Any multifactor authentication adds protection, but a physical token is the best bet when it really counts.

In August,  the internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn't burrow deeper into the company's systems. That's because, as part of Cloudflare's security controls, every employee must use a physical security key to prove their identity while logging into all applications. Weeks later, the company announced a collaboration with the hardware authentication token-maker Yubikey to offer discounted keys to Cloudflare customers. 

Cloudflare wasn't the only company high on the security protection of hardware tokens, though. Earlier this month, Apple announced hardware key support for Apple IDs, seven years after first rolling out two-factor authentication on user accounts. And two weeks ago, the Vivaldi browser announced hardware key support for Android.

The protection isn't new, and many major platforms and companies have for years supported hardware key adoption and required that employees use them as Cloudflare did. But this latest surge in interest and implementation comes in response to an array of escalating digital threats.

“Physical authentication keys are some of the most effective methods today for protecting against account takeovers and phishing,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “If you think about it as a hierarchy, physical tokens are more effective than authentication apps, which are better than SMS verification, which is more effective than email verification.” 

Hardware authentication is very secure, because you need to physically possess the key and produce it. This means that a phisher online can't simply trick someone into handing over their password, or even a password plus a second-factor code, to break into a digital account. You already know this intuitively, because this is the whole premise of door keys. Someone would need your key to unlock your front door—and if you lose your key, it's usually not the end of the world, because someone who finds it won't know which door it unlocks. For digital accounts, there are different types of hardware keys that are built on standards from a tech industry association known as the FIDO Alliance, including smart cards that have a little circuit chip on them, tap cards or fobs that use near-field communication, or things like Yubikeys that plug into a port on your device.

You likely have dozens or even hundreds of digital accounts, and even if they all supported hardware tokens it would be difficult to manage physical keys for all of them. But for your most valuable accounts and those that are a fallback for other logins—namely, your email—the security and phishing resistance of hardware keys can mean significant peace of mind.

Meanwhile, after years of work, the tech industry finally took major steps in 2022 toward a long-promised passwordless future. The move is riding on the back of a technology called “passkeys” that are also built on FIDO standards. Operating systems from Apple, Google, and Microsoft now support the technology, and many other platforms, browsers, and services have adopted it or are in the process of doing so. The goal is to make it easier for users to manage their digital account authentication so they don't use insecure workarounds like weak passwords. As much as you might wish it, though, passwords aren't going to disappear anytime soon, thanks to their sheer ubiquity. And amid all the buzz about passkeys, hardware tokens are still an important protection option.

“FIDO has been positioning passkeys somewhere between passwords and hardware-based FIDO authenticators, and I think that’s a fair characterization,” says Jim Fenton, an independent identity privacy and security consultant. “While passkeys will probably be the right answer for many consumer applications, I think hardware-based authenticators will continue to have a role for higher-security applications, like for staff at financial institutions. And more security-focused consumers should also have the option to use hardware-based authenticators, particularly if their data has previously been breached, if they have a high net worth, or if they are just concerned about security.”

While it may feel daunting at first to add one more best practice to your digital security to-do list, hardware tokens are actually easy to set up. And you'll get plenty of mileage from just using them on a couple of, ahem, _key_ accounts.

The Password Isn’t Dead Yet. You Need a Hardware Key

The year was marked by sinister new twists on cybersecurity classics, including phishing, breaches, and ransomware attacks.

With the pandemic evolving into an amorphous new phase and political polarization on the rise around the world, 2022 was an uneasy and often perplexing year in digital security. And while hackers frequently leaned on old chestnuts like phishing and ransomware attacks, they still found vicious new variations to subvert defenses.

Here's WIRED's look back on the year's worst breaches, leaks, ransomware attacks, state-sponsored hacking campaigns, and digital takeovers. If the first years of the 2020s are any indication, the digital security field in 2023 will be more bizarre and unpredictable than ever. Stay alert, and stay safe out there.

For years, Russia has pummeled Ukraine with brutal digital attacks causing blackouts, stealing and destroying data, meddling in elections, and releasing destructive malware to ravage the country's networks. Since invading Ukraine in February, though, times have changed for some of Russia's most prominent and most dangerous military hackers. Shrewd long-term campaigns and grimly ingenious hacks have largely given way to a stricter and more regimented clip of quick intrusions into Ukrainian institutions, reconnaissance, and widespread destruction on the network—and then repeated access over and over again, whether through a new breach or by maintaining the old access. The Russian playbook on the physical battlefield and in cyberspace seems to be the same: one of ferocious bombardment that projects might and causes as much pain as possible to the Ukrainian government and its citizens.

Ukraine has not been digitally passive during the war, though. The country formed a volunteer “IT Army” after the invasion, and it, along with other actors around the world, have mounted DDoS attacks, disruptive hacks, and data breaches against Russian organizations and services.

Over the summer, a group of researchers dubbed 0ktapus (also sometimes known as “Scatter Swine”) went on a massive phishing bender, compromising nearly 10,000 accounts within more than 130 organizations. The majority of the victim institutions were US-based, but there were dozens in other countries as well, according to researchers. The attackers primarily texted targets with malicious links that led to fake authentication pages for the identity management platform Okta, which can be used as a single sign-on tool for numerous digital accounts. The hackers' goal was to steal Okta credentials and two-factor authentication codes so they could get access to a number of accounts and services at once.

One company hit during the rampage was the communications firm Twilio. It suffered a breach at the beginning of August that affected 163 of its customer organizations. Twilio is a big company, so that only amounted to 0.06 percent of its clients, but sensitive services like the secure messaging app Signal, two-factor authentication app Authy, and authentication firm Okta were all in that slice and became secondary victims of the breach. Since one of the services Twilio offers is a platform for automatically sending out SMS text messages, one of the knock-on effects of the incident was that attackers were able to compromise two-factor authentication codes and breach the user accounts of some Twilio customers. 

As if that wasn't enough, Twilio added in an October report that it was also breached by 0ktapus in June and that the hackers stole customer contact information. The incident highlights the true power and menace of phishing when attackers choose their targets strategically to magnify the effects. Twilio wrote in August, “we are very disappointed and frustrated about this incident.”

In recent years, countries around the world and the cybersecurity industry have increasingly focused on countering ransomware attacks. While there has been some progress on deterrence, ransomware gangs were still on a rampage in 2022 and continued to target vulnerable and vital social institutions, including health care providers and schools. The Russian-speaking group Vice Society, for example, has long specialized in targeting both categories, and it focused its attacks on the education sector this year. The group had a particularly memorable showdown with the Los Angeles Unified School District at the beginning of September, in which the school ultimately took a stand and refused to pay the attackers, even as its digital networks went down. LAUSD was a high-profile target, and Vice Society may have bitten off more than it could chew, given that the system includes more than 1,000 schools serving roughly 600,000 students. 

Meanwhile, in November, the US Cybersecurity and Infrastructure Security Agency, the FBI, and the Department of Health and Human Services released a joint warning about the Russia-linked ransomware group and malware maker known as HIVE. The agencies said the group's ransomware has been used to target over 1,300 organizations around the world, resulting in roughly $100 million in ransom payments from victims. “From June 2021 through at least November 2022, threat actors have used Hive ransomware to target a wide range of businesses and critical infrastructure sectors,” the agencies wrote, “including Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially Healthcare and Public Health.”

