Whether you want to turn off link previews or block unwanted FaceTime calls, here's what you need to know.

Apple prides itself on the security measures built into its software and hardware—and it continues to add new protections and safeguards over time. Lockdown Mode is a new feature heading to iPhones, iPads, and Macs later this year, and it promises to protect your devices from "highly targeted cyberattacks."

As you might surmise from the name, Lockdown Mode is a bit like closing the shutters, double-bolting the doors, and turning off all the lights in your home. It severely restricts the kinds of activity allowed on your devices, the logic being that if something unwanted has gained access, the damage will be limited.

For example, attachments other than images get turned off in Messages, and link previews are disabled. Incoming FaceTime calls from unknown numbers are blocked, as are wired connections with other hardware and accessories. Shared albums are removed from the Photos app, and new shared album invitations are blocked.

On a more technical level, a number of web technologies are turned off, including just-in-time (JIT) JavaScript compilation (where code is run and compiled at the same time.) In addition, configuration profiles (for work or school for example) can't be installed.

Lockdown Mode will be arriving on iPhones with iOS 16.

Courtesy of Apple

Lockdown Mode is disabled by default but can be enabled on an iPhone by going to **Settings**, then **Privacy and Security**, then **Lockdown Mode**. Turning it on or off requires a system reboot and the device's PIN. While Apple is describing the feature as something for users at risk from "state-sponsored mercenary spyware"—which sounds like high-profile targets—anyone will be able to switch it on for additional protection.

"Lockdown Mode is an extreme, optional protection that should only be used if you believe you may be personally targeted by a highly sophisticated cyberattack," is the way that Apple puts it in its support documentation. "Most people are never targeted by attacks of this nature."

As Apple explains, the overall idea is to reduce the attack surface that malware and spyware have access to. Tools including the Pegasus spyware package developed by the NSO Group have the potential to read texts, track calls, collect passwords, monitor a user's location, and more—and some require no interaction from the user.

With Pegasus, for example, a WhatsApp call to the target device is all it takes for the spyware to start its work, even if the call isn't answered. It's worth noting that this particular piece of spyware is blocked from running on devices with iOS 15 or higher installed, but there are plenty of other threats still out there, and plenty more that will be developed in the future.

With Lockdown Mode enabled, it should be much harder for spyware to take root in the first place. If a device has already been compromised, the mode will limit the impact that the malicious code can have. You might want to turn it on while traveling, for example, or if you've noticed any suspicious activity on your smartphone.

Turning Lockdown Mode on or off requires a full device reset.

Courtesy of Apple

Apple says it's going to continue to strengthen Lockdown Mode with additional features over time, and it has also announced a related bug bounty program: Anyone who manages to discover a security vulnerability in the Lockdown Mode protections is eligible for a payout from Apple of up to $2 million. Further funds are being made available for organizations that are fighting back against spyware and cyberattacks.

Those funds will be distributed by representatives from a number of interested parties, including The Engine Room, Amnesty Tech, Access Now, and the Citizen Lab, a security research group operating out of the University of Toronto in Canada.

"There is now undeniable evidence from the research of the Citizen Lab and other organizations that the mercenary surveillance industry is facilitating the spread of authoritarian practices and massive human rights abuses worldwide," says Ron Deibert, the director of the Citizen Lab.

We're expecting iOS 16 to launch alongside the new iPhones in September (and iPadOS 16 and macOS Ventura should appear around the same time.) Other security features coming with the update include a Safety Check feature for resetting access to other individuals (useful in domestic and partner violence situations), and Apple will also begin to push out security patches in between major software updates.

How to Use Lockdown Mode in iOS 16 to Make Your Phone More Secure

Plus: A crypto-heist extravaganza, a peek at an NSO spyware dashboard, and more.

Cryptocurrency tracing has become a key tool for police investigating everything from fraud and ransomware to child abuse. But its accuracy may soon be put to the test.

This week, we reported on new court filings from the legal team representing Roman Sterlingov, who’s been in jail for 15 months, accused of laundering $336 million in cryptocurrency as the alleged owner and operator of dark-web crypto mixer Bitcoin Fog. Sterlingov not only maintains he is innocent, but his defense attorney claims that the blockchain analysis that served as evidence that Sterlingov set up Bitcoin Fog is flawed.

Elsewhere, we highlighted Microsoft’s newly bolstered Morse bug-hunting team, which aims to catch flaws in the company’s software before they cause problems for the company’s 1 billion users. We dove into the spectacular failure of a new post-quantum encryption algorithm. We listed all the big security updates you need to be on top of from July, and we detailed all the data that Amazon’s Ring cameras collect about you.

Finally, a new report from cybersecurity company Mandiant found an attack on Albania’s government has the hallmarks of state-sponsored Iranian hacking—a notable moment of escalation in the history of cyberwar, given that Albania is a NATO member. And we got into the weeds of a Slack error that exposed hashed passwords for five years.

But that’s not all. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

This is not a test. Software used to transmit US government-issued emergency alerts on television and radio contains flaws that could allow an attacker to broadcast false messages, according to the Federal Emergency Management Agency and the security researcher who found the vulnerabilities. The company that makes the software, Digital Alert Systems, has issued patches, and FEMA has alerted the TV and radio networks that use the software to update their devices immediately. Of course, patches may not be universally adopted, leaving the system at risk. There’s no evidence that an attacker has exploited the flaws so far. But considering the mayhem false emergency alerts can cause, we’ll just have to hope that it stays that way.

