Julian Assange was Back in the news this week, but also a group called Distributed Denial of Secrets, which has taken on the WikiLeaks coat in many ways. In the past year and a half, DDoSecrets has released a lot of sensitive data from anonymous contributors. And this week, a dump called BlueLeaks was released – 269 gigabytes of police files, mostly from centralized “fusion centers,” that contained law enforcement emails, audio recordings, and memos.
At Apple’s global developer conference on Monday, Apple announced that Safari and iOS 14 will take more aggressive steps overall to stop digital ad tracking and protect user privacy. In the meantime, Google said on Wednesday that after much criticism, your data such as “web and app activity”
This week we looked at a class of attacks that use “side channels” for clever and unexpected hacking. We went through the process of taking your old signal messages with you on a new phone. And to make you feel a little better about the chaos in your email inbox, we met an engineer who, thanks to an address that he created 16 years ago and that turned out to be a booby trap, always drowns in messages that are intended for other people.
And there is more. Every Saturday we summarize the security and data protection reports, which we have not reported in detail, but which you should know about. Click on the headings to read them and stay safe out there.
The U.S. Department of Justice announced on Wednesday a replacement indictment against WikiLeaks founder Julian Assange that will broaden the scope of the existing 18 indictments. The indictment alleges that Assange and other WikiLeaks members have worked with hacking collectives such as LulzSec and Anonymous, what DoJ calls “computer interventions to benefit WikiLeaks”. Assange was originally charged by the Department of Justice with hacking crimes in April 2019. At the end of May, the Justice Department lifted a replacement charge for alleged violations of the Espionage Act. This move was seen as a potential attack on press freedom, regardless of whether you believe Assange’s work at WikiLeaks was journalism or not.
On Tuesday, Senators Lindsey Graham (R-SC), Tom Cotton (R-AR) and Marsha Blackburn (R-TN) presented a bill requiring technology companies to incorporate legal access tools or back doors into their buildings Bypass encryption protection for user data. The move is Congress’s most explicit attack on encryption for years. “The increasing dependence of technology companies on encryption has turned their platforms into a new, lawless playground for criminal activity,” Cotton said in a statement on the proposed legislation. “This bill ensures that law enforcement agencies can access encrypted material with a warrant.” However, security researchers have long insisted that there is no technical way to build a back door in encryption for law enforcement agencies that does not fundamentally undermine protection. It is possible that the effort is a red herring to make another bill that threatens encryption, the EARN IT Act, appear more palatable in comparison.
In a Thursday report, Symantec researchers said the notorious Evil Corp. group has worked to infect companies with ransomware by targeting people who work from home during the Covid-19 pandemic. Hackers of all kinds have used the pandemic conditions to do everything from phishing attacks to unemployment fraud and espionage. However, Evil Corp’s activities are remarkable as the group was charged with hacking by the Department of Justice in December. The Treasury also imposed sanctions on the group and said it had links to the Russian FSB security agency. However, the United States’ deterrence efforts have not prevented Evil Corp from expanding its activities. Research released earlier this week by Fox-IT shows that the group has developed new ransomware and refined its attack techniques.
Australian Prime Minister Scott Morrison said last Friday that government agencies and corporations are struggling with a month-long flood of cyberattacks by an unnamed nation-state actor. Although Morrison did not name a suspect, anonymous press officials said the malicious actor was probably China. The researchers also speculated about this possibility, which was based on similarly aggressive Chinese espionage and business secret thefts that have plagued countries around the world. The trade negotiations between Australia and China are also tense at the moment. Zhao Lijian, a spokesman for the Chinese foreign ministry, vehemently denied that China is behind the hacking spree against Australia.
More great WIRED stories