Underwater cables keep the internet online. When they congregate in one place, things get tricky.

The Asia-Africa-Europe-1 internet cable travels 15,500 miles along the seafloor, connecting Hong Kong to Marseille, France. As it snakes through the South China Sea and toward Europe, the cable helps provide internet connections to more than a dozen countries, from India to Greece. When the cable was cut on June 7, millions of people were plunged offline and faced temporary internet blackouts.

The cable, also known as AAE-1, was severed where it briefly passes across land through Egypt. One other cable was also damaged in the incident, with the cause of the damage unknown. However, the impact was immediate. “It affected about seven countries and a number of over-the-top services,” says Rosalind Thomas, the managing director of SAEx International Management, which plans to create a new undersea cable connecting Africa, Asia, and the US. “The worst was Ethiopia, that lost 90 percent of its connectivity, and Somalia thereafter also 85 percent.” Cloud services belonging to Google, Amazon, and Microsoft were all also disrupted, subsequent analysis revealed.

While connectivity was restored in a few hours, the disruption highlights the fragility of the world’s 550-plus subsea internet cables, plus the outsized role Egypt and the nearby Red Sea have in the internet’s infrastructure. The global network of underwater cables forms a large part of the internet’s backbone, carrying the majority of data around the world and eventually linking up to the networks that power cell towers and Wi-Fi connections. Subsea cables connect New York to London and Australia to Los Angeles.

Sixteen of these submarine cables—which are often no thicker than a hosepipe and are vulnerable to damage from ships’ anchors and earthquakes—pass 1,200 miles through the Red Sea before they hop over land in Egypt and get to the Mediterranean Sea, connecting Europe to Asia. The last two decades have seen the route emerge as one of the world’s largest internet chokepoints and, arguably, the internet’s most vulnerable place on Earth. (The region, which also includes the Suez Canal, is also a global choke point for shipping and the movement of goods. Chaos ensued when the container ship _Ever Given_ got wedged in the canal in 2021.)

“Where there are chokepoints, there are single points of failure,” Nicole Starosielski, an associate professor of media, culture, and communication at New York University and an author on submarine cables. “Because it's a site of intense concentration of global movement, that does make it more vulnerable than many places around the world.”

The area has also recently gained attention from the European Parliament, which in a June report highlighted it as a risk for widespread internet disruption. “The most vital bottleneck for the EU concerns the passage between the Indian Ocean and the Mediterranean via the Red Sea because the core connectivity to Asia runs via this route,” the report says, flagging extremism and maritime terrorism are risks in the area.

Pyramid Scheme

Look at Egypt on a map of the world’s subsea internet cables and it immediately becomes clear why internet experts have been concerned about the area for years. The 16 cables in the area are concentrated through the Red Sea and touch land in Egypt, where they make a 100-mile journey across the country to reach the Mediterranean Sea. (Cable maps don’t show the exact locations of cables.)

It has been estimated that around 17 percent of the world’s internet traffic travels along these cables and passes through Egypt. Alan Mauldin, the research director of telecoms market research firm TeleGeography, says last year the region had 178 terabits of capacity, or 178,000,000 Mbps—the US has median home internet speeds of 167 Mbps.

The Most Vulnerable Place on the Internet

Authoritarian societies depend on people ratting each other out for activities that were recently legal—and it's already happening in the US.

There’s a knock at the door. Local authorities have received a tip that you’ve broken the moral code—a new set of laws banning your once-accepted lifestyle. You’re being called in for questioning, and it’s unclear when you’ll return home.

In an authoritarian state, neighborhood trust is a thing of the past. Citizens are often encouraged to report any perceived wrongdoing in their communities to the government. There are countless examples of this in history—and around the world today. It happens in Russia, and there’s even an app for it in Saudi Arabia.

In the United States, we appear to be creeping toward this culture of community surveillance. Texas’ SB 8 deputized everyday Americans to sue anyone who has had an abortion or assisted with one. Texans are reporting the parents of transgender children to authorities. Virginia Governor Glenn Youngkin set up a tip line and encouraged parents to report teachers who are teaching “divisive” subjects. Florida’s “Don’t Say Gay” law encourages parents to monitor teachers. With the Republican Party increasingly embracing authoritarianism, this is likely just the start.

Tom Ginsburg, a professor of international law at the University of Chicago, says these kinds of policies are an American version of what you might see in authoritarian states.

“It incentivizes private enforcement of moral norms,” Ginsburg says. “That’s very corrosive. It’s a process that is undermining the ability of society to function in the traditional way that societies do.”

Ginsburg says he worries that we’re losing democracy in states where Republican candidates for office appear willing to subvert future elections, which means citizens’ ability to reject authoritarian leaders may be slipping away. He says he doesn’t think our conservative Supreme Court has any interest in helping prevent democratic backsliding, either.

“The Supreme Court may facilitate the undermining of democracy from below through the general stance of, ‘Well, that’s not our problem,’” Ginsburg says.

