Hamas posted gruesome images and videos that were designed to go viral. Sources argue that Telegram’s lax moderation ensured they were seen around the world.

How Telegram Became a Terrifying Weapon in the Israel-Hamas War

Plus: Major vulnerability fixes are now available for a number of enterprise giants, including Cisco, VMWare, Citrix, and SAP.

October has been a security flaw-fest, with Apple, Microsoft, and Google issuing patches for vulnerabilities that are being used in real-life attacks. There were also multiple enterprise fixes during the month, with Cisco, VMWare, and Citrix fixing serious security bugs.

Some of the patches are more urgent than others, so read on to find out what you need to know about the updates released in October.

Apple iOS and iPad OS

October was a busy month for Apple, with the iPhone maker issuing its second set of fixes as part of iOS 17.1 at the end of the month. The two dozen security fixes in iOS 17.1 include patches for serious flaws in the Kernel at the heart of the iOS operating system and WebKit, the engine that underpins the Safari browser.

Tracked as CVE-2023-42849, the Kernel issue fixed in iOS 17.1 could allow an attacker that has already achieved code execution to bypass memory mitigations, Apple said on its support page. The three WebKit flaws—tracked as CVE-2023-40447, CVE-2023-41976, and CVE-2023-42852—could lead to arbitrary code execution.

Apple has also issued iOS and iPad OS 16.7.2, fixing the same flaws for users of older devices or those who don’t want to upgrade right away. They came alongside macOS Sonoma 14.1, macOS Ventura 13.6, macOS Monterey 12.7.1, tvOS 17.1, WatchOS 10.1, and Safari 17.1.

Earlier this month, Apple released iOS 17.0.3 and iOS 16.7.1, fixing issues being used in real-life attacks. Tracked as CVE-2023-42824, the first is a Kernel bug that could allow an attacker with access to your device to elevate their privileges.

Apple also fixed CVE-2023-5217, a buffer overflow flaw that could allow an attacker to execute code. Affecting multiple browsers and platforms, the bug has already been patched in Google’s Chrome browser.

Microsoft

Microsoft’s Patch Tuesday has seen the tech giant fix over 100 flaws, including two zero-day vulnerabilities in Microsoft WordPad and Skype for Business.

CVE-2023-36563 is an information disclosure bug in the WordPad word processing program that could expose NTLM hashes and result in NTLM relay attacks. However, it requires user interaction: The attacker must send someone a malicious file and convince them to open it, Microsoft said.

CVE-2023-41763 is an elevation of privilege vulnerability in Skype for Business. “An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address,” potentially disclosing IP addresses or port numbers, Microsoft said.

Microsoft also patched a flaw in Message Queuing tracked as CVE-2023-35349 with a CVSS critical score of 9.8, which could allow an unauthenticated attacker to remotely execute code.

October’s Patch Tuesday is a particularly urgent one, so it’s important to update as soon as you can.

Google Chrome

Google has released 20 security fixes for its Chrome browser, including one patch for a flaw rated as critical. Tracked as CVE-2023-5218, the bug is a use-after-free issue in Site Isolation. Another six fixes cover inappropriate implementation vulnerabilities marked as having medium impact, while CVE-2023-5476 is a use-after-free flaw in Blink History. Another issue, CVE-2023-5474, is a heap buffer overflow in PDF, according to Google’s blog.

A further four inappropriate implementation vulnerabilities are rated as having a low impact, with Google also fixing a low severity use-after-free bug in Cast tracked as CVE-2023-5473.

None of the flaws fixed in October have been exploited, but given how actively the browser is targeted, it makes sense to update as soon as you can.

Google Android

Google’s October Android update was a major one because it fixed 53 issues, including two vulnerabilities already being used in real-life attacks. The first is CVE-2023-4863, a heap buffer overflow bug in libwebp affecting the applications that use the library to encode and decode images in the WebP format. This vulnerability impacts many applications and could be used to install spyware, security firm Malwarebytes wrote in a blog.

There are indications that the bug “may be under limited, targeted exploitation,” Google said in an advisory.

CVE-2023-4211 is an issue in Arm components rated as having a high impact, which Google said is also being used in attacks. “A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory,” Malwarebytes said, adding that the vulnerability affects multiple versions of Arm Mali GPU drivers. These are used in multiple Android device models, including those made by Google, Samsung, Huawei, and Xiaomi.

Another scary flaw in the System tracked as CVE-2023-40129 is rated as critical. “The \[vulnerability\] could lead to remote code execution with no additional execution privileges needed,” Google said.

The update is available for Google’s Pixel and Samsung’s Galaxy series, so if you have an Android device, check your settings ASAP.

Cisco

Software giant Cisco has released patches to fix two already exploited flaws. Tracked as CVE-2023-20198 and with an eye-watering CVSS score of 10, the first is an issue in the web user interface feature of Cisco IOS XE software. It affects physical and virtual devices running Cisco IOS XE software that also have the HTTP or HTTPS Server feature enabled, researchers at Cisco Talos said in a blog.

“Successful exploitation of CVE-2023-20198 allows an attacker to gain privilege level 15 access to the device, which the attacker can then use to create a local user and log in with normal user access,” the researchers warned.

The attacker can use the new unauthorized local user account to exploit a second vulnerability, CVE-2023-20273, in another component of the WebUI feature. “This allows the adversary to inject commands with elevated root privileges, giving them the ability to run arbitrary commands on the device,” said Talos Intelligence, Cisco’s cybersecurity firm.

Cisco “strongly recommends that customers disable the HTTP Server feature on all internet-facing systems or restrict its access to trusted source addresses,” the firm wrote in an advisory.

