A woman in eastern Pennsylvania allegedly created a series of deepfake videos in a harassment and bullying campaign meant to intimidate teenage girls in competition with her daughter and get them kicked off a local cheerleading team.

Hilltown Township police earlier this month charged Raffaela Spone with three counts of cyber harassment of a child after she allegedly began harassing the teenagers last July, according to the Bucks County District Attorney Matthew Weintraub.

The girls received voice and text messages saying, “You should kill yourself,” followed by doctored videos taken from images on their social media profiles and altered to make them appear nude, vaping, or drinking. The altered images included captions reading, “toxic traits, revenge, dating boys, and smoking” and “was drinking at the shore, smokes pot, and uses ‘attentionwh0re69’ as a screen name.” The images and videos were also sent to coaches for the team, seemingly in an attempt to have the girls removed from the team.

On review, police found video “to be the work of a program that is or is similar to ‘Deep Fakes,’ where a still image can be mapped onto an existing video and alter the appearance of the person in the video to show the likeness of the victim’s image instead,” according to an affidavit filed in the case. Spone allegedly used several phone numbers to send the messages, but investigators determined all the numbers were obtained through the same wholesaler and executed a warrant on the wholesaler seeking IP address information about the originating calls. That information was linked to Spone’s residence, and after searching Spone’s devices, police determined her phone was “used to download, access, and or manipulate data” on the wholesaler’s app.

Weintraub said Spone faces misdemeanor charges and not higher-level charges because the “nude” images did not actually depict minors in sexual situations (real or simulated). Instead, the images were basically crude digital removals of an existing bikini to create a “Barbie doll-like” effect “with no obvious genitalia.” Had the images actually looked like nudes, Spone would have faced “a much more serious felony offense.”

Fake images, real crimes

In the way of many once-novel technologies, tools for creating deepfake video are rapidly becoming more accessible and more affordable. In 2019, for example, the maker of a program called DeepNude, which used neural networks to make images of clothed women appear to be realistic nudes, was forced to stop distributing the tool following strong public backlash. A few months later, Ars’ own Timothy Lee demonstrated how to turn Facebook CEO Mark Zuckerberg into the galaxy’s most famous android, Lt. Cmdr. Data from Star Trek: The Next Generation using neural networks.

In recent years, as the technology has become more accessible, several states have passed laws specifically addressing use of deepfakes. Virginia in 2019 became the first to adopt a law imposing criminal penalties on distribution of faked, nonconsensual, sexually themed material (i.e., revenge porn). In the same year, Texas banned deepfakes designed to influence an election. California then passed two laws, one to deal with revenge porn and one to deal with election manipulation, and several other states have continued to introduce legislation tackling one or the other.

The federal government, too, is trying to find its way on the issue. The 2020 National Defense Authorization Act (passed in December 2019) included several provisions related to studying the potential national security threat poised by deepfake content. The 2021 version included similar provisions.

https://arstechnica.com/?p=1749616

A US grand jury has indicted the CEO of a Canadian company that sells encrypted phones, alleging that he and an associate violated racketeering and drug laws. On Friday, the federal grand jury “returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices,” the Department of Justice said in a press release.

Sky Global CEO Jean-Francois Eap and Thomas Herdman, a former distributor of Sky Global devices, were charged with a conspiracy to violate the Racketeer Influenced and Corrupt Organizations Act (RICO), a law designed to punish organized crime. They were also charged with a conspiracy to distribute illegal drugs and aiding and abetting. The racketeering and drug counts each carry maximum penalties of life in prison, the DOJ said. The US is seeking criminal convictions and forfeiture of “at least $100,000,000” worth of assets.

The indictment is available in this Motherboard article.

“Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering,” the DOJ said. “As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.”

The company “installs sophisticated encryption software in iPhone, Google Pixel, Blackberry, and Nokia handsets,” allowing users to “communicate with each other in a closed network, and Sky Global routes these communications through encrypted servers located in Canada and France,” the DOJ said.

CEO defends fight against surveillance

Eap intends to fight the charges, he said in a statement posted on Sky Global’s website yesterday:

Sky Global’s technology… was not created to prevent the police from monitoring criminal organizations; it exists to prevent anyone from monitoring and spying on the global community. The indictment against me personally in the United States is an example of the police and the government trying to vilify anyone who takes a stance against unwarranted surveillance. It seems that it is simply not enough that you have not done anything illegal. There is no question that I have been targeted, as Sky Global has been targeted, only because we build tools to protect the fundamental right to privacy. The unfounded allegations of involvement in criminal activity by me and our company are entirely false.

That statement was available on Sky Global’s website earlier today. But the website now has a message saying, “This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant.”

We contacted the Electronic Frontier Foundation today about this case and about the legality of selling encrypted devices. EFF Senior Staff Attorney Andrew Crocker responded, “Providing an encrypted communications platform to the public is not and should not be illegal, regardless of whether users of the platform engage in illegal activity. In this case, the defendant is accused of knowingly aiding criminal enterprises, which is a separate matter.”

US and Canada cooperated

The indictment was made in US District Court for the Southern District of California. While Sky Global is based in Canada, the indictment said the alleged criminal activity occurred “within the Southern District of California and elsewhere.”

“The international operation to seize Sky Global’s infrastructure involved cooperation and efforts by law enforcement authorities in the United States and Canada,” the DOJ said. “In addition, on March 10, 2021, Europol announced that judicial and law enforcement authorities in Belgium, France, and the Netherlands had wiretapped Sky Global’s servers and monitored hundreds of millions of messages by Sky Global’s users. The European investigation resulted in hundreds of arrests, the seizure of thousands of kilograms of cocaine and methamphetamine, hundreds of firearms, and millions of Euros.”

