Why Is The US Trying To Punish Hackers For Accessing Vaccine Research We Should Be Sharing With The World?

from the what-a-stupdendous-waste-of-time dept

Back in May, I wondered why the US was trying to hide vaccine data from the Chinese. In fact, it was bizarre that the US government seemed concerned about Chinese hackers trying to access vaccine data, because why would anyone keep such data secret in the first place. This is a global pandemic and the way you solve a global pandemic is with a global solution, and the way to get there faster (and better) is with the open sharing of information. Hoarding and locking up information regarding a potential vaccine makes no sense at all. And yet, this morning, the DOJ made a big showing of how it had indicted Chinese hackers for trying to hack COVID-19 related research.

The Justice Department on Tuesday accused two Chinese hackers of stealing hundreds of millions of dollars of trade secrets from companies across the world and more recently targeting firms developing a vaccine for the coronavirus.

This is totally performative, as those hackers are in China and the US can't do a damn thing about them, other than allow for Attorney General Bill Barr and FBI Director Chris Wray to grandstand and pretend they're doing something useful. And, again, the really shameful part is the fact that this research is "secret" in the first place.

And, of course, last week we had a repeat of the story from May, except that this time it wasn't "Chinese hackers" trying to get vaccine data, but theoretical Russian hackers:

Russian cyber actors are targeting organizations involved in coronavirus vaccine development, according to a new warning by US, UK and Canadian security officials on Thursday that details activity by a Russian hacking group called APT29, which also goes by the name "the Dukes" or "Cozy Bear."

An advisory published by the UK National Cyber Security Centre (NCSC) details activity by the Russian hacking group and explicitly calls out efforts to target US, UK and Canadian vaccine research and development organizations.

"APT29's campaign of malicious activity is ongoing, predominantly against government, diplomatic, think tank, healthcare and energy targets to steal valuable intellectual property," a press release on the advisory said.

I'm sure within a month or two we'll have another performative press conference from Barr and Wray announcing pointless show charges against Russian hackers as well, because why not?

And, again, rather than recognize that saving and protecting global health is the key priority here, the US government is responding by worrying that others might save the world first. House Minority Leader Rep. Kevin McCarthy is even introducing a bill to "sanction foreign hackers" for trying to get US COVID-19 vaccine information in his somewhat pointless Defend COVID Research from Hackers Act".

The bill is pointless on multiple levels. Foreign hackers are not subject to US jurisdiction, so this wouldn't do anything in the first place. Second, given the indictments announced today, it's not as if law enforcement actually needs greater authority. They seem to have the authority they need to go after hackers. But, (to repeat myself) more importantly, we should be sharing this research widely and getting everyone else to pool their research efforts as well in order to move everyone forward as quickly as possible in order to save as many lives as possible. This isn't a zero sum game where one country "wins" and another "loses." This is about stopping a devastating global pandemic.

As even CNN is admitting, there are no good health reasons for keeping this info secret or worrying about hacks, it's literally a completely wasteful attempt to want to claim bragging rights.

Given the inevitable confusion ahead, getting to the head of the line just does not make sense as an explanation, at least from a financial windfall perspective or a saving lives perspective. But the need to dominate voiced both by Trump and the leader of Russian vaccine efforts, Dmitriev, makes the likely reason for any sneak attack all too clear. It's less about saving the world with a vaccine than about beating the other guy and taking home the first place medal.

What a stupid, stupid reason. Leadership is about doing the right thing even if it makes you look bad. The right thing here is figuring out how to save as many lives as possible and to end the pandemic as quickly as possible. McCarthy's bill would do the opposite of that, and is a total waste of time. I get that it's still driven by the silly belief that everything related to drug discovery must be "owned" and "patented," but actual lives are on the line right now, and Rep. McCarthy should be ashamed that he's wasting time and holding back research, instead of encouraging more open sharing of information.

Filed Under: china, chris wray, covid-19, hacking, information sharing, innovation, kevin mccarthy, patents, russia, sharing, vaccines, william barr

The Trump Administration Has Given The CIA Free Rein To Engage In A Cyberwar

from the cybercoups-on-tap dept

Outside of the agencies desiring to participate in a cyberwar, cyberwars are generally considered to be a bad idea. At some point, the cyber is going to turn physical and we'll just be stuck in a regular war that actually kills people. And since accurate attribution still remains elusive, the potential for picking the wrong fight remains.

There was some talk of going to cyberwar with Russia after the DNC server hacking. The CIA, in particular, was all too willing to send its keyboard warriors out to do battle. This desire to draw virtual blood found some backing in the press when NBC acted as the agency's PR office, talking up the new bright, shiny warfare and asking viewers if they'd like to know more.

As long as officials have been claiming we're on the cusp of a "cyber Pearl Harbor," the CIA has been wanting to go on the offensive. The CIA already participates in plenty of cyber-attacks, but it's mostly of the one-to-one variety, targeting individuals the agency has placed under surveillance. But the agency does know how to disrupt elections, participate in coups, and otherwise wreak havoc in "enemy" lands.

Now it can do it at the cyber level. And, as Yahoo News was the first to report, it's been doing it for a few years now thanks to the new kid in town.

The Central Intelligence Agency has conducted a series of covert cyber operations against Iran and other targets since winning a secret victory in 2018 when President Trump signed what amounts to a sweeping authorization for such activities, according to former U.S. officials with direct knowledge of the matter.