The digital extortion gang Lapsus$ was on an intense hacking spree at the beginning of 2022, stealing source code and other sensitive information from companies like Nvidia, Samsung, Ubisoft, and Microsoft and then leaking samples as part of apparent extortion attempts. Lapsus$ has a sinister talent for phishing, and in March, it compromised a contractor with access to the ubiquitous authentication service Okta. The attackers appeared to be based primarily in the United Kingdom, and at the end of March, British police arrested seven people in association with the group and charged two at the beginning of April. In September, though, the group flared back to life, mercilessly breaching the ride-share platform Uber and seemingly the _Grand Theft Auto_ developer Rockstar as well. On September 23, police in the UK said they had arrested an unnamed 17-year-old in Oxfordshire who seems to be one of the individuals previously arrested in March in connection with Lapsus$.

The beleaguered password manager giant LastPass, which has repeatedly dealt with data breaches and security incidents over the years, said at the end of December that a breach of its cloud storage in August led to a further incident in which hackers targeted a LastPass employee to compromise credentials and cloud storage keys. The attackers then used this access to steal some users' encrypted password vaults—the files that contain customers' passwords—and other sensitive data. Additionally, the company says that “some source code and technical information were stolen from our development environment” during the August incident. 

LastPass CEO Karim Toubba said in a blog post that in the later attacks, hackers compromised a copy of a backup that contained customer password vaults. It is not clear when the backup was made. The data is stored in a “proprietary binary format" and contains both unencrypted data, like website URLs, and encrypted data, like usernames and passwords. The company did not provide technical details about the proprietary format. Even if LastPass's vault encryption is strong, hackers will attempt to brute-force their way into the password troves by attempting to guess the “master passwords” that users set to protect their data. With a strong master password, this may not be possible, but weak master passwords could be at risk of being defeated. And since the vaults have already been stolen, LastPass users can't stop these brute-force attacks by changing their master password. Users should instead confirm that they have deployed two-factor authentication on as many of their accounts as they can, so even if their passwords are compromised, attackers still can't break in. And LastPass customers should consider changing the passwords on their most valuable and sensitive accounts.

The Worst Hacks of 2022

The password manager's most recent data breach is so concerning, users need to take immediate steps to protect themselves.

You've heard it again and again: You need to use a password manager to generate strong, unique passwords and keep track of them for you. And if you finally took the plunge with a free and mainstream option, particularly during the 2010s, it was probably LastPass. For the security service's 25.6 million users, though, the company made a worrying announcement last week: A security incident the firm previously reported on November 30 was actually a massive and concerning data breach that exposed encrypted password vaults—the crown jewels of any password manager—along with other user data. 

The details LastPass provided about the situation last Thursday were worrying enough that security professionals quickly started calling for users to switch to other services. Now, nearly a week since the disclosure, the company has not provided additional information to confused and worried customers. LastPass has not returned WIRED's multiple requests for comment about how many password vaults were compromised in the breach and how many users overall were affected. 

The company hasn't even clarified when the breach occurred. It seems to have been sometime after August 2022, but the timing is significant because a big question is how long it will take attackers to start “cracking” or guessing the keys used to encrypt the stolen password vaults. If attackers have already had three or four months with the stolen data, the situation is even more urgent for impacted LastPass users than if hackers have only had a few weeks. The company also did not respond to WIRED's questions about what it calls “a proprietary binary format” it uses to store encrypted and unencrypted vault data. In characterizing the scale of the situation, the company simply said in its announcement last week that hackers were “able to copy a backup of customer vault data from the encrypted storage container.”

“In my opinion they are doing a world-class job detecting incidents, and a really, really crummy job preventing issues and responding transparently,” says Evan Johnson, a security engineer who worked at LastPass more than seven years ago. “I'd be either looking for new options or looking to see a renewed focus on building trust over the next few months from their new management team.”

The breach also includes other customer data, including names, email addresses, phone numbers, and some billing information. And LastPass has long been criticized for storing its vault data in a hybrid format where items like passwords are encrypted, but other information like URLs are not. In this situation, the plaintext URLs in a vault could give attackers an idea of what’s inside and help them to prioritize which vaults to work on cracking first. The vaults, which are protected by a user-selected master password, pose a particular problem for users seeking to protect themselves in the wake of the breach because changing that primary password now with LastPass won't do anything to protect the vault data that's already been stolen.

Or, as Johnson puts it, “With vaults recovered, the people who hacked LastPass have unlimited time for offline attacks by guessing passwords and attempting to recover specific user's master key."

This means that LastPass users should go through their vaults and take extra steps to protect themselves—including changing all of their passwords. 

Start by turning on two-factor authentication for as many of your accounts as possible, particularly high-value accounts like your email, financial services, and highly used social media accounts. This way, even if attackers compromise the passwords for the accounts, they can't actually log in without the one-time code or hardware authentication key you've added as the “second factor.” Next, change the passwords for all of those sensitive and high-value accounts. And then change all the remaining passwords stored in your LastPass vault.

As you're doing all of this (or at least as much of it as you can), the time is ripe to switch to a new password manager. You can add accounts to the new service as you change them. WIRED recommends 1Password and the free service Bitwarden along with some alternatives. We haven't recommended LastPass since the company scaled back its free offerings a couple of years ago, given that LastPass had suffered an array of past security incidents before this latest, most dire breach was even revealed.

“One hundred percent, yes, people should switch to other password managers,” says one senior security engineer, who asked not to be named because of professional relationships with people on the LastPass security team. “They failed to do the one thing they are supposed to provide—cloud-based secure credential storage.”

Security practitioners universally emphasize that the situation with LastPass shouldn't deter people from using password managers in general. And if you're a loyal LastPass user, you should still change your vault password, turn on two factor for every account that offers it, and change all the passwords in your vault even if you don't migrate somewhere else in the process.

“As someone with experience handling and communicating EU data breach notifications, I’d say that LastPass’s chosen communication strategy may undermine user confidence,” says Lukasz Olejnik, an independent privacy researcher and consultant. “The big issue is also the timing. Why do it just prior to the end of year holidays when the initial investigation began months ago?”

As Jeremi Gosney, a longtime password cracker and senior principal engineer of the Yahoo security team, wrote this week in an extensive series of posts about the situation: “I used to support LastPass. I recommended it for years and defended it publicly in the media … But things change."

LastPass Data Breach: It's Time to Ditch This Password Manager

The Kremlin’s aggression in Ukraine is following a dangerous playbook that began to unfold years ago.

For eight long years prior to Russia's disastrous and brutal invasion of its neighbor in February, the Kremlin instead waged a limited war in the east of the country, throwing that eastern border region into a state of turmoil, all while raining down cyberattacks on Ukraine's critical infrastructure far beyond any war zone. Many military and cybersecurity observers around the world warned that Russia's scorched-earth hacking was demonstrating a playbook that would, sooner or later, be used outside of Ukraine too—a warning that soon proved true, with cyberattacks that struck everything from American hospitals to the 2018 Winter Olympics.

