Paige Thompson, a former Amazon employee accused of stealing the personal information of 100 million customers by breaching banking giant CapitalOne in 2019, has been found guilty by a Seattle jury on charges of wire fraud and computer hacking. From a report: Thompson, 36, was accused of using her knowledge as a software engineer working in the retail giant's cloud division, Amazon Web Services, to identify cloud storage servers that were allegedly misconfigured to gain access to the cloud stored data used by CapitalOne. That included names, dates of birth, Social Security numbers, email addresses and phone numbers, and other sensitive financial information, such as credit scores, limits and balances. Some one million Canadians were also affected by the CapitalOne breach. Thompson also accessed the cloud stored data of more than 30 other companies, according to a superseding indictment filed by the Justice Department almost two years after Thompson was first charged, which reportedly included Vodafone, Ford, Michigan State University and the Ohio Department of Transportation.

Police forces around the world have increasingly used hacking tools to identify and track protesters, expose political dissidents' secrets, and turn activists' computers and phones into inescapable eavesdropping bugs. Now, new clues in a case in India connect law enforcement to a hacking campaign that used those tools to go an appalling step further: planting false incriminating files on targets' computers that the same police then used as grounds to arrest and jail them. Wired: More than a year ago, forensic analysts revealed that unidentified hackers fabricated evidence on the computers of at least two activists arrested in Pune, India, in 2018, both of whom have languished in jail and, along with 13 others, face terrorism charges. Researchers at security firm SentinelOne and nonprofits Citizen Lab and Amnesty International have since linked that evidence fabrication to a broader hacking operation that targeted hundreds of individuals over nearly a decade, using phishing emails to infect targeted computers with spyware, as well as smartphone hacking tools sold by the Israeli hacking contractor NSO Group. But only now have SentinelOne's researchers revealed ties between the hackers and a government entity: none other than the very same Indian police agency in the city of Pune that arrested multiple activists based on the fabricated evidence.

"There's a provable connection between the individuals who arrested these folks and the individuals who planted the evidence," says Juan Andres Guerrero-Saade, a security researcher at SentinelOne who, along with fellow researcher Tom Hegel, will present findings at the Black Hat security conference in August. "This is beyond ethically compromised. It is beyond callous. So we're trying to put as much data forward as we can in the hopes of helping these victims." SentinelOne's new findings that link the Pune City Police to the long-running hacking campaign, which the company has called Modified Elephant, center on two particular targets of the campaign: Rona Wilson and Varvara Rao. Both men are activists and human rights defenders who were jailed in 2018 as part of a group called the Bhima Koregaon 16, named for the village where violence between Hindus and Dalits -- the group once known as "untouchables" -- broke out earlier that year. (One of those 16 defendants, 84-year-old Jesuit priest Stan Swamy, died in jail last year after contracting Covid-19. Rao, who is 81 years old and in poor health, has been released on medical bail, which expires next month. Of the other 14, only one has been granted bail.)

The US defence contractor L3Harris is in talks to take over NSO Group's surveillance technology, in a possible deal that would give an American company control over one of the world's most sophisticated and controversial hacking tools. From a report: Multiple sources confirmed that discussions were centred on a sale of the Israeli company's core technology â" or code â" as well as a possible transfer of NSO personnel to L3Harris. But any agreement still faces significant hurdles, including requiring the blessing of the US and Israeli governments, which have not yet given the green light to a deal. In a statement, a senior White House official said: "Such a transaction, if it were to take place, raises serious counterintelligence and security concerns for the US government." If agreed, the deal would mark an astounding turnaround for NSO, less than a year after the Biden administration placed the company on a US blacklist and accused it of acting "contrary to the foreign policy and national security interests of the US."

"Paige Thompson worked as a software engineer in Seattle and ran an online community for other programmers," remembers the New York Times. [Alternate URL here and here.]

