The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software.

Both Apple and Google have struggled for years to keep malicious apps out of their official mobile app stores and away from users' phones. Simple programs like flashlight apps, photo editing tools, and games can mask efforts to grab user data, authorize rogue charges, or steal login credentials to a legitimate service. Today, Meta said it has found and reported more than 400 apps this year in official app stores that were set up to steal victims' Facebook credentials.

Meta will notify 1 million users that they may have been exposed to one of the rogue applications. That doesn't mean all those users had their Facebook accounts compromised, but Meta researchers say they are being cautious and casting a wide net because they have limited visibility beyond their own platform to know exactly what went on with each user. Of the 400 programs Meta flagged and reported, 45 were iOS apps. The company says that the activity didn’t appear to be targeted toward a particular geographic region or subset of people.

“It's a highly adversarial space, and some of these apps manage to evade detection,” says David Agranovich, Meta's director of threat disruption. “Flashlight apps, photo editors, mobile games. There are many legitimate applications on the Apple and Google stores, but cybercriminals know how popular these types of apps are and use that to their advantage. We want to deter threat actors and keep people safe.”

Agranovich says that this group of 400 apps from 2022 targeted only Facebook, not Instagram and WhatsApp, the company's other popular platforms. But the company has tracked threats from similar credential-stealing apps that are focused on those services.

Google Play and Apple's App Store each have their own vetting systems, but some malicious apps still slip by. Credential theft is a classic focus of developers of these rogue apps, and attackers often craft their ploys to take over high-value accounts like Facebook profiles that both contain a lot of data themselves and are also used as single sign-on platforms to log in to other services. Nearly 47 percent of the apps Meta flagged masqueraded as photo editing services. About 15 percent claimed to be business utilities. And nearly 12 percent pretended to be VPNs, while “phone utilities,” games, and lifestyle made up the remaining categories.

Google says that the Android apps Meta identified have all been taken down from Google Play and that the company had independently caught and removed many of them throughout the year before Meta's disclosures.

Apple said that it doesn't tolerate fraudulent or malicious apps in the App Store and that the 45 iOS apps Meta researchers flagged have already been removed.

Both companies have struggled to police their official app stores, and each faces its own version of the same challenges. For Google, Android's open ecosystem means that users can download apps from third-party app stores beyond Google's control. This makes it even more problematic when malicious apps show up in Play, but it also gives users leeway to source apps where they want to (ideally, if they know they can trust a particular developer). The closed iOS ecosystem has far fewer threats from rogue apps outside the App Store, but as a result all users must get their apps from Apple, making it even more valuable for attackers to sneak their malicious apps in.

“Apple is usually quick to respond once scam apps are reported, but potentially unwanted programs are absolutely a big problem on iOS, and nobody other than Apple has the ability to do anything about it,” says Thomas Reed, director of Mac and mobile platforms at the antivirus maker Malwarebytes.

The apps Meta flagged steal credentials by prompting unsuspecting victims to log into Facebook. Instead of using a secure deployment of the single-sign-on service Sign in With Facebook, though, the apps would simply present Facebook’s browser login flow while capturing whatever credentials users entered, including usernames, passwords, and two-factor authentication codes. In the majority of cases, Meta says, the apps immediately prompted users to log in and didn’t offer any functionality, like a game or flashlight tool, before or after the user completed the login.

Meta researchers say that while Facebook accounts are far from the only ones targeted in this way, they wanted to publish findings on the issue to raise awareness about malicious mobile apps both among users and in the tech industry more broadly. Meta suggests that users think about three factors to protect themselves against potentially malicious apps. First, carefully consider why an app might be requesting credentials for another service. A flashlight app shouldn't need to be linked to a social media account at all, and you should be able to play a game or use a photo editing app without a login requirement. Second, consider the app's reputation as best you can. Check to make sure you're downloading the exact app you intend to and not a lookalike. And third, think about whether an app offers the features it promises before—and certainly after—“logging in” to a required account. If your photo editor isn't doing much photo editing, there's probably a problem.

Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year

Blockchain investigators have uncovered at least $4 million—and counting—in cryptocurrency fundraising has reached Russia's violent militia groups.

As Russian troops have flooded into Ukraine’s borders for the past eight months—and with an ongoing mobilization of hundreds of thousands more underway—the Western world has taken drastic measures to cut the economic ties that fuel Russia’s invasion and occupation. But even as those global sanctions have carefully excised Russia from global commerce, millions of dollars have continued to flow directly to Russian military and paramilitary groups in a form that’s proven harder to control: cryptocurrency.

Since Russia launched its full-blown invasion of Ukraine in February, at least $4 million worth of cryptocurrency has been collected by groups supporting Russia’s military in Ukraine, researchers have found. According to analyses by cryptocurrency-tracing firms Chainalysis, Elliptic, and TRM Labs, as well as investigators at Binance, the world’s largest cryptocurrency exchange, recipients include paramilitary groups offering ammunition and equipment, military contractors, and weapons manufacturers. That flow of funds, often to officially sanctioned groups, shows no sign of abating and may even be accelerating: Chainalysis traced roughly $1.8 million in funding to the Russian military groups in just the past two months, nearly matching the $2.2 million it found the groups received in the five months prior. And despite the ability to trace those funds, freezing or blocking them has proven difficult, due largely to unregulated or sanctioned cryptocurrency exchanges—most of them based in Russia—cashing out millions in donations earmarked for invaders.

“Our aim is to identify all the crypto wallets being used by Russian military groups and the people helping them; to find, seize and block all this activity that is helping to buy the bullets, the ammunition of this occupation,” says Serhii Kropyva, who until recently served as deputy of Ukraine’s Cyber Police and advisor to the country’s prosecutor general. “With the close cooperation of companies like Chainalysis and Binance, we can see all the wallets involved in this criminal activity, these money flows of millions of dollars. But we can, unfortunately, see that the transfer is continuing all the time.”

In separate reports, the cryptocurrency-tracing firms and Binance’s investigations team each tracked donations to the Russian war effort that very often began with public posts on the messaging app Telegram soliciting crowdfunded donations. Chainalysis, for instance, found Telegram posts from organizations including the pro-Russian media sites Rybar and Southfront, as well as the paramilitary group Rusich—which has ties to the notorious Wagner mercenary group—all posting cryptocurrency donation addresses to Telegram. These posts told followers that the money raised there would be used for everything from weaponized drones to radios, rifle accessories, and body armor. In another instance, Chainalysis points to a fundraiser by a group called Project Terricon that attempted to auction NFTs to support pro-Russian militia groups in Eastern Ukraine, though the NFTs were removed from the marketplace they were hosted on before any bids were placed.

Binance’s investigations team, in its own report, found that a total of $4.2 million in crypto had been funneled to Russian military groups since February. The groups named in its research didn’t entirely overlap with those named in Chainalysis’ report, suggesting that the overall funding could be far greater than either Binance’s or Chainalysis’ total. Binance, for instance, points to a pro-Russian “cultural heritage” group known as MOO Veche that has carried out fundraisers for military equipment similar to the kinds funded by the groups Chainalysis flagged. While Binance, TRM Labs, and Elliptic all name MOO Veche as a major fundraiser, Elliptic traced $1.7 million in crypto donations to the group, far more than the other researchers.

