Tag: russia

As the Mastermind of Far-Right ‘Active Clubs’ Goes to Prison, His Violent Movement Goes Global

[ad_1]

American neo-Nazi Robert Rundo’s six-year “battle with the feds”—a fight that spans two dismissals, three appellate reversals, and an extradition and deportation from at least two countries—concludes today with his sentencing to federal prison for attacking ideological opponents at political rallies across California in 2017.

Along with several members of the Rise Above Movement, a fight club-cum-street gang Rundo cofounded with fellow extremist Ben Daley in Southern California during the peak of the alt-right movement, Rundo was convicted on 2018 charges of conspiracy to violate the federal Anti-Riot Act for training and planning a series of attacks on political opponents at rallies across California and Unite the Right in Virginia the year prior. While Rundo may be locked behind bars for years, the movement he created is running wild around the globe.

In the interceding years since his initial arrest, indictment, imprisonment, and flight from the US after his case was initially dismissed in 2019, Rundo helped mastermind an international network of RAM clones known as “Active Clubs.” A transnational alliance of far-right fight clubs that closely overlap with skinhead gangs and neofascist political movements in North America, Europe, the Antipodes, and South America, the Active Club network is proliferating internationally. There are dozens of Active Clubs in the United States, United Kingdom, Ireland, France, Germany, Holland, Scandinavia, Australia, and Colombia, according to the groups’ presence on Telegram and extremism researchers.

Seemingly harmless from the outside, Active Clubs are small groups of young men who go on hikes, train in combat sports, weight-lift, and build camaraderie—all part of the Rise Above Movement’s original program. But the darkness is in the details: The groups’ membership often overlaps with other extremist organizations like Patriot Front, criminal skinhead groups like the Hammerskins, and other violent extremists in foreign nations. Some US-based Active Clubs are branching out into political intimidation and violence, like the Rise Above Movement before them.

“I definitely do believe that in the future there needs to be a mass movement, a mass organization, but when it comes for that, do you really want a bunch of guys coming strictly from the online world to come join a mass movement without having any experience or skills?” Rundo said in a video posted online shortly before his March 2023 arrest in Bucharest, Romania. “Active clubs are a great local way to start guys off as they come from the online world into the real world, to learn actual skills.”

Hannah Gais, a senior research analyst at the Southern Poverty Law Center who has long researched Rundo and his associates, says the Active Club model stands out for its low barrier to entry, emphasis on positive community building to draw new blood from outside of extremist circles, and a ready-made international network. “The model has really made it easier to facilitate those transnational connections,” Gais says. “If you’re not an organization, then you can network with whoever you want.”

[ad_2]

Source link

December 13, 2024
US Officials Recommend Encryption Apps Amid Chinese Telecom Hacking

[ad_1]

A consortium of global law enforcement agencies led by Britain’s National Crime Agency announced a takedown operation this week against two major Russian money-laundering networks that process billions of dollars each year in more than 30 locations around the world. WIRED had exclusive access to the investigation, which uncovered new and troubling laundering techniques, particularly schemes to directly change cryptocurrency for cash. As the United States government scrambles to address China’s “Salt Typhoon” digital espionage campaign into US telecoms, two senators demanded this week that the Department of Defense investigate its failure to secure its own communications and address known vulnerabilities in US telecom infrastructure. Meanwhile, Signal Foundation president Meredith Whittaker spoke at WIRED’s The Big Interview event in San Francisco this week about Signal’s enduring commitment to bring private, end-to-end encrypted communication services to people all over the world regardless of geopolitical climate.

A new smartphone scanner from the mobile device security firm iVerify can quickly and easily detect spyware and has already flagged seven devices infected with the invasive Pegasus surveillance tool. Programmer Micah Lee built a tool to help you save and delete your X posts after he offended Elon Musk and was banned from the platform. And privacy advocate Nighat Dad is fighting to protect women from digital harassment in Pakistan after escaping from an abusive marriage.

