The former owner of a computer repair shop in Delaware is suing Twitter for defamation, alleging that the platform’s choice to moderate a New York Post story that cited him as a source is tantamount to labeling him personally a “hacker.”

Twitter’s “actions and statements had the specific intent to communicate to the world” that John Paul Mac Isaac “is a hacker,” the suit (PDF) alleges, eventually forcing him to shut down his Delaware business. Mac Isaac is seeking $500 million in punitive damages from the suit, as well as whatever “further relief” the court deems appropriate.

The alleged defamation ties to a specific October episode in a fall that was, frankly, full of strange episodes. On October 14, the New York Post ran a story alleging that President-Elect Joe Biden’s son, Hunter Biden, had connected his father with Ukrainian energy firm Burisma in 2014. These allegations were based on emails the Post said it got from Trump attorney and former New York mayor Rudy Giliani, who in turn allegedly obtained them from a laptop that Biden’s son Hunter dropped off at Mac Isaac’s computer repair shop in 2019.

In the suit, Mac Isaac says between July 2019 and October 2020 he spoke several times with the FBI and Robert Costello, an attorney for Giuliani, about Biden’s hard drive. Mac Isaac was not aware the New York Post had any information about the hard drive or that the paper was going to publish a story about its contents, he claims, and he did not give Giuliani, Costello, or the Post “authorization” to release his name.

The Post story immediately raised a series of red flags for disinformation experts, and in the heated pre-election environment both Facebook and Twitter took relatively quick action to slow down the spread of the story. Facebook deprecated links to the story in users’ newsfeeds; a spokesman at the time said, “I want [to] be clear that this story is eligible to be fact checked by Facebook’s third-party fact checking partners. In the meantime, we are reducing its distribution on our platform.”

Twitter’s first approach was likewise to deprecate links to the story, so they wouldn’t bubble to the top in algorithmically-managed timelines. By the time a few hours had passed, however, Twitter went one step further and outright prohibited links to the story from appearing on its platform, either in users’ regular timeline or in direct messages.

By way of explanation, Twitter representatives pointed media to the platform’s hacked materials policy, which prohibits sharing links to or images of hacked content. The company, as you might assume, faced widespread criticism for this choice—especially, though not exclusively, from conservative politicians and commentators.

Within the next day, Twitter CEO Jack Dorsey apologized for Twitter’s move, saying that “straight blocking of URLs was wrong.” Twitter updated its hacked materials policy around the same time, saying it will “no longer remove hacked content unless it is directly shared by hackers or those acting in concert with them.” Stories about or citing hacked content are fine to post under that policy, as long as they do not violate any additional Twitter rules such as the sharing of personal private information.

By blocking the story under the “hacked materials” policy, Mac Isaac claims, Twitter acted with “malicious intent” to harm him, as it implies he hacked the laptop to gain access to the files. “The information obtained from the computer does not hacked materials [sic], because [Mac Isaac] lawfully gained access to the computer,” the suit says, “first with the permission of its owner, and then, after Biden failed to retrieve the hard drive despite [Mac Isaac’s] requests, in accordance with the Mac Shop’s abandoned property policy.”

https://arstechnica.com/?p=1732245

After months of uncertainty, corporations and hobbyists alike finally have a set of drone guidelines from the Federal Aviation Administration. The final rules are a step back from some proposed restrictions, as they will allow flights over crowds and some nighttime operations. But all drones weighing over 0.25kg (0.55lb) will need to have a unique Remote ID, as will smaller drones that are flown over crowds.

One proposal that didn’t make the final cut would have required Remote ID to connect over the Internet to a location-tracking database so drone operations could be monitored in real time by the FAA (and law enforcement). The FAA believes that Remote ID, which will locally transmit the location of both drone and “control stations,” meets the needs of national security and law enforcement.

“These final rules carefully address safety, security and privacy concerns while advancing opportunities for innovation and utilization of drone technology,” said US Secretary of Transportation Elaine L. Chao in a press release.

Remote ID is a must for all drones over the half-pound weight limit. Obviously, there are a large number of hobbyist drones in operation that lack Remote ID capability. To get around this, the FAA says that such drones should be affixed with a “Remote ID broadcast module” that would broadcast the relevant information. The only other alternative is to fly a drone solely at specific “FAA-recognized identification areas.”

The FAA has created four categories [PDF] for drones. Category 1 is for drones under the weight limit that are not covered by this rule-making. Categories 2 and 3 are essentially defined by the amount of injury they could cause in a crash, while Category 4 is for drones that need an airworthiness certificate. Category 1-3 drones are permitted to operate over people, but not continuously fly above moving vehicles.

Drones operating under the cover of darkness will need navigation lights viewable from three miles away. Those wishing to fly at night will need to pass a test first.

Both UPS and Amazon have received federal approval for limited drone deliveries, and the new rules are seen as a positive for them and other companies looking to commercialize delivery by drone.

The new rules will take effect 60 days after publication in the Federal Register. Once published, drone manufacturers have an 18-month window in which to begin building drones with Remote ID baked in. One year after that window closes, all drone operators will need to be flying drones that broadcast their Remote ID.

https://arstechnica.com/?p=1732256

Michael Williams’ every move was being tracked without his knowledge—even before the fire. In August, Williams, an associate of R&B star and alleged rapist R. Kelly, allegedly used explosives to destroy a potential witness’s car. When police arrested Williams, the evidence cited in a Justice Department affidavit was drawn largely from his smartphone and online behavior: text messages to the victim, cell phone records, and his search history.

