The company says an expansion of privacy features in Messenger is unrelated to a high-profile Nebraska abortion case.

A Nebraska woman and her 17-year-old daughter are facing felony and misdemeanor charges related to allegedly performing an abortion after 20 weeks, which has long been illegal in the state, and concealing a body. Reports from _The Lincoln Journal Star_ and _Motherboard_ revealed this week that law enforcement collected evidence for the charges in part by soliciting data from Meta with a warrant that ordered the company to hand over records from the 17-year-old's Messenger chat histories. While Meta was complying with a lawful court order, the company would not have been able to produce the chats had the participants been using end-to-end encryption, a feature Meta has long promised to turn on for all users by default.

Meanwhile, in a move that Meta says is totally unrelated, the social media giant announced this morning that it is testing expansions of end-to-end encrypted messaging on Messenger.

The company has been promising full-scale default deployment of the privacy feature since 2016. CEO Mark Zuckerberg even committed in 2019 to implement end-to-end encryption across all of its chat apps. But the company has faced technical and political challenges that have delayed the full rollout year after year, forcing Meta to fall back on gradual, incremental steps instead. The social giant currently says that it is driving toward a “global rollout of default end-to-end encryption for personal messages and calls in 2023."

For now, though, the company continued the slow march today, saying that it is testing a group of new encryption-related features and initiatives. This week, Meta will expand the number of chats between certain people that automatically have end-to-end encryption turned on. This means those users won't have to opt-in to enable the protection. Similarly, the company says that it will “soon” broaden the number of users who can opt into end-to-end encryption on Instagram Direct Messenger. 

Beginning this week, Meta is also testing a “secure storage” feature for end-to-end encrypted chats, so users can back up their messages in case they lose a device or get a new one and want to restore their chat history. The company says this secure backup feature will be the default for end-to-end encrypted chats on Messenger with the option to lock the backups with a PIN or a generated code. Users will also be able to opt-out of the backups and turn the feature off.

When asked directly whether the timing of the announcement was related to revelations about the Nebraska case, Meta spokesperson Alex Dziedzan told WIRED, “This is not a response to any law enforcement requests.” He added, “We've had this date in the diary for months, but the short notice is because Messenger product teams have been finalizing the tests that are going live. These tests will start \[Thursday\]. We want people to hear about these tests from us before they see changes in the app.”

Dziedzan also cited a talk Meta engineers are giving at the Crypto academic cryptography conference in Santa Barbara this weekend as a reason for the timing.  

Meta said in a statement on Tuesday that it received warrants related to the Nebraska case on June 7, before the United States Supreme Court released its decision in the _Dobbs v. Jackson_ reproductive rights case. The company added that the warrants it received did not mention abortion and that they came with non-disclosure orders that have since been lifted.

For privacy advocates, though, the Nebraska case clearly illustrates the value and the stakes of deploying default end-to-end encryption.

“Having end-to-end encrypted communications by default has never been more important,” says Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory. “Making it work for billions of people across multiple services is a daunting challenge, and Meta has to proceed carefully to make sure they get it right. But from the war in Ukraine to a teenage girl in Nebraska who needed abortion care, we’ve seen how strong encryption—or the lack thereof—can make a huge difference in the lives of real people.”

Meta Just Happens to Expand Messenger's End-to-End Encryption

The Raspberry Pi-powered device can scan for phones around you. If it keeps spotting the same one, it’ll send you an alert.

Matt Edmondson, a federal agent with the Department of Homeland Security for the last 21 years, got a call for help last year. A friend working in another part of government—he won’t say which one—was worried that someone might have been tailing them when they were meeting a confidential informant who had links to a terrorist organization. If they were being followed, their source’s cover may have been blown. “It was literally a matter of life and death,” Edmondson says.

“If you’re trying to tell whether you’re being followed, there are surveillance detection routes,” Edmondson says. If you’re driving, you can change lanes on a freeway, perform a U-turn, or change your route. Each can help determine whether a car is following you. But it didn’t feel like enough, Edmondson says. “He had those skills, but he was just looking for an electronic supplement,” Edmondson explains. “He was worried about the safety of the confidential informant.”

After not finding any existing tools that could help, Edmondson, a hacker and digital forensics expert, decided to build his own anti-tracking tool. The Raspberry Pi-powered system, which can be carried around or sit in a car, scans for nearby devices and alerts you if the same phone is detected multiple times within the past 20 minutes. In theory it can alert you if a car is tailing you. Edmondson built the system using parts that cost around $200 in total, and will present the research project at the Black Hat security conference in Las Vegas this week. He’s also open-sourced its underlying code.

The anti-tracking tool is made up of a Raspberry Pi, wireless signal detectors, and a battery pack.

Photograph: Matt Edmondson

In recent years there’s been an explosion in the number of ways people can be tracked by domestic abusers, stalkers, or those in the murky world of government-backed espionage. Tracking can either be software- or hardware-based. Stalkerware and spyware that can be installed directly on people’s phones can give attackers access to all your location data, messages, photos, videos, and more, while physical trackers—such as Apple’s AirTags—have been used to track where people are in real time. (In response to criticism, Apple has added some anti-tracking tools to AirTags.)

A quick search online reveals plenty of tracking tools, which are easy to buy. “There’s so much out there to spy on people, and so little to help people who are wondering whether they're being spied on,” Edmondson says.

The homemade system works by scanning for wireless devices around it and then checking its logs to see whether they also were present within the past 20 minutes. It was designed to be used while people are on the move rather than sitting in, say, a coffee shop, where it would pick up too many false readings.

