The unidentified attackers have targeted people on both sides of Russia’s war against Ukraine, carrying out espionage operations that suggest state funding.

Ukrainian networks have been on the receiving end of grimly sophisticated and innovative cyberattacks from pRussia for nearly a decade, and Ukraine has increasingly struck back, particularly since the Kremlin's invasion last year. Amidst all of this and activity from other governments and hacktivists, researchers from the security firm Malwarebytes say that they've been tracking a new hacking group that has been conducting espionage operations since 2020 against both pro-Ukraine targets in central Ukraine and pro-Russia targets in eastern Ukraine. 

Malwarebytes attributes five operations between 2020 and the present to the group, which it has dubbed Red Stinger, though the researchers only have insights into two of the campaigns conducted in the past year. The group's motives and allegiance aren't yet clear, but the digital campaigns are noteworthy for their persistence, aggressiveness, and lack of ties to other known actors.

The campaign that Malwarebytes calls “Operation Four” targeted a member of Ukraine's military who works on Ukrainian critical infrastructure, as well as other individuals whose potential intelligence value is less obvious. During this campaign, attackers compromised victims' devices to exfiltrate screenshots and documents, and even record audio from their microphones. In Operation Five, the group targeted multiple election officials running Russian referendums in disputed cities in Ukraine, including Donetsk and Mariupol. One target was an adviser to Russia's Central Election Commission, and another works on transportation—possibly railroad infrastructure—in the region.

“We were surprised about how big these targeted operations were, and they were able to gather a lot of information,” says Roberto Santos, a threat intelligence researcher at Malwarebytes. Santos collaborated on the investigation with former colleague Hossein Jazi, who first identified Red Stinger activity. “We have seen past targeted surveillance, but the fact that they were collecting real microphone recordings from victims and data from USB drives, it's unusual to see.”

Researchers from the security firm Kaspersky first published about Operation 5 in late March, naming the group behind it Bad Magic. Kaspersky similarly saw the group focusing on government and transportation targets in eastern Ukraine, along with agricultural targets.

“The malware and techniques used in this campaign are not particularly sophisticated, but are effective, and the code has no direct relation to any known campaigns,” Kaspersky researchers wrote.

The campaigns begin with phishing attacks to distribute malicious links that lead to tainted ZIP files, malicious documents, and special Windows linking files. From there, attackers deploy basic scripts to act as a backdoor and a loader for malware. The Malwarebytes researchers note that Red Stinger seems to have developed its own hacking tools and reuses characteristic scripts and infrastructure, including specific malicious URL generators and IP addresses. The researchers were able to expand their understanding of the group's operations after discovering two victims who appear to have infected themselves with Red Stinger malware while testing it.

“It's happened in the past with different attackers that they infect themselves,” Santos says. “I think they just got lazy because they were undetected since 2020.”

Red Stinger appears to be currently active. With details about its operations now entering the public sphere, the group may tweak its methods and tools in an attempt to evade detection. The Malwarebytes researchers say that by releasing information about the group's activities, they hope other organizations will deploy detections for Red Stinger operations and search their own telemetry for additional indications of what the hackers have done in the past and who is behind the group.

A Mysterious New Hacker Group, Red Stinger, Is Lurking in Ukraine’s Cyberspace

For a decade, a group called Big Pipes has worked behind the scenes with the FBI to target the worst cybercriminal “booter” services plaguing the internet.

When the FBI announced the takedown of 13 cyberattack-for-hire services yesterday, it may have seemed like just another day in law enforcement’s cat-and-mouse game with a criminal industry that has long plagued the internet’s infrastructure, bombarding victims with relentless waves of junk internet traffic to knock them offline. In fact, it was the latest win for a discreet group of detectives that has quietly worked behind the scenes for nearly a decade with the goal of ending that plague for good.

Yesterday’s operation was just the most recent of three major cybercriminal takedowns in the past five years that all began inside an informal working group that calls itself Big Pipes. The team’s roughly 30 members, who communicate mostly through Slack and weekly video calls, include staffers from several of the internet’s biggest cloud service providers and online gaming companies—though members from those companies spoke to WIRED on the condition that their employers not be named—as well as security researchers, academics, and a small number of FBI agents and federal prosecutors.

Big Pipes’ detectives have for years methodically tracked, measured, and ranked the output of “booter” or “stresser” services that sell distributed denial-of-service (DDOS) attacks that allow their customers to barrage enemies’ servers with disruptive floods of data. They’ve hunted the operators of those services, with private-sector members of the group often digging up leads that they hand to the group’s law enforcement agents and prosecutors. Together, they worked to initiate a takedown operation in December 2018 that led to the arrest of three hackers and knocked a dozen booter services offline. Last December, their work laid the foundation for Operation Power Off, which led to six arrests and the takedown of no fewer than 49 DDOS-for-hire sites, the biggest bust of its kind.

Yesterday’s takedowns, just four months after Operation Power Off, suggest the operations resulting from the group’s work may be accelerating. And Big Pipes is still tracking and hunting the booters that remain online, warns Richard Clayton, who leads a security research team at Cambridge University and has served as one of the group’s longest-running members. “We’re hoping that some of the people who were not taken down in this round get the message that perhaps it’s time they retired,” says Clayton. “If you weren’t seized this time, you might conclude you’ve pushed up your chance of being investigated. You might not want to wait and see what happens.”

Big Pipes Start Fights

The idea for Big Pipes was sparked at the Slam Spam conference in Pittsburgh in 2014, when Allison Nixon, a security researcher then at Deloitte, met with Elliot Peterson, an FBI agent who’d recently worked on the takedown of the notorious Game Over Zeus botnet. Nixon suggested to Peterson that they collaborate to take on the growing problem of booter services: At the time—and still today—hackers were wreaking havoc by launching ever-growing DDOS attacks across the internet for nihilistic fun, petty revenge, and profit, increasingly selling their attacks as a service.

