European Law Enforcement Officials Upset Facebook Is Warning Users Their Devices May Have Been Hacked

from the screw-the-little-people,-we've-got-bad-guys-to-hack dept

Oh boy. Facebook has just added fuel to the anti-encryption fire. And by doing nothing more than something it should be doing: notifying users that their device may have been compromised by malware.

The Wall Street Journal article covering this standard notification is full of quotes from government officials who aren't happy a suspected terrorist was informed his phone had possibly been infected by targeted malware. [Non-paywalled version here.]

A team of European law-enforcement officials was hot on the trail of a potential terror plot in October, fearing an attack during Christmas season, when their keyhole into a suspect’s phone went dark.

WhatsApp, Facebook Inc. ’s popular messaging tool, had just notified about 1,400 users—among them the suspected terrorist—that their phones had been hacked by an “advanced cyber actor.” An elite surveillance team was using spyware from NSO Group, an Israeli company, to track the suspect, according to a law-enforcement official overseeing the investigation.

Facebook is no fan of NSO Group. In fact, very few people are fans of NSO Group, other than their customers, which have included UN-blacklisted countries and a number of governments that rank pretty high on the Most Human Rights Violated charts. Facebook sued NSO back in November, making very questionable allegations about CFAA violations. Facebook's servers were never targeted by NSO's malware. Only end users were, which makes it pretty difficult for Facebook to claim it has been personally (so to speak) injured by NSO's actions.

Back to the matter at hand, Facebook didn't just warn suspected terrorists about detected malware.

WhatsApp’s Oct. 29 message to users warned journalists, activists and government officials that their phones had been compromised, Facebook said. But it also had the unintended consequence of potentially jeopardizing multiple national-security investigations in Western Europe about which Facebook hadn’t been alerted—and about which government agencies can’t formally complain, given their secret nature.

Would these government officials rather have not been warned about threats? Were any of these government officials receiving warnings the same ones now complaining the warning allowed a terrorism suspect to vanish? Maybe so. The one quoted in the article seems very short-sighted.

On the day WhatsApp sent its alert, the official overseeing the terror investigation in Western Europe said, he was stuck in traffic on his way to work when a call came in from Israel. “Have you seen the news? We’ve got a problem,” he said he was told. WhatsApp was notifying suspects whom his team was tracking that their phones had been hacked. “No, that can’t be right. Why would they do that?” the official said he asked his contact, thinking it a joke.

"Why would they do that" indeed. Maybe to protect their users from cybercriminals and state-sponsored hackers. It's not about allowing suspected criminals to dodge law enforcement, even though it will undoubtedly have that effect. It's about keeping users and their communications protected -- users that include journalists, activists, and government officials.

This response indicates the investigators pursuing the suspected terrorist would rather hundreds of innocent people be harmed than someone suspected of terrorism go free. But it really doesn't matter what unnamed officials think about Facebook's "you may have been compromised" notifications or the harm these might do to ongoing investigations. Facebook's voluntary warnings will soon be mandatory in Europe. By the end of 2020, all service providers and telcos will be obligated to warn customers of security threats.

That fact -- and the apparent willingness to allow innocent people to be victimized by targeted attacks -- makes the article's closing statement all the more ridiculous.

Gilles de Kerchove, the European Union’s counterterrorism coordinator, says encryption shouldn’t allow criminals to be “less accountable online than in real life.”

I have no idea what that means. I know what the official thinks it's supposed to mean -- that "online" is bad because sometimes criminals get away -- but even that interpretation doesn't make sense. Criminals discover their phones have been tapped and stop using those lines. Criminals talk to each other in person to avoid creating records of conversations. Criminals get tips from other criminals they're under surveillance. This stuff just happens. Investigations don't always run smoothly.

A standard warning about possibly-compromised devices and services is just good business -- something that protects everyone who uses the service, not just the people governments think are OK to protect. These warnings are essential and they benefit everyone, not just the people governments want to lock up.

Filed Under: disclosure, europe, hacking, law enforcement, malware, terrorists
Companies: facebook, nso group, whatsapp

Academic Publishers Get Their Wish: DOJ Investigating Sci-Hub Founder For Alleged Ties To Russian Intelligence

from the oh-come-on dept

We've written plenty about Sci-Hub over the years. The service, which was set up to allow free and easy access to academic research that is all-to-often hidden behind insanely expensive paywalls (often, despite being paid for with public funds), is the bane of academic publishers, though the hero to many academics. As we've highlighted, the big publishers keep playing whac-a-mole with the service as they try to take it down around the globe, and each time it just seems to get the site more attention. From the earliest days, it's been clear that Sci-Hub works by getting academics with access to various collections to "donate" their login credentials, so that Sci-Hub can fetch any missing papers not in its collection (if it, and its associated site Libgen, already have it, they make that version available).

However, the Washington Post is now claiming that the DOJ has been investigating Sci-Hub founder, Alexandra Elbakyan, who started the site as an academic herself who found it nearly impossible to access the research she needed. But here's the twist, apparently the DOJ is alleging that Elbakyan is somehow tied to Russian intelligence.