The US Federal Trade Commission is targeting data brokers who it says unlawfully tracked protesters and US military personnel, but the enforcement efforts seem likely to trail off under the Trump administration. Similarly, the US Consumer Financial Protection Bureau has devised a strategy to impose new oversight on predatory data brokers, but the new administration may not continue the initiative. Some new laws are finally coming around the world in 2025 that will attempt to regulate the dysfunction of the digital advertising industry, but malicious advertising is still booming around the world and continues to play a big role in global scamming.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in-depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Remember how the US federal government spent much of the last three decades periodically decrying the dangers of strong, freely available encryption tools, arguing that because they enable criminals and terrorists, they should be outlawed or required to implement government-approved backdoors? As of this week, the government will never again be able to make that argument without privacy advocates pointing to a particular phone call where two officials recommended Americans use exactly those encryption tools to protect themselves amidst an ongoing massive breach of US telecoms by Chinese hackers.

In a briefing with reporters about the breach of no fewer than eight phone companies by the Chinese state-sponsored espionage hackers known as Salt Typhoon, officials from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI both said that amid the still-uncontrolled infiltration of US telecoms that have exposed calls and texts, Americans should use encryption apps to safeguard their privacy. “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication,” said Jeff Greene, CISA’s executive assistant director for cybersecurity. (Signal and WhatsApp, for instance, end-to-end encrypt calls and texts, though the officials didn’t name any particular apps.)

The recommendation amid what one senator has called “the worst telecom hack in our nation’s history” represents a stunning reversal from previous US officials’ rhetoric on encryption, and in particular the FBI’s repeated calls for access to backdoors in encryption. In fact, it was exactly this sort of government-approved wiretap capability requirement for US telecoms that the Salt Typhoon hackers in some cases exploited to access Americans communications.

The hacker group known as Secret Blizzard, Snake, or Turla, widely believed to work for Russia’s FSB intelligence agency, is known for using some of the most ingenious hacking techniques ever seen to spy on its victims. One of the tricks that’s now become its signature move: hacking the infrastructure of other hackers to stealthily piggyback on their access. This week Microsoft’s threat intelligence researchers and security firm Lumen Technologies revealed that Turla gained access to the servers of a Pakistan-based hacker group and used its visibility into victim networks to spy on government, military and intelligence targets in India and Afghanistan of interest to the Kremlin. In some cases, Turla hijacked the Pakistani hackers’ access to install their own malware, while in other instances they appear to have used the other group’s tools for even greater stealth and deniability. The incident marks the fourth known time since 2017, when it penetrated an Iranian hacker group’s command-and-control servers, that Turla has freeloaded on another hacker group’s infrastructure and tooling, according to Lumen.

The Russian government is known for turning a blind eye to cybercrime—until it doesn’t. This week 15 convicted members of the notorious dark web market Hydra learned the limits of that forbearance when they reportedly received prison sentences ranging from 8 years to 23 years, as well an unprecedented life sentence for the site’s creator Stanislav Moiseyev. Before it was taken down two years ago in a law enforcement operation led by IRS criminal investigators in the US and Germany’s BKA police agency, Hydra was a uniquely sprawling dark web marketplace, one that not only served as the post-Soviet world’s biggest online bazaar for narcotics but also a vast money laundering machine for crimes including ransomware, scams, and sanctions evasion. In total, Hydra enabled more than $5 billion dollars in dirty cryptocurrency transactions since 2015, according to crypto tracing firm Elliptic.

Russian law enforcement charged and arrested a software developer last week who is suspected of prolific contributions to multiple ransomware groups, including building malware to extort money from businesses and other targets. The suspect is reportedly Mikhail Matveev, or “Wazawaka,” who has worked as an affiliate with ransomware gangs like Conti, LockBit, Babuk, DarkSide, and Hive. Social media reports indicate that Matveev confirmed his indictment and said that he has been released from law enforcement custody on bail.

Russia’s prosecutor general did not name Matveev, but described charges last week against a 32-year-old hacker under Article 273 of Russia’s Criminal Code, which bans the creation or use of malware. The move came as Russia seemed to be sending some sort of message about its tolerance for cybercrime with the sentencing of the dark web marketplace Hydra’s staff, including a life sentence for its administrator. In 2023, the US government indicted and sanctioned Matveev.

In a disturbing scoop (one we didn’t cover last week due to the Thanksgiving holiday), Reuters reporters have revealed that the FBI is now investigating a lobbying consultancy hired by Exxon over the firm’s role in a hack-and-leak operation that targeted climate change activists. DCI Group, a lobbying firm hired at the time by Exxon, allegedly gave a list of target activists to a private investigator who then outsourced a hacking operation against those targets to mercenary hackers. After the private investigator—an Israeli man named Amit Forlit, who was later arrested in London and faces US hacking charges—allegedly gave the hacked material to DCI, it leaked the activists’ internal communications about climate change litigation against Exxon to the media, Reuters discovered. The FBI, according to Reuters, has determined that DCI also first previewed that material to Exxon before leaking it. “Those documents were directly employed by Exxon to come after me with all guns blazing,” one attorney working with the activist group, the Center for Climate Integrity, told Reuters. “It turned my life upside down.”