"In 2019, she downloaded personal information belonging to more than 100 million Capital One customers, the Justice Department said..." It included 140,000 Social Security numbers and 80,000 bank account numbers (drawn from applications for credit cards). Nearly three years after the disclosure of one of the largest data breaches in the United States, the former Amazon employee accused of stealing customers' personal information from Capital One is standing trial in a case that will test the power of a U.S. anti-hacking law.... She faces 10 counts of computer fraud, wire fraud and identity theft in a federal trial that began Tuesday in Seattle.... Thompson, 36, is accused of violating an anti-hacking law known as the Computer Fraud and Abuse Act, which forbids access to a computer without authorization. Thompson has pleaded not guilty, and her lawyers say her actions — scanning for online vulnerabilities and exploring what they exposed — were those of a "novice white-hat hacker."

Critics of the computer fraud law have argued that it is too broad and allows for prosecutions against people who discover vulnerabilities in online systems or break digital agreements in benign ways, such as using a pseudonym on a social media site that requires users to go by their real names. In recent years, courts have begun to agree. The Supreme Court narrowed the scope of the law last year, ruling that it could not be used to prosecute people who had legitimate access to data but exploited their access improperly. And in April, a federal appeals court ruled that automated data collection from websites, known as web scraping, did not violate the law. Last month, the Justice Department told prosecutors that they should no longer use the law to pursue hackers who engaged in "good-faith security research."

Thompson's trial will raise questions about how far security researchers can go in their pursuit of cybersecurity flaws before their actions break the law. Prosecutors said Thompson had planned to use the information she gathered for identity theft and had taken advantage of her access to corporate servers in a scheme to mine cryptocurrency... The Justice Department has argued that Thompson had no interest in helping Capital One plug the holes in its security and that she cannot be considered a "white hat" hacker. Instead, she chatted with friends online about how she might be able to profit from the breach, according to legal filings.... Some security researchers said Thompson had ventured too far into Capital One's systems to be considered a white-hat hacker.... "Legitimate people will push a door open if it looks ajar," said Chester Wisniewski, a principal research scientist at Sophos, a cybersecurity firm.... But downloading thousands of files and setting up a cryptocurrency mining operation were "intentionally malicious actions that do not happen in the course of testing security," Wisniewski said....

"Thompson scanned tens of millions of AWS customers looking for vulnerabilities," Brown wrote in a legal filing.
The article notes that Capitol One ultimately agreed to pay $80 million in 2020 "to settle claims from federal bank regulators that it lacked the security protocols needed to protect customers' data" and another $190 million to settle a class-action lawsuit representing people whose data was exposed.

Several US federal agencies today revealed that Chinese-backed threat actors have targeted and compromised major telecommunications companies and network service providers to steal credentials and harvest data. BleepingComputer reports: As the NSA, CISA, and the FBI said in a joint cybersecurity advisory published on Tuesday, Chinese hacking groups have exploited publicly known vulnerabilities to breach anything from unpatched small office/home office (SOHO) routers to medium and even large enterprise networks. Once compromised, the threat actors used the devices as part of their own attack infrastructure as command-and-control servers and proxy systems they could use to breach more networks.

"Upon gaining an initial foothold into a telecommunications organization or network service provider, PRC state-sponsored cyber actors have identified critical users and infrastructure including systems critical to maintaining the security of authentication, authorization, and accounting," the advisory explains. The attackers then stole credentials to access underlying SQL databases and used SQL commands to dump user and admin credentials from critical Remote Authentication Dial-In User Service (RADIUS) servers.

"Armed with valid accounts and credentials from the compromised RADIUS server and the router configurations, the cyber actors returned to the network and used their access and knowledge to successfully authenticate and execute router commands to surreptitiously route, capture, and exfiltrate traffic out of the network to actor-controlled infrastructure," the federal agencies added. The three federal agencies said the following common vulnerabilities and exposures (CVEs) are the network device CVEs most frequently exploited by Chinese-backed state hackers since 2020. "The PRC has been exploiting specific techniques and common vulnerabilities since 2020 to use to their advantage in cyber campaigns," the NSA added. Organizations can protect their networks by applying security patches as soon as possible, disabling unnecessary ports and protocols to shrink their attack surface, and replacing end-of-life network infrastructure that no longer receives security patches.

The agencies "also recommend networks to block lateral movement attempts and enabling robust logging and internet-exposed services to detect attack attempts as soon as possible," adds BleepingComputer.