The investigators served Google a “keyword warrant,” asking the company to provide information on any user who had searched for the victim’s address around the time of the arson. Police narrowed the search, identified Williams, then filed another search warrant for two Google accounts linked to him. They found other searches: the “detonation properties” of diesel fuel, a list of countries that do not have extradition agreements with the US, and YouTube videos of R. Kelly’s alleged victims speaking to the press. Williams has pleaded not guilty.

Data collected for one purpose can always be used for another. Search history data, for example, is collected to refine recommendation algorithms or build online profiles, not to catch criminals. Usually. Smart devices like speakers, TVs, and wearables keep such precise details of our lives that they’ve been used both as incriminating and exonerating evidence in murder cases. Speakers don’t have to overhear crimes or confessions to be useful to investigators. They keep time-stamped logs of all requests, alongside details of their location and identity. Investigators can access these logs and use them to verify a suspect’s whereabouts or even catch them in a lie.

It isn’t just speakers or wearables. In a year where some in Big Tech pledged support for the activists demanding police reform, they still sold devices and furnished apps that allow government access to far more intimate data from far more people than traditional warrants and police methods would allow.

A November report in Vice found that users of the popular Muslim Pro app may have had data on their whereabouts sold to government agencies. Any number of apps ask for location data, for say, the weather or to track your exercise habits. The Vice report found that X-Mode, a data broker, collected Muslim Pro users’ data for the purpose of prayer reminders, then sold it to others, including federal agencies. Both Apple and Google banned developers from transferring data to X-Mode, but it’s already collected the data from millions of users.

The problem isn’t just any individual app, but an over-complicated, under-scrutinized system of data collection. In December, Apple began requiring developers to disclose key details about privacy policies in a “nutritional label” for apps. Users “consent” to most forms of data collection when they click “Agree” after downloading an app, but privacy policies are notoriously incomprehensible, and people often don’t know what they’re agreeing to.

An easy-to-read summary like Apple’s nutrition label is useful, but not even developers know where the data their apps collect will eventually end up. (Many developers contacted by Vice admitted they didn’t even know X-Mode accessed user data.)

The pipeline between commercial and state surveillance is widening as we adopt more always-on devices and serious privacy concerns are dismissed with a click of “I Agree.” The nationwide debate on policing and racial equity this summer brought that quiet cooperation into stark relief. Despite lagging diversity numbers, indifference to white nationalism, and mistreatment of nonwhite employees, several tech companies raced to offer public support for Black Lives Matter and reconsider their ties to law enforcement.

Amazon, which committed millions to racial equity groups this summer, promised to pause (but not stop) sales of facial-recognition technology to police after defending the practice for years. But the company also noted an increase in police requests for user data, including the internal logs kept by its smart speakers.

Google’s support for racial equity included donations and doodles, but law enforcement agencies increasingly rely on “geofence warrants.” In these cases, police request data from Google or another tech company on all the devices in the area near an alleged crime around the time it occurred. Google returns an anonymized list of users, which police narrow down, then send a subsequent request for data on suspects.

As with keyword warrants, police get anonymized data on a large group of people for whom no tailored warrant has been filed. Between 2017 and 2018, Google reported a 1,500 percent increase in geofence requests. Apple, Uber, and Snapchat also have received similar requests for the data of a large group of anonymous users.

Civil rights organizations have called on Google to disclose how often it fulfills these geofence and keyword requests. A magistrate judge in a Chicago case said the practice “ensures an overbroad scope” and questioned whether it violates Fourth Amendment protections against invasive searches. Similarly, a forensic expert who specializes in extracting data from IoT devices like speakers and wearables questioned whether it was possible to tailor a search. For example, while investigating data from a smart speaker, data might link to a laptop, then to a smartphone, then to a smart TV. Connecting these devices is marketed as a convenience for consumers, but it also has consequences for law enforcement access to data.

These warrants allow police to rapidly accelerate their ability to access our private information. In some cases, the way apps collect data on us turns them into surveillance tools that rival what police could collect even if they were bound to traditional warrants.

The solution isn’t simply for people to stop buying IoT devices or for tech companies to stop sharing data with the government. But “equity” demands that users be aware of the digital bread crumbs they leave behind as they use electronic devices and how state agents capitalize on both obscure systems of data collection and our own ignorance.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1732186

The House of Representatives has voted to override Donald Trump’s veto of the National Defense Authorization Act (NDAA) by a vote of 322 to 87 votes—easily exceeding the required two-thirds vote. The measure now goes to the Senate, where it must also pass by a two-to-one margin to overcome Trump’s opposition.

Every year, Congress passes the NDAA to fund the military—this year’s bill provides $740 billion for the Pentagon. Thanks to broad public support for the military, the NDAA is widely seen as a “must pass” measure. This makes it a tempting vehicle for attaching unrelated proposals that might not otherwise win Congressional approval.

In recent months, Donald Trump has been calling for Congress, the Federal Communications Commission, and other government agencies to modify or repeal Section 230 of the Communications Decency Act, a 1996 law that shields websites from liability for content uploaded by their users. Trump sees repeal of Section 230 as a way to retaliate against Facebook and Twitter for their perceived bias against him. But so far, Trump’s campaign against Section 230 has not gotten traction.