But looking back on nearly a year of Vladimir Putin's full-blown war in Ukraine, it's now clear that Russia's earlier cyberwar in the country also served as a different sort of harbinger: It foreshadowed exactly how Russia would carry out its full-scale physical attacks on Ukraine, with a vastly greater human cost. In 2022's war, just as in that earlier digital blitz, Russia's real playbook has proven to be one of ruthless bombardment of civilian critical infrastructure, with no tactical intention other than to project its power and inflict pain hundreds of miles past the war's front lines.

In the past two months, Ukraine's power grid has come under relentless bombardment by Russian bombs, taking down as much as half of the country's electric infrastructure and at times leaving the majority of the country without power. In Kyiv, more than 200 miles west of the ongoing fighting in the region known as Donbas, Ukrainians are reduced to hunting for generators, storing food outside to prevent it from spoiling, charging their phones and computers during the few hours a day of reliable power, and keeping backup food and water supplies in apartment building elevators in case someone is trapped inside during a blackout. Water supplies have been paralyzed at times, too, along with portions of the country's electrified rail system. And winter, with only a fraction of the country's heating systems operational, still looms ahead.

"It's like the central nervous system of the human body: If you mess with it, you put all sorts of systems out of whack," says Rajan Menon, a director of the Defense Priorities think tank who recently returned from a trip to the Ukrainian capital, speaking about Russia's power grid attacks. "It’s not only an inconvenience but an enormous economic cost. It’s an effort to create pain for the civilian population, to show that the government can’t protect them adequately."

Menon notes, however, that every one of his comments could just as easily apply to Russia's earlier waves of cyberattacks on the country's internet—such as the NotPetya malware released by Russia's GRU hackers, which five years earlier destroyed the digital networks of hundreds of government agencies, banks, airports, hospitals, and even its radioactivity monitoring facility in Chernobyl. “They're different in the technicalities, but the goal is the same,” he says. “Demoralizing and punishing civilians.”

Russia's practice of carrying out missile and artillery strikes on civilian targets has already become notorious, from the Mariupol theater airstrike in May that killed 600 people to the bombings of multiple sites in central Kyiv that Russia carried out in October in retaliation for the destruction of the Kerch bridge linking the Crimean peninsula to Russia. The repeated failures of Russia's military to take or hold territory in the face of the Ukrainian counteroffensive seem only to have amplified the Kremlin's preference for softer, nonmilitary targets: In late November, Ukrainian defense minister Oleksii Reznikov wrote that fully 97 percent of Russia's 16,000 missile strikes have targeted civilians. "We are fighting against a terrorist state," Reznikov wrote.

But for anyone involved in fending off Russia's cyberattacks on Ukraine over the past eight years, Russia's preference for civilian over military targets has long been apparent, says Viktor Zhora, a senior cybersecurity-focused official in Ukraine's State Services for Special Communications and Information Protection, or SSSCIP. Zhora, whose cybersecurity firm worked on incident response for Russia's breach of Ukraine's Central Election Commission in 2014 before he joined the government, lists the Kremlin's biggest cyberattacks on his country over the past eight years: that election-focused intrusion, designed to both cripple Ukraine's electoral body and spoof its results; cyberattacks on electric utilities that caused blackouts in late 2015 and 2016; data-destroying attacks that hit the country's treasury, railways, and Ministry of Finance; and finally, the NotPetya worm that carpet-bombed Ukrainian networks in 2017 before spreading globally to cause more than $10 billion in damage.

Given that every one of those attacks targeted civilian institutions, it was all too predictable that Russia's physical war would fall back to the same pattern, Zhora argues. “Without any significant successes on the battlefield, we see that Russia switched to purely terroristic tactics,” says Zhora. “They continue to attack our civilian infrastructure, and in this way, it’s more or less similar to their trends in cyberwarfare.”

Zhora notes that those cyberattacks on civilians haven't stopped—they've only fallen off the radar as vastly more destructive, lethal physical attacks have eclipsed them. The Ukrainian government, he says, has counted hundreds of breaches this year of the country’s energy, telecom and finance sectors.

The purpose of all of that civilian targeting, both cyber and physical, is in part an attempt to weaken Ukrainians' resolve as a country, says Oleh Derevianko, founder of the Ukrainian cybersecurity firm ISSP. “They want to create a situation where people are not satisfied with what's going on and exert pressure on the government to engage into negotiations,” says Derevianko—adding that the strategy has badly backfired, instead unifying Ukrainians against the Russian threat more strongly than ever. But he argues that on some level, too, Russian forces may also be responding to pressure to simply do _something_ to contribute to the war effort. "They need to report some success to their chain of their command," says Derevianko. “They're frustrated on the battlefield, so they attack civilians.”

SSSCIP's Zhora, on the other hand, goes further: He believes that Russia's attacks on civilians may not be a means to an end, but rather Russia's true goal. He says Russia isn't merely trying to defeat the Ukrainian military, win a war, or conquer the Donbas, but instead to defeat and destroy the Ukrainian people.

“The intention is to wipe out the whole nation,” says Zhora. He says that motivation to directly attack Ukraine's population can be seen in the history of the two countries' relations far earlier than any recent war or cyberwar, stretching back as far as the Holodomor, the man-made famine that starved to death millions of Ukrainians in the early 1930s as Soviet officials ordered Ukrainian grain to be confiscated or locked in warehouses to rot.

“It’s a continuation of genocide,” Zhora says. “It’s one more chance to try to wipe out the Ukrainian people, to restore the Soviet Union, to change the global order.”

Russia’s Cyberwar Foreshadowed Deadly Attacks on Civilians

Throughout 2022, geopolitics has given rise to a new wave of politically motivated attacks with an undercurrent of state-sponsored meddling.

During its brutal war in Ukraine, Russian troops have burnt cities to the ground, raped and tortured civilians, and committed scores of potential war crimes. On November 23, lawmakers across Europe overwhelmingly labeled Russia a “state sponsor” of terrorism and called for ties with the country to be reduced further. The response to the declaration was instant. The European Parliament’s website was knocked offline by a DDoS attack.

The unsophisticated attack—which involves flooding a website with traffic to make it inaccessible—disrupted the Parliament’s website offline for several hours. Pro-Russian hacktivist group Killnet claimed responsibility for the attack. The hacktivist group has targeted hundreds of organizations around the world this year, having some limited small-scale successes knocking websites offline for short periods of time. It’s been one player in a bigger hacktivism surge. 

Following years of sporadic hacktivist activity, 2022 has seen the re-emergence of hacktivism on a large scale. Russia’s full-scale invasion of Ukraine spawned scores of hacktivist groups on both sides of the conflict, while in Iran and Israel, so-called hacktivist groups are launching increasingly destructive attacks. This new wave of hacktivism, which varies between groups and countries, comes with new tactics and approaches and, increasingly, is blurring lines between hacktivism and government-sponsored attacks.

“I’m not going to say that hacktivism was dying, but it was definitely withering for some time,” says Juan Andres Guerrero-Saade, principal threat researcher at security firm SentinelOne. For the past four or five years, Guerrero-Saade explains, hacktivism has often existed at extremes: low-level disruptions and more sophisticated attacks that could be cover for a nation-state’s hacking. “You have so many more players in the space and a much beefier middle ground between those two extremes,” Guerrero-Saade says of the current situation.