It’s unclear whether Elbakyan is using Sci-Hub’s operations in service of Russian intelligence, but her critics say she has demonstrated significant hacking skills by collecting log-in credentials from journal subscribers, particularly at universities, and using them to pilfer vast amounts of academic literature.

The investigation has both criminal and intelligence-gathering elements, according to the people familiar with the matter, who spoke on the condition of anonymity to discuss an ongoing probe.

A former senior U.S. intelligence official said he believes Elbakyan is working with Russia’s military intelligence arm, the GRU, the same organization that stole emails from the Democratic National Committee and Hillary Clinton’s campaign chairman and then provided them to WikiLeaks in 2016.

Given the typical demonization of those who seek to open up access to academic research (see: Swartz, Aaron), I'd take this report with a pretty large grain of salt until some actual evidence is provided.

Some of the accusations -- provided in the article by Elsevier's lawyer, who has worked on cases against Sci-Hub -- claim that rather than academics sharing their credentials willingly, Sci-Hub has resorted to phishing to get them. If true, that would be quite unfortunate. And, at one point in the article, Elbakyan might admit to as much, though it's not clear if the full context of the question or response from her is included in the article:

“We’ve seen phishing, that’s most common,” he said, referring to the use of deceit to trick someone into providing a username and password. “But also password-breaking,” Pitts added, suggesting Elbakyan uses more-aggressive hacking techniques.

“I do not deny that some accounts that Sci-Hub is using were obtained” in such a way, Elbakyan said, but she declined to elaborate on how she comes by credentials.

If true, that would be disappointing. But it still seems like a lot more evidence would be necessary to argue that it's a tool of Russian intelligence.

Filed Under: academic papers, alexandra elbakyan, copyright, doj, hacking, open access, passwords, phishing, research, russia, russian intelligence
Companies: sci-hub

Facebook's Sues Israeli Malware Marketer With A Lawsuit That Aims To Make An Easily-Abused Law Even More Abusable

from the OK-BOOMER dept

Facebook is suing Israeli exploit developer NSO Group for utilizing WhatsApp to target 1,400 users with malware that allowed NSO's clients to circumvent the chat app's end-to-end encryption.

That NSO is being accused of helping bad people surveill good people is not news. NSO is not very selective when it comes to selling malware, putting its powerful tech in the hands of governments that seem just as likely to target NSO's home country as they are to target local dissidents, journalists, and activists. NSO's software and cavalier approach to sales have been exposed by multiple Citizen Lab investigations, which have outed NSO's sales to blacklisted countries.

Facebook's lawsuit [PDF] basically echoes the findings of Citizen Lab.

In a lawsuit filed in federal court in San Francisco, messaging service WhatsApp, which is owned by Facebook Inc (FB.O), accused NSO of facilitating government hacking sprees in 20 countries. Mexico, the United Arab Emirates and Bahrain were the only countries identified.

WhatsApp said in a statement that 100 civil society members had been targeted, and called it “an unmistakable pattern of abuse.”

Abusive it is, especially when you're trying to tout the benefits of end-to-end encryption, only to have a malware developer show you how easy it is to route around these protections. NSO's malware was spread using WhatsApp's video chat feature, which apparently allowed government agencies to eavesdrop on communications and possibly access device contents.

This isn't the only lawsuit NSO is facing.

NSO came under particularly harsh scrutiny over the allegation that its spyware played a role in the death of Washington Post journalist Jamal Khashoggi, who was murdered at the Saudi Consulate in Istanbul a little over a year ago.

Khashoggi’s friend Omar Abdulaziz is one of seven activists and journalists who have taken the spyware firm to court in Israel and Cyprus over allegations that their phones were compromised using NSO technology. Amnesty has also filed a lawsuit, demanding that the Israeli Ministry of Defense revoke NSO’s export license to “stop it profiting from state-sponsored repression.”

This matters enough to NSO for it to engage in a very limited charm offensive. It has promised to abide by UN guidelines on human rights abuses, which means it's going to have to trim a few countries off its client list. It also claims to have saved the lives of "tens of thousands" of people. It's a great claim to make, especially when no one really expects you to back up it up with evidence or data.

But the lawsuit Facebook is pursuing is questionable, if not a bit dangerous. Facebook likely doesn't have a way to block NSO clients from accessing WhatsApp. It has permanently deleted the accounts of every employee of NSO Group it could find for "violating" Facebook's terms of use. But it's helpless to root out accounts used by NSO's customers, since these aren't nearly going to be as obvious as those belonging to people who list NSO as their employer.

That explains the lawsuit and Facebook's desire to obtain a permanent injunction against NSO Group, blocking it from utilizing WhatsApp to spread malware. But the lawsuit is on pretty shaky legal ground. Worse, if Facebook somehow prevails, the much-abused CFAA will be rewritten in a way that's going to harm plenty of people who've never sold malware to known human rights abusers.

Here's Wired's Andy Greenberg (and defense attorney Tor Ekeland) explaining just one of the problematic aspects of Facebook's lawsuit.