In some cases, attackers would use botnets of thousands of computers infected with malware. In others, they’d use “reflection” or “amplification” attacks, exploiting servers run by legitimate online services that could be tricked into sending large amounts of traffic to an IP address of the hackers’ choosing. In many instances, gamers would pay a fee to one of a growing number of booter services—often just around $20 dollars for a subscription offering multiple attacks—to hit their rivals’ home connections. Those DDOS techniques frequently caused serious collateral damage for the internet service providers dealing with those indiscriminate floods of traffic. In some cases, DDOS attacks aimed at a single target could take down entire neighborhoods’ internet connections; disrupt emergency services; or, in one particularly gruesome case, break automated systems at a chicken farm, killing thousands of birds.

Big Pipes soon began to recruit staff from major internet services who had firsthand knowledge of booters based on their experiences as both victims and defenders in their attacks. (The group got its name from the phrase “big pipes start fights,” a joke about its members bragging about who among them had the biggest bandwidth on the internet.) Nixon and Clayton, for their part, contributed data from sensor networks they’d created—honeypots designed to join hackers’ botnets or act as their reflection servers and thus allow the researchers to see what attack commands the hackers were sending.

From Big Pipes’ inception, some members also went so far as to actively hunt for the identities of booter service operators, using clues from their forum posts and the websites where they advertised their attack services as starting points to try to unmask them. In one instance, a member of the group identified a booter operator by following a trail of online pseudonyms, phone numbers, and email addresses that led him from the hacker’s handle on the website HackForums—“itsfluffy”—to a web page that revealed his day job as a trainer for Pawfect Dog Training, along with his real name, Matthew Gatrel. “The operators of commodity DDOS services are not the most sophisticated actors out there,” says the Big Pipes member who followed those breadcrumbs, and who asked to remain unnamed. “They make mistakes.”

A Christmas Takedown Tradition

As Big Pipes’ data collection on booter service operators grew, so did the group’s partnership with the FBI. Eventually, that collaboration developed into an intermittent Christmas tradition of rounding up and disrupting as many of the internet’s worst booter services as possible. The timing of these operations, Big Pipes’ members emphasize, wasn’t intended for cruelty but as a response to the hackers’ own targeting of the holiday: For years, nihilistic hackers would wait until Christmas Day to launch disruptive DDOS attacks against online gaming services like the Playstation Network and Xbox Live, aiming to knock major gaming services offline on the busiest day of the year, just as kids were trying out their newly gifted games.

So in 2018, Big Pipes’ members worked with the FBI and the US Justice Department to stage their own pre-Christmas intervention, sifting through their data and giving leads to the group’s agents and prosecutors to take out the most active services in the growing booter industry. “We’re figuring out target selection: Which of these booter owners can be identified? Which of these booters are the highest harm in terms of the amount of DDOS traffic they’re pushing?” says Nixon, who today works at the security firm Unit221b. “So we figure out, OK, these are the highest-harm targets, these ones are low-hanging fruit. Who are we actually going to take down?”

In December of 2018, just five days before Christmas, the FBI announced a bust of 15 of the booters Big Pipes had suggested were the worst offenders. They included one called Quantum that the FBI says had launched 80,000 DDOS attacks and another, DownThem, accused of launching no fewer than 200,000. Three men operating those services in Pennsylvania, California, and Illinois—including the dog trainer Matthew Gatrel—were arrested and charged.

In the wake of that operation, Clayton’s Cambridge research team found that attacks from booter services fell by nearly a third for more than two months, and the services’ attacks with US victims were nearly cut in half for that time. So Big Pipes suggested they do it all again, only now going after _every_ major booter service that remained online. “Let’s see what happens if we go after everything that matters,” says Peterson, the FBI agent. “How do they react?”

It would take four years for the FBI and Justice Department to work back up to a second major booter takedown, following long delays that included Gatrel’s trial—he was sentenced in 2021 to two years in prison—and the Covid-19 pandemic. But finally, last December the FBI pulled off an even bigger purge of the booter underworld. Along with UK and Dutch federal police, they arrested six booter operators and tore down 49 web domains for booter services—all based on a long list of targets assembled from Big Pipes’ data about the most prominent and high-volume cyberattack services.

In fact, Clayton says that the operation took offline 17 of the top 20 booter services, based on his Cambridge research team’s data. Among the larger list of targets of the operation, he found that half of the 49 services returned under new names, but they carried out only half as much attack traffic for the next several months, with the number of attacks only returning to their previous level in March. That sustained dip was due, Clayton guesses, to the deterrent effect of the operation on potential booter customers. “I’d been pushing this idea that we should take down every booter in the world,” Clayton says. “We got halfway there.”

Yesterday, the FBI and Justice Department announced the success of yet another mass booter takedown, this time seizing 13 web domains of booter services. In fact, the DOJ says that 10 of those domains were seizures of reincarnated, renamed booters that had also been seized in the previous sweep in December, an action meant to signal to booter operators that they can’t evade law enforcement by merely relaunching their service with a new name and domain. Meanwhile, prosecutors also announced yesterday that four of the six defendants charged in that previous operation have now pleaded guilty.

Honeypots, Google Ads, Knock-and-Talks

Despite their constant communication, the members of Big Pipes and the FBI are careful to note that the internet services with staff members in the group don’t share their users’ private information without going through the usual legal processes of subpoenas and search warrants. Nor does the FBI share private data with Big Pipes, or blindly arrest or search people based on the group’s leads, Peterson says; the FBI investigates the defendants from scratch, treating information from Big Pipes as it would tips from any source. The FBI’s 2018 case against Gatrel, for instance, began with a subpoena to Cloudflare—a DDOS mitigation service Gatrel was ironically using to protect his own booter website—and then search warrants for Gatrel’s Google accounts.

But Peterson says Big Pipes’ work has nonetheless significantly helped him understand who to target in the booter landscape and how to pursue them far more efficiently. “If you take Big Pipes away, could we have worked cases against booter services? Yes,” he says. “But it might have taken a few more years to get to a similar scale.”