Eap and Hardman are both citizens of Canada and residents of Vancouver. Warrants were issued for their arrests on Friday.

The case is similar to one involving Phantom Secure CEO Vincent Ramos. In October 2018, the DOJ announced a plea deal in which “Ramos admitted that he and his co-conspirators facilitated the distribution of cocaine, heroin, and methamphetamine to locations around the world including in the United States, Australia, Mexico, Canada, Thailand and Europe by supplying narcotics traffickers with Phantom Secure encrypted communications devices designed to thwart law enforcement.” Ramos was sentenced to nine years in prison and ordered to forfeit $80 million.

Sky Global sold 70,000 modified devices

“There are at least 70,000 Sky Global devices in use worldwide, including in the United States,” the indictment on Friday said. Having operated since 2010, Sky Global “generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.”

Sky Global replaces key components of commercially available phones to prevent surveillance by law enforcement, the indictment said:

Whereas the standard iPhone, Google Pixel, Blackberry, or handset is sold to the public with the capability for voice communication, GPS navigation, camera, Internet access, and the Messenger services, when Sky Global receives the devices, their technical team removes the internal hardware/software responsible for the GPS, camera, Internet, and voice communications. Sky Global then installs sophisticated encryption software and routes the data through encrypted servers located in Canada and France.

Sky Global charged subscription fees of “approximately $1,200-$2,000 USD per six month period,” the indictment said. Sky Global “used digital currencies, including Bitcoin, to facilitate illegal transactions on the website, to protect the membership’s anonymity, and to facilitate the laundering of the membership’s ill-gotten gains,” the indictment also said.

After the Phantom Secure case, “Sky Global instituted an ‘ask nothing/do nothing’ approach toward its clients,” the DOJ said. “This policy allowed for Sky Global to claim plausible deniability from the activities of their clients that they knew or had reason to know participated in illegal activities, including international drug trafficking.”

https://arstechnica.com/?p=1749746

A group of US lawmakers is proposing new legislation that would allow media organizations to set terms with social media platforms for sharing their content, reminiscent of a controversial measure recently adopted in Australia.

The Journalism Competition and Preservation Act of 2021 basically creates a temporary 48-month carve-out to existing antitrust and competition law that would allow small news outlets to join forces to negotiate as a collective bloc with “online content distributors” such as Facebook and Google for favorable terms.

“A strong, diverse, free press is critical for any successful democracy. Access to trustworthy local journalism helps inform the public, hold powerful people accountable, and root out corruption,” said Rep. David Cicilline (D-R.I.), when introducing the proposal. “This bill will give hardworking local reporters and publishers the helping hand they need right now, so they can continue to do their important work.”

This is the third time Cicilline has introduced a similar bill, but he now has more company than in the previous two Congressional sessions. Reps. Ken Buck (R-N.Y.) and Mark DeSaulnier (D-Calif.) and Sens. Amy Klobuchar (D-Minn.) and John Kennedy (R-La.) also plan to co-sponsor the measure—giving it both bipartisan and bicameral support.

Text for the 2021 edition of the bill was not yet available at publication time, but previous editions define “online content distributors” covered by the law as aggregators that “display, distribute, or direct users to news articles, works of journalism, or other content on the Internet” that is generated by news companies and that have “not fewer than” 1 billion users. Very few businesses in this world have more than a billion users, so the bill is effectively tailored to apply to Facebook and Google without actually naming either company.

Seems familiar…

The House Antitrust Subcommittee, of which Cicilline is chair, held an often-contentious hearing Friday on the bill and the broader topic of how to ensure that media—especially smaller, local media—can stay afloat and in the black when the vast majority of the Internet is controlled by Google or Facebook.

Microsoft President Brad Smith testified at the hearing and said he supported legislative action in the US, just as Microsoft did in Australia.

“The problems that beset journalism today are caused in part by a fundamental lack of competition in the search and ad tech markets that are controlled by Google,” Smith said. “As a result, there is a persistent and structural imbalance between a technology gatekeeper and the free press… this makes it very unlikely that the economic transformation needed to restore journalism to health can succeed at scale without new legislation and government support.”

Smith then explicitly drew the connection to Australia’s new law, arguing, “The idea there was straightforward: the Australians put in place legislation to help drive market-based solutions.” The US, too, could seek that kind of solution, he suggested.

The path to legislation in Australia, however, was anything but smooth. After regulators in that nation first proposed the law, Google and Facebook went all-out in their campaign against it, not only lobbying lawmakers but also creating pop-up warnings that told Australian users, “Your [Google Search / YouTube] is at risk” when visiting Google’s web properties.

By January of this year, Google was threatening to quit Australia altogether if the bill became law. A month later, the company unexpectedly cut major deals with several Australian media groups to sponsor content outside of search results.

Facebook went a step farther and actually did ban all news links within Australia or from Australian media on its services in February. Facebook backed down a week later when lawmakers agreed to amend the bill, which became law a few days later.

Critics have argued that the deals in Australia now mainly benefit major media empires, such as those owned by mogul Rupert Murdoch, and do not protect or promote the interests of smaller or independent outlets. During the Friday hearing in the House, some Representatives and witnesses worried the same would happen in the US under the proposed legislation.

The proposed bill “provides a temporary fix for a 48-month period,” Cicilline countered. “And in fact, anything these larger media companies would negotiate would be available to the smallest newspaper in any city or town in America.”