Russia’s invasion of Ukraine in February prompted a surge in hacktivism activity. Legacy hacktivist collective Anonymous was revitalized, but new groups were also formed. Ukraine’s unprecedented IT Army, a volunteer group of hackers from around the world, has continuously launched DDoS attacks against Russian targets that are outlined in its Telegram group. In June, a speech by Vladimir Putin was delayed after a cyberattack. Other hacktivist-linked groups have run huge hack-and-leak operations against Russian entities, resulting in hundreds of gigabytes of data from Russia being published online.

On the other side of the conflict, there are four main pro-Russian hacktivist groups, says Sergey Shykevich, threat intelligence group manager at security firm Check Point. These are: Killnet, NoName 057, From Russia With Love, and XakNet. Killnet is probably the most active of these groups, Shykevich says. “Since April, they have targeted around 650 targets—only about 5 percent of them were Ukraine.” Its targets, like the European Parliament, have largely been countries that oppose Russia. The group, which mostly uses DDoS attacks, is proactive on Telegram, media friendly, and appeals to Russian speakers.

DDoS attacks still have an outsize place within modern hacktivism. An FBI notification, issued in early November, says those behind DDoS attacks have “minimal operational impact” on their victims. “Hacktivists often select targets perceived to have a greater perceived impact rather than an actual disruption of operations,” the FBI said. In other words: The bark is often worse than the bite. 

Erica Lonergan, a research scholar at the Saltzman Institute of War and Peace Studies at Columbia University, says the impact of DDoS attacks is often overstated. Media reports can overemphasize the impact of DDoS, making it sound more severe than it is. “There’s this gap between the hyperbole of the language that’s used to talk about the types of attacks that these groups like Killnet are engaged in, and then the reality of their impact,” Lonergan says. 

But it isn’t all DDoS. In South America, the Guacamaya hacktivist group claims to have hacked mining companies and leaked their internal emails. The politically motivated Belarusian Cyber Partisans, which formed in 2020 following Alexander Lukashenko’s election, has innovated as it disrupts Russian and Belarusian efforts linked to the war. The highly organized group became the first to use ransomware for purely political objectives. It has also claimed to have taken data from Russian government organizations and mapped the data of government officials who have backed Lukashenko’s regime. 

Guerrero-Saade says the Cyber Partisans are part of a new style of hacktivists that use targeted sabotage and disruption. “To us, it looked very much like they’re an authentic group. They’re coordinating locally and trying out new ways to actually slow down or disrupt or inconvenience the local government away from supporting the war,” Guerrero-Saade says.

In Iran, the Predatory Sparrow group of hackers—which claims to be hacktivists—used a cyberattack to start a fire in a steel factory in July. The move was an incredibly rare use of a cyberattack to cause physical damage. In 2021, the Adalat Ali hacktivist group hacked and leaked CCTV footage from the notorious Evin political prison. The incidents were part of a larger series of cyberattacks between Iran and Israel. They show the potential extremes of hacktivism.

Check Point’s Shykevich says much of the hacktivism seen in 2022 can be classified as “state-affiliated” hacking. “In most cases, it’s difficult to tell if this group is guided or sponsored by a specific state organization,” Shykevich says. “But most of those groups, they have very clear pro or anti-regime narrative.”

Working out who is behind a cyberattack of any kind is always complex and difficult for organizations to do—attackers often try to disguise their activity or hide it from view. However, there is evidence some hacktivists are linked to individual countries. Researchers suspect Predatory Sparrow is linked to a government, for instance. Meanwhile, security firm Mandiant believes that the pro-Russian groups XakNet, Infoccentr, and Cyber Army of Russia all coordinate their operations with Russia’s GRU military hackers. The Cyber Army of Russia launched DDoS attacks against US organizations around the November midterm elections, with XakNet and KillNet also trying to influence the elections, Mandiant claims.

“They can be used in witting and unwitting ways by governments for political purposes,” Lonergan says. “Killnet for example, on the Russian side, has been pretty explicit in its Telegram channels of disavowing direct links with Moscow. But at the same time, they follow the implicit rules of the road of Russian cyber proxy groups.” Russian cybercrime groups rarely attack Russian targets, and the Kremlin has largely turned a blind eye to them.

The result is that while hacktivist groups are becoming more sophisticated and testing new tools, there’s increasing uncertainty about their origins. “There will be more hacktivism groups that will be more affiliated with governments,” Shykevich says. “Generally, this year the lines between what is governmental attack, hacktivism, and cybercrime have completely blurred.”

Hacktivism Is Back and Messier Than Ever

From SBF to the GRU, these were the most disruptive forces of online chaos this year.

Russian soldiers poured into Ukraine, accompanied by a wave of cyberattacks across the country. A major cryptocurrency exchange imploded and declared bankruptcy, vaporizing billions of dollars from that digital economy. The once-biggest dark-web drug market—after being demolished by law enforcement—clawed back to the top of the online underworld after doggedly resurrecting itself.

It's not 2014, though you could be forgiven for being confused. No, all these episodes of global chaos occurred in 2022, each one a rerun of previous events, but now with the threat they posed vastly multiplied in scale.

This year, some of the phantoms of the Trump era and the Covid-19 pandemic finally seemed to recede—only to make room for new threats and the return of ghosts of years past. The same dictators—Vladimir Putin, Xi Jinping, Kim Jong Un—who have long threatened the global order, their geographic neighbors, and their countries' own citizens. Fresher digital threats like India's slide into online repression, and brazen cybercriminals displaying more ruthlessness than ever. And then there were some vestiges of the Trump era that seemed to have hung on, such as one particularly loud and quixotic billionaire with a large, cultlike following, seemingly doing his best to singlehandedly corrupt social media.

Every year, WIRED assembles a list of the most dangerous people on the internet. For the first time since 2015, Donald Trump doesn't top this list. But there's no shortage of new sources of instability and disruption online. Here are our picks for 2022.

Sam Bankman-Fried

For its entire existence, the cryptocurrency world has been plagued with money laundering, theft, and scams, from Bitcoin-powered dark-web drug markets to billions of dollars stolen from crypto companies by rogue hackers. But one of the most dangerous players in the crypto economy, it seems, was hiding in plain sight. In the collapse of cryptocurrency exchange FTX, a poster boy for cryptocurrency’s growing legitimacy, Sam Bankman-Fried, now stands accused of more than $8 billion in fraud. The rippling fallout for the cryptocurrency economy could be far larger, and the tangled dealings and mismanagement of user funds in FTX's meltdown have yet to be fully unraveled—even the company's new CEO John Ray, who also handled the bankruptcy of Enron, says he's never seen a bigger mess. Under Bankman-Fried's hands-on leadership, FTX invested vast sums of users' cryptocurrency in his own trading platform Alameda Research, which has also gone bankrupt. Aside from those enormous losses, Bankman-Fried represents a particularly troubling figure for the ills of the crypto economy: Unlike so many others in the crypto world, he had appeared to actually _welcome_ tighter government controls of the industry. Now, like a hybrid of Elizabeth Holmes and Lehman Brothers, he's come to represent the face of regulatory capture.