Consuelo Amat, an assistant professor of political science at John Hopkins University, says that when a state becomes authoritarian, anything people in your community learned about you during democratic years can be used against you once the new regime takes power. She’s closely studied Chile under dictator Augusto Pinochet and says that’s what happened there. Amat says those who support the new regime can essentially become informants for it.

“When that starts happening, the dynamic for communities and neighborhoods is extremely bad,” Amat says. “The distrust that people have is huge, so people start not sharing information at all. One of the cores of democracy is neighborhood trust. You need to trust others in your society and in your community for democracy to work. Period. When there’s a very high level of distrust, you will see a fracturing of community.”

If the US moves further toward authoritarianism, you can imagine states passing more laws to disempower, criminalize, or otherwise marginalize certain groups. Anyone you encounter on a regular basis who doesn’t agree with politically could be encouraged to report you for violations of these laws as some sort of act of civic duty. They’ll have more ways to do it than ever before, considering modern technology allows us to monitor people’s social media feeds, watch them through Ring cameras, report them through community-watch apps like Citizen, and more.

Beyond the actions of an authoritarian government, Amat also worries about how paramilitary groups and right-wing extremists could be empowered to enforce a new moral code. This could be done through legal and illegal channels and range from collecting information on people to harassing or even harming political adversaries. Amat says illegal actions become more likely when these groups don’t think they’ll face consequences for their actions, as when a prominent political figure promises to pardon those people if elected and encourages supporters to act violently.

“If the rule of law starts breaking—and especially if there’s a regime that is supportive of those actions—that’s really giving space for people to take actions that are illegal,” Amat says. “Knowing you will not be prosecuted is a big thing.”

All of these sorts of things create a culture of fear in authoritarian countries. People are afraid of their neighbors, afraid to speak freely, and afraid of what might happen next. This fear is made worse by the fact that the citizens dealing with oppressive forces have no ability to hold those in power accountable when they go too far.

The future of American democracy and the rights of citizens remain in question. Amat says anyone worried about an authoritarian future needs to take actions to protect democratic institutions and their way of life.

“Institutions are not in a void,” Amat says. “They are populated by human beings who make choices.”

When Your Neighbor Turns You In

Plus: Important patches from Apple, VMWare, Cisco, Zimbra, SAP, and Oracle.

Other issues fixed in October are a heap buffer overflow in WebSQL tracked as CVE-2022-3446 and a use-after-free bug in Permissions API tracked as CVE-2022-3448, Google wrote in its blog. Google also fixed two use-after-free bugs in Safe Browsing and in Peer Connection.

Google Android

The Android Security Bulletin for October includes fixes for 15 flaws in the Framework and System and 33 issues in the kernel and vendor components. One of the most concerning issues is a critical security vulnerability in the Framework component that could lead to local escalation of privilege, tracked as CVE-2022-20419. Meanwhile, a flaw in the Kernel could also lead to local escalation of privilege with no additional execution privileges needed.

None of the issues are known to have been used in attacks, but it still makes sense to check your device and update it when you can. Google has issued the update to its Pixel devices and it’s also available for the Samsung Galaxy S21 and S22 series smartphones and Galaxy S21 FE.

Cisco

Cisco has urged companies to patch two flaws in its AnyConnect Secure Mobility Client for Windows after it was confirmed the vulnerabilities are being used in attacks. Tracked as CVE-2020-3433, the first could allow an attacker with valid credentials on Windows to execute code on the affected machine with system privileges.

Meanwhile, CVE-2020-3153 could allow an attacker with valid Windows credentials to copy malicious files to arbitrary locations with system-level privileges.

The US Cybersecurity and Infrastructure Security Agency has added the Cisco flaws to its already exploited vulnerabilities catalog.

While both the Cisco flaws require the attacker to be authenticated, it’s still important to update now.

Zoom

Video conferencing service Zoom patched several issues in October, including a flaw in its Zoom client for meetings, which is marked as having a high severity with a CVSS Score of 8.8. Zoom says versions before version 5.12.2 are susceptible to a URL-parsing vulnerability tracked as CVE-2022-28763.

“If a malicious Zoom meeting URL is opened, the link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers,” Zoom said in a security bulletin.

Earlier in the month, Zoom alerted users that its client for meetings for macOS starting with 5.10.6 and prior to 5.12.0 contained a debugging port misconfiguration.

VMWare

Software giant VMWare has patched a serious vulnerability in its Cloud Foundation

Tracked as CVE-2021-39144. The remote code execution vulnerability via XStream open source library is rated as having a critical severity with a maximum CVSSv3 base score of 9.8. “Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation, a malicious actor can get remote code execution in the context of 'root' on the appliance,” VMWare said in an advisory.

The VMware Cloud Foundation update also addresses an XML External Entity vulnerability with a lesser CVSSv3 base score of 5.3. Tracked as CVE-2022-31678, the bug could allow an unauthenticated user to perform denial of service.

Zimbra

Software firm Zimbra has issued patches to fix an already-exploited code execution flaw that could allow an attacker to access user accounts. The issue, tracked as CVE-2022-41352, has a CVSS severity score of 9.8.

