MATT BURGESS LILY HAY NEWMAN
THE CITY OF New York has agreed to pay more than $13 million total to 1,380 people as part of a settlement of a class action related to the New York Police Department’s treatment of demonstrators during protests in 2020 sparked by the murder of George Floyd. Lawyers representing the protesters secured the settlement with the help of a tool that allowed them to comb terabytes of video footage from police body cams, helicopter surveillance, and social media taken during the protests. This quickly produced clear evidence of widespread patterns in police behavior, allowing lawyers to showcase a broad survey rather than focusing on a handful of anecdotes. The tool, developed by SITU Research, a design agency that focuses on protecting civil liberties, is now being used in legal battles around the world.
New findings from researchers in Germany this week underscore longstanding concerns that the cybersecurity defenses of orbiting satellites are woefully inadequate. The researchers found numerous critical vulnerabilities in three different satellite models, underscoring broader problems with satellite security.
Meanwhile, a bill to prevent US law enforcement and intelligence from buying Americans’ data instead of getting a warrant to collect it is gaining traction in Congress as political rivals come together to oppose surveillance overreach.
And there’s more. Each week, we round up the stories we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.
On July 11, Microsoft revealed that a Chinese hacking group it calls Storm-0558 was able to access the email systems of US government agencies, potentially compromising hundreds of thousands of emails. Since then, details of the incident have started to emerge—including reports claiming that the email account of the US ambassador to China and other senior officials were breached. The attackers were able to access the email accounts, according to Microsoft and the US State Department, using a private signing key they had acquired and were using to generate access tokens for the accounts.
A new investigation by the cloud security firm Wiz, though, claims that the compromised key could have also been used to create access tokens for other Microsoft services including SharePoint, Teams, OneDrive, and third-party apps created by customers.
“All of Microsoft, all of Microsoft Office 365, all of Azure relies on authentication tokens. This is the fabric of the cloud,” says Wiz chief technology officer Ami Luttwak.
A Microsoft spokesperson told WIRED in a statement that “many of the claims made in this blog are speculative and not evidence-based,” but did not specify which claims.
“The methodology employed by Wiz to identify the broader scope of where the compromised key would be accepted looks very technically solid,” says Jake Williams, a former NSA hacker who now teaches at the Institute for Applied Network Security in Boston. “The research highlights that the scope of the compromised key is far broader than originally reported.”
Microsoft wrote last week that its “investigations have not detected any other use of this pattern by other actors and Microsoft has taken steps to block related abuse.” But if the stolen signing key could have been used to breach other services, even if it wasn’t used this way in the recent incident, the finding has significant implications for the security of Microsoft’s cloud services and other platforms.
The attack “seems to have a broader scope than originally assumed,” the Wiz researchers wrote. They added , “This isn't a Microsoft-specific issue—if a signing key for Google, Facebook, Okta, or any other major identity provider leaks, the implications are hard to comprehend.”
Microsoft’s products are ubiquitous worldwide, though, and Wiz’s Luttwak emphasizes that the incident should serve as an important warning.
“There are still questions that only Microsoft can answer. For example, when was the key compromised? And how?” he says. “Once we know that, the next question is, do we know it’s the only key that they had compromised?
In response to China’s attack on US government cloud email accounts from Microsoft—a campaign that US officials have described publicly as espionage—Microsoft announced this past week that it will make more of its cloud logging services free to all customers. Previously, customers had to pay for a license to Microsoft's Purview Audit (Premium) offering to log the data.
The US Cybersecurity and Infrastructure Security Agency’s executive assistant director for cybersecurity, Eric Goldstein, wrote in a blog post also published this past week that “asking organizations to pay more for necessary logging is a recipe for inadequate visibility into investigating cybersecurity incidents and may allow adversaries to have dangerous levels of success in targeting American organizations.”
Since OpenAI revealed ChatGPT to the world last November, the potential of generative AI has been thrust into the mainstream. But it isn't just text that can be created, and many of the emerging harms of the technology are only starting to be realized. This week, UK-based child safety charity the Internet Watch Foundation (IWF), which scours the web for child sexual abuse images and videos and removes them, revealed it is increasingly finding AI-generated abuse images online.
In June, the charity started logging AI images for the first time—saying it found seven URLs sharing dozens of images. These included AI generations of girls around 5 years old posing naked in sexual positions, according to the BBC. Other images were even more graphic. While generated content only represents a fraction of the child sexual abuse material available online overall, its existence is worrying experts. The IWF says it found guides on how people could create lifelike images of children using AI and that the creation of the images, which is illegal in many countries, is likely to normalize and encourage predatory behaviors toward children.
After threatening to roll out global password-sharing crackdowns for years, Netflix launched the initiatives in the US and UK at the end of May. And the effort seems to be going as planned. In earnings reported on Thursday, the company said that it added 5.9 million new subscribers in the past three months, a jump nearly three times higher than analysts predicted. Streaming subscribers have grown accustomed to sharing passwords and balked at Netflix’s strict new rules, which were prompted by stagnating new subscriber signups. But ultimately, at least a portion of account-sharers seem to have bit the bullet and started paying on their own.
No comments:
Post a Comment