IRA Financial Trust, a platform that lets users save for retirement in alternative assets like cryptocurrency, is suing the Gemini cryptocurrency exchange over an alleged failure to protect its customers from a heist that resulted in the theft of $36 million in crypto. The financial platform partners with Gemini, owned by the Winklevoss twins, Cameron and Tyler, to allow customers to trade and store cryptocurrency. From a report: In February, IRA was the victim of a major attack that drained the millions in funds customers had stored with Gemini. The company was reportedly swatted, the act of calling the police to report a fake crime at someone's location, when the cyberattack occurred. Police showed up at IRA's South Dakota headquarters after false reports of a robbery, while bad actors made off with millions in crypto. At the time, a source close to Gemini told CoinDesk it wasn't hacked and that it makes various security controls available to its partners. "Gemini knew about the risks attendant to crypto assets," IRA's complaint states. "In fact, it built its public image around purportedly mitigating those risks. But like so much else in the world of crypto, Gemini's image is just that: an image. In reality, Gemini brushes security aside when there is a chance to earn more revenue."

Nintendo described the sentencing of a hacker earlier this year as a "unique opportunity" to send a message to all gamers about video game piracy. Axios reports: A newly released transcript of the Feb. 10 sentencing of Gary Bowser provides rare insight, directly from Nintendo, about the company's grievances. Bowser, a Canadian national, pled guilty last year to U.S. government cybercrime charges over his role as a top member of Team Xecuter. The group sold tech that circumvented copyright protections and enabled the Nintendo Switch and other systems to play pirated games. Authorities estimated the piracy cost Nintendo upward of $65 million over nearly a decade and even compelled the company to spend resources releasing a more secure model of the Switch.

"This is a very significant moment for us," Nintendo lawyer Ajay Singh told the court at the time, as he laid out the company's case against piracy and awaited the sentencing. "It's the purchase of video games that sustains Nintendo and the Nintendo ecosystem, and it is the games that make the people smile," Singh said. "It's for that reason that we do all we can to prevent games on Nintendo systems from being stolen." He noted Nintendo's losses from Team Xecuter's piracy and sounded a note of sympathy for smaller non-Nintendo game makers whose works are also pirated. And he wove in a complaint about cheating, which he said Team Xecuter's hacks enabled. Cheating could scare off honest players and upset families: "Parents should not be forced to explain to their children why people cheat and why sometimes games are not fair, just because one person wants an unfair advantage."

At the hearing, U.S. District Judge Robert Lasnik noted that TV and movies glorify hackers as "sticking it to the man," suggesting that "big companies are reaping tremendous profits and it's good for the little guy to have this." "What do you think?" Lasnik asked Nintendo's lawyer at one point. "What else can we do to convince people that there's no glory in this hacking/piracy?" "There would be a large benefit to further education of the public," Singh replied. In brief remarks directly to Lasnik, Bowser said longer prison time wouldn't scare off hackers. "There's so much money to be made from piracy that it's insignificant," he said.

The phones of Ukrainian officials have been targeted by hackers as Russia pursues its invasion of Ukraine, a senior cybersecurity official said Monday. Reuters: Victor Zhora, the deputy head of Ukraine's State Special Communications Service, said that phones being used by the country's public servants had come under sustained targeting. "We see a lot of attempts to hack Ukrainian officials' phones, mainly with the spreading of malware," Zhora told journalists at an online news conference meant to mark the 100 days since Russian forces poured across the border. Zhora said his service had, so far, not seen any evidence that Ukrainian devices had been compromised. The hacking of government leaders' devices crept up the international agenda following a cascade of revelations last year around the how phones used by presidents, ministers, and other government officials had been targeted or compromised.

"On Ukraine's battlefields, the simple act of powering up a cellphone can beckon a rain of deathly skyfall," reports the Associated Press. "Artillery radar and remote controls for unmanned aerial vehicles may also invite fiery shrapnel showers."

And the same technology can also be used to target navigation, guidance, and communications systems "to blind and deceive the enemy." This is electronic warfare, a critical but largely invisible aspect of Russia's war against Ukraine. Military commanders largely shun discussing it, fearing they'll jeopardize operations by revealing secrets.... It is used against artillery, fighter jets, cruise missiles, drones and more. Militaries also use it to protect their forces.