The FBI and Big Pipes’ increasing tempo of disruption may well just push booter services deeper into the shadows, rather than eliminating them. But if booter operators stop advertising on the open internet and move to the dark web, for instance, Clayton argues that the move would make it more obvious to their customers that the services are illegal and risky, and thus reduce demand for them.

In fact, he and other members of Big Pipes argue that most booter customers seem to believe—or convince themselves—that merely paying to use one of the services to knock out an adversary’s internet connection isn’t against the law, or at least isn’t an enforceable crime. When the UK’s National Crime Agency (NCA) ran a six-month Google advertising campaign in 2018 to intercept people seeking booter services and warn them about their illegality, Clayton’s research group found that attack traffic in the UK remained flat for those six months, while it increased at its usual pace in other countries.

Courtesy of FBI

In the years since, law enforcement agencies seem to have learned from that experiment: The FBI now also buys similar Google advertisements to warn potential booter customers that paying for the services is a crime. The UK’s NCA, meanwhile, has not only launched new advertising campaigns but even run its own fake booter services to identify would-be customers and then send them warnings—sometimes even with in-person visits—about the consequences of paying for criminal DDOS attacks.

Big Pipes’ Allison Nixon says she hopes that softer tactics like those can intercept would-be booter service operators early, before they start committing felonies: She’s found that most booter operators start as customers before launching their own service. But for people who aren’t dissuaded by those interventions, she says, Big Pipes and its partners at the FBI will still be watching them.

“The hope is that this whole show of force will convince some of them to quit and get a real job,” Nixon says. “We want to send a message that there are people tracking you. There are people paying attention to you. We have our eyes on you, we might get you next. And it might not even be on Christmas.”

The Team of Sleuths Quietly Hunting Cyberattack-for-Hire Services

OpenAI has new tools that give you more control over your information—although they may not go far enough.

There’s a chance that ChatGPT knows personal details about you—and if it doesn’t, it might just make something up. As OpenAI’s generative text chatbot has boomed in popularity over the past six months, the risks of the system being trained on data vacuumed up from the web have become clearer.

Data regulators around the world are investigating issues with how OpenAI gathered the data it uses to train its large language models, the accuracy of answers it provides about people, and other legal concerns about the use of its generative text systems. Europe’s data regulators have joined forces to look at OpenAI after Italy temporarily banned ChatGPT from the country. And Canada is also investigating the technology’s potential privacy risks.

In Europe, GDPR laws require companies and organizations to demonstrate lawful reasons for handling people’s personal information and to let people access information about them, be informed of how their information is used, and demand that errors be rectified. In some cases, they can ask that certain types of data be erased. The way people’s personal information has been used in training data has been an early area of concern for EU regulators.

As people have experimented with the chatbot, asking it questions about their lives and friends, a range of potential problems have emerged. OpenAI warns that ChatGPT may provide inaccurate information, and people have found that it makes up jobs and hobbies. It has cooked up false newspaper articles that had even the alleged human authors wondering if they were real. It generated incorrect statements saying a law professor was involved in a sexual harassment scandal, and it said a mayor in Australia had been implicated in a bribery scandal—he is preparing to sue for defamation.

It’s not just individuals who are concerned about how data is used. Samsung has banned employees from using generative AI tools, in part over fears about how data is stored on external servers and the risk that company secrets could ultimately be disclosed to other users. (There are separate issues around copyright and intellectual property.)

In response to the scrutiny—particularly from the Italian data regulator, which has now allowed ChatGPT back into the country after OpenAI made changes to its service—the company has introduced tools and processes that allow people more control over at least some of their data. Here’s how to use them.

Get Your Data Removed From ChatGPT

ChatGPT and GPT-4 generate their human-like answers statistically—predicting which words are likely to follow others after seeing millions of examples of sentences written by human authors. OpenAI has been secretive about the data it has trained its large language models on, so nobody outside the company knows exactly how much of the web (including people’s personal information) it has scraped in the process.

OpenAI says its large language models are trained on three sources of information: data taken from the web, data that the company licenses from others, and the information people feed it through chats. This can include information about individuals. “A large amount of data on the internet relates to people, so our training information does incidentally include personal information,” OpenAI explains in a post, stating that it takes steps to reduce the amount it gathers.

OpenAI has now introduced a Personal Data Removal Request form that allows people—primarily in Europe, although also in Japan—to ask that information about them be removed from OpenAI’s systems. It is described in an OpenAI blog post about how the company develops its language models.

The form primarily appears to be for requesting that information be removed from answers ChatGPT provides to users, rather than from its training data. It asks you to provide your name; email; the country you are in; whether you are making the application for yourself or on behalf of someone else (for instance a lawyer making a request for a client); and whether you are a public person, such as a celebrity.

OpenAI then asks for evidence that its systems have mentioned you. It asks you to provide “relevant prompts” that have resulted in you being mentioned and also for any screenshots where you are mentioned. “To be able to properly address your requests, we need clear evidence that the model has knowledge of the data subject conditioned on the prompts,” the form says. It asks you to swear that the details are correct and that you understand OpenAI may not, in all cases, delete the data. The company says it will balance “privacy and free expression” when making decisions about people’s deletion requests.

Daniel Leufer, a senior policy analyst at digital rights nonprofit Access Now, says the changes that OpenAI has made in recent weeks are OK but that it is only dealing with “the low-hanging fruit” when it comes to data protection. “They still have done nothing to address the more complex, systemic issue of how people’s data was used to train these models, and I expect that this is not an issue that’s just going to go away, especially with the creation of the EDPB taskforce on ChatGPT,” Leufer says, referring to the European regulators coming together to look at OpenAI.

“Individuals also may have the right to access, correct, restrict, delete, or transfer their personal information that may be included in our training information,” OpenAI’s help center page also says. To do this, it recommends emailing its data protection staff at dsar@openai.com. People who have already requested their data from OpenAI have not been impressed with its responses. And Italy’s data regulator says OpenAI claims it’s “technically impossible” to correct inaccuracies at the moment.

