Device manufacturers use “platform certificates” to verify an app’s authenticity, making them particularly dangerous in the wrong hands.

While Google develops its open source Android mobile operating system, the “original equipment manufacturers” who make Android smartphones, like Samsung, play a large role in tailoring and securing the OS for their devices. But a new finding that Google made public on Thursday​ reveals that a number of digital certificates used by vendors to validate vital system applications were recently compromised and have already been abused to put a stamp of approval on malicious Android apps.

As with almost any computer operating system, Google's Android is designed with a “privilege” model, so different software running on your Android phone, from third-party apps to the operating system itself, are restricted as much as possible and only allowed system access based on their needs. This keeps the latest game you're playing from quietly collecting all your passwords while allowing your photo editing app to access your camera roll, and the whole structure is enforced by digital certificates signed with cryptographic keys. If the keys are compromised, attackers can grant their own software permissions it shouldn't have. 

Google said in a statement on Thursday that Android device manufacturers had rolled out mitigations, rotating keys and pushing out the fixes to users' phones automatically. And the company has added scanner detections for any malware attempting to abuse the compromised certificates. Google said it has not found evidence that the malware snuck into the Google Play Store, meaning that it was making the rounds via third-party distribution. Disclosure and coordination to address the threat happened through a consortium known as the Android Partner Vulnerability Initiative.

“While this attack is quite bad, we got lucky this time, as OEMs can quickly rotate the affected keys by shipping over-the-air device updates,” says Zack Newman, a researcher at the software supply-chain security firm Chainguard, which did some analysis of the incident. 

Abusing the compromised “platform certificates” would allow an attacker to create malware that is anointed and has extensive permissions without needing to trick users into granting them. The Google report, by Android reverse engineer Łukasz Siewierski, provides some malware samples that were taking advantage of the stolen certificates. They point to Samsung and LG as two of the manufacturers whose certificates were compromised, among others.

LG did not return a request from WIRED for comment. Samsung acknowledged the compromise in a statement and said that “there have been no known security incidents regarding this potential vulnerability.”

Though Google seems to have caught the issue before it spiraled, the incident underscores the reality that security measures can become single points of failure if they aren't designed thoughtfully and with as much transparency as possible. Google itself debuted a mechanism last year called Google Binary Transparency that can act as a check of whether the version of Android running on a device is the intended, verified version. There are scenarios in which attackers could have so much access on a target's system that they could defeat such logging tools, but they are worth deploying to minimize damage and flag suspicious behavior in as many situations as possible.

As always, the best defense for users is to keep the software on all their devices up to date. 

“The reality is, we will see attackers continue to go after this type of access,” Chainguard's Newman says. “But this challenge is not unique to Android, and the good news is that security engineers and researchers have made significant progress in building solutions that prevent, detect, and enable recovery from these attacks.”

Android Phone Makers’ Encryption Keys Stolen and Used in Malware

As authorities hit citizens with more violence, the social network is proving key to documenting abuses. If it breaks, a human rights lifeline may disappear.

The videos are as horrifying as they are powerful. A daughter kneels in her mother’s grave, saying farewell for the final time after she was shot dead while protesting. In another, crowds of protesters flee along a train station platform after facing police gunfire; a different clip shows officials beating a woman on the floor outside a shopping center. A father created a video montage of his activist son who has been frequently arrested and imprisoned.  

The videos—all linked to Iran’s anti-government protests—have all been posted to Twitter. They’ve been shared thousands of times and viewed by hundreds of thousands of people. However, they are just a small snapshot of the Twitter posts coming out of Iran, as the social media platform has played an important role in documenting the brutality faced by protesters.

Every day for the past two months, countless Iranians have taken to the streets in more than 150 cities to protest the death of 22-year-old Mahsa Amini, who died in the custody of Iran’s “morality police” after they arrested her for not wearing a hijab in public. Protesters have called for greater women’s rights and regime change in Iran. As they have done so, they have been met with increasing violence from Iranian forces. According to the Human Rights Activists’ News Agency (HRANA), more than 450 protestors have been killed, including 64 children. More than 18,000 people have been arrested, the organization says.

Twitter—and social media in general—has been awash in videos appearing to show protesters being attacked by police forces, the bodies of those killed, and people’s injuries. For more than a decade, the social network, now owned by Elon Musk, has been used as a way to document protests and human rights abuses around the world. However, as Musk’s chaotic takeover unravels and key safety teams have been cut, the Iranian protests put fresh light on Twitter’s importance as a platform for information sharing and chronicling events globally.

Twitter has made it possible for the world to see attacks on protesters and revealed the horror of those killed. And in a country where the media is tightly controlled by the government, it provides a lifeline for Iranians to access impartial information. “There is the power of Twitter in terms of how effective it is when Iranians themselves are getting online to express their messages directly to the world,” says Mahsa Alimardani, an academic at the Oxford Internet Institute and senior researcher at digital rights group Article 19 who has studied Iran’s internet controls. “Every day I see a new family member of a political prisoner coming online on Twitter to directly start advocating for their kids.”

Internet experts and others monitoring the protests are concerned that Musk’s takeover of Twitter will damage a key platform for protest and activism at a time when internet freedoms are being curtailed.

A Lifeline and a Megaphone

For the past decade, Iran has created tools to shut down the internet and block social media platforms. While it has blocked Twitter on and off since 2009, the country’s censorship tools have become increasingly sophisticated. In 2019, it shut down the entire internet as people rallied against rising fuel prices. During the protests following Amini’s death, Iran has targeted its internet controls: Digital curfews have been in place, and WhatsApp, Instagram, Skype, Viber, and LinkedIn have all been blocked.