The anti-tracking tool, which can sit inside a shoebox-sized case, is made up of a few components. A Raspberry Pi 3 runs its software, a Wi-Fi card looks for nearby devices, a small waterproof case protects it, and a portable charger powers the system. A touchscreen shows the alerts the device produces. Each alert may be a sign that you are being tailed.

The device runs Kismet, which is a wireless network detector, and is able to detect smartphones and tablets around it that are looking for Wi-Fi or Bluetooth connections. The phones we use are constantly looking for wireless networks around them, including networks they’ve connected to before as well as new networks.

Edmondson says Kismet makes a record of the first time it sees a device and then the most recent time it was detected. But to make the anti-tracking system work, he had to write code in Python to create lists of what Kismet detects over time. There are lists for devices spotted in the past five to 10 minutes, 10 to 15 minutes, and 15 to 20 minutes. If a device appears twice, an alert flashes up on the screen. The system can show a phone’s MAC address, although this is not much use if it’s been randomized. It can also record the names of Wi-Fi networks that devices around it are looking for—a phone that’s trying to connect to a Wi-Fi network called Langley may give some clues about its owner. “If you have a device on you, I should see it,” he says. In an example, he showed WIRED that a device was looking for a network called SAMSUNGSMART.

To stop the system from detecting your own phone or those of other people traveling with you, it has an “ignore” list. By tapping one of the device’s onscreen buttons, it’s possible to “ignore everything that it has already seen.” Edmondson says that in the future, the device could be modified to send a text alert instead of showing them on the screen. He is also interested in adding the capability to detect tire-pressure monitoring systems that could show recurring nearby vehicles. A GPS unit could also be added so you can see where you were when you were being tracked, he says.

“It’s purely designed to try to tell you that you’re seeing something now that you were also seeing a few minutes ago,” Edmondson says. “This isn’t designed to follow people in any way, shape, or form.” The hacker says he lives near the desert, so he tested the system in his car while driving around places where nobody else was, carrying multiple phones with him that could be detected by the tool. Edmondson says he believes the tool can be effective, since even spies working for a government still carry devices.“You still have your phone in your pocket,” he says. “You still have your phone on the seat sitting next to you, or in the center console.”

Edmondson has no plans to make the device into a commercial product, but he says the design could easily be copied and reused by anyone with some technical knowledge. Many of the parts involved are easy to obtain or may be lying around the homes of people in tech communities.

Ultimately, he says, the tech community needs to take tech-enabled tracking and surveillance more seriously. “It was really kind of disheartening and depressing to look at the ratio of tools to spy on people versus tools to help you not get spied on,” he says, adding that a person close to him has been the victim of a stalker in the past. In the case of his clandestine friend in another government department, the anti-tracking device was useful. “It was really designed to help someone who came to me asking for help,” he says. Fortunately for Edmondson’s friend (and his source), they used it in the real world, and the device didn’t find anyone following them.

This Anti-Tracking Tool Checks If You’re Being Followed

Before the flagship phone ever landed in users’ hands, the security team thoroughly hacked it by finding bugs and developing exploits.

When Google launched the Pixel 6 and 6 Pro in October 2021, key features included its custom Tensor system-on-a-chip processor and the security benefits of its onboard Titan M2 security chip. But with so much new equipment launching at once, the company needed to be extra careful that nothing was overlooked or went wrong. At the Black Hat security conference in Las Vegas today, members of the Android red team are recounting their mission to hack and break as much as they could in the Pixel 6 firmware before launch—a task they accomplished. 

The Android red team, which primarily vets Pixel products, caught a number of important flaws while attempting to attack the Pixel 6. One was a vulnerability in the boot loader, the first piece of code that runs when a device boots up. Attackers could have exploited the flaw to gain deep device control. It was particularly significant because the exploit could persist even after the device was rebooted, a coveted attack capability. Separately, the red teamers also developed an exploit chain using a group of four vulnerabilities to defeat the Titan M2, a crucial finding, given that the security chip needs to be trustworthy to act as a sort of sentry and validator within the phone.

“This is the first proof of concept ever to be publicly talked about getting end-to-end code execution on the M2 Titan chip,” Farzan Karimi, one of the red team leads, told WIRED ahead of the talk. “Four vulnerabilities were chained to create this, and not all of them were critical on their own. It was a mixture of highs and moderate severity that when you chain them together creates this impact. The Pixel developers wanted a red team to focus these types of efforts on them, and they were able to patch the exploits in this chain prior to release.”

The researchers say that the Android red team prioritizes not just finding vulnerabilities but spending time developing real exploits for the bugs. This creates a better understanding of how exploitable, and therefore critical, different flaws really are and sheds light on the range of possible attack paths so the Pixel team can develop comprehensive and resilient fixes.

Like other top red teams, the Android group uses an array of approaches to hunt for bugs. Tactics include manual code review and static analysis, automated methods for mapping how a codebase functions, and looking for potential problems in how the system is set up and how different components interact. The team also invests significantly in developing tailored “fuzzers” that it can then hand off to teams across Android to catch more bugs while development is first going on.

“A fuzzer is basically a tool that throws malformed data and junk at a service to get it to crash or reveal some security vulnerability,” Karimi says. “So we build these fuzzers and hand them off so other teams can continuously run them throughout the year. It’s a really nice thing that our red team has accomplished outside of finding bugs. We’re really institutionalizing fuzzing.”

The idea across Android, in general, is to bake security assessments and improvements into the development process as early as possible to avoid costly mistakes later. In the Black Hat talk, the researchers will also be highlighting some of the types of bugs they are most focused on looking for to try to stay ahead of trends in attacker exploitation.

