company, the families allege that Good Smile’s role in 4chan “is not that of a passive investor but is actively involved in the management of the social media site.”

In a statement from April, Good Smile denied WIRED’s reporting, insisting, “We do not have a partnership with 4chan, never had influence over the management and/or control of 4chan.” In the same statement, however, Good Smile also says, “We severed any limited relationship we previously had with 4chan in June of 2022. Since then, we have not had any relationship with 4chan.” The company has cited “confidentiality obligations” preventing it from commenting on the matter and has ignored multiple requests for comment.

Buffalo Mass Shooting Victims' Families Sue Meta, Reddit, Amazon

A government effort to collect people’s internet records is moving beyond its test phase, but many details remain hidden from public view.

The UK government is quietly expanding and developing a controversial surveillance technology that could be capable of logging and storing the web histories of millions of people.

Official reports and spending documents show that in the past year, UK police have deemed the testing of a system that can collect people’s “internet connection records” a success, and have started work to potentially introduce the system nationally. If implemented, it could hand law enforcement a powerful surveillance tool.

Critics say the system is highly intrusive, and that officials have a history of not properly protecting people’s data. Much of the technology and its operation is shrouded in secrecy, with bodies refusing to answer questions about the systems.

At the end of 2016, the UK government passed the Investigatory Powers Act, which introduced sweeping reforms to the country’s surveillance and hacking powers. The law added rules around what law enforcement and intelligence agencies can do and access, but it was widely criticized for its impact on people’s privacy, earning it the name the “Snooper’s Charter.”

Particularly controversial was the creation of so-called internet connection records (ICRs). Under the law, internet providers and phone companies can be ordered—with a senior judge approving the decision—to store people’s browsing histories for 12 months.

An ICR isn’t a list of every page online you visit, but may nonetheless reveal a significant amount of information about your online activities. ICRs can include that you visited Wired.com but not that you read this individual article, for instance. An ICR can also be your IP address, a customer number, the date and time the information was accessed, and the amount of data being transferred. The UK government says an internet connection record could indicate when, for example, the travel app EasyJet is accessed on someone’s phone, but not how the app was used.

“ICRs are highly intrusive and should be protected from over-retention by telecommunications operators and intelligence agencies,” says Nour Haidar, a lawyer and legal officer at UK civil liberties group Privacy International, which has been challenging data collection and handling under the Investigatory Powers Act in court.

Little is known about the development and use of ICRs. When the Investigatory Powers Act was passed, internet companies said it would take them years to build the systems needed to collect and store ICRs. However, some of those pieces may now be falling into place. In February, the Home Office, a government department that oversees security and policing in the UK, published a mandatory review of the operation of the Investigatory Powers Act so far.

The review says the UK’s National Crime Agency (NCA) has tested the “operational, functional, and technical aspects” of ICRs and found a “significant operational benefit” of collecting the records. A small trial that “focused” on websites that provided illegal images of children found 120 people who had been accessing these websites. It found that “only four” of these people had been known to law enforcement based on an “intelligence check.”

WIRED first reported the existence of the ICR trial in March 2021, when there were even fewer details about the test. It is still unclear which telecom companies were involved. The Home Office’s February report is the first official indication that the trial was useful to law enforcement, and could help lay the groundwork for expanding the system across the UK. The Home Office review also states its trial found that “ICRs appear to be currently out of reach for some potentially key investigations,” raising the possibility that the law may be changed in the future.

In May 2022, the Home Office issued a procurement notice revealing that future trials “work is now underway” to create a “national ICR service.” The existence of the notice was initially reported by the public sector technology publication PublicTechnology. The notice says the government had a budget of up to £2 million to create a technical system that allowed law enforcement officials to access ICR data for investigations.

The contract for the technical system was awarded to defense firm Bae Systems in July 2022. In response to a Freedom of Information Act request from WIRED, the Home Office provided some pages of the contract with Bae but refused to give any technical details due to commercial interests. (A spokesperson for Bae said it could not discuss specific contracts for confidentiality and security reasons.)

The Home Office FOIA response also refused to provide details of an internal review into ICRs, citing national security and law enforcement grounds. A Home Office spokesperson said the UK has “one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world” and confirmed that trials of ICRs are ongoing.