One major theft of cryptocurrency in a week would be bad, and this week saw two. First, thanks to a flaw in the Nomad bridge—a type of application that lets users move digital tokens across blockchains that are prime hacker targets—“hundreds” of people were able to steal a collective $190 million in cryptocurrencies. Nomad now says that anyone who returns 90 percent of the funds they swiped will be considered a “white hat” and can keep the remaining 10 percent as a bounty. Some $22 million of the stolen funds had been recovered so far.

The second crypto hack of the week came just a day later, on Tuesday night, with hackers draining around 8,000 “hot” wallets (cryptocurrency storage apps that are connected to the internet) connected to the Solana ecosystem, allowing them to steal around $5 million worth of crypto. Solana said in a tweet that the exploit was due to a bug in “software used by several software wallets popular among users of the network,” not the Solana network or its cryptography.

It’s one thing to be told what NSO Group’s spyware can do, but it’s quite another to see it for yourself. Reporters at Israel’s _Haaretz_ got their hands on never-before-seen screenshots of Syaphan, a prototype of NSO’s now-infamous Pegasus spyware, which has retained much of the look and functionality of its precursor. The screenshots show that operators have the ability to access call logs and messages and remotely enable cameras and microphones to turn an infected device into a real-time spying tool.

Government use of Pegasus and other spyware has resulted in a growing number of scandals, particularly in Europe. Yesterday, Panagiotis Kontoleon, the head of Greece’s intelligence service, and Grigoris Dimitriadis, general secretary of the prime minister’s office, resigned. Their departures follow a complaint filed by Nikos Androulakis, the head of the socialist PASOK party, who alleged that his phone had been targeted by Predator spyware created by Cytrox, which is based in neighboring North Macedonia. Greece’s prime minister’s office maintains, however, that the resignations and the spyware allegations are unconnected. “In no case does it have anything to do with Predator (spyware), to which neither he nor the government are in any way connected, as has been categorically stated,” it said in a statement.

Remember a few months ago when everyone was mad at DuckDuckGo? Well, that thing you were angry about has now been (mostly) fixed, according to the company. Back in May, security researcher Zach Edwards found that DuckDuckGo’s privacy browsers—not its search engine, for which the company is better known—allowed some third-party Microsoft tracking scripts. DuckDuckGo, which has a partnership with Microsoft, says it has expanded its 3rd-Party Tracker Loading Protection to include 21 more domains, thus blocking the bulk of Microsoft tracking scripts on websites accessed via its mobile DuckDuckGo Privacy Browser or while using its Privacy Essentials extension, which can be used with all major browsers. However, DuckDuckGo will still allow advertisers to track clicks from DuckDuckGo through scripts from the bat.bing.com domain. Is it perfect? No—even DuckDuckGo admits that. But it’s still a privacy improvement over mainstream browsers and search engines.

The US Emergency Alert System Has Dangerous Flaws

Now that Charter has reached settlements with major record labels, it’s unclear whether the cable provider will pull the plug on users who pirate music.

Charter Communications has agreed to settle piracy lawsuits filed by the major record labels, which accused the cable internet provider of failing to terminate the accounts of subscribers who illegally download copyrighted songs.

Sony, Universal, Warner, and their various subsidiaries sued Charter in US District Court in Colorado in March 2019 in a suit that claimed the ISP helps subscribers pirate music by selling packages with higher internet speeds. They filed another lawsuit against Charter in the same court in August 2021.

Both cases were settled. The record labels and Charter told the court of their settlements on August 2 in filings that said, “The Parties hereby notify the Court that they have resolved the above-captioned action.” Upon the settlements, the court vacated the pending trials and asked the parties to submit dismissal papers within 28 days.

Charter subsidiary Bright House Networks also settled a similar lawsuit in US District Court for the Middle District of Florida this week. The record labels’ case in Florida was settled one day before a scheduled trial, as TorrentFreak reported on August 2. The case was dismissed with prejudice after the settlement.

No details on any of the settlements were given in the documents notifying the courts. A three-week jury trial in one of the Colorado cases was scheduled to begin in June 2023 but is no longer needed.

The question for internet users is whether the settlements mean that Charter will be more aggressive in terminating subscribers who illegally download copyrighted material. Charter declined to comment when Ars Technica asked whether it agreed to increase account terminations of subscribers accused of piracy. Ars Technica also contacted the big three record labels and will update this article if they provide any information on the settlements.

$1B Cox Verdict May Force ISPs to Cut Off Subscribers

Even if the settlements have no specific provision on terminating subscribers, Charter presumably has to pay the record labels to settle the claims. That could make the country’s second-biggest ISP more likely to terminate subscribers accused of piracy in order to prevent future lawsuits.

A jury ruled in December 2019 that Cox must pay $1 billion in damages to the major record labels in a case filed in US District Court for the Eastern District of Virginia. That decision raised alarm bells for the Electronic Frontier Foundation (EFF), the Center For Democracy and Technology, the American Library Association, the Association of College and Research Libraries, the Association of Research Libraries, and consumer-advocacy group Public Knowledge.

Those groups warned in a June 2021 court filing that the verdict, if not overturned, “will force ISPs to terminate more subscribers with less justification or risk staggering liability.” The US Court of Appeals for the Fourth Circuit heard oral arguments in March 2022 and has not yet issued a ruling.