“Iran is one of the world’s worst abusers of internet freedom. It ranks down there with China and Russia,” says Cathryn Grothe, a research analyst for the Middle East and North Africa at Freedom House, a nonprofit that produces an annual report on internet freedom. As a result of the curfews and blocks, there has been a surge in Iranians using virtual private networks and censorship circumvention tools to get online.

Twitter isn’t Iran’s biggest social network—WhatsApp, Instagram, and Telegram are more popular—but as in many other countries, it is used to share breaking news and real-time updates on events. It stops Iran from being an information black hole. “This is a pivotal space for people to express themselves, to connect with friends and family, to mobilize around demonstrations, and then also to hold governments to account,” Grothe says. “We really are seeing Twitter being used by folks on the ground,” Alimardani says.

Videos and images shared by protesters have been used to shine a light on the actions of the Iranian police forces and officials. A BBC investigation has used social media data to help identify young people and children killed in the nationwide protests. There is no official record of those who have died during the protests, and HRANA estimates that only 3,400 people who have been detained by officials have been identified. More than 18,000 have been arrested.

High-profile accounts both inside and outside Iran, belonging to those on the ground, members of the Iranian diaspora, and researchers, are sharing hundreds of videos of what is happening in Iran. For example, opposition activist collective 1500tasvir has seen its Farsi Twitter account grow from 55,000 followers in September to around 400,000 followers now. (In the past two months its Instagram account has also jumped from 450,000 followers to 1.7 million.)

“You cannot find any normal or correct news from Iranian TV, because there is no independent platform inside the country,” says Saeed Bagheri, a lecturer in international law at the University of Reading. Bagheri says those using Twitter in Iran have been “really effective in sharing firsthand news about human rights violations and Islamic republics of brutality against peaceful protests.” On November 24, the United Nations opened an investigation into “deadly violence against protesters,” citing images of those who had been subjected to violence. Iranian officials claimed “necessary measures” had been taken by authorities.

However, it is not only Iranian protesters and activists using Twitter. Iranian state-backed actors have a history of trying to use Twitter to manipulate politics. In June 2019, Twitter removed almost 5,000 accounts associated with or “directly backed” by the Iranian government. These accounts—which tweeted around 2 million times—were pushing the views of the Iranian government and used fake profiles to “target conversations about political and social issues in Iran and globally.” 

One Iranian digital propaganda researcher, who asked not to be named for security reasons, says they have been monitoring the most popular Farsi tweets for several months. Before the protests started, they say, accounts that appear to support the Iranian government pushed messages that were justifying its policies. Once the protests started, accounts pivoted to sharing mis- and disinformation about the events, they say. “I have never seen such a big and massive effort in pouring the Iranian Twitterverse with false information. But the regime was not successful in this regard.”

System Failure

Twitter has long been a place where protests have been organized. However, Musk’s takeover of the platform and the chaotic scenes that have followed—including gutting Twitter’s human rights team—could have real-world consequences where protests are taking place. This could include the ability to keep people safe.

The Oxford Internet Institute and Article 19’s Alimardani says that much of Musk’s time in charge has so far focused on US issues despite the fact that the majority of Twitter users are from outside of the United States. “Iranians don’t care that Elon Musk is waging a war against woke culture in America,” Alimardani says. “Iranians just want to get their message to the world as fast and efficiently as possible.”

Alimardani and Amir Rashidi, the director of digital rights and security at Iran-focused human rights organization Miaan Group, both praise the work of the limited number of people at Twitter who are working on emergency issues and keeping people in Iran safe. However, they say more resources are needed, and it is becoming harder to get answers about more complicated cases. 

“Article 19 is highlighting clear instances of human rights abuses being platformed on Twitter,” Alimardani says. “These conversations are much more difficult and cumbersome to have right now,” Alimardani adds. As highlighted by BBC journalist Shayan Sardarizadeh, it took multiple days for Twitter to suspend an account that appeared to be linked to Iran’s Revolutionary Guard. The account, which had 91,000 followers, was allegedly posting images of protesters who had been attacked. It is likely the tip of the iceberg. 

“There are still hundreds of accounts of users that are tied to the state or clearly tied to the security forces that are still posting forced confessions,” Alimardani claims. (Twitter, which is believed to no longer have a communications department, did not reply to WIRED’s request for comment.)

Rashidi adds that Musk’s announcement that suspended Twitter accounts would be given an “amnesty” is a particular cause for concern. He highlights pro-Iranian government accounts that have been removed in the past for violating Twitter’s rules. “They were going after activists. They were harassing individuals. They were even putting out videos of forced confessions on their accounts,” Rashidi says. If those accounts return, Rashidi adds, Twitter will be less safe for Iranians.

Iran’s Protests Reveal What’s Lost If Twitter Crumbles

The Heliconia hacking tool exploited vulnerabilities in Chrome, Windows Defender, and Firefox, according to company security researchers.

The commercial spyware industry has increasingly come under fire for selling powerful surveillance tools to anyone who can pay, from governments to criminals around the world. Across the European Union, details of how spyware has been used to target activists, opposition leaders, lawyers, and journalists in multiple countries have recently touched off scandals and calls for reform. Today, Google's Threat Analysis Group announced action to block one such hacking tool that targeted desktop computers and was seemingly developed by a Spanish firm.

