Researchers found that mobile applications contain keys that could provide access to both user information and private files from unconnected apps.

As with any piece of software, mobile apps can create an array of security issues and exposures, from rogue programs that are intentionally malicious to apps that contain an obscure but significant flaw. Now, new research is shedding light on systemic oversights in mobile app cloud infrastructure that are all too common and create the risk that users' data could leak where it shouldn't or be compromised.

Researchers from Broadcom's Symantec Threat Hunter team published findings on Thursday about the prevalence of hard-coded authentication credentials lurking in the cloud services that underlie hundreds of mainstream apps. These login credentials are often meant to give the app access to a single file or service, like a mechanism for an app to display public images from a company's website or run text through a translation service at a user's request. But in practice, the researchers found, these same credentials often grant access to all files stored in a cloud service, like company data, database backups, and system control components. And when multiple apps have been created by the same third-party development firm or incorporate the same publicly available software development kits (SDKs), these static authentication tokens may even grant access to the infrastructure and user data of multiple, unconnected apps.

All of this means that if an attacker discovered these access tokens, they could potentially unlock massive and disparate troves of sensitive data all by finding one key under one doormat.

“The cloud is still kind of a new frontier. And sometimes when you hear about the practices being used, you realize that a lot of organizations may not be where they are with security on other fronts,” says Symantec's Dick O’Brien. “It’s hard to say whether it’s people cutting corners or whether it’s just an ignorance of what you’re exposing by putting those credentials out there, but it’s certainly obvious that data isn’t being ring-fenced anywhere near the way it should be."

The researchers found 1,859 publicly available apps on both Android and iOS that contained hard-coded Amazon Web Services credentials. The vast majority were iOS apps, a discrepancy Symantec says it has tracked for years but hasn't fully explained. The credentials present in more than three-quarters of the apps granted access to private cloud services, and nearly half of those additionally gave access to private files. Fifty-three percent of the apps contained access tokens that were also found in other, often totally unrelated, apps.

“Initially it was very surprising, but this is a systemic thing,” O’Brien says. “People need to do a complete audit of what they’re using and realize that there are multiple layers there. The practice of implementing hard coded access keys is not great. Temporary credentials that expire after a short period of time are probably the way to go, and also there needs to be greater awareness that you need to silo information.” 

Symantec says it has notified the developers of the apps where it sees the most pressing issues and hopes to raise awareness about how insecure development practices and shared resources can create exposures without careful consideration and segmentation. 

In one case, the researchers realized that several mainstream iOS banking apps were all using the same third-party AI digital identity software development kit that exposed cloud credentials of the shared service. While none of the banking apps themselves created the SDK, the credentials exposed its server structure and infrastructure blueprints, source code, and the AI models underlying the identity service. And more than 300,000 biometric fingerprint files from users of five of the mobile banking apps were leaking and potentially exposed.

In another case, the researchers noticed what it calls a large hospitality and entertainment company working with a technology company on sports betting apps. In total, hard-coded credentials gave infrastructure access to 16 online gambling apps, exposing their cloud services and even granting root access to take control of this backend platform. 

Symantec's O’Brien emphasizes that while the company isn't naming the impacted apps, it hopes the findings will raise awareness about these common pitfalls and their potentially outsize impact on users. “The things we found—it illustrates the significance of what we’re dealing with here,” he says.

Careless Errors in Hundreds of Apps Could Expose Troves of Data

Prepaid phones are looking good as privacy worries peak.

Even if surveillance overreach (abortion bounty-hunting, police use of face recognition) doesn't make you want to ditch your smartphone for something less connected, you could still consider a burner phone, a practically disposable prepaid mobile device that's not under contract with a wireless carrier.

Yep, prepaid cell phones that were popularized by brands like Boost Mobile and Cricket in the mid-aughts, and in pop culture by their frequent use in TV's _The Wire__,_ are still around. In fact, tens of millions of customers still go for burner phones, whether they're flip phones or smartphones on Android or iOS from providers such as Verizon-owned TracFone, Simple Mobile, or Total Wireless.

What's the appeal? The idea is that a cheap phone with prepaid calling minutes and data is disposable, free of any contract commitment, and more private. For someone who uses a cell phone or data plan infrequently, it could be much cheaper than a typical mobile phone plan.

Prabhat Agarwal, senior director of research and trends at the Consumer Electronics Association, says that while wireless companies steer customers to post-paid plans with higher-margin 5G data plans and longer commitments, prepaid phones “are not going away anytime soon. There's a lot of groups for which prepaid makes a lot of sense,” he explains.

If you pay cash for the hardware and the service, you are theoretically untethered from being traced to the phone with your bank account, credit card, or home address. Of course, that anonymity vanishes the moment you start using a burner phone to log in to your Facebook account or you commit a crime serious enough to warrant the authorities investigating who used a burner phone to, say, plan an _Ocean's 11_\-style casino heist.

Going off-grid isn't the only reason to get a prepaid phone, though. Maybe you want a dedicated second phone for a side hustle like Lyft driving that doesn't get used all the time, since it won't be subject to use-it-or-lose-it monthly fees. You might be someone who wants to keep your online dating or personal email completely separate from the premium smartphone you use for work. Or you could use a cheap, locked-down phone that allows your kids to call friends and grandparents and play games. A cheap prepaid device won't cause as much stress if the screen gets cracked or the handset ends up in the toilet.

In all these cases, a burner phone can allow you to be accessible by phone but with a different phone number than your main one. If you value keeping your main cell number nonpublic, but you still need to be reachable to a large number of people, a prepaid phone may be simpler than getting a second line or using a service like Google Voice.

How to Choose a Burner Phone

If that sounds interesting, the first thing you need to decide is _how_ _much_ burner phone you actually need. If it's just for phone calls and light data communication, you could go retro with a flip phone and hope you remember how to use T9 texting.

Especially for smartphones, depending on the model, there might be limited built-in memory for apps, video, and other data. You may also need to supply your own SIM and SD cards to use the mobile network and expand the phone's memory. Make sure you remove both of those cards before you get rid of the phone, or at least wipe the memory on the SD card first.