VMWare

VMWare has patched two out-of-bounds write and information disclosure vulnerabilities in its vCenter Server. Tracked as CVE-2023-34048, the first is a vulnerability in the implementation of the DCERPC protocol that could lead to remote code execution. VMware has rated the flaw as critical with a CVSS base score of 9.8.

At the other end of the CVSS scale but still worth mentioning is CVE-2023-34056, a partial information disclosure bug with a score of 4.3. “A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data,” VMWare wrote in an advisory.

Citrix

Enterprise software firm Citrix has issued urgent fixes for vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Tracked as CVE-2023-4966 and with a CVSS score of 9.4, the first bug could allow an attacker to expose sensitive information.

CVE-2023-4967 is a denial of service issue with a CVSS score of 8.2. Exploits of CVE-2023-4966 on unmitigated appliances “have been observed,” Citrix said. “Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions of NetScaler ADC and NetScaler Gateway as soon as possible.”

SAP

SAP’s October Security Patch Day saw the release of seven new security notes, all of which were rated as having a medium impact. Tracked as CVE-2023-42474, the worst flaw is a cross-site scripting vulnerability in SAP BusinessObjects Web Intelligence with a CVSS score of 6.8.

With only nine new and updated security notes, SAP’s October Patch Day “belongs to the calmest of the last five years,” security firm Onapsis said.

While SAP’s October flaw count was much smaller than its peers’, attackers are still out there, so you should still keep up to date and get patching as soon as you can.

Apple, Google, and Microsoft Just Patched Some Spooky Security Flaws

Plus: Details emerge of a US government social media-scanning tool that flags “derogatory” speech, and researchers find vulnerabilities in the global mobile communications network.

As the Israel-Hamas war raged on this week and Israel expanded its ground invasion of the Gaza Strip, the territory's compromised internet infrastructure and access to connectivity went fully dark on Friday, leaving Palestinians without access to ground or mobile data connections. Meanwhile, researchers are bracing for the fallout if Hamas makes good on its threats to distribute hostage execution videos online. And TikTokkers are using a niche livestreaming feature and exploiting the Israeli-Hamas conflict to collect virtual gifts from viewers, a portion of which goes to the social media company as a fee.

As the worst mass shooting in Maine's history unfolded this week and the gunman remained at large, disinformation about the situation and the suspect flooded social media, adding to the already chaotic and horrific situation. Elon Musk, the owner of X (formerly Twitter) posted remarks earlier this month mocking Ukrainian president Vlodymr Zelensky that were met with a flood of support and enthusiasm from Russian trolls and accounts distributing pro-Russia propaganda.

The US federal foreign intelligence collection tool—a frequently abused surveillance authority—known as Section 702 is facing its demise at the end of the year despite being viewed as the “crown jewel” of US surveillance powers. So far, no members of Congress have introduced a bill to prevent its January 1 sunset. And the identity-management platform Okta suffered a breach that had implications for nearly 200 of its corporate clients and brought up memories of a similar hack the company suffered last year that also had knock-on effects for customers.

An EU government body has been pushing a controversial proposal with far-reaching privacy implications in an attempt to combat child sexual abuse material, but its most outspoken advocates recently added to the drama significantly by essentially launching an influence campaign to support its passage. The long-foreseen nightmare of using generative AI to create digital child abuse materials has arrived with a flood of images, some of which are completely fabricated while others depict real victims generated from old datasets.

We also went deep this week on a situation in which hackers say they can crack a locked USB drive that contains a massive 7,002 bitcoins, worth about $235 million—but the drive's owner hasn't let them try.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

A cryptominer that never seemed to generate very much cryptocurrency for its creators is part of a larger digital espionage campaign, according to researchers from security firm Kaspersky Lab. The platform, which they call StripedFly, has infected more than 1 million Windows and Linux targets globally since 2017. StripedFly is modular and has multiple components for compromising targets' devices and collecting different types of data, indicating that it was likely created as part of a well-funded state espionage program, not a cybercriminal enterprise. It also includes an update mechanism so attackers can distribute improvements and new functionality to the malware.

StripedFly can, among other things, steal access credentials from compromised devices; take screenshots; grab databases, sensitive files, videos, or other information of interest; and record live audio by compromising a target's microphone. Notably, StripedFly uses an innovative, custom Tor client to mask communication and exfiltration between the malware and its command-and-control servers. It also has a ransomware component that attackers have occasionally deployed. It infects targets initially using a customized version of the notorious EternalBlue exploit leaked from the US National Security Agency.

Documents reviewed by 404 Media shed new light on US Immigration and Customs Enforcement’s scanning and database tool for identifying “derogatory” online speech about the US. Dubbed Giant Oak Search Technology (GOST), it assists ICE agents in scanning social media posts. According to the documents, they then use the findings in immigration enforcement actions.

One of the documents shows a GOST catchphrase, “We see the people behind the data,” and a user guide from the documents says GOST is “capable of providing behavioral-based internet search capabilities.” ICE agents can search the system for specific names, addresses, email addresses, and countries of citizenship. The documents say that “potentially derogatory social media can be reviewed within the interface.”

The world’s telephony networks have often been built on legacy infrastructure and with a convoluted maze of interconnections. The system enables mobile data access across much of the world, but its complexity and the collision of new and archaic technologies can lead to vulnerabilities. This week, University of Toronto’s Citizen Lab published extensive research on the degree to which roaming arrangements between mobile providers contain security issues that can be exploited to track devices, and by extension the people who own them. The flaw comes from a lack of protection on the communications between cell towers as you, for instance, travel on a train, ride a motorcycle, or walk around town. The concern is that governments, criminals, or other snoops can manipulate the weaknesses in these handoff communications to track device locations. “These vulnerabilities are most often tied to the signaling messages that are sent between telecommunications networks which expose the phones to different modes of location disclosure,” Citizen Lab researchers wrote.