The exploitation framework, dubbed Heliconia, came to Google's attention after a series of anonymous submissions to the Chrome bug reporting program. The disclosures pointed to exploitable vulnerabilities in Chrome, Windows Defender, and Firefox that could be abused to deploy spyware on target devices, including Windows and Linux computers. The submission included source code from the Heliconia hacking framework and called the vulnerabilities Heliconia Noise, Heliconia Soft, and Files. Google says the evidence points to the Barcelona-based tech firm Variston IT as the developer of the hacking framework.

“The findings indicate that we have many small players within the spyware industry, but with strong capabilities related to zero days,” TAG researchers told WIRED, referring to unknown, unpatched vulnerabilities. 

Variston IT did not respond to a request for comment from WIRED. The company's director, Ralf Wegner, told TechCrunch that Variston was not given the opportunity to review Google’s research and could not validate it. He added that he “would be surprised if such item was found in the wild.” Google confirmed that the researchers did not contact Variston IT in advance of publication, as is the company's standard practice in these types of investigations. 

Google, Microsoft, and Mozilla patched the Heliconia vulnerabilities in 2021 and 2022, and Google says it has not detected any current exploitation of the bugs. But evidence in the bug submissions indicates that the framework was likely being used to exploit the flaws starting in 2018 and 2019, long before they were patched. Heliconia Noise exploited a Chrome renderer vulnerability and a sandbox escape, while Heliconia Soft used a malicious PDF laced with a Windows Defender exploit, and Files deployed a group of Firefox exploits for Windows and Linux. TAG collaborated on the research with members of Google's Project Zero bug-hunting group and the Chrome V8 security team.

The fact that Google does not see current evidence of exploitation may mean that the Heliconia framework is now dormant, but it might also indicate that the hacking tool has evolved. “It could be there are other exploits, a new framework, their exploits didn’t cross our systems, or there are other layers now to protect their exploits,” TAG researchers told WIRED.

Ultimately, the group says its goal with this type of research is to shed light on the commercial spyware industry's methods, technical capabilities, and abuses. TAG created detections for Google's Safe Browsing service to warn about Heliconia-related sites and files, and the researchers emphasize that it's always important to keep software up to date.

“The growth of the spyware industry puts users at risk and makes the internet less safe,” TAG wrote in a blog post about the findings. “And while surveillance technology may be legal under national or international laws, they are often used in harmful ways to conduct digital espionage against a range of groups.”

Google Moves to Block Invasive Spanish Spyware Framework

Plus: Major patches dropped this month for Chrome, Firefox, VMware, Cisco, Citrix, and SAP.

November saw the release of patches from the likes of Apple’s iOS, Google Chrome, Firefox, and Microsoft Windows to fix multiple security vulnerabilities. Some of these issues are pretty severe, and several have already been exploited by attackers. 

Here’s what you need to know about all the important updates released in the past month.

Apple iOS and iPadOS 16.1.1

Apple has released iOS and iPadOS 16.1.1, which the iPhone maker recommends all users apply. The patch fixes two security vulnerabilities—and given the speed of the release, you can assume they are pretty serious. 

Tracked as CVE-2022-40303 and CVE-2022-40304, the two flaws in the libxml2 software library could allow an attacker to execute code remotely, according to Apple’s support page. The issues were both reported by security researchers working for Google’s Project Zero. 

For Mac users, the flaws were addressed by macOS Ventura 13.0.1.

The good news is, it’s believed neither vulnerability has been exploited by attackers, but it’s still a good idea to apply the update as soon as possible. 

Microsoft Windows

Microsoft’s November Patch Tuesday was another big release, seeing the Windows maker fix 68 vulnerabilities, four of which were zero days. 

Tracked as CVE-2022-41073, the first is a Windows print spooler elevation of privilege vulnerability that could allow a cybercriminal to gain system privileges. Meanwhile, CVE-2022-41125 is a Windows Cryptographic Next Generation key isolation issue that could allow an adversary to escalate privileges and gain control of the system. CVE-2022-41128 is a Windows scripting language vulnerability that could result in remote code execution. Lastly, CVE-2022-41091 is a vulnerability in Microsoft’s Mark of the Web security feature.

Google Android

More big updates for users of Google’s Android devices have arrived in November, with Google issuing patches for multiple vulnerabilities, some of which are serious. At the top of the list is a high-severity vulnerability in the Framework component that could lead to local escalation of privilege, Google said in a security advisory.

The patches in November include two Google Play system updates for issues impacting the Media Framework components (CVE-2022-2209) and WiFi (CVE-2022-20463). Google also fixed five issues affecting its Pixel devices.

The Android updates have started to roll out to Samsung devices, including third- and fourth-generation Galaxy foldables. You can check for the update in your Settings. 

Google Chrome 

The world’s most popular browser continues to be a major target for attackers, with Google this month fixing its eighth zero-day vulnerability this year. 

The vulnerability, tracked as CVE-2022-4135, is a heap buffer overflow in GPU reported by Clement Lecigne, a researcher in Google's own threat analysis group. Google said it “is aware that an exploit for CVE-2022-4135 exists in the wild.”

Earlier in the month, Google issued an update to fix 10 Chrome vulnerabilities, six of which are rated as high-severity. These include four use-after-free bugs: CVE-2022-3885, CVE-2022-3886, CVE-2022-3887, and CVE-2022-3888. Meanwhile, CVE-2022-3889 is a “type confusion” issue in V8, and CVE-2022-3890 is a heap buffer overflow in Crashpad. 