How to Delete Your ChatGPT Chat History

You should be cautious of what you tell ChatGPT, especially given OpenAI’s limited data-deletion options. The conversations you have with ChatGPT can, by default, be used by OpenAI in its future large language models as training data. This means the information could, at least theoretically, be reproduced in answer to people’s future questions. On April 25, the company introduced a new setting to allow anyone to stop this process, no matter where in the world they are.

When logged in to ChatGPT, click on your user profile in the bottom left-hand corner of the screen, click **Settings**, and then **Data Controls**. Here you can **toggle off Chat History & Training**. OpenAI says turning your chat history off means data you input into conversations “won’t be used to train and improve our models.”

As a result, anything you enter into ChatGPT—such as information about yourself, your life, and your work—shouldn’t be resurfaced in future iterations of OpenAI’s large language models. OpenAI says when chat history is turned off, it will retain all conversations for 30 days “to monitor for abuse” and then they will be permanently deleted.

When your data history is turned off, ChatGPT nudges you to turn it back on by placing a button in the sidebar that gives you the option to enable chat history again—a stark contrast to the “off” setting buried in the settings menu.

How To Delete Your Data From ChatGPT

Documents obtained by WIRED show SafeGraph, which sold location data related to Planned Parenthood visits, is now pursuing contracts with the US Air Force.

In its early years, SafeGraph sold direct access to individualized location traces tied to device IDs. SafeGraph has historically denied any links to law enforcement. “Contrary to some belief, we don’t have any law enforcement customers,” Hoffman, the founder, wrote in 2022. However, this kind of data, sold by other vendors, has reportedly been purchased by the FBI, Immigration and Customs Enforcement, and local police. 

In 2019, it spun off a subsidiary company called Veraset, which took over SafeGraph’s relationships with data providers, such as apps and other data brokers, and its business selling individualized data. The SafeGraph brand then shifted to selling aggregated and processed products based in part on Veraset’s raw data.

The AFWERX contract is the first publicly reported relationship between SafeGraph and the US military, but the company has a history of working with other government agencies. In 2018, it sold two years of raw data to the Illinois Department of Transportation. In the first months of the Covid-19 pandemic, it inked a $420,000 deal with the Centers for Disease Control. Meanwhile, Veraset gave raw, individualized data about millions of people to the Washington, DC, Department of Health and other agencies around the country. And in 2020 and 2021, Santa Clara County used SafeGraph data to monitor attendance at a local church as part of a broader effort to enforce Covid restrictions. Materials shared with the Air Force mention relationships with the US Department of Agriculture, the Federal Reserve Bank, and the Los Angeles County, New York City, and New Jersey governments. 

SafeGraph has also shown interest in the homeland security business. In 2022, it cosponsored the Institute for Defense and Government Advancement’s Homeland Security Week, a trade show and expo that connects security contractors with top federal and local law enforcement officials. In a joint video presentation with Department of Homeland Security contractor GoTenna, a SafeGraph representative advertised “strategic intelligence” to help border patrol agents monitor US “points of entry” and areas that can’t be watched in other ways. 

In May 2022, Vice revealed that SafeGraph was selling access to aggregated counts of where people were before and after visiting abortion clinics, including Planned Parenthood. In response, 14 US senators sent the company a letter demanding answers about its business practices, and SafeGraph promised to stop selling data about abortion clinic visitors.

Although SafeGraph is best known for dealing in cell-phone-based location data, its pitch to the Air Force makes little mention of data about human movement—the only direct reference is a slide that says it can help “analyze human activity for Landing Zone (LZ) selection,” without explaining what that means. But SafeGraph has recently expanded its business to incorporate other kinds of data as well. For example, in 2022, it launched Spend, a product that profiles the customers of brick-and-mortar stores, including what they spend, what wireless carriers they use, and whether they take out short-term “buy now, pay later” loans. 

In its slide deck for the Air Force, SafeGraph also claims to use a “global language model” able to “ingest data from 193 countries” and “100+ languages” to augment its data about physical places using “web-crawling and Machine Learning.” In response to a question about outstanding challenges, it said it plans to build “deeper language models” to help it gather data about places of interest to the Air Force, such as the Middle East.

SafeGraph is funded in part by the CIA-backed venture capital firm In-Q-Tel, and In-Q-Tel head of investments George Hoyem sits on SafeGraph’s board, according to its slide deck. SafeGraph has also received investments from a motley crew including Peter Thiel, Sam Harris, former Republican House majority leader Eric Cantor, and former Saudi Arabian intelligence chief Prince Turki bin Faisal Al Saud. SafeGraph’s last funding round valued the company at $370 million, according to the records.

In a post-contract questionnaire, SafeGraph told AFWERX it had met eight times with various parts of the Air Force to discuss the use of its products. It now plans to apply for a larger Phase 2 contract with the Air Force in the third quarter of 2023, targeting Task Force 99 of the Al Udeid Air Base in Qatar. The records also mention the possibility of a facility security clearance, which would allow SafeGraph to access classified information directly.

SafeGraph Lands US Air Force Contract After Targeting Abortion Clinics

A  few simple tools can help filter out most Twitter Blue users (but still see the ones you like).

I'm not here to judge anyone who pays for Twitter Blue. However, I'm not a fan of pay-to-win mechanics. At this point, Twitter is a game where players compete for the most attention; Twitter Blue is overpowered DLC. If you buy a subscription, your tweets are shown at the top of comment threads and prioritized in other contexts, including the “For You” page. This makes Blue the social media equivalent of paying for unlimited ammo or improved body armor, regardless of who you are or whether what you have to say is worth promoting.

It also makes Twitter really annoying to use. No one wants to play with the people who are paying to win. That's why there's so much mockery of, and desire to avoid, Twitter Blue users.

Granted, there are plenty of reasons why longtime Twitter power users—in particular, public figures or people who historically have trouble with impersonators—might pay for Twitter Blue. No one wants to lose an audience they worked hard to build, and Twitter has the right to monetize itself however it likes. You also have the right to consume (or not consume) the social media you choose.