Expect to pay anywhere from $20 for a cheap flip phone to $300 or more for something like a fully loaded prepaid iPhone 11. If being untrackable is your primary goal, paying with a credit card or online account might defeat the purpose. Go to a store. Pay cash or use a gift card. Burn the receipt, or, better yet, don't ask for one.

Prepaid phone plans that include voice, text, and data might be sold in time increments from a month at a time up to a year. Some may offer “unlimited” usage, but be sure to read the fine print on what that actually means. One thing to watch out for, Agarwal says, is that some prepaid data plans have much lower data allotments and may throttle the speed of the network even before you hit your data limit. You should also be aware of what wireless network the prepaid provider uses. For instance, Cricket uses AT&T's mobile network, and TracFone is on Verizon's. That matters less for privacy, but more for understanding where you’ll have service and what speed of wireless service will be available.

If you don't want new hardware in your life, you could look for a software solution such as the aptly named Burner app, available for iOS and Android that promises to give you a second phone line and more privacy for $3.99 to $4.99 a month, depending on your plan.

How to Use a Burner Phone

First, as with any device, you'll need to activate the phone. (There's usually easy-to-follow instructions in the phone packaging.) You can keep buying additional data and voice minutes with prepaid cards you buy in stores or online.

Depending on the phone, you might have access to apps you're already familiar with that offer good privacy and encryption options, such as Telegram or Signal. You could also use VPN apps to further anonymize your online activity.

However, you should understand that no matter how careful you are to protect your privacy, any login to a website from a burner phone or even hopping onto a Wi-Fi network could expose your location data and other private information. The Intercept has a good video guide geared toward protestors with tips to keep some of that data private.

Once you're done with a burner phone, you can erase the data on it with a factory reset (don't forget to wipe the SD card if one is in use). Then stash it away, throw it away, or resell it on the secondary market to a site such as Gazelle or Swappa. You may even be able to trade it in with a wireless carrier.

You’re Not Stringer Bell, but You May Still Need a Burner Phone

Plus: Chrome patches another zero-day flaw, Microsoft closes up 100 vulnerabilities, Android gets a significant patch, and more.

August was a bumper month for security patches, with Apple, Google, and Microsoft among the firms issuing emergency fixes for already exploited vulnerabilities. The month also saw some big fixes arriving from the likes of VMWare, Cisco, IBM, and Zimbra.

Here’s everything you need to know about the important security fixes issued in August.

Apple iOS 15.6.1

After a two-month patch hiatus, followed by multiple fixes in July, Apple released an emergency security update in August with iOS 15.6.1. The iOS update fixed two flaws, both of which were being used by attackers in the wild.

It is thought that the vulnerabilities in WebKit (CVE-2022-32893) and the Kernel (CVE-2022-32894) were being chained together in attacks, with serious consequences. A successful attack could allow an adversary to take control of your iPhone and access your sensitive files and banking details.

Combining the two flaws “typically provides all the functionality needed to mount a device jailbreak,” bypassing almost all Apple-imposed security restrictions, Paul Ducklin, a principal research scientist at Sophos, wrote in a blog analyzing the vulnerabilities. This would potentially allow adversaries to “install background spyware and keep you under comprehensive surveillance,” Ducklin explained.

Apple always avoids giving out details about vulnerabilities until most people have updated, so it’s hard to know who the attack targets were. To ensure you are safe, you should update your devices to iOS 15.6.1 without delay.

Apple also released iPadOS 15.6.1, watchOS 8.7.1, and macOS Monterey 12.5.1, all of which you should update at the next opportunity.

Google Chrome

Google released a security update in August to fix its fifth zero-day flaw this year. In an advisory, Google listed 11 vulnerabilities fixed in August. The patches include a use-after-free flaw in FedCM—tracked as CVE-2022-2852 and rated as critical—as well as six highly rated issues and three classed as having a medium impact. One of the highly rated vulnerabilities has been exploited by attackers, CVE-2022-2856.

Google hasn’t provided any detail about the exploited flaw, but since attackers have gotten ahold of the details, it’s a good idea to update Chrome now.

Earlier in August, Google released Chrome 104, fixing 27 vulnerabilities, seven of which were rated as having a high impact.

Google Android

The August Android security patch was a hefty one, with dozens of fixes for serious vulnerabilities, including a flaw in the framework that could lead to local privilege escalation with no additional privileges needed. Meanwhile, an issue in the media framework could lead to remote information disclosure, and a flaw in the system could lead to remote code execution over Bluetooth. A vulnerability in kernel components could also lead to local escalation of privileges.

The Android security patch was late in August, but it’s now available on such devices as Google’s Pixel range, the Nokia T20, and Samsung Galaxy devices (including the Galaxy S series, Galaxy Note series, Galaxy Fold series, and Galaxy Flip series).

Microsoft

Microsoft’s August Patch Tuesday fixed over 100 security flaws, of which 17 are rated as critical. Among the fixes was a patch for an already exploited flaw tracked as CVE-2022-34713, also known as DogWalk.

The remote code execution (RCE) flaw in the Windows Support Diagnostic Tool (MDST) is rated as having a high impact because exploiting it can result in a system compromise. The vulnerability, which affects all users of Windows and Windows Server, was first exposed over two years ago in January 2020, but Microsoft didn’t consider it a security issue at the time.

VMWare

VMWare fixed a bunch of flaws in August, including a critical authentication bypass bug tracked as CVE-2022-31656. On releasing the patch, the software firm warned that public exploit code is available.

VMWare also fixed an RCE vulnerability in VMware Workspace ONE Access, Identity Manager, and Aria Automation (formerly vRealize Automation), tracked as CVE-2022-31658 with a CVSS score of eight. Meanwhile, a SQL injection RCE vulnerability found in VMware Workspace ONE Access and Identity Manager also got a CVSS score of eight. Both require an attacker to have administrator and network access before they can trigger remote code execution.

Apple Fixed a Serious iOS Security Flaw—Have You Updated Yet?

In the last two weeks of the war, an ad hoc team armed with group chats, QR codes, and satellite maps launched a mad dash to save imperiled Afghan allies.

Inside the Shadow Evacuation of Kabul

Anti-Putin media network February Morning has become a central player in the underground fight against the Kremlin.