Charter Motion to Dismiss Denied

In the Colorado court, the record labels’ complaint said Charter “has knowingly contributed to, and reaped substantial profits from, massive copyright infringement committed by thousands of its subscribers. Charter has insisted on doing nothing—despite receiving thousands of notices that detailed the illegal activity of its subscribers, despite its clear legal obligation to address the widespread, illegal downloading of copyrighted works on its internet services, and despite being sued previously by Plaintiffs for similar conduct.”

Charter argued in a motion to dismiss the case that “a failure to terminate a customer’s access to the internet based solely upon unverified (and unverifiable) notices alleging past infringement does not demonstrate the requisite intent by an ISP to encourage infringement.” Charter said it has a “policy to not terminate customer accounts based solely upon the receipt of notices containing unverifiable accusations of infringement.”

Charter also wrote that “plaintiffs do not (and cannot) allege that termination restricts access to the infringing content. It is common sense that terminating a customer’s internet connection does not prevent a customer from finding another source of Internet access, nor does it impact the availability of the allegedly infringing content hosted via peer-to-peer networks or programs. Charter has no more ability to block access to peer-to-peer networks than a subscriber's electric company.” Charter’s motion to dismiss the case was denied, and the company ultimately chose not to go to trial.

In Florida, the judge dismissed the record labels’ claim for vicarious liability, but the industry’s complaint also sought damages for vicarious copyright infringement.

_Disclosure: The Advance/Newhouse Partnership, which owns 12.4 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica and WIRED._

_This story originally appeared on_ _Ars Technica__._

An ISP Settled Piracy Lawsuits. Could Users Take the Hit?

The exposure of cryptographically scrambled passwords isn’t a worst-case scenario—but it isn’t great, either.

The office communication platform Slack is known for being easy and intuitive to use. But the company said on Friday that one of its low-friction features contained a vulnerability, now fixed, that exposed cryptographically scrambled versions of some users' passwords. 

When users created or revoked a link—known as a “shared invite link”—that others could use to sign up for a given Slack workspace, the command also inadvertently transmitted the link creator's hashed password to other members of that workspace. The flaw impacted the password of anyone who made or scrubbed a shared invite link over a five-year period, between April 17, 2017, and July 17, 2022.

Slack, which is now owned by Salesforce, says a security researcher disclosed the bug to the company on July 17, 2022. The errant passwords weren't visible anywhere in Slack, the company notes, and could have only been apprehended by someone actively monitoring relevant encrypted network traffic from Slack's servers. Though the company says it's unlikely that the actual content of any passwords were compromised as a result of the flaw, it notified impacted users on Thursday and forced password resets for all of them. 

Slack said the situation impacted about 0.5 percent of its users. In 2019 the company said it had more than 10 million daily active users, which would mean roughly 50,000 notifications. By now, the company may have nearly doubled that number of users. Some users who had passwords exposed throughout the five years may not still be Slack users today.

“We immediately took steps to implement a fix and released an update the same day the bug was discovered, on July 17th, 2022,” the company said in a statement. “Slack has informed all impacted customers and the passwords for impacted users have been reset.”

The company did not respond to questions from WIRED by press time about which hashing algorithm it used on the passwords or whether the incident has prompted broader assessments of Slack's password-management architecture.

“It's unfortunate that in 2022 we're still seeing bugs that are clearly the result of failed threat modeling,” says Jake Williams, director of cyber-threat intelligence at the security firm Scythe. “While applications like Slack definitely perform security testing, bugs like this that only come up in edge case functionality still get missed. And obviously, the stakes are very high when it comes to sensitive data like passwords.”

The situation underscores the challenge of designing flexible and usable web applications that also silo and limit access to high-value data like passwords. If you received a notification from Slack, change your password, and make sure you have two-factor authentication turned on. You can also view the access logs for your account.

A Slack Bug Exposed Some Users’ Hashed Passwords for 5 Years

The popular security devices are tracking (and sharing) more than you might think.

Jolynn Dellinger, a senior lecturing fellow focusing on privacy and ethics at Duke University’s school of law, says recording audio when someone is on the street is a “serious problem” for privacy and may change how people behave. “We operate with a sense of obscurity, even in public,” Dellinger says. “We are in danger of increasing surveillance of everyday life in a way that is not consistent with either our expected views or really what’s best for society.” In October 2021, a British woman won a court case that said her neighbor’s Ring cameras, which overlooked her house and garden, broke data laws.

Ring’s privacy policy says it can save videos of subscribers to its Ring Protect Plan, a paid service that provides an archive of 180 days of video and audio captured. The company says people can log in to the service to delete the videos, but the company may ultimately keep them anyway. “Deleted Content and Ring Protect Recordings may be stored by Ring in order to comply with certain legal obligations and are not retrievable without a valid court order,” the privacy policy says.

Ring can also keep videos shared to its Neighbors’ app—an app where people and law enforcement agencies can share alerts about “crimes” and post their videos of what is happening around the homes. (There are rules about what people are allowed to post.)

Ring’s privacy policy and terms of service allow it to use all this information it collects in multiple ways. It lists 14 ways the company can use your data—from improving the service Ring provides and protecting against fraud to conducting consumer research and complying with legal requirements. Its privacy policy includes the ambiguous statement: “We also may use the personal information we collect about you in other ways for which we provide specific notice at the time of collection and obtain your consent if required by applicable law.” Ring spokesperson Sarah Rall says this could apply if the company added features or use cases that are not already covered by its privacy policy. “We would provide additional notice or get permission as needed,” Rall says.