All the same, it can't be denied that a lot of really annoying posts from Twitter Blue users with low follower counts show up in all kinds of contexts. If you don't want to see those posts, I don't blame you, and here's how you can filter them all out:

Blue Lite Blocker

Twitter via Justin Pot

BlueLiteBlocker is a free, open-source browser extension for Chrome and Firefox that can filter comments from Twitter Blue subscribers out of your Twitter timeline. You can install the extension and then use Twitter the way you normally do. All comments from Twitter Blue users will be obscured—you can click “View” if you are absolutely certain you want to see them.

Unlike some extensions (BluesBlocker, for example, or Twitter Blue Blocker), Blue Lite Blocker doesn't affect anyone that you actively follow, meaning it won't accidentally filter out your friends. The extension also allows you to still see the tweets from Twitter Blue users that have a certain number of followers—the default threshold is 100,000, but you can set it to whatever you want.

Twitter via Justin Pot

These two features make Blue Lite Blocker the perfect compromise. It filters out the annoying Twitter Blue users while not affecting the people you care about and the public figures whose posts you might want to see. If there's a Twitter Blue user with a lot of followers who you don't want to see, you can block or mute them manually.

Other Workarounds to Clean Up Twitter

Blue Lite Blocker isn't a perfect solution. It requires a browser extension, which not everyone is going to like, and it doesn’t help on mobile (not that there’s much help on mobile anyway). There are a few alternatives, though.

Twitter via Justin Pot

The first is to make sure you're using the Following tab instead of For You. This tab is just tweets from the people you follow, so it doesn't artificially favor Twitter Blue subscribers. You could also try blocking all retweets if you want to clean things up a little more.

If that's not enough, you could try TweetDeck, the power user's version of Twitter. This tool doesn't have a For You page or any algorithmic sorting, meaning Twitter Blue users aren't artificially boosted on it. TweetDeck is the one part of Twitter that's completely untouched by the recent changes there, and I hope this doesn't change. (So please, no one tell Elon Musk that TweetDeck still exists.)

Another cool extension, if you miss seeing legacy checkmarks, is Eight Dollars. Right now blue checkmarks only show up if someone is paying for Blue, meaning most people who had a checkmark prior to April 20, 2023 no longer have one. Eight Dollars can show you which users were verified before legacy verified checkmarks were removed, which is useful if you trusted the old system.

There's a cat and mouse element to all of this, of course. Twitter's current regime really, really wants to turn Blue checkmarks into sellable status symbols and any tool that diminishes the visibility of Blue subscribers cuts against that goal. They're going to try to find a way to break this, and all similar, tools. For now, though, they work—use them while you can. 

Or you could just abandon your Twitter account, set up a public archive of your tweets, and learn how to get started on Mastodon or Bluesky. Up to you.

Your Twitter Feed Sucks Now. These Free Add-Ons Can Help

Plus: Apple and Google plan to stop AirTag stalking, Meta violated the FTC’s privacy order, and how to tell if your car is tracking you.

In December 2020, security giant Mandiant revealed it had been hacked. Its disclosure was the first public sign of the SolarWinds hack, a Russian-orchestrated supply chain attack that's widely regarded as one of the biggest espionage hacks ever. Among its victims were the US Departments of Homeland Security, Energy, and Justice. This blow-by-blow retelling of the historic SolarWinds attack, from Kim Zetter, charts the ways the hackers pulled off the attack—and how they were eventually caught.

Anti-abortion group the American College of Pediatricians (ACPeds) suffered a significant data breach this week. The doctors' organization, which sued the US government to ban the abortion drug mifepristone, left an unsecured Google Drive on its website, exposing a decade's worth of email exchanges, financial and tax records, and more sensitive data. The details give an unprecedented view of the organization, which has been described as a “hate group” for its views on LGBTQ people.  While ACPeds—which is not a school at all—characterizes itself as a “scientific organization,” leaked records show its deeply evangelical Christian mission.

Security experts have promised a future where passwords will cease to exist for the best part of a decade. However, that reality took a big step forward this week—really!—as Google launched passkey logins for billions of people. The technique uses cryptographic keys that are stored on your devices to replace your old, insecure passwords.

Elsewhere, cops in the US, Europe, and nine other countries have arrested 288 people for their involvement in the dark web drug markets, including the site Monopoly Market, which was quietly taken offline in 2021. Facebook owner Meta has added new tools to its business accounts in an attempt to thwart bad actors abusing them, including who can become account administrators and access lines of credit.

But that’s not all. Each week, we round up the news we didn’t report in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

Russian ships with underwater operations equipment have been identified as being near the sites of the Nord Stream gas pipeline explosions in the days before the blasts, according to a joint investigation from national broadcasters in Denmark, Norway, Sweden, and Finland. Journalists at the publications combined intercepted radio broadcasts from the ships with satellite images to pinpoint their locations and track their paths. It is the latest example of investigators piecing together different sources of data, from varying unconnected sources, to reveal new details about real-world events.

Three ships, according to the investigation, sailed from naval bases in Russia to near the blast sites in June and September 2022. All of the ships had turned off their location tracking AIS services, an act often described as “going dark” and commonly used for disguising activity. Among the vessels were the navy research ship Sibiryakov and a tugboat called SB-123, which is said to be capable of launching mini-submarines. (In November 2022, WIRED reported on the presence of “ghost ships” around the time of the explosions, but had no information on their identity.)

Separately, another Russian vessel, the SS-750, was near the pipelines four days before they were blown up. In response to a public records request, the Danish Defense Command confirmed to the Information, a Danish news site, that it had 26 photos of the SS-750 near the sites.

Since the explosions at the Nord Stream 1 and 2 pipelines in September, there has been no official confirmation, with supporting evidence, of who may have been behind the blasts. The investigation from the Nordic journalists says the ships’ behavior was unusual but does not conclude what they were doing near the Nord Stream sites. Russia has denied being involved in the attacks, pointing fingers at both the UK and US. Other reports have claimed a pro-Ukranian group may have conducted the attack, which Ukraine has denied. Official investigations into the blasts are still ongoing in multiple European countries and the exact cause of the explosions is still unclear.