The secret authorization, known as a presidential finding, gives the spy agency more freedom in both the kinds of operations it conducts and who it targets, undoing many restrictions that had been in place under prior administrations. The finding allows the CIA to more easily authorize its own covert cyber operations, rather than requiring the agency to get approval from the White House.

Rather than develop targets over months and years, the CIA can now rush in whenever it feels there's a target worth attacking. It's not just attacks targeting infrastructure or weapons development capability. It's also disinformation campaigns and the breaching of protected servers to obtain sensitive (and potentially embarrassing) documents to leak locally. Yes, the CIA is now a self-contained Wikileaks that sources and obtains its own documents.

But there's more to it than that. The authorization of CIA activities allows it to go after targets that were previously considered off-limits if it can find the slightest justification for doing so.

The presidential authorization makes it much easier for the CIA to target “cut-outs” believed to be working surreptitiously for hostile foreign intelligence services at media organizations, charities, religious institutions, or other non-state entities for disruptive or destructive cyber actions, said former officials. In the past, the burden of proof for targeting such entities was high; now, standards have been made far more lax, said former officials.

The administration has also given the CIA more power to attack foreign financial institutions, something previous administrations -- and the Treasury Department itself -- opposed due to concerns about collateral damage to international relations or the world economy itself. These concerns are now being ignored. The CIA -- thanks in part to the departed John Bolton -- now operates with near-impunity. The end result of the Trump Administration casting off the shackles binding this component of the Deep State is operations like the one described in the Yahoo article -- one that appears to have been performed by the CIA.

In another stunning hack-and-dump operation, an unknown group in March 2019 posted on the internet chat platform Telegram the names, addresses, phone numbers and photos of Iranian intelligence officers allegedly involved in hacking operations, as well as hacking tools used by Iranian intelligence operatives. That November, the details of 15 million debit cards for customers of three Iranian banks linked to Iran’s Islamic Revolutionary Guard Corps were also dumped on Telegram.

Although sources wouldn’t say if the CIA was behind those Iran breaches, the finding’s expansion of CIA authorities to target financial institutions, such as an operation to leak bank card data, represents a significant escalation in U.S. cyber operations.

The CIA is a power player in the cyber-arena now. It has finally secured the powers it's been seeking for three straight administrations. But, on top of concerns about potential international "incidents" the CIA may be leading us towards, there's the more immediate concern about how the CIA secures its own stuff. If you want to wage a cyberwar, you'd better have your home front locked down tight. Recent events have shown the CIA's approach to internal security is lax at best. If the agency is out picking fights with foreign hackers, it won't be long before someone takes the CIA's weapons and starts wielding them against our allies… or the United States itself.

Filed Under: cia, cyberwar, hacking

New Indictment Tries To Tie Julian Assange To A Hacking He Had Nothing To Do With

from the several-versions-of-truth-and-this-one-is-the-DOJ's dept

The government is still trying to get Julian Assange out of the UK so it can ring him up on a variety of charges related to obtaining and publishing a large number of sensitive documents. Most of the charges are still related to the documents obtained from Chelsea Manning. The DOJ wants to use the oft-abused CFAA to put Assange behind bars because he supposedly helped Manning hack a CIA database.

Another indictment [PDF] has been issued by the DOJ, making this its third attempt to throw the book at Assange. If the DOJ can prove Assange contributed to hacking attempts, it may end up with a case worth pursuing. But much of what the indictments deal with is normal journalism behavior: the cultivation of sources and the encouragement of sources to locate/leak newsworthy documents. The blurry line the DOJ is walking on is the same line the previous administration seemed to feel wasn't worth crossing, no matter how much harm/embarrassment Assange had caused with the release of sensitive documents.

The latest indictment expands the government's espionage theories. The government's second superseding indictment deals with Assange's alleged "unlawful overt acts:" the hacking attempts supposedly made targeting Defense Department computers, possibly with the aid of Chelsea Manning and other Wikileaks associates.

Much of this expanded narrative seems to rely on the input of FBI informants, including Sigurdur Thordarson, who was convicted twice for sex with minors after he began working for the FBI in 2011. Sketchy contributors aside, there are some major omissions in the government's narrative.

First, as Dell Cameron points out for Gizmodo, the indictment casually ignores the government's contribution to cyber attacks on American businesses located overseas, as well as some foreign government targets. But there is a significant omission in the new indictment. And the purpose of this crucial admission appears to be an attempt to link Assange to a data breach he never participated in.

A section of the indictment titled “Sabu, Hammond, and ASSANGE” begins on the date December 25, 2011, and refers to an attack on servers belonging to a private firm identified only as “Intelligence Consulting Company.” This is obviously Stratfor, the Austin-based private intelligence company whose millions of pilfered emails comprise the WikiLeaks drop known as the Global Intelligence Files.

DOJ omits several crucial details about the Stratfor hack in its attempts to name Assange as a conspirator in a breach that happened without his knowledge. Most notably, prosecutors exclude that the actual breach of Stratfor’s security, in late 2011, occurred 83 days prior to the events they describe, unknownst by anyone DOJ identifies as part of the conspiracy, including Assange.

