Amnezia, a free virtual private network, allows users to set up their own servers, making it harder for Moscow to block this portal to the outside world.

The Russian government has banned more than 10,000 websites for content about the war in Ukraine since Moscow launched the full-scale invasion in February 2022. The blacklist includes Facebook, Twitter, Instagram, and independent news outlets. Over the past year, Russians living inside the country have turned to censorship circumvention tools such as VPNs to pierce through the information blockade.

But as dozens of virtual private networks get blocked, leaving users scrambling to maintain their access to free information, local activists and developers are coming up with new solutions. One of them is Amnezia VPN, a free, open source VPN client.

“We even do not advertise and promote it, and new users are still coming by the hundreds every day,” says Mazay Banzaev, Amnezia VPN’s founder.

Unlike commercial VPNs that route users through company servers, which can be blocked, Amnezia VPN makes it simple for users to buy and set up their own servers. This allows them to choose their own IP address and use protocols that are harder to block.

“More than half of the commercial VPNs in Russia have been blocked because it’s easy enough to block them: They do not block them by protocols, but by IP addresses,” says Banzaev. “\[Amnezia\] is an order of magnitude more resilient than a typical commercial VPN.”

Amnezia VPN is similar to Outline, a free and open source tool developed by Jigsaw, a subsidiary of Google. Amnezia was created in 2020 during a hackathon supported by Russian digital rights organization Roskomsvoboda. Even then, “it was clear that things were moving toward stricter censorship,” says Banzaev.

Russian authorities have been attempting to control tools such as VPNs and anonymous proxy servers for years, including by introducing a law regulating these tools in 2017. Since Russia's invasion of Ukraine, however, the Kremlin has escalated its efforts to control information. 

Just days after Russian troops headed toward Kyiv, Ukraine’s capital, Vladimir Putin signed legislation that criminalizes spreading "fake" information about the war, with a penalty of up to 15 years in prison. Most independent news outlets are now blocked, with editors and journalists ending up in prison, leaving Russians with state propaganda.

This has made VPNs and other censorship circumvention tools all the more important, says Stanislav Shakirov, cofounder of Roskomsvoboda and founder of tech development organization Privacy Accelerator. “If internet users in Russia stop receiving information other than state information,” he says, “we will have no hope of any processes leading to a change in the current regime.”

The Kremlin is, of course, not giving up on its crackdown. In September 2022, Roskomnadzor, the main government body responsible for internet censorship, announced it would block six popular VPN services, including ExpressVPN and NordVPN. This was followed in March 2023 by announcements that VPNs refusing to provide data to domestic intelligence agencies would be blocked in Russia, as well as proposals to restrict anonymization tools such as virtual phone numbers. Messaging app Telegram, which saw a steep rise in popularity in Russia after the invasion, has been offering virtual phone numbers since December 2022.

Free VPN Amnezia Helps Users Avoid Censorship in Russia

Without an information sharing and analysis center, the country’s food and agriculture sector is uniquely vulnerable to hackers.

Just-in-time logistics mean that even short-term cyberattacks can have serious consequences. Hacks that disrupt fertilizer or pesticide production can force farmers to sit out planting seasons. Breaches at meat-packing plants can cause destabilizing supply shortages. Tampering at a food processing firm can lead to deadly contamination. Already, ransomware attacks that have forced companies to shut down operations for a week have left schools without milk, juice, and eggs, according to Sachs.

“A major disruption in this sector leads to immediate public health and safety issues,” says Mark Montgomery, who served as executive director of the Cyberspace Solarium Commission.

Despite being increasingly vulnerable, Sachs says, the food and agriculture sector still “doesn’t really understand the threat mindset” as well as higher-profile sectors, like financial services and energy, do.

Critical Businesses, Limited Support

Today, food and agriculture is one of four critical infrastructure sectors (out of 16) without an ISAC, along with dams, government facilities, and nuclear reactors and materials.

The food and agriculture sector was one of the first to launch such a center, in 2002, but it disbanded in 2008 because few companies were sharing information through it. Members were afraid that such openness jeopardized their competitive advantages and exposed them to regulatory action. Now, Sachs says, businesses worry that exchanging information with each other could prompt antitrust lawsuits, even though such collaboration is legal.

Some companies participate in a Food and Agriculture Special Interest Group (SIG) housed inside the IT-ISAC, which gives them access to data and analysis from some of the world’s biggest tech companies, as well as resources like playbooks for confronting specific hacker groups.

“Our work with the industry has really expanded over the last three years or so,” says IT-ISAC executive director Scott Algeier. In that same time period, the IT-ISAC has recorded 300 ransomware attacks on the food and agriculture sector.