Mozilla Firefox

November was also a big month for Google Chrome competitor Firefox. Mozilla has issued Firefox 107, fixing 19 security vulnerabilities, eight of which are marked as having a high impact. 

One of the most important patches is for CVE-2022-45404, a full-screen notification bypass that could allow an attacker to cause a window to go full-screen without the user seeing the notification prompt. This could result in spoofing attacks. Meanwhile, several use-after-free bugs could lead to an exploitable crash, and one flaw could be exploited to run arbitrary code.

VMWare

Software maker VMWare has released security fixes for multiple security vulnerabilities in its VMware Workspace ONE Assist, three of which have a CVSSv3 base score of 9.8. The first, CVE-2022-31685, is an authentication bypass vulnerability. “A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application,” VMWare warned in an advisory.

A broken authentication method vulnerability tracked as CVE-2022-31686 could enable a malicious actor with network access to obtain admin access without the need to authenticate.

Drop What You're Doing and Update iOS, Android, and Windows

With AlphaBay shuttered, Operation Bayonet enters its final phase: driving the site’s refugees into a giant trap. But one refugee hatched his own plan.

The Hunt for the Kingpin Behind AlphaBay, Part 6: Endgame

Google provided investigators with location data for more than 5,000 devices as part of the federal investigation into the attack on the US Capitol.

The FBI’s biggest-ever investigation included the biggest-ever haul of phones from controversial geofence warrants, court records show. A filing in the case of one of the January 6 suspects, David Rhine, shows that Google initially identified 5,723 devices as being in or near the US Capitol during the riot. Only around 900 people have so far been charged with offenses relating to the siege.

The filing suggests that dozens of phones that were in airplane mode during the riot, or otherwise out of cell service, were caught up in the trawl. Nor could users erase their digital trails later. In fact, 37 people who attempted to delete their location data following the attacks were singled out by the FBI for greater scrutiny.

Geofence search warrants are intended to locate anyone in a given area using digital services. Because Google’s Location History system is both powerful and widely used, the company is served about 10,000 geofence warrants in the US each year. Location History leverages GPS, Wi-Fi, and Bluetooth signals to pinpoint a phone within a few yards. Although the final location is still subject to some uncertainty, it is usually much more precise than triangulating signals from cell towers. Location History is turned off by default, but around a third of Google users switch it on, enabling services like real-time traffic prediction. 

The geofence warrants served on Google shortly after the riot remained sealed. But lawyers for Rhine, a Washington man accused of various federal crimes on January 6, recently filed a motion to suppress the geofence evidence. The motion, which details the warrant’s process and scale, was first reported by the Empty Wheel blog. 

In a statement, a Google spokesperson defended the company’s handling of geofence warrants.

“We have a rigorous process for geofence warrants that is designed to protect the privacy of our users while supporting the important work of law enforcement,” the company said. “When Google receives legal demands, we examine them closely for legal validity and constitutional concerns, including overbreadth, consistent with developing case law. If a request asks for too much information, we work to narrow it. We routinely push back on overbroad demands, including overbroad geofence demands, and in some cases, we object to producing any information at all.”

Google requires a three-step process for geofence warrants to narrow their scope to only those most likely to be guilty of a crime. In the first and broadest step, the FBI asked Google to identify all devices in a 4-acre area, including the Capitol and its immediate surroundings, between 2 pm and 6:30 pm on January 6. Google initially found 5,653 active devices that “were or could have been” within the geofence at that time. When Google added in data from devices that only connected to its servers later that day, or the next, the number increased to 5,723. (Location History works in airplane mode because phones can continue to receive GPS satellite signals.)

In the second step, the FBI asked Google for a list of devices that were present at the Capitol from 12 pm to 12:15 pm on January 6, and from 9 pm to 9:15 pm. As there were no rioters in the Capitol during those times, these devices likely belonged to congressional members or staff, police, and other people authorized to be there. Over 200 such phones were excluded from the initial list, reducing its total to 5,518. 

For the final step, the government sought subscriber information, including phone numbers, Google accounts, and email addresses, for two groups of users. The first was for devices that appeared to have been entirely within the geofence, to about a 70 percent probability. The second was any devices for which the Location History was deleted between January 6 and January 13. 

From this, in early May 2021, the FBI received identifying details for 1,535 users, as well as detailed maps showing how their phones moved through the Capitol and its grounds. Geofence evidence has so far been cited in over 100 charging documents from January 6. In nearly 50 cases, geofence data seems to have provided the initial identification of suspected rioters. 

Rhine was first flagged to the FBI by tipsters who had heard that he had been inside the Capitol. But investigators only identified him in surveillance footage after they matched it against the precise geofence coordinates of his phone. His lawyer is now trying to get the geofence evidence thrown out on a number of grounds, including that it was overly broad in who it rounded up, and that Rhine had a constitutional expectation of privacy in his Google data. 

“The government enlisted Google to search untold millions of unknown accounts in a massive fishing expedition,” the attorneys wrote. “Just a small amount of Location History can identify individuals … engaged in personal and protected activities (such as exercising their rights under the First Amendment). And as a result, a geofence warrant almost always involves intrusion into constitutionally protected areas.”

If the judge tosses the geofence evidence in the Rhine case, there is a chance that he and other suspects identified using it could walk free. 