While Ring’s privacy policies apply to those who purchase its devices, people who are captured in footage or audio don’t have a chance to agree to them. “Privacy, security, and customer control are foundational to Ring, and we take the protection of our customers’ personal and account information seriously,” Rall says.

Ultimately, you agree to give Ring permission to control the “content” you share—including audio and video—while you own the intellectual property to it. The company’s terms of service say you give it an “unlimited, irrevocable, fee free and royalty-free, perpetual, worldwide right” to store, use, copy, or modify content you share through Neighbors or elsewhere online. (Audio recording can be turned off in Ring’s settings.)

“When I went out to buy a security camera last year, I looked for ones only that did local storage,” says Jen Caltrider, the lead researcher on Mozilla’s Privacy Not Included, which evaluates the privacy and security of products. Caltrider says people should try to keep as much control of their data as possible and not store files in the cloud unless they need to. “I don’t want any company having this data that I can’t control. I want to be able to control it.”

How Ring Works With Police

Ring’s deals with police forces—both in the US and the UK—have proved controversial. For years, the company has partnered with law enforcement agencies, providing them with cameras and doorbells that can be given to residents. By the start of 2021, Ring had partnered with more than 2,000 US law enforcement and fire departments. Documents have shown how Ring also controls the public messaging of police departments it has partnered with. “There is nothing mandating Ring build a tool that is easily accessible and helpful to police,” Guariglia says.

Rings’ terms of service say that the company may “access, use, preserve and/or disclose” videos and audio to “law enforcement authorities, government officials, and/or third parties” if it is legally required to do so or needs to in order to enforce its terms of service or address security issues. Government officials could include any “regulatory agency or legislative committee that issues a legally binding request for information,” Rall says. For the six months between January and June 2022, Ring says it had more than 3,500 law enforcement requests in the US.

All the Data Amazon's Ring Cameras Collect About You

A Tehran-linked hack of a NATO member marks a significant escalation against the backdrop of US-Iran nuclear talks.

In mid-July, a cyberattack on the Albanian government knocked out state websites and public services for hours. With Russia’s war raging in Ukraine, the Kremlin might seem like the likeliest suspect. But research published on Thursday by the threat intelligence firm Mandiant attributes the attack to Iran. And while Tehran’s espionage operations and digital meddling have shown up all over the world, Mandiant researchers say that a disruptive attack from Iran on a NATO member is a noteworthy escalation.

The digital attacks targeting Albania on July 17 came ahead of the “World Summit of Free Iran,” a conference scheduled to convene in the town of Manëz in western Albania on July 23 and 24. The summit was affiliated with the Iranian opposition group Mujahideen-e-Khalq, or the People’s Mojahedin Organization of Iran (often abbreviated MEK, PMOI, or MKO). The conference was postponed the day before it was set to begin because of reported, unspecified “terrorist” threats.

Mandiant researchers say that attackers deployed ransomware from the Roadsweep family and may have also utilized a previously unknown backdoor, dubbed Chimneysweep, as well as a new strain of the Zeroclear wiper. Past use of similar malware, the timing of the attacks, other clues from the Roadsweep ransomware note, and activity from actors claiming responsibility for the attacks on Telegram all point to Iran, Mandiant says.

“This is an aggressive escalatory step that we have to recognize,” says John Hultquist, Mandiant’s vice president of intelligence. “Iranian espionage happens all the time all over the world. The difference here is this isn’t espionage. These are disruptive attacks, which affect the lives of everyday Albanians who live within the NATO alliance. And it was essentially a coercive attack to force the hand of the government."

Iran has conducted aggressive hacking campaigns in the Middle East and particularly in Israel, and its state-backed hackers have penetrated and probed manufacturing, supply, and critical infrastructure organizations. In November 2021, the US and Australian governments warned that Iranian hackers were actively working to gain access to an array of networks related to transportation, health care, and public health entities, among others. “These Iranian government-sponsored APT actors can leverage this access for follow-on operations, such as data exfiltration or encryption, ransomware, and extortion,” the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency wrote at the time.

Tehran has limited how far its attacks have gone, though, largely keeping to data exfiltration and reconnaissance on the global stage. The country has, however, participated in influence operations, disinformation campaigns, and efforts to meddle in foreign elections, including targeting the US.

“We’ve become used to seeing Iran being aggressive in the Middle East where that activity just has never stopped, but outside of the Middle East they’ve been far more restrained,” Hultquist says. “I’m concerned that they may be more willing to leverage their capability outside of the region. And they clearly have no qualms about targeting NATO states, which suggests to me that whatever deterrents we believe exist between us and them may not exist at all.”

With Iran claiming that it now has the ability to produce nuclear warheads, and representatives from the country meeting with US officials in Vienna about a possible revival of the 2015 nuclear deal between the countries, any signal about Iran’s possible intentions and risk tolerance when it comes to dealing with NATO are significant.

An Attack on Albanian Government Suggests New Iranian Aggression

What's it like to be responsible for a billion people's digital security? Just ask the company's Morse researchers.

As a rush of cybercriminals, state-backed hackers, and scammers continue to flood the zone with digital attacks and aggressive campaigns worldwide, it’s no surprise that the maker of the ubiquitous Windows operating system is focused on security defense. Microsoft’s Patch Tuesday update releases frequently contain fixes for critical vulnerabilities, including those that are actively being exploited by attackers out in the world.