The bill currently under consideration in Congress also does not contain the arbitration provisions present in Australia’s law, which were the largest point of contention during negotiations in that country.

https://arstechnica.com/?p=1749284

Apple sued a former employee on Thursday, alleging that he leaked trade secrets to a reporter and sought favors from the reporter in exchange.

The lawsuit was filed against Simon Lancaster in US District Court for the Northern District of California. Lancaster spent 11 years at Apple before taking a job as head of consumer products at Arris Composites in late 2019. Lancaster was advanced materials lead and product design architect at Apple, where he “was instrumental in the development of the 13″/15″ MacBook Pro with the touch bar, and the design of unreleased Apple products,” an Arris Composites press release said at the time.

Apple’s lawsuit alleged:

Despite over a decade of employment at Apple, Lancaster abused his position and trust within the company to systematically disseminate Apple’s sensitive trade secret information in an effort to obtain personal benefits. He used his seniority to gain access to internal meetings and documents outside the scope of his job’s responsibilities containing Apple’s trade secrets, and he provided these trade secrets to his outside media correspondent. The Correspondent then published the stolen trade secrets in articles, citing a “source” at Apple. On multiple occasions, Lancaster proposed that the Correspondent give benefits to Lancaster in exchange for Apple’s trade secrets. For example, Lancaster proposed that the Correspondent provide favorable coverage of a startup company in which Lancaster was an investor as a quid pro quo. Lancaster even recruited the Correspondent to serve as his personal investigator. In one instance, Lancaster requested that the Correspondent explore a rumor that could prove harmful to a company in which Lancaster had invested.

Those last two sentences relate to an incident in spring 2019 in which Lancaster told the reporter of his “displeasure with Apple” due to “a story published that day that reported a rumor that Apple would produce a new hardware product,” the lawsuit said. “Shortly thereafter, Lancaster asked the Correspondent to investigate the substance of that story because ‘it could mean trouble for my [Lancaster’s] startup.’ The Correspondent replied, ‘I’ll see what I can find out.'”

Lancaster subsequently “communicated to a third party that the Correspondent had committed to publishing an article about Lancaster’s startup if it obtained $1 million in funding,” Apple said, alleging that “the Correspondent agreed to publish that article in exchange for Lancaster’s ongoing misappropriation of Apple trade secrets.” When he left Apple for Arris Composites, Lancaster asked the reporter to “write a story about a 12-year Apple Design Veteran leaving for an amazing startup,” Apple said. Whether those stories proposed by Lancaster were published is not made clear in the lawsuit.

We contacted Lancaster about the lawsuit and will update this article if we get a response. The reporter was not named in the lawsuit. Apple said the leaks included “unreleased Apple hardware products” but did not say which ones.

Apple trade secrets

Apple’s lawsuit alleged that Lancaster violated the federal Defend Trade Secrets Act and the California Uniform Trade Secret Act and breached a confidentiality and intellectual property agreement.

Apple alleged that Lancaster continued giving trade secrets to the reporter after he announced his resignation. “Lancaster’s role as the Correspondent’s ‘source’ deepened even after he announced his resignation from his role at Apple,” the lawsuit said. “Indeed, Apple’s internal investigation of the Apple-owned devices provided to Lancaster as part of his employment shows that after Lancaster announced his resignation, he communicated with the Correspondent regarding specific Apple trade secrets sought by the Correspondent and took specific steps to obtain additional Apple trade secrets.”

Apple is famously secretive about its plans for future products, but details are often reported in advance of announcements because of leaks to journalists.

“The trade secrets Lancaster stole and sent to the Correspondent for publication included details of unreleased Apple hardware products, unannounced feature changes to existing hardware products, and future product announcements, all of which Apple guards closely,” Apple said in the lawsuit. “Apple’s product teams—innovators, designers, and builders—work in complete secrecy, often for many years, and at significant personal burden, all to surprise and delight Apple’s customers with their creations. The deceitful and indefensible release of these product details enabled by Lancaster’s misappropriation has undermined the morale of the teams that worked on the products and features in question.”

Apple said that a “forensic review” of Lancaster’s work devices show that “Lancaster and the Correspondent coordinated to pilfer specific documents and product information from Apple. On numerous occasions, the Correspondent had requested Lancaster obtain specific Apple trade secret documents and information. On multiple occasions, Lancaster then sent the Correspondent certain of the requested confidential materials using Apple-owned devices. On other occasions, Lancaster met with the Correspondent in person to provide them with the requested confidential Apple information. The full extent of their conspiracy is presently unknown; however, Apple’s investigation is ongoing.”

Apple security measures

Apple said it “takes all reasonable steps to maintain the confidentiality” of its trade secrets, including physical security at buildings, monitoring of computer access, “requir[ing] all employees to execute strict confidentiality agreements,” and training employees on policies for treatment of confidential information. Apple said that Lancaster signed the company’s confidentiality and intellectual property agreement in May 2008.

Lancaster was granted access to confidential information because he had a “senior role” that involved “evaluating materials and prototyping innovations to enable future generations of products,” Apple said.

While Apple didn’t name Arris Composites directly in the lawsuit, the complaint said that Lancaster’s new employer has a vendor service agreement with Apple. “Portions of the trade secret information Lancaster misappropriated relate directly to his role at his new employer, and it is likely Lancaster’s misuse of Apple’s trade secrets continues to this day,” Apple alleged. “In fact, on his last day at Apple, Lancaster downloaded a substantial number of confidential Apple documents from Apple’s corporate network onto his personal computer that would benefit his new company.”

The vendor agreement with Apple includes a confidentiality agreement that Lancaster is subject to, Apple said. “Apple therefore seeks the return of any and all copies of its [trade secrets] and to ensure that Lancaster no longer possesses such data and information and an injunction against any use of that information,” the complaint said.