When asked whether ICRs will be rolled out across the entire UK, the Home Office spokesperson pointed to the FOIA response, which says that providing additional information may jeopardize law enforcement activities. “Information on law enforcement capabilities and targeting is very sensitive, particularly in the field of digital communications, where it is often the case that criminal groups or individuals themselves display a high degree of technical sophistication and awareness,” the FOIA response says. Because of this, it continues, “it is vital that sensitive information on how they might conduct their investigations, or the nature of their technical abilities, are not publicly known.”

The Investigatory Powers Commissioner's Office (IPCO), which oversees intelligence agencies, police, and local authorities, says the collection of ICRs to date has been to support “small-scale trials” and that it is “unable” to provide any figures on the number of data retention notices issued. A separate independent review of the Investigatory Powers Act is due to be published this summer. The National Crime Agency says it is still participating in the ICR trials to evaluate the use of ICRs, and that “data exploitation is essential” to its work.

Despite the potentially limited use of ICRs so far, there has already been one documented failure. In its annual 2020 report, published in January 2022, IPCO highlighted that an unnamed telecoms company that was asked to provide internet connection requests “provided data in excess of that which had been authorized.” The reason? There was a technical error. No extra detail was provided.

WIRED contacted nine of the UK’s internet service providers and telecom companies asking about their abilities to create and store people’s internet connection records. Eight did not respond to the request for comment. TalkTalk, the only one that did, said it will “meet its obligations” under UK law but couldn’t “confirm or deny” whether ICRs existed.

The possible expansion of ICR collection in the UK comes as governments and law enforcement agencies globally try to gain access to increasing amounts of data, particularly as technology advances. Multiple nations are pushing to create encryption backdoors, potentially allowing access to people’s private messages and communications. In the US, a storm is brewing about the FBI’s use of Section 702 of the Foreign Intelligence Surveillance Act (FISA), which allows it to intercept the communications of overseas targets.

Haidar of Privacy International says that creating powers to collect more of people’s data doesn’t result in “more security” for people. “Building the data retention capabilities of companies and a vast range of government agencies doesn't mean that intelligence operations will be enhanced,” Haidar says. “In fact, we argue that it makes us less secure as this data becomes vulnerable to being misused or abused.”

The UK’s Secretive Web Surveillance Program Is Ramping Up

The two-factor authentication tool got some serious upgrades that can help you bolster security for your online accounts.

Yes, two-factor authentication is a crucial layer of security to add to your online accounts, but you remain vulnerable to hacks if you receive the codes via text message. A better way to manage these quick codes is to use an authenticator app, like Google Authenticator or Twilio Authy. When you use an authenticator app, the multifactor codes are available in-app instead of through a text.

Want to make the switch from a 2FA process ruled by SMS messages to a more secure option? Here’s how you can get started with Google Authenticator, what’s recently changed about the app, and how to access your codes in-app.

How Do I Set It Up?

To start off, download the app to your smartphone or tablet. Google Authenticator is available for iOS and Android. Open the app and tap on the **Get Started** button. You will have the option to either log in with your Google account or use the app without logging in. If you do log in, Google Authenticator will save your 2FA data for you. More on this in a moment.

The next step is to pick which online account you want to set up with Google Authenticator. The websites you visit most often likely support multifactor authentication through the app. From Amazon and Gmail to TikTok and Dropbox, the steps vary a little, but the overall process is essentially the same.

Once you’ve selected an account, the rest of the setup can go one of two ways. You can either scan a QR code using the camera on your smartphone or manually enter the code.

Let’s use Amazon’s login process as an example. Your first option is to log in to your Amazon account on a laptop, go to the **Account** page, and choose **Login & security**. Then, click **Turn on** for two-factor authentication and **Get started** on the following page. The preselected choice you’ll see is to receive the codes via text message. Instead, choose the option for an **Authenticator App**.

When you see a QR code on the laptop screen, open the Google Authenticator app on your phone. Tap the plus sign in the bottom-right corner of the app and then **Scan a QR code**. Decide whether you want to allow the app access to your camera; otherwise you’ll need to enter the codes by hand. Scan the barcode with your smartphone and an expiring code will pop up in the app and keep regenerating. Next, type the six-digit code into the laptop. Acknowledge that older devices may require a special login process for 2FA codes and finish the setup process.