Exxon has denied knowing about any hacking activities and DCI told Reuters in a statement that “we direct all our employees and consultants to comply with the law.”

[ad_2]

Source link

December 7, 2024
She Was a Russian Socialite and Influencer. Cops Say She’s a Crypto Laundering Kingpin

[ad_1]

OFAC announced sanctions against the founder, as well as Elena Chirkinyan and Andrej Bradens, who also goes by the surname Carenoks, both of whom work for TGR—Chirkinyan is described as Rossi’s “second in command.” Four companies tied to Rossi and TGR have also been included on sanctions lists: TGR Partners Ltd, TGR Corporate Concierge, TGR DWC LLC, and Siam Expert Trading Company Ltd. The companies, on their websites, claim to provide a range of financial services, events management, and similar corporate services.

“What TGR will do is provide an interface to be able to take illicitly generated cash and put it into the legitimate banking system, although that might be in jurisdictions of risk for example,” Lyne from the NCA says. In 2023, the sanctions claim, TGR’s Chirkinyan allegedly helped transfer funds out of Russia, from Russian state-media media outfit RT, which has been widely sanctioned by Western governments, to help fund a Russian-language media organization in the UK.

However, the sanctioned TGR companies are likely the tip of a dense iceberg, with multiple legal identities linked to the brand name or company records. Archived versions of the now sanctioned TGR Partners’ website have in the last few years claimed the business has “partner” offices in the UK, Singapore, Russia, Ukraine, Turkey, the UAE, Latvia, Cyprus, Luxembourg, Bulgaria, and the US. (The most recent version of the website only includes the UK and UAE addresses.)

TGR Corporate Concierge, which was also sanctioned, was previously called TGR Wealth Solutions, according to public company records. Many of the businesses linked to TGR—which also includes those not sanctioned by officials—share the same phone numbers, legal addresses, and similar website designs, a WIRED review shows.

Bradens also owns at least 50 percent of Pullman Global Solutions LLC, a Wyoming-based entity, according to OFAC.

Rossi and Bradens did not immediately respond to requests for comment. Chirkinyan could not be immediately reached for comment.

The companies have a limited public presence. Many of the websites do not contain many specifics about what the businesses do and often include boilerplate-style text. The TGR Partners website also includes a peculiar series of blog posts from early 2020, listing the most expensive wines in the world, Europe’s best virtual museums and galleries, and the winners of the 2020 Oscars. “I think that is very typical of traditional money-laundering typologies, where a website will simply be lifted, a new company will be put on there, and the images and text won’t necessarily correlate to what the company purportedly does,” the NCA’s tactical lead for the operation says.

[ad_2]

Source link

December 4, 2024
How the Ukraine-Russia war is reshaping the tech sector in Eastern Europe

[ad_1]

LMT’s Pollaks says he has visited Ukraine often since the war began. Though he declines to give more details, he euphemistically describes Ukraine’s wartime bureaucracy as “nonstandardized.” If you want to blow something up in front of an audience in the EU, he says, you have to go through a whole lot of approvals, and the paperwork can take months, even years. In Ukraine, plenty of people are willing to try out your tools.

“[Ukraine], unfortunately, is the best defense technology experimentation ground in the world right now,” Pollaks says. “If you are not in Ukraine, then you are not in the defense business.”

Jack Wang, principal at UK-based venture capital fund Project A, which invests in military-tech startups, agrees that the Ukraine “track” can be incredibly fruitful. “If you sell to Ukraine, you get faster product and tech iteration, and live field testing,” he says. “The dollars might vary. Sometimes zero, sometimes quite a bit. But you get your product in the field faster.”

The feedback that comes from the front is invaluable. Atlas Dynamics has opened an office in Ukraine, and its representatives there work with soldiers and special forces to refine and modify their products. When Russian forces started jamming a wide band of radio frequencies to disrupt communication with the drones, Atlas designed a smart frequency-hopping system, which scans for unjammed frequencies and switches control of the drone over to them, putting soldiers a step ahead of the enemy.