The company already has the requisite groups to hunt for weaknesses in its code (the “red team") and develop mitigations (the “blue team”). But recently, that format evolved again to promote more collaboration and interdisciplinary work in the hopes of catching even more mistakes and flaws before things start to spiral. Known as Microsoft Offensive Research & Security Engineering, or Morse, the department combines the red team, blue team, and so-called green team, which focuses on finding flaws or taking weaknesses the red team has found and fixing them more systemically through changes to how things are done within an organization.

“People are convinced that you cannot move forward without investing in security,” says David Weston, Microsoft’s vice president of enterprise and operating system security who’s been at the company for 10 years. “I’ve been in security for a very long time. For most of my career, we were thought of as annoying. Now, if anything, leaders are coming to me and saying, ‘Dave, am I OK? Have we done everything we can?’ That’s been a significant change.”

Morse has been working to promote safe coding practices across Microsoft so fewer bugs end up in the company’s software in the first place. OneFuzz, an open source Azure testing framework, allows Microsoft developers to be constantly, automatically pelting their code with all sorts of unusual use cases to ferret out flaws that wouldn’t be noticeable if the software was only being used exactly as intended.

The combined team has also been at the forefront of promoting the use of safer programming languages (like Rust) across the company. And they’ve advocated embedding security analysis tools directly into the real software compiler used in the company’s production workflow. That change has been impactful, Weston says, because it means developers aren’t doing hypothetical analysis in a simulated environment where some bugs might be overlooked at a step removed from real production.

The Morse team says the shift toward proactive security has led to real progress. In a recent example, Morse members were vetting historic software—an important part of the group’s job, since so much of the Windows codebase was developed before these expanded security reviews. While examining how Microsoft had implemented Transport Layer Security 1.3, the foundational cryptographic protocol used across networks like the internet for secure communication, Morse discovered a remotely exploitable bug that could have allowed attackers to access targets’ devices.

As Mitch Adair, Microsoft’s principal security lead for Cloud Security, put it: “It would have been as bad as it gets. TLS is used to secure basically every single service product that Microsoft uses.”

The stakes are indescribably high when your job is to catch mistakes before someone else does in a product that’s used by more than a billion people around the world. Anything you let slip by could play a role in the next global cybersecurity crisis. But Weston says the Morse team self-selects for people who view that reality as a driving motivation, rather than a paralyzing specter.

“This is a game of inches; you can be amazing 99.9 percent of the time and introduce the wrong code at the wrong time and it can have dire consequences,” Weston says. “If you work on the top of a tall building all day, you don’t even notice it. But one day you might look down and go, ‘whoa, I’m pretty high up here, that’s scary.' But there are only a couple of places where you can do things at a billion scale, so the nice thing is we rarely have someone coming in who doesn’t find that exciting rather than scary.”

Perhaps most importantly, Weston says the tradeoff for living with Microsoft’s scale and the accompanying responsibility is that anything is possible at the company in a way that is only true at a small handful of the biggest tech giants.

“In some companies it’s like, well, we build a web application, we’re sort of constrained on the tools we have or the expertise in the company,” he says. “At Microsoft, we have everything from silicon to compilers to the operating system. You don’t really have good excuses for why you can’t do something.”

For the Morse team, though, this means there’s no room to squander that rarified position.

The Microsoft Team Racing to Catch Bugs Before They Happen

SIKE was a contender for post-quantum-computing encryption. It took researchers an hour and a single PC to break it.

In the U.S. government's ongoing campaign to protect data in the age of quantum computers, a new and powerful attack that used a single traditional computer to completely break a fourth-round candidate highlights the risks involved in standardizing the next generation of encryption algorithms.

Last month, the US National Institute of Standards and Technology (NIST), selected four post-quantum-computing encryption algorithms to replace algorithms like RSA, Diffie-Hellman, and elliptic curve Diffie-Hellman, which are unable to withstand attacks from a quantum computer.

In the same move, NIST advanced four additional algorithms as potential replacements pending further testing, in hopes one or more of them may also be suitable encryption alternatives in a post-quantum world. The new attack breaks SIKE, which is one of the latter four additional algorithms. The attack has no impact on the four PQC algorithms selected by NIST as approved standards, all of which rely on completely different mathematical techniques than SIKE.

Getting Totally SIKEd

SIKE—short for supersingular isogeny key encapsulation—is now likely out of the running, thanks to research that was published over the weekend by researchers from the Computer Security and Industrial Cryptography group at KU Leuven. The paper, titled “An Efficient Key Recovery Attack on SIDH (Preliminary Version),” described a technique that uses complex mathematics and a single traditional PC to recover the encryption keys protecting the SIKE-protected transactions. The entire process requires only about an hour’s time. The feat makes the researchers, Wouter Castryck and Thomas Decru, eligible for a $50,000 reward from NIST.

“The newly uncovered weakness is clearly a major blow to SIKE,” David Jao, a professor at the University of Waterloo and co-inventor of SIKE, wrote in an email. “The attack is really unexpected.”

The advent of public-key encryption in the 1970s was a major breakthrough, because it allowed parties who had never met to securely trade encrypted material that couldn’t be broken by an adversary. Public-key encryption relies on asymmetric keys, with one private key used to decrypt messages and a separate public key for encrypting. Users make their public key widely available. As long as their private key remains secret, the scheme remains secure.