This Cryptomining Tool Is Stealing Secrets

As Israel increases its ground operation in Gaza, the last remaining internet and mobile connections have gone dark.

For more than three weeks, Gaza has faced an almost total internet blackout. The cables, cell towers, and infrastructure needed to keep people online have been damaged or destroyed as Israel launched thousands of missiles in response to Hamas attacking Israel and taking hundreds of hostages on October 7. Then, this evening, amid reports of heavy bombing in Gaza, some of the last remaining connectivity disappeared.

In the days after October 7, people living in Gaza have been unable to communicate with family or friends, leaving them unsure whether loved ones are alive. Finding reliable news about events has become harder. Rescue workers have not been able to connect to mobile networks, hampering recovery efforts. And information flowing out of Gaza, showing the conditions on the ground, has been stymied.

As the Israel Defense Forces said it was expanding its ground operations in Gaza this evening, internet connectivity fell further. Paltel, the main Palestinian communications company, has been able to keep some of its services online during Israel’s military response to Hamas’ attack. However, at around 7:30 pm local time today, internet monitoring firm NetBlocks confirmed a “collapse” in connectivity in the Gaza Strip, mostly impacting remaining Paltel services.

“We regret to announce a complete interruption of all communications and internet services within the Gaza Strip,” Paltel posted in a post on its Facebook page. The company claimed that bombing had “caused the destruction of all remaining international routes.” An identical post was made on the Facebook page of Jawwal, the region’s biggest mobile provider, which is owned by Paltel. Separately, Palestinian Red Crescent, a humanitarian organization, said on X (formerly Twitter) that it had lost contact with its operation room in Gaza and is “deeply concerned” about its ability to keep caring for people, with landline, cell, and internet connections being inaccessible.

“This is a terrifying development,” Marwa Fatafta, a policy manager focusing on the Middle East and North Africa at the digital rights group Access Now, tells WIRED. “Taking Gaza completely off the grid while launching an unprecedented bombardment campaign only means something atrocious is about to happen.”

A WIRED review of internet analysis data, social media posts, and Palestinian internet and telecom company statements shows how connectivity in the Gaza Strip drastically plummeted after October 7 and how some buildings linked to internet firms have been damaged in attacks. Photos and videos show sites that house various internet and telecom firms have been damaged, while reports from official organizations, including the United Nations, describe the impact of people being offline.

Damaged Lines

Around the world, the internet and telecoms networks that typically give web users access to international video calls, online banking, and endless social media are a complicated, sprawling mix of hardware and software. Networks of networks, combining data centers, servers, switches, and reams of cables, communicate with each other and send data globally. Local internet access is provided by a mix of companies with no clear public documentation of their infrastructure, making it difficult to monitor the overall status of the system as a whole. In Gaza, experts say, internet connectivity is heavily reliant on Israeli infrastructure to connect to the outside world.

Amid Israel’s intense bombing of Gaza, physical systems powering the internet have been destroyed. On October 10, the United Nations’ Office for the Coordination of Humanitarian Affairs (OCHA), which oversees emergency responses, said air strikes “targeted several telecommunication installations” and had destroyed two of the three main lines of communications going into Gaza.

The Destruction of Gaza’s Internet Is Complete

TikTokkers are using a little-known livestreaming feature to falsely represent Israelis and Palestinians—and the company is taking a cut of costly in-app gifts viewers give to participants.

TikTokkers are using a little-known livestreaming feature to cash in on the huge interest in the Israel-Hamas war despite having no links to the crisis. TikTok, meanwhile, is taking up to 50 percent of the earnings.

In the days after Hamas attacked Israel on October 7, TikTok creators have been engaging in “live matches” on the platform where one creator plays the role of Israelis and the other that of Palestinians, while encouraging—and often shouting at—their followers to continue to donate expensive gifts. The side with the most gifts after five minutes wins the battle.

Some of these gifts cost hundreds of dollars each, and several livestreams WIRED observed in recent days have continued for multiple hours without a break. One battle had seen the creator representing Palestinians winning 72 matches in a row.

The creators can cash out their winnings for real currency, but only after TikTok itself has taken a major cut of the earnings.

As the humanitarian crisis in Gaza continues to worsen, social media platforms have been accused of allowing disinformation to fester while platforms including TikTok have been accused of silencing certain viewpoints. Now TikTok appears to be profiting off their users’ fascination with Israel and Palestinians, and allowing creators who may not be from Israel or the Palestinian territories to earn money off the conflict.

WIRED found dozens of examples of creators seeking to cash in on people’s interest in the crisis, but one pair of creators appears to be cashing in more than most.

On multiple days over the course of the past week, a Turkish streamer who claims to represent Palestinians battled a Greek-Georgian streamer who claims to represent Israelis. In case there was any doubt about who each was supposedly representing, each had the flag of their respective adopted sides onscreen during the battles.

In all of the battles WIRED observed, none of the participants appeared to have any link to the entities they claimed to be representing, and none of them suggested they were planning on donating any of the money earned to the people directly impacted by the current crisis.

Battles between influencers online have been a feature of streaming services since at least 2016, particularly in China, though on most other platforms, the participants have to complete tasks or show off a skill in order to win a battle. On TikTok, it’s mostly just screaming.

Live matches, also known as player knockout or PK battles, have been a feature on TikTok since at least 2021, though TikTok does not mention the feature on its own webpage describing how livestreaming works. Despite the feature being available for more than two years, it is not very well known, and to the uninitiated, the TikTok battles may make little sense, with viewer counters, stickers, and never-ending comments crowding the screen while the two creators shout and scream in a bid to get their followers to donate more gifts.