It's an area where Russia was thought to have a clear advantage going into the war. Yet, for reasons not entirely clear, its much-touted electronic warfare prowess was barely seen in the war's early stages in the chaotic failure to seize the Ukrainian capital of Kyiv. [A former U.S. Army commander tells the AP "What we're learning now is that the Russians eventually turned it off because it was interfering with their own communications so much."] It has become far more of a factor in fierce fighting in eastern Ukraine, where shorter, easier-to-defend supply lines let Russia move electronic warfare gear closer to the battlefield.

"They are jamming everything their systems can reach," said an official of Aerorozvidka, a reconnaissance team of Ukrainian unmanned aerial vehicle tinkerers, who spoke on the condition of anonymity because of safety concerns. "We can't say they dominate, but they hinder us greatly." A Ukrainian intelligence official called the Russian threat "pretty severe" when it comes to disrupting reconnaissance efforts and commanders' communications with troops. Russian jamming of GPS receivers on drones that Ukraine uses to locate the enemy and direct artillery fire is particularly intense "on the line of contact," he said.
Later the article says Ukraine's Aerorozvidka has also modified camera-equipped drones "to pinpoint enemy positions and drop mortars and grenades. Hacking is also used to poison or disable enemy electronics and collect intelligence."

So far Ukraine has captured "captured important pieces of hardware — a significant intelligence coup — and destroyed at least two multi-vehicle mobile electronic warfare units." They've been aided by technology and intelligence from NATO members (including from satellites and surveillance aircraft). But the article also calls Elon Musk's Starlink "a proven asset." Its more than 2,200 low-orbiting satellites provide broadband internet to more than 150,000 Ukrainian ground stations. Severing those connections is a challenge for Russia. It is far more difficult to jam low-earth orbiting satellites than geostationary ones.

Musk has won plaudits from the Pentagon for at least temporarily defeating Russian jamming of Ukrainian satellite uplinks with a quick software fix. But he has warned Ukrainians to keep those terminals powered down when possible — they are vulnerable to geolocation — and recently worried on Twitter about redoubled Russian interference efforts.
The article points out that to "stay nimble," Ukraine is also using cutting-edge technologies including software-defined radio and 3D printing.

A notorious Russian cybercrime group has updated its attack methods in response to sanctions that prohibit US companies from paying it a ransom, according to cybersecurity researchers. From a report: The security firm Mandiant said Thursday it believes that the Evil Corp gang is now using a well-known ransomware tool named Lockbit. Evil Corp has shifted to using Lockbit, a form of ransomware used by numerous cybercrime groups, rather than its own brand of malicious software to hide evidence of the gang's involvement so that compromised organizations are more likely to pay an extortion fee, researchers said. The US Treasury Department in 2019 sanctioned the alleged leaders of the Evil Corp gang, creating legal liabilities for American companies that knowingly send ransom funds to the hackers. While cybersecurity firms have associated Evil Corp with two kinds of malware strains, known as Dridex and Hades, the group's use of LockBit could cause hacked organizations to believe that another hacking group, other than Evil Corp, was behind the breach. Evil Corp is believed to be behind some of the worst banking fraud and computer hacking schemes of the past decade, stealing more than $100 million from companies across 40 countries, according to the US government.

Researchers suspect the checkm8[dot]info service is used by criminals to launder stolen iPhones. The tool's administrator claims the service is just a response to Apple's poor right to repair policies. From a report: "Activation Lock," a message displayed across the iPhone's screen read. "This iPhone is linked to an Apple ID. Enter the Apple ID and password that were used to set up this iPhone." This lock essentially turns iPhones into very expensive paperweights until the owner enters the requested credentials. The feature is designed to stop anyone else from using the phone if it's lost, or thieves from making money by reselling a stolen device. In part, Activation Lock is intended to make iPhones less attractive to thieves because stolen devices can't be used.