For example, the researchers have been hunting for vulnerabilities in the cellular communication tech that’s baked into Pixels and every smartphone. “We’re actively invested in that area, and what I can say is that it’s 100 percent worth the effort,” Karimi says. And he adds that the biggest type of vulnerability the group has its eye on right now is “race condition” bugs, in which attackers take advantage of the sequence or timing of an uncontrollable event and inject themselves into a software interaction at the opportune time to gain unintended system access.

“Imagine you’re setting up a profile on a … smartwatch,” Karimi says. “Maybe the system tries to run commands and the attacker injects their own commands during that process to submit or execute malicious code that they control. We’re thinking about unique ways to tackle this.”

In part, the red team’s job is to set priorities and bet on the right security horses to protect Pixel users around the world.

“Pixel 6 was a complete transformation of prior generation phones, and it was our job to red team it and secure it,” Karimi says. “We were looking at all this attack surface and testing what we felt is at most risk within about a year and half of time. There are 100 things you have to look at, and they’re all high priority. So you have to be selective about what’s the lowest level of effort for an attacker to abuse and start with that.”

Google's Android Red Team Had a Full Pixel 6 Pwn Before Launch

Ten years after it was first unveiled, the powerful firmware analysis platform Ofrak is now available to anyone.

At the 2012 DefCon security conference in Las Vegas, Ang Cui, an embedded device security researcher, previewed a tool for analyzing firmware, the foundational software that underpins any computer and coordinates between hardware and software. The tool was specifically designed to elucidate internet-of-things (IoT) device firmware and the compiled “binaries” running on anything from a home printer to an industrial door controller. Dubbed FRAK, the Firmware Reverse Analysis Console aimed to reduce overhead so security researchers could make progress assessing the vast and ever-growing population of buggy and vulnerable embedded devices rather than getting bogged down in tedious reverse engineering prep work. Cui promised that the tool would soon be open source and available for anyone to use.

“This is really useful if you want to understand how a mysterious embedded device works, whether there are vulnerabilities inside, and how you can protect these embedded devices against exploitation,” Cui explained in 2012. “FRAK will be open source very soon, so we’re working hard to get that out there. I want to do one more pass, internal code review before you guys see my dirty laundry.”

He was nothing if not thorough. A decade later, Cui and his company, Red Balloon Security, are launching Ofrak, or OpenFRAK, at DefCon in Las Vegas this week.

“In 2012 I thought, here’s a framework that would help researchers move embedded security forward. And I went on stage and said, I think the community should have it. And I got a number of emails from a number of lawyers,” Cui told WIRED ahead of the release. “Embedded security is a space that we absolutely need to have more good eyes and brains on. We needed it 10 years ago, and we finally found a way to give this capability out. So here it is.”

Though it hadn’t yet fulfilled its destiny as a publicly available tool, FRAK hasn’t been languishing all these years either. Red Balloon Security continued refining and expanding the platform for internal use in its work with both IoT device makers and customers who need a high level of security from the embedded devices they buy and deploy. Jacob Strieb, a software engineer at Red Balloon, says the company always used FRAK in its workflow, but that Ofrak is an overhauled and streamlined version that Red Balloon itself has switched to.

Cui’s 2012 demo of FRAK raised some hackles because the concept included tailored firmware unpackers for specific vendors’ products. Today, Ofrak is simply a general tool that doesn’t wade into potential trade secrets or intellectual property concerns. Like other reverse engineering platforms, including the NSA’s open source Ghidra tool, the stalwart disassembler IDA, or the firmware analysis tool Binwalk, Ofrak is a neutral investigative framework. And Red Balloon’s new offering is designed to integrate with these other platforms for easier collaboration among multiple people.

“What makes it unique is it’s designed to provide a common interface for other tools, so the benefit is that you can use all different tools depending on what you have at your disposal or what works best for a certain project,” Strieb says.

The platform is also unusual for offering advanced, automated repacking mechanisms for firmware binaries. Most reverse engineering tools aid in unpacking but lack extensive repacking capabilities, because even small modifications you make to firmware can incidentally break functionality or change how the program behaves. Repacking was always a core part of how Cui conceived FRAK, though, and Red Balloon has continued to improve it over the years for the company’s own work.

When Cui gave his original FRAK presentation, the project already had support from a now-concluded Defense Advanced Research Projects Agency program. Known as Cyber Fast Track, the DARPA initiative was run by security researcher Peiter Zatko, better known as Mudge.

“The proposal was compelling enough for me to fund it in April 2012, and I worked extremely hard to ensure I was a good steward of such funding,” Mudge says. “This is a valuable tool that significantly facilitated security researchers’ work in the field of applied embedded security. I am very happy to see more of this project being made available to such a wide audience through open source.”

After the end of Cyber Fast Track in 2013, Ofrak continued to receive partial support from DARPA’s Assured Micropatching program.

“Oftentimes, it’s cost prohibitive for organizations to hire reverse engineers with specialized skills to patch embedded devices,” says Sergey Bratus, a DARPA program manager. “A key goal of the AMP program is to make this capability readily available through automation. Automating the application of a fix turns out to be a hard computer science problem with fundamental research challenges. These challenges must be supported with new classes of modular, community-building, research-enabling tools such as Ofrak.”

In other words, Ofrak is not only useful for independent researchers who want to penetrate the black box of embedded devices. It can also help manufacturers assess their own products and play a role in patch development and distribution, a longtime challenge and frequent debacle in IoT.

Red Balloon’s Strieb says the company hopes Ofrak will be widely adopted and that people will develop add-on modules for community use. Red Balloon plans to maintain the tool long-term, and says it is fully committed to keeping licenses for personal use and research free in perpetuity. 