A screenshot of a Russian-language Telegram post from the pro-Russian military MOO Veche group, describing equipment paid for with its fundraising, including “thermal imagers, binoculars with rangefinders, spotting scopes, car radios, collimators and first aid kits.“

Telegram via Andy Greenberg

Other organizations that Binance spotted raising money through cryptocurrency crowdfunding on Telegram include the pro-Russian nationalist groups Save Donbas and REAR, as well as the Russian arms manufacturer Lobaev, which it saw directly soliciting donations on the platform. Yet another group, known as Romanov Light, whose fundraising was spotted by TRM Labs and Elliptic, claimed to be collecting crypto for Russian special forces. Romanov Light raised as much as $330,000 worth of donations, according to Elliptic, which it told donors it spent on military equipment like weapon accessories, flashlights, and armor plates.

Despite the relative clarity of all that financial tracing, preventing cryptocurrency from continuing to bolster Russia’s unprovoked incursion into Ukraine hasn’t been simple. Exchanges can block or freeze funds at the points where they’re exchanged for traditional currency. But according to Chainalysis, the majority of the crypto funds the groups have raised have been cashed out through Russian exchanges, including Chatex, Suex, and Garantex—all of which have already been targeted with Western sanctions for their extensive use by criminals. Chatex and Garantex did not respond to WIRED’s request for comment. Suex no longer appears to have a public website, and no contact information for the exchange could be found.

Not every exchange that has served as an ATM for Russian military crypto crowdfunding is hosted in Russia, however. Blockchain analysts who spoke to WIRED pointed to seven other exchange services, some hosted in India and China, that have received funds from the pro-Russian groups they tracked, though they declined to name them on the record, in part because the amounts of those funds in most cases were in the single-digit thousands or less.

In one telling example of how hard it is to prevent these cash-outs, however, analysts saw MOO Veche send more than $150,000 worth of bitcoin to an exchange hosted on the infrastructure of the Chinese cryptocurrency exchange Huobi—a “nested” exchange that essentially uses Huobi as its trading platform. But any responsibility that Huobi might have for blocking or freezing those funds was complicated by another unknown intermediary service that analysts saw the money travel through before entering the Huobi-hosted service. When WIRED reached out to Huobi for comment, it wrote in a statement that it has a “know-your-customer” process “which ensures to the best of our ability that our clients’ source of funds are above board.”

Binance, for its part, says its exchange accounts were also used by four of the groups it tracked and received more than $208,000 worth of cryptocurrencies. It tells WIRED that it froze all four accounts it discovered. “We’re making sure that no harm comes to civilians as a result of the fundraising that happens in these extremist spaces,” says Jennifer Hicks, who manages Binance’s intelligence and investigations team. “When cryptocurrency exchanges know that something illicit is happening that will end in real-world, kinetic effects like this, it’s the exchange’s responsibility to put a stop to it as fast as possible.”

Even when exchanges do monitor for crypto sent from sanctioned groups like these pro-Russian fundraisers, that dirty money won’t always be straightforward to detect, warns Thibaud Madelin, who leads research at Elliptic. He says he’s increasingly seeing Russian sources of illicit funds use “bridges” or “coin swaps”—services that allow easy trading of one cryptocurrency for another, often without offering any identifying information—as money-laundering techniques. He’s watched those tools grow in popularity among dark-web black markets and cybercriminal users and expects the same will happen with those seeking to launder illicit arms funding. “It’s a bit early to say definitively. But what we’re seeing is that it’s likely to become a bigger problem,” says Madelin. “They’re likely to mirror the methodologies seen across dark net services users, enabling large-scale money laundering and potentially sanctions evasion.”

An image in Chainalysis’s report pulled from a pro-Russian social media fundraiser that shows items funded through cryptocurrency donations, including targeting equipment, drone components, and satellite radios.

Courtesy of Chainanalysis

Millions of dollars in cryptocurrency funding to Russian troops may be the least of Ukraine’s problems in a war where Russia has thrown billions into its invasion force. Ukraine, it’s worth noting, has also vastly out-raised Russia in cryptocurrency: By Elliptic’s count, the Ukrainian government has collected more than $77 million in crypto donations since the war began. But that is to be expected, given the West’s broad support of Ukraine following Russia’s unprovoked aggression and the global sanctions placed on Russia. And even the smaller amount of cryptocurrency Russian forces have raised demonstrates cryptocurrency’s ongoing potential to circumvent those sanctions and offer another financial lifeline to Russia’s war machine.

“It’s not like Russia is buying new tanks with this money. They’re paying for thermal imaging scopes and UAVs,” says Andrew Fierman, a sanctions-focused Chainalysis researcher. “But for grassroots facilitation of these militia efforts, any amount of money that they receive to bolster their gear is going to have an impact.” And despite all the light that cryptocurrency tracers can shine on that funding—and the West’s best efforts to stop it—the crypto flow into Russia’s war chest continues.

The Fight to Cut Off the Crypto Fueling Russia's Ukraine Invasion

Sixteen states collectively suffered more than 90 false reports of school shooters during three weeks in September—and many appear to be connected.

At 1:15 pm on September 15, a man who identified himself as Tom Gomez called Sangamon County Central Dispatch in Illinois to report that two gunmen had shot a dozen students at Springfield High School. According to call audio obtained by WIRED, the man was specific. The caller, breathing heavily, told dispatchers that he was locked inside a math classroom with other students and that the two men, both dressed in blue pants and green jackets, were killing students in the adjacent classroom: room 219.

Within five minutes, Springfield Police were at the high school's second floor, descending on the room where they were told a mass murder had occurred. The problem is that, according to police records, Springfield High doesn’t have a room 219. In fact, there was no shooting at all.

The dangerous hoax call was one of more than 90 false reports of active shooter incidents at US schools made during the second half of September, WIRED found. From Lincoln High in Dallas, Texas, to Lincoln High in Des Moines, Iowa; McArthur High in Hollywood, Florida, to Hollywood High in Los Angeles, these false reports are part of a disturbing spree of recent swatting incidents that crisscross the United States. While experts who study violence at schools say that false reports of shootings inspire copycats, state and local law enforcement officials say that many of these swatting attacks seem to stem from a single person or group.

Through local news reports, police records, and interviews with state and local officials, WIRED compiled a list of 92 false reports of school shooting incidents in 16 states that took place from September 13 to 30. Many of the false reports we tracked align with data collected by the Educator’s School Safety Network. While several impacted states experienced only one such call, others recorded a staggering number, including at least eight in Ohio, 15 in Virginia, and 17 in Minnesota during that three-week period.

Of the false reports WIRED tracked, at least 32 appear to be linked to a single group or perpetrator. Of the 60 remaining calls, many were made within minutes of one another. Most police departments refused to provide us with records or did not respond to multiple requests to confirm details about the contents of the calls, however, so the number of calls linked to a single swatting campaign may be much higher.

Data Visualization: Datawrapper

Superintendent Drew Evans of the Minnesota Bureau of Criminal Apprehension, a statewide fusion center tracking these incidents, says that in each of the 17 calls in his state, the caller had a distinct accent and that the calls were made using the same voice over IP technology. “There’s a lot of different technology that could make it appear to be a single person, but all the indications we have are that it’s either one person or a single entity,” Evans says.