Exploitation was spotted by Rapid7 researchers, who identified signs it had been used in attacks. Zimbra initially released a workaround to fix it, but now the patch is available, you should apply it ASAP.

SAP

Enterprise software firm SAP has published 23 new and updated Security Notes in its October Patch Day. Among the most serious issues is a critical Path Traversal vulnerability in SAP Manufacturing Execution. The vulnerability affects two plugins: Work Instruction Viewer and Visual Test and Repair and has a CVSS score of 9.9.

Another issue with a CVSS score of 9.6 is an account hijacking vulnerability in the SAP Commerce login page.

Oracle

Software giant Oracle has released a whopping 370 patches as part of its quarterly security update. Oracle’s Critical Patch Update for October fixes 50 vulnerabilities rated as critical.

The update contains 37 new security patches for Oracle MySQL, 11 of which may be remotely exploitable without authentication. It also contains 24 new security patches for Oracle Financial Services Applications, 16 of which may be remotely exploitable without authentication.

Due to “the threat posed by a successful attack,” Oracle “strongly recommends” that customers apply Critical Patch Update security patches as soon as possible.

You Need to Update Google Chrome, Windows, and Zoom Right Now

Open-internet advocates are breathing a sigh of relief after a recent election for the International Telecommunications Union's top leadership.

While Bogdan-Martin’s win was significant, the down-ballot races also seemed to indicate a rejection of this expanded ITU mandate. A Russian incumbent lost his spot on the ITU’s radio regulatory board, while Russia was shut out of a seat on a broader regulatory council. Iran, which runs one of the world’s most expansive and authoritarian internet-filtering systems, also lost its council seat.

While China fared better, its support declined considerably. In 2018, Houlin Zhao was elected secretary-general with no competition—in 2022, a Chinese candidate came third in a race for a lesser position, only narrowly securing him a spot on the board.

Some of these successes are undoubtedly a result of American reengagement; the Trump White House first announced a plan to prioritize organizations like the ITU, which had been ignored by Washington for years, in 2017, in order to counteract China’s increasing success at these international bodies. Over the past year, President Joe Biden energetically campaigned for Bogdan-Martin’s candidacy.

Geopolitics—and Russia’s war against Ukraine, in particular—undoubtedly helped reshape the ITU’s leadership.

When Bella Cherkesova, a Russian deputy minister, stood to address the conference, she railed against the United States and its allies. “Recently, at the behest of certain countries, we have been confronting the politicization of the Union’s work,” Cherkesova said, lamenting that fully a third of Russia’s delegates had their visas rejected and could not attend the conference and that other Russian officials were not nominated to various administrative posts.

Cherkesova went on to laud Moscow’s promotion of the internet. “Russia provides security, protection of public order, health and morals of the population on the internet,” she said.

In a dueling speech, one of Ukraine’s representatives to the ITU offered a poignant counterpoint. “Representatives of the aggressor country are also here and talk about progress and standards,” Yurii Shchyhol, chair of the State Service of Special Communications and Information Protection of Ukraine, told the conference. “We have to defend ourselves.”

Shchyhol added that Russia had “turned into a weapon” the basic technology that the ITU is tasked with regulating and expanding. “Today, seven months after the invasion, we understand that the Russian Federation has also sought to destroy the connection in Ukraine,” Shchyhol continued, listing a variety of ways in which Russia has allegedly violated ITU rules.

While think tanks like CSIS and the Heritage Foundation have encouraged American engagement at the ITU to be focused on counteracting China, analysts more intimately involved in the ITU say the fight is more complicated—and, they say, this month’s meeting lacked ambition.

In its analysis of the proposals up for debate at the conference, the Internet Society, a nonprofit that promotes open technology, expressed disappointment that the ITU did not codify more formal cooperation with organizations like ICANN, nor did it make additional space for researchers and non-governmental organizations.

The Center for Democracy & Technology’s Knodel, who was also part of the American delegation, says inviting advocates like her has “made the ITU vastly more open than it once was. However, nongovernment stakeholders are far from welcomed at the ITU, which in the internet age is a stark contrast to the governance fora that are largely responsible for internet standardization and the cooperation required for implementing its decentralized design.”

While states like China are “proposing more technical designs that centralize control and surveillance,” Knodel says, even many of those discussions were sidestepped at the most recent conference.

Other big issues, like how to handle fees paid to countries that handle the fiber optic cables that make up the backbone of the internet—which could undercut revenues for poorer countries—have also been left unresolved.

Knodel says, with this new ITU leadership in place, the priority for the future should be figuring out “how to extend meaningful access to the internet rather than eroding it.”

The Election That Saved the Internet From Russia and China

Plus: The New York Post gets hacked, a huge stalkerware network is exposed, and the US claims China interfered with its Huawei probe.

For years, AlphaBay ruled the dark web. If you were in the market to buy drugs or stolen credit cards, the digital bazaar was the place to turn. At its peak, more than 350,000 products were listed for sale—an estimated 10 times the size of the notorious Silk Road market—and the website proved to be the ire of law enforcement the world round. That was until cops took AlphaBay offline in 2017.