On the evening of August 20, Russian TV pundit and conspiracy theorist Darya Dugina was killed on the outskirts of Moscow when a powerful explosion ripped apart her Toyota Land Cruiser. Dugina was a vocal supporter of Russia's invasion of Ukraine and the daughter of fascist philosopher and writer Alexander Dugin, nicknamed “Putin’s brain” thanks to his perceived ties to Russian president Vladimir Putin. According to Russian authorities, a remote-controlled “explosive device,” presumably installed in her car, went off at around 9 pm local time.

News of Dugina’s assassination spread like wildfire through social media, most notably on the instant messaging service Telegram, where it was shared approvingly by a vast network of Russian and Ukrainian channels. But in the hours that followed, it became clear that one channel, operated by the media outlet Utro Fevralya, or February Morning, is more than just a place to share the news. It aims to play a key role in the story.

Created by exiled former Russian MP and dissident Ilya Ponomarev, February Morning was the first to report on a group claiming responsibility for Dugina’s death. Ponomarev himself took to YouTube, where February Morning airs its shows, claiming that the perpetrators were a little-known Russian resistance group called the National Republican Army. According to Ponomarev, an all-out war against “Putinism” had just begun.

While the National Republican Army’s involvement remains unconfirmed, Ponomarev’s announcement crystallized February Morning’s role as the center of gravity of a growing guerilla movement to spark revolution in Russia. The movement’s ecosystem includes activists and saboteurs of all types, from anarchists to fascists, connected through a network of Telegram channels and a singular goal: overthrowing Vladimir Putin.

Making History

On a sun-drenched balcony overlooking a busy street in downtown Kyiv, 48-year-old Evgeni Lesnoy smokes a final cigarette before going back on the air. The seasoned journalist is one of the faces of February Morning, which he joined shortly after its creation following Russia’s invasion of Ukraine in the early hours of February 24. “Because of my friends and relatives who stayed in Russia, I had been closely following the events there prior to February 24,” Lesnoy says in Russian. After his outspoken condemnation of the war in Donbas and the annexation of Crimea cost him his friends and, ultimately, his job, the journalist left Russia for Ukraine in 2015 and has been living with his husband in Kyiv ever since.

“When I was told that this project existed, I figured that this is where I needed to be,” he says, gesturing towards the TV studio in the next room. “Because I understand the context of what is happening inside Russia: I was born there, and I understand how people there think.”

Ponomarev, February Morning’s founder, is the only member of the Russian Duma to have voted against the 2014 annexation of Crimea. After the vote, he became persona non grata in Putin’s Russia, so he and his family fled to Ukraine’s capital city and started a new life. “For quite a long time, I had wanted to create a media aimed at a Russian audience, and that would broadcast from Kyiv,” he tells WIRED over Signal. “I tried to raise money for what I thought would be a Russian-language Al-Jazeera for maybe a year._”_ The venture was unsuccessful. But when Russian tanks crossed into Ukraine, the former MP and father of two joined the Territorial Defense in Kyiv, and the project took on new urgency. “After the first couple of days, many of my friends started telling me that now might be the time to revisit the idea of a media targeting Russians.”

The living room of the 18th-century apartment in which February Morning has taken residence is home to its television studio with a semicircular stage lit with a bluish light. Two screens broadcast in the background. When presenting the day’s show, Lesnoy sits before a small table draped with a white and blue tricolor flag—the symbol of the Russian opposition to the invasion—and that of Ukraine.

Broadcast on YouTube, the professionally produced daily programs try to counter the official Russian narrative surrounding the war, reporting on the atrocities committed by the “occupiers” against the Ukrainian population. “Putin’s supporters and apologists have big media organizations and prime-time news shows,'' says Lesnoy. “We want to give a voice to those who oppose the war.”

Which is what Ponomarev did on August 21, when he claimed on air that the National Republican Army assassinated Dugina—an act he described as “legitimate.” He also read the group’s purported manifesto, which called on all Russians to join the ranks of the National Republican Army and vow to destroy all those who have “usurped their power.”

February Morning’s insights into the domestic resistance movement in Russia stem from its 27 regional outlets, each with its own Telegram channel where activists and journalists mingle to gather and share news of anti-Putin actions. A binational team of around 70 journalists, technicians, and activists operates covertly in the far-flung regions of Russia and in Kyiv. In addition to its studio in Ukraine’s capital, the network brazenly broadcasts from Moscow. “I don't know how long the studio there will be able to operate, but even if the FSB shows up at the door and shuts us down, there will be another one,” says Ponomarev.

Whereas most media outlets only report the story, February Morning intends to be part of it. “We are referring to ourselves as the Russian ‘NEXTA,’ the Belarusian resource that played a key role in the protests two years ago following the reelection of Alexander Lukashenko,” says Ponomarev, referring to Belarus’ autocratic leader. “We want to be the resource that will play a critical role in the future revolutionary changes in the country.”

To this end, Ponomarev and his team have set up a Telegram channel known as Rospartizan, which has become an aggregator for information pertaining to the resistance to Putin and the war in Ukraine as well as a key recruitment tool. Every day, Rospartizan relays the latest developments across Russia, from the torching of a military recruitment office to the unfurling of an antiwar banner in front of the Russian Ministry of Defense building in Moscow.

According to Ponomarev, representatives of the National Republican Army first made contact with him through Rospartizan, a testament to the channel’s growing notoriety. “We are providing, in my opinion, the most comprehensive news stream on what is going on in Russian regions, in terms of acts of sabotage and the actual resistance,” says Ponomarev. The National Republican Army’s manifesto concludes, “stay in contact with us through the Rospartizan Telegram channel.”

With more than 26,000 followers, Rospartizan embraces anyone who’s anti-Putin, no matter their political ideology—a feature, not a bug, according to Ponomarev, a former Communist Party member and self-described “social globalist.”

“I am right now not only reaching out, but very actively interacting with not only my friends on the left side of the political spectrum,” he says, “but also with people on the far-right, who we are usually fighting with.”

The Enemy of My Enemy

Roman Popkov, the former head of the Moscow branch of the National-Bolshevik party, falls into that far-right camp. Popkov used to be a member of the influential Russian National Unity, a now-defunct neo-Nazi group responsible for a string of racist crimes, before joining the political party founded by controversial Russian writer, poet, and dissident Eduard Limonov, who sought to unite far-left and far-right radicals on the same platform.