At Global Wolf, battlefield testing for the Mosphera has led to small but significant iterations of the product, which have come naturally as soldiers use it. One scooter-related problem on the front turned out to be resupplying soldiers in entrenched positions with ammunition. Just as urban scooters have become last-mile delivery solutions in cities, troops found that the Mosphera was well suited to shuttling small quantities of ammo at high speeds across rough ground or through forests. To make this job easier, Global Wolf tweaked the design of the vehicle’s optional extra trailer so that it perfectly fits eight NATO standard-sized bullet boxes.

Within weeks of Russia’s full-scale invasion, Mosphera scooters were at Ukraine’s front line—and even behind it, being used by Ukrainian special forces scouts.
GLOBAL WOLF

Some snipers prefer the electric Mosphera to noisy motorbikes or quads, using the vehicles to weave between trees to get into position. But they also like to shoot from the saddle—something they couldn’t do from the scooter’s footplate. So Global Wolf designed a stable seat that lets shooters fire without having to dismount. Some units wanted infrared lights, and the company has made those, too. These types of requests give the team ideas for new upgrades: “It’s like buying a car,” Asmanis says. “You can have it with air conditioning, without air conditioning, with heated seats.”

Being battle-tested is already proving to be a powerful marketing tool. Bukavs told me he thinks defense ministers are getting closer to moving from promises toward “action.” The Latvian police have bought a handful of Mospheras, and the country’s military has acquired some, too, for special forces units. (“We don’t have any information on how they’re using them,” Asmanis says. “It’s better we don’t ask,” Bukavs interjects.) Military distributors from several other countries have also approached them to market their units locally.

Although they say their donations were motivated first and foremost by a desire to help Ukraine resist the Russian invasion, Bukavs and Asmanis admit that they have been paid back for their philanthropy many times over.

[ad_2]

Source link

December 4, 2024
Russia’s Ballistic Missile Attack on Ukraine Is an Alarming First

[ad_1]

The Oreshnik missile launched Tuesday apparently took off from Russia’s Kapustin Yar rocket base roughly 800 kilometers from Dnipro, well away from intense fighting.

This is the first time any IRBM has been used in combat. The Intermediate-Range Nuclear Forces Treaty, ratified by the United States and the Soviet Union in 1988, banned ground-launched IRBMs. The US pulled out of the treaty in 2019 under the first Trump administration, citing noncompliance from Russia. At the time, US officials noted that China, which was not a signatory to the treaty, possessed more than 1,000 IRBMs in its arsenal.

Putin said Western air defenses are not capable of destroying the Oreshnik missile in flight, although this claim can’t be verified. He said Russia would provide warnings to Ukraine in advance of similar missile attacks in the future to allow civilians to escape danger zones.

The Oreshnik missiles strike their targets at speeds of up to Mach 10, or 2.5 to 3 kilometers per second, Putin said. “The existing air defense systems around the world, including those being developed by the US in Europe, are unable to intercept such missiles.”

A Global War?

In perhaps the most chilling part of his remarks, Putin said the conflict in Ukraine is “taking on global dimensions” and said Russia is entitled to use missiles against Western countries supplying weapons for Ukraine to use against Russian targets.

“In the event of escalation, we will respond decisively and in kind,” Putin said. “I advise the ruling elites of those countries planning to use their military forces against Russia to seriously consider this.”

The change in nuclear doctrine authorized by Putin earlier this week also lowers the threshold for Russia’s use of nuclear weapons to counter a conventional attack that threatens Russian “territorial integrity.”

This seems to have already happened. Ukraine launched an offensive into Russia’s Kursk region in August, taking control of more than 1,000 square kilometers of Russian land. Russian forces, assisted by North Korean troops, are staging a counteroffensive to try to retake the territory.

Singh called Russia’s invitation of North Korean troops “escalatory” and said Putin could “choose to end this war today.”

US officials say Russian forces are suffering some 1,200 deaths or injuries per day in the war. In September, The Wall Street Journal reported that US intelligence sources estimated that a million Ukrainians and Russians had been killed or wounded in the war.

The UN Human Rights Office most recently reported that 11,973 civilians have been killed, including 622 children, since the start of the full-scale Russian invasion in February 2022.

“We warned Russia back in 2022 not to do this, and they did it anyways, so there are consequences for that,” Singh said. “But we don’t want to see this escalate into a wider regional conflict. We don’t seek war with Russia.”