Assange and Wikileaks may have helped distribute the documents obtained in the breach and there does appear to be evidence Assange provided the hackers with some tools for searching the stash of five million emails, but there's nothing in the indictment that ties Assange to the underlying hacking. The only thing in the indictment is stuff the DOJ is generously calling "evidence."

At best, these are copies of exchanges taken from chat rooms in which a user claims to be Assange, which is not likely to hold up in court.

To be sure, indictments are often a pile of helpful omissions designed to speedily initiate prosecutions. But the more the government adds to its accusations, the more glaring its omissions become. This case was already problematic -- willing to walk right up to the First Amendment and dare it to do something about it. Now it's become more farcical, with the government accusing someone of doing something it appears clear they didn't do and bolstering it with half-truths about the FBI's own involvement in malicious hacking efforts.

Filed Under: cfaa, doj, extradition, hacking, indictment, julian assange, leaks
Companies: stratfor, wikileaks

Investigation Shows Governor's Claims That Democrats Tried To Hack The Georgia Election Were Bullshit

from the another-unforced-error-by-Brian-Kemp dept

Georgia Governor Brian Kemp is very involved with the electorate. Well, perhaps not that involved with the residents of the state, but he does seem to keep a very close -- and very partisan -- eye on election security. Election security is important, especially as more states move to electronic ballots, but Kemp has spent most of the last four years using election security as a political football to score points with.

When President Obama was still leading the nation, Kemp (while still Georgia's Secretary of State) claimed the DHS had breached his office's firewall during its security testing -- something he had directly asked it not to do. Kemp claimed his state had already implemented the DHS's recommendations and had asked to be left out of this nationwide testing. The DHS apparently ignored that, resulting in Kemp making lots of noise about an overreaching federal agency.

Kemp's tune changed once Trump was elected. While running for the job of governor against Democrat Stacey Abrams, Kemp -- a Republican -- generated a lot of bad press for himself by allegedly engaging in voter suppression efforts. He capped this off with a bad judgment two-fer.

First, he insisted the Democratic Party was trying to hack the voter registration system. The only evidence Kemp had for this is that a hacking attempt had been made. He responded to this by opening an investigation into the Democratic Party based on apparently nothing more than his animosity towards it. This was capped off a few days later when Kemp released a ton of absentee voting info, including names, addresses, and the reason they voted absentee.

Two years later, ProPublica -- using documents obtained from the Georgia Bureau of Investigation (GBI) -- has published the investigation's findings. No surprise, GBI's conclusions don't agree with Kemp's baseless and partisan assertions.

“The investigation by the GBI revealed no evidence of damage to (the secretary of state’s office’s) network or computers, and no evidence of theft, damage, or loss of data,” according to a March 2 memo from a senior assistant attorney general recommending that the case be closed.

Unlike Kemp's 2016 assertion about DHS meddling (which was later shown to be routine checks of the state's firearm database by law enforcement) where it wasn't asked to, the alleged "failed hacking attempt" seen by Brian Kemp's office was actually the DHS doing something the state had asked it to do.

The internet activity that Kemp’s staff described as hacking attempts was actually scans by the U.S. Department of Homeland Security that the secretary of state’s office had agreed to, according to the GBI. Kemp’s chief information officer signed off on the DHS scans three months beforehand.

Kemp continues to be wrong about election security -- something that only seems to concern him when it can be leveraged to (incorrectly in every case) target political opponents. The state's election system still has security issues. The article points out the site where voters can check their information still contains a "significant vulnerability" that Kemp has been notified of, but refused to acknowledge.

All the bluster worked, though. Kemp was elected governor in 2018 and now has an even bigger platform to be wrong about election security issues. And he -- and his former office -- were completely wrong about this one. The other alleged hacking his office thought it was witnessing -- other than the DHS's pentest traffic -- was nothing more than someone doing what anyone could do: altering site URLs to view other voters' data.

That's not hacking. That's what anyone who knows how websites work can do at any time with zero skill or additional tools. And from that, an entire conspiracy theory was erected by Kemp's office, resulting in thousands of tax dollars being wasted to pursue Kemp's politically motivated accusations. There's some hackery going on here, but it's only of the partisan variety.

Filed Under: brian kemp, dhs, e-voting, georgia, hacking, politics, voting machines, voting security

Documents Show NSO Group Is Pitching Its Malware To US Local Law Enforcement Agencies

from the get-in-bed-with-the-UAE,-locals dept

Infamous Israeli malware developer NSO Group is currently being sued by Facebook for using WhatsApp as its preferred attack vector. Malicious links and malware payloads are sent to targets, allowing government agencies -- including those in countries with horrendous human rights records -- to intercept communications and otherwise exploit compromised phones.

NSO has argued it can't be sued for the things done by its customers, all of which appear to be government agencies. The company says those actions are protected by sovereign immunity. NSO insists it only sells the malware. It does not assist its customers with target acquisition or malware deployment. Documents filed by Facebook say otherwise. NSO appears to deploy malware through servers it owns or rents in the United States, suggesting it is actually more involved in its customers' actions than it has sworn in court.

Like any business, NSO Group wants more customers. It's not content to sell exploits to questionable governments that have used its offerings to target journalists, lawyers, activists, and dissidents. It wants to do business in the United States, where there are thousands of potential law enforcement customers.

Some details of NSO's stateside push emerged a few years ago, when reports showed the DEA had met with NSO to discuss its offerings. Motherboard has obtained additional documents indicating NSO is courting local law enforcement as well.