Arris Composites, founded in 2017, says it makes “carbon fiber composites that can be combined with other materials such as metals and even electronics.”

In addition to requesting an “injunction enjoining [Lancaster] from continuing to misappropriate Apple’s trade secret information,” Apple asked the court to make Lancaster pay damages, punitive damages, restitution, and attorneys’ fees and costs.

“Why I left Apple”

Lancaster wrote favorably of his time at Apple in a November 2019 post on LinkedIn titled “Why I left Apple and joined Arris Composites.” At Apple, “I was able to step up and help the engineering product design department take sketches off the drawing board and turn them into real products,” he wrote. “I fell in love with the magic of certain processes, like additive manufacturing and composites, and would stay on to become Apple’s advanced materials lead.”

Lancaster has a few dozen patents from his time at Apple. As Lancaster became an angel investor in startups, “I realized how much I missed the thrill of the unknown, the journey of exploration that many of these young founders were experiencing,” he wrote. Apple, by contrast, was a “well oiled machine” that “works so well it’s hard to justify changing it.” Lancaster wrote that Arris will “show that composites manufacturing is not just something for space shuttles, but can change the products we carry in our pockets and cherish on our desks.”

https://arstechnica.com/?p=1749184

Last week, Arizona’s House of Representatives approved legislation to prohibit platform owners like Apple and Google from locking app makers into their own payment systems. The bill passed only narrowly, and it must be approved by the Arizona Senate and Gov. Doug Ducey before it can become law. But regardless of the bill’s ultimate fate, the vote is the latest sign of a dramatic shift in public attitudes toward Silicon Valley’s most powerful companies.

For the first two decades of the Internet era, there was a broad consensus that politicians shouldn’t tie Silicon Valley companies down with burdensome rules and regulations. Companies like Apple, Amazon, Google, and Uber were widely admired. In 2007, presidential candidates from both parties made pilgrimages to associate themselves with Google. In 2015, Jeb Bush, Ted Cruz, and other Republican hopefuls tripped over each other to position themselves as the most Uber-friendly candidate.

Tech companies’ prestige bolstered their political power. Those who proposed regulations to rein in tech companies—or in some cases just wanted to subject them to the same rules as other companies—were often dismissed as out-of-touch reactionaries and enemies of progress.

But all that is changing. Products like YouTube, the iPhone, and ride-hailing apps have become banal parts of modern life. The companies behind them are widely considered entrenched incumbents. And so the public and their elected representatives increasingly treat them like other big, powerful companies. Politicians score points by railing against them. Proposals to rein them in sometimes poll well.

The next few years are going to be particularly challenging for companies like Apple, Google, Facebook, and Uber because they are global companies. They not only have to worry about antitrust lawsuits by the US federal government, they also face heavy scrutiny from US states and from foreign governments around the world. For the tech giants, there’s a danger that a policy experiment in one jurisdiction could become a precedent that’s copied around the world.

Scorched-earth tactics used to work for Uber and Lyft

Back in 2016, the city of Austin, Texas, wanted Uber and Lyft to fingerprint drivers—a rule that already applied to regular taxi drivers in the city. The idea was approved by 56 percent of the city’s voters. Uber and Lyft responded by going nuclear—shutting down their Austin operations until the city changed its rules.

Austin officials argued they were simply requiring Uber and Lyft to play by the same rules as other taxi providers. But many members of the public, especially customers of the services, bought into a different narrative: that Austin officials were out of touch and hostile to modern technology. Having a significant part of the public behind them gave Uber and Lyft a lot of power—power Uber and Lyft ultimately used to get the state legislature to override Austin’s rules.

This wasn’t a one-off victory. It’s a playbook the companies used over and over again in their early years. Uber and Lyft would frequently swoop into a new metropolitan area without worrying too much about local taxi regulations. Spending millions in venture capital, they’d try to build up a customer base as quickly as possible. City officials feared a backlash from these customers, and they didn’t want to be seen as standing in the way of progress. So they almost always relented.

Now Uber and Lyft are on the defensive

This strategy has become less effective in recent years. Partly that’s because activists have generated more negative press for these firms. Once the gusher of venture-funded subsidies dried up, driving for Uber or Lyft proved to be a low-paying and precarious gig. Critics have also highlighted the problem of sexual assaults occurring in Uber and Lyft vehicles—although it’s not clear if Uber and Lyft have a bigger problem here than traditional taxis.

But perhaps the most important shift is that Uber and Lyft are no longer seen as underdogs. In the early 2010s, these companies’ survival still seemed like an open question. Customers worried that incumbent taxi companies would use antiquated regulations to smother them in the cradle. So when Uber and Lyft argued that a particular regulation could force them to leave a city or state, customers believed them, and some lobbied their elected officials to back off.

Today this just isn’t a serious concern. Uber and Lyft are multibillion dollar companies operating in dozens of cities. Many jurisdictions have passed legislation explicitly allowing this type of service to operate.

As a result, the companies are finding it more and more difficult to beat back efforts to regulate their business practices. In 2019, California passed legislation requiring Uber and Lyft to treat their drivers as employees. As they’ve done in the past, Uber and Lyft threatened to shut down their services if voters didn’t overturn the law. Voters ultimately approved a ballot measure sponsored by Uber and Lyft. But Uber and Lyft were forced to make some tactical concessions; the voter-approved measures offered gig-economy drivers some added protections.