Rather than making any coherent argument about the rights of Israelis or Palestinians during this crisis, the streamers instead shout out their side’s name or scream comments such as: “Like, like, like,” and “Follow me.”

The streams WIRED observed were watched live by thousands of TikTok users. Today, just before this article was published, a push notification showed the streamers were going live once again.

The two streamers did not respond to WIRED’s messages about their battles.

The rise of TikTok live matches related to the Israel-Hamas war was first highlighted by Abbie Richards, a research fellow at the Accelerationism Research Consortium who specializes in tracking misinformation on TikTok. Richards said it was “gross to grift off atrocities.”

“So this is real people, sending real money to TikTokkers to gesture support for the concept of Israel or Palestine,” Richards said in a video posted on Instagram this week. “But do you know who’s really making money off of these? TikTok, because they take roughly half of the money creators make on live. This helps literally no one except these grifters and TikTok. It’s fucking disgusting.”

TikTok did not respond to WIRED’s request for comment.

A lot of TikTok creators use the app’s livestream feature to generate income, with some streamers broadcasting their entire lives on the platform. The “live match” feature is little known on the hugely popular video-sharing app that allows two people to “battle” against each other for five minutes at a time. The winner is the person who gains the most likes and gifts from their followers.

The strange phenomenon means that the TikTokkers participating need to encourage their followers to donate as many gifts as possible in order for them to “win.”

Virtual gifts are purchased with TikTok’s in-app currency, known as coins. The cost of coins vary depending on how many you are buying, but you can buy 70 coins for less than a dollar.

The gifts range from stickers of roses and the TikTok logo, which cost just a couple of coins, up to animations that take over the full screen that cost up to 45,000 coins. Purchasing enough coins to buy the most expensive gifts on TikTok can cost over $500.

After a user donates the gift to a creator during a battle, those gifts are then converted into Diamonds, which creators can then cash out for real currency.

However, the full value of the gift is not transferred to the creator, with TikTok taking a significant slice of each gift donated. The exact amount is unclear, but a BBC investigation last year found creators received just 30 percent of the money donated to them. TikTok at the time said its cut was significantly less than 70 percent but would not specify an exact percentage.

But even small purchases can quickly accumulate. In January, people spent $6 billion in-app on TikTok, according to a report released by Data.ai, a mobile market trends firm

It can be a lucrative business, with some TikTokkers claiming they are making up to $30,000 a month from live matches. Meanwhile, those who are sending the gifts are also reporting that they can easily become addicted, leading to financial and emotional problems.

TikTok Streamers Are Staging ‘Israel vs. Palestine’ Live Matches to Cash In on Virtual Gifts

In the hours following the worst mass shooting in Maine’s history, disinformation about the suspected gunman flooded social media with false claims that he had been arrested.

Following a mass shooting at a bowling alley and restaurant in Lewiston, Maine, yesterday evening that left at least 18 people dead, state police urgently warned residents to “stay inside your home with the doors locked” as they mounted a manhunt for the suspect.

Misinformation about the suspect flooded social media platforms like X (formerly Twitter), Facebook, and TikTok moments after the shooting. On X, verified accounts pushed out bogus claims that the threat had been neutralized and a suspect had been arrested. Police have since identified 40-year-old Robert Card as a “person of interest” in the shooting. While Card remains at large as of 10 am ET this morning, posts featured videos of the supposed arrest that have been viewed hundreds of thousands of times.

A prolific verified X account with almost 300,000 followers was among the first to post the claim that the suspect had been arrested, and while the account subsequently posted an update stating that the suspect was still at large, the original post—which has been seen over 170,000 times—remains active.

The top result for the search term “Robert Card arrested” on X was a post featuring the same video that has been viewed over 1.9 million times, even though it had a Community Note attached making it clear the claims in the post were false.

The same video circulating on X was also being shared on TikTok, where one post had been viewed 80,000 times by this morning.

Another of the main false narratives circulating in the hours after Card was identified was that he had been arrested in 2016 for possessing and disseminating sexually explicit materials. This was also inaccurate: It refers to a different person named Robert Card, who is also 40 years old and from Maine.

Some accounts labeled Card “a far-left lunatic” based on the unverified claim that he voted for former US president Barack Obama. Others wildly tried to link the incident to the current crisis in the Middle East, claiming, without evidence, that Card “was a Hamas supporter.”

While misinformation about the mass shooting proliferated across social media, the problem was acute on X, where owner Elon Musk has incentivized people to post engaging and viral content even if it’s not accurate. As a result, users rushed to be the first to post updates about the shooting despite being blatantly false.

“It’s as if everyone thinks disinformation is a problem, but not for them personally—only for _other_ people,” Caroline Orr, a behavioral scientist and postdoctoral researcher at the University of Maryland who tracks disinformation online, wrote on X, adding: “When 20+ people are murdered in a mass shooting, and the reaction of most people on this website is: ‘How can I use this to push a political agenda?’ or ‘How can I use this to attack XYZ person?’ … that reflects something far more disturbing.”

X, Meta, and TikTok did not immediately respond to WIRED’s request for comment.

At 3 am ET this morning, Lewiston Police Department confirmed on its Facebook page that Card, a certified firearms instructor and a member of the US Army from Bowdoin, Maine, was still on the run. The department said Card “should be considered armed and dangerous” and that members of the public should not approach him.

Law enforcement believes the shooter killed at least 16 people and 13 more at around 7 pm yesterday at the Sparetime Recreation bowling alley and the nearby Schemengees Bar and Grille. Officials said the death toll is expected to rise, with one local city councilor telling CNN that it could be as high as 22.

The incident was the nation’s worst mass shooting this year, according to the Gun Violence Archive.