NSO Group, the surveillance vendor best known for selling hacking technology to authoritarian governments, including Saudi Arabia, also tried to sell its products to local U.S. police, according to documents obtained by Motherboard.

[...]

"Turn your target's smartphone into an intelligence gold mine," a brochure for the hacking product, called Phantom, reads. The brochure was made by Westbridge Technologies, "the North American branch of NSO Group," it says. Motherboard obtained the document and related emails through a public records act request.

"Phantom" is just US branding for NSO's "Pegasus" -- the hacking tool sold to foreign governments that's at the center of Facebook's lawsuit. According to the marketing documents sent to the San Diego Police Department, Phantom turns targeted phones into a steady stream of intercepted communications. The software allows police to grab emails, text messages, contact lists, track the device's location, and surreptitiously activate the phone's camera and microphone. Once a phone is compromised, encryption is no longer a problem, as NSO's sales materials point out.

Pitching a tool this powerful to the San Diego PD had a predictable response:

After talking to the company in a phone call, SDPD Sergeant David Meyer told Westbridge in an email that the hacking system "sounds awesome."

The PD's statement says the department is always looking at products that could aid them in investigations. But as tempting as this one was, it was out of the PD's price range.

In his email, Sergeant Meyer added, "we simply do not have the kind of funds to move forward on such a large scale project."

That the NSO Group is seeking US law enforcement customers isn't a surprise. But the nation's police agencies should try to be selective about who they purchase from. NSO has sold malware to serial human rights abusers and one would hope US agencies would voluntarily choose not to buy from a company with such shady clientele. Unfortunately, this single sampling of law enforcement documents shows at least one cop shop showed interest in buying what NSO was selling, and was only held back by budgetary constraints.

Filed Under: hacking, law enforcement, police, spyware, us
Companies: nso group

Suspected DNC & German Parliament Hacker Used His Name As His Email Password

from the opsec-yo dept

You may have seen the news reports this week that German prosecutors have issued an arrest warrant for Dmitry Badin for a massive hack of the German Parliament that made headlines in 2016. The reports about the German arrest warrant all mention that German authorities "believe" that Badin is connected to the Russian GRU and its APT28 hacking group.

The folks over at Bellingcat have done their open source intelligence investigation thing, and provided a ton of evidence to show that Badin almost certainly is part of GRU... including the fact that he registered his 2018 car purchase to the public address of a GRU building. This is not the first time this has happened. A few years back, Bellingcat also connected a bunch of people to the GRU -- including some accused of hacking by the Dutch government -- based on leaked car registration info.

There's much, much more in the Bellingcat report, but the final paragraph really stands out. Bellingcat also found Badin -- again, a hacker who is suspected in multiple massive and consequential hacks, including of email accounts -- didn't seem to be all that careful with his own security:

The most surreal absence of “practice-what-you-breach” among GRU hackers might be visible in their lackadaisical attitude to their own cyber protection. In 2018, a large collection of hacked Russian mail accounts, including user name and passwords, was dumped online. Dmitry Badin’s email — which we figured out from his Skype account, which we in turn obtained from his phone number, which we of course got from his car registration — had been hacked. He had apparently been using the password Badin1990. After this, his email credentials were leaked again as part of a larger hack, where we see that he had changed his password from Badin1990 to the much more secure Badin990.

Yes, the password for at least one of his email accounts... was apparently his own last name and the year he was born. The cobbler's kids go shoeless again.

Filed Under: apt28, dmitry badin, dnc, dnc emails, email, germany, gru, hacking, opsec, passwords, podesta emails, russia

Court Filings Show NSO Group Ran Malware Attacks Through Servers Located In California

from the not-immune-from-its-own-carelessness dept

Things are getting even more interesting in Facebook's lawsuit against Israeli malware merchant, NSO Group. Facebook was getting pretty tired of NSO using WhatsApp as an attack vector for malware delivery, which resulted in the company having to do a lot more upkeep to ensure users were protected when utilizing the app.

Unfortunately, Facebook wants a court to find that violating an app's terms of service also violates the CFAA -- something most of us really don't want, even if it would keep NSO and its customers from exploiting messaging services to target criminals, terrorists… and, for some reason, lots of journalists, dissidents, and activists.

NSO finally responded to Facebook's lawsuit by saying it could not be sued over the actions of its customers. Its customer base is mainly government agencies -- including some especially sketchy governments. NSO claims all it does is sell the stuff. What the end users do with it is between the end users and their surveillance targets. Since its customers are governments, sovereign immunity applies… which would dead-end this lawsuit (wrong defendant) and any future lawsuits against governments by Facebook (the sovereign immunity).

NSO's claims it can't be touched by this lawsuit are falling apart. Citizen Lab researcher John Scott-Railton pointed out on Twitter that Facebook's latest filings point to NSO operating its malware servers from inside the United States -- apparently doing far more than simply selling malware to government customers and letting them handle the deployment details.

Facebook's answer to NSO's attempt to dismiss the lawsuit concedes NSO's point: it is not its customers. But that's precisely why it can be sued. From Facebook's response [PDF]:

A flawed premise runs through the motion to dismiss (“MTD”). Defendants contend that they cannot be held responsible for designing and marketing spyware and then deploying it using WhatsApp’s U.S.-based servers, including in California, to hack into WhatsApp users’ devices. Instead, Defendants pin blame on unidentified foreign sovereigns. That argument fails at every turn: Defendants cannot cloak themselves in their putative clients’ immunity; they are accountable for suit in a California court; and the Complaint states valid claims for relief based on Defendants’ unauthorized access to and hijacking of WhatsApp’s servers.