Matthew Tokson, a law professor and Fourth Amendment expert at the University of Utah, says there remains a high level of uncertainty around the whole idea of geofence warrants: “Some courts have said they are valid. Some have said they are overbroad and sweep up too many innocent people. We are still in the very early stages of this.”

Despite the unprecedented number of individuals swept up in the January 6 search warrant and some strong arguments from Rhine’s lawyer, Tokson thinks the chance of his motion succeeding is very low. “Unlike a geofence warrant for a bank robbery, the people in this location are all likely to be engaged in at least a low-level criminal trespass and in some cases worse,” he says. “There’s a stronger than usual probable cause argument in favor of the government here.”

Andrew Ferguson, a professor of law at American University, agrees. “And that worries me because the January 6 cases are going to be used to build a doctrine that will essentially enable police to find almost anyone with a cellphone or a smart device in ways that we, as a society, haven’t quite grasped yet,” he says. “That is going to undermine the work of journalists, it’s going to undermine political dissenters, and it's going to harm women who are trying to get abortion services.”

The judge is likely to rule on Rhine’s motion in December, with his trial scheduled for late January 2023. While that will decide Rhine’s fate, it is unlikely to settle the question of geofence warrants more broadly. “This very likely will be appealed one way or the other,” says Tokson. “It’s going to be a very high-level, high-profile case likely to generate a major precedent out of the appeals court, if not the Supreme Court.”

A Peek Inside the FBI's Unprecedented January 6 Geofence Dragnet

Plus: WikiLeaks’ website is falling apart, tax websites are sending your data to Facebook, and cops take down a big phone-number-spoofing operation.

Cybersecurity startup Corellium offered or sold its software to spyware and hacking-tool creators in multiple repressive countries, a WIRED investigation revealed this week. A previously unreported 507-page document, believed to have been prepared by Apple, details how Corellium offered a trial of its products to the controversial spyware firm NSO Group, to a cybersecurity company with ties to the UAE government, and to a firm in China that also has government links. In response, Corellium, which makes phone-virtualization software that can help find security bugs in iOS and Android, published a blog post detailing how it now vets potential customers.

As millions of people across the US celebrated Thanksgiving and attended parades, we looked at the US shortage of bomb-sniffing dogs. Experts say the pandemic has led to a drop in the supply of dogs in the country—85 to 90 percent of them come from overseas—and that the lack of trainer animals is fueling national security concerns.

In other national security news, US lawmakers are calling for stricter rules on autonomous vehicles (AVs), which are able to gather reams of real-time data about their environment. China is a chief concern. In a letter shared exclusively with WIRED, Republican congressman August Pfluger said, “AV technology has opened the door for a foreign nation to spy on American soil, as Chinese companies potentially transfer critical data to the People’s Republic of China.”

We also looked at how hidden data stored in PDF files helped researchers reveal names that had been redacted. Court filings, national security files, and responses to Freedom of Information Act requests have all exposed such information in this way. And we heard the cautionary tale of how one person lost $17,000 in crypto—and how you can avoid the same fate. 

Finally, we published part five of the series “The Hunt for the Dark Web’s Biggest Kingpin,” which chronicles the downfall of AlphaBay, the world’s largest dark-web marketplace. In this installment, investigators in Thailand swoop in on AlphaBay’s mastermind, Alexandre Cazes, and discover he had a fortune topping $20 million. 

But wait, there’s more! Each week, we highlight news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Apple’s privacy policy for analytics services on its devices, which gather data about how you use its products, claims the information collected isn’t used to identify you. However, a new analysis of the tools, reported by Gizmodo, claims a permanent ID number within the service is “tied to your full name, phone number, birth date, email address and more.” This ID number is sent to Apple alongside the analytics data about how you use your device, researchers from the software company Mysk told the publication. 

The findings appear to contradict the company’s privacy promises. Apple did not answer Gizmodo’_s_ questions on the report. In recent years, Apple has pushed a pro-privacy stance, using it as an advantage over competitors, and it has run ads saying the data on people’s iPhones stays on their devices. However, experts have increasingly questioned some of Apple’s practices. (At the same time, Apple has been growing its advertising business.) In separate research published earlier in November, Mysk researchers claimed that Apple collects detailed information on people using its products through its own apps, even when they turn tracking off.

In June, the UK government approved the extradition of WikiLeaks founder Julian Assange to the United States. While Assange waits on an appeal in the case, the website he created is falling apart. At one point, WikiLeaks hosted more than 10 million leaked documents. However, according to an analysis by the Daily Dot, fewer than 3,000 of the files are now available. Aside from the drop-in documents, the website also has technical issues: It is frequently inaccessible, people have problems searching its content, and parts of its navigation have vanished. 

Meta’s Pixel, formerly known as the Facebook Pixel, is a snippet of code that websites can install to track their visitors. The tool is useful for advertisers. Millions of websites use the tracking tool, and the data is sent back to Meta. This week, The Markup revealed that major US tax websites are using the Pixel and sending financial information to Meta. Some of the data transferred includes names, email addresses, income information, and tax filing status. Some tax websites stopped using Meta’s Pixel following the report. A spokesperson for Meta, Dale Hogan, said that advertisers “should not send sensitive information” about people through its tools. 