Elon Musk

The antics of Elon Musk, as a Willy Wonka figure with his mercuriality dialed up to 11, seemed harmless enough—or possibly even a net good for human progress—when he was focused on next-generation rockets and electric cars. But with his acquisition of Twitter, the dark side of Musk was put on display, and the fickle power of the (sometimes) world's richest man suddenly threatened a central institution of the internet. Musk's immediate, summary layoffs of thousands of Twitter's staffers put at risk key functions of a service that serves as a central artery of digital conversation. Sure, he justified lifting Twitter's ban on neo-Nazis like Andrew Anglin as well as former president Donald Trump (after the latter was removed from Twitter after using it to incite the January 6 riots and invasion of the US Capitol building) with free speech arguments. But Twitter's new emperor has also decimated its staff of content moderators, leading to situations like a single staffer being left to police child abuse content on Twitter for all of Japan and the Asia-Pacific region. Under Musk's watch, Twitter has also banned left-wing accounts he described as "antifa," contradicting his stance on free speech. Just days after the acquisition, Musk briefly tweeted—then deleted—disinformation that the man who attacked US House speaker Nancy Pelosi’s husband in October was his gay lover. Later, he seemed to call for the prosecution of the White House’s chief medical advisor Anthony Fauci for his handling of the Covid-19 pandemic, without explanation. In doing so, he offered a glimpse of the conspiracy-minded politics and trolling that truly drive his actions. Twitter hasn't collapsed under Musk, as some of its doomsayers predicted. But it may be morphing into the worst version of itself.

Xi Jinping

Xi Jinping has presided over some of China's worst human rights abuses, including its mass internment of Uyghur Muslims in Xinjiang and the crackdown on protestors in Hong Kong. Each of those waves of repression has come with its own accompanying tightening of restrictions online, as censors scoured social media for any reference to protests and Han Chinese police in Xinjiang even demanded that Uyghurs download an app that scans their phones for banned content. This year, the protests against China's draconian zero-Covid lockdowns have triggered a new online crackdown, one in which even "liking" a post about protests is deemed illegal and signs of misbehavior are tracked in a regulated "credit system" that can lead to users being summarily banned from online platforms. Xi has already established himself as the most powerful figure in China's government in decades, taking an unprecedented third term as head of the Chinese Communist Party. He's made clear that authoritarian power will extend deep into the digital lives of the world's biggest population of internet users.

Narendra Modi

Under Modi and his party, the BJP, India has become increasingly China-like in its repression of protests both physical and digital. In just the past few years, the Indian government temporarily shut down the internet in the embattled region of Kashmir, banned a large collection of China-based apps including TikTok, and just weeks ago delegated oversight of content moderation decisions on social media to a three-person group—a move widely seen as the latest step in the government's attempts to tighten its grip on those platforms. In perhaps the most appalling case of digital repression, security researchers this year revealed that hackers who fabricated evidence on the computers of activists in the region near the city of Pune had ties to the very same Pune police who arrested those activists. One of the activists targeted in that frame job died in detention. Eleven other defendants in the case remain in jail. Modi's India has proven that even a so-called democracy offers no guarantees of a remotely free internet.

GRU

Russia's GRU military intelligence agency has, for years, been home to some of the most aggressive and dangerous hackers in the world. The GRU groups known as Sandworm and APT28 have, in just the past seven years, triggered two blackouts in Ukraine, launched the hack-and-leak operation designed to sway the US 2016 election, released the NotPetya malware that spread worldwide and caused at least $10 billion in damage, and tried to destroy the backend of the 2018 Olympics. In 2022, thanks to Russia's unprovoked and brutal war in Ukraine, the GRU's focus zeroed in again on the country that has long been Russia's favorite hacking victim. In 2022, it launched countless cyberattacks designed to destroy data on Ukrainian government and corporate networks, often in tandem with physical attacks carried out by the invasion forces. One GRU malware attack went so far as to disable communications to 5,000 wind turbines across Germany in a case of collateral damage reminiscent of NotPetya. The GRU's Sandworm hackers also attempted a third blackout attack in Ukraine, which—according to Ukraine's government at least—defenders managed to foil this time. A+ for continued wanton, reckless aggression. B- for execution.

DeSnake

When the dark-web market for drugs and hacked data known as AlphaBay was shut down in 2017 and its creator Alexandre Cazes was found dead in a Thai jail cell, it seemed the story of AlphaBay was over. Then, in the summer of last year, fully four years after that massive bust, AlphaBay relaunched under the command of its cofounder and Cazes' top lieutenant, known only as DeSnake. In the year-plus since then, DeSnake has dragged AlphaBay back to the top of the dark web's competing scrum of criminal markets. To his credit, he's set more rules for what can be sold on his black market than Cazes ever did, banning the sale of fentanyl and ransomware tools, for instance. But AlphaBay remains a bustling criminal bazaar for hard drugs and stolen data, and it may be harder to shut down than ever. DeSnake has implemented security upgrades to the site, such as allowing only the harder-to-trace cryptocurrency Monero instead of Bitcoin. And he also claims to be located in the former Soviet Union—potentially putting him far farther beyond the reach of law enforcement than his unlucky predecessor.

Lazarus

In 2022, North Korea continued to distinguish itself as the world's top perpetrator of state-sponsored cybercrime: Its government hackers continued to steal hundreds of millions of dollars worth of loot, largely in the form of cryptocurrency, from targets around the globe. That spree of burglaries actually seems to be escalating. According to the blockchain analysis firm Chainalysis, North Korean thieves took in $840 million in the first five months of 2022 alone, more than the previous two years combined. Some $600 million of that came from just one heist. All of it goes toward funding one of the worst regimes in the world, with hundreds of thousands of political prisoners in concentration camps and a tendency to fire missiles over its neighbors' heads.

Conti

The scourge of ransomware continued to plague the world in 2022, and no group illustrated that threat better than Conti. In the first months of the year, the group hit dozens of corporate and government targets. Most catastrophically, it launched a wave of crippling cyberattacks across Costa Rica, shutting down 27 government bodies and medical services there and leading to a national state of emergency. After Russia's invasion of Ukraine, Conti declared its full support for that war—a decision that led to one of its disgruntled members leaking a vast trove of the group's internal communications online. Conti has subsequently shut down, but likely only in name. Its hackers may have rebranded and splintered, but the chaos that is their business model will no doubt persist.

Lapsus$

The only thing more dangerous than a group of ruthless ransomware hackers is a group of ruthless ransomware hackers who are also teenagers. In December of 2021, Lapsus$ made its entrance onto the hacking scene with a cyberattack on the Brazilian Ministry of Health in the midst of its Covid-19 response. It's since carried out a spree of splashy, often nihilistic breaches of major tech firms including Uber, Okta, Rockstar Games, Nvidia, Microsoft, Samsung, and Vodafone. Last spring, British law enforcement arrested seven people suspected of being members of the group, all ages 16 to 21. Those arrests included Lapsus$'s alleged 16-year-old "mastermind." But inexplicably, those suspects were released without charges, and the group's "hacker joyride" rolls on.