But the SIG’s offerings are limited, Sachs argues. It doesn’t hold regular large-scale exercises simulating attacks on food and agriculture firms, doesn’t staff a 24/7 watch center that constantly monitors these firms’ infrastructure (along with related events like severe weather and supply chain disruptions), and can’t automatically generate insights and alerts by comparing classified government intelligence with data from sensors inside that infrastructure. “I appreciate everything Scott is doing over there,” Sachs says. “It's a very good thing. But it's not an ISAC.”

Algeier says the IT-ISAC has hosted exercises focused on the food and agriculture sector and that “members can reach out to us 24/7 if needed.”

But the sector needs its own ISAC that can “analyze the threat and provide a true operational assessment,” says Brian Harrell, a former assistant director for infrastructure security at the US Cybersecurity and Infrastructure Security Agency (CISA).

Pfluger says, “Plenty of folks I’ve spoken with think there needs to be a dedicated ISAC.”

Companies also need more support from the federal government.

The US Department of Agriculture, the industry’s sector risk management agency, is “significantly less effective” than other SRMAs, Montgomery says. The USDA doesn’t even have dedicated funding for its security support, which includes biannual sector-wide meetings, weekly threat bulletins, and occasional town halls.

The Dangerous Weak Link in the US Food Chain

Italy’s recent ban of Open AI’s generative text tool may just be the beginning of ChatGPT's regulatory woes.

When OpenAI released GPT-3 in July 2020, it offered a glimpse of the data used to train the large language model. Millions of pages scraped from the web, Reddit posts, books, and more are used to create the generative text system, according to a technical paper. Scooped up in this data is some of the personal information you share about yourself online. This data is now getting OpenAI into trouble. 

On March 31, Italy’s data regulator issued a temporary emergency decision demanding OpenAI stop using the personal information of millions of Italians that’s included in its training data. According to the regulator, Garante per la Protezione dei Dati Personali, OpenAI doesn’t have the legal right to use people’s personal information in ChatGPT. In response, OpenAI has stopped people in Italy from accessing its chatbot while it provides responses to the officials, who are investigating further. 

The action is the first taken against ChatGPT by a Western regulator and highlights privacy tensions around the creation of giant generative AI models, which are often trained on vast swathes of internet data. Just as artists and media companies have complained that generative AI developers have used their work without permission, the data regulator is now saying the same for people’s personal information.

Similar decisions could follow all across Europe. In the days since Italy announced its probe, data regulators in France, Germany, and Ireland have contacted the Garante to ask for more information on its findings. “If the business model has just been to scrape the internet for whatever you could find, then there might be a really significant issue here,” says Tobias Judin, the head of international at Norway’s data protection authority, which is monitoring developments. Judin adds that if a model is built on data that may be unlawfully collected, it raises questions about whether anyone can use the tools legally.

Italy’s blow to OpenAI also comes as scrutiny of large AI models is steadily increasing. On March 29, tech leaders called for a pause on the development of systems like ChatGPT, fearing its future implications. Judin says the Italian decision highlights more immediate concerns. “Essentially, we’re seeing that AI development to date could potentially have a massive shortcoming,” Judin says.

The Italian Job

Europe’s GDPR rules, which cover the way organizations collect, store, and use people’s personal data, protect the data of more than 400 million people across the continent. This personal data can be anything from a person’s name to their IP address—if it can be used to identify someone, it can count as their personal information. Unlike the patchwork of state-level privacy rules in the United States, GDPR’s protections apply if people’s information is freely available online. In short: Just because someone’s information is public doesn’t mean you can vaccuum it up and do anything you want with it.

Italy’s Garante believes ChatGPT has four problems under GDPR: OpenAI doesn’t have age controls to stop people under the age of 13 from using the text generation system; it can provide information about people that isn’t accurate; and people haven’t been told their data was collected. Perhaps most importantly, its fourth argument claims there is “no legal basis” for collecting people’s personal information in the massive swells of data used to train ChatGPT.

“The Italians have called their bluff,” says Lilian Edwards, a professor of law, innovation, and society at Newcastle University in the UK. “It did seem pretty evident in the EU that this was a breach of data protection law.”

Broadly speaking, for a company to collect and use people’s information under GDPR, they must rely on one of six legal justifications, ranging from someone giving their permission to the information being required as part of a contract. Edwards says that in this instance, there are essentially two options: getting people’s consent—which OpenAI didn’t do—or arguing it has “legitimate interests” to use people’s data, which is “very hard” to do, Edwards says. The Garante tells WIRED it believes this defense is “inadequate.”

OpenAI’s privacy policy doesn’t directly mention its legal reasons for using people’s personal information in training data but says it relies upon “legitimate interests” when it “develops” its services. The company did not respond to WIRED’s request for comment. Unlike with GPT-3, OpenAI has not publicized any details of the training data that went into ChatGPT, and GPT-4 is thought to be several times larger.