Now, an underground group is offering people a way to strip that lock from certain iPhones with its pay-for-hacking service. iOS security experts suspect it is being used to remove protections from stolen iPhones. The hacking group called Checkm8[dot]info offering the service, which lifts its name from a popular free-to-use jailbreak, insists its tool cannot be used by thieves. "Our goal is the ability to repair electronics as it's the key to saving resources, tackling e-waste and environmental damage," the administrator of Checkm8[dot]info told Motherboard in an email. Motherboard has previously written about how criminals have used phishing emails to grab necessary login credentials to remove the Activation Lock. Checkm8[dot]info provides a much easier method, and appears to streamline what is ordinarily a complicated process into one that non-technical users can follow. Checkm8[dot]info is correct in that Activation Lock can be frustrating to iPhone repair professionals, electronic waste facilities, and refurbishers, and has caused many perfectly good phones obtained through legal means to be shredded or destroyed. A user of the Checkm8[dot]info site told Motherboard they used the service as part of their legal phone reselling business.

The Department of Justice announced today a policy shift in that it will no longer prosecute good-faith security research that would have violated the country's federal hacking law the Computer Fraud and Abuse Act (CFAA). Motherboard: The move is significant in that the CFAA has often posed a threat to security researchers who may probe or hack systems in an effort to identify vulnerabilities so they can be fixed. The revision of the policy means that such research should not face charges.

"Computer security research is a key driver of improved cybersecurity," Deputy Attorney General Lisa O. Monaco said in a statement published with the announcement. "The department has never been interested in prosecuting good-faith computer security research as a crime, and today's announcement promotes cybersecurity by providing clarity for good-faith security researchers who root out vulnerabilities for the common good." The policy itself reads that "the Department's goals for CFAA enforcement are to promote privacy and cybersecurity by upholding the legal right of individuals, network owners, operators, and other persons to ensure the confidentiality, integrity, and availability of information stored in their information systems."

The F.B.I. informed the Israeli government in a 2018 letter that it had purchased Pegasus, the notorious hacking tool, to collect data from mobile phones to aid ongoing investigations, the clearest documentary evidence to date that the bureau weighed using the spyware as a tool of law enforcement. The New York Times reports: The F.B.I.'s description of its intended use of Pegasus came in a letter from a top F.B.I. official to Israel's Ministry of Defense that was reviewed by The New York Times. Pegasus is produced by an Israeli firm, NSO Group, which needs to gain approval from the Israeli government before it can sell the hacking tool to a foreign government. The 2018 letter, written by an official in the F.B.I.'s operational technology division, stated that the bureau intended to use Pegasus "for the collection of data from mobile devices for the prevention and investigation of crimes and terrorism, in compliance with privacy and national security laws."

The Times revealed in January that the F.B.I. had purchased Pegasus in 2018 and, over the next two years, tested the spyware at a secret facility in New Jersey. Since the article's publication, F.B.I. officials have acknowledged that they considered deploying Pegasus but have emphasized that the bureau bought the spying tool mainly to test and evaluate it -- partly to assess how adversaries might use it. They said the bureau never used the spyware in any operation.

An anonymous reader writes: Former NASA engineer Mark Rober builds some awesome stuff on his YouTube channel, like devious squirrel mazes, but his most popular video series is the annual glitter bomb, a beautifully over-engineered fake package that douses porch pirates with a shower of glitter and fart spray. In an unexpected twist, last year's glitter bomb video also helped police catch and arrest someone involved in a phone scam scheme, and Rober's spent the subsequent year digging into just how these phone scam operations work. In a new video he shows off the extensive results of that effort, including hiring double agents to infiltrate several phone centers in India and hacking their security camera footage. And of course he got off a stink bomb, too.

For Rober, this crusade started when he teamed up with another YouTuber, Jim Browning, to try to send a glitter bomb to a scammer operation. Browning's whole channel, which has 3.7 million followers, is devoted to identifying the call centers behind tech support scams and refund scams. These scams typically target the elderly and less computer-savvy folks and usually rely on the scammers gaining remote access to your computer and then tricking them into giving up personal information like their bank account login. 'Refund' scams make people believe they've been overcompensated with some bogus refund and trick them into sending cash in the mail to the scammers. The people who receive those cash packages in the United States are essentially underlings in these scam operations, so after getting a glitter bomb in their hands last year, Rober set his sights on the call centers themselves. With Browning's help, they were able to gain access to the CCTV of the infiltrated call centers, while another YouTube pair, Trilogy Media, traveled to Kolkata, India to run operations on the ground. Also worth checking out: Kitboga's YouTube channel.