So in a desperate move, Trump began threatening to veto the NDAA unless Congress adding language repealing Section 230. Congressional leaders didn’t take the threat very seriously, since Section 230 has nothing to do with national defense and repealing it would be a drastic step. But after Congress passed the NDAA without a Section 230 provision, Trump followed through on his threat.

Trump has vetoed a handful of other bills during his presidency. Until now Congress has never overridden his vetoes because Republicans had remained loyal to him. But Trump’s lame duck status means he now has rapidly declining clout with Republicans in Congress.

Unsurprisingly, Democrats overwhelmingly voted to override Trump’s vote, with 212 in favor and only 20 against. But more surprisingly, Republicans strongly supported the override too: 109 in favor and just 66 against.

That bodes well for the Senate’s chances of overriding Trump’s veto when it takes up the issue on Tuesday. If a majority of Senate Republicans and almost every Democrat votes to override Trump’s veto, the measure should pass easily.

The Senate previously passed the bill in an 84-13 vote. So if most of the bill’s previous supporters vote to override, the NDAA will become law despite Trump’s veto.

https://arstechnica.com/?p=1732230

Reddit alternative Voat shut down on Christmas Day, citing a lack of operational funding, and casting doubt on the abilities of other similar almost-anything-goes, “free speech” platforms to stay online in the long run.

“I just can’t keep it up,” Voat cofounder Justin Chastain said in the shutdown announcement. Investment dried up in March 2020, he explained. “I personally decided to keep Voat up until after the U.S. election of 2020. I’ve been paying the costs out of pocket but now I’m out of money.”

Voat first launched in 2014 as a smaller Reddit alternative dedicated to “free speech,” including explicit hate speech, extreme right-wing content, racism, and other content limited or prohibited on other sites. It gained traction in 2015, when Reddit finally banned several explicitly racist subreddits from its platform in a bid to limit harassment, and some discontented Reddit users decided to migrate over.

In the middle of 2015, Voat’s web host, Host Europe, suspended service to the platform, saying, “we will not tolerate any form of illegal right-wing extremist content and we explicitly distance ourselves from this.” (Host Europe is based in Germany, which has stronger hate speech laws than the US.)

PayPal also suspended Voat’s account in 2015, amid allegations the platform was hosting sexually explicit images of minors. Voat removed several forums in the wake of the suspension, including the ones dedicated to “jailbait,” and switched to accepting donations in digital currencies such as bitcoin.

By 2020, another wave of users booted off other platforms had migrated to Voat: QAnon adherents. The QAnon conspiracy is linked to several incidents of real-world violence. Reddit banned several Q-linked communities in 2018, and Twitter, Facebook, and YouTube followed suit in 2020.

Several other so-called “free speech” platforms have also launched in the past few years, as mainstream social media companies try to keep the worst of the hate speech and violent threats they can catch off their own sites. These efforts, so far, have been mixed. Gab, for example, launched in 2016 only to become an immediate haven for neo-Nazis and anti-Semites, including the shooter who committed mass murder at a Pittsburgh synagogue in 2018. Apple and Google both kicked Gab out of their respective mobile app stores; Gab now uses Mastodon as a platform, allowing it to have a mobile presence.

More recently, Parler has entered the fray. Where Voat and Gab were perhaps designed to be less partisan but more extremist, Parler is not necessarily extremist but skews heavily partisan, drawing mostly conservative and right-wing users based on false claims that other social media sites “censor” conservative views for political reasons. The site soared in popularity over the summer and into the fall but engagement largely dropped off in the wake of the November election.

https://arstechnica.com/?p=1732147

On a warm April morning in 2007, one of the world’s most notorious spammers walked through the doors of the Lloyd D. George Federal Courthouse in Las Vegas. Though the Federal Trade Commission was attempting to collect a $4 million judgment against him, Sanford “Spamford” Wallace showed up to his sworn deposition without a lawyer—and without any of the documents required of him.

Wallace, though nominally cooperative, had been nearly impossible to reach. When attorneys from the social network MySpace had sued him weeks before, the process server tasked with delivering legal documents couldn’t make contact with Wallace and eventually went to the OPM Nightclub where Wallace worked weekends as a $400-a-week disc jockey under the name “DJ MasterWeb.” The process server claimed to have approached Wallace at the club before being intercepted by security guards; the lawsuit papers were literally thrown at Wallace in an attempt to get good service on him.

FTC lawyer David Frankel, who was overseeing Wallace courthouse questioning as part of a separate spam case brought by the government, had resorted to telephone calls, FedEx packages, and e-mails to contact Wallace; he even sent a personal messenger on occasion. Despite the extraordinary measures, Frankel didn’t know when he showed up to court that April morning whether Wallace would actually arrive.

Wallace did arrive. After swearing to tell the truth in his testimony, he explained to Frankel that the problems weren’t the result of malice but were instead caused by utter disorganization. “Let me just state, for the record, that I am chronically disorganized, and that’s one of the reasons it’s so difficult to communicate with me, and some of the things that would appear to the normal person to be uncooperative, it’s actually possible and very often related to the fact that I’m a very disorganized person,” he said at the beginning of his testimony. “I think you’ll see that as we continue this conversation that as a lot of documents haven’t been filed or organized in a very efficient manner by myself, I want to just state for the record that that is something that I could probably have a psychiatrist to verify if I had to.”