However, GPT-4’s technical paper includes a section on privacy, which says its training data may include “publicly available personal information,” which comes from a number of sources. The paper says OpenAI takes steps to protect people’s privacy, including “fine-tuning” models to stop people asking for personal information and removing people’s information from training data “where feasible.”

“How to collect data lawfully for training data sets for use in everything from just regular algorithms to some really sophisticated AI is a critical issue that needs to be solved now, as we’re kind of on the tipping point for this sort of technology taking over,” says Jessica Lee, a partner at law firm Loeb and Loeb.

The action from the Italian regulator—which is also taking on the Replika chatbot—has the potential to be the first of many cases examining OpenAI’s data practices. GDPR allows companies with a base in Europe to nominate one country that will deal with all of its complaints—Ireland deals with Google, Twitter, and Meta, for instance. However, OpenAI doesn’t have a base in Europe, meaning that under GDPR, every individual country can open complaints against it. 

Model Data

OpenAI isn’t alone. Many of the issues raised by the Italian regulator are likely to cut to the core of all development of machine learning and generative AI systems, experts say. The EU is developing AI regulations, but so far there has been comparatively little action taken against the development of machine learning systems when it comes to privacy.

“There is this rot at the very foundations of the building blocks of this technology—and I think that’s going to be very hard to cure,” says Elizabeth Renieris, senior research associate at Oxford’s Institute for Ethics in AI and author on data practices. She points out that many data sets used for training machine learning systems have existed for years, and it is likely there were few privacy considerations when they were being put together. 

“There’s this layering and this complex supply chain of how that data ultimately makes its way into something like GPT-4,” Renieris says. “There’s never really been any type of data protection by design or default.” In 2022, the creators of one widely used image database, which has helped trained AI models for a decade, suggested images of people’s faces should be blurred in the data set. 

In Europe and California, privacy rules give people the ability to request that information be deleted or corrected if it is inaccurate. But deleting something from an AI system that is inaccurate or that someone doesn’t want there may not be straightforward—especially if the origins of the data are unclear. Both Renieris and Edwards question whether GDPR will be able to do anything about this in the long term, including upholding people’s rights. “There is no clue as to how you do that with these very large language models,” says Edwards from Newcastle University. “They don’t have provision for it.”

So far, there has been at least one relevant instance, when the company formerly known as Weight Watchers was ordered by the US Federal Trade Commission to delete algorithms created from data it didn’t have permission to use. But with increased scrutiny, such orders could become more common. “Depending, obviously, on the technical infrastructure, it may be difficult to fully clear your model of all of the personal data that was used to train it,” says Judin, from Norway’s data regulator. “If the model was then trained by unlawfully collected personal data, it would mean that you would essentially perhaps not be able to use your model.”

ChatGPT Has a Big Privacy Problem

Digging through manuals for security cameras, a group of gearheads found sinister details and ignited a new battle in the US-China tech war.

A Tiny Blog Took on Big Surveillance in China—and Won

North Korean hackers appear to have used the corrupted VoIP software to go after just a handful of crypto firms with “surgical precision.”

Software supply-chain attacks, in which hackers corrupt widely used applications to push their own code to thousands or even millions of machines, have become a scourge, both insidious and potentially huge in the breadth of their impact. But the latest major software supply-chain attack, in which hackers who appear to be working on behalf of the North Korean government hid their code in the installer for a common VoIP application known as 3CX, seems so far to have had a prosaic goal: breaking into a handful of cryptocurrency companies.

Researchers at Russian cybersecurity firm Kaspersky today revealed that they identified a small number of cryptocurrency-focused firms as at least some of the victims of the 3CX software supply-chain attack that's unfolded over the past week. Kaspersky declined to name any of those victim companies, but it notes that they're based in “western Asia.” 

Security firms CrowdStrike and SentinelOne last week pinned the operation on North Korean hackers, who compromised 3CX installer software that's used by 600,000 organizations worldwide, according to the vendor. Despite the potentially massive breadth of that attack, which SentinelOne dubbed “Smooth Operator,” Kaspersky has now found that the hackers combed through the victims infected with its corrupted software to ultimately target fewer than 10 machines—at least as far as Kaspersky could observe so far—and that they seemed to be focusing on cryptocurrency firms with “surgical precision.”

“This was all just to compromise a small group of companies, maybe not just in cryptocurrency, but what we see is that one of the interests of the attackers is cryptocurrency companies,” says Georgy Kucherin, a researcher on Kaspersky's GReAT team of security analysts. “Cryptocurrency companies should be especially concerned about this attack because they are the likely targets, and they should scan their systems for further compromise.”