What’s New About It?

In the past, a common criticism of Google Authenticator was that all of your codes were locked into one phone. If you lost the device on a buzzy night out with friends or a thief snatched it from your grasp, it could be difficult or impossible to get into your connected accounts. Similarly, if you upgraded your phone, it could be a pain to scan all of the QR codes for your sites and services or to export and import them to the new device and set everything up again.

In addition to some design changes, Google recently added functionality that enables your codes to be synced across your Google account. When you’re in the authenticator app, you’ll see a green cloud with a check mark in the top-right corner next to your profile photo that indicates your codes are synced. Note that you have to be logged in to use this feature, so if you’ve been using Google Authenticator without logging in, you’ll have to either log in to store the info in your account or export and import your data on new devices the old way.

OK, Now Give Me Those Darn Codes

So, you’ve set it up and synced the codes with your Google account. What’s next? When logging in to any accounts you’ve connected to Google Authenticator, you’ll open the app, locate the impermanent code associated with that account, and use it to finish the process. 

Looking for more ways to protect your online accounts? An authenticator app is not your only option for beefed-up security. In fact, you can protect your most important logins even further with a physical security key.

How to Use Google Authenticator

The FBI disables notorious Russia-linked malware, the EU edges toward a facial recognition ban, and security firm Dragos has an intrusion of its own.

While the company says that they did not find any evidence of malicious use of the exposed data, the incident highlights an increasing threat as car manufacturers push into vehicle connectivity and AI-enabled features require the collection of massive quantities of data.

You can check the types of data a particular car manufacturer might be collecting and sharing using this free tool made by automotive privacy company Privacy4Cars.

The United States and its allies have successfully disabled Russian malware that one of the Kremlin’s most sophisticated hacker units had installed on hundreds of computers around the world. After spending years monitoring a malware network called Snake, the FBI developed and deployed a tool called Perseus—named after the Greek hero who slayed monsters—that caused the malware to overwrite and disable itself, the Department of Justice announced on Tuesday.

Snake is developed and operated by Turla, a notorious state-sponsored hacking group linked to Russia’s Federal Security Service, or FSB. Prosecutors said the Russian spies behind Turla have used versions of the Snake malware to steal sensitive documents from scores of governments, journalists, and “other targets of interest to the Russian Federation.” 

According to unsealed court documents, the Snake malware operated as a “peer-to-peer” network linking infected computers around the world, allowing Turla to install malware and exfiltrate data.

Europe this week got one step closer to banning facial recognition in public spaces with a lawmaker agreement to strengthen proposed legislation governing how artificial intelligence technology can be used in the European Union. 

In a vote on Thursday morning, members of the European Parliament agreed to include the ban in the text of the highly anticipated AI Act, the world's first comprehensive legislation governing the technology. "This vote is a milestone in regulating AI, and a clear signal from the Parliament that fundamental rights should be a cornerstone of that," MEP Kim van Sparrentak told Reuters. "AI should serve people, society, and the environment, not the other way around."

A ransomware group attempted to extort money from Dragos, a leading industrial cybersecurity firm, in an unsuccessful campaign targeting company executives, the firm said on Wednesday.

While the hackers gained access to a limited set of customer data, Dragos said it chose not to engage with the group. “The data that was lost and likely to be made public because we chose not to pay the extortion is regrettable,”  the company said. “However, it is our hope that highlighting the methods of the adversary will help others consider additional defenses against these approaches so that they do not become a victim to similar efforts.”

Toyota Leaked Vehicle Data of 2 Million Customers

Three states are suing to block security rules for water facilities. If they win, it may open the floodgates for challenges to other cyber rules.

The White House doesn’t have the same control over the EPA, which is an independent agency, but Greene says that from what he saw, the agency tried to collaborate with the water sector.

The NSC did not respond to a request for comment about the EPA lawsuit and its possible effects on the administration’s agenda. The EPA declined to comment because the litigation is pending.

A Legal Fight on Multiple Fronts

The Republican attorneys general challenging the EPA directive make several claims. They say the agency failed to follow the proper procedure for issuing a regulation. They allege that the EPA exceeded its authority under the Safe Drinking Water Act and subsequent legislation. And they argue that, by requiring state water regulators to fold cybersecurity into their inspections, the federal government is usurping states’ sovereign authority to regulate water facilities and unconstitutionally burdening them with new work.