In 2006, after years of harassment by Russian security forces, Popkov was arrested and spent more than two years in pretrial detention in the infamous Butyrka prison. The European Court of Human Rights ruled that his detention was illegal, and his arrest is widely considered to have been motivated by his political activism.

Popkov, now residing in Ukraine, works as a journalist for a number of independent media outlets, and is the head of a recently launched media project called Poslezavtra, or “The Day After Tomorrow.” An “old friend” of Ponomarev, Popkov has featured extensively on February Morning’s shows and took part in the broadcast that followed Dugina’s assassination.

“We are covering direct actions targeting the military and the apparatus of political repression of Putin's regime,'' Popkov says over the phone. “First of all, we are trying to inspire people, to get them to act, and second, we inform and report on what is being done.”

Like Ponomarev, Popkov stresses that activists’ ideologies are not as important as a willingness to defy Putin’s regime and to oppose the war in Ukraine.

“Our collective unites people opposed to Putin's regime, with different political views and ideologies,” says Popkov. “At the moment, it's not that important if one is an anarchist, a nationalist, or a liberal as, since Russia is not a democracy, we have no representation in parliament, and can't vote for our candidates.”

According to Popkov, acts of sabotage in Russia are mostly the work of small-scale far-right and far-left groups, the most famous of those being the Anarcho-Communist Combat Organization, or BO-AK. The organization rose to prominence after it sabotaged the railway leading to a Russian military arsenal in the small town of Kirzach, 100 km east of Moscow. The group shared photos of the sabotage on their own Telegram channel, which quickly spread to other anti-Putin channels, including Rospartizan, and was soon featured on February Morning’s broadcast.

Yet even the staunch anarchists of the BO-AK acknowledge the need to reach out to the other side of the political spectrum. “Most of our contacts are from our ideological camp, but not all,” an anonymous representative of the group tells WIRED. “We believe that alliances with different forces are necessary in our struggle.”

The anarchists of the BO-AK consider direct actions and acts of sabotage as the best way to kickstart the social revolution, a view shared by many members of Rospartizan. In addition to two sabotage operations targeting military railways, the BO-AK claims to have set fire to a cell phone tower in the Belgorod region “in order to damage Putin’s army communications in Ukraine.”

“Only those who can back it with their actions can call themselves the opposition,” an anonymous contributor to Rospartizan says over Telegram, “be them a Molotov cocktail thrown at a military recruitment office, a wire strung across train tracks, or a gas canister taken to the car of a regime collaborator.”

Dangerous Cocktails

Inspired by the Belarusian resistance to Lukashenko and the protestors’ innovative use of Telegram, Popkov, Ponomarev, and activists like the anarchists of BO-AK have turned to social media to organize, recruit, and incite people to act against the war and Putin’s increasingly authoritarian regime.

“Telegram is a less censored, more intelligent, and politicized social network. A large part of our immediate target audience is present here—people who are potentially interested in radical politics,_”_ says the BO-AK. “This is where lies the usefulness of social networks for campaigning and education—they are an excellent channel for broadcasting and communicating.”

Antiwar activists in Ukraine and in Russia have taken full advantage of the relative anonymity Telegram provides. A website known as Ostanovi Vagony, or “Stop the Wagon,” and its associated Telegram channel aim to educate Russian would-be partisans on the safest, most effective ways to sabotage the railway system. Meanwhile, a Telegram channel created in late May called Gromko (“loud” in Russian) creates sleek infographics explaining how to make a Molotov cocktail—described as the best way to disable the car of a Putin sympathizer—or how to deface the regime’s propaganda posters.

This material is regularly shared by Ponomarev's Rospartizan, which has become a central conduit for guerrilla efforts to rally new recruits, spread information and news, and, purportedly, to facilitate the assassination of a high-profile regime collaborator. In an interview with Russian independent media Meduza, Ponomarev claimed to have known in advance that “something was going to happen” ahead of Dugina’s assassination. He further claimed that he helped the National Republican Army exfiltrate Natalya Volk, the woman whom Russian security services named as the main suspect in her death: “Sometimes people need to be saved from FSB persecution, they need to be pulled out of Russia—we pull them out.”

Telegram did not respond to WIRED's request for comment.

While unconfirmed, the number of acts of sabotage targeting military and state infrastructure in Russia appears to grow weekly. According to Russian independent media Insider, there have been more than 20 attacks on military registration and enlistment offices in Russia (which were reported by the media and Telegram channels), most of which were arson. “There were no similar incidents last year,” notes Insider journalist Alisa Zemlyanskaya, writing under a pseudonym. Meanwhile, an estimated 63 freight trains derailed in Russia between March and June, a significant increase compared to the same period last year.

Russian authorities, eager to downplay the significance of the apparent sabotage efforts, have blamed those incidents on the poor condition of the railway system. The scale of guerrilla attacks on Russian entities remains, therefore, difficult to assess.

“When it comes to railway sabotage especially, it's difficult, or even impossible, to tell if it’s sabotage, or if it’s an accident due to a technical problem, or to the incompetence of the authorities,” says Popkov.

According to the BO-AK—whose members signed the sabotaged section of rail in Kirzach with the name of their group and the link to its Telegram channel—“that’s because many guerrilla groups do not leave any message or position themselves in the media in any way.”

“In any case, every week there are several reports of railway sabotage, the destruction of power lines, and other acts of resistance,” says the group. “This suggests that the guerrilla movement is not a mass movement, but a fairly large-scale one.”

Russian security services are quick to blame infiltrated Ukrainian saboteurs for these attacks. Regardless of who’s behind them, acts of sabotage continue unabated: On August 17, yet another freight train derailed near Mogilev, in Belarus, while last Wednesday, a man threw two Molotov cocktails at the regional administration building in Oryol, in western Russia.

Fire-bombing a car or derailing a Russian train can, of course, carry significant penalties. But even less extreme activities are dangerous, especially in light of a slew of new repressive Russian laws. In July, lawmakers updated Russia’s Criminal Code to crack down on working with “foreign states and organizations,” public activities “directed against the security of the state,” and the production and public display of “Nazi paraphernalia or symbols.” Because Putin has repeatedly claimed, baselessly, that Ukraine was run by a clique of drug addicts and Nazis and cited “denazification” as one of the primary motivators of his invasion, this last amendment could potentially land an antiwar protestor waving a Ukrainian flag in prison.