Kaspersky based that conclusion on the discovery that, in some cases, the 3CX supply-chain hackers used their attack to ultimately plant a versatile backdoor program known as Gopuram on victim machines, which the researchers describe as “the final payload in the attack chain.” Kaspersky says the appearance of that malware also represents a North Korean fingerprint: It has seen Gopuram used before on the same network as another piece of malware, known as AppleJeus, linked to North Korean hackers. It's also previously seen Gopuram connect to the same command-and-control infrastructure as AppleJeus, and has seen Gopuram used previously to target cryptocurrency firms. All of that suggests not only that the 3CX attack was carried out by North Korean hackers, but that it may have been intended to breach cryptocurrency firms in order to steal from those companies, a common tactic of North Korean hackers ordered to raise money for the regime of Kim Jong-Un.

It has become a recurring theme for sophisticated state-sponsored hackers to exploit software supply chains to access the networks of thousands of organizations, only to winnow their focus down to a few victims. In 2020's notorious Solar Winds spy campaign, for instance, Russian hackers compromised the IT monitoring software Orion to push malicious updates to about 18,000 victims, but they appear to have stolen data from only a few dozen of them. In the earlier supply chain compromise of the CCleaner software, the Chinese hacker group known as Barium or WickedPanda compromised as many as 700,000 PCs, but similarly chose to target a relatively short list of tech firms.

“This is becoming very common,” says Kucherin, who also worked on the SolarWinds analysis and found clues linking that supply-chain attack to a known Russian group. “During supply-chain attacks, the threat actor conducts reconnaissance on the victims, collecting information, then they filter out this information, selecting victims to deploy a second-stage malware.” That filtering process is designed to help the hackers avoid detection, Kucherin points out, since deploying the second-stage malware to too many victims allows the attack to be more easily detected.

But Kucherin notes that the 3CX supply-chain attack was nonetheless detected relatively quickly, compared to others. The installation of the initial malware that the hackers appeared to use for reconnaissance was detected by companies like CrowdStrike and SentinelOne last week, less than a month after it was deployed. “They tried to be stealthy, but they failed,” Kucherin says. “Their first-stage implants were discovered.”

Given that detection, it's not clear how successful the campaign has been. Kucherin says Kaspersky hasn't seen any evidence of actual theft of cryptocurrency from the companies it saw targeted with the Gopuram malware.

But given the hundreds of thousands of potential victims of the 3CX supply-chain compromise, no one should conclude yet that crypto companies alone were targeted, says Tom Hegel, a security researcher with SentinelOne. “The current theory at this point is that the attackers did initially target crypto firms to get into those high-value organizations,” Hegel says. “I’m going to guess that once they saw the success of this, and the kinds of networks they were in, other objectives probably came into play.”

For now, Hegel says, no single security firm can see the whole shape of the 3CX hacking campaign or definitively state its goals. But if North Korean hackers really did compromise a piece of software used by 600,000 organizations around the world and use it just to try to steal cryptocurrency from a handful of them, they may have thrown away the keys to a much larger kingdom.

“This is all unfolding very quickly. I think we’ll continue to gain better insight into the victims,” Hegel says. “But from an attacker standpoint, if all they did was target crypto firms, this was a dramatic wasted opportunity.”

Massive 3CX Supply-Chain Hack Targeted Cryptocurrency Firms

An agency database WIRED obtained reveals widespread use of so-called 1509 summonses that experts say raises the specter of potential abuse.

US Immigration and Customs Enforcement agents are using an obscure legal tool to demand data from elementary schools, news organizations, and abortion clinics in ways that, some experts say, may be illegal. 

While these administrative subpoenas, known as 1509 custom summonses, are meant to be used only in criminal investigations about illegal imports or unpaid customs duties, WIRED found that the agency has deployed them to seek records that seemingly have little or nothing to do with customs violations, according to legal experts and several recipients of the 1509 summonses. 

A WIRED analysis of an Immigration and Customs Enforcement (ICE) subpoena tracking database, obtained through a Freedom of Information Act request, found that agents issued custom summons more than 170,000 times from the beginning of 2016 through mid-August 2022. The primary recipients of 1509s include telecommunications companies, major tech firms, money transfer services, airlines, and even utility companies. But it’s the edge cases that have drawn the most concern among legal experts, 

The outlier cases include custom summonses that sought records from a youth soccer league in Texas; surveillance video from a major abortion provider in Illinois; student records from an elementary school in Georgia; health records from a major state university’s student health services; data from three boards of elections or election departments; and data from a Lutheran organization that provides refugees with humanitarian and housing support.

In at least two instances, agents at ICE used the custom summons to pressure news organizations to reveal information about their sources. 

All of this is done without judicial oversight. 

“This is really dangerous,” says Matthew Guariglia, a policy analyst at the Electronic Frontier Foundation, a digital rights nonprofit. He adds that the frequent and apparently widespread use of 1509 summonses creates “a situation where this agency can fully go rogue” by using this tool in investigations that fall outside the scope of the law.