Michael Blumenthal, an environmental regulation lawyer at McGlinchey Stafford, says the EPA did appear to have violated the Administrative Procedure Act by issuing its directive to states as a reinterpretation of existing guidance about states’ responsibilities to conduct “sanitary surveys” of water facilities, thus sidestepping the public comment process.

Peggy Otum, a partner at WilmerHale who leads the law firm’s environment practice, says the state-sovereignty argument reflects a broader debate about how much the federal government—and the EPA in particular—can burden states with new mandates. “‘Who's gonna pay for it?’ is the main question,” Otum says.

Greene was skeptical of this argument. The White House is aware of the water sector’s funding issues, he says, but that’s not a good enough reason to refrain from mandating better security.

Open for Interpretation

But the most consequential argument in the case concerns whether the EPA’s regulatory authority for the water sector even extends to cybersecurity. Blumenthal says the Safe Drinking Water Act “does not give them the authority to fold in cybersecurity.”

The EPA derived its authority from newly reinterpreted definitions of key terms in its guidance to states, but Blumenthal says that approach was invalid and would allow mandates that were “never contemplated to begin with.”

Greene argues that laws like the Safe Drinking Water Act, while enacted before cyber threats gained prominence, were clearly intended to let the EPA protect vital resources against all manner of dangers. “It would be an overly literal reading of the intent of these \[laws\] to say, ‘They didn’t think about cybersecurity, so you can't cover it,’” Greene says. “That's like saying, ‘The colonial armies didn’t think about air assets.’”

Courts have historically deferred to agencies in lawsuits over the interpretation of their core statutes, but this principle, known as _Chevron_ deference, “is hanging on by a thread” at the US Supreme Court, Otum says.

“Everyone's Sniffing Around”

The EPA lawsuit looms large as a potential stumbling block for the Biden administration’s new national cyber strategy, which describes critical infrastructure regulation as a national security imperative. Other regulators “are going to watch this case very closely to see what happens,” Blumenthal says.

The Department of Health and Human Services is working on cyber rules for hospitals, which, like water facilities, are heavily regulated by states. The Federal Communications Commission (FCC) is preparing rules to secure the Emergency Alert System, a critical tool for state and local authorities. And the Federal Trade Commission (FTC) is updating its security regulations and sharpening its oversight of data breach disclosures.

A Republican-Led Lawsuit Threatens Critical US Cyber Protections

The social network's new privacy feature is technically flawed, opt-in, and limited in its functionality. All this for just $8 a month.

Elon Musk's long-promised launch of encrypted direct messages on Twitter has arrived. Like most attempts to add end-to-end encryption to a massive existing platform—never an easy proposition—there's good, bad, and ugly. The good: Twitter has added an optional layer of security for a small subset of its users that has never existed in Twitter's 16-plus years online. As for the bad and ugly: Well, that list is quite a lot longer.

On Wednesday night, Twitter announced the release of encrypted direct messages, a feature that Musk had assured users was coming from his very first days running the company. To Twitter's credit, it accompanied the new feature with an article on its help center breaking down the new feature's strengths and weaknesses with unusual transparency. And as the article points out, there are plenty of weaknesses. 

In fact, the company appears to have stopped short of calling the feature "end-to-end" encrypted, the term that would mean only users on the two ends of conversations can read messages, rather than hackers, government agencies that can eavesdrop on those messages, or even Twitter itself.

"As Elon Musk said, when it comes to Direct Messages, the standard should be, if someone puts a gun to our heads, we still can’t access your messages," the help desk page reads. "We’re not quite there yet, but we’re working on it."

In fact, the description of Twitter's encrypted messaging feature that follows that initial caveat seems almost like a laundry list of the most serious flaws in every existing end-to-end encrypted messaging app, now all combined into one product—along with a few extra flaws that are all its own.

The encryption feature is opt-in, for instance, not turned on by default, a decision for which Facebook Messenger has received criticism. It explicitly doesn't prevent “man-in-the-middle” attacks that would allow Twitter to invisibly spoof users' identities and intercept messages, long considered the most serious flaw in Apple's iMessage encryption. It doesn't have the “perfect forward secrecy” feature that makes spying on users harder even after a device is temporarily compromised. It doesn't allow for group messaging or even sending photos or videos. And perhaps most seriously, it currently restricts this subpar encrypted messaging system to only the verified users messaging each other—most of whom must pay $8 a month—vastly limiting the network that might use it.