And finally, in a major blow to scammers, an international police operation took down the iSpoof website, which let people disguise their phone numbers and show fake caller IDs when making phone calls. It’s estimated that people using iSpoof were contacting up to 20 people every minute of the day as they used false identities to try and trick people into handing over their money. One person was tricked out of £3 million ($3.6 million), reports say. The website now shows a notice saying it has been seized by the FBI and United States Secret Service. In total, 142 people were arrested in the operation, including the alleged administrator of the website, who was arrested in the UK. Police from the UK, US, Ukraine, France, Germany, and five other countries were involved.

Apple Tracks You More Than You Think

Popular redaction tools don’t always work as promised, and new attacks can reveal hidden information, researchers say.

For years, if you wanted to protect sensitive text in a document, you could grab a pair of scissors or a scalpel and cut out the information. If this didn’t work, a chunky black marker pen would do the job. Now that most documents are digitized, securely redacting their contents has become harder. The majority of redactions—by government officials and courts—involve placing black boxes over text in PDFs. 

When this redaction is done incorrectly, people’s safety and national security can be put at risk. New research from a team at the University of Illinois looked at the most popular tools for redacting PDF documents and found many of them wanting. The findings, from researchers Maxwell Bland, Anushya Iyer, and Kirill Levchenko, say two of the most popular tools for redacting documents offer no protection to the underlying text at all, with the text accessible by copying and pasting it. Plus, a new attack method they devised makes it possible to extract secret details from the redacted text.

The flaws aren’t just theoretical. After examining millions of publicly available documents with blacked-out redactions—including from the US court system, the US Office of the Inspector General, and Freedom of Information Act requests—the researchers found thousands of documents that exposed people’s names and other sensitive details. “I’ve been in lots of discussions with the US court system, I provided them 710 different documents that were just trivial copy-paste style redactions,” says Bland, the paper’s lead author.

Officials usually redact sections of text in documents because those parts contain people’s personal information, or they decide the information shouldn’t be released to protect an organization’s interests. Court documents may redact names of confidential informants or whistleblowers; policy documents may redact information that could damage national security if it is made public.

During the new research, which has been published as a preprint, the team analyzed 11 popular redaction tools. They discovered that PDFzorro and PDFescape Online allowed full access to text that had allegedly been redacted. All they needed to do to access the text was copy and paste it. The researchers registered CVE numbers—used to catalog unique security vulnerabilities—for both of the issues.

PDFzorro did not respond to WIRED’s request for comment. When we tested the tool, it was possible to access PDFzorro redactions by highlighting them. However, if you click on an option to “lock” the PDF before you download it, the text can’t be accessed. Meanwhile, a customer service representative from PDFescape Online said the software has been recently acquired by a new company and they have “rolled out an update for PDFescape Online” that includes security fixes. “The mentioned redaction tool has been removed and will be reworked to be fully compliant,” they said. 

The Illinois research goes further than copy and paste. It also demonstrates a new way to attack PDF documents and use hidden fingerprints to reveal names that have been redacted. The team focused on names, Bland says, as they are commonly redacted and sensitive. It does not appear possible to unredact large blocks of text, the researchers say. To reveal people’s names, the team built a tool, dubbed Edact-Ray, that can “identify, break, and fix redaction information leaks.” 

“Even if you do the redaction, supposedly correctly, even if you remove the text, there’s a lot of latent information that is dependent on the content that was redacted, and even that can leak information,” Levchenko says. “If you redact a name in a PDF, if the attacker has any context—they know this is an American—they will be able to, with high probability, either recover that name or narrow it down to a very small list of candidates.”

Edact-Ray focuses on the size of glyphs (broadly, characters or letters) and their positioning. “It’s pretty clear to a lot of people that the letter ‘L’ is skinnier than a letter ‘M,’ and that if you redacted just the letter ‘L,’ then you might be able to tell it is different from a redaction with just the letter ‘M,’” Bland says. The tool is essentially able to automatically compare the size of the redaction and the position of the letters with a predefined “dictionary” of words to estimate what has been replaced.

The software is constructed by inferring how the original document was produced—for instance, in Microsoft Word—and then reverse engineering the specifics of the document. “That tells us about how the text was laid out,” Levchenko says. “Once we know that, we have a model for how that tool laid out the text and how and what information it deposited throughout the rest of the document.” From here, it is ultimately possible to simulate what the original text may have been and produce a series of potential, or likely, matches. During testing, the team was able to eliminate 80,000 guesses per second.

“We found, for example, that redacting a surname from a PDF generated by Microsoft Word set using 10-point Calibri leaves enough residual information to uniquely identify the name in 14 percent of all cases,” the team’s research paper concludes, adding that this is likely to be a “lower bound on the extent of vulnerable redactions.”

Daniel Lopresti, a professor of computer science at Lehigh University who has studied redaction techniques, says the research is impressive. It “presents a comprehensive study of redaction tools and the ways in which they can be broken, including exploiting nearly invisible aspects of a document’s typography,” says Lopresti, who was not involved with the research. “The picture it paints is scary; too often redaction is done badly.”

The vast majority of the organizations impacted by real-world redaction failures highlighted in the research—including the US Department of Justice, the US courts system, the Office of Inspector General, and Adobe—did not respond to WIRED’s request for comment. Bland and the research paper say that many of the organizations have engaged with the team’s research.

Microsoft did not address data being leaked from Word documents that are converted to PDFs. “Customers can save a document as a PDF, but it is the role of the redaction tool to censor or obscure information,” says Jeff Jones, senior director, Microsoft. Jones adds that people should “review” data and their files before converting them to a format that is going to be shared.