The US Federal Trade Commission is planning to impose a “blanket ban” on Meta and its companies—Instagram, Messenger, Facebook, WhatsApp, and VR firm Horizon Worlds—from making money from the data of people under 18. This could potentially mean the company would not be able to use data from these users to show them targeted advertisements and could only use the information it collects for providing its services or security purposes. The FTC also says that Meta would not be able to start using data collected before people turned 18 for commercial purposes.

The proposal comes as the FTC alleged Meta hasn’t complied with a previous 2020 privacy order it agreed to as part of a $5 billion settlement. In a statement, the FTC says Meta has “misled parents about their ability to control with whom their children communicated through its Messenger Kids app, and misrepresented the access it provided some app developers to private user data.” The proposed changes would be a modification to the FTC’s previous order, and it says it may also limit how Meta uses face recognition technology and require it to provide extra protection for users. Mark Zuckerberg’s firm has 30 days to respond to the FTC, which then may alter its plans.

How do you know if you are being stalked with an AirTag? If you have an iPhone running a newish version of iOS, then you should receive push notifications if an AirTag that doesn’t belong to you is following you around. However, if you own an Android device, you have to go through the extra step of downloading an app to discover if you are being tracked—a high burden for people in potentially abusive situations. Apple and Google said this week they are now working together to create a common standard for all phones to detect Bluetooth trackers that are being used to stalk or harass people. The proposal is also backed by Samsung and Bluetooth tracker manufacturers. The plan comes years after Apple’s cheap devices were first released without the additional privacy protections Apple added after the AirTags launch.

In 2017, the NotPetya cyberattack—the most devastating in history—caused more than $10 billion in damage to the companies and organizations it impacted. Among them was pharmaceutical giant Merck, which lost hundreds of millions of dollars as a result of the malware. This week, a New Jersey court ruled that Merck's insurers have to cover losses from the cyberattack. The insurers had argued the use of the malware, which has been linked to Russia, should be considered a warlike act and, as a result, would not fall under insurance policies.

The judges didn't agree. “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action,” they wrote in a decision. “Coverage could only be excluded here if we stretched the meaning of 'hostile' to its outer limit.” The decision comes as US president Joe Biden's administration looks to shift the liability for security issues to companies that are impacted.

Whether you know it or not, your car is a data goldmine. Within a few minutes, it is possible to "fingerprint" you based on the data your vehicle collects. Some consider the amount of data that vehicles grab a national security threat. A new free tool, from vehicle privacy company Privacy4Cars, aims to reveal how much data your car and its manufacturer can collect about you. Entering your vehicle identification number (VIN) into the tool will tell you whether your car collects "identifiers, location data, biometrics, and data synced from mobile phones," as well as what data manufacturers sell to third parties, such as data brokers.

Russian ‘Ghost Ships’ Identified Near the Nord Stream Blasts

Leaked documents reveal that the American College of Pediatricians viewed “mainstream medicine” and “nominal Christians” as its opposition.

In a declaration in federal court in 2021, Quentin Van Meter, the president of the American College of Pediatricians, described the organization as a “secular, scientific medical association,” whose “views are not religious as such.” 

ACPeds has also targeted donors, physicians, and other clinicians based solely on their political leanings, documents show. The group maintains a list of more than 5,000 “conservative doctors,” for instance, and records reveal that they have been routinely targeted with mailers designed to elicit interest in membership. 

In 2021, ACPeds solicited a proposal from a direct-mail fundraising agency on how to boost its fundraising efforts and where to spend the windfall. The agency recommended that ACPeds target “30,000 prospective conservative donors,” whose gifts, it said, would in turn be spent to “target conservative professionals in the medical community.” In an explanation of the services it offers, the agency said it could procure donor lists from “other like-minded organizations,” and that, if ACPeds wished, it could facilitate “exchanges” and “rentals” of other mailing lists.

Information about medical professionals would not be sold or exchanged, the agency said, if the professionals are “existing ACPeds members.” A contract between the group and the agency was finalized in August 2021, records show. 

Despite its homages to science, the views of ACPeds and its board are deeply rooted in a morality based exclusively in evangelical religious beliefs. Notes taken at board meetings, which open and close with prayer, show that its directors view consensus science, people who hold advanced degrees, and even the law itself as a threat to its agenda. Prayer is prescribed as “armor” against the group’s perceived adversaries, which include other Christians whose devotion they’ve judged to be inadequate.

Minutes from a 2017 board meeting read: “Threats to the College include the Southern Poverty Law Center (SPLC), the Human Rights Campaign (HRC), and the LGBTQ lobbying body, as well as mainstream medicine, psychology, academia, media, corporate America and nominal Christians, churches and organizations.” 

The atmosphere at ACPeds’ closed-door meetings, dozens of which are meticulously documented, contrasts sharply with the image it aims to project publicly. Conversations over exactly how religious the group can present itself publicly have rolled from one year to the next. During meetings in 2014 and 2015, members discussed the potential benefits of declaring their “recognition of God versus standing purely as a scientific organization.” A minute taker noted that no “definitive agreement” could be reached about “whether or not to do this.” 

Records of its membership totals show that as few as half of ACPeds’ 700 members may be practicing pediatricians, with its numbers being boosted by subscriptions from students, retirees, and so-called “friends” of the organization. Records show the group has also explored expanding its ranks to include additional members without medical expertise in response to its lackluster returns on expensive recruitment efforts. 

Debates over whether to harness its religiosity in a more public way have been attended by a Catholic attorney, who in 2014 advised them to “express belief in a deity without being evangelical.” After the opening prayer at the following year’s gathering, the group’s then president, Michelle Cretella, mimicked the lawyer’s advice, reminding members that ACPeds is not a “religious organization,” but a “theistic” one that recognizes “natural laws” imparted by a supreme being.

Doctors Behind Mifepristone Ban Called ‘Christians’ a Top Threat

The company is adding new tools as bad actors use ChatGPT-themed lures and mask their infrastructure in an attempt to trick victims and elude defenders.