This week, WIRED published the first in a six-part series detailing the hunt for Alpha02, the mastermind believed to be behind AlphaBay, and the huge international takedown operation that wiped the marketplace from the web. Each week, we’ll publish a new part of the series, excerpted from WIRED reporter Andy Greenberg’s new book, _Tracers in the Dark_.

Schools across the US have faced dozens of hoax calls about mass shootings in recent months. After a call is made, police scramble to the scene fearing the worst, only to find out there is no shooter. Now hoax phone call recordings obtained by WIRED and conversations with law enforcement officials reveal how the calls have been made and show that law enforcement officials are closing in on the alleged hoaxer. Police are looking for a male “with a heavy accent described as Middle Eastern or African” and have linked the phone calls to Ethiopia.

Elsewhere, a bug in Apple’s new macOS 13 Ventura operating system is causing problems for malware scanners and security monitoring tools. With the new software update, Apple accidentally crippled third-party security products in a way users may not notice. The company is planning to fix the bug in an upcoming software release.

We also looked at a newly discovered Chinese influence operation that is targeting US elections—although it is not having much success. And now that Elon Musk owns Twitter, here’s how you should think about your privacy and security on the bird website.

But wait, there’s more! Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Officials in Canada and the Netherlands are investigating allegations that Chinese police forces have operated a network of illegal police stations within their countries. According to reports that emerged this week, Chinese police forces have been operating out of clandestine bases and using their presence to track and threaten dissidents. The Dutch government has called such sites “illegal” and said it is “investigating exactly what they are doing here,” while officials in Canada said they are investigating “so-called ‘police’ stations.”

However, it is just the tip of the iceberg. Spanish civil rights group Safeguard Defenders first claimed that Chinese police forces from the cities of Fuzhou and Qingtian were running “overseas police service stations” across the West in a report published in September. Since 2018, the group claims, more than 38 police service stations have appeared in “dozens of countries” spread across five different continents. “Such overseas police ‘service stations’ have been used by police back in China to carry out such ‘persuasion to return’ operations on foreign soil, including in Europe,” the report states. Lawmakers in both England and Scotland are also planning on investigating the stations, reports say.

Chinese officials have not denied the existence of the service stations, but say they exist to provide bureaucratic services to Chinese citizens and don’t involve police operations. The Chinese embassy in Canada said the stations exist to allow Chinese citizens to complete tasks such as renewing their driving licenses: “The main purpose of the service station abroad is to provide free assistance to overseas Chinese citizens in this regard.”

If stalkerware is installed on your phone or laptop, the malicious software can send every tap, message, and photo back to the person who added it to your device. The software is often hard to find, and the insidious industry that creates it operates in the shadows. This week, a TechCrunch investigation revealed how a huge stalkerware network, with hundreds of thousands of victims, operates.

Leaked data obtained by TechCrunch shows TheTruthSpy stalkerware has been installed on more than 300,000 devices and has victims all around the world. Over a six-week period analyzed by the publication, more than 9,400 new devices were infected with the stalkerware. Thousands of calls, millions of text messages, and more than 470,000 photos and videos were collected by the app without its victims’ knowledge. And data was also likely collected from the phones of children. This tool can tell if your device was compromised.

A pair of Chinese intelligence officers attempted to bribe a US official involved in the criminal case against Huawei, the US Department of Justice claimed this week. Across three separate cases, the Justice Department charged 13 people with alleged efforts to “exert influence” in the US on behalf of the People’s Republic of China. The charges range from trying to disrupt the US government’s Huawei investigation to trying to recruit people as intelligence agents. Two people were also arrested for allegedly attempting to “cause the forced repatriation” of a Chinese national living in the US. “The actions announced today take place against a backdrop of malign activity from the government of the People’s Republic of China that includes espionage, attempts to disrupt our justice system, harassment of individuals, and ongoing efforts to steal sensitive US technology,” deputy attorney general Lisa O. Monaco said in a statement. In an unprecedented move in July, the head of the FBI and the UK’s MI5 made a joint public appearance to warn about the perceived threat from China, saying the nation is the biggest threat to economic and national security.

The website and Twitter account of the _New York Post_ were hacked this week. On Thursday, the publication’s Twitter account started sharing links to stories with offensive headlines and posts about politicians. US president Joe Biden, US representative Alexandria Ocasio-Cortez, and New York governor Kathy Hochul were all targeted. The _Post_, which is owned by News Corp, tweeted that it was investigating the incident, but very few details have been made public so far. In February this year, News Corp announced it had been hacked, with the attackers believed to have accessed journalists’ emails. The latest attack against the _Post_ echoes a recent hack of the business news website _Fast Company_. In September, the publication’s content management system (CMS) was breached and the attacker sent offensive push notifications to Apple News subscribers.

China Operates Secret ‘Police Stations’ in Other Countries

What's next for the social network is anyone's guess—but here's what to watch as you wade through the privacy and security morass.