APT41

For years, China's hackers focused on by-the-book espionage. But more recently, one group, known as APT41, has proven itself to be the closest thing China has to North Korean state-sponsored cybercriminals. That group, which the US Department of Justice tied in an indictment to the Ministry of State Security contractor known as Chengdu 404, has for years moonlighted as a for-profit cybercriminal outfit. Just this month, the group was linked to the theft of $20 million in Covid-19 relief funds, an unprecedented robbery of US government money by a Chinese state-sponsored hacking outfit. Meanwhile, APT41 was also responsible for dozens of espionage-focused intrusions across the world this year, according to analysts at PricewaterhouseCoopers, which calls the group the most prolific cyberspying operation in the world. Despite the Justice Department charging seven of the group's members in 2020, they remain at large, and their unique blend of espionage and outright theft continues unabated.

The Most Dangerous People on the Internet in 2022

Ever-expanding cloud storage presents more risks than you might think.

Every year, more than a billion people use the Google Photos app to upload and store billions of pictures and videos. For many, the process is likely identical: You snap some photos with your phone and they’re automatically uploaded to Google’s cloud service. You might pick the best photo and share it on WhatsApp or Instagram and then never think about the rest of them ever again. The photos join a constantly updating stream of data about life.

But it shouldn’t be this way. Uploading thousands of photos and never taking any steps to sort or manage them creates a series of privacy risks and is making it impossible to maintain your photo collection in the future. Now is the time to stop being an information hoarder, before it spirals out of control.

For the past six weeks, I’ve spent around a dozen hours deleting thousands of photos that had been uploaded to my Google Photos account in the last half-decade. In total, I erased 16,774 photos and videos. During the process—and thousands of "delete" taps—three things stood out: My photos collection unknowingly includes a lot of sensitive personal information (both about me and others); I don't need to keep so many photos; and wrestling my collection into shape frees up a lot of space in my Google account.

My photo archive goes back to the early 2000s when everything was captured using an eight-megapixel digital camera. There are tens of thousands of photos—it’s impossible to say how many exactly—and they are entirely handled by Google. The photos were initially stored on CDs, moved to Flickr before it limited collections to 1,000 images, and finally found their way onto Google Photos around 2018. When Google limited accounts to 15 gigabytes of storage, I started paying for more.

Inside the collection, family holiday shots sit alongside selfies. Food pictures and dog pictures are plentiful. As phone cameras have improved and cloud storage has become seemingly unending, it appears that I take more photos every year. I am not the only one. Google Photos holds an unfathomable amount of data about us all: In 2020, the company said it stores 4 trillion photos, with 28 billion new photos and videos uploaded each week.

Deleting thousands of photos was a manual, tedious process. Using an iPad, I scrolled through every photo I had backed up from the past 15-plus years and tapped each one that I wanted to send to trash. In one of the longer sessions, I erased 2,211 photos in 45 minutes. The majority of photos binned were duplicates: Instead of having 16 pictures of me running through a forest, only the best two or three remain. Thousands of screenshots were culled: The moment I was verified on Twitter and the news article about a goat being arrested didn’t make it through the process unscathed.

But beneath the surface, there were plenty of images that should never have been kept in the first place. For years, I had been keeping photos of passports—my own and those of friends who had sent me the details for booking trips. I found photos of the details needed to log in to my bank account. I was storing people’s addresses and screenshots of directions to their homes. The list goes on: private email addresses, NSFW photos, screenshots of embarrassing conversations, common running routes and travel directions, pictures of notebooks from sensitive meetings. Huge swaths of my life were stored in my photos. I didn’t know they were there or had forgotten about them as soon as they weren’t useful. 

Each of these presents a risk. While Google makes the vast majority of its profits from advertising—its privacy policy says it won’t show you personalized ads based on your photos—the company has a strong data security record. Successful hacks against the company are incredibly rare. However, each piece of data that you’re unnecessarily storing adds a little extra hazard if something does go wrong. Documents could be used to assist with identity theft, while other personal details could contribute to building up a picture of who you talk to, where you live, and the places you frequent. Aside from any potential data breaches, my photos could potentially be accessed if my phone is lost or stolen. (These issues aren’t unique to Google Photos; they equally apply to any online photo storage service.)

But there are other reasons to spend some time clearing up your photos. Ever-expanding cloud storage makes it possible to keep taking photos and adding to the pile. Once sorted, it has been easier to find specific events and the best photos from them. If I had waited another few years, the task would have been too daunting to even start. In another 10 years, I may have taken an extra 20,000 to 40,000 photos. Now I plan on sorting the most recent photos once a year. 

Plus, practically speaking, there’s now more space in my Google account. Before I started deleting everything, I’d used up around 80 GB of storage; I’ve decreased this to about 60 GB. Google has some tools to help you manage your photos. You can archive photos if you don’t want to delete them or keep them in your main photo library. And pictures can be siphoned off into albums (it was too late for me). Its storage management tools allow you to delete large photos and videos in bulk and get rid of screenshots and blurry photos. It’s also possible to free up some of your account’s space by shrinking the size of photos by dropping them to “storage saver quality.”

However, my obsession with organizing my digital life—including operating a strict WhatsApp Zero policy—means that I would be fully satisfied with the job only if I did it manually. As I sifted through the tens of thousands of photos I’ve taken during two-thirds of my life, there was a satisfying glow to the process—a nostalgia vortex. Once I was done, I started taking more photos.

Everyone Is Using Google Photos Wrong

Plus: An offensive US hacking operation, swatters hacking Ring cameras, a Netflix password-sharing crackdown, and more.

We at WIRED are winding down for the year and gearing up for what is sure to be an eventful 2023. But 2022 isn’t going down without a fight. 

This week, following a new surge in mayhem at Twitter, we dove into exactly why the public needs real-time flight tracking, even if Elon Musk claims it’s the equivalent of doxing. The crucial transparency this publicly available data provides far outweighs the limited privacy value that censoring would give to the world’s rich and powerful. Unfortunately, Musk’s threats of legal action against the developer of the @ElonJet tracker are having broader chilling effects. 

Meanwhile, Iran’s internet blackouts—a response to widespread civil rights protests—are sabotaging the country’s economy, according to a new assessment from the US Department of State. Due to heavy sanctions on Iranian entities, the exact economic impact of Tehran’s internet blackouts is difficult to calculate. But experts agree it’s not good. 

You may have encountered the Flipper Zero in a recent viral TikTok video—but don’t believe everything you see. WIRED’s Dhruv Mehrotra got his hands on the palm-size device, which packs an array of antennas that allow you to copy and broadcast signals from all types of devices, like RFID chips, NFC cards, and more. We found that while the Flipper Zero can’t, say, make an ATM spill out money, it allows you to do plenty of other things that could get you into trouble. But mostly, it allows you to see the radio-wave-filled world around you like never before.

But that’s not all. Each week, we round up the security stories we didn’t cover in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there. 

Between long hours, medallion costs, and the rise of Uber and Lyft, the life of a New York City cab driver is hard enough. Now it seems that Russian hackers—and a couple of their enterprising partners in Queens—were trying to get their own cut of those drivers’ fares.