In audio of the call to Springfield dispatch, the caller indeed had a discernible accent. In a detailed report of the call for service, the dispatcher noted that the caller was a “FOREIGN SPEAKING MALE” and that the caller was “SPEAKING VERY FAST WITH MIDDLE EASTERN ACCENT.” Audio of two calls from Ohio that WIRED obtained appear to be of the same person as the Springfield call's “Tom Gomez," and the caller describes the fake shooting with nearly identical details about the incident. In total, law enforcement officials from six states—Illinois, Iowa, Louisiana, Minnesota, Ohio, and Virginia—all described receiving similar calls. In each call, officials confirmed that a man with a heavy accent called from an out-of-state number and reported a mass-casualty attack. In some instances the caller reported that the shooting occurred in a specific room number that does not exist and included details about the color of the pants, shirts, and jackets of the alleged shooters.

The voice in the false-report call about Springfield High in Illinois sounds identical to a caller targeting schools in other states. One from Ohio is embedded below.

Swatting—a prank call in which someone makes a false report to emergency services in order to get a SWAT team dispatched to a target location—has been around for more than a decade. (The US Department of Justice has used the term “swatting” since at least 2007.) While no one has been seriously injured in the recent surge of swatting attacks at schools, these pranks can be deadly. In 2017, Wichita police shot and killed a 28-year-old man at his front door while responding to a false report. (In what appears to be a coincidence, Wichita’s North High School was targeted in this recent spree.)

Bolton High School in Alexandria, Louisiana, was one of at least 16 Louisiana schools targeted in September. Lieutenant Lane Windham of the Alexandria Police Department says the explanation is obvious. “I don’t think this is some prank. It’s terrorism,” he says. “When someone’s trying to terrorize the teachers, parents, all the students, and the community, what else can you call it?”

School swatting attacks appear to be preying on a familiar American fear that not only are students vulnerable to violence in their classrooms, but that law enforcement is powerless to stop it, sometimes spurring parents to try to do so themselves. This nightmare scenario became all too real during the mass shooting at Robb Elementary in Uvalde, Texas, in late May, where parents rescued their own children as police failed to act. Meanwhile, the threat of school shootings remains all too real. ​​According to research from Everytown USA, a nonprofit that tracks school shootings, the 2021–2022 school year saw nearly quadruple the average number of gunfire incidents since 2013.

A Coordinated Swatting Spree Is Targeting US Schools

Constantly posting content on social media can erode your privacy—and sense of self.

To be online is to be constantly exposed. While it may seem normal, it’s a level of exposure we’ve never dealt with before as human beings. We’re posting on Twitter, and people we’ve never met are responding with their thoughts and criticisms. People are looking at your latest Instagram selfie. They’re literally swiping on your face. Messages are piling up. It can sometimes feel like the whole world has its eyes on you.

Being observed by so many people appears to have significant psychological effects. There are, of course, good things about this ability to connect with others. It was crucial during the height of the pandemic when we couldn’t be close to our loved ones, for example. However, experts say there are also numerous downsides, and these may be more complex and persistent than we realize.

Studies have found that high levels of social media use are connected with an increased risk of symptoms of anxiety and depression. There appears to be substantial evidence connecting people’s mental health and their online habits. Furthermore, many psychologists believe people may be dealing with psychological effects that are pervasive but not always obvious.

“What we’re finding is people are spending way more time on screens than previously reported or than they believe they are,” says Larry Rosen, professor emeritus of psychology at California State University, Dominguez Hills. “It’s become somewhat of an epidemic.”

Rosen has been studying the psychological effects of technology since 1984, and he says he’s watched things “spiral out of control.” He says people are receiving dozens of notifications every day and that they often feel they can’t escape their online lives.

“Even when you’re not on the screens, the screens are in your head,” Rosen says.

One value of privacy is that it gives us space to operate without judgment. When we’re using social media, there are often a lot of strangers viewing our content, liking it, commenting on it, and sharing it with their own communities. Any time we post something online, thus exposing a part of who we are, we don’t fully know how we’re being received in the virtual world. Fallon Goodman, an assistant professor of psychology at George Washington University, says not knowing what kind of impression you’re making online can cause stress and anxiety.

“When you post a picture, the only real data you get are people’s likes and comments. That’s not necessarily a true indication of what the world feels about your picture or your post,” Goodman says. “Now you’ve put yourself out there—in a semi-permanent way—and you have limited information about how that was received, so you have limited information about the evaluations people are making about you.”

Anna Lembke, a professor of psychiatric and behavioral sciences at Stanford University, says we construct our identities through how we’re seen by others. Much of that identity is now formed on the internet, and that can be difficult to grapple with.

“This virtual identity is a composition of all of these online interactions that we have. It is a very vulnerable identity because it exists in cyberspace. In a weird kind of way we don’t have control over it,” Lembke says. “We’re very exposed.”

Without the ability to find out how their identity is ricocheting around the virtual world, people often feel a fight-or-flight response when they’ve been online for many hours—and even after they’ve logged off.

“It’s kind of an adapted hyper-vigilance. As soon as you send something out into the virtual world, you’re sort of sitting on pins and needles waiting for a response,” Lembke says. “That alone—that kind of expectancy—is a state of hyperarousal. How will people respond to this? When will they respond? What will they say?”

It would be one thing if only you saw any negative reactions, Lembke says, but they’re often available for everyone to see. She says this exacerbates feelings of shame and self-loathing that are already “endemic” in the modern world.

We are social creatures, and our brains evolved to form communities, communicate with each other, and work together. We have not evolved to expose ourselves to the judgment of the whole world on a daily basis. These things affect everyone differently, but it’s clear many people regularly feel overwhelmed by this exposure level.

If we’re not careful, our online lives can become a source of chronic stress that subtly seeps into everything. Everyone needs some privacy, but we often don’t provide it for ourselves and end up feeling like we’re constantly battling invisible enemies.

There are things you can do for yourself, however. You can turn off your notifications for social media apps, reduce how much time you spend on them, limit when you allow yourself to use them, and more. Goodman says it sometimes helps to keep your phone in the other room so you’re not so easily tempted to pick it up.

Lembke says we need to change how we think about social media and internet use as a society. She calls it a “collective” problem, not just an individual one.

“We need to come up with a kind of cultural etiquette around what appropriate and healthy consumption is, just like we have for other consumptive problems,” Lembke says. “We have nonsmoking areas. We don’t eat ice cream for breakfast. We have all kinds of laws around who can buy and consume alcohol, who can go into a casino. We need guardrails for these digital products, especially for minors.”

The High Cost of Living Your Life Online

Plus: CIA failures allegedly got US informants killed, a former NSA worker is charged under the Espionage Act, and more.

There were global ripples in tech policy this week as VPN providers were forced to pull out of India as the country’s new data collection law takes hold, and UN countries prepare to elect a new head of the International Telecommunications Union—a key internet standards body.

After explosions and damage to the Nord Stream gas pipeline that runs between Russia and Germany, the destruction is being investigated as deliberate, and a complicated hunt is on to identify the perpetrator. And still-unidentified hackers are “hyperjacking” victims to grab data using a long-feared technique for hijacking virtualization software.