Security researchers have noticed a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly for attacks in the wild. BleepingComputer reports: The method enabled the threat actor behind the attack to plant fileless malware in the file system in an attack filled with techniques and modules designed to keep the activity as stealthy as possible. [...] The dropper copies the legitimate OS error handling file [...] and then drops an encrypted binary resource to the 'wer.dll' (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code. DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path.

[Denis Legezo, lead security researcher at Kaspersky] says that the dropper's purpose is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 - 'AB' in ASCII. If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager. "The dropped wer.dll is a loader and wouldn't do any harm without the shellcode hidden in Windows event logs," says Legezo. The new technique analyzed by Kaspersky is likely on its way to becoming more popular as Soumyadeep Basu, currently an intern for Mandiant's red team, has created and published on GitHub source code for injecting payloads into Windows event logs.

This week the Washington Post described Russia as "struggling under an unprecedented hacking wave" — with one survey finding Russia is now the world's leader for leaked sensitive data (such as passwords and email addresses). "Federation government: your lack of honor and blatant war crimes have earned you a special prize..." read a message left behind on one of the breached networks...

Documents were stolen from Russia's media regulator and 20 years of email from one of Russia's government-owned TV/radio broadcasting companies. Ukraine's government is even suggesting targets through its "IT Army" channel on telegram, and has apparently distributed the names of hundreds of Russia's own FSB security agents. And meanwhile, the Post adds, "Ordinary criminals with no ideological stake in the conflict have also gotten in on the act, taking advantage of preoccupied security teams to grab money as the aura of invincibility falls, researchers said." Soon after the invasion, one of the most ferocious ransomware gangs, Conti, declared that it would rally to protect Russian interests in cyberspace. The pledge backfired in a spectacular fashion, since like many Russian-speaking crime groups it had affiliates in Ukraine. One of them then posted more than 100,000 internal gang chats, and later the source code for its core program, making it easier for security software to detect and block attacks.

Network Battalion 65 [a small hacktivist group formed as the war began looking inevitable] went further. It modified the leaked version of the Conti code to evade the new detections, improved the encryption and then used it to lock up files inside government-connected Russian companies. "We decided it would be best to give Russia a taste of its own medicine. Conti caused (and still causes) a lot of heartache and pain for companies all around the world," the group said. "As soon as Russia ends this stupidity in Ukraine, we will stop our attacks completely."

In the meantime, Network Battalion 65 has asked for ransomware payments even as it has shamed victims on Twitter for having poor security. The group said it hasn't gotten any money yet but would donate anything it collects to Ukraine.
Ars Technica quotes a cybersecurity researcher who now says "there are tens of terabytes of data that's just falling out of the sky."

Thanks to long-time Slashdot reader SpzToid for sharing the article!

While Russia's "relentless digital assaults" on Ukraine might seem less damaging than anticipated, the attacks actually focused on a different goal with "chilling potential consequences," reports the Associated Press. "Data collection."

Even in an early February blog post, Microsoft said Russia's intelligence agency had tried "exfiltrating sensitive information" over the previous six months from military, government, military, judiciary and law enforcement agencies.

The AP reports: Ukrainian agencies breached on the eve of the February 24 invasion include the Ministry of Internal Affairs, which oversees the police, national guard and border patrol. A month earlier, a national database of automobile insurance policies was raided during a diversionary cyberattack that defaced Ukrainian websites. The hacks, paired with prewar data theft, likely armed Russia with extensive details on much of Ukraine's population, cybersecurity and military intelligence analysts say. It's information Russia can use to identify and locate Ukrainians most likely to resist an occupation, and potentially target them for internment or worse.

"Fantastically useful information if you're planning an occupation," Jack Watling, a military analyst at the U.K. think tank Royal United Services Institute, said of the auto insurance data, "knowing exactly which car everyone drives and where they live and all that."