In practice, public-key cryptography can often be unwieldy, so many systems rely on key encapsulation mechanisms, which allow parties who have never met before to jointly agree on a symmetric key over a public medium such as the internet. In contrast to symmetric-key algorithms, key encapsulation mechanisms in use today are easily broken by quantum computers. SIKE, before the new attack, was thought to avoid such vulnerabilities by using a complex mathematical construction known as a supersingular isogeny graph.

The cornerstone of SIKE is a protocol called SIDH, short for supersingular isogeny Diffie-Hellman. The research paper published over the weekend shows how SIDH is vulnerable to a theorem known as “glue-and-split” developed by mathematician Ernst Kani in 1997, as well as tools devised by fellow mathematicians Everett W. Howe, Franck Leprévost, and Bjorn Poonen in 2000. The new technique builds on what’s known as the GPST adaptive attack, described in a 2016 paper. The math behind the latest attack is guaranteed to be impenetrable to most non-mathematicians. Here’s about as close as you’re going to get:

“The attack exploits the fact that SIDH has auxiliary points and that the degree of the secret isogeny is known,” Steven Galbraith, a University of Auckland mathematics professor and the “G” in the GPST adaptive attack, explained in a short write-up on the new attack. “The auxiliary points in SIDH have always been an annoyance and a potential weakness, and they have been exploited for fault attacks, the GPST adaptive attack, torsion point attacks, etc.”

More important than understanding the math, Jonathan Katz, an IEEE member and professor in the Department of Computer Science at the University of Maryland, wrote in an email: “The attack is entirely classical, and does not require quantum computers at all.”

Lessons Learned

SIKE is the second NIST-designated PQC candidate to be invalidated this year. In February, IBM postdoc researcher Ward Beullens published research that broke Rainbow, a cryptographic signature scheme with its security, according to Cryptomathic, “relying on the hardness of the problem of solving a large system of multivariate quadratic equations over a finite field.”

NIST’s PQC replacement campaign has been running for five years. Here’s a brief history:

*   1st round (2017)—69 candidates
*   2nd round (2019)—26 surviving candidates
*   3rd round (2020)—7 finalists, 8 alternates
*   4th round (2022)—3 finalists and 1 alternate selected as standards. SIKE and three additional alternates advanced to a fourth round.

Rainbow fell during round 3. SIKE had made it until round 4.

Katz continued:

_It is perhaps a bit concerning that this is the second example in the past six months of a scheme that made it to the 3rd round of the NIST review process before being completely broken using a classical algorithm. (The earlier example was Rainbow, which was broken in February.) Three of the four PQC schemes rely on relatively new assumptions whose exact difficulty is not well understood, so what the latest attack indicates is that we perhaps still need to be cautious/conservative with the standardization process going forward._

I asked Jao, the SIKE co-inventor, why the weakness had come to light only now, in a relatively later stage of its development. His answer was insightful. He said:

_It's true that the attack uses mathematics which was published in the 1990s and 2000s. In a sense, the attack doesn't require new mathematics; it could have been noticed at any time. One unexpected facet of the attack is that it uses genus 2 curves to attack elliptic curves (which are genus 1 curves). A connection between the two types of curves is quite unexpected. To give an example illustrating what I mean, for decades people have been trying to attack regular elliptic curve cryptography, including some who have tried using approaches based on genus 2 curves. None of these attempts has succeeded. So for this attempt to succeed in the realm of isogenies is an unexpected development._

_In general there is a lot of deep mathematics which has been published in the mathematical literature but which is not well understood by cryptographers. I lump myself into the category of those many researchers who work in cryptography but do not understand as much mathematics as we really should. So sometimes all it takes is someone who recognizes the applicability of existing theoretical math to these new cryptosystems. That is what happened here._

The version of SIKE submitted to NIST used a single step to generate the key. A possible variant of SIKE could be constructed to take two steps. Jao says it’s possible that this latter variant might not be susceptible to the math causing this breakage. For now, though, SIKE is dead, at least in the current running. The schedule for the remaining three candidates is currently unknown.

_This story originally appeared on_ _Ars Technica__._

A New Attack Easily Knocked Out a Potential Encryption Algorithm

Roman Sterlingov, accused of laundering $336 million, is proclaiming his innocence—and challenging a key investigative tool.

Tools to trace cryptocurrencies have, over just the past several years, allowed law enforcement agencies to convict dark-web black-market administrators, recover millions in ransomware payments, seize billions in stolen bitcoins, and even disrupt networks of child abuse. Now one criminal defendant claims those same tools have also unjustly put him in jail for more than 15 months.

In the spring of 2021, Roman Sterlingov, a 33-year-old Swedish-Russian national, was arrested by Internal Revenue Service criminal investigators at the Los Angeles airport and was accused of creating and operating Bitcoin Fog, a bitcoin “mixing” service on the dark web that took in coins from its users and returned others with the intention of preventing forensic accountants from following that money’s trail. The US Justice Department accuses Sterlingov of no less than $336 million in money laundering over Bitcoin Fog’s decade online.

Now, Sterlingov’s legal team, led by the well-known hacker defense attorney Tor Ekeland, has fired back: They’re claiming in a series of legal motions filed late yesterday that Sterlingov is innocent and vowing to take his case to trial. In doing so, Sterlingov’s defense says, they plan to show not only that he never ran Bitcoin Fog but also that the blockchain analysis techniques used to pin the case on him were faulty, leading to his wrongful arrest and a lost year of his life.