The notorious Lapsus$ hackers have been back on their hacking joyride, compromising massive companies around the world and delivering a dire but important warning about how vulnerable large institutions really are to compromise. And the end-to-end-encrypted communication protocol Matrix patched serious and concerning vulnerabilities this week.

Pornhub debuted a trial of an automated tool that pushes users searching for child sexual abuse material to seek help for their behavior. And Cloudflare rolled out a free Captcha alternative in an attempt to validate humanness online without the headache of finding bicycles in a grid or deciphering blurry text.

We’ve got advice on how to stand up to Big Tech and advocate for data privacy and users' rights in your community, plus tips on the latest iOS, Chrome, and HP updates you need to install.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

On Thursday night, Microsoft confirmed that two unpatched Exchange Server vulnerabilities are actively being exploited by cybercriminals. The vulnerabilities were discovered by a Vietnamese cybersecurity company named GTSC, which claims in a post on its website that the two zero-days have been used in attacks against its customers since early August. While the flaws only impact on-premise Exchange Servers that an attacker has authenticated access to, according to GTSC, the zero-days can be chained together to create backdoors into the vulnerable server. “The vulnerability turns out to be so critical that it allows the attacker to do RCE \[remote code execution\] on the compromised system,” the researchers said.

In a blog post, Microsoft described the first flaw as a server-side request forgery (SSRF) vulnerability, and the second as “an attack that allows remote code execution on a vulnerable server when PowerShell is accessible to the attacker.” The post also provides guidance for how on-premises Microsoft Exchange customers should mitigate the attack.

Sloppy dev-ops and CIA negligence partially enabled Iranian intelligence to identify and capture informants who risked their lives to provide the United States with information, according Reuters. The year-long investigation follows the story of six Iranian men who were jailed as part of an aggressive counterintelligence operation by Iran that began in 2009. The men were partially outed by what Reuters describes as a flawed web-based covert communications system that led to the arrest and execution of dozens of CIA informants in Iran and China. In 2018, Yahoo News reported on the system.

Because the CIA appeared to have purchased web-hosting space in bulk from the same provider, Reuters was able to enumerate hundreds of secret CIA websites meant to facilitate communications between informants around the world and their CIA handlers. The sites, which are no longer active, were devoted to topics such as beauty, fitness, and entertainment. Among them, according to Reuters, was a _Star Wars_ fan page. Two former CIA officials told the news agency that each fake website was assigned to only one spy in order to limit exposure of the entire network in case any single agent was captured.

James Olson, a former chief of CIA counterintelligence, told Reuters, “If we’re careless, if we’re reckless, and we’ve been penetrated, then shame on us.”

On Wednesday, a former National Security Agency staffer was charged with three violations of the Espionage Act for allegedly attempting to sell classified national defense information to an unnamed foreign government, according to court documents unsealed this week. In a press release about the arrest, the US Department of Justice stated that Jareh Sebastian Dalke, of Colorado Springs, Colorado, used an encrypted email to send excerpts of three classified documents to an undercover FBI agent, who he believed to be working with a foreign government. Dalke allegedly told the agent that he was in serious financial debt and, in exchange for the information, needed compensation in cryptocurrency.

The FBI arrested Dalke on Wednesday when he arrived at Union Station in downtown Denver to deliver classified documents to the undercover agent. If convicted, he could face up to life in prison or the death penalty.

On Tuesday, hackers hijacked _Fast Company_’s content management system, blasting two obscene push notifications to the publication’s Apple News followers. In response, the publication’s parent company, Mansueto Ventures, shut down Fastcompany.com and Inc.com, which it also owns. _Fast Company_ issued a statement calling the messages “vile” and “not in line with the content and ethos” of the outlet. An article the hacker apparently posted to _Fast Company_’s website claimed they got access through a password that was shared across many accounts, including an administrator.

As of yesterday, the company’s websites were still offline, instead redirecting to a statement about the hack.

Microsoft Exchange Server Has a Zero-Day Problem

People around the world are rallying to subvert Iran's internet shutdown, but actually pulling it off is proving difficult and risky.

Amid widespread protests across Iran sparked by the death of 22-year-old Mahsa Amini in “morality police” custody earlier this month, the government has imposed severe and extensive internet blackouts and blocked numerous digital services around the country for days. With most of Iran’s 80 million citizens impacted, people around the world have been searching for ways to get Iranians back online. But every approach comes with caveats.

Iranians have faced escalating internet restrictions for years and have some workarounds in place as a result, like VPNs and other relay services. As repressive governments have increasingly deployed connectivity blackouts as a means to control citizens, the measure has morphed from a dark horse tactic to a well-known strategy. But even with increased awareness, there’s still no easy, affordable, and broad way to restore digital access to people whose government is actively blocking it.

Efforts to reinstate digital lifelines in Iran center around two goals. Both broadband internet and mobile data are suffering outages, thanks to what are essentially internet “off” switches—infrastructure the regime has spent years investing in. So one area of focus is the potential to establish alternative connections, namely through satellite services. But the government is also filtering and blocking access to specific digital services even when people can connect to Wi-Fi or mobile data. This means people inside and outside of the country are also attempting to provide technical workarounds so Iranians can maintain access to vital services that would otherwise be inaccessible, like WhatsApp and Instagram. Given the extent of the government’s control, the logistical hurdles, and extensive global sanctions currently in place against Iran, progress is slow.

“The first thing we need to understand is that this time is different because they are going after every possible channel of communication,” says Amir Rashidi, director of internet security and digital rights at the Iran-focused human rights organization Miaan Group. “And this is something that was really new to us. As someone who’s worked on the internet of Iran for more than a decade, I never saw the Iranian government so aggressively going after every communication channel.”

Rashidi says that all email providers, including Yahoo Mail and Mail.com, are blocked. (Perhaps counterintuitively, Gmail, iCloud, and ProtonMail are still accessible.) Messaging platforms like WhatsApp and Instagram are also blocked, and the government is even cutting access to many video games because of their chat functions.

Last week, the United States Treasury Department issued a general license to create leeway within otherwise stringent sanctions for US tech companies to provide hardware, software, cloud services, and other technology to Iranians if they can find a way to do so. 

“While Iran’s government is cutting off its people’s access to the global internet, the United States is taking action to support the free flow of information and access to fact-based information to the Iranian people,” the Treasury wrote. “The updated guidance will authorize technology companies to offer the Iranian people more options of secure, outside platforms and services.”

Some communication services have systems in place for attempting to skirt digital blockades. The secure messaging app Signal, for example, offers tools so people around the world can set up proxy servers that securely relay Signal traffic to bypass government filters. Proxy service has previously only been available for Signal on Android, but the platform added iOS support on Wednesday. 

Still, if people in Iran don’t already have the Signal app installed on their phones or haven’t registered their phone numbers, the connectivity outages make it difficult to download the app or receive the SMS code used for account setup. Android users who can’t connect to Google Play can also download the app directly from Signal’s website, but this creates the possibility that malicious versions of the Signal app could circulate on other forums and trick people into downloading them. In an attempt to address this, the Signal Foundation created the email address “getsignal@signal.org” that people can message to request a safe copy of the app. 