Two current agents from ICE’s Homeland Security Investigations (HSI) arm cautioned against drawing conclusions about potential abuse of the summons without additional context about each investigation referenced in the database. The agents, who asked not to be named because they are unauthorized to speak to the media, argue that because the agency is responsible for enforcing hundreds of laws pertaining to customs—including the distribution of child sexual abuse material (CSAM)—it’s possible that each summons was issued for a permissible investigation under the law. 

However, a former high-level Department of Homeland Security (DHS) official, who spoke on the condition of anonymity because their current employer forbids them from speaking to the press, expressed serious concern about many of the summonses. “It seems reasonable that ICE should be able to inspect records from a company like Amazon for customs investigations,” they say. “But what possible use or authority would ICE have for subpoenaing records from an abortion clinic?”

“It's like all power,” the official adds. “If it's not controlled, it gets abused.”

Casting a Wide Net

The 1509 customs summons is an administrative subpoena explicitly and exclusively meant for use in investigations of illegal imports or unpaid customs duties under a law known as Title 19 US Code 1509. Its goal is to provide agencies like ICE with a way to obtain business records from companies without having to go to a judge for a warrant. 

The subpoena-tracking database that WIRED obtained offers the most detailed breakdown of how ICE has been using the customs summons to date. The data shows that between January 4, 2016, and August 22, 2022, ICE issued 172,679 summonses, averaging more than 70 per day. Half of these were sent to telecommunications companies like AT&T, T-Mobile, and Comcast. Big technology companies like Google, Meta, and Microsoft collectively received nearly 15,000 summonses. Of the thousands of summonses sent to social media companies, Meta and Snapchat make up the vast majority.

ICE Is Grabbing Data From Schools and Abortion Clinics

Mullvad Browser, a collaboration between the nonprofit and Mullvad VPN, offers an anti-tracking browser designed to be used with a VPN.

The easiest way to use the digital anonymity service Tor is through the Tor Browser. You download and use it like a regular browser, and it covers your digital footprints as you go, making it very difficult for anyone to track your online activity. On top of that, the Tor Browser is designed with countersurveillance measures that block trackers and stymie device fingerprinting methods. But you might not want to use the Tor Browser all the time, because it has relatively slow page load times and can be a bit cumbersome. But launching today, a new browser developed by the Tor Project's user experience and applications teams offers the same privacy focus built with different infrastructure to incorporate VPN support instead of Tor.

Known as the Mullvad Browser, the tool comes out of a collaboration between the Tor Project and the VPN maker Mullvad. The free, open source browser is available now for download. The VPN space is crowded and has some problematic players, but Mullvad has consistently been a well-regarded and trusted VPN because it's open source, doesn't monetize user data, and provides independent third-party audits of its systems and infrastructure. Nonetheless, the Mullvad Browser can be used with any VPN you trust or can be used without a VPN as simply a privacy-focused browser.

“We’re not here to compete and to win browser market share; we are here because our mission is to advance human rights with technology,” says Isabela Bagueros, executive director of the Tor Project. “So we want to provide alternatives for people who need privacy and censorship bypassing."

Photograph: Tor Project

Both the Tor Network and virtual private networks encrypt your web traffic and tunnel it through an intermediary, but Tor is focused on the anonymity that comes from a specific scheme of sending your traffic through a series of “hops” or special servers. VPNs, in contrast, don't take such great pains to anonymize your traffic and instead focus on offering privacy protections by creating a system in which only you and the VPN provider can see your web activity. As a result, VPNs have a complicated reputation, because they are only as private as the VPN provider is trustworthy. Depending on your use case and circumstances, though, they can be a valuable tool.

“Mullvad’s mission is to make mass surveillance impractical, and a VPN alone is not enough for achieving online privacy—you also need a privacy-focused web browser,” says Mullvad CEO Jan Jonsson. “We wanted to offer a privacy-focused browser as good as the Tor Browser but for those who want to connect to the internet through a VPN instead of the Tor Network. The collaboration is all about providing more privacy alternatives for people.”

The Tor Project and Mullvad both said of each other that they were attracted to the collaboration by the other's record on human rights and digital privacy initiatives. And Mullvad has been a longtime financial supporter of the Tor Project, which is a nonprofit.  

There are other well-regarded privacy browsers, like Brave, and they can also be used with a VPN or even have built-in VPN capabilities. But the Tor Project says that their years of experience pioneering antitracking techniques like cookie isolation and other anti-surveillance technologies means that Mullvad Browser is launching at a very high quality. Tor Project's Bagueros adds that, while developing Mullvad Browser, the team made some discoveries and improvements that have now been incorporated back into the Tor Browser.

“Maybe this new browser will reach an audience that we’re not reaching right now,” Bagueros says. “Multiple alternatives can coexist and support each other. We're into building alternatives in collaboration, in solidarity with other organizations, because this is a big fight. We’re going against big players, so we need to work together.”