Card, whose own X profile was filled with conspiracy theories about trans mass shooters and pro-MAGA content, had been committed to a mental health facility for two weeks earlier this year after he reported “hearing voices and threats to shoot up the National Guard Base in Saco, Maine,” according to a police bulletin circulated by law enforcement and reported by AP.

Notably, Card also liked two posts, one from Donald Trump Jr. and another by far-right personality Dinesh D'Souza, about their opposition to gun control.

The rapid unchecked spread of misinformation last night and into this morning mirrored the response earlier this month when Hamas militants attacked Israel on October 7. In the hours and days following the attack and the bombing of Gaza by the Israeli government, X was overrun by disinformation shared by verified users, who rehashed old footage, video game content, and photoshopped images to push partisan narratives.

_Updated at 10:55 am ET, October 26, 2023, to include the latest casualty and wounded figures provided by Maine governor Janet Mills during a press conference this morning._

Maine Mass Shooting Disinformation Floods Social Media as Suspect Remains at Large

A recent breach of authentication giant Okta has impacted nearly 200 of its clients. But repeated incidents and the company’s delayed disclosure have security experts calling foul.

On Friday, October 20, the identity management platform Okta said it suffered an intrusion in its customer support system. As an access and authentication service, a breach of Okta always comes with risks to other organizations, and the company confirmed that “certain Okta customers” were affected. Okta tells WIRED that it notified “around 1 percent” of its 18,400 customers that they were impacted.

The password manager 1Password, an Okta customer, said this week that it had notified the company on September 29 of suspicious activity that ultimately was tied to the support system incident. BeyondTrust, another identity and access management firm and also an Okta customer, said last week that it had similarly flagged concerning behavior in its Okta administrator account and notified the company about the issue on October 2. Internet infrastructure company Cloudflare also said last week that it had detected a similar incident in its Okta systems on October 18 and notified the company as well.

Companies like Okta that provide crucial digital services to a large population of prominent customers are always going to be prime targets for attacks because they can serve as a sort of one-stop shop for hackers looking to compromise numerous organizations. And as tech giants like Microsoft have shown, some of these attacks may well lead to breaches even if the vast majority are blocked. The breach at Okta is particularly concerning because it shares many features with a security incident the company dealt with in 2022, in which attackers compromised a subprocessor that Okta had trusted to do customer support work.

“What I find surprising in this case is that, after the 2022 breach, you'd think Okta would be on high alert for any externally exposed systems or personnel who may be targeted—and yet something has happened again,” says Adam Chester, a senior security consultant at TrustedSec.

The latest incident directly affected Okta's internal customer support service rather than one provided by a third-party partner. In this case, attackers used stolen login credentials to compromise an Okta support account, and then leveraged this access to steal cookies and session tokens used to give customer support providers access to clients' systems for troubleshooting. With these access tokens, attackers could then compromise Okta customer accounts directly.

1Password, BeyondTrust, and Cloudflare all said that they were able to detect and block the intrusions before any of their own customers were affected, but they all highlighted the fact that they had notified Okta about the situation before Okta warned them—in some cases weeks before Okta's public disclosure.

“This is the second time Cloudflare has been impacted by a breach of Okta’s systems,” a group of Cloudflare engineers wrote on Friday. They went on to share a list of recommendations for how Okta can improve its security posture: “Take any report of compromise seriously and act immediately to limit damage. Provide timely, responsible disclosures to your customers when you identify that a breach of your systems has affected them. Require hardware keys to protect all systems, including third-party support providers.”

The Cloudflare engineers added that they view taking protective steps like these as “table stakes” for a company like Okta that provides such crucial security services to so many organizations.

When WIRED asked Okta a series of questions about what steps it is taking to improve customer service defenses in the wake of the two breaches, and why there appears to be a lack of urgency when the company receives reports of potential incidents, the company declined to comment. A spokesperson said it would share more information about these subjects soon.

“I really want to know what technical controls Okta had implemented following the 2022 breach, and why this time will be different,” says Evan Johnson, cofounder of RunReveal, which develops a system visibility and incident detection tool. “My hunch is they did not roll out hardware security keys, or didn’t roll them out for their contractors doing support.”

Jake Williams, a former US National Security Agency hacker and current faculty member at the Institute for Applied Network Security, emphasizes that “the issue is bigger than Okta,” noting that software supply chain attacks and the volume of hacks companies must defend against is significant. “It's unfortunately common for service providers of any size to have trouble believing they are the source of an incident until definitive proof is offered,” he says.

Still, Williams adds, “there's a pattern here with Okta, and it involves outsourced support.” He also notes that one of the remediations Okta suggested to customers in the wake of the recent incident—carefully removing support session tokens that could be compromised from troubleshooting data—is not realistic.

“Okta's suggestion—that somehow the customer must be responsible for stripping session tokens from the files they specifically request for troubleshooting purposes—is absurd,” he says. “That's like handing a knife to a toddler and then blaming the toddler for bleeding.”

Okta's Latest Security Breach Is Haunted by the Ghost of Incidents Past

Inauthentic accounts on X flocked to its owner’s post about Ukrainian president Vlodymr Zelensky, hailing “Comrade Musk” and boosting pro-Russia propaganda.

Since Elon Musk spent $44 billion on Twitter (now X) last year, the billionaire has been determined to wipe out bots and spammy accounts. Things haven’t gone smoothly. Amid the chaos, in recent weeks Russian trolls have jumped on one of Musk’s own posts and used it to push pro-Kremlin messaging, a new analysis shows.