[...]

The statute confers immunity only on foreign states—not private companies who develop and operate their own technology and then claim to act on a foreign state’s behalf.

The claim that NSO Group operates from California (making this venue appropriate for the lawsuit) isn't some distended stretch where malware briefly passed through WhatsApp servers in the US on its way to its targets. Declarations [PDF] by Facebook's expert witnesses show NSO is routing malware deliveries through California data centers. This is only a small part of the list of IP addresses linked to NSO deployments Facebook has uncovered.

Attached as Exhibit 1 is a true and accurate screenshot from IP2Location.com obtained on April 22, 2020, for IP address 104.223.76.220. Exhibit 1 shows that IP address 104.223.76.220 is currently located in Los Angeles, California, and is owned by QuadraNet Enterprises LLC.

According to historical IP address location information from Maxmind.com for IP address 104.223.76.220 obtained through the website archive.org, IP address 104.223.76.220 was located in Los Angeles, California, and owned by QuadraNet Enterprises LLC as of May 28, 2019. Attached as Exhibit 2 is a true and accurate screenshot of the Maxmind.com csv.zip file available for download at archive.org that contains historical IP location information. Attached as Exhibit 3 is a true and accurate screenshot of the unzipped Maxmind.com csv.zip file showing the date of the files as May 28, 2019. Attached as Exhibits 4a, 4b, and 4c are true and accurate screenshots of the netblock for IP address 104.223.76.220 showing the location and ownership of IP address 104.223.76.220 as of May 28, 2019.

This is the upshot of Facebook's investigation of NSO's WhatApp-based efforts:

NSO used QuadraNet’s California-based server more than 700 times during the attack to direct NSO’s malware to WhatsApp user devices in April and May 2019.

These filings appear to show something very different than what NSO Group has claimed. It is not a blind provider of malware to government agencies. This indicates NSO is purchasing and operating servers stateside that its customers use to deploy malware. And if it runs these servers, then it quite possibly knows who its customers are targeting. This is far more involved than its sworn statements have said. The plausible deniability it's trying to project just isn't that plausible.

Facebook's response points out the logical leap NSO is demanding from the court.

The Complaint alleges targeting of 1,400 separate devices, Compl. ¶ 42, and NSO does not specify who it was working for in each attack. Instead, NSO relies on a conclusory declaration from its CEO Shalev Hulio stating that “NSO markets and licenses its Pegasus technology exclusively to sovereign governments and authorized agencies,” and those sovereigns—not NSO—“operate [the] Pegasus technology.” Hulio Decl. ¶¶ 9, 14-15. But Hulio fails to identify any specific foreign sovereign for whom NSO worked—let alone cite a single contract or any evidence establishing NSO’s purportedly limited operational role.

NSO's options are all unappealing at the moment. It can't hope to settle since its customers aren't going to be willing to give up exploitation of an encrypted messaging app used by millions of people around the world. It also can't be looking forward to continued litigation since that's only going to mean more exposure of its actions and inner workings as the lawsuit drags on. But these are the risks you take when your favored attack vector is another company's service and your payload deliveries route themselves through rented/purchased servers located in the United States.

NSO turned itself into a villain by selling its products to governments wanting to target dissidents, journalists, activists, and attorneys. A little more judiciousness would have gone a long way. Running attacks through services owned by one of the most powerful tech companies in the world may have provided NSO's customers with a broad user base to attack, but it also ensured it would find itself in court facing a well-funded and well-equipped adversary.

Filed Under: cfaa, hacking, jurisdiction, spying, surveillance
Companies: facebook, nso group, whatsapp

Over-The-Air Updates Could Turn Millions Of Inexpensive Devices Into Much-Needed Ventilators To Treat Seriously-Ill COVID-19 Patients -- If Manufacturer Helps

from the profits-before-people dept

Last week we wrote about attempts to repair much-needed ventilators for serious coronavirus cases being stymied by manufacturers' refusal to allow hospital technicians to carry out the necessary work. Trammell Hudson, who describes himself as "a programmer, photographer, frequent hacker and occasional watchmaker", has come up with another approach to supplying ventilators to hospitals. It involves taking the inexpensive and widely-used Constant Positive Air Pressure (CPAP) devices typically used for sleep apnea, and turning them into emergency ventilators suitable for COVID-19 patients. These are known as Bi-level Positive Airway Pressure (BiPAP) machines. BiPAP devices are more sophisticated than CPAP ones: they apply higher pressure when the patient tries to breathe in, and lower pressure when they start to breathe out. In investigating the popular Airsense 10 CPAP device manufactured by ResMed, Hudson made a remarkable discovery:

Our work indicates that the actual difference between a low-end CPAP device and a high-end iVAPS [intelligent volume-assured pressure support] device is just a software upgrade. The CPAP machines have many of the same sensors as the more expensive models, and the Airsense 10 CPAP devices include in their firmware all of the other modes, such as iVAPS and BiPAP-ST [spontaneous/timed mode]. When we unlock that mode in software, the CPAP device functions like a much more capable and expensive iVAPS device.