According to prosecutors, two Queens men, Daniel Abayev and Peter Leyman, worked with Russian hackers to gain access to the taxi dispatch system for New York’s JFK airport. They then allegedly created a group chat where drivers could secretly pay $10 to skip the sometimes hours-long line to be assigned a pickup—about a fifth of the $52 flat fee passengers pay for rides from the airport to elsewhere in NYC. The indictment against the two men doesn’t name the Russians or detail exactly how they gained access to JFK’s dispatch system. But it notes that since 2019, Abayev and Leyman allegedly schemed to get access to the system by multiple methods, including bribing someone to insert a USB drive with malware into one of the dispatch operators’ computers, gaining unauthorized access to their systems via Wi-Fi, and stealing one of their tablet computers. “I know that the Pentagon is being hacked,” Abayev wrote to his Russian contacts in November 2019, according to the indictment. “So, can’t we hack the taxi industry\[?\]” 

Before the scheme was shut down, prosecutors say it was enabling as many as a thousand fraudulent line-skips a day for drivers, 

It’s hardly a secret that Cyber Command, the more cyberattack-focused sister organization to the NSA, is frequently engaged in “hunting forward,” as Cybercom director Paul Nakasone has described it. That means hacking foreign hackers preemptively to disrupt their operations, often in advance of an event like a US election. So perhaps it’s no surprise, as _The Washington Post_ reports, that Cybercom targeted Russian and Iranian hackers throughout the 2022 midterm elections. It’s not clear exactly how those hackers were disrupted, but one official told the _Post_ that the operations typically go after the basic tools the hackers use to operate, including their computers, internet connections, and malware. In some cases, that foreign malware is discovered by Cybercom abroad and shared with potential targets in the US to make it more easily detected. 

While foreign hacking of US elections has waned since its peak in 2016—when Russia hacked the Democratic National Committee, Clinton campaign, and many other targets—it has by no means disappeared. Cybersecurity firm Mandiant reported this week that the Russian military intelligence agency the GRU appears to have targeted election websites with distributed denial-of-service attacks during the midterm elections, despite Cyber Command’s efforts.

On Monday, federal prosecutors charged two men—one from Wisconsin, the other from North Carolina—for allegedly participating in a swatting scheme that, over a one-week span, targeted the owners of more than a dozen compromised Ring home security door cameras.  According to the indictment, Kya Christian Nelson, 21, and James Thomas Andrew McCarty, 20, used login credentials from leaked Yahoo accounts to access Ring accounts from individuals around the country. The defendants then allegedly phoned in false reports to law enforcement claiming to dispatchers that a violent incident was taking place at the victim’s house, and then they livestreamed the police response to the hoax. In several of the incidents, the two men taunted responding police officers and victims through the microphone of the Ring device, according to the indictment.

Nelson, who went by the alias “ChumLul,” is currently incarcerated in Kentucky in an unrelated case. McCarty, who went by the alias “Aspertaine,” was arrested last week on federal charges filed in the District of Arizona. Nelson and McCarty are both charged with conspiring to intentionally access computers without authorization. Nelson has also been charged with two counts of intentionally accessing a computer without authorization and two counts of aggravated identity theft. If convicted, they could each face up to five years in prison, with Nelson facing an additional seven years for the additional charges.

In March 2017, Netflix tweeted a simple message: “Love is sharing a password.” Now, five years later, that sentiment is coming to the end of its life. According to a _Wall Street Journal_ report this week, the streaming service plans to clamp down on password sharing in early 2023. Netflix has been testing ways to stop households in Latin America from sharing passwords throughout 2022, and the report suggests it is ready to expand the measures. Netflix says more than 100 million viewers watch its TV shows and movies using other people’s passwords, and it wants to convert those views into cash. “Make no mistake, I don’t think consumers are going to love it right out of the gate,” the _Journal_ reports Netflix co-CEO Ted Sarandos telling investors earlier this year. Elsewhere, the UK government’s Intellectual Property Office said it believes sharing passwords for online streaming services could breach copyright laws. It is unlikely anyone would ever be prosecuted, though.

The Roomba J7 home robot uses “PrecisionVision Navigation” to avoid objects in your home—such as piles of clothes on the floor or accidental piles of dog crap. The robot is partly able to do this using a built-in camera and computer vision. However, as _MIT Technology Review_ reported this week, gig economy workers in Venezuela posted photos from the robots online—including one image of a woman on the toilet. The photos and videos were captured by a development version of the J7 robot in 2020 and shared with a startup that contracts workers to label the images, helping to train computer vision systems. Those using the development machines had agreed for their data to be shared. Roomba maker iRobot, which is being purchased by Amazon, said it is ending its contract with the startup that leaked the images and is investigating what happened. However, the incident highlights some of the potential privacy risks with the vast data sets that are used to train artificial intelligence applications.

All Kelly Conlon wanted to do was watch the Rockettes with her daughter’s Girl Scout troop. But thanks to a face recognition system run by Madison Square Garden Entertainment, Conlon was summarily kicked out of Radio City Music Hall because she was unknowingly banned from the venue. The issue, according to MSG Entertainment, is that Conlon is an attorney at a law firm that’s currently engaged in litigation against the company. (Conlon said she is not personally involved in that litigation.) “They knew my name before I told them. They knew the firm I was associated with before I told them. And they told me I was not allowed to be there,” Conlon told NBC New York. MSG Entertainment, meanwhile, defended the attorney's expulsion as necessary to avoid an “inherently adverse environment.” The episode adds to concerns over the use of face-recognition tech, which remains so underregulated that a corporation can use it to punish its enemies. Happy holidays!

Russians Hacked JFK Airport Taxi Dispatch in Line-Skipping Scheme

Don’t be fooled by its fun name and Tamagotchi-like interface—this do-everything gadget is trouble waiting to happen and a whole lot more.

Across the US, countless buildings, from government offices to your next hotel room door, are protected by RFID-controlled locks. On a recent trip to my office, I passed nearly 20 of these keyless entry systems, which are among the most pervasive in the world. But a playful palm-sized gadget with a Tamagotchi-like interface can likely thwart the locks on many of these doors. 

The $200 device is called Flipper Zero, and it’s a portable pen-testing tool designed for hackers of all levels of technical expertise. The tool is smaller than a phone, easily concealable, and is stuffed with a range of radios and sensors that allow you to intercept and replay signals from keyless entry systems, Internet of Things sensors, garage doors, NFC cards, and virtually any other device that communicates wirelessly in short ranges. For example, in just seconds, I used the Flipper Zero to seamlessly clone the signal of an office RFID badge tucked safely inside my wallet.

If you had only heard about Flipper Zero through TikTok, where the tool has gone viral, you might think that it was a toy that could make ATMs spit out money, cars unlock themselves, and gas spill out of pumps for free. I spent the last week testing one to determine whether the world was as vulnerable to Flipper Zero as social media made it out to be. What I found was mixed: Many of the most dramatic videos posted to TikTok are likely staged—most modern wireless devices are not susceptible to simple replay attacks—but the Flipper Zero is still undeniably powerful, giving aspiring hackers and seasoned pen-testers a convenient new tool to probe the security of the world’s most ubiquitous wireless devices. 

In reviews, people liken Flipper Zero to a Swiss Army knife for physical penetration testing. But in my week testing Flipper Zero, it felt more like a blacklight—something I could literally hold up to a device that would reveal information, invisible to the human eye, about how it worked, what data it was emitting, and how often it was doing so. 