To make that charge stick, WhatsApp will have to show that NSO obtained illegal access to WhatsApp's own systems. Given that NSO's targets were WhatsApp users rather than, say, WhatsApp's servers, they'll have to find an argument that they, as the plaintiff, were the victim. "The fundamental question is, what’s the unauthorized access?" says Ekeland. "You might be able to argue that NSO hacked WhatsApp and not just their users. Maybe they’re trying to make that argument. But they’re not being clear about it, and that lack of clarity is an attack vector for the defendant."

Facebook's on a clear path if it chooses to stick with the argument NSO violated its terms of service. Those terms specifically forbid reverse-engineering code or sending malware via the app. But even if it's limited to that, the obvious solution is for Facebook to ban NSO from using its services. That may be close to impossible to do since Facebook doesn't have access to its client list or their user accounts. Arguing past that point may cause problems, though.

While it may work out for Facebook to have the CFAA cover "uses of our stuff that we don't like," it's going to harm a lot of other people. Security researchers, regular researchers, and anyone else who might use Facebook's platform or apps in a way Facebook doesn't like could be prosecuted or sued under this definition. While it's plainly advantageous for Facebook to force all users to use its products only in a way it approves, the downside is a garden with higher walls that put users completely at the mercy of Facebook. Since terms of use can be rewritten on the fly and applied immediately, Facebook could go after "violators" who aren't even aware they've actually violated anything.

Adding to Facebook's hurdles is a recent Ninth Circuit Court of Appeals ruling (this lawsuit is filed in the Ninth Circuit) that says scraping a site for data -- even when forbidden by the terms of use -- isn't necessarily a violation of the CFAA. Making this tougher for Facebook is there's no evidence it ever gave NSO prior notice its abuse of WhatsApp was forbidden. The lack of notice makes it a bit more difficult for Facebook to claim NSO knowingly violated the terms by using WhatsApp to distribute malware. It will be tough to prove NSO clients had unauthorized access, especially since Facebook didn't get around to permabanning anyone until after it filed its lawsuit.

I'm no fan of NSO and its client list, but I'm no fan of Facebook's lawsuit, either. An opinion finding using internet services in a way their developers don't like is not the precedent we need -- not if we're going to keep pushing for a safer internet for everyone. It will allow dominant players to establish rules that benefit the platforms and stave off competition from third-party offerings that attempt to address shortcomings major platforms refuse to correct. It will also prevent researchers from making online services safer or better, which will be a net loss for all platform users, even if it prevents a handful of authoritarians from exploiting a single service to target the people they think need more surveilling.

There's a lot at stake here but Facebook can't see past its immediate (and somewhat convenient, given its recent rakings over Congressional coal) desire to appear to be the good guy for once.

Filed Under: cfaa, encryption, hacking, key logger, malware
Companies: facebook, nso group, whatsapp

Big News: Appeals Court Says CFAA Can't Be Used To Stop Web Scraping

from the this-is-good dept

Two years after a lower court correctly decided that LinkedIn couldn't use the CFAA to stop third parties from scraping their site, the 9th Circuit appeals court has upheld that decision in a very important decision for the future of an open web. For a long time we've talked about how various internet companies -- especially the large ones -- have abused the CFAA to stop competition and interoperability. If you're unaware, the CFAA is basically the US's "anti-hacking" law, which was designed to make it a crime (and a civil infraction) to "break into" someone else's computer. But for years it's been interpreted way too broadly (to the point that it's referred to as "the law that sticks" when trying to get someone for "doing something bad on a computer."

While we have tremendous concerns about criminal CFAA prosecutions, the use of CFAA in civil contexts by companies trying to block competition is perhaps just as troubling. We've called out Craigslist and, especially, Facebook for abusing the CFAA to stop companies from building on what they've built and providing a better service. To this day, we remain troubled by the 9th Circuit siding with Facebook in declaring the CFAA an okay tool to block a third party from building a better service for Facebook users and believe (somewhat strongly) that this particular decision and abuse is part of why Facebook is in the position its in today and that there are no significant competitors it faces. In that decision, the 9th Circuit ruled that because Facebook had sent a cease-and-desist letter to Power, any access after that was now "without authorization" and thus violated the CFAA.

And that's part of what makes this new HiQ v. Linkedin decision, done by the very same court, so fascinating. It seems to go the other way. While Facebook was allowed to use the CFAA to stop Power users from scraping content from Facebook (with permission from the account holder), here, the 9th Circuit has ruled that LinkedIn can't (at this stage) use the CFAA to stop HiQ from scraping its site.

The fact that the results in HiQ and Power came out differently deserves some exploration -- and we can highlight ways in which both decisions are weird and troubling. But from a pure policy standpoint, saying that scraping a site does not violate the law is an undeniably good thing and we should be happy with the overall outcome. Though, the it's now set up a weird system where the 9th Circuit itself seems to disagree with itself and there's a wider circuit split -- meaning it's possible that the Supreme Court could take up this issue at some point.