"I did not create Bitcoin Fog. I was never an administrator of Bitcoin Fog,” Sterlingov told WIRED, speaking from a Northern Virginia jail. "I’ve been here for more than a year now. I’m really perplexed at the system that could put me in here, at what they can do to an innocent man. It’s a Kafkaesque nightmare."

Unlike in some more-clear-cut investigations of criminal use of cryptocurrency, prosecutors in Sterlingov’s case haven’t pointed to any smoking-gun digital evidence retrieved from Sterlingov’s possessions or devices when he was arrested during his trip to the US last year. Instead, the statement of facts released when charges against Sterlingov became public in April 2021 detailed a combination of blockchain-based cryptocurrency tracing, IP address matching, and online account information links. The IRS says that collection of evidence ties Sterlingov to Bitcoin Fog’s creation in 2011 and shows—through Bitcoin tracing in particular—that he continued to receive profits from the service as late as 2019.

“Where’s the corroborating evidence?” asks Sterlingov’s defense attorney Ekeland. He runs through the inventory of items found on Sterlingov at the time of his arrest, which he says included laptops, hard drives, backup codes for his accounts, Bitcoin debit cards, and a customized smartphone for storing cryptocurrency. “But you know what’s not found when they catch him traveling? A shred of evidence that he operated Bitcoin Fog. No witnesses, no logs, no communications. They’re pinning it on a multi-layer guessing game.”

The Department of Justice did not yet respond to WIRED’s request for comment. The IRS declined to comment on pending litigation.

Sterlingov and his lawyers yesterday filed a motion to dismiss, a motion for a bill of particulars, a motion to free seized assets, and a motion to reconsider pretrial detention, among other items. The DOJ has produced more than three terabytes of data related to the case during discovery. The defense alleges that the sheer volume of information is difficult to parse but that nothing in it seems to establish a direct connection between Sterlingov and the creation or operation of Bitcoin Fog. And they further argue that the digital forensic analysis the prosecution has shared is flawed and opaque at best.

If the prosecution doesn’t produce clear evidence as Sterlingov’s case unfolds, it may have to rely on the more indirect digital connections between Sterlingov and Bitcoin Fog that it describes in the statement of facts assembled by the IRS’s criminal investigations division, much of which was based on cryptocurrency tracing techniques. That statement shows a trail of financial transactions from 2011 allegedly linking Sterlingov to payments made to register the Bitcoinfog.com domain, which was not Bitcoin Fog’s actual dark-web site but a traditional website that advertised it.

The funds to pay for that domain traveled through several accounts and were eventually exchanged from Bitcoin for the now-defunct digital currency Liberty Reserve, according to prosecutors. But the IRS says IP addresses, blockchain data, and phone numbers linked with the various accounts all connect the payments to Sterlingov. A Russian-language document in Sterlingov’s Google Account also described a method for obfuscating payments similar to the one he’s accused of using for that domain registration.

Sterlingov says he “can’t remember” if he created Bitcoinfog.com and points out that he worked at the time as a web designer for a Swedish marketing company, Capo Marknadskommunikation. “That was 11 years ago,” Sterlingov says. “It’s really hard for me to say anything specific."

Even if the government _can_ prove that Sterlingov created a website to promote Bitcoinfog.com in 2011, however—and Ekeland argues even that is based on faulty IP address connections that came from Stertlingov’s use of a VPN—Ekeland points out that’s very different from running the Bitcoin Fog dark-web service for the subsequent decade it remained online and laundered criminal proceeds.

To show Sterlingov’s deeper connection to Bitcoin Fog beyond a domain registration, the IRS says it used blockchain analysis to trace Bitcoin payments Sterlingov allegedly made as “test transactions” to the service in 2011 before it was publicly launched. Investigators also say that Sterlingov continued to receive revenue from Bitcoin Fog until 2019, also based on their observations of cryptocurrency payments recorded on the Bitcoin blockchain.

Ekeland counters that the defense hasn’t received any details of that blockchain analysis and points out that it was left out of the most recent superseding indictment against Sterlingov, which was filed last week. That means, he argues, that the government has based the core of its case on an unproven, relatively new form of forensics—one that he says led them to the wrong suspect. “Has it been peer-reviewed? No,” Ekeland says of blockchain analysis. “Is it generally accepted in the scientific community? No. Does it have a known error rate? No. It’s unverifiable. They can say total nonsense, and everyone has to take it on faith."

Ekeland says that discovery documents in the case show that the prosecution’s cryptocurrency tracing was performed with tools sold by Chainalysis, a New York–based blockchain analysis startup, along with consulting help from Excygent, a government contractor specializing in cybercriminal and cryptocurrency investigations, which Chainalysis acquired in 2021.

Ekeland argues that Chainalysis, valued at $8.6 billion in a recent investment round and frequently used in high-profile cybercriminal law enforcement investigations, had a conflict of interest in the case, given its financial dependence on US government contracts and a flow of former government investigators who have gone to work for Chainalysis. “This is a story of people profiteering and advancing their careers, throwing people in jail to promote their blockchain analysis tool that is junk science and doesn’t withstand any scrutiny,” says Ekeland. He adds that, based on the evidence provided in Sterlingov’s case, he believes “Chainalysis is the Theranos of blockchain analysis."

Chainalysis declined to comment about the motions filed yesterday, their broader implications, or Ekeland’s characterization of its work.