“A business that worked”

Yet Wallace had been organized enough to become a massive spammer. Born in 1968, he attended high school in Maplewood, New Jersey, but realized the academic world wasn’t for him. He tried attending college twice, first at SUNY-Buffalo and then at New Jersey’s Ramapo College; he didn’t last a semester at either. He later described himself as “not a good student.”

That didn’t stop him from finding monetary success—and public notoriety—during the mid-1990s with his Pennsylvania company Cyber Promotions. As a heavyset twentysomething with close-cropped hair and glasses, Wallace first spammed fax machines and then moved on to e-mail, believing that he had a legal right to market his wares as he saw fit. Dubbed “Spamford” by opponents, he eventually embraced the nickname and even registered the domain spamford.com. (In 1997, Hormel sent him a letter objecting to the name on the grounds that it used the company’s potted meat SPAM trademark). Unlike other spammers who hid their identities, Wallace regularly tangled in public with antispam crusaders.

Cyber Promotions quickly became so hated that a dozen Internet service providers, including AOL, sued Wallace in the late 1990s, each hoping to halt his flood of junk e-mail despite the lack of antispam laws at the time. Wallace pressed on, but the lawsuits did cramp his business. He settled several of them by agreeing not to spam the particular network at issue, which gradually whittled down the list of places he could send spam without getting into more trouble.

Antispam vigilantes were also after him and his company. They hacked his website, replacing its homepage, and went after the Michigan Internet provider that served Cyber Promotions. As recounted in the 2004 book Spam Kings by Brian McWilliams, Wallace was angry enough about the hacking to offer a $15,000 reward and claimed he was alerting the FBI.

By 1998, the pressure was so intense that Wallace had trouble finding an Internet provider to offer service to his company. In January, a local Philadelphia paper reported that Wallace had returned to his roots in junk faxing despite the fact that federal law now prohibited the practice. Local residents were furious; one managed to get Cyber Promotions delisted from the Better Business Bureau.

In April 1998, Wallace publicly announced his “retirement” from spamming. After several more failed ventures and a failed marriage, he moved to New Hampshire and in January 2002 bought a nightclub called Plum Crazy from Walter Rines, a former spam partner. The club, just outside of Rochester, proved popular; few visitors knew that club owner DJ MasterWeb had such a colorful past.

When Wired magazine visited Plum Crazy in 2003, Wallace appeared to be a changed man. Those lawsuits from Internet providers hadn’t killed his business; “they put me into business—a business that worked,” he said at the time. Even top antispam lawyers were pleased to see the change of heart. The Wired story included a line that at the time seemed perfectly sane: “I think the world of Sanford,” it quoted Pete Wellborn, an Atlanta attorney who won a $2 million judgment against Wallace on behalf of EarthLink in 1998. “He really is a man of his word, unlike the spammers we see now who are either ignorant or common criminals.”

The power of friends

But Wallace soon needed money. Plum Crazy went bankrupt; Wallace sold his house and moved to Las Vegas. He revived an older business of his called SmartBot and soon began a scheme in which he infected computers with spyware that then popped up messages selling an “antispyware program” to clean the infection. This finally moved the feds to action. The Federal Trade Commission (FTC) filed suit against Wallace in 2004 to halt his SpamBot practices. FTC lawyers worked the case for two years and in March 2006 obtained a default judgment of $4 million when Wallace didn’t show up in court to contest the charges.

In October of that year, Wallace’s friend Rines was also hit with an injunction in an online marketing case. While this might have seemed like a good time for each man to lie low, the pair instead partnered again. They were soon at work on a new plan to make money marketing through the newly hot social networks. (The two “wasted little time in violating the Court’s Order” is how FTC lawyers later put it.) Their plan targeted the hugely popular MySpace site with the ultimate goal of directing MySpace users to websites advertising such things as ring tones and adult dating services.

Few people would click such low-quality links if they were clearly presented as ads. The beauty of the Wallace/Rines approach was that because their links appeared as messages from a MySpace user’s actual friends rather than as ads, clickthrough rates were high—as were profits. The FTC estimated that the scheme raked in at least $555,850.04 (the actual tally was probably higher).

The project showed real, if devious, creativity. In order to access people’s MySpace accounts, Wallace and Rines devised a plan to get people to hand over their account information. No subject was off-limits. Could the resurrection of Jesus somehow be used to generate money from sex sites? Yes, it could. In one memorable exploit, the pair used MySpace accounts they had created to send 392,726 unsolicited messages pitching Easter e-cards to other MySpace users. When the recipients clicked the link to view the online card, they were asked if they would like to “forward” the card to their own friends. They did so by entering their MySpace password and username into a form that looked a lot like the actual MySpace log-in page; Wallace and Rines would then add the accounts to their database. Later, they would log into these accounts and spam links to people’s friends, advertising whatever websites were willing to pay them. Visitors to the Easter e-card site who tried to leave the page without divulging their MySpace credentials were simply redirected to the advertising sites.

Even for a network the size of MySpace, which had 50 million registered users in early 2006, Wallace quickly became a serious problem. As the technical side of the operation, he used automated tools to log in to more than 300,000 MySpace accounts and send more than 890,000 messages with links. The MySpace abuse team received more than 800 complaints about this behavior. In early 2007, the company filed a lawsuit against Wallace, and the FTC soon went after both men for violating the injunctions against more spamming. But Wallace defended his actions.