The anonymity service Tor is largely inaccessible in Iran, but some activists are working to establish Tor bridges within Iran to connect internal country networks to the global platform. The work is difficult without infrastructure and resources, though, and is extremely dangerous if the regime detects the activity. Similarly, other efforts to establish clandestine infrastructure within the country are fraught because they often require too much technical expertise for a layperson to carry out safely. Echoing the issue with safely downloading apps like Signal, it can also be difficult for people to determine whether circumvention measures they learn about are legitimate or tainted.

Users in Iran have also been leaning on other services that have proxies built in. For example, Firuzeh Mahmoudi, executive director of the US-based nonprofit United for Iran, says that the law enforcement-tracking app Gershad has been in heavy use during the connectivity blackouts. The app, which has been circulating in Iran since 2016 and is now developed by United for Iran, lets users crowdsource information about the movements of the regime’s “morality police” and is now also being used to track other security forces and checkpoints.

The basic issue of connectivity access is still a fundamental challenge. Efforts to provide satellite service as an alternative could theoretically be very fruitful and threaten the totality of internet blackouts. SpaceX CEO Elon Musk tweeted last week that he was “activating” the company’s Starlink satellite internet service for people in Iran. In practice, though, the option isn’t a panacea. To use Starlink or any satellite internet, you need hardware that includes base stations to pick up and translate the signal. Procuring and setting up this infrastructure takes resources and is especially infeasible in a place like Iran, where sanctions and trade blockades drastically limit access to equipment and the ability to pay for subscription services or other connectivity fees. And even if users can overcome these hurdles, jamming is also a potential issue. The French satellite operator Eutelsat said yesterday, for example, that two of its satellites were being jammed from Iran. In addition to providing internet services, the satellites also broadcast two prominent Iranian dissident television channels.

“There are just so many challenges of installing this in Iran,” Miaan Group’s Rashidi says. “If you have a terminal, my understanding is that Starlink is working, but getting those terminals into the country is a challenge. And then they are a security risk because the government can locate those terminals. And then, who is going to pay for all of it and how, given the sanctions? But even if you ignore all those issues, satellite base stations don’t solve the problem that mobile data is part of the shutdown. You can’t put a Starlink terminal in your backpack to go to a protest. So satellite connectivity would be helpful, but it doesn’t solve the issues.”

Though the problem is nuanced, human rights advocates and Iranian activists emphasize that the global community can make a difference by raising awareness and continuing to work on creative solutions to the problem. With digital censorship and connectivity blackouts being used as levers for authoritarian control, developing circumvention tools is increasingly vital. As United for Iran’s Mahmoudi puts it, “We all need to keep the lights on.”

The Challenge of Cracking Iran’s Internet Blockade

Plus: WhatsApp plugs holes that could be used for remote execution attacks, Microsoft patches a zero-day vulnerability, and more.

None of the issues patched by Google are known to have been exploited in attacks, but if the update is available to you, it’s a good idea to apply it as soon as possible.

Microsoft

Microsoft Patch Tuesday is an important one because it comes with a fix for a flaw already being used in attacks. The zero-day vulnerability, tracked as CVE-2022-37969, is a privilege escalation issue in the Windows Common Log File System Driver that could allow an adversary to take control of the machine.

The zero-day is among 63 vulnerabilities patched by Microsoft, including five rated as critical. These include CVE-2022-34722 and CVE-2022-34721, remote code execution (RCE) flaws in the Windows Internet Key Exchange Protocol (IKE) which both have a CVSS score of 9.8.

Later in September, Microsoft issued an out-of-band security update for a spoofing vulnerability in its Endpoint Configuration Manager tracked as CVE 2022 37972.

WhatsApp

Encrypted messaging service WhatsApp has released an update to fix two vulnerabilities that could result in remote code execution. CVE-2022-36934 is an integer overflow issue in WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, and Business for iOS prior to v2.22.16.12, which could result in remote code execution in a video call.

Meanwhile, CVE-2022-27492 is an integer underflow flaw in WhatsApp for Android prior to v2.22.16.2 and WhatsApp for iOS v2.22.15.9 that could have caused remote code execution for someone receiving a crafted video file, according to the WhatsApp security advisory.

WhatsApp patched these flaws about a month ago, so if you are running the current version, you should be safe.

HP

HP has fixed a serious issue in the support assistant tool that comes preinstalled on all of its laptops. The privilege escalation bug in HP Support Assistant is ranked as a high-severity issue and is tracked as CVE-2022-38395.

HP has released only limited details about the vulnerability on its support page, but it goes without saying that those with affected equipment should ensure they update now.

SAP

SAP’s September Patch Day saw the release of 16 new and updated patches, including three high-priority fixes for SAP Business One, SAP BusinessObjects, and SAP GRC.

The SAP Business One fix, which patches an Unquoted Service Path vulnerability, is the most critical of the three. Attackers could exploit the flaw “to execute an arbitrary binary file when the vulnerable service starts, which could allow it to escalate privileges to SYSTEM,” security firm Onapsis says.

A second fix for SAP BusinessObjects patches an information disclosure vulnerability. “Under certain conditions, the vulnerability allows an attacker to gain access to unencrypted sensitive information in the Central Management Console of SAP BusinessObjects Business Intelligence Platform,” says Onapsis in its blog.

The third High Priority Note affecting SAP GRC customers could allow an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad.

Cisco

Software giant Cisco has issued a patch to fix a high-severity security issue in the binding configuration of SD-WAN vManage software containers. Tracked as CVE-2022-20696, the flaw could allow an unauthenticated attacker who has access to the VPN0 logical network to access the messaging service ports on an affected system.

“A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload,” Cisco warned in an advisory.

Sophos

Security company Sophos has just fixed an RCE flaw in its firewall product that it says is already being used in attacks. Tracked as CVE-2022-3236, the code injection vulnerability was discovered in the User Portal and Webadmin of Sophos Firewall.

“Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region,” the firm said in a security advisory.

WP Gateway WordPress Plugin

A vulnerability in a WordPress plugin called AP Gateway is already being used in attacks. Tracked as CVE-2022-3180, the privilege escalation bug could allow attackers to add a malicious user with admin privileges to take over sites running the plugin.

“As this is an actively exploited zero-day vulnerability, and attackers are already aware of the mechanism required to exploit it, we are releasing this public service announcement to all of our users,” said Ram Gall, a Wordfence senior threat analyst, adding that certain details have been withheld intentionally to prevent further exploitation.

Go Update iOS, Chrome, and HP Computers to Fix Serious Flaws

The messenger protocol had gained popularity for its robust security, but vulnerabilities allowed attackers to decrypt messages and impersonate users.

Developers of the open source Matrix messenger protocol have released an update to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform’s meteoric rise.

Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there’s a dizzying array of other members as well.

Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can’t be spoofed and that only the senders and receivers of messages can read the contents.

Matthew Hodgson—the cofounder and project lead for Matrix and the CEO and CTO at Element, maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany.

On Wednesday, a team published research that reports a host of vulnerabilities that undermine Matrix’s authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect that an attack is underway.