According to Russian independent media OVD-Info, authorities in Russia detained some 16,500 people between February and July for having taken part in protests or actions against the war.

Activists and dissidents both in Russia and abroad expose themselves to retaliation from Putin’s regime—a fact that they are acutely aware of. “I'm a reasonable person, I don’t think I'm invulnerable or immortal,” Ponomarev says. “So I do understand that there are issues with security and everything. But I have done a lot of effort to protect myself and the place where I live, as well as the way I move across the city.” Those concerns have been heightened following Dugina’s assassination and Ponomarev’s subsequent declarations. On August 21, a member of the Russian government proposed a contest for the best video or photo of the dissident politician “crawling on broken legs and apologizing while spitting his teeth.”

“I’m not going to pretend that I am not scared at all,” says February Morning’s Lesnoy after his last interview of the day had ended. “But I live in Ukraine, where Putin is waging war. Everybody here is at risk.”

When asked about their motivation for joining the resistance and potentially exposing themselves to repression, an anonymous contributor to Rospartizan summed it up simply: “Let us use the platitude, ‘who else if not us?’”

The Telegram-Powered News Outlet Waging Guerrilla War on Russia

Plus: An Iranian hacking tool steals inboxes, LastPass gets hacked, and a deepfake scammer targets the crypto world.

This week, former Twitter chief security officer Peiter “Mudge” Zatko filed an explosive whistleblower complaint against the company. The allegations, which Twitter contests, claim the social media firm has multiple security flaws that it hasn’t taken seriously. Zatko alleges Twitter put an Indian government agent on its payroll and failed to patch servers and company laptops. Among the claims, however, one stands out: the suggestion that Twitter engineers could access live software and had virtually untracked access to its system.

In a privacy win for students across the US, an Ohio judge has ruled that it is unconstitutional to scan students’ homes while they are taking remote tests. We also detailed the privacy flaw that is threatening US democracy—a lack of federal privacy protections means mass surveillance systems could be used against citizens in new ways.

Elsewhere, as Russia’s full-scale invasion of Ukraine passes six months, military forces are increasingly turning to open source data to back their efforts. Police in India are using facial recognition with very low accuracy rates—the technology is being widely used in Delhi but could be throwing up plenty of false positives. And we dived deeply (perhaps too deeply) into how four high school students hacked 500 of their schools’ cameras, across six locations, and rickrolled thousands of students and teachers. It’s one elaborate graduation prank.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Since Russia-backed trolls flooded Facebook and Twitter with disinformation around the 2016 US elections, the social media firms have improved their ability to bust disinformation networks. The companies frequently take down propaganda accounts linked to authoritarian states, such as Iran, Russia, and China. But it’s rare that Western disinformation efforts are discovered and exposed. This week, the Stanford Internet Observatory and social media analysis firm Graphika detailed a five-year operation that was pushing pro-Western narratives. (The research follows Twitter, Facebook, and Instagram as they remove a series of accounts from their platforms for “coordinated inauthentic behavior.”)

The propaganda accounts used memes, fake news websites, online petitions, and various hashtags in an attempt to push pro-Western views and were linked to both overt and covert influence operations. The accounts, some of which appear to use AI-generated profile pictures, targeted internet users in Russia, China, and Iran, among other countries. The researchers say the accounts “heavily criticized” Russia following its full-scale invasion of Ukraine in February and also “promoted anti-extremism messaging.” Twitter said the activity it saw is likely to have originated in the US and the UK, while Meta said it was the US.

Many of the techniques used by the online influence operation appear to mimic those the Russia-backed accounts used in the buildup to the 2016 elections. It’s likely, however, that the Western influence operations weren’t that successful. “The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19 percent of the covert assets we identified had more than 1,000 followers,” the researchers say.

In recent years, Charming Kitten, a hacking group linked to Iran, has been known for its “aggressive, targeted phishing campaigns.” These phishing efforts aim to gather the usernames and passwords of people’s online accounts. This week, Google’s Threat Analysis Group (TAG) detailed a new hacking tool Charming Kitten is using that’s capable of downloading people’s entire email inboxes. Dubbed Hyperscrape, the tool can steal people’s details from Gmail, Yahoo, and Microsoft Outlook. “The attacker runs Hyperscrape on their own machine to download victims’ inboxes using previously acquired credentials,” TAG says in a blog post. The tool can also open new emails, download their contents, and then mark them as unread, so as not to raise suspicions. So far, Google says it has seen the tool used against fewer than two dozen accounts belonging to people based in Iran.

Password management company LastPass says it has been hacked. “Two weeks ago, we detected some unusual activity within portions of the LastPass development environment,” the company wrote in a statement this week. LastPass says an “unauthorized party” was able to gain access to its development environment through a compromised developer account. While the hacker (or hackers) were within LastPass’s systems, they took some of its source code and “proprietary LastPass technical information,” the company says in its statement. It has not detailed which elements of its source code were taken, making it difficult to assess the seriousness of the breach. However, the company does say that customer passwords and data have not been accessed—there’s nothing LastPass users need to do in response to the hack. Despite this, the indictment is still likely to be a headache for the LastPass technical teams. (It’s not the first time LastPass has been targeted by hackers either.)

The chief communications officer of crypto exchange Binance claims scammers created a deepfake version of him and tricked people into attending business meetings on Zoom calls with his fake. In a blog post on the company’s website, Binance’s Patrick Hillmann said that several people had messaged him for his time. “It turns out that a sophisticated hacking team used previous news interviews and TV appearances over the years to create a ‘deepfake’ of me,” Hillmann wrote, adding that the alleged deepfake was “refined enough to fool several highly intelligent crypto community members.” Neither Hillmann nor Binance has posted any images showing the claimed deepfake. Since deepfakes first emerged in 2017, there have been relatively few incidents of faked video or audio scams impersonating people. (The vast majority of deepfakes have been used to create nonconsensual pornographic images). However, recent reports say deepfake scams are on the rise, and in March of last year the FBI warned that it anticipated a rise in malicious deepfakes within the next 12 to 18 months.