And things are going even worse for Uber outside the United States. Last month the Supreme Court of the United Kingdom ruled that Uber can’t treat its drivers like independent contractors. Courts in France and Spain have reached similar conclusions—though Uber seems to still be resisting a switch to an employee model in France.

Last year, Massachusetts filed a lawsuit against Uber and Lyft arguing that their drivers are employees under state law. A class-action lawsuit in Ontario makes a similar claim.

In each of these jurisdictions, a key Uber argument is that enforcing traditional labor law will break Uber’s on-demand business model. That argument is hard to evaluate, since Uber has mostly been successful in defeating these efforts. But Uber will very likely need to change how it does business in the UK, France, Spain, and probably other jurisdictions in the coming years.

If Uber manages to come up with a viable model that treats drivers as employees, it will face pressure to adopt the same model in other cities. Though, of course, the opposite is also possible: maybe a switch to an employee-based model will make Uber’s service dramatically worse in places like France and Spain, strengthening Uber’s case in future battles.

https://arstechnica.com/?p=1747386

The Microsoft Exchange vulnerabilities that allow hackers to take over Microsoft Exchange servers are under attack by no fewer than 10 advanced hacking groups, six of which began exploiting them before Microsoft released a patch, researchers reported Wednesday. That raises a vexing question: how did so many separate threat actors have working exploits before the security flaws became publicly known?

Researchers say that as many as 100,000 mail servers around the world have been compromised, with those for the European Banking Authority and Norwegian Parliament being disclosed in the past few days. Once attackers gain the ability to execute code on the servers, they install web shells, which are browser-based windows that provide a means for remotely issuing commands and executing code.

When Microsoft issued emergency patches on March 2, the company said the vulnerabilities were being exploited in limited and targeted attacks by a state-backed hacking group in China known as Hafnium. On Wednesday, ESET provided a starkly different assessment. Of the 10 groups ESET products have recorded exploiting vulnerable servers, six of those APTs—short for advanced persistent threat actors—began hijacking servers while the critical vulnerabilities were still unknown to Microsoft.

It’s not often that a so-called zero-day vulnerability is exploited by two groups in unison, but it happens. A zero-day under attack by six APTs simultaneously, on the other hand, is highly unusual, if not unprecedented.

“Our ongoing research shows that not only Hafnium has been using the recent RCE vulnerability in Exchange, but that multiple APTs have access to the exploit, and some even did so prior to the patch release,” ESET researchers Matthieu Faou, Mathieu Tartare, and Thomas Dupuy wrote in a Wednesday post. “It is still unclear how the distribution of the exploit happened, but it is inevitable that more and more threat actors, including ransomware operators, will have access to it sooner or later.”

Beyond unlikely

The mystery is compounded by this: within a day of Microsoft issuing the patches, at least three more APTs joined the fray. A day later, another one was added to the mix. While it’s possible that those four groups reverse-engineered the fixes, developed weaponized exploits, and deployed them at scale, those types of activities usually take time. A 24-hour window is on the short side.

There’s no clear explanation for the mass exploitation by so many different groups, leaving researchers few alternatives other than to speculate.

“It would seem that while the exploits were originally used by Hafnium, something made them share the exploit with other groups around the time the associated vulnerabilities were getting patched by Microsoft,” Costin Raiu, director of the Global Research and Analysis Team at Kaspersky Lab, told me. “This could suggest a certain degree of cooperation between these groups, or it may also suggest the exploits were available for sale in certain markets and the potential of them getting patched resulted in a drop of price, allowing others to acquire it as well.”

Juan Andres Guerrero-Saade, principal threat researcher at security firm SentinelOne, arrived at largely the same assessment.

“The idea that six groups coming from the same region would independently discover the same chain of vulnerabilities and develop the same exploit is beyond unlikely,” he wrote in a direct message. “The simpler explanation is that there’s (a) an exploit seller in common, (b) an unknown source (like a forum) available to all of these, or (c) a common entity that organizes these different hacking groups and provided them the exploit to ease their activities (say, China’s Ministry of State Security).”

Naming names

The six groups ESET identified exploiting the vulnerabilities when they were still zero-days are:

• Hafnium: The group, which Microsoft said is state sponsored and based in China, was exploiting the vulnerabilities by early January.
• Tick (also known as Bronze Butler and RedBaldKnight): On February 28, two days before Microsoft issued patches, this group used the vulnerabilities to compromise the web server of an East Asian IT services company. Tick has been active since 2018 and targets organizations mostly in Japan but also in South Korea, Russia, and Singapore.
• LuckyMouse (APT27 and Emissary Panda): On March 1, this cyber-espionage group known to have breached multiple government networks in Central Asia and the Middle East compromised the email server of a governmental entity in the Middle East.
• Calypso (with ties to Xpath): On March 1, this group compromised the email servers of governmental entities in the Middle East and South America. In the following days, it went on to target organizations in Africa, Asia, and Europe. Calypso targets governmental organizations in these regions.
• Websiic: On March 1, this APT, which ESET had never seen before, targeted mail servers belonging to seven Asian companies in the IT, telecommunications, and engineering sectors and one governmental body in Eastern Europe.
• Winnti (aka APT 41 and Barium): Just hours before Microsoft released the emergency patches on March 2, ESET data shows this group compromising the email servers of an oil company and a construction equipment company, both based in East Asia.

ESET said it saw four other groups exploiting the vulnerabilities in the days immediately following Microsoft’s release of the patch on March 2. Two unknown groups started the day after. Two other groups, known as Tonto and Mikroceen, began on March 3 and March 4, respectively.