In discussing the CFAA, this 9th Circuit panel seems to fully understand the intention of the CFAA: to stop hacking. Not to stop companies from blocking people/companies they dislike:

The 1984 House Report on the CFAA explicitly analogized the conduct prohibited by section 1030 to forced entry: “It is noteworthy that section 1030 deals with an ‘unauthorized access’ concept of computer fraud rather than the mere use of a computer. Thus, the conduct prohibited is analogous to that of ‘breaking and entering’ . . . .’” H.R. Rep. No. 98-894, at 20 (1984); see also id. at 10 (describing the problem of “‘hackers’ who have been able to access (trespass into) both private and public computer systems”). Senator Jeremiah Denton similarly characterized the CFAA as a statute designed to prevent unlawful intrusion into otherwise inaccessible computers, observing that “[t]he bill makes it clear that unauthorized access to a Government computer is a trespass offense, as surely as if the offender had entered a restricted Government compound without proper authorization.”11 132 Cong. Rec. 27639 (1986) (emphasis added). And when considering amendments to the CFAA two years later, the House again linked computer intrusion to breaking and entering. See H.R. Rep. No. 99-612, at 5–6 (1986) (describing “the expanding group of electronic trespassers,” who trespass “just as much as if they broke a window and crawled into a home while the occupants were away”).

In recognizing that the CFAA is best understood as an anti-intrusion statute and not as a “misappropriation statute,” Nosal I, 676 F.3d at 857–58, we rejected the contract-based interpretation of the CFAA’s “without authorization” provision adopted by some of our sister circuits.

That's all good -- and because of that, the court finds that LinkedIn can't claim that scraping their site is a CFAA violation, even after a cease-and-desist. But, it tries to differentiate from the Facebook v. Power decision by saying that one involves a password, and the other does not. So it's the fact that the information being scraped on LinkedIn is public information that changes the calculus here.

We therefore conclude that hiQ has raised a serious question as to whether the reference to access “without authorization” limits the scope of the statutory coverage to computer information for which authorization or access permission, such as password authentication, is generally required. Put differently, the CFAA contemplates the existence of three kinds of computer information: (1) information for which access is open to the general public and permission is not required, (2) information for which authorization is required and has been given, and (3) information for which authorization is required but has not been given (or, in the case of the prohibition on exceeding authorized access, has not been given for the part of the system accessed). Public LinkedIn profiles, available to anyone with an Internet connection, fall into the first category. With regard to such information, the “breaking and entering” analogue invoked so frequently during congressional consideration has no application, and the concept of “without authorization” is inapt.

Neither of the cases LinkedIn principally relies upon is to the contrary. LinkedIn first cites Nosal II, 844 F.3d 1024 (9th Cir. 2016). As we have already stated, Nosal II held that a former employee who used current employees’ login credentials to access company computers and collect confidential information had acted “‘without authorization’ in violation of the CFAA.” Nosal II, 844 F.3d at 1038. The computer information the defendant accessed in Nosal II was thus plainly one which no one could access without authorization.

So too with regard to the system at issue in Power Ventures, 844 F.3d 1058 (9th Cir. 2016), the other precedent upon which LinkedIn relies. In that case, Facebook sued Power Ventures, a social networking website that aggregated social networking information from multiple platforms, for accessing Facebook users’ data and using that data to send mass messages as part of a promotional campaign. Id. at 1062–63. After Facebook sent a cease-and-desist letter, Power Ventures continued to circumvent IP barriers and gain access to password-protected Facebook member profiles. Id. at 1063. We held that after receiving an individualized cease-and-desist letter, Power Ventures had accessed Facebook computers “without authorization” and was therefore liable under the CFAA. Id. at 1067–68. But we specifically recognized that “Facebook has tried to limit and control access to its website” as to the purposes for which Power Ventures sought to use it. Id. at 1063. Indeed, Facebook requires its users to register with a unique username and password, and Power Ventures required that Facebook users provide their Facebook username and password to access their Facebook data on Power Ventures’ platform. Facebook, Inc. v. Power Ventures, Inc., 844 F. Supp. 2d 1025, 1028 (N.D. Cal. 2012). While Power Ventures was gathering user data that was protected by Facebook’s username and password authentication system, the data hiQ was scraping was available to anyone with a web browser.

That last bit... confuses me. Yes, the information that was at stake in the Power case was locked up with password protection, but (and this is the important part), it was the user whose password it was that gave permission to Power to access the data in Facebook on their behalf. So I have trouble seeing how it's really that different than this HiQ case. This ruling seems to suggest that there's some magical property to a password that doesn't seem supported by the law. In the Power case, the access is still very much "authorized" because the holder of the password is giving it out. But the court tries to dance around this by pretending that the authorization question is different. I don't see how that makes any sense -- even if I'm happy that at least scraping of public info is considered fair game. Still, the panel leans in hard on the password question to distinguish these two cases:

For all these reasons, it appears that the CFAA’s prohibition on accessing a computer “without authorization” is violated when a person circumvents a computer’s generally applicable rules regarding access permissions, such as username and password requirements, to gain access to a computer. It is likely that when a computer network generally permits public access to its data, a user’s accessing that publicly available data will not constitute access without authorization under the CFAA. The data hiQ seeks to access is not owned by LinkedIn and has not been demarcated by LinkedIn as private using such an authorization system. HiQ has therefore raised serious questions about whether LinkedIn may invoke the CFAA to preempt hiQ’s possibly meritorious tortious interference claim.