This idea, that the difference between CPAP and BiPAP machines is a software change rather than a hardware change, is at the root of our work. If the common, highly distributed CPAP devices could have a software upgrade that turns them into iVAPS or BiPAP-ST devices capable of ventilating COVID patients, that would be a huge boon to the hospitals and health care workers around the world who are struggling with a lack of ventilators or alternatives to treat the influx of COVID patients.

Following his discovery, Hudson wrote a firmware patch that can be applied to the Airsense 10 CPAP device in order to access its more advanced features. However, he stresses:

We want to be very clear here: this modified firmware should not be flashed on CPAP machines and used to treat COVID patients immediately. The firmware that we've developed is an effective demonstration of the capability, and while it has been reviewed and validated by expert researchers, biomedical engineers, and clinical pulmonologists, it has not yet been put through FDA approval.

Although FDA approval could be sought, Hudson points out that by far the best solution would be for ResMed itself to provide the software upgrade -- something that doesn't need FDA permission. There are two other big benefits of taking this route. First, the manufacturer could more easily provide the slightly different patches for the various models of its devices. Perhaps even more importantly, for the majority of machines, the manufacturer could use a built-in always-on cellular connection to upgrade them over the air, without even needing to open them up. Unfortunately, it seems unlikely that the manufacturer will embrace this idea. On its Web site, a FAQ specifically addresses the issue of using a CPAP machine as a ventilator:

CPAP devices are designed to provide only PAP (positive airway pressure) and would require significant rework in order to function as a ventilator.

Hudson's work suggests that is not true: a simple software upgrade is pretty much all that is required. When asked by Ars Technica whether the company would be willing to work with researchers to convert low-cost models to more capable ventilators, a representative wrote: "We are already exploring that option, but our primary focus is to maximize production of our current ventilation devices, masks, and accessories". In other words, rather than helping to save thousands of lives by carrying out over-the-air upgrades of existing machines -- millions of them in the US alone, according to Hudson -- the "primary focus" is on selling more expensive machines. As with the previous story about repairing ventilators, it seems that even during a pandemic, profits are more important than patients.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: airsense 10, bipap, covid-19, cpap, fda, hacking, ota, over the air updates, trammell hudson, ventilators
Companies: resmed

NSO Fires Back At Facebook, Says It's Not Responsible For Malware Deployments By Foreign Governments

from the fair-point-but-doesn't-really-make-NSO-Group-look-any-better dept

NSO Group has finally decided to engage in the lawsuit Facebook filed against it late last year. The Israeli surveillance tech company has shown itself to be pretty cavalier about its market expansion plans. Despite being located in a country surrounded by unfriendly governments, NSO is more than willing to give Israel's enemies something to use against it. Its client list includes Saudi Arabia, United Arab Emirates, Bahrain, and Kazakhstan.

Facebook's lawsuit is questionable and if it wins, it would cause a lot of damage. Facebook is unhappy NSO software uses WhatsApp to deliver malware payloads to targets. But seeking precedent that would criminalize terms of service violations isn't going to help anyone, much less stop NSO from using encrypted messaging apps as attack vectors.

NSO is now firing back. And it makes a point that's true, if not all that sympathetic. It is not its customers. Much like the gun dealer who sells the gun eventually used in a mass shooting, NSO's sales of malware to governments that use them in questionable ways isn't really NSO's fault. It may have provided the surveillance tech, but it is not telling governments who to target or participating in the surveillance directly.

In its first substantive legal filing in the case, filed last week, NSO hit back at WhatsApp and its parent company, Facebook, which it said were seen by governments as “safe spaces for terrorists and other criminals” who – without NSO’s services – could operate “without fear of detection by law enforcement”.

NSO Group also argued that WhatsApp had “conflated” NSO Group’s actions with the actions of NSO’s “sovereign customers”. While NSO Group licenses its signature spying technology, Pegasus, to government law enforcement and intelligence agencies and assists with “training, setup, and installation”, it said it did not operate the technology.

This is NSO arguing it cannot be held responsible for the actions of others. If Facebook doesn't like what these governments are doing with NSO's tech, it's welcome to sue those governments directly. Not that those lawsuits would succeed. We're not the only nation that extends sovereign immunity to government agencies. That's standard operating procedure around the world. This is what NSO is hoping will convince the court to toss the suit.

“For that reason,” the company said in the filing, “permitting this litigation to proceed would infringe critical national security and foreign policy concerns of sovereign governments”.

NSO is also fighting back with a little dirt of its own. Long before it was sued by Facebook, it spent a little time discussing its spyware with the company.

In October 2017, NSO was approached by two Facebook representatives who asked to purchase the right to use certain capabilities of Pegasus, the same NSO software discussed in Plaintiffs' Complaint.

The Facebook representatives stated that Facebook was concerned that its method for gathering user data through Onavo Protect was less effective on Apple devices than on Android devices. The Facebook representatives also stated that Facebook wanted to use purported capabilities of Pegasus to monitor users on Apple devices and were willing to pay for the ability to monitor Onavo Protect users. Facebook proposed to pay NSO a monthly fee for each Onavo Protect user.