“This clearly is not better than Signal or WhatsApp or anything that uses the Signal Protocol, in terms of features, in terms of security,” says Matthew Green, a professor of computer science at Johns Hopkins who focuses on cryptography, referring to the Signal Messenger app that's widely considered the modern standard in end-to-end encrypted calling and texting. Signal's encryption protocol is also used in both WhatsApp's encrypted-by-default communications and Facebook Messenger's opt-in encryption feature known as Secret Conversations. (Both Signal and WhatsApp are free, compared to the $8 per month for a Twitter Blue subscription that includes verification.) “You _should use those things instead_ if you really care about security,” Green says. "And they’ll be easier because you won’t have to pay $8 a month."

"On the positive side," Green adds, "hey, it’s a first step, maybe it’ll get better."

Musk has praised Signal in comments to Twitter's staff, and even said that he'd spoken with Signal's creator, Moxie Marlinspike, about similarly encrypting Twitter's DMs—a goal that Marlinspike himself shared when he briefly led Twitter's security team nearly a decade ago.

So Green—who has consulted at both WhatsApp and Facebook in their rollouts of encryption features based on Signal's protocol—was surprised to see that Twitter's encrypted messaging feature lacks so many of the positive properties of Signal and WhatsApp's end-to-end encryption. Beyond its lack of support for encrypted photos, videos, and group chats—key features of both Signal and WhatsApp—it also excludes the Signal protocol's constantly changing cryptographic keys, which are used to encrypt each message and never repeat.

That feature of Signal is what ensures "perfect forward secrecy," the security property that if a device is somehow compromised and the private key that decrypts messages is stolen, an eavesdropper still can't spy on future messages to and from that user. “I'm a little baffled by the lack of perfect forward secrecy,” says Green. “That's a basic feature of the Signal protocol.”

Twitter writes in its help center explanation that it essentially couldn't make that feature work while preserving the ability to access DMs when the user logs in on a new device. “We don’t plan to address this limitation,” the article reads.

Then there's the company's professed inability to stop “man-in-the-middle” attacks, in which Twitter itself could spoof users' identities to intercept their messages. In end-to-end encryption systems, messages are encrypted with an intended recipient's public key, such that only the recipient's private key—which is safely stored on the recipient's device—can decrypt them. But Twitter could trick a user—or even be compelled to do so by a government—so that their device invisibly encrypts messages to an eavesdropper's public key instead. Those messages could then be read and then re-encrypted with the intended recipient's key before they're sent on.

Apple's iMessage, which is otherwise considered a relatively strong end-to-end encryption system, has long suffered from this same vulnerability. But WhatsApp and Signal attempt to prevent man-in-the-middle attacks by allowing users to check a key “fingerprint” that ensures they're encrypting messages to the intended recipient. For now, Twitter has no such fingerprint-checking feature, though it says that it will add it soon.

That missing feature may be part of why Twitter has so far declined to even claim that it offers true end-to-end encryption, the "can't-read-your-messages-with-a-gun-to-our-head" feature Musk has promised.

"This appears to be a hasty deployment of a product that isn’t quite fully baked yet," says Riana Pfefferkorn, a security researcher at Stanford University's Internet Observatory. She points out that Zoom was penalized by the Federal Trade Commission in 2020 for claiming that it offered "end-to-end" encryption when it didn't—and that Twitter's reluctance to use the term may be a sign that it's not sure its system could meet that “end-to-end-encrypted” standard.

While Twitter is remarkably transparent about its encrypted DM feature's shortcomings on its help center page, Pfefferkorn worries that its flaws may not be as clear in the actual web and app interface that users see. “I think it was a good choice for the help page to try from the very first paragraph to manage expectations,” she says. “It remains to be seen whether Twitter users will believe that encrypted DMs offer more privacy and security than they actually do.”

Perhaps the most serious drawback to Twitter's encrypted DMs is simply that very few of its users will have the ability to send or receive them. The feature, at least for now, only works between two verified accounts, which either must be verified institutions or users who pay $8 a month for their blue check mark. “This shouldn’t be something you have to pay for,” says Green. “You shouldn’t have to pay for basic security.”

