This week, WIRED reports an alarming phenomenon of real warships whose location is rigged by an unknown disbeliever. Over the past few months, dozens of ships have appeared to be crossing contested waters when they were in fact hundreds of miles away. The disinformation came in the form of simulated AIS tracking data, which appears on aggregation sites like MarineTraffic and AISHub. It’s unclear who is responsible, or how exactly they are doing, but it does hold a game dangerously close to barrels of gunpowder in Crimea and elsewhere.
Speaking of controversy, a pair of researchers this week released a tool to the world that crawls every website for vulnerabilities in low hanging fruit – think SQL injections and cross-site scripting – and makes the results not only public but searchable. This is actually the second iteration of the system, known as the Punkspider; they closed the first one after numerous complaints to their hosting provider. Much of the same criticism remains this time around, leaving Punkspider’s long-term fate in doubt.
Apple presents itself as the large, most privacy-friendly tech company over there, and it’s done much to support this reputation. But we took a look this week at a major step towards consumer privacy that the company is definitely not taking: Implementing a global privacy control that would allow Safari and iOS users to automatically stop most followings.
Our British colleagues also spoke with a cam girl passing by Coconut Kitty who used digital effects to make themselves look younger live. In many ways, this could be the future of adult content, which has potential repercussions far beyond just that one Only Fans account.
And there’s more. Each week, we put together all the security news that WIRED hasn’t covered in depth. Click on the titles to read the full stories and stay safe.
A joint opinion from law enforcement agencies in the US, UK and Australia this week identified the 30 most exploited vulnerabilities. Perhaps unsurprisingly, the list includes a preponderance of flaws that were publicly disclosed years ago; everything on the list has a fix available for anyone who wants to install it. But as we have written on repeatedly, many companies are slow to push updates for all kinds of reasons, whether it’s resources, know-how, or the inability to cope with the downtime often required for a software update. Given how many of these vulnerabilities can lead to remote code execution (which you don’t want), hopefully they’ll start making fixes a priority.
An app called Doxcy billed itself as a dice game, but actually gave anyone who downloaded it access to content from Netflix, Amazon Prime, and more once they entered a password. in the search bar. Apple has removed the app from the App Store after Gizmodo inquires, but you probably shouldn’t have installed it anyway; it was riddled with ads and likely mishandled your data. All in all, you had better pay a subscription.
In early July, the Iranian rail system suffered a cyberattack that looked a lot like an elaborate troll; hackers posted messages on screens suggesting passengers to call Supreme Leader Khamenei’s office for help. Further inspection by security firm SentinelOne, however, shows that the malware was in fact a wiper, designed to destroy data rather than just hold it hostage. The malware that researchers call Meteor appears to have come from a new threat actor and lacked some degree of finishing. Which is happy for whoever they decide to target next.
Last week, Amnesty International and more than a dozen other organizations released a report on how authoritarian governments abused NSO Group spyware to spy on journalists and political rivals. Shortly after, the Israeli government visited the offices of the famous surveillance provider in that country. The NSO group has repeatedly and forcefully denied Amnesty International’s report, but national pressure appears to have intensified after names like French President Emmanuel Macron appeared on a list of potential spyware targets.
The Justice Department revealed on Friday that Cozy Bear, the pirates behind the SolarWinds hacking and other sophisticated spy campaigns, also broke into at least one email account in 27 US prosecutor’s offices last year. Eighty percent of email accounts used at the four New York-based US attorney’s offices have been compromised. The campaign likely gave them access to all kinds of sensitive information, which the Russian government will surely use responsibly.
More great WIRED stories
Top 30 Cyber Security Bugs Include Many Common Suspects
Source link Top 30 Cyber Security Bugs Include Many Common Suspects