Elon Musk is buying Twitter for $44 billion after the least sexy will-they-won't-they saga of all time. And while Musk attempted to reassure advertisers yesterday that "Twitter obviously cannot become a free-for-all hellscape, where anything can be said with no consequences," the acquisition raises practical questions about what the social network's nearly 240 million active users can expect from the platform in the future.

Chief among these concerns are questions about how Twitter's stances on user security and privacy may change in the Musk era. A number of top Twitter executives were fired last night, including CEO Parag Agrawal, the company's general counsel Sean Edgett, and Vijaya Gadde, the company's head of legal policy, trust, and safety who was known for working to protect user data from law enforcement requests and court orders. Gadde ran the committee that ousted Donald Trump from Twitter in January 2021 following the Capitol riots. Musk, meanwhile, said in May that he would want to reinstate Trump on the platform and called the former US president's removal “morally bad.” 

This afternoon, Musk wrote that “Twitter will be forming a content moderation council with widely diverse viewpoints. No major content decisions or account reinstatements will happen before that council convenes.”

Content moderation has real implications for user security on any platform, particularly when it involves hate speech and violent misinformation. But other topics, including the privacy of Twitter direct messages, protection from unlawful government data requests, and the overall quality of Twitter's security protections, will loom large in the coming weeks. This is particularly true in light of recent accusations from former Twitter chief security officer Peiter “Mudge” Zatko, who described Twitter as having grossly inadequate digital security defenses in an August whistleblower report.

“Personally, I don’t know what to do, especially when you take Mudge’s whistleblower complaint into consideration,” says Whitney Merrill, a privacy and data protection lawyer and former Federal Trade Commission attorney. “I’m just not putting any sensitive data or data I’d like to stay confidential into DMs.”

Twitter offers a tool for downloading all the data it holds in your account, and reviewing your own trove is a good first step in understanding what information the company has linked to you. It's unclear, though, exactly how much control you currently have over deleting this data, and the policies could continue to evolve under the Musk administration. Twitter DMs, for example, only offer the option to “Delete for You,” meaning delete messages from your own account but not for other users. 

More broadly, Twitter's current policy on account deactivation simply says, “If you do not log back into your account for the 30 days following the deactivation, your account will be permanently deactivated.  Once permanently deactivated, all information associated with your account is no longer available in our Production Tools.” It is unclear what exactly this means in terms of long-term data retention and, again, policies may change in the future.

“It appears Twitter isn't even deleting data of end users, and private messages are kept forever or maybe until all participants delete,” Merrill says. (Twitter did not yet respond to WIRED's request for comment.)

It's worth noting that for most users, Twitter's core purpose as a public microblogging service is something of a saving grace. A lot of the things most people have done on Twitter over the years were meant to be publicly accessible. But private Twitter accounts and direct message chats are both popular Twitter features and important considerations as the company evolves.

“This is an emerging situation, but to the extent DMs were ever considered safe from inspection by staff, the threat is greater with the extensively reported rumors of staff reductions,” says Jake Williams, director of cyber-threat intelligence at the security firm Scythe and a former National Security Agency hacker. “Some of the first staff to be cut in any reorganization are personnel involved in nonfunctional activities, such as security specialists and internal policy oversight.”

Zatko, the former Twitter chief security officer, warned in both his written report and subsequent Congressional testimony of rogue insiders at Twitter, including nation-state actors, woefully inadequate access controls, and weak digital security defenses. As a result, a lack of security investment in the Musk era could pose a real danger to users over time. And Twitter has been plagued by both criminal and state-backed attacks over the years.

It's important to keep in mind, though, that the social giant is still a public company and that Musk himself would face legal liability if he or any of his appointees personally access user data or take other rogue actions like, say, leveraging the Twitter mobile application to grab user data outside of Twitter's scope.

“This all should be very concerning, but users don't need to overreact,” Williams says. “There will still be disincentives to run afoul of regulators.”

Even if many users are sticking around to see how things shake out, some are already balking at the extreme uncertainty of the situation. This evening, General Motors said it was temporarily suspending advertising on the social network.

If Musk Starts Firing Twitter's Security Team, Run

Your anti-malware software may not work if you upgraded to the new operating system. But Apple says a fix is on the way.

The release of Apple's new macOS 13 Ventura operating system on October 24 brought a host of new features to Mac users, but it's also causing problems for those who rely on third-party security programs like malware scanners and monitoring tools. 

In the process of patching a vulnerability in the 11th Ventura developer beta, released on October 11, Apple accidentally introduced a flaw that cuts off third-party security products from the access they need to do their scans. And while there is a workaround to grant the permission, those who upgrade their Macs to Ventura may not realize that anything is amiss or have the information needed to fix the problem. 

Apple told WIRED that it will resolve the issue in the next macOS software update but declined to say when that would be. In the meantime, users could be unaware that their Mac security tools aren't functioning as expected. The confusion has left third-party security vendors scrambling to understand the scope of the problem.

“Of course, all of this coincided with us releasing a beta that was supposed to be compatible with Ventura,” says Thomas Reed, director of Mac and mobile platforms at the antivirus maker Malwarebytes. “So we were getting bug reports from customers that something was wrong, and we were like, ‘crap, we just released a flawed beta.’ We even pulled our beta out of circulation temporarily. But then we started seeing reports about other products, too, after people upgraded to Ventura, so we were like, ‘uh oh, this is bad.’”