As the digital age evolves, information dominance is increasingly wielded for social control, as China has shown in its repression of the Uyghur minority. It was no surprise to Ukrainian officials that a prewar priority for Russia would be compiling information on committed patriots. "The idea was to kill or imprison these people at the early stages of occupation," Victor Zhora, a senior Ukrainian cyber defense official, alleged.... There is little doubt political targeting is a goal. Ukraine says Russian forces have killed and kidnapped local leaders where they grab territory....

The Ukrainian government says the Jan. 14 auto insurance hack resulted in the pilfering of up to 80% of Ukrainian policies registered with the Motor Transport Bureau.
But the article also points out that Ukraine also "appears to have done significant data collection — quietly assisted by the U.S., the U.K., and other partners — targeting Russian soldiers, spies and police, including rich geolocation data." Serhii Demediuk [deputy secretary of Ukraine's National Security and Defense Council] said the country knows "exactly where and when a particular serviceman crossed the border with Ukraine, in which occupied settlement he stopped, in which building he spent the night, stole and committed crimes on our land."

"We know their cell phone numbers, the names of their parents, wives, children, their home addresses," who their neighbors are, where they went to school and the names of their teachers, he said.

Analysts caution that some claims about data collection from both sides of the conflict may be exaggerated. But in recordings posted online by Ukrainian Digital Transformation Minister Mikhailo Fedorov, callers are heard phoning the far-flung wives of Russian soldiers and posing as Russian state security officials to say parcels shipped to them from Belarus were looted from Ukrainian homes.

In one, a nervous-sounding woman acknowledges receiving what she calls souvenirs — a woman's bag, a keychain.

The caller tells her she shares criminal liability, that her husband "killed people in Ukraine and stole their stuff."

She hangs up.

An anonymous reader quotes a report from Bloomberg: The FBI searched emails, texts and other electronic communications of as many as 3.4 million U.S. residents without a warrant over a year, the nation's top spy chief said in a report. The "queries" were made between December 2020 and November 2021 by Federal Bureau of Investigation personnel as they looked for signs of threats and terrorists within electronic data legally collected under the Foreign Intelligence Surveillance Act, according to an annual transparency report issued Friday by the Office of the Director of National Intelligence. The surge came as the FBI made a push to stop hacking attacks.

The authority the FBI used in this case was under Section 702 of FISA, which is set to expire at the end of next year unless it's renewed by Congress. The report doesn't say the activity was illegal or even wrong. But the revelation could renew congressional and public debates over the power U.S. agencies have to collect and review intelligence information, especially data concerning individuals. In comparison, fewer than 1.3 million queries involving Americans' data were conducted between December 2019 and November 2020, according to the 38-page report. The report sought to provide a justification for the increase in queries during the last year.

"In the first half of the year, there were a number of large batch queries related to attempts to compromise U.S. critical infrastructure by foreign cyber actors," according to the report. "These queries, which included approximately 1.9 million query terms related to potential victims -- including U.S. persons -- accounted for the vast majority of the increase in U.S. person queries conducted by FBI over the prior year." The exact number of U.S. residents who potentially had their information reviewed isn't known because there's no precise way to measure the data, according to the report. "Today's report sheds light on the extent of these unconstitutional 'backdoor searches,' and underscores the urgency of the problem," said senior staff attorney with the ACLU. "It's past time for Congress to step in to protect Americans' Fourth Amendment rights."

Information released under data protection laws sheds light on apparent effort to undermine Canadian research group Citizen Lab. From a report: When Downing Street was recently named as the suspected victim of a phone hack by the United Arab Emirates using the Israeli-made spyware, Pegasus, few were surprised at who was behind the discovery. The Citizen Lab at the University of Toronto has for years been a thorn in the side of the NSO Group, deciphering the company's sophisticated hacking tools and -- crucially -- identifying victims of the spyware. Ron Deibert, the longtime director of the Canadian research group, is one of the world's leading experts on identifying digital threats against civil society. John Scott-Railton, a senior researcher at Citizen Lab, is among a relatively small group of experts globally who can identify which iPhones and Android devices have been infected with Pegasus, and which government clients are likely to have been responsible.