A US Propaganda Operation Hit Russia and China With Memes

The phishing attack on the SMS giant exposes the dangers of B2B companies to the entire tech ecosystem.

The communication company Twilio suffered a breach at the beginning of August that it says impacted 163 of its customer organizations. Out of Twilio's 270,000 clients, 0.06 percent might seem trivial, but the company's particular role in the digital ecosystem means that that fractional slice of victims had an outsized value and influence. The secure messaging app Signal, two-factor authentication app Authy, and authentication firm Okta are all Twilio customers that were secondary victims of the breach.

Twilio provides application programming interfaces through which companies can automate call and texting services. This could mean a system a barber uses to remind customers about haircuts and have them text back “Confirm” or “Cancel.” But it can also be the platform through which organizations manage their two-factor authentication text messaging systems for sending one-time authentication codes. Though it's long been known that SMS is an insecure way to receive these codes, it's definitely better than nothing, and organizations haven't been able to move away from the practice completely. Even a company like Authy, whose core product is an authentication code-generating app, uses some of Twilio's services.

The Twilio hacking campaign, by an actor that has been called “0ktapus” and “Scatter Swine,” is significant because it illustrates that phishing attacks can not only provide attackers valuable access into a target network, but they can even kick off supply chain attacks in which access to one company's systems provides a window into those of their clients.

“I think this will go down as one of the more sophisticated long-form hacks in history,” said one security engineer who asked not to be named because their employer has contracts with Twilio. “It was a patient hack that was super-targeted yet broad. Pwn the multi-factor authentication, pwn the world.”

Attackers compromised Twilio as part of a massive, yet tailored phishing campaign against more than 130 organizations in which attackers sent phishing SMS text messages to employees at the target companies. The texts often claimed to come from a company's IT department or logistics team and urged recipients to click a link and update their password or log in to review a scheduling change. Twilio says that the malicious URLs contained words like "Twilio," "Okta," or "SSO" to make the URL and the malicious landing page it linked to seem more legitimate. Attackers also targeted the internet infrastructure company Cloudflare in their campaign, but the company said at the beginning of August that it wasn't compromised because of its limits on employee access and use of physical authentication keys for logins. 

“The biggest point here is the fact that SMS was used as the initial attack vector in this campaign instead of email,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “We’ve started to see more actors pivoting away from email as initial targeting and as text message alerts become more common within organizations it’s going to make these types of phishing messages more successful. Anecdotally, I get text messages from different companies I do business with all the time now, and that wasn’t the case a year ago.”

The hackers used their Twilio access to compromise 93 Authy accounts and authorize additional devices that the attacker controlled instead of the account owner. Authy has roughly 75 million users in all. Meanwhile, the Twilio breach potentially exposed 1,900 accounts on the encrypted communication app Signal, and attackers seem to have actually used the access to initiate takeovers of as many as three accounts. Because of how Signal is designed, attackers wouldn't have gotten access to a user's message history or contact list but would have been able to impersonate the user and send messages while in control of the account.

On Thursday, the online food delivery service DoorDash announced that it suffered a breach of some internal systems and user data because one of its third-party service providers was compromised. “Based on our investigation, we determined the vendor was compromised by a sophisticated phishing attack,” DoorDash wrote in a statement. “The unauthorized party used the stolen credentials of vendor employees to gain access to some of our internal tools.” The marketing automation platform Mailchimp said earlier this month that it was breached in a phishing attack on its employees as well.

Researchers from the cybersecurity firm Group-IB said in a report on Thursday that it had identified and notified 136 organizations that seemed to be victims of the phishing campaign. Of those, 114 victim companies are based in the United States. And the researchers found that the majority of targets are cloud services, software development companies, or IT management firms. The findings underscore the seemingly thoughtful and targeted nature of the campaign to maximize impact by focusing on internet infrastructure and business management services that provide crucial support, including components of login authentication, for large clients.

“We are very disappointed and frustrated about this incident,” Twilio wrote in an update on August 10. “Trust is paramount at Twilio, and we recognize that the security of our systems and network is an important part of earning and keeping our customers' trust.”

Phishing has been an inveterate and consequential threat for years, playing a role in many impactful breaches around the world, including Russia's attack on the Democratic National Committee in 2016. But if the next phase of the trend is phishing-fueled supply chain attacks, the scale of the collateral damage will magnify in an unprecedented way.

Why the Twilio Breach Cuts So Deep

An attack on Russian mercenaries shows how militaries are increasingly using open source data—with sometimes deadly consequences.

The shadowy Russian Wagner paramilitary group has been responsible for atrocities around the world. After first surfacing during Russia’s 2014 annexation of Crimea, Wagner mercenaries have been spotted across Central Africa, Syria, and Libya. Since March, according to British intelligence, Wagner forces have been operating in Ukraine, directly alongside Russia’s official military forces.

One part of the Wagner group was attacked in the city of Popasna, Ukraine, earlier this month. On August 8, a pro-Russian journalist in the area shared photos on the Telegram messaging app that allegedly showed the local Wagner headquarters. In doing so, they exposed the location of the group. One photo, which has since been deleted, included a sign revealing the base’s address. Ukrainian forces put the data to work.

A few days after the photos were posted online, Ukraine’s military turned the base to rubble, claiming they hit it using American-made rocket systems. A Ukrainian government official said that it “seems” the Wagner-operated location was found using the photos shared on Telegram. The strike appears to be one of the latest incidents in Russia’s full-scale invasion of Ukraine where open source intelligence—knowledge gained from publicly available information—has been used to target military attacks or inform tactical operations.

Analysts and online sleuths, such as journalists at the investigative news outlet Bellingcat, have developed and professionalized open source investigation techniques for years. Open source intelligence, also known as OSINT, involves the use of public data—such as social media posts, flight tracking data, and satellite images, among other sources—to let anyone investigate events worldwide, from potential war crimes to human rights violations.

Piecing together small details from multiple sources of information can allow investigators to understand a clearer picture of events on the ground. For instance, comparing features in a photograph, such as a row of trees, and matching them to satellite images can reveal a real-world location. OSINT investigations have previously uncovered Russia’s involvement in the downing of flight MH17; tracked down soldiers in Cameroon who allegedly killed children; and tackled human rights violations around the world.