Security monitoring tools need system visibility, known as full disk access, to conduct their scans and detect malicious activity. This access is significant and should be granted only to trusted programs, because it could be abused in the wrong hands. As a result, Apple requires users to go through multiple steps and authenticate before they grant permission to an antivirus service or system monitoring tool. This makes it much less likely that an attacker could somehow circumvent these hurdles or trick a user into unknowingly granting access to a malicious program. 

Longtime macOS security researcher Csaba Fitzl found, though, that while these setup protections were robust, he could exploit a vulnerability in the macOS user privacy protection known as Transparency, Consent, and Control to easily deactivate or revoke the permission once granted. In other words, an attacker could potentially disable the very tools users rely on to warn them about suspicious activity. 

Apple attempted to fix the flaw multiple times throughout 2022, but each time, Fitzl says, he was able to find a workaround for the company's patch. Finally, Apple took a bigger step in Ventura and made more comprehensive changes to how it manages the permission for security services. In doing that, though, the company made a different mistake that's now causing the current issues.

“Apple fixed it, and then I bypassed the fix, so they fixed it again, and I bypassed it again,” Fitzl says. “We went back and forth like three times, and eventually they decided that they will redesign the whole concept, which I think was the right thing to do. But it was a bit unfortunate that it came out in the Ventura beta so close to the public release, just two weeks before. There wasn't time to be aware of the issue. It just happened.”

If you use a security scanner on your Mac and you update to macOS Ventura, check the program directly to see if it's flagging an error. The workaround to fix the problem is simple once you know to do it. In System Preferences go to Security & Privacy, then the Privacy tab, and then Full Disk Access. Click the lock icon in the lower-left corner of the screen and authenticate with your system password to allow changes. Then uncheck the box next to any security services that are malfunctioning, to let the system know you want to disable their permission. Click the lock in the lower-left corner again to save the change, then redo the process and recheck the relevant boxes to freshly enable the permission without the flaw.

“Once you upgrade to Ventura, you could run a Malwarebytes scan, but it wouldn’t scan everything that it could if it had full disk access, and all of the real-time protection features are completely disabled,” Malwarebytes' Reed says. “We get handicapped if we don’t get full disk access. And there are a number of ways that you could tell if Malwarebytes is not functioning properly, but if you’re not looking in the right places or you disabled certain settings, you might not notice. With other security clients, it's probably similar—if you’re not interacting with it, you might not know.”

Researchers noticed—and Apple confirmed to WIRED—that the bug doesn't happen when large organizations use Apple's “mobile device management” program to upgrade their fleet of devices to Ventura. This is significant, because if the bug carried over to managed enterprise devices, it would mean yet another reason for companies to put off important software updates. 

MacOS security researcher Patrick Wardle, founder of the Objective-See Foundation, says that he still recommends regular users upgrade their Macs to Ventura to get the new operating system's other security and privacy protections. In the meantime, though, Wardle says he has been deluged by bug reports about his free, open source malware monitoring tool, BlockBlock. The Ventura bug even makes it appear that security services like BlockBlock and Malwarebytes have been granted extra system access beyond what these programs request, including the accessibility permission, access to input monitoring, and even screen recording. 

“Users were understandably asking me, ‘Why does your tool need that?!’ And I'm like, ‘Uh, I have no idea. It doesn't!’” Wardle says. “It shows that when Apple is pushing out security fixes for reported bugs, they're still struggling to do that comprehensively and successfully without breaking other things. And in this case, they’re shipping a version of their operating system that is breaking security tools for millions, if not tens of millions, of users. It's frustrating and disheartening.”

Independent researcher Fitzl, who presented his original disabling permission vulnerability findings at Black Hat Asia in May and Wardle's Objective-See Mac and iOS security conference at the beginning of October, says that he's sympathetic about the misstep. 

“Apple was trying to redesign this thing to fix all of my bypasses, and they made a mistake—it happens,” he says. But he adds, ruefully, that the whole situation has played out in an unfortunate way. “I felt a bit weird about all of these issues and knowing that I pushed Apple into this because I was trying to get something else fixed.”

Apple MacOS Ventura Bug Breaks Third-Party Security Tools

The suspected Chinese influence operation had limited success. But it signals a growing threat from a new disinformation adversary.

Since Russia bombarded the 2016 election with Twitter trolls and astroturfed lies, election watchers have been on guard against social media “influence operations.” Four years later, Iran took a stab at meddling in the 2020 presidential election, with more mixed results. Now, the People's Republic of China—or, at least, a group with a long-running pro-Chinese government agenda—seems to be trying out its own political influence operation just ahead of this year's US midterm elections. And while that operation seems to have largely failed this time, the campaign represents the growing boldness of a new adversary in the fight against organized disinformation.