This story originally appeared on Ars Technica.

[ad_2]

Source link

November 23, 2024
The US Is Calling Out Foreign Influence Campaigns Faster Than Ever

[ad_1]

Ahead of the the 2024 US elections, the US intelligence community and law enforcement were on high alert and ready to share information—both among agencies and publicly—as foreign malign influence operations emerged. Tech giants like Microsoft similarly sprang into action, collaborating with government partners and publishing their own information about election-related disinformation campaigns. The speed and certainty with which authorities were able to pin these efforts on threat actors in Russia, China, and Iran was unprecedented. But researchers also caution that not all attributions are created equal.

At the Cyberwarcon security conference in Arlington, Virginia, today, researchers from the Atlantic Council’s Digital Forensic Research Lab are presenting initial findings on the role of attribution in the 2024 US elections. Their research compares the impact of quickly naming and shaming foreign influence actors to other recent US elections in which government attribution was far less common.

“We’re building on a project that we did back in 2020 where there was a lot more context of concern that the Trump administration was not being forthcoming about foreign attacks,” says Emerson Brooking, director of strategy and resident senior fellow for DFRLab. “In contrast to 2020, now there was an abundance of claims by the US government of influence operations being conducted by different adversaries. So in thinking through the policy of attribution, we wanted to look at the question of overcorrection.”

In the lead-up to the 2016 US presidential election, Russia’s extensive influence operations—which included hack-and-leak campaigns as well as strategic disinformation—caught the US government by surprise. Law enforcement and the intelligence community were largely aware of Russia’s digital probing, but they didn’t have an extreme sense of urgency, and the big picture of how such activity could impact public discourse hadn’t yet come into view. After Russia’s hack of the Democratic National Committee in June that year, it took four months for the US Office of the Director of National Intelligence and the Department of Homeland Security to publicly attribute the attack to the Kremlin. Some officials had said in the weeks following the incident that formal confirmation from the US government might never come.

Even in the highly politicized landscape that followed, federal, state, and local collaboration around election security expanded dramatically. By 2020, the researchers say, 33 of the 84 influence operation attributions they studied related to the 2020 US elections, or about 39 percent, came from US intelligence or federal sources. And this year, 40 of the 80 the group tracked came from the US government. DFRLabs resident fellow Dina Sadek notes, though, that one important factor in assessing the utility of US government attributions is the quality of the information provided. The substance and specificity of the information, she says, is important to how the public views the objectivity and credibility of the statement.

Specific information confirming that Russia had manufactured a video that purported to show ballots being destroyed in Bucks County, Pennsylvania was a high-quality, useful attribution, the researchers say, because it was direct, narrow in scope, and came very quickly to minimize speculation and doubt. Repeated statements from the Office of the Director of National Intelligence’s Foreign Malign Influence Center warning very broadly and generally about Russian influence operations is an example of the type of attribution that can be less helpful, and even serve to amplify campaigns that otherwise might not register with the public at all.

Similarly, in the lead-up to the 2020 elections, the researchers point out, statements from the US government about Russia, China, and Iran playing a role in Black Lives Matter protests may have been mismatched to the moment because they didn’t include details on the extent of the activity or the specific objectives of the actors.

Even with all of this in mind, though, the researchers note that there was valuable progress in the 2024 election cycle. But with a new Trump administration coming into the White House, such transparency could start to trend in a different direction.

“We don’t want to come across like rearranging deck chairs on the Titanic, because the state of affairs that was is not the state of affairs that will be,” Brooking says. “And from a public interest perspective I think we got a lot closer on disclosure in 2024.”

[ad_2]

Source link

November 22, 2024
Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack

[ad_1]

Only after the next intrusion, when Volexity managed to get more complete logs of the hackers’ traffic, did its analysts solve the mystery: The company found that the hijacked machine which the hackers were using to dig around in its customer’s systems was leaking the name of the domain on which it was hosted—in fact, the name of another organization just across the road. “At that point, it was 100 percent clear where it was coming from,” Adair says. “It’s not a car in the street. It’s the building next door.”

With the cooperation of that neighbor, Volexity investigated that second organization’s network and found that a certain laptop was the source of the street-jumping Wi-Fi intrusion. The hackers had penetrated that device, which was plugged into a dock connected to the local network via Ethernet, and then switched on its Wi-Fi, allowing it to act as a radio-based relay into the target network. Volexity found that, to break into that target’s Wi-Fi, the hackers had used credentials they’d somehow obtained online but had apparently been unable to exploit elsewhere, likely due to two-factor authentication.