For Cui, it all fits into his original FRAK vision from 10 years ago.

“If more people looked inside the things and realized they could change the things, we would have more secure embedded devices,” he says. “So please take Ofrak, realize you have the power to reason about and change the code running on these devices, and then there’s a whole world of things you can create that are better than what we have now.”

A Long-Awaited IoT Reverse Engineering Tool Is Finally Here

It cost a researcher only $25 worth of parts to create a tool that allows custom code to run on the satellite dishes.

Since 2018, Elon Musk’s Starlink has launched more than 3,000 small satellites into orbit. This satellite network beams internet connections to hard-to-reach locations on Earth and has been a vital source of connectivity during Russia’s war in Ukraine. Thousands more satellites are planned for launch as the industry booms. Now, like any emerging technology, those satellite components are being hacked.

Today, Lennert Wouters, a security researcher at the Belgian university KU Leuven, will reveal one of the first security breakdowns of Starlink’s user terminals, the satellite dishes (dubbed Dishy McFlatface) that are positioned on people’s homes and buildings. At the Black Hat security conference in Las Vegas, Wouters will detail how a series of hardware vulnerabilities allow attackers to access the Starlink system and run custom code on the devices.

To access the satellite dish’s software, Wouters physically stripped down a dish he purchased and created a custom hacking tool that can be attached to the Starlink dish. The hacking tool, a custom circuit board known as a modchip, uses off-the-shelf parts that cost around $25. Once attached to the Starlink dish, the homemade printed circuit board (PCB) is able to launch a fault injection attack—temporarily shorting the system—to help bypass Starlink’s security protections. This “glitch” allows Wouters to get into previously locked parts of the Starlink system.

Wouters is now making his hacking tool open source on GitHub, including some of the details needed to launch the attack. “As an attacker, let’s say you wanted to attack the satellite itself,” Wouters explains, “You could try to build your own system that allows you to talk to the satellite, but that’s quite difficult. So if you want to attack the satellites, you would like to go through the user terminal as that likely makes your life easier.”

The researcher notified Starlink of the flaws last year and the company paid Wouters through its bug bounty scheme for identifying the vulnerabilities. Wouters says that while SpaceX has issued an update to make the attack harder (he changed the modchip in response), the underlying issue can’t be fixed unless the company creates a new version of the main chip. All existing user terminals are vulnerable, Wouters says.

Starlink says it plans to release a “public update” following Wouters’ presentation at Black Hat this afternoon, but declined to share any details about that update with WIRED prior to publication.

Starlink’s internet system is made up of three major parts. First, there are the satellites that move in low Earth orbit, around 340 miles above the surface, and beam down connections to the surface. The satellites communicate with two systems on Earth: gateways that send internet connections up to the satellites, and the Dishy McFlatface dishes people can buy. Wouters’ research focuses on these user terminals, which originally were round, but newer models are rectangular.

There have been multiple teardowns of Starlink’s user terminals since the company started selling them. Engineers on YouTube have opened up their terminals, exposing their components and how they work. Others discuss the technical specs on Reddit. However, Wouters, who previously created hardware that can unlock a Tesla in 90 seconds, looked at the security of the terminal and its chips. “The user terminal was definitely designed by capable people,” Wouters says.

His attacks against the user terminal involved multiple stages and technical measures before he finally created the now open source circuit board that can be used to glitch the dish. Broadly, the attack using the custom circuit board works by bypassing signature verification security checks, which look to prove that the system is launching correctly and hasn’t been tampered with. “We’re using this to accurately time when to inject the glitch,” Wouters says.

Starting in May 2021, Wouters began testing the Starlink system, getting 268-Mbps download speeds and 49-Mbps upload speeds on his university building’s roof. Then it was time to open the device up. Using a combination of a “heat gun, prying tools, isopropyl alcohol, and a lot of patience,” he was able to remove the large metal cover from the dish and access its internal components.

Photograph: Lennert Wouters

Under the 59-cm diameter hood is a large PCB that houses a system-on-chip, including a custom quad-core ARM Cortex-A53 processor, the architecture of which isn’t publicly documented, making it harder to hack. Among other items on the board are radio frequency equipment, power over ethernet systems, and a GPS receiver. Opening up the dish allowed Wouters to understand how it boots up and download its firmware.

To design the modchip, Wouters scanned the Starlink dish and created the design to fit over the existing Starlink board. The modchip requires soldering to the existing Starlink PCB and connecting it using a few wires. The modchip itself is made up of a Raspberry Pi microcontroller, flash storage, electronic switches, and a voltage regulator. When creating the user terminal’s board, Starlink engineers printed “Made on Earth by humans” across it. Wouters’ modchip reads: “Glitched on Earth by humans.”

To get access to the dish’s software, Wouters used his custom system to bypass security protections by using the voltage fault injection attack. When the Starlink dish is turning on, it uses a series of different bootloader stages. Wouters’ attack runs the glitch against the first bootloader, known as the ROM bootloader, which is burned onto the system-on-chip and can’t be updated. The attack then deploys patched firmware on later bootloaders, which allows him to take control of the dish.

“From a high-level view, there are two obvious things that you could try to attack: the signature verification or the hash verification,” Wouters says. The glitch works against the signature verification process. “Normally you want to avoid shorts,” he says. “In this case we do it on purpose.”

Initially, Wouters attempted to glitch the chip at the end of its boot cycle—when the Linux operating system has fully loaded—but ultimately found it easier to cause the glitch at the start of the boot. This way was more reliable, Wouters says. To get the glitch to work, he says, he had to stop decoupling capacitors, which are used to smooth out the power supply, from operating. Essentially, the attack disables the decoupling capacitors, runs the glitch to bypass the security protections, and then enables the decoupling capacitors.