Orin Kerr -- who probably knows more about the CFAA than anyone else -- has done a deep dive on this ruling as well, which is worth reading. As he notes, part of the weirdness in this case is procedural. HiQ is focused on getting a preliminary injunction stopping LinkedIn from using the CFAA to stop them from scraping the LinkedIn site. That sets the standards a bit lower than might otherwise be, and means that the ruling is not necessarily the final world on the CFAA in this situation. He also notes that this should be seen as a big win for the open internet, and (in many ways) isolates the Power decision as "an outlier."

I also think this decision renders Power Ventures an outlier. I may be biased, as I thought Power Ventures was wrong. As regular readers may remember, I represented Power Ventures on the petition for rehearing to try to get the panel decision overturned. But Power Ventures seemed to give cease-and-desist letters magical powers given their clarity and notice. It was possible to read Power Ventures broadly as saying that as long as the computer owner sends the cease-and-desist letter, the computer owner's written directive controls the CFAA question—the recipient is sent into Brekka-land where their access rights were withdrawn.

HiQ Labs now places a critical limit on Power Ventures. Under HiQ Labs, the cease-and-desist letter only controls access rights to non-public data. That seems to reduce Power Ventures to a limited application of Nosal II. Under both Nosal II and Power Ventures-as-construed-in-HiQ, once a computer owner tells you to go away, you can't then rely on a current legitimate user's permission to let you back in.

Putting the cases together, the Ninth Circuit law right now seems to go like this. You can scrape a public website, and you can violate terms of service, without violating the CFAA. However, you can only access non-public areas of a computer if you haven't had your access rights canceled before, either through a cease-and-desist letter or through the relationship ending that had granted you access rights.

As Kerr and the 9th Circuit itself note, however, there remains a circuit split between the 9th's hodge podge interpretations of the CFAA and other appeals courts. That certainly suggests that this could end up before the Supreme Court at some point.

One other note: I've seen a few lawyers, including those I respect, worry that this decision could actually lead to restrictions on the tools that sites themselves use to block more malicious parties. As Eric Goldman noted in his analysis:

Meanwhile, if server operators can’t restrict who can access their servers, then it will embolden data scavengers–including trolls, malefactors, and governments–who intend to weaponize the data against users.

This is one of the rare cases where I disagree with Goldman's analysis. I don't see how the ruling would lead to such a result. The ruling does suggest that it's tortious interference (this is separate from the CFAA analysis) for LinkedIn to block HiQ, since doing so undermine's HiQ's entire business. But I don't see how that same analysis would apply "trolls, malefactors, and governments." I do find the tortious interference discussion a bit confusing in its own right. While I don't think LinkedIn should be able to use the law to stop HiQ from scraping its site, it seems silly (and of questionable legality) to argue that it can't even use technical measures to block HiQ. But that's what the ruling appears to say:

LinkedIn’s threats to invoke the CFAA and implementation of technical measures selectively to ban hiQ bots could well constitute “intentional acts designed to induce a breach or disruption” of hiQ’s contractual relationships with third parties.

I agree on the use of the CFAA. But disagree on the point about "technical measures." One involves using the power of the government to block perfectly reasonable activity -- but the other is a purely technical question. And I don't see how or why the law should block any site from implementing technical measures to prevent access, even if overall public policy should encourage such access.

All in all this seems like a mostly good decision, with this oddity, combined with the tap dance to distinguish it from other rulings. Add in the big circuit splits and you can rest assured that this is nowhere near the last word on this matter.

Filed Under: 9th circuit, authorized access, cfaa, hacking, open access, scraping, tortious interference
Companies: facebook, hiq, linkedin, power ventures

Microsoft Nabs Russian Hackers Exploiting Flimsy IOT Security

from the the-check-will-someday-come-due dept

Week after week we've documented how internet of things devices are being built with both privacy and security as a distant afterthought, resulting in everything from your television to your refrigerator creating both new attack vectors and wonderful new surveillance opportunities for hackers and state actors. And CIA leaks have indeed confirmed that "smart" TVs and other devices with embedded microphones make for wonderful surveillance tools.

So it's not too surprising to see Microsoft's Security Response Center proclaim this week that it has caught Russian hacking group “Strontium" (aka Fancy Bear and APT28) using poorly secured printers, VoIP phones, and video decoders to gain access to sensitive networks. As is usually the case, Microsoft found that once these devices' security was bypassed (often an easy feat given there's sometimes little to no security measures in place), they were able to use them as a beach head to gain broader access to the networks they were connected to:

"After gaining access to each of the IoT devices, the actor ran tcpdump to sniff network traffic on local subnets. They were also seen enumerating administrative groups to attempt further exploitation. As the actor moved from one device to another, they would drop a simple shell script to establish persistence on the network which allowed extended access to continue hunting. Analysis of network traffic showed the devices were also communicating with an external command and control (C2) server."