China and beyond

Joe Slowik, senior security researcher at security firm DomainTools, published his own analysis on Wednesday and noted that three of the APTs that ESET saw exploiting the vulnerabilities ahead of the patches—Tick, Calypso, and Winnti—have previously been linked to hacking sponsored by the People’s Republic of China. Two other APTs that ESET saw exploiting the vulnerabilities a day after the patches—Tonto and Mikroceen—also have ties to the PRC, the researcher said.

Slowik produced the following timeline:

The timeline includes three exploitation clusters that security firm FireEye has said were exploiting the Exchange vulnerabilities since January. FireEye referred to the groups as UNC2639, UNC2640, and UNC2643 and didn’t tie the clusters to any known APTs or say where they were located.

Because different security firms use different names for the same threat actors, it’s not clear if the groups identified by FireEye overlap with those seen by ESET. If they were distinct, the number of threat actors exploiting the Exchange vulnerabilities prior to a patch would be even higher.

A range of organizations under siege

The tracking of the APTs came as the FBI and the Cybersecurity and Infrastructure Security Agency issued an advisory on Wednesday that said threat groups are exploiting organizations including local governments, academic institutions, non-governmental organizations, and business entities in a range of industries, including agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceutical.

“This targeting is consistent with previous targeting activity by Chinese cyber actors,” the advisory stated. With security firm Palo Alto Networks reporting on Tuesday that an estimated 125,000 Exchange servers worldwide were vulnerable, CISA and FBI officials’ call for organizations to patch took on an extra measure of urgency.

Both ESET and security firm Red Canary have seen exploited Exchange servers that were infected with DLTMiner, a piece of malware that allows attackers to mine cryptocurrency using the computing power and electricity of infected machines. ESET, however, said it wasn’t clear if the actors behind those infections had actually exploited the vulnerabilities or had simply taken over servers that had already been hacked by someone else.

With so many of the pre-patch exploits coming from groups tied to the Chinese government, the hypothesis from SentinalOne’s Guerrero-Saade—that a PRC entity provided the exploits to multiple hacking groups ahead of the patches—seems to be the simplest explanation. That theory is further supported by two other PRC-related groups—Tonto and Mikroceen—being among the first to exploit the vulnerabilities following Microsoft’s emergency release.

Of course, it’s possible that the half-dozen APTs that exploited the vulnerabilities while they were still zero-days independently discovered the vulnerabilities and developed weaponized exploits. If that’s the case, it’s likely a first, and hopefully a last.

https://arstechnica.com/?p=1748741

Twitter is suing Texas Attorney General Ken Paxton, alleging that a probe Paxton launched into its business is an act of retaliation against the platform’s choice to ban the account of former US President Donald Trump.

The suit (PDF) accuses Paxton of using his office to “intimidate, harass, and target Twitter in retaliation for Twitter’s exercise of its First Amendment rights.”

The conflict all goes back to the January 6 events at the US Capitol. At the height of the chaos, while a mob was actively storming the building, Trump took to Twitter to reiterate his false claims of electoral fraud and seemingly egg on the violence. In the following hours, Twitter deleted three tweets and suspended Trump’s account for 12 hours.

Less than a day after that 12-hour suspension expired, Trump was back on the platform, again seeming to encourage the insurrectionists. Twitter interpreted the new posts as further calls to violence, which are against the platform’s terms of service, and permanently banned Trump’s account. Twitter was far from alone: Twitch, Snapchat, and Facebook (including Instagram) also all suspended Trump “indefinitely” during the same period.

Paxton took issue with the bans. The following week, his office launched an investigation into Twitter and other tech firms. “The seemingly coordinated de-platforming of the President of the United States and several leading voices not only chills free speech, it wholly silences those whose speech and political beliefs do not align with leaders of Big Tech companies,” Paxton said at the time. “The public deserves the truth about how these companies moderate and possibly eliminate speech they disagree with.”

The company, however, basically contends that Paxton’s entire position is retaliatory hogwash. “AG Paxton has long disagreed with Twitter’s content moderation decisions and made that displeasure widely known,” the company said in the filing. Paxton is indeed just one of many Republican politicians and media figures who strenuously objects to content moderation that Twitter and other platforms perform.

“Twitter sought for weeks to reach an agreement with AG Paxton that would put reasonable limits on the scope of this demand, but to no avail,” the suit reads. “Instead, AG Paxton made clear that he will use the full weight of his office, including his expansive investigatory powers, to retaliate against Twitter for having made editorial decisions with which he disagrees. Now Twitter, already targeted because of its protected activity, is left with the untenable choice to turn over highly sensitive documents or else face legal sanction.”

Twitter also faces other pressure in Texas, where Gov. Greg Abbott recently promoted a state Senate bill that would severely curtail the ability of social media firms to moderate content. The bill (PDF) determines that social media platforms such as Twitter, Facebook, and YouTube are “akin to common carriers” and therefore should not be allowed to “block, ban, remove, deplatform, demonetize, de-boost, restrict, deny equal access or visibility to, or otherwise discriminate against” any viewpoint they find objectionable.

That bill seems incredibly likely to be challenged and probably overturned on First Amendment grounds should it become state law.

https://arstechnica.com/?p=1748520

Microsoft has patched a critical zero-day vulnerability that North Korean hackers were using to target security researchers with malware.

The in-the-wild attacks came to light in January in posts from Google and Microsoft. Hackers backed by the North Korean government, both posts said, spent weeks developing working relationships with security researchers. To win the researchers’ trust, the hackers created a research blog and Twitter personas who contacted researchers to ask if they wanted to collaborate on a project.