Meanwhile, Mike Lissner, executive director of the Free Law Project, a nonprofit that helps open up court data and provided access to legal documents for the research, says the organization has developed a system that can help identify badly redacted documents. “This works well, but by the time a document is published in a court’s filing system, the secret is out, so we’re working on tools that will integrate with document management systems that lawyers use,” Lissner says. 

Digital document redaction has proved challenging for years, with unnumbered examples of failures to properly secure sensitive information. Sometimes it is human error; other times, technical failings are at fault. “It’s hard to redact something as complicated as a PDF to completely remove the information,” Levchenko says. PDFs can contain text, images, tables, metadata, and more information.

Multiple high-profile redaction failures have exposed information that someone wanted to keep secret. These have involved mistakes in the redaction process, failure to properly protect the information, and the inclusion of enough details to allow people to decipher what the redactions were meant to be. 

For instance, in 1991 researchers used a “desktop computer” to reverse engineer the Dead Sea Scrolls to reveal their full text and open the documents up to more people. Back in 2008, details about secret wiretapping agreements between the US government and telecoms firms could be accessed using copy and paste. In 2016, Edward Snowden was revealed as the target of US spying following a failure to redact his personal details. In October 2020, journalists were able to decipher redactions in Ghislaine Maxwell’s court deposition. And in February 2021, the European Commission published a version of its Covid-19 contract for the AstraZeneca vaccine that it didn’t properly redact.

When it comes to effectively redacting documents and protecting people’s information, the Illinois researchers hope their work will highlight another way PDFs can be attacked and encourage the creators of software to include measures that prevent hidden information from being leaked. They say that for now the NSA’s guidelines for redacting documents are perhaps the best way to protect redactions. The guide says if you redact Word documents, you should change the content of the original document before redacting the resulting PDF. Change someone’s name to a row of “x” characters or the word “redacted,” just to be safe.

Redacted Documents Are Not as Secure as You Think

I’m not the first person to suffer this fate, but hopefully I can be the last.

In 2014, I bought 25,000 dogecoin as a joke. By 2021, it was briefly worth over $17,000. Problem was, I couldn’t remember the password. Determined to get my coins back, I embarked on a journey that exposed me to online hackers, the mathematics behind passwords, and a lot of frustration.

Although most people don’t have thousands in forgotten cryptocurrency, everyone relies on passwords to manage their digital lives. And as more and more people buy crypto, how can they protect their assets? We talked to a host of experts to figure out how to create the best passwords for your digital accounts, and, if you have crypto, what your basic storage tradeoffs are. Let’s dive in.

How to Hack Your Own Crypto Wallet

There are a few common ways to lose crypto. You might have a wallet on a hard drive you throw away. Your exchange could get hacked. You might lose your password, or you might get personally hacked and have your coins stolen. For those who lose their password, as I did, hackers actually present a silver lining. If you still control your wallet, you can try to hack your own wallet—or find someone who will.

So I contacted Dave Bitcoin, an anonymous hacker famous for cracking crypto wallets. He agreed to help break into the wallet, for his standard 20 percent fee—paid only if he is successful. Dave and other hackers are mostly using brute force techniques. Basically, they’re just guessing passwords—a lot of them.

You can also try to hack your own wallet with apps like Pywallet or Jack the Ripper. But I didn’t want to do it myself, so I sent Dave a list of password possibilities and he got started.

After a little waiting, I received an email from Dave. “I tried over 100 billion passwords on your wallet,” Dave told me over email. I assumed such a mind-boggling amount of tries meant my coins were surely recovered, but alas, we had only scratched the surface. The password was not hacked, and my coins remained lost. But how?

The Math Behind Strong Passwords

Each new digit in a password makes it exponentially harder to crack. Consider a one-digit password that could be a letter or a number. If the password is case-sensitive, there are 52 letters plus 10 numerals. Not very secure. You could simply guess the password by trying 62 times. (A, a, B, b, C, c … and so on).

Now make it a two-digit password. It doesn’t get twice as hard to guess—it gets 62 times harder to guess. There are now 3884 possible passwords to guess (AA, Aa, AB, etc.) A six-digit password with the same rules has around 56 billion possible permutations, assuming we don’t use special characters. A 20-character password with those rules has 62-to-the-20th-power permutations: that is, ​​704,423,425,546,998,022,968,330,264,616,370,176 possible passwords. That makes 100 billion look pretty small in comparison.

This math was bad news for me, since I’m pretty sure I had some sort of long password, like a few lines of a song lyric. Talk about facing the music.

Password Best Practices

Whether it’s for your email or crypto wallet, how can you balance creating a strong password that’s also memorable?

“Choosing passwords is tricky,” says Dave, “If you go out of your way to create an unusual password for your wallet that you wouldn’t typically use, then it makes it quite difficult for you to remember and for me to help. It’s easier to guess your password if you use consistent patterns. Of course, this is bad for security, and someone who is trying to hack your accounts will have an easier time.” Balancing security with memorability is ultimately a tough task that will depend on the individual’s needs and preferences.

I Lost $17,000 in Crypto. Here’s How to Avoid My Mistake

'Tis the season for swindlers and hackers. Use these tips to spot frauds and keep your payment info secure.

Black Friday attracts crowds, and crowds attract scammers, and that means you need to take extra care when shopping online over the Black Friday and Cyber Monday weekend. There'll be people out there eager to relieve you of more money than you'll save on a TV set or a gaming console.