Volexity eventually tracked the hackers on that second network to two possible points of intrusion. The hackers appeared to have compromised a VPN appliance owned by the other organization. But they had also broken into the organization’s Wi-Fi from another network’s devices in the same building, suggesting that the hackers may have daisy-chained as many as three networks via Wi-Fi to reach their final target. “Who knows how many devices or networks they compromised and were doing this on,” says Adair.

In fact, even after Volexity evicted the hackers from their customer’s network, the hackers tried again that spring to break in via Wi-Fi, this time attempting to access resources that were shared on the guest Wi-Fi network. “These guys were super persistent,” says Adair. He says that Volexity was able to detect this next breach attempt, however, and quickly lock out the intruders.

Volexity had presumed early on in its investigation that the hackers were Russian in origin due to their targeting of individual staffers at the customer organization focused on Ukraine. Then in April, fully two years after the original intrusion, Microsoft warned of a vulnerability in Windows’ print spooler that had been used by Russia’s APT28 hacker group—Microsoft refers to the group as Forest Blizzard—to gain administrative privileges on target machines. Remnants left behind on the very first computer Volexity had analyzed in the Wi-Fi-based breach of its customer exactly matched that technique. “It was an exact one-to-one match,” Adair says.

[ad_2]

Source link

November 22, 2024
NATO’s Tech Scouts Are Fortifying Europe for a World With Donald Trump

[ad_1]

It’s the day after Donald Trump declared his election victory, and a tech scout for NATO is peering down at a miniature factory, the size of a shoebox, designed to manufacture semiconductors in space.

Chris O’Connor, with his black bomber jacket and military haircut, has spent the past year scouring Europe for companies that will give NATO a technological edge over Russia and China—a job that has become even more urgent in the past 36 hours as the region rushes to prepare for Trump 2.0. Here, in a gray industrial estate on the outskirts of Cardiff in Wales, he believes he’s found one.

Space Forge wants to send satellites equipped with tiny clean rooms into space, where they’ll grow semiconductor crystals before transporting them safely back to Earth.

One Space Forge satellite could eventually create enough semiconductor material to power tens of thousands of phones, estimates chief technology officer Andrew Bacon, speaking in an office overcrowded with freshly-hired staff. Bacon says he is more interested in making chargers for electric cars to fight climate change, and Space Forge’s potential to exorcize all polluting industries from the planet.

But O’Connor is here because Space Forge has piqued the interest of the €1 billion ($1bn) NATO Innovation Fund (NIF). Manufacturing semiconductors in space, where there is no dirt, air, or gravity, has the potential to provide efficiencies that could create superior versions of military tools such as radar.

“The distance that radar can cover—translating to what it can see and how quickly it can do that—can be dramatically improved by using these materials,” O’Connor says, explaining why Space Forge was among the NIF’s first six investments to be made public.

Alongside Space Forge, the one-year-old NIF’s investments include battlefield robots, a company manufacturing a lighter version of the carbon fiber used to build cars and rockets, and several space startups.

This is the alliance’s first foray into the high-risk, high-reward world of venture capital, using its members’ money to fund the experiment. Space Forge has never actually made semiconductor material in space. The only time the company attempted to launch its satellites, the Virgin Orbit rocket giving them a ride failed 177 km above Earth before crashing into the ocean. O’Connor, one of three partners at the fund, is sanguine about the fact there is no guarantee the investments will work out. “We’ve been given a mandate to go take this risk,” he says.

[ad_2]

Source link

November 14, 2024
More Spyware, Fewer Rules: What Trump’s Return Means for US Cybersecurity

[ad_1]

Trump is also unlikely to continue the Biden administration’s campaign to limit the proliferation of commercial spyware technologies, which authoritarian governments have used to harass journalists, civil-rights protesters, and opposition politicians. Trump and his allies maintain close political and financial ties with two of the most prolific users of commercial spyware tools, Saudi Arabia and the United Arab Emirates, and he showed little concern about those governments’ human-rights abuses in his first term.

“There’s a high probability that we see big rollbacks on spyware policy,” says Steven Feldstein, a senior fellow in the Carnegie Endowment for International Peace’s Democracy, Conflict, and Governance Program. Trump officials are likely to care more about spyware makers’ counterterrorism arguments than about digital-rights advocates’ criticisms of those tools.