Eventually, the fake Twitter profiles asked the researchers to use Internet Explorer to open a webpage. Those who took the bait would find that their fully patched Windows 10 machine installed a malicious service and an in-memory backdoor that contacted a hacker-controlled server.

Microsoft on Tuesday patched the vulnerability. CVE-2021-26411, as the security flaw is tracked, is rated critical and requires only low-complexity attack code to exploit.

From rags to riches

Google said only that the people who reached out to the researchers worked for the North Korean government. Microsoft said they were part of Zinc, Microsoft’s name for a threat group that is better known as Lazarus. Over the past decade, Lazarus has transformed from a ragtag group of hackers to what can often be a formidable threat actor.

A United Nations report from 2019 reportedly estimated Lazarus and associated groups have generated $2 billion for the country’s weapons of mass destruction programs. Lazarus has also been tied to the Wannacry worm that shut down computers around the world, fileless Mac malware, malware that targets ATMs, and malicious Google Play apps that targeted defectors.

Besides using the watering-hole attack that exploited IE, the Lazarus hackers who targeted the researchers also sent targets a Visual Studio Project purportedly containing source code for a proof-of-concept exploit. Stashed inside the project was custom malware that contacted the attackers’ control server.

While Microsoft describes CVE-2021-26411 as an “Internet Explorer Memory Corruption Vulnerability,” Monday’s advisory says the vulnerability also affects Edge, a browser Microsoft built from scratch that’s considerably more secure than IE. The vulnerability retains its critical rating for Edge, but there are no reports that exploits have actively targeted users of that browser.

The patch came as part of Microsoft’s Update Tuesday. In all, Microsoft issued 89 patches. Besides the IE vulnerability, a separate escalation privilege flaw in the Win32k component is also under active exploit. Patches will install automatically over the next day or two. Those who want the updates immediately should go to Start > settings (the gear icon) > Update & Security > Windows Update.

https://arstechnica.com/?p=1748406

T-Mobile next month will start a new program that gives customers’ web-browsing and device-usage data to advertisers unless customers opt out of the data sharing.

“[S]tarting April 26, 2021, T‑Mobile will begin a new program that uses some data we have about you, including information we learn from your web and device usage data (like the apps installed on your device) and interactions with our products and services for our own and 3rd party advertising, unless you tell us not to,” T-Mobile said in a privacy notice. “When we share this information with third parties, it is not tied to your name or information that directly identifies you.”

For directions on how to opt out of the expanded data sharing, see the first section of the T-Mobile privacy notice. There’s also an opt-out link here.

T-Mobile, which completed its purchase of Sprint in April 2020, said that the new advertising “program changes the way Sprint offered choices for sharing in the past, as this data was previously used only if you indicated that it was OK with you first.”

It’s not clear exactly how big a change this is for non-Sprint customers of T-Mobile. An August 2020 version of the privacy policy said that T-Mobile collects “websites and URLs visited” but did not list smartphone customers’ web-browsing data in the list of information shared with third parties. However, that August 2020 version said that T-Mobile sold “device identifiers and Internet and electronic network activity to facilitate certain advertising activities commonly deployed by online and technology companies.” A similar disclosure was in T-Mobile’s privacy policy before the Sprint acquisition as well.

T-Mobile says in another webpage describing its advertising and analytics program that it collects “addresses of websites visited; types of websites visited, like sports sites, music sites, etc.; applications, content, and features used—including how much time you spent using them, and information from servers that host these apps, content, and features.”

Advertising IDs used instead of customer names

In order to anonymize data before it’s sold to third parties, T-Mobile said that it ties the information “to your mobile advertising identifier or another unique identifier” instead of the customer’s name. But you’ll have to take T-Mobile’s word on just how anonymous the anonymized data actually is. “[P]rivacy groups say those IDs can be linked back to people by comparing different data sets,” The Wall Street Journal noted in an article on the T-Mobile changes today.

“It’s hard to say with a straight face, ‘We’re not going to share your name with it,'” Electronic Frontier Foundation lawyer Aaron Mackey told the Journal. “This type of data is very personal and revealing, and it’s trivial to link that de-identified info back to you.”

Before the merger with T-Mobile, “Sprint had previously shared similar data only from customers who opted into its third-party ad program,” the Journal wrote. “We’ve heard many say they prefer more relevant ads so we’re defaulting to this [opt-out] setting,” a T-Mobile spokesperson told the Journal.

We asked T-Mobile several questions about the data-sharing changes and for details on how exactly it ensures that data can’t be linked to individual customers, and we’ll update this article if we get a response.

Update at 9:37 pm ET: In response to our question about what data is being shared, a T-Mobile spokesperson told us, “We only share Advertising IDs, which are pooled to create audience segments based on customer interests, like sports or entertainment. We do not share underlying customer broadband or device usage data with third parties.”

However, T-Mobile’s privacy policy indicates that each “Advertising ID” is tied to one device. T-Mobile didn’t provide much of an explanation on how it makes sure each Advertising ID cannot be tied to an individual customer, saying only that “we do not utilize information for advertising that directly identifies customers, like name, address, email or precise location information.”

T-Mobile did not answer our question about whether it was already giving third-party companies access to the web and device usage data of its non-Sprint customers. As mentioned earlier in this article, T-Mobile’s privacy notice seems to indicate that the new data-sharing program is a bigger change for Sprint customers than for T-Mobile customers, but the notice is vague enough that it’s possible the change is about the same for both sets of customers.

AT&T and Verizon data-sharing doesn’t go as far

The Journal article said that T-Mobile is being more aggressive in sharing individual customers’ Internet usage data with advertisers than AT&T and Verizon:

AT&T automatically enrolls wireless subscribers in a basic ad program that pools them into groups based on inferred interests, such as sports or buying a car. An enhanced version of the program shares more-detailed personal information with partners from customers who opt into it.