The following precautions apply any time of year, but it's worth reminding yourself of them every time a serious holiday season comes around. In the rush to get gifts sorted, it's all too easy to miss a warning sign, or get complacent about online security.

Update All Your Software

Keeping programs and operating systems up to date is important enough that Microsoft, Apple, Google, Mozilla, and all the other big names in tech now make it difficult for anyone to lag behind with their updates—most of the time you'll be prompted regularly to install new versions of your software, and it might even happen automatically in the background without you noticing.

The biggest retail event of the year has grown into an entire month of sales that ebb and flow. Here’s how to make the most of it.

Today's browsers, apps, and OSes are adept at spotting scams as they happen, whether it's phishing emails (designed to lure you to a fake shopping or banking site) or unauthorized logins on your accounts. To make the most of this built-in security, ensure you're running the latest versions across the board, which means the latest security patches—if you've been putting off updates on your phone or your computer, then get them done ahead of Black Friday.

If you do have a laptop that's too old to run the latest versions of Windows or macOS, avoid using it if possible—you'll be safer shopping on your phone, as long as it's running the most recent Android or iOS updates. On Android, you can check for updates via **System** and **System Update** in Settings; on iOS, it's **Settings** and then **General** and **Software Update**.

Be Wary of Email and Social Media Deals

You're likely to be inundated with special offers over email and social media this Black Friday, but be careful when it comes to clicking through on deals that come from suspicious sources (stores you've never shopped at before, for example). Always check that the link you clicked sent you to the website you were expecting to visit.

There's no hard and fast way to guarantee you'll never get caught out by a dodgy link (apart from just ignoring them all completely), but you can minimize the risk: Check that the social media account or email address sending the link is genuine, head to the site in question in a separate browser window to see whether you can find the same offer advertised, and be sure the offer you're looking at is the one that was promoted.

If your browser is up to date, as we mentioned above, dangerous links should be blocked before you reach them, but we'd still recommend being wary. You'll see some great offers advertised over social media and email, but no discount is worth the risk of exposing yourself to scammers.

Make sure all your devices are updated before shopping.

Android via David Nield

Do Your Research

Wherever possible, stick to trusted stores online. All the major players have robust security procedures in place, so the chances of them (and you) getting hacked are smaller. Still, if you're buying from any site, always check you're on the store website you think you are by checking in your browser's address bar.

We're not saying you should never shop at smaller outlets, but make sure they're using HTTPS technology (indicated with a padlock in your browser's address bar). Look for contact details, an office with a physical address, and reviews left by other users (Trustpilot can be helpful here). See if they're on Twitter and Facebook—and whether those accounts are actually active.

Debit and credit card issuers will usually protect you against fraud—check their policies online if you're not sure about yours—but nevertheless, keep an eye on your bank accounts throughout the Black Friday weekend to make sure only the amounts you're expecting to be debited are going out.

Double-Check Deals

Retailers change their prices all the time—especially online—so a "big discount" you see might only apply to whatever the price was last week, not what it's been over the course of the past year. Price trackers such as CamelCamelCamel can help you work out whether you're getting a genuine bargain or just something that was already heavily reduced.

Checking out product reviews on the web is a useful way of determining how current something is and how much you should be spending on it. Are you looking at the genuine article, or just a cheap knock-off? Is the gadget you're about to buy future-proofed with the latest tech or will it be out of date in six months? And (especially on Amazon) is it being sent from your current region or the other side of the world? Who's the actual seller? Make sure you read what previous buyers have to say via the user reviews before spending your money.

Just be aware that stores also use the occasion to try and shift their remaining stock of older, less popular products. Make sure you're looking at what you're buying and not just the price drop.

CamelCamelCamel will show you previous price drops on Amazon.

CamelCamelCamel via David Nield

Protect Your Accounts

As always, keep your accounts locked down and protected on Black Friday. Use strong, unique passwords for all your accounts (a dedicated password manager or your browser's password management system can help here), and turn on two-factor authentication on every account that offers it (Microsoft, Apple, Google, Facebook, and Twitter ones all do, for a start).

While it may seem convenient to quickly set up a new shopping account with your “usual” password, it only takes one account sharing the same password to get exposed, and all the others can come tumbling down after it. If you're using the latest versions of Chrome and Safari, you'll notice you can now use a strong password suggested by your browser (the option should pop up automatically when you're in a password field).

If you're planning on shopping at outlets where you haven't purchased anything before, it's a good idea to get these accounts set up ahead of time—this means you aren't rushing when it comes to thinking up new passwords and entering potentially sensitive information into your web browser.

Guard Your Payment Info

Many places that you're shopping at on Black Friday and Cyber Monday will already have your payment info on file, but if you're entering details into a new site, again make sure the padlock symbol is showing in the address bar—the full URL should also begin “https://”, which indicates that your payment details will be encrypted in transit.

If you’re on vacation or out of town, we recommend waiting until you get back home before buying anything—or at least using the cellular data on your phone to make a connection rather than a public Wi-Fi hotspot, as it's much harder for hackers to intercept your details (or look over your shoulder as you're typing them). If you are shopping in-store, be careful to guard your PIN numbers and other sensitive details when you're surrounded by crowds—or even just one shop assistant.

As tempting as Black Friday offers might be, it's usually a good idea to shop in as few places as possible, if you can: The fewer companies that hold your payment data, the less likely you are to be victim to a data breach, and the risk of those breaches are really down to the company's security policies rather than any precautions you can take.

Source

Wired