During his deposition with Frankel, the FTC lawyer, Wallace insisted that the messages he sent to other MySpace users weren’t “unsolicited” at all. This was the beauty of sending links from one MySpace user to the user’s friends. “A message between two friends is not defined as ‘unsolicited’ by several standards,” Wallace said. “If I call you up tomorrow and ask you if you’d like me to send you a document, is that an unsolicited phone call, or do we have an existing relationship?”

Besides, this wasn’t e-mail in the traditional technical sense, he said. “It’s not something coming from a stranger with a fake return address like the CAN-SPAM act is apparently trying to address… “This is friend to friend communication, and we don’t evade any type of friend to friend blocking techniques. We don’t trick in any way. We don’t trick people into getting messages from their friends. It’s based solely on their friend’s action [in giving log-in information to Wallace].” Wallace insisted that he had found a novel, legal way to market websites. “I’ve just been working with [Rines] on MySpace-related activities, advertising and Internet traffic and things of that sort, nothing in violation of your order,” he said.

Frankel let it go and turned to the question of the money. Why hadn’t Wallace paid the millions he owed the FTC? After all, Wallace had pulled in more than $4 million from SmartBot alone and was earning hundreds of thousands from his work on MySpace. Wallace insisted he was in debt, that he no longer had a credit card because “I basically could not pay off some of my credit card bills,” and that he had made big payments to six casinos for gambling debts—including $350,000 to the MGM Grand Mirage. But beyond that, he was maddeningly vague.

He said he could not recall the amounts he had paid to other casinos. He claimed to have no real idea of the total income he had made over the years. And he could not explain what had happened to all of his money:

Q. [Frankel] Well, here’s the kicker with all that. What happened to all this money? What happened to the $4 million plus, where is it today?

A. [Wallace] Most of it was spent, I had debts and all this has to be—all this has to be reconciled through the use of this bank account which I would like to get cleared and taken care of with you, so that you can see exactly where the monies went. It’s all pretty much a pretty obvious story if you look at the bank.

Q. What’s your—give me the general answer. What happened to the money? Right now you’re saying you have to show me documents, but where did the money go? Where is it? It’s a lot of money.

A. Yeah. I mean I had a lot of debt, and honestly I don’t know exactly where the money went. I would have to look at my bank account with you, and I’m not evading your question. I just don’t know how to give a general answer to that. And monies went out and came in for three years.

Q. I’m not a rich guy, but if I had $4 million and I have nothing now, I would have at least some sense as to where the money went.

A. I had over a million dollars in casino debts.

Q. Okay. Grant that. Now, where did the other $3 million go?

A. Again, this is a very impossible question for me to answer without having actual paperwork in front of me to go over specific itemization of what happened to the money and what didn’t happen to the money.

Although he claimed that he currently had only $20,000 in a checking account, Wallace drove a $30,000 car with only 1,500 miles on it, had a $1,100-a-month apartment, and had just purchased a $1,400 watch. How did he afford it all, Frankel asked, on his $400-a-week DJ income? “I could not afford my rent if I did not have the other business,” Wallace admitted, referring to his MySpace activities. When the money got tight, he went back to what he knew.

Frankel was resigned. “I’m trying to help you reform,” he said, as the day of sparring drew to a close, “which is probably not going to happen, but I’m trying.”

https://arstechnica.com/?p=388451

2020 was a tough year for a lot of reasons, not least of which were breaches and hacks that visited pain on end users, customers, and the organizations that were targeted. The ransomware menace dominated headlines, with an endless stream of compromises hitting schools, governments, and private companies as criminals demanded ransoms in the millions of dollars. There was a steady stream of data breaches as well. Several mass account takeovers made appearances, too.

What follows are some of the highlights. For good measure, we’re also throwing in a couple notable hacks that, while not actively used in the wild, were impressive beyond measure or pushed the boundaries of security.

The SolarWinds hack

2020 saved the most devastating breach for last. Hackers that multiple public officials say are backed by the Russian government started by compromising the software distribution system of SolarWinds, the maker of network monitoring software that tens of thousands of organizations use. The hackers then used their position to deliver a backdoored update to about 18,000 customers. From there, the hackers had the ability to steal, destroy, or modify data on the networks of any of those customers.

It’s going to take time for investigators to assess the damage. That’s because not everyone who installed the malicious update received follow-on attacks. So far, security firm FireEye has said the hackers sought information about its government customers and also stole red-team tools used to test customers’ security defenses. US officials, meanwhile, have said that dozens of Treasury Department email accounts have also been hacked.

While the full effects of the breach won’t be known for another few months, it’s already clear the SolarWinds hack is one of the most damaging espionage hacks visited on the US in the past decade, if not of all time. It was carried out by attacking a software supply chain that’s vital to some of the biggest companies and government agencies in the world. Attackers then used that pipeline to burrow deep into the networks of the most interesting entities.

Besides the loss of so much valuable data, the SolarWinds hack is notable for the top-tier tradecraft it used. The attackers, according to Yahoo News, had control of SolarWinds update system no later than October 2019. They started pushing out malicious updates in March. The industry-wide compromise came to light not by government agencies tasked with uncovering such things, but rather because of the investigation FireEye did.

Mass compromises of Twitter, Nintendo accounts

In July, Twitter lost control of its internal systems to hackers pushing a Bitcoin scam. The breach was notable because it compromised accounts belonging to politicians, celebrities, and business executives, many with millions of followers.