On Wednesday, cybersecurity and threat intelligence firm Mandiant published new findings about a group it calls Dragonbridge, which it's seen for years promoting pro-Chinese interests in fake grassroots social media campaigns designed to influence politics in Taiwan and Hong Kong. Now, Mandiant's analysts have tied Dragonbridge to a series of more US-focused influence campaigns. The group claimed that a notorious hacking spree carried out by known Chinese state-sponsored hackers was actually carried out by US intelligence, falsely blamed the sabotage of the Nord Stream pipeline on the US government, and—perhaps most brazenly—seeded hundreds of posts on social media designed to demoralize voters and reduce turnout ahead of the November midterms.

“This actor has been rapidly growing and hyper-aggressive. They went from carrying out limited campaigns focused on Hong Kong to a global operation on dozens of platforms,” says John Hultquist, Mandiant's VP of intelligence analysis. “Interfering in our elections is just another line that they're clearly willing to cross.”

Mandiant declined to reveal in its report or to WIRED the full collection of disinformation posts that it's tied to Dragonbridge, but the company says the posts numbered in the thousands. Nor would Mandiant name all the platforms where Dragonbridge had created accounts. But it describes posts published by these accounts arguing that American democracy was being taken over by extreme partisanship, as well as posts pointing to episodes of confrontations and violence between political groups and against the FBI as instances of “civil war.” The group also published a video, Mandiant says, that discourages Americans from voting, making claims about political gridlock and inaction and showing images of the January 6, 2021, insurrection at the US Capitol Building. “The solution to America’s ills is not to vote for someone,” the video argues at one point, according to Mandiant, but “to root out this ineffective and incapacitated system.” All of the content Mandiant identified in its report as part of the Dragonbridge operations has since been deleted, the company says.

Other simultaneous influence campaigns from the group tie it more evidently to Chinese government interests. Pseudonymous Twitter accounts that Mandiant says were controlled by Dragonbridge posted claims in both English and Mandarin stating that espionage campaigns carried out by the prolific China-linked hacker group APT41 were really the work of the NSA and CIA. “For at least ten years, the American hacker group \[APT41\] has repeatedly carried out cyber attacks, espionage activities, cyber piracy and cyber crimes against other countries,” reads one tweet in October from a seemingly fictional person named Karen Diaz.

In fact, the US Department of Justice indicted seven Chinese men in 2020 as members of APT41, tying them to a contractor working on behalf of China's Ministry of State Security known as Chengdu 404. The indictment accuses the men of hacking hundreds of targets around the globe, both to carry out espionage on behalf of the MSS and to profit from their own cybercrime operations.

In an attempt to shift that blame, Dragonbridge's influence campaign went so far as to create spoofed posts from Intrusion Truth, a mysterious pseudonymous Twitter account that has previously released evidence tying multiple hacking campaigns to China, including those of APT41. The fake Intrusion Truth posts instead falsely tie APT41 to US hackers. Dragonbridge also created an altered, spoofed version of an article in the Hong Kong news outlet _Sing Tao Daily_ pinning APT41's activities on the US government.

In a more timely example of Dragonbridge's disinformation operations, it also sought to blame the destructive sabotage of the Nord Stream natural gas pipeline—a key piece of infrastructure connecting European countries to Russian gas sources—on the United States. Mandiant says that claim, which echoes statements from Russian president Vladimir Putin and Russian disinformation sources, appears to be part of a larger campaign designed to sow divisions between the United States and its allies that have opposed and sanctioned Russia for its unprovoked and catastrophic military invasion of Ukraine.

None of those campaigns, Mandiant emphasizes, was particularly successful. Most of the posts had single-digit likes, retweets, or comments at best, the company says. Some of its spoofed tweets impersonating Intrusion Truth have no signs of engagement at all. But Hultquist warns nonetheless that Dragonbridge demonstrates a new interest in aggressive disinformation from pro-China sources, and possibly from China itself. He worries, given China's widespread cyber intrusions around the world, that future Chinese disinformation campaigns might include hack-and-leak operations that blend real revelations into disinformation campaigns, as Russia's GRU military intelligence agency has done. “If they get their hands on some real information from a hacking operation,” Hultquist says, “that's where they become especially dangerous.”

Despite Dragonbridge's occasional pro-Russian messages, Hultquist says that Mandiant has little doubt of the group's pro-China focus. The company first spotted Dragonbridge engaged in a fake grassroots campaign to disparage Hong Kong pro-democracy protestors in 2019. Earlier this year, it saw the group pose as Americans protesting against US rare-earth metal mining companies that competed with Chinese firms.

That doesn't mean Dragonbridge's campaigns are necessarily the work of a Chinese government agency or even a contractor firm like Chengdu 404. But they're very likely at least located in China, Hultquist says. “It's hard to imagine their activity, in its totality, being in any other country's interest,” says Hultquist.

If Dragonbridge is working directly for the Chinese government, it may mark a new phase in China's use of disinformation. In the past, China has largely stayed away from influence operations. A Director of National Intelligence report on foreign threats to the 2020 election declassified last year stated that China “considered but did not deploy influence efforts designed to change the outcome of the US Presidential election.” But just last month Facebook, too, says it spotted and removed campaigns of Chinese political disinformation posted to the platform from mid-2021 to September 2022, though it didn't say if the campaigns were linked to Dragonbridge.