The researchers privately reported the vulnerabilities to Matrix earlier this year and agreed to a coordinated disclosure timed to Wednesday’s release by Matrix of updates that address the most serious flaws.

“Our attacks allow a malicious server operator or someone who gains control of a Matrix server to read the messages of users and to impersonate them to each other,” the researchers wrote in an email. “Matrix aims to protect against such behavior by providing end-to-end encryption, but our attacks highlight flaws in its protocol design and its flagship client implementation Element.”

Hodgson said he disagrees with the researchers’ contention that some of the vulnerabilities reside in the Matrix protocol itself and asserts they are all implementation bugs in the first generation of Matrix apps, which include Element. He said that a newer generation of Matrix apps, including ElementX, Hydrogen, and Third Room, are unaffected. There are no indications that the vulnerabilities have ever been actively exploited, he added.

Breaking Confidentiality, Attacking Verification, and More

The first two attacks provide a simple confidentiality break by exploiting the homeserver’s control over the users and devices that are permitted to join a private room. Only a person who creates a room or is deputized by the room creator is permitted to invite and admit new members, but the room management messages that make this mechanism possible aren’t required to be authenticated with the cryptographic keys of these authorized users. It’s trivial for someone with control of the homeserver to spoof such messages and, from there, admit users without the permission of the authorized users. Once admitted, the attacker gains access to decrypted communications sent in that room.

The researchers are careful to note that all new room entrants are automatically logged in an event timeline and hence can be detected by anyone in the room who manually inspects the membership list in real time. In large rooms with lots of activity, however, this kind of inspection may not be practical, the researchers said.

A variation of this attack is for the homeserver to add a device under the attacker’s control to the account of a user already in a private room. In a case like this, the new device will be displayed and labeled as “unverified” to all users, but at that point, all existing devices will automatically share the keys needed to decrypt all future messages.

A third proof-of-concept exploit provides an attack on the out-of-band mechanism Element offers so users can verify that the cryptographic identity they’re communicating with matches the person they think it does. This verification allows users or devices to compare short authentication strings to make sure they match, in much the way that the Signal messenger uses safety numbers. In either case, users perform the comparison outside of the app.

The researchers wrote:

_Our attack against out-of-band verification in Matrix enables an attacker to convince a target to cryptographically sign (and thus verify) a cross-signing identity controlled by the attacker. In this attack, a malicious homeserver assigns each device a device identifier that is also a valid cryptographic identity (under the homeserver’s control). At the end of the out-of-band verification process, each device will send a homeserver-controlled cryptographic identity to the other device. They do this by assigning the target device a device identifier that is also a cryptographic identity, exploiting a lack of domain separation between the two. When a device receives such a message, it is interpreted as a cryptographic identity. The receiving device will then sign (and thus verify) a homeserver-controlled cryptographic identity, with the false understanding that they have verified this identity out-of-band!_

With that, the attacker can perform a mallory-in-the-middle attack that breaks the confidentiality and authenticity of an underlying “Olm” channel, which under the Matrix design is the protocol for transmitting end-to-end data sent between two chat partners.

A fourth attack provides for what the researchers call “semi-trusted impersonation.” At times—such as when a user adds a new device to their account—a Matrix device may not have access to inbound messages in so-called Megolm sessions, as they’re known in the Matrix specification. This can prevent the device from being able to decrypt messages sent before it was added. The device can recover by using a key request to obtain the needed decryption keys.

Matrix, the researchers said, doesn’t provide a cryptographic mechanism for ensuring that the keys shared through the key request are legitimate. Instead, the Matrix specification requires sharing of inbound messages to be completed only between devices that trust each other. When this occurs, Matrix generates a warning message to messages that were decrypted using a forwarded key.

The researchers continued:

_Whilst Element clients restrict who they share keys with, no verification is implemented on who to accept key shares from. Our attack exploits this lack of verification in order to send attacker-controlled Megolm sessions to a target device, claiming they belong to a session of the device they wish to impersonate. The attacker can then send messages to the target device using these sessions, which will authenticate the messages as coming from the device being impersonated. Whilst these messages will be accompanied by a warning, this is the same warning that accompanies keys \*honestly\* forwarded with the “Key Request protocol.”_

The fifth and sixth attacks are what the researchers call trusted impersonation and impersonation to confidentiality break. Each builds off the other to enable a server to impersonate users and read their messages. A seventh attack works against a backup feature and is only of theoretical interest because the researchers can’t instantiate an attack exploiting it against a real Matrix server.

Agreeing to Disagree

In his email, Hodgson said Matrix regards only three of the vulnerabilities—the trusted impersonation, the attack on key verification, and the malicious backup attack—as critical security issues. And even then, he said all three are flaws in how Matrix was implemented in its first-generation client software developer kit, known as matrix-js-sdk. He added:

_They have highlighted two issues with the protocol which are much lower severity: that homeservers can currently add malicious users and devices to conversations that they are hosting, and that homeservers can fake history which users did not directly receive at the time. However, users are clearly warned when these situations occur: if you have verified the users in a conversation and an unverified user or device is added to a conversation, it is very clearly marked in all Matrix clients with a big red warning cross. Similarly, if an unexpected user suddenly appears in a conversation, everyone in the room is immediately informed that this user has joined, and can take appropriate evasive action._

_By confusing the legitimate implementation bugs which only affect matrix-js-sdk and derivatives with these lower severity protocol design considerations, the researchers have artificially inflated the overall severity of the problem, by falsely implying that the protocol itself is vulnerable._

_This said, we are also addressing these protocol design issues—we’ve already eliminated most situations where the server could fake history in tomorrow’s release, and we’ll be following up with an update which cryptographically ensures that users/devices can only be added to a room if they were invited by an admin in the room. We are also shifting to “trust on first use,” so that any unexpected devices/users get flagged, whether or not you’ve verified the users in a room._

Besides disagreeing on some of the specific vulnerabilities, the researchers and Hodgson remain at odds on another point. The researchers said the vulnerabilities they uncovered “highlight a lack of a unified and formal approach to security guarantees in Matrix” and that the specification has grown “organically with new sub-protocols adding new functionalities and thus inadvertently subverting the security guarantees of the core protocol.”

For his part, Hodgson said:

_We consider the protocol itself to be sound, and we consider our security processes to be robust. We agree that the first generation implementations have grown organically (they predated the formal protocol specification), and the fact is that we have been focusing our efforts on auditing our next generation implementations which we will be switching over to in the coming months. We have 4 independent public audits booked in with Least Authority, one of which is already published:_ _https://matrix.org/blog/2022/05/16/independent-public-audit-of-vodozemac-a-native-rust-reference-implementation-of-matrix-end-to-end-encryption__, and it’s worth reiterating that the next gen implementations were not susceptable\[sic\] to these attacks. It’s obviously unfortunate that we didn’t catch the first gen SDK vulns in an existing audit (the bugs occurred since our original 2016 NCC Group audit), but going forwards our reference implementations will all be independently verified. Unfortunately we didn’t have resources to audit both the legacy and next-gen implementations recently, and so focused on the next-gen \[implementations\], knowing they will shortly obsolete the legacy \[implementations\]._

The research paper, _Practically-exploitable Cryptographic Vulnerabilities in Matrix_, was authored by Martin R. Albrecht, Sofía Celi, Benjamin Dowling, and Daniel Jones. Albrecht and Jones are with the Information Security Group at the Royal Holloway University of London; Celi is with Brave Software; and Dowling is with the Security of Advanced Systems Group, University of Sheffield.