Mullvad VPN and Tor Project Create New Privacy-Focused Mullvad Browser

Plus: A major new supply chain attack, Biden’s spyware executive order, and a hacking campaign against Exxon’s critics.

Did you hear that Donald Trump got indicted this week? Of course you did. Ridiculous question. The first-ever indictment of a former US president had been looming for weeks. And now that it's happened, the move by a Manhattan grand jury is deepening fissures in America's already-fraught political divide. But while Trump headlines flood your feeds, there were plenty of other big stories this week, none of which have anything to do with any of _that_. 

In Germany, police are cracking down on people who post adult content to websites and platforms that lack age-verification checks, like Twitter. This has resulted in fines and threats of jail time, while some performers are deleting their accounts—or fleeing the country. This is just one of the impacts of a wave of age-verification laws sweeping the global internet.

Meanwhile, in darker corners of the internet, North Korea–backed hackers are using a rare technique to launder their stolen cryptocurrencies: paying to mine clean crypto with loot taken from their victims. The tactic is meant to throw blockchain detectives off the trail of swiped funds. Speaking of ill-gotten gains, Costa Rica is still reeling from a series of ransomware attacks last spring that left swaths of the country's infrastructure devastated. As a result, the US government is sending $25 million in aid to help it recover. 

Most victims of cyberattacks don't get help from the US government, however. Fortunately for them, this week Microsoft announced its new system, Security Copilot, which integrates OpenAI's ChatGPT and home-grown artificial intelligence to help incident responders managed breaches. Of course, the best way to protect yourself from getting hacked is to make sure all your systems are fully patched and up to date.

To top it all off, this week we revealed new documents obtained through a public records request which show that Good Smile, a major toy company that creates figurines for companies like Disney, invested $2.4 million in the toxic imageboard 4chan, helping to keep the company online.

But that's not all. Each week, we dive into the stories we weren't able to report on ourselves. Click on the headlines to read the full stories. And stay safe out there.

The Russian government and military remain the most aggressive in the world when it comes to disruptive acts of cyber-sabotage against civilian infrastructure. But documents leaked by a whistleblower inside a Russian intelligence contractor seem to reveal some new and alarming pages of the Kremlin’s hybrid war playbook.

A consortium of investigative journalists at 11 news outlets including Paper Trail Media, _The Guardian_, and _The Washington Post_ obtained a leak of secret documents from a Russian cybersecurity contractor firm called Vulkan, the Russian word for _volcano_. The documents, which were also analyzed by cybersecurity firm Mandiant, reveal that Vulkan sold software tools to Russian intelligence agencies like the KGB-successor FSB and the GRU military intelligence agency, including its notorious cyberattack-focused team known as Sandworm. 

The tools include one piece of software for scanning the internet for security vulnerabilities and another that seemed designed to organize disinformation campaigns and coordinate offensive hacking operations. Perhaps most disturbing of all was a proposal for a third tool that appeared to be designed to allow hackers to train in simulated networks of infrastructure systems like railways and pipelines, with specific references to methods to sabotage those systems with catastrophic effects. But it’s not clear whether that last tool was ever built, and if so, whether it was used primarily for offensive hacking or “red team” defensive training, or whether it led to the development of any actual hacking capabilities targeting critical infrastructure.

Security experts say North Korea–linked hackers have successfully carried out a supply chain attack through compromised versions of 3CX, a video and voice communications platform used by high-profile companies including American Express and Mercedes-Benz. 3CX says it has more than 600,000 customers. The hackers were able to install malware within the Mac and Windows versions of 3CX, which were signed with the company's keys, thus allowing the Trojanized apps to go undetected. The attack is being compared to Russian hackers' SolarWinds supply chain attack, which wrought havoc around the world for months. 

As hacker-for-hire firms' tools proliferate to governments around the world, the Biden administration has made clear: The US will not be one of that industry's customers. A new executive order bans US agencies from buying access to that commercial spyware, a key step in a growing effort to curb companies like NSO Group, Cytrox, and Candiru, which have enabled surveillance and human rights abuses from Spain to Mexico to Saudi Arabia. US agencies haven't been confirmed to be past customers of any of those companies, though the FBI did at one point test NSO's Phantom spyware before ultimately walking away from a deal with the company. But the order nonetheless sets a precedent for governments worldwide, assuring that US taxpayer funds won't flow to a dangerous industry whose tools have offered intrusive hacking techniques to repressive regimes targeting activists, journalists, and human rights defenders.