The notion of end-to-end encrypted Twitter DMs might one day offer a crucial new method to find someone online and send them a secret message; after all, Signal and WhatsApp's biggest drawback is that both require that you know a person's cell phone number, while Twitter DMs allow strangers to interact more freely. But as long as the encrypted DM feature is only available to send messages to and from verified accounts, its network will, by some measures, be even more restricted, limited to only a tiny fraction of Twitter's overall users.

For Twitter's security-conscious users, there remains only one way to send someone an encrypted message, and it hasn't changed in years. Send someone a DM, ask for their Signal number, and use Signal to start an actual, end-to-end encrypted conversation.

_Additional reporting by Lily Hay Newman_

Twitter’s Encrypted DMs Are Deeply Inferior to Signal and WhatsApp

We talk to the Signal Foundation’s Meredith Whittaker about how the surveillance economy is newer than we all might realize—and what we can do to fight back.

How to Reclaim Your Online Privacy

The unidentified attackers have targeted people on both sides of Russia’s war against Ukraine, carrying out espionage operations that suggest state funding.

Ukrainian networks have been on the receiving end of grimly sophisticated and innovative cyberattacks from pRussia for nearly a decade, and Ukraine has increasingly struck back, particularly since the Kremlin's invasion last year. Amidst all of this and activity from other governments and hacktivists, researchers from the security firm Malwarebytes say that they've been tracking a new hacking group that has been conducting espionage operations since 2020 against both pro-Ukraine targets in central Ukraine and pro-Russia targets in eastern Ukraine. 

Malwarebytes attributes five operations between 2020 and the present to the group, which it has dubbed Red Stinger, though the researchers only have insights into two of the campaigns conducted in the past year. The group's motives and allegiance aren't yet clear, but the digital campaigns are noteworthy for their persistence, aggressiveness, and lack of ties to other known actors.

The campaign that Malwarebytes calls “Operation Four” targeted a member of Ukraine's military who works on Ukrainian critical infrastructure, as well as other individuals whose potential intelligence value is less obvious. During this campaign, attackers compromised victims' devices to exfiltrate screenshots and documents, and even record audio from their microphones. In Operation Five, the group targeted multiple election officials running Russian referendums in disputed cities in Ukraine, including Donetsk and Mariupol. One target was an adviser to Russia's Central Election Commission, and another works on transportation—possibly railroad infrastructure—in the region.

“We were surprised about how big these targeted operations were, and they were able to gather a lot of information,” says Roberto Santos, a threat intelligence researcher at Malwarebytes. Santos collaborated on the investigation with former colleague Hossein Jazi, who first identified Red Stinger activity. “We have seen past targeted surveillance, but the fact that they were collecting real microphone recordings from victims and data from USB drives, it's unusual to see.”

Researchers from the security firm Kaspersky first published about Operation 5 in late March, naming the group behind it Bad Magic. Kaspersky similarly saw the group focusing on government and transportation targets in eastern Ukraine, along with agricultural targets.

“The malware and techniques used in this campaign are not particularly sophisticated, but are effective, and the code has no direct relation to any known campaigns,” Kaspersky researchers wrote.

The campaigns begin with phishing attacks to distribute malicious links that lead to tainted ZIP files, malicious documents, and special Windows linking files. From there, attackers deploy basic scripts to act as a backdoor and a loader for malware. The Malwarebytes researchers note that Red Stinger seems to have developed its own hacking tools and reuses characteristic scripts and infrastructure, including specific malicious URL generators and IP addresses. The researchers were able to expand their understanding of the group's operations after discovering two victims who appear to have infected themselves with Red Stinger malware while testing it.

“It's happened in the past with different attackers that they infect themselves,” Santos says. “I think they just got lazy because they were undetected since 2020.”

Red Stinger appears to be currently active. With details about its operations now entering the public sphere, the group may tweak its methods and tools in an attempt to evade detection. The Malwarebytes researchers say that by releasing information about the group's activities, they hope other organizations will deploy detections for Red Stinger operations and search their own telemetry for additional indications of what the hackers have done in the past and who is behind the group.

Source

Wired