Verizon likewise pools subscriber data before sharing inferences about them with advertisers, with a more-detailed sharing program called Verizon Selects for users who enroll. Its separate Verizon Media division shares data gathered through its Yahoo and AOL brands.

AT&T says on this webpage that it doesn’t “share information about your individual web browsing or TV viewing” in its “relevant advertising” system but offers an “enhanced relevant advertising” system that shares additional information only with customers’ “prior explicit consent.”

Verizon says on a relevant mobile advertising FAQ that “Information Verizon Wireless has about web activity from your mobile device is not used in the program.” The program does use “mobile and online web browsing information” collected by Verizon’s Yahoo and AOL subsidiaries, but this apparently wouldn’t cover browsing to non-Verizon websites. Customers can opt out of this targeted advertising program.

In 2016, Verizon agreed to pay a $1.35 million fine and give users more control over “supercookies” that identify customers in order to deliver targeted ads. Verizon’s previous use of the supercookies without properly notifying users violated an FCC rule that required Internet providers to disclose accurate information about network management practices to consumers.

Carriers sold location data without consent

T-Mobile and the other major carriers were previously caught selling their customers’ real-time location data to third-party data brokers without customer consent, violating a law banning sales of phone-location data. The Federal Communications Commission in February 2020 proposed a fine of $91 million for T-Mobile, the biggest for any of the major carriers, but T-Mobile said it would fight the penalty.

The Obama-era FCC tried to require home-Internet and mobile broadband providers to get consumers’ opt-in consent before using, sharing, or selling web-browsing and app-usage histories, but a Republican-controlled Congress and then-President Trump killed the rule in 2017 before it took effect.

https://arstechnica.com/?p=1748388

A new report alleges that Google employees who report experiencing gender or racial harassment or discrimination routinely are told to take “medical leave” and seek mental health treatment—only to be shoved aside when they try to come back.

Nearly a dozen current and former Google employees told NBC News that company HR officials told them to seek mental health treatment or take medical leave “after colleagues made comments about their skin color or Black hairstyles, or asked if they were sexually interested in their teammates.” Another dozen current and former Google employees told NBC the practice is common within the company.

“I can think of 10 people that I know of in the last year that have gone on mental health leave because of the way they were treated,” one former Google employee told NBC News. He himself had taken medical leave “after he said he had numerous unproductive conversations with human resources about how his colleagues discussed race.”

Those breaks mostly served to push people out of the organization, either quickly or slowly, sources said. Multiple employees told NBC that when they returned from a recommended leave, they found themselves assigned to new managers or new parts of the company. Those changes, in turn, suppressed positive performance reviews, due to lack of time to build up new relationships and work histories, and so those employees did not receive promotions or raises when they otherwise could have.

Another employee told NBC that after they experienced racism at Google, they took HR up on the offer to take medical leave and move to a different position when they came back. Upon return, however, the employee was turned down from every single internal role they applied for, so they were forced to leave Google.

Google spokesperson Jennifer Rodstrom told NBC the company has “a well-defined process for how employees can raise concerns and we work to be extremely transparent about how we handle complaints,” adding that “[a]ll concerns reported to us are investigated rigorously, and we take firm action against employees who violate our policies.”

Minority reports

Women, especially Black and Latina women, are drastically underrepresented at Google, according to the company’s own data.

Google’s 2020 diversity report (PDF) found that Google employees overall were 51.7 percent white and 41.9 percent Asian. Black workers represented only 3.7 percent of the company’s 2020 workforce, and Hispanic workers were 5.9 percent. (Less than 1 percent of Google employees were Native American.)

The picture grows even more stark broken down on gender lines. Globally, 68 percent of Google employees are men and 32 percent are women. Only 2 percent of all Google employees are Latina women, and 1.6 percent are Black women, according to the report. The numbers are worse when it comes to leadership positions within the company, about 66 percent of which are held by white employees.

Google’s diversity report also focuses on inclusion, in addition to diversity, which helps companies retain employees who feel a sense of belonging and support rather than a sense of tokenism or being singled out. Recent events and reports, however, cast doubt on the effectiveness of those efforts.

In particular, the December departure of well-known AI ethics head Timnit Gebru thrust Google’s inclusivity efforts into the spotlight. Google said Gebru resigned, but Gebru (who is Black) said Google pushed her out, describing a pervasive attitude inside the company to silence marginalized voices, including women and people of color.

Gebru said that she, too, was told to go seek mental health treatment when she reported issues to her managers about how women were treated inside Google. “And I would respond that no amount of support system is going to get rid of Google’s hostile work environment,” Gebru told NBC.

Google has in recent years faced several suits related to its handling of sexual harassment and racial discrimination in the workplace. A trio of former Google employees sued in 2017, alleging that women inside the company were systematically pushed into lower-paying jobs. A 2018 lawsuit accused Google of fostering a “bro culture,” with retaliation against women who complained about experiencing sexual harassment on the job.

Thousands of employees staged a walkout in 2018 to protest Google’s handling of sexual harassment allegations in the wake of reports that found three senior executives received multimillion-dollar payouts to leave the company after they were credibly accused of misconduct. Shareholders sued Alphabet, Google’s parent company, in the wake of those allegations; Google settled that suit in 2020.

Earlier this year, Google also agreed to settle with federal regulators over allegations that it systematically underpaid women software engineers and unfairly passed over women and Asian candidates for software engineering roles.

https://arstechnica.com/?p=1747883