Putting It All Together

The researchers and Hodgson disagree on some key points, but there’s an important consensus that has led to changes that once again restore the confidentiality and authentication guarantees of Matrix, even in the case of a malicious or compromised homeserver. But for users to avail themselves of these assurances, the researchers said:

_Each user must enable “cross-signing” and perform out-of-band verification with each of their own devices, and with each user they interact with. They must then remain vigilant: any warning messages or icons must be spotted and investigated. In the Element user interface, this requires checking the room icon and each individual message they receive (in some cases, past messages can retroactively receive a warning). Note that such warnings could be expected behavior (for example if the message was decrypted using a server-side Megolm backup or through the “Key Request protocol”). Users would need the expertise to investigate these warnings thoroughly and, if an issue is found, recover from it. If you follow these instructions without fail, Matrix can provide you with confidentiality and authentication._

_This places an unnecessary burden on users of Matrix clients, limits the user base to those with an understanding of the cryptography used in Matrix and how it is applied, and is impractical for daily use. The burden this places on users is unnecessary and the result of the design flaws we highlight in our paper (this is our “Simple confidentiality break”/“Homeserver Control of Room Membership” attack). Whilst this issue will persist after today’s fixes, a remediation is planned by the Matrix developers for a later date. It is understandable that they have delayed the release of this remediation, since it requires sizable changes to the protocol._

Besides updating Element, people will also want to install patches for Beeper, Cinny, SchildiChat, Circuli, Synod.im, and any other clients based on matrix-js-sdk, matrix-ios-sdk, or matrix-android-sdk2. It’s important to install the fixes first and only then perform the verification with new devices.

_This story originally appeared on_ _Ars Technica__._

_Update 9-29-22, 4:30 pm ET: Updated to clarify that the patch has already been released._

A Matrix Update Patches Serious End-to-End Encryption Flaws

For decades, security researchers warned about techniques for hijacking virtualization software. Now one group has put them into practice.

For decades, virtualization software has offered a way to vastly multiply computers’ efficiency, hosting entire collections of computers as “virtual machines” on just one physical machine. And for almost as long, security researchers have warned about the potential dark side of that technology: theoretical “hyperjacking” and “Blue Pill” attacks, where hackers hijack virtualization to spy on and manipulate virtual machines, with potentially no way for a targeted computer to detect the intrusion. That insidious spying has finally jumped from research papers to reality with warnings that one mysterious team of hackers has carried out a spree of “hyperjacking” attacks in the wild.

Today, Google-owned security firm Mandiant and virtualization firm VMware jointly published warnings that a sophisticated hacker group has been installing backdoors in VMware’s virtualization software on multiple targets’ networks as part of an apparent espionage campaign. By planting their own code in victims’ so-called hypervisors—VMware software that runs on a physical computer to manage all the virtual machines it hosts—the hackers were able to invisibly watch and run commands on the computers those hypervisors oversee. And because the malicious code targets the hypervisor on the physical machine rather than the victim’s virtual machines, the hackers’ trick multiplies their access and evades nearly all traditional security measures designed to monitor those target machines for signs of foul play.

“The idea that you can compromise one machine and from there have the ability to control virtual machines _en masse_ is huge,” says Mandiant consultant Alex Marvi. And even closely watching the processes of a target virtual machine, he says, an observer would in many cases see only “side effects” of the intrusion, given that the malware carrying out that spying had infected a part of the system entirely outside its operating system.

Mandiant discovered the hackers earlier this year and brought their techniques to VMware’s attention. Researchers say they’ve seen the group carry out their virtualization hacking—a technique historically dubbed hyperjacking in a reference to “hypervisor hijacking”—in fewer than 10 victims’ networks across North America and Asia. Mandiant notes that the hackers, which haven’t been identified as any known group, appear to be tied to China. But the company gives that claim only a “low confidence” rating, explaining that the assessment is based on an analysis of the group’s victims and some similarities between their code and that of other known malware.

While the group’s tactics appear to be rare, Mandiant warns that their techniques to bypass traditional security controls by exploiting virtualization represent a serious concern and are likely to proliferate and evolve among other hacker groups. “Now that people know this is possible, it will point them toward other comparable attacks,” says Mandiant’s Marvi. “Evolution is the big concern.”

In a technical writeup, Mandiant describes how the hackers corrupted victims’ virtualization setups by installing a malicious version of VMware’s software installation bundle to replace the legitimate version. That allowed them to hide two different backdoors, which Mandiant calls VirtualPita and VirtualPie, in VMware’s hypervisor program known as ESXi. Those backdoors let the hackers surveil and run their own commands on virtual machines managed by the infected hypervisor. Mandiant notes that the hackers didn’t actually exploit any patchable vulnerability in VMware’s software, but instead used administrator-level access to the ESXi hypervisors to plant their spy tools. That admin access suggests that their virtualization hacking served as a persistence technique, allowing them to hide their espionage more effectively long-term after gaining initial access to the victims’ network through other means.

In a statement to WIRED, VMware said that “while there is no VMware vulnerability involved, we are highlighting the need for strong operational security practices that include secure credential management and network security.” The company also pointed to a guide to “hardening” VMware setups against this sort of hacking, including better authentication measures to control who can tamper with ESXi software and validation measures to check whether hypervisors have been corrupted.

Since as early as 2006, security researchers have theorized that hyperjacking presents a method to stealthily spy on or manipulate victims using virtualization software. In a paper that year, Microsoft and University of Michigan researchers described the potential for hackers to install a malicious hypervisor they called a “hypervirus” on a target machine that places the victim inside a virtual machine run by the hacker without the victim’s knowledge. By controlling that malicious hypervisor, everything on the target machine would be under the hacker’s control, with practically no sign within the virtualized operating system that anything was amiss. Security researcher Joanna Rutkowska dubbed her own version of the technique a Blue Pill attack, since it trapped the victim in a seamless environment entirely created by the hacker, _Matrix_\-style, without their knowledge.

What Mandiant observed isn’t exactly that Blue Pill or hypervirus technique, argues Dino Dai Zovi, a well-known cybersecurity researcher who gave a talk at the Black Hat security conference about hypervisor hacking in the summer of 2006. In those theoretical attacks, including his own work, a hacker creates a new hypervisor without the victim’s knowledge, while in the cases Mandiant discovered, the spies merely hijacked existing ones. But he points out that this is a far easier and yet highly effective technique—and one he’s expected for years. “I’ve always assumed it was possible and even being done,” says Dai Zovi. “It’s just a powerful position that gives full access to any of the virtual machines running on that hypervisor.”

Aside from the difficulty of detecting the attack, he points out that it also serves as a multiplier of the hacker’s control: In virtualization setups, two to five virtual machines can typically run on any physical computer, and there are often thousands of virtual machines on an organization’s network running as everything from PCs to email servers. “That’s a lot of scale and leverage,” says Dai Zovi. “For an attacker, it’s a good return on their investment.”