The social media giant Meta warned today that it sees many malware actors spreading their attack infrastructure across multiple platforms, to make it more difficult for individual tech companies to detect their malicious activity. The company added, though, that it views the shift in tactics as a sign that industry crackdowns are working, and it says it is launching additional resources and protections for business users with the goal of raising the barriers for attackers even more.

On Facebook, Meta has now added new controls for business accounts to manage, audit, and limit who can become an account administrator, who can add other administrators, and who can perform sensitive actions like accessing a line of credit. The goal is to make it more difficult for attackers to use some of their most common tactics. For example, bad actors may take over the account of an individual who is employed by or otherwise connected to a target company, so the attacker can then add the compromised account as an administrator on the business page.

Meta is also launching a step-by-step tool for businesses to help them flag and remove malware on their enterprise devices and will even suggest using third-party malware scanners. The company says it sees a pattern in which users' Facebook accounts are compromised, the owners regain control, and then the accounts are re-compromised because the targets' devices are still infected with malware or have been reinfected.

“This is an ecosystem challenge, and there’s a lot of adversary adaptation,” says Nathaniel Gleicher, Meta’s head of security policy. “What we’re seeing is adversaries working really hard, but defenders moving more systematically. We're not just disrupting individual bad actors; there are a number of different ways that we are countering them and making it harder.”

The move to distribute malicious infrastructure across multiple platforms has advantages for attackers. They may distribute ads on a social network like Facebook that aren't directly malicious, but that link to a fake creator page or other niche profile. On that site, attackers can post a special password and link to a file-sharing service like Dropbox or Mega. Then they can upload their malicious file to the hosting platform and encrypt it with the password from the previous page to make it harder for companies to scan and flag. In this way, victims follow the bread crumbs through a chain of legitimate-looking services, and no one site has a complete view of every step in the attack.

As public interest in generative AI chatbots like ChatGPT and Bard has ramped up in recent months, Meta also says it has seen attackers incorporating the topic into their malicious ads, claiming to offer access to these and other generative AI tools. Since March 2023, the company says, it has blocked more than 1,000 malicious links used in generative AI-themed lures so they can't be shared on Facebook or other Meta platforms, and it has shared the URLs with other tech companies. It has also reported multiple browser extensions and mobile apps related to these malicious campaigns.

Meta says the attackers who distribute a known malware strain called Ducktail have increasingly leaned on these techniques in an attempt to compromise a range of victims and take over Facebook business accounts to distribute more of their malicious ads. Meta attributes Ducktail's activity to actors in Vietnam, and the company recently issued a cease-and-desist letter to specific individuals in addition to reporting the activity to law enforcement.

In late January, Meta also identified a new malware strain, dubbed NodeStealer, that was targeting Windows browsers to record victims' usernames and passwords, steal cookies, and use the data to compromise Facebook accounts as well as Gmail and Outlook accounts. Meta also attributes this campaign to Vietnamese actors, and it quickly began submitting takedown requests to hosting providers, domain registrars, and other application services that the actor was using for its activity and malware distribution. The company says these steps appear to have been disruptive, and it hasn't detected new samples of NodeStealer since February 27.

“What they’re counting on is that we are going to keep working in silos amongst companies and we’re not going to be able to follow them jump to jump, platform to platform,” Meta's Gleicher says. 

He adds that in addition to adding new features for users, expanding Meta's automatic detections, and taking direct action against attackers, the company uses public disclosure and information-sharing with other companies and law enforcement as a way of making things more difficult for attackers.

“It’s easy to recognize that the more platforms need to coordinate, the more complex the defenses can be,” Gleicher says. “But the more distributed an adversary's operation is, the more they have to keep all these different platforms working together, and the number of victims who make it through that funnel is lower and lower. The more we force them to be distributed, the higher the cost on the adversary.”

Meta Moves to Counter New Malware and Repeat Account Takeovers

The tech industry’s transition to passkeys gets its first massive boost with the launch of the alternative login scheme for Google’s billions of users.

Google is announcing a major effort to let its account holders log in with the password replacement known as “passkeys.” The feature launches today for the company's billions of accounts, and users will be able to proactively seek it out and turn it on. Google says it plans to promote passkeys in the coming months and start nudging account holders to convert their traditional username and password login to a passkey.

Password-based authentication has been standard across the internet (and computing in general) for decades, but the system has serious security issues, namely that attackers can steal your password or trick you into giving it to them in phishing attacks. The passkey scheme is specifically designed to address phishing attacks by relying on a different model that uses cryptographic keys stored on your devices for account authentication. 

In the year since the industry association known as the FIDO Alliance began publicly promoting the rollout of passkeys, the makers of the world's biggest consumer operating systems—Microsoft, Google, and Apple—have launched the necessary infrastructure to support passkeys. But if you still have never used a passkey in your daily life, you're far from alone.

The next step toward passkey adoption is for services to actually offer passkeys as a login option for user accounts. So far, companies like PayPal, Shopify, CVS Health, Kayak, and Hyatt have taken the plunge. Today's launch of passkeys for Google’s users is noteworthy given the company's resources and sheer scale.

“It's very, very significant,” says Andrew Shikiar, executive director of the FIDO Alliance. “It's an inflection point. A company like Google enabling this with so many people actually seeing passkey sign-ins, they’ll be more likely to use them elsewhere. And it will also accelerate other companies’ deployment plans and help them deploy better, because we will learn from this as a body."

You can log in with passkeys using biometric sensors like fingerprint or face scanners, your smartphone's device lock PIN, or physical authentication dongles like YubiKeys. To transition your Google account, you'll navigate to this link, log in with your username, password, and any additional authentication factors you have set up, and then click “+ Create a passkey” on the device you're using.

“We have an opportunity here to change the way users think about signing in,” says Christiaan Brand, an identity and security product manager at Google and co-chair of the FIDO2 technical working group. “If we can change the way that signing in works for your Google account, we hope that consumers will start to get more accustomed to the technology, and also signal to industry that we’re not just _talking_ about this stuff—it is ready for prime-time adoption.”