In at least two instances, the hacks were only made possible thanks to hardware shipping with default username and password logins, something that has frequently plagued residential routers as well. Just as unsurprising as the hack was Microsoft's warning that this is a problem that's only going to get worse, regardless of the government or organization pulling the strings:

"While much of the industry focuses on the threats of hardware implants, we can see in this example that adversaries are happy to exploit simpler configuration and security issues to achieve their objectives,” the report noted. “These simple attacks taking advantage of weak device management are likely to expand as more IoT devices are deployed in corporate environments."

As security researchers like Bruce Schneier have long noted, there's some severe market failure driving this dysfunction. Companies don't want to spend money on security and privacy standards as they connect everything under the sun to the internet, and by the time vulnerabilities are discovered, they're off to selling the next big thing. Because the devices often don't provide insight into what they're doing, consumers routinely have no idea what the device is even doing on the network. And by the time vulnerabilities are addressed, consumers are off to buy the next big thing (with equally terrible security holes).

Year after year after year, we're connecting millions upon millions of devices to home and business networks with paper-mache grade security. And while there's some fleeting efforts to address the problem (like incorporating flaws into product reviews), it's still not something folks are taking seriously enough. And while such proclamations are often dismissed as hyperbole, it's something folks like Schneier predict isn't likely to change until these vulnerabilities result in some notable human casualties.

Filed Under: hacking, iot, russia, security
Companies: microsoft

Content Moderation At Scale Is Impossible: The Case Of YouTube And 'Hacking' Videos

from the how-do-you-deal-with-this? dept

Last week there was a bit of an uproar about YouTube supposedly implementing a "new" policy that banned "hacking" videos on its platform. It came to light when Kody Kinzie from Hacker Interchange, tweeted about YouTube blocking an educational video he had made about launching fireworks via WiFi:

Kinzie noted that YouTube's rules on "Harmful or dangerous content" now listed the following as an example of what kind of content not to post:

Instructional hacking and phishing: Showing users how to bypass secure computer systems or steal user credentials and personal data.

This resulted in some quite reasonable anger at what appeared to be a pretty dumb policy. Marcus "Malware Tech" Hutchins posted a detailed blog post on this change and why it was problematic, noting that it simply reinforces the misleading idea that all "hacking is bad."

Computer science/security professor J. Alex Halderman chimed in as well, to highlight how important it is for security experts to learn how attackers think and function:

Of course, some noted that while this change to YouTube's description of "dangerous content" appeared to date back to April, there were complaints about YouTube targeting "hacking" videos last year as well.

Eventually, YouTube responded to all of this and noted a few things: First, and most importantly, the removal of Kozie's videos was a mistake and the videos have been restored. Second, that this wasn't a "new" policy, but rather just the company adding some "examples" to existing policy.

This raises a few different points. While some will say that since this was just another moderation mistake and therefore it's a non-story, it actually is still an important point in highlighting the impossibility of content moderation at scale. You can certainly understand why someone might decide that videos that explain how to "bypass secure computer systems or steal user credentials and personal data" would be bad and potentially dangerous -- and you can understand the thinking that says "ban it." And, on top of that, you can see how a less sophisticated reviewer might not be able to carefully distinguish the difference between "bypassing secure computer systems" and some sort of fun hacking project like "launching fireworks over WiFi."

But it also demonstrates that there are different needs for different users -- and having a single, centralized organization making all the decisions about what's "good" and what's "bad," is inherently a problem. Going back to Hutchins' and Halderman's points above, even if the Kinzie video was taken down by mistake, and even if the policy is really supposed to be focused on nefarious hacking techniques, there is still value for security researchers and security professionals to be able to keep on top of what more nefarious hackers are up to.

This is not all that different than the debate over "terrorist content" online -- where many are demanding that it be taken down immediately. And, conceptually, you can understand why. But when we look at the actual impact of that decision, we find that removing such content appears to make it harder to stop actual terrorist activity, because it's now harder to track and to stop.

There is no easy solution here. Some people seem to think that there must be some magic wand that can be waved that says, "leave up the bad content for good people with good intentions to use to stop that bad behavior, but block it from the bad people who want to do bad things." But... that's not really possible. Yet, if we're increasingly demanding that these centralized platforms rid the world of "bad" content, at the very least we owe it to ourselves to look to see if that set of decisions has some negative consequences -- perhaps even worse than just letting that content stay up.

Filed Under: content moderation, content moderation at scale, hacking, hacking videos
Companies: youtube

Man Temporarily Nukes Five News Websites, Walks Away With Less Prison Time Than Matthew Keys, Who Attacked ZERO Websites

from the [shrug-emoji] dept

So, if someone can be sentenced to two years in prison for 40 minutes of newspaper website defacement performed by a party other than himself, it stands to reason someone who took down five websites would be looking at a minimum of ten years in jail.