Here’s a brief list of some things I’ve learned with the help of Flipper Zero this week: Some animal microchips will tell you the body temperature of your pet. My neighbor’s car tire pressure sensor leaks data to anyone in range of the signal. My iPhone blasts my face with infrared signals every few seconds. My home security system has built-in signal-jamming detection. WIRED’s office bathroom has a soap dispenser that broadcasts whether it needs a refill.

When I told Alex Kulagin, one of Flipper Zero’s co-creators, about my experiences using his tool to make these kinds of mundane observations, he explained that this is exactly what the device is meant for. “We want to help you understand something deeply, explore how it works, and explore the wireless world that’s all around you but difficult to understand,” he says. 

Kulagin and his business partner, Pavel Zhovner, first came up with the idea for Flipper Zero in 2019. Since then, their company has sold 150,000 devices and they’ve grown their team to nearly 50 people. But as they’ve grown, they’ve encountered some resistance. This summer, payments of more than $1.3 million were held up by PayPal, and in September, US Customs and Border Patrol seized a shipment of devices. According to Kulagin, CBP released the shipment after a month but has yet to tell the company why it held the shipment. CBP declined WIRED’s request to comment about the seized Flipper Zeros.

Bob Zahreddine is a lieutenant for the Glendale Police Department and executive officer with the High Tech Crime Cops, an industry group made up of law enforcement officials that, according to its website, “connects cyber cops and investigators.” Zahreddine says that he isn’t necessarily surprised that CBP has taken an interest in Flipper Zero. “Because Flipper Zero is so customizable, the potential is there for it to be used in all sorts of crime,” he says. 

Zahreddine’s organization maintains a listserv where investigators will often solicit advice from their peers and share news or information about developments in the latest law enforcement technology. He told WIRED that while he hasn’t heard any chatter about Flipper Zero being used in any crimes on his listserv, investigators there are aware of the tool and have been following its development since Kulagin and Zhovner began fundraising on Kickstarter. 

Indeed, it’s easy to imagine how someone could break the law or even just get up to some petty mischief with this device. For instance, not only was I able to clone the ID badge of my office with Flipper Zero, I was able to record the signal that my neighbor’s garage door opener makes when he pulls into his driveway. Older cars that don’t use rolling code encryption are likely unlockable with the device, and my Flipper Zero was able to read my credit card number through my wallet and pants.

But Kulagin isn’t particularly concerned about his tool’s potential for criminal mischief. “Obviously, there are old cars that are vulnerable to Flipper. But they aren’t secure by definition—that is not Flipper’s fault,” he says. “There are bad people out there, and they can do bad stuff with any computer. We aren’t intending to break laws.”

To that end, Flipper Zero’s firmware, by default, prevents individuals from transmitting on frequencies that are banned in the country the device is in, and Flipper Zero’s Discord server explicitly forbids discussions about alternative firmware with illegal features. The tool also isn’t able to copy or replay any encrypted signals. For instance, while I was able to read the signal from my credit and debit cards, I was unable to use that signal to actually pay for anything with contactless payment systems. However, because the project is open source, a savvy Flipper user could adjust the firmware to enable additional, perhaps malicious, functionality.

When I asked Kulagin whether he had been contacted by law enforcement about the Flipper, he told me that he hadn’t. “No, not yet at least,” he says.

While it’s possible to get into trouble with a device like a Flipper Zero, the tool undeniably gives any curious person looking to learn about the devices around them a way to access and dissect the signals and protocols that power our lives. Personally, I am more engaged with the technology I encounter while walking around after my week with the Flipper Zero. I’m thinking more like a pen-tester.

What Is Flipper Zero? The Hacker Tool Going Viral on TikTok, Explained

A new US State Department assessment highlights the stark economic toll of Tehran’s recent shutdowns and platform control.

As internet shutdowns, platform blocking, and content filtering become increasingly common levers for authoritarian control around the world, Iran has presented an especially dramatic case study on the economic impact and humanitarian toll of connectivity blackouts. 

In response to mass government opposition and protests, the Iranian regime launched an extensive shutdown in September that drastically limited all digital communication in the country. And Tehran has ongoing campaigns to slow connectivity and access to popular services, including Meta's Instagram. Dragging out the disruptions, though, is beginning to reveal the true economic toll of the brutal technique, according to new assessments by the US Department of State.

Iran is already a heavily sanctioned and isolated nation, yet the government has repeatedly imposed broad digital restrictions and shutdowns, including notable initiatives in 2017 and 2019. The cumulative impact of these crackdowns has affected the rights of more than 80 million people living in Iran and disrupted every aspect of Iranian society, including commerce.

“This is another instance, an important one, in which the officials show how they consistently pick their own self-interest over the public interest,” says Reza Ghazinouri, a strategic adviser for the San Francisco–based human rights and civil liberties group United for Iran. “In the past years, millions of Iranians have fallen below the poverty line, and further limiting access to platforms like Instagram just adds many more to that number. And this disproportionately impacts women. Sixty-four percent of Iranian businesses on Instagram are women-owned.”

From communicating with customers to processing transactions, businesses rely on digital platforms in different ways, but digital disruptions have an impact on businesses of all sizes. Multiple Iranian trade associations have said in recent weeks that their member companies are reporting major losses. And some reports have found that the recent outage affected hundreds of thousands of small businesses. 

“This censorship underscores the degree to which Iran’s leadership fears what is possible when its people can freely communicate with one another and the outside world,” Rob Malley, US special envoy for Iran, told WIRED in written remarks.

The protest movement in Iran has gained momentum since 22-year-old Mahsa Amini died in the custody of Iran's “morality police” while being held for allegedly breaking rules about wearing hijab. Since September, more than 18,000 people have been detained by Iranian law enforcement related to the demonstrations, and nearly 500 people, including nearly 60 children, have been killed at the protests as officials exert increasingly draconian force on demonstrators. 

Analysis of the recent shutdown by a consortium of digital rights groups, published at the end of November and cited by the State Department, showed that the Iranian government has been deploying an increasingly broad set of technical capabilities to make it more difficult for the population to circumvent digital restrictions. For example, the government has broadened its ability to block encrypted connections to defeat users' efforts to conceal their web browsing. Officials have also continued to expand their blocks on the Google Play Store, Apple's App Store, and browser extension stores, making it harder for Iranians to download circumvention tools. The findings also indicate that there is a cumulative impact and increasing effectiveness over time as the government stacks censorship, content filtering, and blocking with intermittent and large-scale outages.

It is difficult to gauge the exact economic impact of the digital blackouts and disentangle it from other factors like international sanctions. Based on the escalating internet shutdown tactics and tolerance for self-inflicted damage, though, the State Department believes that the Iranian regime feels more threatened by the recent protest movement than previous public waves of opposition. 

Earlier this month, in a high-profile concession to protesters, the Iranian government said it had shut down the “morality police” that enforced restrictive laws, particularly a rigid Islamic dress code for women. The laws are still in place, though, and it is unclear how much the move will actually impact enforcement in practice.

A State Department spokesperson told WIRED in a statement that the White House is “committed to helping the Iranian people exercise their universal right to freedom of expression and to freely access information via the internet.”

Source

Wired