Mandiant suggests in its writeup of the hacking campaign that attackers may be turning to hyperjacking as part of a larger trend of compromising network elements that have less rigorous monitoring tools than the average server or PC. But given the power of the technique—and the years of warnings—it’s perhaps most surprising that it hasn’t been put to malicious use earlier.

“When people first hear about virtualization technology, they always raise their eyebrows and ask, ‘What happens if someone takes control of the hypervisor?’” says Mandiant’s Marvi. “Now it’s happened.”

Mystery Hackers Are ‘Hyperjacking’ Targets for Insidious Spying

Damage to the pipeline that runs between Russia and Germany is being treated as deliberate. Finding out what happened may not be straightforward.

The Nord Stream gas pipelines are colossal pieces of infrastructure. Running more than 1,200 kilometers from Russia, across the Baltic Sea to Germany, the pipes can carry up to 110 billion cubic meters of gas, enough for 26 million homes. The Nord Stream 1 pipeline alone is constructed of 202,000 huge pieces of piping. Each section is 12 meters long and contains piping that uses around 4 centimeters of steel, which is covered with 11 centimeters of concrete. The pipes are not built to break.

So when the pressure in one of the Nord Stream pipes dropped on June 26, alarm bells started ringing. Danish authorities told ships to steer clear of the pipes as methane gas was bubbling into the sea. Hours later, two more leaks were detected, one in Nord Stream 2 and a second in Nord Stream 1. Now, authorities are suspecting foul play. “We are not talking about an accident,” Mette Frederiksen, the Danish prime minister said.

Ursula von der Leyen, head of the European Commission, believes the leaks may be a result of “sabotage” and said any “deliberate disruption” of energy infrastructure will “lead to the strongest possible response.” NATO officials agree; the US has pledged its support to help Europe find out what happened. However, the incidents have raised fears about attacks on critical infrastructure and the security protections in place around systems that can provide the world’s fuel. The incident comes on top of Russia reducing its supply of gas to Europe, with large parts of the continent facing winter energy crises.

While officials have indicated the leaks may have been caused deliberately, very little evidence about the attacks has emerged so far. Military flights over the region show gas bubbling at the surface more than a kilometer wide, and Swedish seismic experts say they are convinced explosions took place after they recorded tremors equal to a magnitude 2.3 earthquake.

Fingers immediately pointed at Russia, which partly owns the pipes. Ukraine has said it is a “terrorist attack,” and German newspaper _Der Spiegel_ reported that the CIA warned German officials about possible attacks against Baltic pipelines several weeks ago. (Right-wing commentators in the US and one Polish MP accused the US of being involved after President Joe Biden said, in February, he would “put an end” to Nord Stream 2 if Russia invaded Ukraine.)

"It's a very classic Russian hybrid warfare approach,” says Hans Tino Hansen, the CEO of Risk Intelligence, a Denmark-based security firm that deals with maritime issues. Hansen says if Russia did attack the Nord Stream pipelines it would show they have “complete deniability.” Because Russia partly owns the Nord Stream infrastructure, it makes people question why it would be behind any attacks against it. (The Kremlin claimed suggestions it is behind the leaks are “stupid.) “They are showing that they can attack seabed energy infrastructure, with the pipelines, which then sends the signal that they can attack and destroy any energy infrastructure in Europe," Hansen says.

Investigators across Europe, including intelligence agencies, will now be trying to piece together exactly who and what caused the apparent explosions. This is likely to involve multiple steps, such as examining what data is held about the area, including seismic data and other sensors, checking whether any communications around the incident have been intercepted, and examining the pipelines to see if there are any signs of intentional destruction.

Neither of the pipes is operational—Nord Stream 1 was paused for repairs in August and Nord Stream 2 has not officially opened after Germany pulled support for it ahead of Russia’s full-scale invasion of Ukraine in late February—but both pipes are holding gas. All three leaks happened relatively close to each other, near the Danish island of Bornholm, in the Baltic sea. The island is surrounded by Denmark to the west, Sweden to the north, and both Germany and Poland to the south. The leaks are in international waters, but also sit in both Denmark and Sweden’s exclusive economic zones. “It's quite shallow, around 50 meters on average in this region,” says Julian Pawlak, a research associate at the Helmut Schmidt University and the German Institute for Defence and Strategic Studies.

Security sources have speculated if the attacks were deliberate, they could have been conducted by unmanned underwater drones, involve mines being dropped or planted by boats, been carried out by divers, or even from within the pipes themselves. “We still don't know what the origin is of those explosions or where they came from—if they originated from the outside or if they originated from the inside of the pipelines,” Pawlak says. In a process called “pigging,” cleaning and inspection machines can be sent down the pipes from Russia in the direction of Germany. It’s possible pigging was repurposed to carry out an attack.

Back in 2007, before the first Nord Stream pipeline was constructed, a review of the project by the Swedish Defence Research Agency (FOI) warned about potential explosions around the pipe, in the context of terrorism. “Despite its concrete coating, a pipeline is rather vulnerable, and one diver would be enough to set an explosive device,” its report said. “However, the impact of such an assault would probably be rather modest and most likely a minor incident of this type would not result in a large explosion.”

"They \[Russia\] have the capability for subsea warfare, with the divers, but also with mini-submarines and drones,” Hansen says. However, confirming any responsibility isn’t necessarily straightforward. The relatively shallow depth of the area around the Nord Stream pipes means it is unlikely that any large submarines would have been operating nearby, as they would be easy to detect.

Pawlak says any vessels in the area could potentially detect others that may have caused the damage. Undersea sensors could equally spot something in the area moving, but it is unclear where any of these systems are. “It's still not the case that all of the Baltic Sea is filled up with sensors and that NATO knows every movement,” Pawlak says. “On the surface, but especially on the seabed, it's still not possible to know, at every time, at every place, what's moving, what's going on.”

However, the Nord Stream incidents draw into focus the protections that are placed around critical infrastructure. In recent years, cyberattacks have shut down the US Colonial Pipeline, cutting off fuel supplies. And ahead of Russia’s full-scale invasion of Ukraine, its military hackers used the country as a cyberwarfare testing ground, shutting down power grids with their code.

Undersea infrastructure can be particularly vulnerable to damage—either from natural causes, such as earthquakes, or physical attacks. Since the Nord Stream pipes burst on Tuesday huge volumes of gas have poured into the sea, potentially causing an “unprecedented” environmental impact. "As we—and many others—have been saying for many years, we need to address the security of energy infrastructure and also everything subsea,” Hansen says. This includes the myriad of internet cables stretching thousands of kilometers around the world and keeping billions of people online.

In January, the head of the UK’s armed forces warned that Russian submarines have been threatening subsea cables. “Russia has grown the capability to put at threat those undersea cables and potentially exploit those undersea cables,” Admiral Tony Radakin said.

Hansen says there are two starting points for protecting subsea infrastructure: first, building out ways to detect faults and issues with equipment automatically and then also making sure there is equipment, such as underwater drones, that are able to scramble to sites to inspect them when damage has happened. Those steps may already be underway, with Norway’s prime minister saying the country will up the military protection of its energy infrastructure.

Source

Wired