Many of these investigations often take place online, far from events and often months or years after the events that have taken place. Throughout Russia’s invasion of Ukraine, OSINT has played a big role and changed many of the rules of conventional war. Satellite images have shown Russian troop buildups around Ukraine’s borders, identified Russian army commanders, and tracked those alleged to have killed Ukrainian prisoners of war.

“What you’re now seeing in Russia and Ukraine is a lot more of open source investigations geolocating targets, bases, military equipment,” says Jack McDonald, a senior lecturer in war studies at King’s College London, who studies information and privacy in war. OSINT has the potential to provide crucial intelligence to military forces defending Ukraine and launching counterattacks. McDonald says one of the biggest changes during this conflict has been the Ukraine government’s repurposing of the Diia public services app, which includes an “e-Enemy” feature allowing people to report the movements of Russian troops.

When it comes to militaries launching attacks using open source intelligence (including in the Wagner incident), it is unlikely that they will do so solely based on data gleaned from social media. While Ukrainian officials have said the photos of the Wagner base were useful, it is not clear whether they combined this with existing information before they launched their attack. Ukraine’s Ministry of Defence did not respond to questions about how it is using open source intelligence. However, it did recently share a photo online claiming that a Russian tourist posed for holiday photos in front of Russian air defense systems.

“Militaries like to have fidelity if they’re going to do a kinetic strike or target something—they have to justify their targeting,” says Maggie Smith, an assistant professor at the Army Cyber Institute at West Point, adding that her views do not represent those of the US military. Smith says OSINT can “show you where activity may be so that you can point more exquisite intelligence assets to focus on that area and get better visibility, better granularity, learn more about it.”

The Wagner attack is not the only instance of military action based (at least in part) on information published online. In June, the Centre for Information Resilience (CIR), a nonprofit organization that counters influence operations, published a report saying a pro-Russian OSINT group used footage from a Ukrainian news channel to locate a munitions factory in Kyiv. The building was then hit by Russian missiles, and three civilians were killed. People in Ukraine have also faced criticism for sharing social media footage of their locations.

Anything that is posted online can be used by military forces for their planning or operations. “As a commander on the ground, you have to be aware that so much data is being produced about every single one of your soldiers at any given time,” Smith says. “The signals that are emitted from cell phones or any of anybody’s web presence, anything like that, can send signals to your adversary about your location, potential training cycles, all those types of things. Any sort of photo that is posted by anybody in your ranks can probably be used to help identify where you’re located, what assets you may have.” (In the past, public data from fitness app Strava exposed military bases, as well as the names and heart rates of soldiers on them.)

Giangiuseppe Pili, an open source intelligence research fellow at the Royal United Services Institute for Defence and Security Studies, says that OSINT has been used by militaries and intelligence for years, but there has recently been an acceleration in what is possible. “The big change is the data fusion capability of open source intelligence now—so to combine different sources into one product that really brings a picture of the reality in a realistic sense,” Pili says. The speed of analyzing open source data has also increased, Pili says.

In addition to ensuring that data is accurate before it is acted on, McDonald says that there may be privacy questions of militaries using open source data that they scrape from social media. “We don’t really have a good understanding of what the limits should be or whether there should be any limits,” McDonald says, adding that if citizens send in information they have taken, this could make them military targets, further blurring the line between civilian and combatant.

While OSINT is being used on the ground for military purposes, it’s also being used in Ukraine to clean up after battles have taken place. Andro Mathewson, a research officer at the HALO Trust, is using open source data in Ukraine to help clear landmines and understand what weapons are being used. This largely comes from social media posts. “Our analysis helps us to plan our operations, tailor our demining training, and know what to educate people about in our risk education outreach,” Mathewson says.

In April, HALO Trust relocated its headquarters to the Kyiv region to focus on “clearing the contamination from the occupation” in the area, Mathewson says. “During our open source data trawling, I spotted a cluster of tractor and combine harvester accidents caused by antitank mines in Makarov,” they say. “Things like videos of burning tractors or photographs of large craters, or destroyed vehicles missing wheels.” As a result of the social posts and the open source data, the group was able to deploy its teams to the area and start clearing the destruction.

Their Photos Were Posted Online. Then They Were Bombed

An Ohio judge ruled that such surveillance to prevent cheating could form a slippery slope to more illegal searches.

As the pandemic unfolded in spring 2020, an Educause survey found that an increasing number of students—who had very little choice but to take tests remotely—were increasingly putting up with potential privacy invasions from schools. Two years later, for example, it’s considered a common practice that some schools record students throughout remote tests to prevent cheating, while others conduct room scans when the test begins.

Now—in an apparent win for students everywhere—an Ohio judge has ruled that the latter practice of scanning rooms is not only an invasion of privacy but a violation of the Fourth Amendment’s guaranteed protection against unlawful searches in American homes.

The decision came after a Cleveland State University student, Aaron Ogletree, agreed to a room scan before a chemistry exam, even though his teacher had changed their policy, and he did not expect it to happen before the test. Because there were others in his home, he took the test in his bedroom, where he says he had sensitive tax documents spread out on a surface. These confidential documents, he claimed, could not be moved before the test and were visible in the room scan recording—which was shared with other students.

After the test, Ogletree sued Cleveland State for violating his Fourth Amendment rights, and Ohio judge J. Philip Calabrese decided on August 22 that Ogletree was right: Room scans are unconstitutional.

Before the decision, Cleveland State defended its room scanning practice by saying that it had become common during the pandemic and, therefore, more acceptable to society.

Under the Fourth Amendment, only reasonable searches are protected, and the university did not see their room scans as unreasonable. Part of the school’s logic was that Ogletree knew there would be a room scan and was not coerced into scanning his room. They say he also could’ve prepared to remove any sensitive documents from the room or simply chosen to take the test in a different room. The university claimed that the room scans were considered so universally harmless by students that nobody ever complained about the practice before Ogletree.

Calabrese did not accept this defense, partly because “rooms scans go where people otherwise would not”—like Ogletree’s bedroom—and partly because the home has always been considered a core protected space where privacy could be reasonably assumed in the US.