Spyware companies “will undoubtedly receive a more favorable audience under Trump,” Feldstein says—especially market leader NSO Group, which is closely affiliated with the Trump-aligned Israeli government.

Dubious Prospects

Other Biden cyber initiatives are also in jeopardy, even if their fates are not as clear.

Biden’s National Cybersecurity Strategy emphasized the need for greater corporate responsibility, arguing that well-resourced tech firms must do more to prevent hackers from abusing their products in devastating cyberattacks. Over the past few years, CISA launched a messaging campaign to encourage companies to make their products “secure by design,” the Justice Department created a Civil Cyber-Fraud Initiative to prosecute contractors that mislead the government about their security practices, and White House officials began considering proposals to make software vendors liable for damaging vulnerabilities.

That corporate-accountability push is unlikely to receive strong support from the incoming Trump administration, which is almost certain to be stocked with former business leaders hostile to government pressure.

Henry Young, senior director of policy at the software trade group BSA, predicts that the secure-by-design campaign will “evolve to more realistically balance the responsibilities of governments, businesses, and customers, and hopefully eschew finger pointing in favor of collaborative efforts to continue to improve security and resilience.”

A Democratic administration might have used the secure-by-design push as a springboard to new corporate regulations. Under Trump, secure-by-design will remain at most a rhetorical slogan. “Turning it into something more tangible will be the challenge,” the US cyber official says.

Chipping Away at the Edges

One landmark cyber program can’t easily be scrapped under a second Trump administration but could still be dramatically transformed.

In 2022, Congress passed a law requiring CISA to create cyber incident reporting regulations for critical infrastructure operators. CISA released the text of the proposed regulations in April, sparking an immediate backlash from industry groups that said it went too far. Corporate America warned that CISA was asking too many companies for too much information about too many incidents.

[ad_2]

Source link

November 14, 2024
Auto-Rebooting iPhones Are Causing Chaos for Cops

[ad_1]

Maybe you already heard, but Donald Trump will be president of the United States again. The far-right is celebrating by calling for mass executions. The left is responding with their own election conspiracy theories. Convicted January 6 rioters are banking on a pardon. And women who oppose Trump have frankly had enough.

Ahead of Election Day, WIRED found that an “election integrity” app made by True the Vote, a right-wing group that helped popularize election denialism around the 2020 election, was leaking the emails of its users. In one instance it revealed an election officer in California who appeared to be engaged in illegal voter suppression.

Disinformation and other forms of election interference have been a major issue since Russia’s hack of the Democratic National Committee in the lead-up to the 2016 election. But 2024 appears to have been the worst yet, with US officials warning that Russia had amplified its efforts to unprecedented levels.

In non-election news, Canadian authorities arrested Alexander “Connor” Moucka, who is accused of hacking a slew of Snowflake cloud storage customers earlier this year. Security experts who’ve long followed the exploits of a hacker who went by the handle Waifu—whom authorities say is Moucka—believe him to be “one of the most consequential threat actors of 2024.”

A federal judge in Michigan sentenced Richard Densmore to 30 years in prison after he pleaded guilty to sexually exploiting a child. Densmore was highly active in 764, an online criminal network that the FBI now considers to be a “tier one” terrorism threat.

Finally, in WIRED’s first story published in partnership with 404 Media, reporter (and 404 co-owner) Joseph Cox took a deep dive into the world of infostealer malware—the same kind used in all those Snowflake account breaches Moucka is accused of committing.

And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Some iPhones that police have in their possession for forensic examination are suddenly rebooting themselves, making it more difficult for investigators to access their contents, reports 404 Media. Police use tools like Cellebrite to essentially hack into phones, but this is typically done when a device is in the so-called After First Unlock (AFU) state. Once they reboot, iPhones are put into Before First Unlock (BFU), which makes them much harder to access with forensic tools.

According to a document obtained by 404, police believed the sudden reboots stemmed from the fact that the devices run iOS 18, Apple’s new mobile operating system. The police suspected that iOS 18 contains a secret feature that allowed the impacted devices, all of which were in airplane mode, to communicate with other nearby iPhones, which sent “a signal to devices to reboot after so much time had transpired since device activity or being off network,” the document reads.

[ad_2]

Source link

November 9, 2024