While the damage was modest—about $100,000 in phony Bitcoin promotion payments and some personal data stolen from some account holders—a hack like this could have been used to do much worse things (think an announcement from government or business leaders that manipulates the stock market or stokes geopolitical tensions).

Another thing that made this breach significant was the people who perpetrated it and the tactics they used. Authorities charged a 17-year-old, a 19-year-old and a 22-year-old with using a spear phishing attack that stole an administrative password from a Twitter employee working from home during the COVID-19 pandemic.

A runner up for another hack that led to the mass compromise of accounts was the one that hit Nintendo in April.

Ransomware attacks on Dusseldorf University Hospital, Garmin, and Foxconn

These are separate breaches, but together they underscore the cost ransomware attacks are exacting, not only on the targeted organizations but the millions of people who rely on them.

During an outage that hit one of the hospitals near Dusseldorf, Germany, a patient seeking life-saving treatment was turned away and died as she tried to obtain services from a more distant facility. It’s possible or even likely that the patient would have died anyway, but the compromise nonetheless illustrates the potentially fatal role ransomware and other types of damaging hacks can have.

The Garmin attack, meanwhile, caused a four-day outage that knocked out GPS services to millions of people, some of them aircraft pilots doing flight planning and mapping.

Another ransomware attack that attracted attention was the breach of electronics giant Foxconn. Attackers demanded $34 million for the return of the data, making it the highest ransom ever sought.

Data breaches hitting Marriott and EasyJet

These were also separate hacks, but they led to compromise of personal data belonging to hundreds of millions of individuals.

For Marriott, the loss of information for 5.2 million guests was the second time in three years it had sustained a hack of that magnitude. A breach of EasyJet affected nine million passengers.

An iPhone zero-click exploit and the extraction of an Intel CPU crypto key

Not all hacks are bad. More often than not, they’re done by the good guys. And occasionally, they’re so elegant that you just have to admire them for the ingenuity that went into them.

This year’s most impressive hack came from Ian Beer, a member of Google’s Project Zero vulnerability research team. He devised an attack that, until Apple issued an update, gave him full access to every iPhone within range of his malicious Wi-Fi access point.

His attack didn’t require the iPhone user to do anything, and it was wormable, meaning exploits could spread from one nearby device to another. The exploit is one of the most impressive hacking feats in recent memory and shows the damage that can result from a single garden-variety vulnerability. Apple patched a buffer overflow flaw after Beer privately reported it.

Another top hack this year was the extraction of a secret key used to encrypt microcode on an Intel CPU—a first in the annals of security and reverse engineering.

The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse-engineer it and learn precisely how to exploit the hole it’s patching. The key may also allow parties other than Intel—say a malicious hacker or a hobbyist—to update chips with their own microcode, although that customized version wouldn’t survive a reboot.

There’s an old saying in security circles that attacks only get better. 2020 proved the saying to be true once again, and no doubt 2021 will do the same.

https://arstechnica.com/?p=1731509

California-based workers for food delivery app Grubhub have reacted angrily to changes to the platform which they say discourage tipping, saying they would wipe out the supposed benefits of new gig worker rules in the state.

Last month, California passed Proposition 22, which though falling far short of the benefits received by full-time employees, gave gig workers a limited number.

Weeks after the ruling, Grubhub reduced its default tip amount from about 20 percent to zero, adding a suggestion to “leave an optional tip on top of driver benefits.”

Like other apps, Grubhub added an additional “benefit” fee, in its case $1.50, to each order in California—though that money is put into a centralized pot for which only a limited number of drivers are expected to fully qualify.

“[The] benefits are not nearly high enough to compensate for encouraging no tipping,” wrote one Grubhub worker on Reddit.

“Such bullshit to drive this wedge between customers and drivers,” wrote another. A third added: “This is chilling. Really disappointing.”

Under Proposition 22, workers receive a healthcare stipend, provided they clock at least an average of 15 hours per week on one of the gig apps. However, in order to qualify, workers must already be the primary policyholder on an existing healthcare plan.

To get the full stipend, workers must put in at least 25 hours per week. The companies only count “engaged” time, not including periods spent driving without an assigned job — estimated to be about a third of all time spent on the road, according to a University of California, Berkeley, study. No allowances are made for time off or sickness. Data shared by Uber suggested that about three-quarters of its own drivers would not meet this threshold.

Other benefits include a guaranteed minimum earning rate, accident insurance, and $0.30 per mile for vehicle expenses. The measures have been derided as inadequate by workers’ groups, but the gig companies maintained that such a model was vital if workers were to maintain their flexible work patterns.

But a study by University of California, Santa Cruz, in May determined that “delivery workers are particularly dependent on tips, which account for 30 percent of their estimated earnings.”

“I keep records,” said Jeanine, a Grubhub worker in the San Francisco Bay Area. “And there’s been a complete flip. It’s stunning.”

She shared with the Financial Times a breakdown of her tips on the platform both before and after the change. On two consecutive Saturdays she completed the same number of orders—eight—but on the first Saturday, before the change, 100 percent of her customers left at least a small tip—totalling $61.03.

On the second Saturday, five of her eight customers left no tip, with the rest totalling $24.71.

In response to criticism over the new tip options, a Grubhub spokeswoman said: “Some diners in California may see this at checkout alongside a driver benefits fee, and diners continue to have the ability to leave a tip for their driver, including through the custom tip feature.”