“Though schools may routinely employ remote technology to peer into houses without objection from some, most, or nearly all students, it does not follow that others might not object to the virtual intrusion into their homes or that the routine use of a practice such as room scans does not violate a privacy interest that society recognizes as reasonable, both factually and legally,” Calabrese wrote.

A Cleveland State spokesperson provided Ars with this statement: “As directed by the Court, Cleveland State University’s counsel will confer with Mr. Ogletree’s counsel on appropriate next steps. Ensuring academic integrity is essential to our mission and will guide us as we move forward. While this matter remains in active litigation, we are unable to comment further.”

Remote Scans Slippery Slope to More Illegal Searches?

Calabrese’s decision came down to what the law considered reasonable for schools attempting to prevent cheating.

Ultimately, because Cleveland State unevenly used room scans—they are optional by the teachers’ discretion—and the school had various other methods to combat cheating, the judge said the room scans could not be considered a justified privacy invasion. He also said that because the pandemic, and Ogletree’s family’s health concerns, prevented the student from accessing other options like in-person testing, any student “who valued privacy” would have to sacrifice the right to privacy at home to remain enrolled. That benefit—unlike the loss of benefits from social support programs without agreeing to a home search by the state—does not outweigh the loss of privacy to citizens, Calabrese wrote.

Scans of Students’ Homes During Tests Are Deemed Unconstitutional

Without robust federal protections, the country's widespread mass surveillance systems could be used against citizens like never before.

Talk of creeping authoritarianism in the United States seems to be everywhere—in the news, in books, and in conversations among neighbors around the country. The January 6 insurrection and the events that followed have Americans increasingly worried about the fate of democracy in their country.

An NPR/Ipsos poll from January found that 64 percent of Americans believe democracy is “in crisis and at risk of failing.” A Yahoo News/YouGov poll from June found that more than half of Democrats and Republicans think it’s “likely” the US will “cease to be a democracy in the future.”

The two most likely Republican presidential nominees for 2024—Donald Trump and Ron DeSantis—both exhibit an authoritarian mindset. Critics are ringing alarm bells over what could happen to American democracy should one of these men end up in the White House, but little has been said about what the current president and Congress could do right now to constrain a future autocrat.

One of the primary tools authoritarian leaders around the world use to control their citizens is mass surveillance. Neil Richards, a law professor at Washington University in St. Louis, says Congress needs to pass legislation that protects the privacy of Americans so existing surveillance mechanisms can no longer be abused.

“We need a robust federal privacy law, we need robust enforcement mechanisms, we need to somehow rein in the commercial surveillance apparatus because that’s a key component in authoritarian regimes. … They co-opt the existing cameras and sensors,” Richards says. “It used to be that it would be a fascist’s dream to have a camera and a speaker in every home, and of course, we did it to ourselves.”

Woodrow Hartzog, a law professor at Boston University, says any privacy laws that Congress passes need to be written with the understanding that a future president could try to find ways to get around these privacy protections.

“Congress should focus on making sure that the rules that they do pass are specific and constrained enough to give a legal mandate and prevent shenanigans when a different regime takes over,” Hartzog says. “If you create a rule that can easily be watered down or circumvented, then that’s not a very helpful privacy rule.”

Congress is working on data privacy legislation known as the American Data Privacy Protection Act, but critics have claimed that it doesn’t go far enough to protect people’s privacy. The Federal Trade Commission is also reportedly working to create new rules for how large tech companies handle people’s data, and Hartzog says those rules could theoretically provide a helpful check on an authoritarian government because it would have less ability to “co-opt our own devices against us.”

As many Americans learned following the overturning of _Roe v Wade_, it’s important to have strong privacy rights in place before changes in the law or shifts in power threaten basic civil liberties. What doesn’t appear to be a major risk to your rights now can become a substantial threat later on.

“Everybody should care about privacy because information is power, and human information confers power over human beings,” Richards says. “In an information society where so many decisions are made based upon our data, having meaningful protections for that information across the board is essential if we are to remain free, happy, and able to flourish in our lives.”

Richards notes that following President Richard Nixon’s resignation in the 1970s, American lawmakers realized they needed to protect against future presidents abusing their power in the ways Nixon did, which led to major policy reforms. He says something similar should happen now.

“This has happened before. After Watergate, where it was clear that President Nixon had abused the powers of his office and had violated the privacy of American citizens, there were a series of rules put in place restricting the ability of future presidents to do that,” Richards says. “There was a federal privacy law—the Privacy Act of 1974 was passed—there were a whole bunch of open government and government ethics rules that were put in place.”

Following the resignation of Richard Nixon over the Watergate scandal, Congress passed legislation like the Ethics in Government Act, the Government in the Sunshine Act, the Inspector General Act of 1978, the Presidential Records Act, and more in response to the Nixon administration’s widespread misconduct. Former President Trump is now facing the possibility of being charged with violating the Presidential Records Act over his handling of classified documents.

Congress needs to pass new legislation to protect privacy and protect against corruption, Richards says, because we’ve seen what can happen when a president decides to test how much they’re able to do with the power that’s available to them. He says the Trump administration demonstrated this repeatedly.

There is the risk of any legislation Congress passes being struck down by what is now an ultra-conservative Supreme Court, however. Hartzog says legislation will have to be written with this in mind.

“Anything that is going to get passed has to be cognizant of the state of the Supreme Court right now and their tendencies,” Hartzog says. “That includes, of course, a very skeptical view of certain kinds of privacy, such as decisional privacy rights, as we’ve seen with _Roe_ recently.”

A law that based a right to privacy on long-standing traditions may not be struck down by the current Supreme Court—with its so-called originalist point of view—and Hartzog says lawmakers are already starting to focus on this strategy when crafting legislation.

It’s also going to be important to build up and safeguard institutions, Richards says, because strong institutions help prevent would-be authoritarians from wielding so much power. He says government agencies should be doing everything they can to become more independent and more robust so they can withstand future abuses of power, and Congress should work to protect these institutions.

Congress has spent ample time focusing on how to keep the next presidential election from being stolen, but it hasn’t really considered what it could be doing to protect the rights of Americans if an election ends up being stolen or a would-be authoritarian wins an election outright.

If support for authoritarian leaders remains strong, one could feasibly come to power. Preparing for that now is better than simply reacting to abuses of power when they inevitably use the weapons we left waiting for them.

Source

Wired