Welcome to the hilarious and tragic world of CFAA-related sentencing. Matthew Keys was hit with a two-year sentence for supposedly sharing his login password (something Keys has steadfastly denied doing), an act that resulted in someone else subjecting the L.A. Times website to a 40-minute inconvenience. The momentary vandalism of the site's landing page suggested Congressional representatives were being pressured to elect CHIPPY 1337. No. Seriously. That was the extent of the "damage."

Once the DOJ decided this was worth pursuing under the CFAA, internal L.A. Times' emails regarding the "hack" suddenly cost $225/each to create. The feds wanted five years but settled for two. And while Matthew Keys served his sentence, no one in the federal government made any effort to locate the person who actually performed the website defacement.

A more serious hacking -- one that resulted in five news websites being completely unreachable for a short period of time -- has netted the "hacker" involved with a very lenient sentence.

The 36-year-old man who hacked and temporarily shut down Palo Alto Online and other Embarcadero Media websites nearly four years ago was sentenced Wednesday in San Jose federal court to time already served, one-year of home incarceration with electronic monitoring, three years of supervised release and $27,130 in restitution to the company.

Ross Colby was indicted on April 6, 2017, following an investigation by the Federal Bureau of Investigation of the Sept. 17, 2015, crime, which took down five news sites owned and operated by Palo Alto-based Embarcadero Media: Palo Alto Online, Mountain View Online, Almanac Online, PleasantonWeekly.com and DanvilleSanRamon.com.

Colby was convicted of all charges, but will only be serving zero years. The six months he spent in jail prior to his trial will be all the time he's required. Colby claimed -- during an interview with the FBI -- to have performed the hack at the request of a Menlo Park resident (Hiruy Amanuel) who wished to have stories about him removed from the websites. Amanuel, currently located in Ethiopia, denies he asked Colby to hack the sites.

Like in the Keys' case, the end result was a temporary defacement. But this hack also made the sites' content unreachable by readers. The temporary damage Colby caused was far more significant than the minor prank pulled by someone (not Matthew Keys!) with Keys' login info.

Colby deleted the content of all of Embarcadero's websites and replaced it with an image of Guy Fawkes, the icon of the activist group Anonymous, and posted a message stating: "Greetings, this site has been hacked. Embarcadero Media Group (Alamanac) (sic) has failed to remove content that has been harmful to the wellbeing and safety of others. Failure to honor all requests to remove content will lead to the permanent shutdown of all Embarcadero Media websites." Each website's URL was replaced with the text "Unbalanced journalism for profit at the cost of human right, Brought to you by the Almanac."

So, why the disparity in sentencing? Well, it boils down to several things, starting with the law itself. The law is broad and vague and can be beaten to fit/painted to match almost any "unauthorized access."

Furthermore, CFAA charges are confounding for juries, judges… even the DOJ itself. It's tough to assess the actual damages of a website defacement, so the DOJ relies on the aggrieved party, which has every motivation to portray momentary inconveniences as internet apocalypses. Meanwhile, judges and juries get swamped in techno-jargon, with no one to lead them in the promised land of "laymen's terms" but the prosecution.

In Colby's case, a couple of attempts to get him perceived as incapable of standing trial tried the court's patience, as did Colby's hiding of a recording of his interview with the FBI. And yet, he got less time than Keys did for a more serious attack on multiple websites -- one Colby actually performed, rather than farmed out to a willing miscreant.

Because the law makes so little sense, the outcomes will be nonsensical. The only hope is a complete rewriting of the law -- one that takes charging security researchers and internet jokesters out of the equation. The government may claim harsh sentences are needed to act as a deterrent, but this assertion makes no sense when it showed zero interest in finding the person who actually defaced a Tribune website with borrowed credentials.

Filed Under: cfaa, hacking, hiruy amanuel, matthew keys, news websites, ross colby
Companies: palo alto online

Julian Assange Arrested On Behalf Of The US, For Trying To Help Manning Crack CIA Password

from the cfaa-and-conspiracy dept

Julian Assange has been arrested in the UK on behalf of the US, as Ecuador has finally tired of their overstaying asylumed house guest. We're about to see quite a major legal battle, first in the UK and then almost certainly in the US, about Assange. The current charges seem narrowly focused on a CFAA-based "conspiracy" between Assange and Manning to try to hack a CIA computer, but if they expand to other Wikileaks activities, there should be concerns over press freedom issues.

I am no fan of Julian Assange or Wikileaks. However, for years I've made it clear that prosecuting him for publishing leaked documents would be a huge mistake by the US. The DOJ spent years trying to come up with an excuse to charge Assange, but kept realizing they had no case, because while he may have had malicious intent, none of his public actions in releasing documents were any different -- legally speaking -- than what any investigative journalism outlet did in releasing obtained documents. The Supreme Court has made it clear that publishing classified documents is protected by the First Amendment. If he went beyond just releasing documents, as the indictment alleges, it becomes a lot trickier -- but there's a fine line here.