Proposition 22 gave workers “more stability,” the statement added.

Uber and DoorDash last week said they would raise prices in order to fund Proposition 22 benefits, though as yet only Grubhub has made changes to its tipping system.

In June, it was announced Grubhub would be acquired by European food delivery group Just Eat Takeaway in a deal worth $7.3 billion.

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1732036

For the 460,000 Twitter followers of Praying Medic, one of the most prolific posters of the QAnon conspiracy, the US election is not over. His timeline is peppered with claims of electoral fraud, alongside retweets from President Donald Trump.

“Anyone who thinks Donald Trump has no chance of winning reelection hasn’t thought through all the contingencies to their logical or likely end,” Praying Medic said in a tweet earlier this month. “Biden’s only hope of winning was convincing Trump to concede. He failed.”

But despite his optimism, the rightwing theory has been dealt a heavy blow by Joe Biden’s US presidential victory. Experts warn, however, that it could still cast a shadow over global politics for years to come.

With its central belief that the US is embroiled in a long-running power struggle with a so-called “deep state,” QAnon gained mainstream traction during the election. It garnered endorsements from high-profile figures including politicians and influencers.

But according to Joe Ondrak, senior researcher at counter-misinformation organization Logically, Mr. Biden’s win has left the community largely “rudderless.” He added that there had been a notable drop-off in momentum on major social platforms since, and only one post from the pseudonymous “Q” in December.

“It’s hard to consider the [current] state of Q a success,” he said.

The US election result destabilized QAnon because one of its central predictions was that Mr. Trump would win a second term. The movement has also been hampered by actions taken by social platforms to stamp out QAnon-related content. Facebook, once a key hub for Q communities, is now “a desert,” said Vegas Tenold, an investigative researcher at the Anti-Defamation League’s Center on Extremism.

“A lot of [interpersonal] networks were made [before August, when Facebook tightened its policy on QAnon] but the spreading of the message has to a large degree been stopped,” he said.

QAnon had found some recent success on alternative platforms, said Samantha North, director of counter-disinformation organization North Cyber Research. Earlier this month, the chief executive of the rightwing social network Gab described the conspiracy theory as a “decentralized new media network that surfaces, distributes, and fact-checks information in real time.”

But the appeal of such “alt” sites appears to be limited. Parler, the “free speech social media” platform that reached the top of the US app download charts shortly after the election, has fallen out of the top 300 on the Apple App Store, according to data from SensorTower.

“I can’t really envision someone’s aunt or uncle going on to [alt platforms],” said Ms North. “Twitter and Facebook will hold on to the mainstream.”

Experts warn, however, that QAnon’s ability to continually reinvent itself means that such setbacks may only be temporary. President Trump’s election defeat, for example, was unlikely to shake the faith of dedicated QAnon believers, said Chine Labbe, European managing editor at counter-misinformation organization NewsGuard.

“There’s been a lot of predictions from the beginning, none of which have come to fruition. Hillary Clinton was supposed to have been arrested three years ago… but this didn’t prevent the movement from growing,” she added.

She also said that the development and mutation of QAnon around the world remains a cause for concern. Ms Labbe said that one of the French QAnon websites she had been tracking had risen from 1,300th place for online engagement in late July to 293rd by late November.

Meanwhile, a core of QAnon influencers who have built careers off the back of the conspiracy theory—selling products such as health supplements and healing rituals—are unlikely to abandon their meal ticket. “[Q] is now so nebulous and infrequent in their posts [that] it really is the tastemakers and influencers who are QAnon now,” said Mr. Tenold.

A report last week from the Institute for Strategic Dialogue and NewsGuard also found that even after Facebook banned QAnon, personal accounts with large followings were continuing to promote the conspiracy.

The 2020 US election marked a milestone for the movement, said Ms Labbe, despite Mr. Trump’s ultimate defeat. “[This year] Q has entered Congress in the US,” she said, referring to Marjorie Taylor Greene, a representative-elect from Georgia who has promoted QAnon conspiracy theories on Twitter.

Ms North said that given the US president’s previous promotion of QAnon, in which he stated that its adherents “love our country,” she could foresee the movement being invoked in future campaigns. “He [Mr. Trump] can position himself as a resistance fighter in a way [in a 2024 presidential bid] . . . I can see [QAnon] being harnessed into this kind of effort.”

“It’s hard to be optimistic because politicians seem quite happy to fan these flames,” said Mr. Tenold. “As long as it is in the interests of politicians to suggest voter fraud and a cabal of pedophiles, I don’t think this is going away.”

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1732031

The soaring price of bitcoin—the virtual currency is now worth more than $250 billion—has gotten a lot of attention in recent weeks. But the real significance of bitcoin isn’t just its rising value. It’s the technological breakthrough that allowed the network to exist in the first place.

Bitcoin’s still anonymous inventor, who went by the pseudonym Satoshi Nakamoto, figured out a completely new way for a decentralized network to reach a consensus about a shared transaction ledger. This innovation made possible the kind of fully decentralized electronic payment systems that cypherpunks had dreamed about for decades.

As part of our recent efforts to shed light on the mechanics of the popular cryptocurrency, today we’ll provide in-depth explanation of how bitcoin works, starting with the basics: how do digital signatures make digital cash possible? How did Nakamoto’s invention of the blockchain solve the double-spending problem that had limited earlier digital cash efforts?