This process allows the researcher to run a patched version of Starlink’s firmware during the boot cycle and ultimately allows access to its underlying systems. In response to the research, Wouters says, Starlink offered him researcher-level access to the device’s software, although he says he declined as he had gone too deep with the work and wanted to build the modchip. (During testing, he hung the modified dish out of this research lab’s window and used a plastic bag as a makeshift waterproofing system.)

Starlink also issued a firmware update, Wouters says, that makes the attack harder, but not impossible, to execute. Anyone wanting to break into the dish in this way would have to put a lot of time and effort into doing so. While the attack isn’t as devastating as being able to take down satellite systems or connectivity, Wouters says it can be used to learn more about how the Starlink network operates.

“What I am working on now is communicating with the backend servers,” Wouters explains. Despite making the details of the modchip available for download on Github, Wouters does not have any plans to sell finished modchips, nor is he providing people with patched user terminal firmware or the exact details of the glitch he used.

As an increasing amount of satellites are launched—Amazon, OneWeb, Boeing, Telesat, and SpaceX are creating their own constellations—their security will come under greater scrutiny. In addition to providing homes with internet connections, the systems can also help to get ships online, and play a role in critical infrastructure. Malicious hackers have already shown that satellite internet systems are a target. As Russian troops invaded Ukraine, alleged Russian military hackers targeted the Via-Sat satellite system, deploying wiper malware that bricked people’s routers and knocked them offline. Around 30,000 internet connections in Europe were disrupted, including more than 5,000 wind turbines.

“I think it’s important to assess how secure these systems are because they are critical infrastructure,” Wouters says. “I don’t think it's very far-fetched that certain people would try to do this type of attack because it is quite easy to get access to a dish like this.”

_Update 5 pm ET August 10, 2022:_ After Wouters’ conference talk, Starlink published a six-page PDF explaining how it secures its systems. “We find the attack to be technically impressive, and is the first attack of its kind that we are aware of in our system,” the paper says. “We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of ‘least privilege’ to constrain the effects in the broader system.”

Starlink reiterates that the attack needs physical access to a user terminal and emphasizes its secure boot system, which was compromised by the glitching process, is only impacted on that one device. Wider parts of the overall Starlink system are not impacted. “Normal Starlink users do not need to be worried about this attack affecting them, or take any action in response,” Starlink says.

The Hacking of Starlink Terminals Has Begun

New research found troubling vulnerabilities in the 5G platforms carriers offer to wrangle embedded device data.

True 5G wireless data, with its ultrafast speeds and enhanced security protections, has been slow to roll out around the world. As the mobile technology proliferates—combining expanded speed and bandwidth with low latency connections—one of its most touted features is starting to come into focus. But the upgrade comes with its own raft of potential security exposures.

A massive new population of 5G-capable devices, from smart city sensors to agriculture robots and beyond, are gaining the ability to connect to the internet in places where Wi-Fi isn't practical or available. Individuals may even elect to trade their fiber optic internet connection for a home 5G receiver. New research that will be presented on Wednesday at the Black Hat security conference in Las Vegas, though, warns that the interfaces carriers have set up to manage internet of things data are riddled with security vulnerabilities they fear will dog the industry long term.

After years of examining potential security and privacy issues in mobile data radio frequency standards, Technical University of Berlin researcher Altaf Shaik says he was curious to investigate the application programming interfaces (APIs) carriers are offering to make IoT data accessible to developers. These are the conduits applications can use to pull, say, real-time bus tracking data or information about stock in a warehouse. Such APIs are ubiquitous in web services, but Shaik points out that they haven't been widely used in core telecommunications offerings. Looking at the 5G IoT APIs of 10 mobile carriers around the world, Shaik and his colleague Shinjo Park found common, widely-known API vulnerabilities in all of them, and some could be exploited to gain authorized access to data or even direct access to IoT devices on the network.

“There's a big knowledge gap, this is the beginning of a new type of attack in telecom,” Shaik told WIRED ahead of his presentation. “There's a whole platform where you get access to the APIs, there’s documentation, everything, and it's called something like ‘IoT service platform.’ Every operator in every country is going to be selling them if they're not already, and there are virtual operators and subcontracts, too, so there will be a ton of companies offering this kind of platform.”

The designs of IoT service platforms aren’t specified in the 5G standard and are up to each carrier and company to create and deploy. That means there's widespread variation in their quality and implementation. In addition to 5G, upgraded 4G networks can also support some IoT expansion, widening the number of carriers that may offer IoT service platforms and the APIs that feed them.

The researchers bought IoT plans on the 10 carriers they analyzed and got special data-only SIM cards for their networks of IoT devices. This way they had the same access to the platforms as any other customer in the ecosystem. They found that basic flaws in how the APIs were set up, like weak authentication or missing access controls, could reveal SIM card identifiers, SIM card secret keys, the identity of who purchased which SIM card, and their billing information. And in some cases, the researchers could even access large streams of other users' data or even identify and access their IoT devices by sending or replaying commands that they shouldn’t have been able to control.

The researchers went through disclosure processes with the 10 carriers they tested and said that the majority of vulnerabilities they found so far are being fixed. Shaik notes that the quality of security protections on the IoT service platforms varied widely, with some appearing more mature while others were “still sticking to the same old, bad security policies and principles.” He adds that the group isn't publicly naming the carriers they looked at in this work because of concerns about how widespread the issues might be. Seven of the carriers are based in Europe, two are in the United States, and one is in Asia.