Sterlingov, for his part, says his cryptocurrency holdings—all of which were frozen at the time of his arrest—came not from Bitcoin Fog but from early investment in cryptocurrency. He concedes that he did send and receive payments to Bitcoin Fog as a user of the service seeking privacy, but says he didn’t use his bitcoins for anything illegal. “I think some of my transfers must have gotten mixed up with everything," he says.

Along with their motions, the defense filed two expert declarations with the court, one from cybersecurity researcher Chris Vickery and the other from intelligence analyst Eric Garland. The documents are meant to support Sterlingov and his lawyer’s accusations about the prosecution’s digital forensic analysis and Chainalysis and Excygent’s alleged conflicts of interest in investigating Sterlingov’s potential ties to Bitcoin Fog.

Sterlingov, who moved with his family from Voronezh, Russia, to Gothenburg, Sweden, when he was 14, also argues that as a Swedish citizen he should be tried in Sweden rather than the United States. He had flown to the US, he says, only to go to flight school to train as a commercial pilot. His defense has argued in Monday’s motions that the District of Columbia prosecutors charging Sterlingov have no venue to pursue the case, given that he has no connection to Washington, DC.

"I don’t understand how I’m in an American jail. I’ve never done business with America,” says Sterlingov. “I’m worried. I don’t know what’s going to happen. I’m thousands of miles from my home. If I were some kind of crypto criminal kingpin, which I’m not, Sweden could deal with me."

Furthermore, Sterlingov’s lawyers argue in their motion to dismiss that the statute of limitations has run out on the charges against him, since the alleged conduct at issue, including registering the Bitcoinfog.com domain and conducting particular Bitcoin transactions, occurred in 2011. The motion argues that three of the counts brought against Sterlingov have a five-year statute of limitations and that one has a six-year statute.

Given that blockchain analysis and cryptocurrency payment tracing techniques have matured over the past decade and have become central to many cybercriminal investigations in the US and worldwide, it is inevitable that their methodology and validity will be called into question and interrogated. Sterlingov’s case is taking the first step to establish that battleground.

Bitcoin Fog Case Could Put Cryptocurrency Tracing on Trial

Keep your logins locked down with our favorite apps for PC, Mac, Android, iPhone, and web browsers.

Bitwarden offers a paid upgrade account. The cheapest of the bunch, Bitwarden Premium, is $10 per year. That gets you 1 GB of encrypted file storage, two-factor authentication with devices like YubiKey, FIDO U2F, Duo, and a password hygiene and vault health report. Paying also gets you priority customer support.

_After signing up,_ _download the app_ _for Windows, MacOS, Android, iOS, or Linux. There are also browser extensions for_ _Firefox, Chrome, Safari, Edge, Vivaldi, and Brave__._

Best Full-Featured Manager

Courtesy of Dashlane

I first encountered Dashlane several years ago. Back then, it was the same as its competitors with no standout attributes. But recent updates have added several helpful features. One of the best is Site Breach Alerts, something other services have since added as well. Dashlane actively monitors the darker corners of the web, looking for leaked or stolen personal data, and then alerts you if your information has been compromised.

Setup and migration from another password manager is simple, and you’ll use a secret key to encrypt your passwords, much like 1Password’s setup process. In practice, Dashlane is very similar to the others in this list. The company did discontinue its desktop app earlier this year, moving to a web-based user interface, which is a little different than 1Password and Bitwarden. (The desktop apps officially shut down on January 10, 2022.) I primarily use passwords in the web browser anyway, and Dashlane has add-ons for all the major browsers, along with iOS and Android apps. If a desktop app is important to you, it’s something to be aware of. Dashlane offers a 30-day free trial, so you can test it out before committing.

_After signing up,_ _download the app_ _for Android and iOS, and grab the browser extensions for_ _Firefox, Chrome, and Edge__._

Best DIY Option (Self-Hosted)

Courtesy of KeePassXC

Want to retain more control over your data in the cloud? Try using a desktop application like KeePassXC. It stores encrypted versions of all your passwords into an encrypted digital vault that keeps you secure with a master password, a key file, or both. The difference is that instead of a hosted service like 1Password syncing it for you, you sync that database file yourself using a file-syncing service like Dropbox or Edward Snowden’s recommended service, SpiderOak. Once your file is in the cloud, you can access it on any device that has a KeePassXC client.

Why do it yourself? In a word: transparency. Like Bitwarden, KeepassXC is open source, which means its code can be and has been inspected for critical flaws.

_Download the_ _desktop app_ _for Windows, MacOS, or Linux and create your vault. There are also extensions for_ _Firefox__,_ _Edge__, and_ _Chrome__. It does not have official apps for your phone. Instead, the project recommends_ _KeePass2Android_ _or_ _Strongbox for iPhone__._

Another Option

Courtesy of NordPass

NordPass is a relatively new kid on the password manager block, but it comes from a company with significant pedigree. NordVPN is a well-known VPN provider, and the company brings to its password manager much of the ease of use and simplicity that made its VPN offering popular. The installation and setup process is a breeze. There are apps for every major platform (including Linux), browser, and device.

The free version of NordPass is limited to one device, and there’s no syncing available. There is a seven-day free trial of the premium version, which lets you test device syncing. But to get that for good, you’ll have to upgrade to the $36-a-year plan. (Like its VPN service, NordPass accepts payment in cryptocurrencies.)

Source

Wired