It's been clear in the last year or so, that despite years of not finding anything, the DOJ was finally moving ahead with plans to charge him. As we noted last year, everyone who believes in a free press should be concerned about what this might mean for press freedoms in the US as the case proceeds. And that's true, even if the specific charges right now are limited to actions that are unrelated to the publishing of the documents.

A few minutes ago, the DOJ released a fairly barebones 7-page indictment, alleging he was in a conspiracy with Chelsea Manning to hack into government computers to obtain documents. From the indictment, the charges are separate from releasing the documents that everyone knows Manning provided to Assange, and specifically revolve around Manning and Assange apparently working together to try to hack the CIA after Manning had finished handing over all of the documents we already know about. The indictment claims (and I kid you not) that Manning "used special software, namely a Linux operating system... to obtain the portion of the password provided to Assange." What was obtained apparently was a hashed password to a CIA computer system, that Assange was allegedly going to try to crack, in order to enable Manning to get more info out of the CIA.

If all of this is true, then it certainly could go beyond issues related to press freedoms. It's one thing to receive classified documents and publish them. It is a different issue altogether to work with a source and participate in trying to hack a government system. There is no evidence that Assange was ever actually successful in cracking the password, but he's facing CFAA and conspiracy charges here that may have more staying power. If the indictment is accurate and there's evidence to back it up, then Assange could potentially be in (and this is the legal term) deep shit.

But so much of what Assange did, even if we might disagree with his reasons for doing it, is little different than what many media organizations do. What will be necessary is watching closely how the case against Assange advances and changes (it is unlikely that these will be the only charges against Assange). If it is narrowly limited to the actions described in the current indictment, the dangers to press freedoms may be limited. However, if it strays beyond that into some of the other, more journalistic efforts of Assange, it could still represent a huge attack on a free press. Given our current President's near daily attacks on the free press, with repeated announcements that he'd like to change the laws to harm them, going after Assange legally (which may seem a bit ironic, given all the accusations that Assange's leaks in 2016 were designed to help Trump get elected), might be the best way to actually achieve that goal.

Filed Under: cfaa, chelsea manning, cia, conspiracy, doj, hacking, julian assange, passwords

New Japanese Law Lets Government Hack IOT Devices, Warn Owners They're Vulnerable

from the internet-of-broken-things dept

By now we've established pretty clearly that the well-hyped "internet of things" sector couldn't actually care less about security or privacy. Companies are in such a rush to cash in on our collective thirst for internet connected tea kettles and not-so-smart televisions, they don't much care if your new gadget was easily hacked or integrated into a DDoS botnet. And by the time security and privacy flaws have been discovered, companies and consumers alike are off to hyperventilate about the next must-have gadget, leaving untold millions of devices in the wild as new potential points of entry into home and business networks.

While most countries hem and haw without doing much of anything about the problem, Japan's government this week proposed a unique legislative solution. A new Japanese law (pdf) passed this week authorizes the Japanese government to actually hack into poorly-secured internet of things devices as part of the country's attempt to conduct a survey measuring the real scale of the problem:

"The survey will be carried out by employees of the National Institute of Information and Communications Technology (NICT) under the supervision of the Ministry of Internal Affairs and Communications. NICT employees will be allowed to use default passwords and password dictionaries to attempt to log into Japanese consumers' IoT devices.

Devices shipped with default username and passwords that users are too lazy (or technically incompetent) to change continue to be a huge problem in IOT devices and routers alike. Once the Japanese government has confirmed the vulnerability, it intends to send notices to impacted users in a bid to try and scare them into actually securing the devices. A Ministry of Internal Affairs and Communications report (pdf) was quick to note that attacks targeting poorly-secured IOT devices comprised two-thirds of all cyberattacks in 2016.

Obviously letting the government hack into consumer and business devices isn't being welcomed warmly in Japan, where many understandably don't trust government with such a task. But it's worth noting these kinds of "solutions" are only emerging in the wake of years of apathy contributing to a global crisis. A crisis many experts say will, inevitably, result in potential mass casualties as essential infrastructure becomes increasingly vulnerable. Collectively we've largely yawned at the problem since much of its impact is what security expert Bruce Schneier calls "invisible pollution:

"The market can't fix this because neither the buyer nor the seller cares. The owners of the webcams and DVRs used in the denial-of-service attacks don't care. Their devices were cheap to buy, they still work, and they don't know any of the victims of the attacks. The sellers of those devices don't care: They're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution, because the insecurity is what economists call an externality: It's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

While other solutions for this problem are being explored (like mandating the inclusion of privacy and security issues in product reviews), they've been few and far between in actually materializing, since giving a damn will actually cost money. Experts like Schneier have long argued that given this market and consumer failure, government needs to play some role in coordinating some rules of the road for flimsy IOT security. Perhaps letting government itself hack into your poorly secured Barbie is a bridge too far (who'd follow up to confirm government didn't abuse the privilege?). But if that's the case, what's the solution?

Filed Under: hacking, iot, japan, nict, proactive hacking, security