“We found vulnerabilities that could be exploited to access other devices even though they don’t belong to us, just by being on the platform,” Shaik says. “Or we could talk to other IoT devices and send messages, extract information. It’s a big issue.”

Shaik emphasizes that he and his colleagues didn’t hack any other customers or do anything improper once they discovered the different flaws. But he points out that none of the carriers detected the researchers’ probing, which in itself indicates a lack of monitoring and safeguards, he says.

The findings are just a first step, but they underscore the challenges of securing massive new ecosystems as the full breadth and scale of 5G starts to appear on the horizon.

One of 5G's Biggest Features Is a Security Minefield

The fact that a search of Donald Trump's Florida home was even necessary says a lot.

Very few people ever find themselves on the receiving end of an FBI search warrant—even fewer end up escaping criminal charges.

The fact that Donald Trump now ranks among the former provides the strongest indication yet that he may soon face the latter.

Monday’s search of the former president’s Mar-a-Lago property in Florida was surely one of the most significant, sensitive, and politically explosive actions the US Justice Department and FBI have ever taken. It’s one of a tiny handful of times the DOJ has ever investigated a president. And it’s an action that likely indicates the FBI and prosecutors had specific knowledge of both a definable crime and the evidence to back it up.

The actual search warrant, which would list specific crimes being investigated, has not been released yet. According to Monday night news reports, however, the search focused on questions about a number of boxes of classified documents that Trump took from the White House to his Florida mansion after leaving the presidency.

While it may take months to learn more about the underlying investigation, the fact that the FBI launched such a high-profile search already tells us a great deal about the state of the Justice Department’s case.

Here are the five big takeaways.

Probable Cause Was Clear

Federal search warrants aren’t designed to be fishing expeditions. The FBI’s legally authorized search of a former president’s primary residence would have been approved and monitored at the highest level of both the FBI and the Justice Department, likely including both the deputy attorney general and the attorney general. It’s hard to imagine how high the bar of probable cause must have been for the Bureau to initiate such a politically sensitive search. Ironically, the scandals the FBI has weathered from past Trump investigations likely made the bar for probable cause and sign-off by the department’s upper levels even higher.

One of the biggest scandals the FBI and Justice Department have endured in recent years was the sloppy (and ultimately illegal) paperwork surrounding a FISA warrant filed amid the 2016 presidential campaign that targeted Trump aide Carter Page. Two of the four warrants used in that case were later declared invalid, and an FBI lawyer pleaded guilty to falsifying part of the underlying evidence and probable cause paperwork. A nearly 500-page inspector general report eviscerated the Bureau’s handling of the FISA warrants, which were long thought to be one of the most thorough and careful of court filings and are supposed to be backstopped by careful evidence reviews known as the “Woods procedures.” As it turned out, the FBI had omitted key questions about the underlying evidence from the Page warrant application and offered misleading characterizations about other pieces of evidence.

That scandal led to internal FBI and Justice Department reforms that would have made the Mar-a-Lago search warrant subject to even closer scrutiny—and ensured that the bar for probable cause would have been so high, the evidence so crystal clear, that it’s likely the Justice Department already feels it has enough information to bring criminal charges.

A Judge Signed Off on the Search

A legally authorized search warrant is an important part of the US Constitution’s system of checks and balances. It requires the assent of two of the three branches of government, whereby the executive branch (the DOJ and the FBI) gets the sign-off from the judicial branch. In the case of the Trump property search, once agents and prosecutors assembled their evidence, an independent federal magistrate judge needed to agree that a crime was likely committed and that there was specific evidence at Mar-a-Lago that would have bearing on the crime.

Notably, this is at least the second time this year that a federal judge has agreed Trump was at least adjacent to a crime. As the January 6 congressional committee has repeatedly pointed out, a federal judge agreed with its assessment this spring that Trump “more likely than not” committed a crime amid his efforts to overturn the 2020 elections.

This Isn’t Just About Trump Taking Classified Docs

One of the most important questions in an investigation is about establishing motive, summed up by the Latin phrase _cui bono_, or _Who benefits?_ Sure, Trump taking home classified documents is technically a crime. But as national security reporter Zach Dorfman points out, it’s hardly a serious enough offense to spur the FBI to raid the home of a former president.

The entire security classification system exists to serve the presidency. The president is the one official in the US government with the ability to unilaterally declassify any piece of information. (Trump famously exercised this power while in office by tweeting a highly classified satellite photo of an Iranian facility). Plus, while classified documents theoretically include highly sensitive information that would damage national security if released, the reality is that many classified documents aren’t that sensitive.

Big Takeaways From the FBI's Mar-a-Lago Raid

Regulators are close to stopping Meta from sending EU data to the US, bringing a years-long privacy battle to a head.

Facebook faces trouble in Europe—and Meta wants you to know about it. Every three months since June 2018, the company has used its financial results to warn that it could be forced to stop running Facebook and Instagram across the continent—potentially pulling its apps from millions of people and thousands of businesses—if it can’t send data between the EU and the US.

Whether Meta’s bluffing will become clear soon enough.

Data regulators are on the verge of making a historic ruling in a years-long case, and they are expected to say Facebook’s data transfers across the Atlantic should be blocked. For years, Meta has fought against European privacy activists over how data is sent to the US, with courts ruling multiple times that European data isn’t properly protected and can potentially be snooped on by the NSA and other US intelligence agencies.