It is unsurprising, then, that the pair were an intense focus at Novalpina, the London-based private equity group which took over NSO Group in 2019, and quickly sought to stem its reputation for enabling repressive governments to commit widespread human rights abuses. Using UK data protection laws, Deibert and Scott-Railton last year sought the personal data held on them by Novalpina. The results of their so-called subject access requests, recently shared with the Guardian, contain snippets of hundreds of emails and attachments that included their names. The released data, combined with information from other sources, sheds light on an apparent attempt by Novalpina partner Stephen Peel to gather information on and undermine Citizen Lab. In one case, he even reached out to George Soros, whose foundation is an important Citizen Lab donor, and complained about the researchers.

An anonymous reader quotes a report from Wired: For most of the world, the common practice of "rooting" or "jailbreaking" a phone allows the device's owner to install apps and software tweaks that break the restrictions of Apple's or Google's operating systems. For a growing number of North Koreans, on the other hand, the same form of hacking allows them to break out of a far more expansive system of control -- one that seeks to extend to every aspect of their lives and minds. On Wednesday, the North Korea-focused human rights organization Lumen and Martyn Williams, a researcher at the Stimson Center think tank's North Korea -- focused 38 North project, together released a report on the state of smartphones and telecommunications in the Democratic People's Republic of Korea, a country that restricts its citizens' access to information and the internet more tightly than any other in the world. The report details how millions of government-approved, Android-based smartphones now permeate North Korean society, though with digital restrictions that prevent their users from downloading any app or even any file not officially sanctioned by the state. But within that regime of digital repression, the report also offers a glimpse of an unlikely new group: North Korean jailbreakers capable of hacking those smartphones to secretly regain control of them and unlock a world of forbidden foreign content.

Learning anything about the details of subversive activity in North Korea -- digital or otherwise -- is notoriously difficult, given the Hermit Kingdom's nearly airtight information controls. Lumen's findings on North Korean jailbreaking are based on interviews with just two defectors from the country. But Williams says the two escapees both independently described hacking their phones and those of other North Koreans, roughly corroborating each others' telling. Other North Korea -- focused researchers who have interviewed defectors say they've heard similar stories. Both jailbreakers interviewed by Lumen and Williams said they hacked their phones -- government-approved, Chinese-made, midrange Android phones known as the Pyongyang 2423 and 2413 -- primarily so that they could use the devices to watch foreign media and install apps that weren't approved by the government. Their hacking was designed to circumvent a government-created version of Android on those phones, which has for years included a certificate system that requires any file downloaded to the device to be "signed" with a cryptographic signature from government authorities, or else it's immediately and automatically deleted. Both jailbreakers say they were able to remove that certificate authentication scheme from phones, allowing them to install forbidden apps, such as games, as well as foreign media like South Korean films, TV shows, and ebooks that North Koreans have sought to access for decades despite draconian government bans.

In another Orwellian measure, Pyongyang phones' government-created operating system takes screenshots of the device at random intervals, the two defectors say -- a surveillance feature designed to instill a sense that the user is always being monitored. The images from those screenshots are then kept in an inaccessible portion of the phone's storage, where they can't be viewed or deleted. Jailbreaking the phones also allowed the two defectors to access and wipe those surveillance screenshots, they say. The two hackers told Lumen they used their jailbreaking skills to remove restrictions from friends' phones, as well. They said they also knew of people who would jailbreak phones as a commercial service, though often for purposes that had less to do with information freedom than more mundane motives. Some users wanted to install a certain screensaver on their phone, for instance, or wipe the phone's surveillance screenshots merely to free up storage before selling the phone secondhand. As for how the jailbreaking was done, the report says both jailbreakers "described attaching phones to a Windows PC via a USB cable to install a jailbreaking tool."

"One mentioned that the Pyongyang 2423's software included a vulnerability that allowed programs to be installed in a hidden directory. The hacker says they exploited that quirk to install a jailbreaking program they'd downloaded while working abroad in China and then smuggled back into North Korea." The other hacker might've obtained his jailbreaking tool in a computer science group at Pyongyang's elite Kim Il Sung University where he attended.