At the start of October, Musk used his platform to mock Ukrainian president Vlodymr Zelensky with a nine-year-old meme. “When it's been five minutes and you haven't asked for a billion dollars in aid,” says the text above the “Trying to Hold a Fart Next to a Cute Girl in Class” meme, which the X owner posted to his 160 million followers. The original image shows a teenage schoolboy visibly agitated while sitting in class next to a girl. Musk’s version swapped in Zelensky’s face. Ukrainians hit back at Musk, accusing him of trolling and posting Russian propaganda.

Now analysis by a volunteer group of researchers who track Russian-language information operations on X says Russian trolls flocked to Musk’s post and news accounts that reported on his meme. “The Zelensky tweet from Musk seems to be the most commented by Kremlin trolls over nearly three months,” says Antibot4Navalny, the anonymous group of volunteers behind the findings.

In the days after the post, around 160 inauthentic accounts pushing pro-Russian messaging sent some 400 posts praising Musk as a “Russian patriot” and photoshopping him into Russian military uniforms, according to the group. They say the main messaging can be summarized, in part, as “Comrade Musk supports Russia.”

Three independent experts, including one former disinformation researcher at Twitter, reviewed the findings from Antibot4Navalny and concluded that the accounts praising Musk and pushing Russian narratives are likely to be part of a coordinated campaign. They say that while there was a small number of accounts pushing the messaging—the post has 93 million views—the targeting may show the accounts testing their messaging and tactics.

The X press office did not respond to WIRED’s request for comment, which included a sample of the accounts identified by the Antibot4Navalny researchers. “Busy now, please check back later,” its automated response says.

The Antibot4Navalny group monitors inauthentic accounts on X, focusing on the Russian language, and it identifies accounts that may not be genuine by analyzing their behavior and the replies they make to media outlets. Data gathered by the researchers shows the accounts replying both to Musk’s original tweet and also those from Russian-language news accounts, such as BBC Russian and DW Russian. The posts are mostly in Russian, but there are also a few in English. “Among troll replies addressing Musk directly, some are using memes or other images which are sometimes a part of the message,” a Antibot4Navalny representative says.

“Russia thanks you for your excellent work, Elon. And answers with memes,” one English language post says. “As usual, Musk is our comrade: like us, he ROFLs at the junkie,” a translated Russian post says. Others praise Musk for telling the “truth” and mocking the Ukrainian president.

One former Twitter disinformation researcher, granted anonymity to allow them to speak freely without fear of retaliation, looked at a sample of the accounts highlighted by Antibot4Navalny. “Most accounts had multiple signs of inauthenticity,” the former staff member says, pointing out that their analysis was done using public-facing data, and only X would be able to make “hard findings” based on technical data available to the company. The former staff member says the accounts had repeated behavior in reposts and “inconsistent or clearly falsified” personal information. “There was a spectrum for how realistically or well chosen an account's profile pic is,” they say, with some profile images being pulled from elsewhere online.

Martin Innes, codirector of the Security Crime and Intelligence Innovation Institute at Cardiff University, who has led international disinformation research, reviewed a sample of the data with colleagues. He also says there are multiple signs that the accounts may not be genuine. “The accounts examined are newly created, in the main during the period of the Ukraine-Russia war, and exhibit behavior designed to target and polarize opinion, and gain popularity through interaction with larger accounts, many of which represent popular media outlets,” Innes says.

Innes and the Cardiff University researchers say the accounts often have low or zero follower numbers, a lack of identifiable personal details, mostly just reply to other accounts’ posts, and produce anti-Ukraine and anti-Zelensky messaging, which mirror wider Russian narratives. Russia has long used social media to impact politics and divide opinions. In September, an EU report concluded that the “reach and influence” of Kremlin-backed accounts on social media had increased in 2023, particularly highlighting X.

“Since the acquisition of Twitter/X by Musk, there have been a series of policy decisions that any expert in the field of misinformation or disinformation would tell you were bad decisions,” the former Twitter staff member says. They point to X removing labels for accounts funded by governments and firing teams working on disinformation. At the same time, Russian propaganda has also focused on influencing African nations.

Kyle Walter, head of research at misinformation- and disinformation-analysis company Logically, says Musk's account has been targeted in the past, in particular with crypto scams. Walter also reviewed the accounts highlighted by Antibot4Navalny and says they appear to be inauthentic. The claims about Musk supporting Russia have “existed for a while,” Walter says. Throughout Russia’s full-scale invasion of Ukraine, which began in February 2022, Musk’s Starlink satellite internet company has provided crucial internet connections to Ukrainian forces for free and has been praised by its politicians. He was criticized last month over a decision not to allow Starlink’s use around Crimea, the Ukrainian peninsula annexed by Russia in 2014.

When it comes to the Musk posts, the Antibot4Navalny researcher says the accounts could have been looking to boost Russian propaganda talking points or to “create an illusion” for those browsing replies to Musk’s tweet that people support the message. Replying to large accounts like Musk’s has the potential to reach a wider audience, the research says.

Logically’s Walter says that it is a critical time for social media platforms as they head toward a slate of elections in 2024—including those in the US, Canada, UK, India, and the European Union. “Bad actors are testing different tactics, testing different capabilities,” Walter says. “You'll often see a lot of these kinds of unsuccessful campaigns where they're not really getting any engagement, not really getting any views on the content, but it's helping them calibrate their kind of broad efforts for future instances.”

Elon Musk Mocked Ukraine, and Russian Trolls Went Wild

Thousands of child abuse images are being created with AI. New images of old victims are appearing, as criminals trade datasets.

A horrific new era of ultrarealistic, AI-generated, child sexual abuse images is now underway, experts warn. Offenders are using downloadable open source generative AI models, which can produce images, to devastating effects. The technology is being used to create hundreds of new images of children who have previously been abused. Offenders are sharing datasets of abuse images that can be used to customize AI models, and they’re starting to sell monthly subscriptions to AI-generated child sexual abuse material (CSAM).