We’ll also explore more recent happenings like the block size debate that has divided the bitcoin community into two warring camps. And finally, we’ll look at the future and talk about why bitcoin’s design could make it a uniquely fertile platform for innovation in the coming years. As you’re about to see, there’s simply a lot to cover.

Asymmetric encryption made digital cash possible

Until the 1970s, all publicly known encryption schemes were symmetric: the recipient of an encrypted message would use the same secret key to unscramble the message that the sender had used to scramble it. But that all changed with the invention of asymmetric encryption schemes. These were schemes in which the key to decrypt a message (known as the private key) was different from the key needed to encrypt it (known as the public key)—and there was no practical way for someone who only had the public key to figure out the private key.

This meant you could publish your public key widely, allowing anyone to use it to encrypt a message that only you—as the holder of the private key—could decrypt. This breakthrough transformed the field of cryptography because it became possible for any two people to communicate securely over an unsecured channel without establishing a shared secret first.

Asymmetric encryption also had another groundbreaking application: digital signatures. In normal public-key cryptography, a sender encrypts a message with the recipient’s public key and then the recipient decrypts it with her private key. But you can also flip this around: have the sender encrypt a message with his own private key and the recipient decrypt it with the sender’s public key.

That doesn’t protect the secrecy of the message since anyone can get the public key. Instead, it provides cryptographic proof that the message was created by the owner of the private key. Anyone who has the public key can verify the proof without knowing the private key.

People soon realized that these digital signatures could make cryptographically secure digital cash possible. Using the classic example scenario, let’s suppose Alice owns a coin and wants to transfer it to Bob.

She’ll write a message that says, “I, Alice, transfer my coin to Bob,” and then sign the message by encrypting it with her private key. Now Bob—or anyone else—can decrypt the signature using Alice’s public key. Since only Alice could have created the encrypted message, Bob can use it to demonstrate that he’s now the rightful owner of the coin.

If Bob wants to transfer the coin to Carol, he follows the same procedure, declaring that he’s transferring the coin to Carol and encrypting the message with his private key. Carol can then use this chain of signatures—Alice’s signature transferring the coin to Bob, and Bob’s signature transferring the coin to Carol—as proof that she now owns the coin.

Notice that none of this requires an official third party to authorize or authenticate the transactions. Alice, Bob, and Carol can generate their own public-private key pairs without help from third parties. Anyone who knows Alice’s and Bob’s public keys can independently verify that the chain of signatures is cryptographically valid. Digital signatures—combined with a few innovations we’ll discuss later—let people engage in banking without needing a bank.

How bitcoin transactions work

The generic digital cash scheme I described in the previous section is very close to how real bitcoin payments work. Here’s a simplified diagram of what real bitcoin transactions look like:

A bitcoin transaction contains a list of inputs and outputs. Each output has a public key associated with it. For a later transaction to spend those coins, it needs an input with a matching digital signature. Bitcoin uses elliptic curve cryptography for digital signatures.

For example, suppose you own the private key corresponding to Public Key D in the diagram above. Someone wants to send you 2.5 bitcoins. The person will create a transaction like Transaction 3, with 2.5 bitcoins going to you—the owner of Public Key D.

When you’re ready to spend those bitcoins, you create a new transaction like Transaction 4. You list Transaction 3, output 1 as a source of the funds (outputs are zero-indexed, so output 1 is the second output). You use your private key to generate Signature D, a signature that can be verified with Public Key D. These 2.5 bitcoins are then split up between two new outputs: 2 bitcoins for Public Key E and 0.5 bitcoins for Public Key F. Now they can only be spent by the owners of the corresponding private keys.

A transaction can have multiple inputs, and it must spend all of the bitcoins from the corresponding outputs of earlier transactions. If a transaction outputs fewer bitcoins than it takes in, the difference is treated as a transaction fee collected by the bitcoin miner who processed the transaction (more details on this later).

On the bitcoin network, the addresses people use to send each other bitcoins are derived from public keys like Public Key D. The exact details of bitcoin’s address format are complicated and have changed over time, but you can think of a bitcoin address as a hash (a short, seemingly random string of bits that serves as a cryptographic fingerprint) of a public key. Bitcoin addresses are encoded in a custom format called Base58Check that minimizes the risk of mistyping. A typical bitcoin address is “18ZqxfuymzK98G7nj6C6YSx3NJ1MaWj6oN.”

A real-world transaction looks like this:

This transaction took 6.07 bitcoins from one input address and split it between two output addresses. One output address got a bit more than 5 bitcoins, while the other got slightly less than 1 bitcoin. Most likely, one of those output addresses belongs to the sender—sending “change” back to themselves—while the other belongs to a third-party recipient.

Of course, real bitcoin transactions can be more complex than the simple examples I’ve shown so far. Probably the most important feature not illustrated above is that in place of a public key, an output can have a verification script written in a simple bitcoin-specific scripting language. To spend that output, a subsequent transaction must have parameters that allow the script to evaluate to true.

This allows the bitcoin network to enforce arbitrarily complex conditions governing how the money can be spent. For example, a script could require three different signatures held by different people and also require that the money not be spent prior to some future date. Unlike Ethereum, bitcoin’s scripting language doesn’t support loops, so scripts are guaranteed to complete in a short amount of time.

https://arstechnica.com/?p=1227267