While we're on the subject of dangerous hacker-for-hire firms targeting vulnerable activists: The _Wall Street Journal_ reported this week that Indian hacker-for-hire firm BellTroX targeted climate change activists campaigning against Exxon, including Greenpeace, Public Citizen, 350.org, and the Rockefeller Family Fund. The firm was hired by Israeli private detective Aviram Azari, who has since pleaded guilty to hacking conspiracy charges. Exactly who hired Azari remains unclear, and Exxon denies having any connection to Azari or the hacking campaign. The hackers successfully accessed email accounts for Greenpeace, Public Citizen, and 350.org, but it's not yet clear whether they successfully penetrated the Rockefeller Family Fund, an organization created by Rockefeller heirs that has worked to combat the oil industry's efforts to lobby against climate change solutions.

‘Vulkan’ Leak Offers a Peek at Russia’s Cyberwar Playbook

Plus: Microsoft Outlook and Android patch serious flaws, Chrome and Firefox get fixes, and much more.

Meanwhile, researchers at Google’s Project Zero have reported 18 zero-day vulnerabilities in Exynos Modems made by Samsung. The four most severe—CVE-2023-24033, CVE-2023-26496, CVE-2023-26497, and CVE-2023-26498—allow internet-to-baseband remote code execution, the researchers wrote in a blog. “Tests conducted by Project Zero confirm that the four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number,” they wrote. 

Affected devices include those in the S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12, and A04 series, as well as Google’s Pixel 6 and Pixel 7 series.

Patch timelines will vary per manufacturer, but affected Pixel devices have received a fix for all four of the severe internet-to-baseband remote code execution vulnerabilities. In the meantime, users with affected devices can protect themselves by turning off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings, Google said.

Google Chrome 

Google has released Chrome 111 of its popular browser, fixing eight security flaws, seven of which are memory safety bugs with a high severity rating. Four use-after-free vulnerabilities include a high-severity issue tracked as CVE-2023-1528 in Passwords and CVE-2023-1529, an out-of-bounds memory access flaw in WebHID.

Meanwhile, CVE-2023-1530 is a use-after-free bug in PDF reported by the UK’s National Cyber Security Centre, and CVE-2023-1531 is a high-severity use-after-free vulnerability in ANGLE.

None of the issues are known by Google to have been used in attacks, but given their impact, it makes sense to update Chrome when you can.

Cisco

Enterprise software giant Cisco has published the twice-yearly security bundle for its IOS and IOS XE Software, fixing 10 vulnerabilities. Six of the issues fixed by Cisco are rated as having a high impact, including CVE-2023-20080, a denial of service flaw, and CVE-2023-20065, a privilege escalation bug.

At the start of the month, Cisco fixed multiple vulnerabilities in the web-based management interface of some Cisco IP Phones that could allow an unauthenticated, remote attacker to execute arbitrary code or cause denial of service. With a CVSS score of 9.8, the worst is CVE-2023-20078, a vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 series multiplatform phones. 

An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface, Cisco said, adding, “A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device.”

Firefox

Privacy-conscious developer Mozilla has released Firefox 111, fixing 13 vulnerabilities, seven of which are rated as having a high impact. These include three flaws in Firefox for Android, including CVE-2023-25749, which may have resulted in third-party apps opening without a prompt.

Meanwhile, two memory safety bugs, CVE-2023-28176 and CVE-2023-28177, have been fixed in Firefox 111. “Some of these bugs showed evidence of memory corruption, and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

SAP

It’s another month of big updates for software maker SAP, which has released 19 new security notes in its March Security Patch Day guidance. Issues fixed during the month include four with a CVSS score of over 9. 

One of the worst of these is CVE-2023-25616, a code injection vulnerability in SAP Business Objects Business Intelligence Platform. This vulnerability in the Central Management Console allows an attacker to inject arbitrary code with a “strong negative impact” on the integrity, confidentiality, and availability of the system, security firm Onapsis said.

Finally, with a CVSS score of 9.9, CVE-2023-23857 is an improper access control bug in SAP NetWeaver AS for Java. “The vulnerability allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services,” Onapsis said.

Apple's iOS 16.4: Security Updates Are Better Than a Goose Emoji

A Manhattan grand jury has issued the first-ever indictment of a former US president. Buckle up for whatever happens next.

The literally unprecedented indictment against Donald Trump marks an outright dangerous—and politically fraught—moment for the United States and serves as a reminder of the unparalleled level of criminality and conspiracy that surrounded the 2016 election.

It’s easy to look back at the 2016 election as though its outcome was inevitable—that Hillary Clinton was too weak of a candidate, one whose years of high-priced speeches had made her lose touch with the working-class voters of Wisconsin and Pennsylvania; that “but her emails” and Jim Comey’s repeated, inappropriate, and misguided meddling in the election turned the tide. But the new indictment of Trump is an important historical corrective, a moment that makes clear how the US, as a country, must reckon with the fact that Trump’s surprise victory was aided by not one but _two_ separate criminal conspiracies.