Onavo was Facebook's VPN -- one that had little to do with offering privacy to its users. It may have shielded them from others attempting to take a look at their web traffic, but it didn't do anything to prevent Facebook from collecting tons of data on users, which included a whole lot of minors. It was booted from Apple's App Store in 2018 for hoovering up too much sensitive data. Roughly six months later, Facebook killed the faux VPN for good.

Facebook claims this is an "inaccurate" portrayal of its meeting with NSO, but it's not like Facebook has much credibility on the privacy front. Its thirst for data has been unquenchable and its mitigation attempts have been provoked by Congressional inquiries and years of work by privacy activists. It hasn't suddenly become altruistic.

Facebook is right to be concerned about the use of WhatsApp to spread malware. But this lawsuit that attempts to use the already badly-abused CFAA to cover things Facebook doesn't like other people doing is going to cause collateral damage to researchers and journalists, rather than prevent NSO from selling WhatsApp-exploiting malware to government agencies.

Filed Under: cfaa, governments, hacking, liability, malware, privacy
Companies: facebook, nso, whatsapp

Report Says Saudi Prince MBS's Whatsapp Account Personally Sent Jeff Bezos Malware Used To Access His Phone

from the 21st-century-espionage dept

Things sure are getting even more bizarre in the world of the rich, famous, and powerful. Saudi Crown Prince Mohammed bin Salman (usually called "MBS") is now being accused of personally being involved in the hacking of Jeff Bezos' phone to get data that was eventually used against him by the National Enquirer. This is a soap opera-level story that involves a bit of background.

You may recall that, approximately a year ago, Jeff Bezos put out quite a Medium post, entitled: No thank you, Mr. Pecker, in which he exposed an attempt by David Pecker's National Enquirer to engage in what sure looks like a blackmail effort to silence Washington Post (which Bezos owns) reporting efforts. The post came about a month after the National Enquirer had released evidence of an affair that Bezos was having, including releasing personal text messages (the National Enqurier release came hours after Bezos himself announced he was getting a divorce from his wife). According to Bezos' blog post, the Enquirer had also threatened to release personal photos of Bezos if he did not call off an investigation he had launched into how the National Enquirer had obtained those text messages.

A little over a month and a half later, the investigator that Bezos had hired, Gavin de Becker, announced that he believed Saudi Arabia was involved in obtaining Bezos's personal data, adding a bit of international intrigue to the whole thing. de Becker argued that the evidence pointed to the Saudis much more than Michael Sanchez, the brother of the woman with whom Bezos was having the affair, who had claimed that he had given the data to the National Enquirer. As de Becker noted, Sanchez seemed to be a fall guy to distract from the possible Saudi connection:

My office quickly identified the person whom the Enquirer had paid as a source: a man named Michael Sanchez, the now-estranged brother of Lauren Sanchez, whom Bezos was dating. What was unusual, very unusual, was how hard AMI people worked to publicly reveal their source’s identity. First through strong hints they gave to me, and later through direct statements, AMI practically pinned a “kick me” sign on Michael Sanchez.

de Becker's investigation pointed out that the National Enquirer had contacted Sanchez first about the affair, suggesting that the attempt to work with him may have been a case of parallel construction, rather than an original source.

Saudi Arabia's potential involved was fascinating -- as the Saudi government, and MBS, have apparently been upset about the Washington Post publishing columns critical of the Saudi government by Jamal Khashoggi -- the journalist who was then killed by Saudi operatives in late 2018, in an operation that many blamed on MBS, and which MBS has eventually taken responsibility for. That murder has brought a lot more critical attention to MBS and his efforts to stomp out criticism.

So now we finally get to the latest news, in which the Guardian first reported that the real way that Bezos' text messages and photos were accessed was because MBS sent Bezos a Whatsapp message that contained the malware payload.

The encrypted message from the number used by Mohammed bin Salman is believed to have included a malicious file that infiltrated the phone of the world’s richest man, according to the results of a digital forensic analysis.

This analysis found it “highly probable” that the intrusion into the phone was triggered by an infected video file sent from the account of the Saudi heir to Bezos, the owner of the Washington Post.

The two men had been having a seemingly friendly WhatsApp exchange when, on 1 May of that year, the unsolicited file was sent, according to sources who spoke to the Guardian on the condition of anonymity.

A related story noted that Bezos and MBS had met a few weeks earlier at a Hollywood dinner organized by filmmaker Brian Grazer and agent Ari Emanuel (what a dinner that must have been) at a time when MBS was trying to ingratiate himself with both the American tech and entertainment industries (efforts that began to run into some issues after the murder of Khashoggi). Bezos and MBS apparently began communicating by Whatsapp after that dinner, and in the midst of the conversation, MBS passed along the link.

The Guardian understands a forensic analysis of Bezos’s phone, and the indications that the “hack” began within an infected file from the crown prince’s account, has been reviewed by Agnès Callamard, the UN special rapporteur who investigates extrajudicial killings. It is understood that it is considered credible enough for investigators to be considering a formal approach to Saudi Arabia to ask for an explanation.

While the Guardian does not share the full report (or even say who wrote it), Vice Motherboard has since obtained the report, and provides even more details:

The report, obtained by Motherboard, indicates that investigators set up a secure lab to examine the phone and its artifacts and spent two days poring over the device but were unable to find any malware on it. Instead, they only found a suspicious video file sent to Bezos on May 1, 2018 that “appears to be an Arabic language promotional film about telecommunications.”