Passkeys can sync between your devices through end-to-end encrypted services like Google Password Manager and iCloud Keychain. Or you can set up passkeys on multiple devices by generating a QR code on a device that's logged in to your Google account that will anoint another device where you want to log in. 

All of your Google account passkeys will be listed on the “Passkey Management Page,” where you can review and revoke them. You can even store a passkey for your account on the device of someone you trust as a recovery option. If you issue a passkey to log into your Google account on a shared device, be sure to revoke it once you're done.

“What doesn’t help is when a vendor or developer only rolls out passkey for iOS or only rolls it out for Android. That’s not how passwords work; passwords are ubiquitous," Brand says. “So for us, it was important to cover as wide a range of devices as possible on launch day, no carve-outs.”

Google says that even once you make a passkey for your account (or five), your traditional username and password login isn't going anywhere, and you can still use it if you choose. But the company is betting that once people get used to passkeys, they'll like them better and find them easier to manage than passwords. And once you've set up a passkey on a device, Google will automatically detect it and prompt you to log in that way going forward.

Brand says that in early tests on a few thousand users, sign-in success rates with passkeys were immediately higher than for traditional username and password logins. That doesn't mean there won't be what Brand calls “rough edges” or use cases where there are passkey bugs. But Google says it hopes to discover and iron out as many of these issues as possible, so smaller organizations can feel more confident implementing passkeys.

Google's announcement comes on the eve of World Password Day on Thursday. But passkey proponents are ramping up their efforts to make the occasion obsolete.

“Eventually, it's going to be like World Horse and Buggy Day, I think,” Shikiar says. “For the time being, it’s a good reminder of the challenge we have to get rid of passwords.”

Google Is Rolling Out Passkeys, the Password-Killing Tech, to All Accounts

A Google Drive left public on the American College of Pediatricians’ website exposed detailed financial records, sensitive member details, and more.

While the material is not expressly religious, it is clearly aimed at painting same-sex marriage as aberrant and immoral behavior. Physicians lobbied by the group are also told to urge patients to purchase Christian-based parenting guides, including one designed to help parents broach the topic of sex with their 11- and 12-year-old kids. The College suggests telling parents to plan a “special overnight trip,” a pretext for instilling in their children sexual norms in line with evangelical practice. The group suggests telling parents to buy a tool called a “getaway kit,” a series of workbooks that run around $54 online. The workbooks methodically walk the parents through the process of springing the topic, but only after a day-long charade of impromptu gift-giving and play. 

These books are full of games and puzzles for the parent and child to cooperatively take on. Throughout the process, the child slowly digests a concept of “sexual purity,” lessons aided by oversimplified scripture and well-trodden Bible school parables. 

Another document the group shared with its members contains a script for appointments with pregnant minors. Its purpose is made evidently clear: The advice is engineered specifically to reduce the odds of minors coming into contact with medical professionals not strictly opposed to abortion. A practice script recommends the doctor inform the minor that they “strongly recommend against” abortion, adding “the procedure not only kills the infant you carry, but is also a danger to you.” (Medically, the term “fetus” and “infant” are not interchangeable, the latter referring to a newborn baby less than one year old.)

The doctors are urged to recommend that the minor visit a website that, like others shared with patients, is not expressly religious but will only direct visitors to Catholic-run “crisis pregnancy centers,” which strictly reject abortion. The same site is widely promoted by anti-abortion groups such as National Right to Life, which last year held that it should be illegal to terminate the pregnancy of a 10-year-old rape victim.

The Professionals

The effort to ban mifepristone, which the Supreme Court paused last month pending further review, faces significant legal hurdles but could ultimately benefit from the appellate court’s disproportionately conservative makeup. Most of the legal power in the fight was supplied by a much older and better funded group, the Alliance Defending Freedom, which has established ties with some of the country’s most elite political figures—former vice president Mike Pence and Supreme Court justice Amy Coney Barrett among them.

A contract in the leaked documents dated April 2021 shows the ADF agreeing to legally represent the College free of charge. It stipulates that ADF’s ability to subsidize expenses incurred during lawsuits would be limited by ethical guidelines; however, it could still forgive any lingering costs simply by declaring the College “indigent.”

In contrast to the College’s some 700 members, the American Academy of Pediatrics (AAP)–the organization from which the College’s founders split 20 years ago–has roughly 67,000. The rupture between the two groups was a direct result of a statement issued by the AAP in 2002. Modern research, the AAP said, had conclusively shown that the sexual orientation of parents had an imperceptible impact on the well-being of children, so long as they were raised in caring, supportive families.

Data visualization: DataWrapper

The College would gain notoriety early on by assailing the positions of the AAP. In 2005, a _Boston Globe_ reporter noted how common it had become for the American College of Pediatricians “to be quoted as a counterpoint” to anything said by the AAP. The institution, he wrote, had a rather “august-sounding name” for being run by a “single employee.” 

Internal documents show that the group’s directors quickly encountered hurdles operating on the fringe of accepted science. Some claimed to be oppressed. Most of the College’s research had been “written by one person,” according to minutes from a 2006 meeting, which were included in the leak. The College was failing to make a splash. In the future, one director suggested, papers rejected by medical journals “should be published on the web.” The vote to do so was unanimous (though the board decided the term “not published” was nicer than “rejected”). 

A second director put forth a motion to create a separate “scientific section” on the group’s website, strictly for linking to articles published in medical journals. The motion was quashed after it dawned on the board that they didn’t “have enough articles” to make the page “look professional.” 

The College struggled to identify the root cause of its runtedness. “To get enough clout,” one director said, “it would take substantial numbers, maybe 10,000.” (The College’s recruitment efforts would yield fewer than 7 percent of this goal in the following 17 years.) Yet another said the marketing department advised that “the College needs to pick a fight with the AAP and get on _Larry King Live_.” Another board member, the notes say, felt the organization was too busy trying to “walk the fence” by neglecting to acknowledge that “we are conservative and religious.”

Source

Wired