The details of how the technology is being abused are included in a new, wide-ranging report released by the Internet Watch Foundation (IWF), a nonprofit based in the UK that scours and removes abuse content from the web. In June, the IWF said it had found seven URLs on the open web containing suspected AI-made material. Now its investigation into one dark web CSAM forum, providing a snapshot of how AI is being used, has found almost 3,000 AI-generated images that the IWF considers illegal under UK law.

The AI-generated images include the rape of babies and toddlers, famous preteen children being abused, as well as BDSM content featuring teenagers, according to the IWF research. “We’ve seen demands, discussions, and actual examples of child sex abuse material featuring celebrities,” says Dan Sexton, the chief technology officer at the IWF. Sometimes, Sexton says, celebrities are de-aged to look like children. In other instances, adult celebrities are portrayed as those abusing children.

While reports of AI-generated CSAM are still dwarfed by the number of real abuse images and videos found online, Sexton says he is alarmed at the speed of the development and the potential it creates for new kinds of abusive images. The findings are consistent with other groups investigating the spread of CSAM online. In one shared database, investigators around the world have flagged 13,500 AI-generated images of child sexual abuse and exploitation, Lloyd Richardson, the director of information technology at the Canadian Centre for Child Protection, tells WIRED. “That's just the tip of the iceberg,” Richardson says.

A Realistic Nightmare

The current crop of AI image generators—capable of producing compelling art, realistic photographs, and outlandish designs—provide a new kind of creativity and a promise to change art forever. They’ve also been used to create convincing fakes, like Balenciaga Pope and an early version of Donald Trump’s arrest. The systems are trained on huge volumes of existing images, often scraped from the web without permission, and allow images to be created from simple text prompts. Asking for an “elephant wearing a hat” will result in just that.

It’s not a surprise that offenders creating CSAM have adopted image-generation tools. “The way that these images are being generated is, typically, they are using openly available software,” Sexton says. Offenders whom the IWF has seen frequently reference Stable Diffusion, an AI model made available by UK-based firm Stability AI. The company did not respond to WIRED’s request for comment. In the second version of its software, released at the end of last year, the company changed its model to make it harder for people to create CSAM and other nude images.

Sexton says criminals are using older versions of AI models and fine-tuning them to create illegal material of children. This involves feeding a model existing abuse images or photos of people’s faces, allowing the AI to create images of specific individuals. “We’re seeing fine-tuned models which create new imagery of existing victims,” Sexton says. Perpetrators are “exchanging hundreds of new images of existing victims” and making requests about individuals, he says. Some threads on dark web forums share sets of faces of victims, the research says, and one thread was called: “Photo Resources for AI and Deepfaking Specific Girls.”

The AI-Generated Child Abuse Nightmare Is Here

Though often viewed as the “crown jewel” of the US intelligence community, fresh reports of abuse by NSA employees and chaos in the US Congress put the tool's future in jeopardy.

A federal law authorizing a vast amount of the United States military’s foreign intelligence collection is set to expire in two months, pulling the plug on history’s most prolific eavesdropping operation and the primary means by which US spies intercept the private communications of people deemed threatening, or simply interesting, by the US government—the world’s foremost surveillant.

The US National Security Agency (NSA) relies heavily on the statute, Section 702 of the Foreign Intelligence Surveillance Act, when compelling the cooperation of communications giants that oversee huge swaths of the world’s internet traffic, intercepting hundreds of millions of phone calls and email messages each year, and eavesdropping on the personal conversations of targeted foreign individuals and anyone else, including Americans, unfortunate enough to be caught in their orbit.

As of now, members of Congress have introduced exactly zero bills to prevent Section 702 from sunsetting on January 1, 2024, even though many—perhaps a majority—view this intelligence “crown jewel” as fundamental to the national defense; a flawed but fixable law. The Democrats, who control the Senate, are not blameless in stalling the reauthorization, with more than a handful vying to ensure its renewal is contingent on new rules that force the government to get a warrant before weaponizing the data against its own citizens. The internal conflict roiling the Republican Party, many of whose members share in the desire to rein in the government’s domestic surveillance capabilities, is nevertheless the biggest factor forestalling a compromise, particularly following the removal of Kevin McCarthy as House speaker earlier this month.

The US intelligence community is not without blame. A litany of reported errors, ethical violations, and at least some criminal activity bearing the telltale signs of having been swept under the rug have gone a long way in validating the concerns of Section 702’s biggest detractors: Privacy defenders on both sides of the aisle who share common ground with political allies of Donald Trump, a wellspring of animosity when it comes to military and intelligence leaders—officials routinely peppered from the right with allegations of partisanship and other “treasonous things.”

A US report published in September by an independent government privacy watchdog describes a number of new “noncompliant” uses of raw Section 702 data by analysts at the NSA, an agency where military and civilian employees have been caught repeatedly abusing classified intel for personal, and even sexual, reasons. Issued by the Privacy and Civil Liberties Oversight Board (PCLOB), a body effectively commandeered by Congress in 2005 in an effort to help gauge the scope of the explosion in surveillance after 9/11, the report adds to a decade’s worth of documented surveillance abuses.

_The Wall Street Journal_ first reported in 2013 amid the exploding Edward Snowden scandal that NSA staff had been caught on numerous occasions spying on what the paper called “love interests.” The phenomenon is common enough at the agency to receive its own internal designation: “LOVEINT,” a portmanteau of “love” and “intelligence,” abbreviated in the style of actual surveillance disciplines such SIGINT and HUMINT (“signals” and “human” intelligence, respectively.)