That file shows an image of the Saudi Arabian flag and Swedish flags and arrived with an encrypted downloader. Because the downloader was encrypted this delayed or further prevented “study of the code delivered along with the video.”

Investigators determined the video or downloader were suspicious only because Bezos’ phone subsequently began transmitting large amounts of data. “[W]ithin hours of the encrypted downloader being received, a massive and unauthorized exfiltration of data from Bezos’ phone began, continuing and escalating for months thereafter,” the report states.

The report highlights that this new massive amount of data flow "never returned to baseline" suggesting that the link certainly did something to his phone that started sending all Bezos' data elsewhere. The report includes some fairly fascinating screenshots, including first how Bezos and MBS connected on Whatsapp:

And then there's a screenshot of the random video link that supposedly lead to the infection of Bezos' phone:

The story then gets even crazier, as it alleges that a few months later, MBS sent two more odd texts to Bezos:

The first such text was sent to Bezos from MBS' account on November 8, 2018, and contained a single photograph of a woman resembling Lauren Sanchez, with whom Bezos was having a then-secret personal relationship. For context, this was after the relationship would have been obvious to persons with access to private texts, calls, and images on Bezos' phone, but months before the relationship was known or reported publicly. The photo and the cryptic caption were sent precisely during the period Bezos and his wife were exploring divorce. "Arguing with a woman is like reading the Software License agreement. In the end you have to ignore everything and click I agree." (Memes such as this were available on the Internet, however the content of the text was not typical of any past communication from MBS, making it likely it was sent with reference to Bezos' personal life events at the time.

The second text was also somewhat creepy -- and also somewhat counterproductive. The two hadn't communicated for a while, and yet just a couple days after Bezos was given a briefing about how the Saudis were mounting a big online campaign against him, MBS randomly texted Bezos not to believe everything he's heard:

The second text demonstrates awareness of non-public information that could have been gained via surveillance of Bezos' phone was sent to Bezos from MBS's WhatsApp account, after more than three (3) months of no communication between the parties. On February 14, 2019, Bezos was provided a detailed briefing about the extent of the Saudi online campaign against him. The briefing was provided in two (2) calls on the Bezos' phone. This text evinces an awareness of what Bezos had just been told:

It seems a bit galaxy brain to suddenly pop up with a message like, telling Bezos not to believe all he'd heard about Saudi attempts to hack him, in a manner that basically would confirm that the Saudi's had access to his private conversations. Though, to be fair, it is possible that MBS's message was not in reference to private briefings, but rather in reference to Bezos' own Medium blog post (referenced at the top of this story) which had come out a week earlier, and had mentioned the possibility of Saudi involvement with the National Enquirer. So there is a potentially non-nefarious explanation for this particular text.

However, it does seem that it was this latter text that caused Bezos and de Becker to begin seriously investigating whether or not the Saudis had hacked Bezos' phone, because it was the very next day that de Becker agreed to get Bezos' phone analyzed.

In response to all of this, two UN Special Rapporteurs, Agnes Callamard, UN Special Rapporteur on summary executions and extrajudicial killings, and David Kaye, UN Special Rapporteur on freedom of expression, have put out a call for an investigation into MBS's role in all of this:

"The information we have received suggests the possible involvement of the Crown Prince in surveillance of Mr. Bezos, in an effort to influence, if not silence, The Washington Post's reporting on Saudi Arabia. The allegations reinforce other reporting pointing to a pattern of targeted surveillance of perceived opponents and those of broader strategic importance to the Saudi authorities, including nationals and non-nationals. These allegations are relevant as well to ongoing evaluation of claims about the Crown Prince's involvement in the 2018 murder of Saudi and Washington Post journalist, Jamal Khashoggi.

"The alleged hacking of Mr. Bezos's phone, and those of others, demands immediate investigation by US and other relevant authorities, including investigation of the continuous, multi-year, direct and personal involvement of the Crown Prince in efforts to target perceived opponents.

"This reported surveillance of Mr. Bezos, allegedly through software developed and marketed by a private company and transferred to a government without judicial control of its use, is, if true, a concrete example of the harms that result from the unconstrained marketing, sale and use of spyware. Surveillance through digital means must be subjected to the most rigorous control, including by judicial authorities and national and international export control regimes, to protect against the ease of its abuse. It underscores the pressing need for a moratorium on the global sale and transfer of private surveillance technology.

"The circumstances and timing of the hacking and surveillance of Bezos also strengthen support for further investigation by US and other relevant authorities of the allegations that the Crown Prince ordered, incited, or, at a minimum, was aware of planning for but failed to stop the mission that fatally targeted Mr. Khashoggi in Istanbul.

At a time when Saudi Arabia was supposedly investigating the killing of Mr. Khashoggi, and prosecuting those it deemed responsible, it was clandestinely waging a massive online campaign against Mr. Bezos and Amazon targeting him principally as the owner of The Washington Post."

The whole story is completely crazy -- and feels like a made up Hollywood movie of the kind Grazer might produce -- rather than a true story involving two of the world's richest and most powerful men. Anyway, in the meantime, never click on random videos sent to you by rich autocrats with a history of oppression.

Filed Under: ari emmanuel, brian grazer, david pecker, gavin de becker, hacking, jeff bezos, malware, mbs, mohammad bin salman, phones
Companies: whatsapp