While the case focuses on Meta, it has widespread ramifications, potentially impacting thousands of businesses across Europe that rely upon the services of Google, Amazon, Microsoft, and more. At the same time, US and European negotiators are scrambling to finalize a long-awaited new data-sharing deal that will limit what information US intelligence agencies can get their hands on. If negotiators can’t get it right, people’s privacy will remain at risk and billions of dollars of trade will be put in jeopardy.

At the start of July, the Irish Data Protection Commission, Facebook’s main data regulator in Europe, issued a draft decision that would block Meta from sending data across the Atlantic. While the specifics of that draft decision aren’t known, if it is enacted, it could create a Facebook blackout across Europe.

Under the GDPR, Europe’s data law, countries across the continent get 30 days to scrutinize Ireland’s Meta decision and respond with any potential changes or complaints. That time is now up. A spokesperson for the Irish regulator says “some” objections have been received from a “small” number of other countries and it is working to address these. Experts say these are likely to be minor points of law, rather than overturning the entire decision.

So, how likely is it that Meta will actually pull its services from Europe? In reality, the chances are probably pretty slim. Meta has said it has “no desire” to leave the continent, going as far as publishing a blog post titled “Meta Is Absolutely Not Threatening to Leave Europe.” Europe’s 30-plus countries are a large market for Meta, and stopping services, even temporarily, could be costly. (A close comparison is when the company briefly banned news posts in Australia in early 2021, following a row with publishers.) While Meta may not leave Europe, it may have to make changes to how it stores and transfers data once the final decision from the Irish regulator is published, although there is no set timeline. It may also face a fine.

“My guess is that Meta is going to have to look at some form of geo-siloing if they want to continue to operate in the EU,” says Calli Schroeder, global privacy counsel at the Electronic Privacy Information Center, a nonprofit digital rights research organization. Schroeder, who previously worked with companies on international data transfers, says this approach could mean Meta would have to create its own servers and data centers in the EU that aren’t connected to its broader databases.

Harshvardhan Pandit, a computer science research fellow at Trinity College Dublin who is researching the GDPR, says that as data authorities are still considering Meta’s case and a final decision hasn’t been published yet, they could include several caveats or steps that Meta should take to fall in line. For instance, one recent data protection decision in Europe gave a six-month period for a company to make changes to its business.

“I think the most pragmatic solution would be for them to create the European infrastructure, like Google or Amazon, which have quite a few data centers here,” Pandit says, adding that Meta could also introduce more encryption to how it stores data and maximize how much it keeps in the EU. All these measures would be costly, though. Jack Gilbert, director and associate general counsel at Meta, says that the issue “is in the process of being resolved.” Facebook did not respond specifically to questions about its plan to respond to the Irish decision.

European officials have twice ruled that systems put in place to share data between the EU and US don’t properly protect people’s data—the complaints have been ongoing since the early 2010s. European courts ruled that international data-sharing agreements weren’t up to scratch first in 2015 and then again in July 2020, when the Privacy Shield agreement was ruled illegal.

“All that the EU is asking for when organizations transfer data to other countries is to protect that data in line with the GDPR,” says Nader Henein, a research vice president specializing in privacy and data protection at Gartner. “The issue is that laws in the US that protect the data of ‘nonresident aliens’ are woefully insufficient and make it very difficult for organizations like Facebook to comply with local law and the GDPR.”

While Meta is the focus of the most high-profile complaint, it isn’t the only company impacted by a lack of clarity on how companies in Europe can send data to the US. “The data transfer issue is not Meta-specific,” David Wehner, Meta’s chief strategy officer, said in a July earnings call. “It relates to how in general data is transferred for all US and EU companies back and forth to the US.”

The impacts of the July 2020 decision to get rid of Privacy Shield are now being felt. Since January of this year, multiple European data regulators have ruled that using Google Analytics, the company’s traffic-monitoring service for websites, falls foul of the GDPR. Danish authorities went even further: Schools can’t use Chromebooks without restrictions being put in place. “There is a ton of legal uncertainty, and there is a significant compliance risk,” says Gabriela Zanfir-Fortuna, vice president of global privacy at Future of Privacy Forum, a nonprofit think tank.

Politicians are well aware of the problems. In March, US president Joe Biden and European Commission president Ursula von der Leyen announced a new Trans-Atlantic Data Privacy Framework, which will change the way data is sent between the EU and US. The deal, which will be introduced by executive order, will limit what data US intelligence agencies can access and will create a new system where Europeans can complain if they think they’ve been illegally spied upon by US agencies.

However, since the deal was announced, no specifics—including any legal texts—have been published. In June, officials said the deal could be published in the coming weeks, but so far, there has been little public progress. The US Department of Commerce says discussions are still taking place, including a meeting between both sides last week. (A European Commission spokesperson says work on the new agreement is ongoing, but they do not have a timeline that can be shared.) The longer the negotiations take, the more blocking orders will drop. “Obviously, if that framework is not complete, we would be in jeopardy of being able to transfer data,” Facebook’s Wehner said earlier this year.

The deal is likely to take a while yet. “Realistically, at this point, we're looking at a potential adequacy decision for this Trans-Atlantic data transfers framework sometime next year—maybe the first quarter of next year,” Zanfir-Fortuna says. Once the details have been published, EU officials will spend months scrutinizing the specifics to see if they fall in line with court orders.

And they won’t be the only ones pouring over it. Privacy activists and lawyers will also be looking at the agreement and could launch further legal challenges if they find that data moving from Europe to the US still isn’t protected strongly enough. “The continued challenges are not unwarranted, particularly considering the Snowden revelations and the prevalence of Big Tech firms coming out of the US,” Schroeder says. “As a whole, America really needs to make sure we rise to the challenge of showing that we can be good stewards of the industry that we're trying to be leaders in.”