Senator Dianne Feinstein, who died who on September 29 at the age of 90, had defended the NSA following the report, referring to the violations as “isolated,” occurring only roughly, she said, once a year. The _Journal_ noted, meanwhile, that nearly all of the known violations had been self-reported, likely by employees fearful of failing a polygraph exam.

The term “LOVEINT” implies a degree of harmlessness, the misguided acts of a hopeless romantic or a jilted lover. Yet it signifies behavior that is by any modern definition equivalent to stalking. That it received this designation at all seemingly suggests that the abuse is constant enough to border on systemic. The watchdog report released last month by the PCLOB notes that, in 2022, one NSA analyst twice conducted queries on people they’d met “through an online dating service,” showing that despite years of procedures developed to protect against such incidents, the temptation to abuse the most expansive surveillance tool in history for personal gain remains too enticing a prospect for some.

“The US government’s incredible surveillance powers are intended to keep Americans safe from global threats, but we’ve seen time and again how officials have misused this authority at the expense of Americans’ civil liberties,” US senator Chuck Grassley, a Republican from Iowa, tells WIRED. “Instead of aiming this tool at terrorists and international criminals, some have put their political rivals and even love interests in the crosshairs.” The intelligence community’s continued access to the 702 data hinges, in part, on its ability to demonstrate that it can cooperate with oversight attempts, Grassley says, and send an “unequivocal message that abuses will be met with steep consequences.”

While any substantive detail about past 702 violations remains obscured by conditions of secrecy, what can be gleaned from unclassified reports about the “consequences” facing NSA staff for stalking is not encouraging. A 2013 letter from the NSA’s then-top internal watchdog, George Ellard, for instance, described years’ worth of abuses that coincide and even predate the existence of Section 702, which Congress passed in 2008 in an effort to legalize the widespread wiretapping of calls already going in and out of the US, as well as immunize telecommunications companies like AT&T, which was revealed early on to be eagerly cooperating with the government’s demands.

Ellard’s letter, combined with more recent abuse disclosures, paints a picture of an agency that discovers surveillance abuses mainly when its employees self-report them, often to avoid trouble during or in advance of a polygraph test. Violators are often on their way out the door, presumably bound for the private sector, or are otherwise given the option to retire rather than face any real consequences for their actions. Numerous civilian employees at the NSA have admitted to wiretapping the phones of romantic partners, yet it's clear that many escaped punishment by quitting the agency before investigations into their conduct were earnestly underway.

In one of the most egregious cases, predating the 702 program by several years, an NSA employee admitted to wiretapping nine phone numbers belonging to women. Like with other offenses, Ellard noted in his letter—made public by Grassley several years ago—that the employee had “resigned before discipline had been proposed.” (Incidentally, Ellard’s decade as the NSA inspector general came to an unceremonious end following allegations that he’d retaliated against an agency whistleblower.)

Only US service members with access to raw 702 data appear to have been held accountable to some degree, almost certainly because they were unable, due to the terms of their service, to walk away from their jobs. A member of a “tactical military unit,” for instance, was demoted and docked one month’s pay after searching the classified database for communications belonging to his wife, while another’s access was cut after the NSA discovered they’d been eavesdropping on random people’s phone calls, purportedly to learn the language the victims were speaking.

Section 702, which last year targeted more than 246,000 “non-US persons,” permits the NSA to collect both text and audio of communications belonging to Americans, even when they are not the target of an investigation or suspected of foreign or criminal ties. These communications are “highly personal and sensitive, capturing exchanges with loved ones, friends, medical providers, academic adviseors, lawyers, or religious leaders,” according to the oversight authorities; capable of providing “great insight into an individual’s whereabouts, both in a given moment and in patterns over time.” While the communications of Americans captured as part of Section 702 surveillance may be subject to “minimization” procedures down the line, they are nevertheless stored in a “raw” or unredacted format and can be viewed with the help of a Google Search-like interface.

It's unclear how many government employees can access Section 702 data, but US lawmakers have offhandedly estimated the figure to be upwards of 10,000 people. This includes many employed by the Federal Bureau of Investigation, where the process of accessing the database remains practically free from judicial review. Under its own procedures, the FBI may conduct searches of the 702 database without probable cause so long as it believes it is “reasonably likely” to retrieve evidence of a crime—the legal equivalent of a hunch. According to a 2016 memorandum authored by the secretive Foreign Intelligence Surveillance Court, the FBI has at times failed to abide by what are already notably loose restrictions on using 702 for the purpose of acquiring communications protected by attorney-client privilege. The FBI's own procedures have long permitted agents to search the 702 database for correspondence between US citizens and their attorneys, as well as disseminate that information internally, provided the target of the search has not been charged with a crime.

While the NSA refers to the communications of Americans captured under Section 702 as having been collected “incidentally”—the statute authorizes only the “targeting” of “non-US persons reasonably believed to be located outside the United States”—it is important to note that the word “incidental” does not mean “by mistake.” It is merely accepted that each year, as a cost of doing business, the NSA will “inevitably” intercept the calls and messages of an unknown but “substantial” number of Americans.

This collection may be best understood as occurring not in error but as collateral surveillance, defended by the government under an ever-expanding list of national security threats: terrorism, first and foremost; then cyberattacks launched by hostile foreign actors; and today, finally, the illicit trafficking of fentanyl from sources in China.

Since the enactment of Section 702 some 15 years ago, US intelligence chiefs have claimed that it would be impossible to provide any clear metrics regarding just how many Americans are “incidentally” eavesdropped on each year. Ironically, it is the sheer amount of surveillance conducted by the NSA that is blamed for obscuring its impact on Americans’ civil liberties. “We do not yet know the scope of incidental collection,” this year’s PCLOB report states. But it should not be understood as “occurring infrequently,” it says, nor as an “inconsequential part of the Section 702 program.”

Source

Wired