In the 2016 race’s final push, in an election that came down to incredibly narrow victories in just three states—10,704 voters in Michigan, 46,765 in Pennsylvania, and 22,177 in Wisconsin—and where Trump lost the overall popular vote by some 3 million votes, he was helped along by a massive and wide-ranging official Russian government operation. That effort was funded in part by oligarch Yevgeny Prigozhin, who is now behind the brutal combat of his Wagner Group mercenary army in Ukraine, which targeted US social media companies and activists on the ground. According to the US Department of Justice’s exhaustive report, in the second arm of the Russian operation, the military intelligence service GRU hacked top Democratic officials, leaked their emails, and shifted the national narrative around Clinton and other Democrats. (Not to mention that this gave rise to the Pizzagate conspiracy theory and, arguably, QAnon.) 

Then there was the separate criminal conspiracy that was the subject of today’s new indictment in New York: the plot in the final weeks of the 2016 election by Trump’s campaign, Trump family fixer Michael Cohen, and the _National Enquirer_ to pay hush money to bury stories of two of the candidate’s affairs, including infamously one with porn star Stormy Daniels. 

While it may seem like news of such an affair would have ended up being a nothingburger amid the campaign’s final weeks, it’s worth remembering the specific context that Cohen and the Trump orbit faced in those finals hours of the campaign. They were performing a fraught and knife’s-edge balancing act to hold onto support from conservatives and evangelicals in the wake of the devastating _Access Hollywood_ tape, a moment where vice presidential nominee Mike Pence seriously considered throwing in the towel himself. The follow-on of more non-family-values-friendly stories might well have begun an unrecoverable spiral. (It’s also worth remembering the still-suspicious interplay of these two threads: how, on a single Friday in October 2016, US intelligence leaders announced publicly for the first time that Russia was behind the election meddling, the _Washington Post_ scooped the existence of the lewd _Access Hollywood_ tape. And then, hours later, Wikileaks began dumping a fresh set of stolen emails from Clinton campaign chair John Podesta.)

The new criminal case related to that second Stormy Daniels conspiracy, brought by Manhattan district attorney Alvin Bragg, also is a reminder of the historic mistake by the US Justice Department to not pursue its own charges against Trump in the same matter. This was a mind-boggling abdication of responsibility given that the Justice Department—in the midst of Donald Trump’s own presidency, no less!—prosecuted Cohen for the same conspiracy, naming Trump in the charges against Cohen as “Individual 1” and, according to a new book by Elie Honig, outlined in a draft indictment Trump’s personal direction and involvement in the case.

According to the book by Honig, himself a former prosecutor, the Southern District of New York ultimately decided to drop any case against Trump after the president left office in January 2021 because, in part, they figured that bigger, more serious investigations were ahead stemming from the January 6 insurrection, which “made the campaign finance violations seem somehow trivial and outdated by comparison.” It was then, and stands now, a serious miscalculation, one that will currently contribute to the democratically untenable “Ford Principle” that presidents stand outside the law both while in office and after. 

Of course, it’s here that we come to what a fraught moment, politically and for American democracy, the historically novel indictment of a former president presents for us in the weeks and months ahead: The true test for Donald Trump and our country is not this particular case but whatever might come next. The New York charges might be the start of multiple criminal cases that would burden Trump even as he begins his phoenix-like presidential reelection bid.

There are signs that Georgia’s Fulton County district attorney is weighing “imminent” charges against Trump, potentially as part of a larger conspiracy, for his well-documented efforts to overturn the state’s election results in 2020. Meanwhile, Justice Department special counsel Jack Smith is zeroing in on potential charges surrounding Trump’s involvement in the January 6 insurrection and related election-meddling schemes, as well as Trump’s attempts to purloin and retain classified documents in Mar-a-Lago after his presidency. Just in recent days, in the classified documents case, a federal judge ruled that there was evidence of a crime that would allow Smith to pierce normal attorney-client privilege and force one of Trump’s lawyers to testify amid evidence that the lawyer participated in that potential crime.

The specter of these indictments has made Trump fire up his always-overheated rhetoric, threatening “death and destruction” if he’s indicted, posting a photo of Bragg and Trump holding a baseball bat, and generally sashaying around the country like a mafioso saying, “Nice country you have here, shame if something happened to it.” His opening campaign rally was in Waco, Texas, amid the 30th anniversary of a 51-day federal siege of a religious cult after the largest shoot-out in US law enforcement history. That standoff left four ATF agents dead and, following the horrific fiery end of the siege, more than 80 members of the Branch Davidian sect dead too. The event helped inspire the bombing of the Alfred P. Murrah Federal Building in Oklahoma City just two years later by a white supremacist, far-right extremist. 

It’s hard not to read Trump’s rally as anything less than a call to arms for his supporters amid the government’s moves against him.

For now, though, the country will wait—and wonder whether the next shoe to drop is more criminal charges or the beginnings of more Trump-inspired violence.

Source

Wired