Will Europe Force a Facebook Blackout?

The popular Microsoft-owned code repository plans to roll out code signing, which will help beef up the security of open source projects.

Following the 2020 SolarWinds cyberespionage campaign in which Russian hackers slipped tainted updates into a widely used IT management platform, a series of other software supply chain attacks has continued to show the urgent need to lock down software chains of custody. And the issue is particularly pressing in open source where projects are inherently decentralized and often ad hoc endeavors. After a series of worrying compromises to widely downloaded JavaScript software packages from the prominent “npm” registry, which is owned by GitHub, the company laid out a plan this week to offer expanded defenses for open source security.

GitHub, which itself is owned by Microsoft, announced on Monday that it plans to support code signing, a sort of digital wax seal, for npm software packages using the code signing platform Sigstore. The tool grew out of cross-industry collaboration to make it much easier for open source maintainers to verify that the code they create is the same code that ends up in the software packages actually being downloaded by people worldwide.

“While most npm packages are open source, there’s currently no guarantee that a package on npm is built from the same source code that’s published,” says Justin Hutchings, GitHub's director of product management. “Supply chain attacks are on the rise, and adding signed build information to open source packages that validates where the software came from and how it was built is a great way to reduce the attack surface.”

In other words, it's all about creating a cryptographically verified and transparent game of telephone. 

Dan Lorenc, CEO of Chainguard, which co-develops Sigstore, emphasizes that while GitHub isn't the only component of the open source ecosystem, it's an absolutely crucial town square for the community because it's where the vast majority of projects store and publish their source code. When developers actually want to download open source applications or tools, though, they typically go to a package manager 

“You don’t install source code directly, you usually install some compiled form of it, so something has happened in between the source code and the creation of the package. And up until now, that whole step has just been a black box in open source,” Lorenc explains. “You see the code and then go and download the package, but there’s nothing that proves that the package came from that code or the same person was involved, so that’s what GitHub is fixing."

By offering Sigstore to package managers, there's much more transparency at every stage of the software's journey, and the Sigstore tools help developers manage cryptographic checks and requirements as software moves through the supply chain. Lorenc says that many people are shocked to hear that these integrity checks aren't already in place and that so much of the open source ecosystem has been relying on blind trust for so long. In May 2021, the Biden White House issued an executive order that specifically addressed software supply chain security. 

“People say, ‘didn’t we already have this?’ That gap where there’s the code and then there's the package—most people just don’t believe you or are terrified," Lorenc says.

Sigstore is co-developed by The Linux Foundation, Google, Red Hat, Purdue University, and Chainguard. The open source software development platform Kubernetes now supports Sigstore, and there is an official tool for signing Python package distributions using Sigstore.

“Traditional methods of managing signing keys just don’t scale well to the sheer size of the open source community and don't give insight into how the software was built," GitHub's Hutchings says. “One of the things we like about Sigstore is that it’s zero-configuration for end users, so we can scale this up with our developer ecosystem regardless of where the source code lives."

Similar to the massive industry effort to promote HTTPS web encryption, made possible in large part by tools like Let's Encrypt from the nonprofit Internet Security Research Group, Sigstore relies on being free and easy to use to spur adoption. Github says it is starting with a proposal on how Sigstore will be implemented for npm and an open comment period to get feedback from the community on exactly how the tool will be deployed. But ultimately the goal is to bring such code signing to as much of the open source world as possible to make supply chain attacks much more difficult.  

“We want to see a world where eventually all software artifacts are signed and linked back to the source code,” GitHub's Hutchings says. “That is why it is so important to build on an open technology stack like Sigstore that other packaging repositories can adopt as well."

Github Moves to Guard Open Source Against Supply Chain Attacks

The new Pretty Good Phone Privacy service for Android hides the data linking you to your mobile device.

As marketers, data brokers, and tech giants endlessly expand their access to individuals’ data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users’ locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world.

The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can’t access or track customers’ metadata, location information, or mobile browsing. Launching in beta today for Android, the company’s Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users’ movements. And it will also offer a Relay service that disassociates a user’s IP address from their web browsing.

“If you can decouple a user’s identity from the way they connect to a network, that’s a general-purpose hammer that can solve a lot of privacy problems,” says Raghavan, a professor at the University of Southern California. “Privacy should be the default and it’s not currently, so we’re working on that. There’s a growing appetite as people become more concerned about what their phone is leaking to telecoms and tech companies.”

PGPP’s ability to mask your phone’s identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a “yes” or “no” about whether a device should get service. 

On the PGPP “Mobile Pro” plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There’s also a “Mobile Core” plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month.

Both of these plans also include PGPP’s Relay service. Similar to Apple’s iCloud Private Relay, PGPP’s Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you’re looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay—in this case, Invisv—but the information about the page you’re trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you’re trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay.

In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. 

“User privacy has historically been in the backseat for internet systems,” says Jana Iyengar, Fastly’s product lead for infrastructure services. “At Fastly, we have always believed that communication and data privacy is fundamental to the future of the internet. We believe it is time to invest, engage, and create products that will move the internet forward in this direction.”

Invisv is still working to bring its services to Apple’s iOS, and the company doesn’t provide voice calling services, only mobile data. But Raghavan and Schmitt say that their goal for this initial launch was to start offering something that would give customers drastically more privacy protection than what they get from other mobile carriers while being truly easy to use.

“The reason we’re doing this, honestly, is that it’s clear nobody else is going to do it,” Schmitt says. “I’m hopeful that people will just start to see what's possible from this, so we can start to make a dent.”

Source

Wired