Despite the apparent resources put into Dragonbridge's long-running operations, its new foray into election meddling looks remarkably ham-fisted, says Thomas Rid, a professor of strategic studies at Johns Hopkins and author of a history of disinformation, _Active Measures_. He points to abstract phrases, like its call to “root out this ineffective and incapacitated system.” That kind of dull language fails to effectively exploit real wedge issues to exacerbate existing divisions in US society—often best identified by local agents on the ground. “It seems like they didn’t read the manual,” Rid says. “It seems like a remote, amateurish affair done from Beijing.”

But both Rid and Mandiant's Hultquist agree that Dragonbridge's relative lack of success shouldn't be seen as a sign of Americans' growing immunity to influence operations. In fact, they argue that the deep political divisions in American society may mean that the US is less equipped than ever to distinguish fact from fabrication in social media. “Authoritative sources are no longer trusted,” says Hultquist. “I'm not sure that we're in a great place right now, as a country, to digest that some major information operation is attributable to a foreign power.”

A Pro-China Disinfo Campaign Is Targeting US Elections—Badly

AlphaBay was the largest online drug bazaar in history, run by a technological mastermind who seemed untouchable—until his tech was turned against him.

The Hunt for the Dark Web’s Biggest Kingpin, Part 1: The Shadow

For months, an anonymous caller has terrorized communities around the US by reporting false shooting threats. We know how they did it. The question is, why?

Four times in the past year, the parents, teachers, and police officers of the small, neighboring Minnesota cities of Cloquet and Esko briefly believed that their children were about to be murdered in their classrooms. The calls began in the spring with two bomb threats. In the first, a man claimed to have seen a suspicious backpack with wires coming out of it at Cloquet and Esko high school. In July, he called again, this time reporting a bomb in a red backpack at Fond du Lac Tribal and Community College, according to police records. Then, in September, the same man, described by the Midwestern dispatchers as having a thick Middle Eastern accent, reported that a pair of gunmen, armed with AK-47s, had killed 10 people at Cloquet High School.

All of these calls turned out to be hoaxes. But according to Derrick Randall, Cloquet’s chief of police, each time they came in, it was “all hands on deck” for his department. Officers sprinted to their squad cars, threw on their extra body armor, and chambered rounds in the squad rifles. They may have blasted through stop signs and traffic signals while racing as fast as they could to face what might have been the worst thing they would ever see in their lives. “It’s dangerous, frustrating. It’s a waste, and we feel helpless,” says Randall. “Our job is to hold people accountable, and when there’s a person or group on the other side of the world able to take advantage of us and exploit our systems like this, they are taking away our power and control.”

According to the Minnesota Department of Public Safety, at least 26 schools in the state have received false reports of bomb threats or active shootings from the same individual or group since spring. The calls are part of an ongoing spree of hoax calls that police say are likely coming from overseas and have sent hundreds of thousands of students nationwide into lockdown. According to police records WIRED obtained, the hoax caller began their spree in March, earlier than previously reported, and could be linked to bomb threats called into dozens of colleges during the summer. Earlier this month, WIRED tracked more than 90 false reports of active shooters made to K-12 schools in 16 states around the country during the second half of September, and NPR found that the number may be even higher. The calls haven’t stopped. Scores of schools in New Jersey, Florida, California, South Carolina, South Dakota, Wisconsin, and Connecticut have been targeted in the past three weeks.

“The biggest frustration amongst parents is why no one can do anything to stop it,” says Hayley Katchenske, whose job includes sending messages to parents when there's an emergency at Cloquet Public Schools. “Why did it happen to us again, why can’t this be traced, and why can’t it be stopped?”

State and federal law enforcement are working to answer these questions. They believe they know how the person carried out these dangerous hoax calls, WIRED has found. But they have yet to discover who is behind this string of attacks and, crucially, why they are doing them. The answers will determine what, if anything, law enforcement can do to stop it.

TextNow, Investigate Later

In an October memo the FBI sent to schools in New York that WIRED obtained, the agency describes a single subject—a male “with a heavy accent described as Middle Eastern or African”—behind many of these hoax calls. Federal and local law enforcement in several states say that the caller appears to be located internationally, perhaps in Ethiopia, and is using VoIP technology to systematically call in threats to targeted schools.

WIRED traced six phone numbers used in the hoax calls to a service called TextNow, a platform that allows users to anonymously place calls using US phone numbers. Unlike with traditional cellular service, where a provider might need a credit card and address to sign up for service, TextNow customers need to provide only an email address to begin making calls. That drastically limits the information the company is able to provide to law enforcement.

According to the October FBI memo, TextNow has provided investigators with subscriber information. The memo also says that an email account behind at least one of the hoax calls was linked to previous hoax 911 calls and that the account had connected to TextNow through the Ethiopian Telecommunications Company, which is owned by the Ethiopian government.

Source

Wired