~this week in security~
a cybersecurity newsletter by @zackwhittaker

volume 4, issue 3


Every deleted Parler post, many with users' location data, has been archived
Gizmodo, Wired ($): After the Capitol riot that left five dead, one hacker turned internet archivist began an effort to download every post from Parler from the day of the attack, Gizmodo reports. Parler was one of several platforms (including Facebook, despite an attempted denial) used by far-right extremists to storm the Capitol building on January 6. The archivist used an "absurdly basic bug" in Parler's platform to download the content, per Wired ($), which let the hacker download the reams of data — much of it included location data that could identify just how far the rioters got into the Capitol. In an analysis of the data, Gizmodo also found Parler users at police stations and U.S. military bases. The FBI has also raised concerns of law enforcement adopting radical views and being recruited to allow access to secured buildings and high-value targets.
More: Gizmodo | The Intercept | @kcimc
Larger CyberBunker investigation yields shutdown of DarkMarket
Cyberscoop: DarkMarket, the "world's largest illegal dark web marketplace" has been seized and shut down, Europol announced this week. The dark web marketplace traded largely in drugs, counterfeit money, hacked goods, and malware, and had close to half-a-million users and over 320,000 transactions. Turns out the marketplace was hosted by CyberBunker, a notorious underground (literally) bunker full of servers that went on to host WikiLeaks and The Pirate Bay. Europol said the seized servers will "give investigators new leaders to further investigate moderators, sellers and buyers."
More: Europol | Background: The New Yorker ($)

Hackers steal Mimecast certificate used to encrypt customers' Microsoft 365 traffic
Ars Technica: Email management provider Mimecast said hackers compromised one of its digital certificates that the company used to encrypt data sent and received by about 10 percent of its customers, or about 36,100 in total. But only a few customers had their accounts actively breached with the certificate. Mimecast, which says the issue is now remediated, said it found out from Microsoft, which has played a major part in uncovering the SolarWinds breach, but it's not known if the incident is related.
More: ZDNet | Mimecast

CISA chief: More federal victims of SolarWinds hacking likely to come forward
Cyberscoop: Speaking of SolarWinds... CISA's new acting chief Brandon Wales, who replaced Chris Krebs, said he expects the number of federal agencies confirmed breached will likely increase as the SolarWinds investigation goes on. So far, some fewer than 10 federal agencies have been confirmed compromised so far by what U.S. authorities are pointing to hackers "likely Russian" in origin. "That being said, we do believe that the number will remain extremely small because of the highly targeted nature of this campaign. And that is going to be true for both government and private-sector entities compromised," said Wales. CISA, which oversees cybersecurity for the federal government, said it needs additional resources to prevent a breach like this in the future.
More: Bloomberg ($) | @snlyngaas

Leaked location data shows another Muslim prayer app tracking users
Motherboard: Yet another Muslim prayer app, Salaat First, was recording and selling granular locations on its users to a data broker, which then sold that data on to other customers. The app (and associated location data) could be used to track Muslims who pray, where, and at what time of the day. To call this is a huge breach of privacy doesn't even come close to cutting it — the company collecting the data, a French firm called Predicio, has been linked to a supply chain that's sold data to the U.S. government, including ICE and CBP.
More: @josephfcox

EMA warns over doctored COVID-19 vaccine data hacked and leaked online
TechCrunch: The European Medical Agency said that vaccine-related information stolen in a hack in December was deliberately doctored and then released. The agency, which oversees Europe's COVID-19 vaccine response, said the data includes correspondence that's been manipulated prior to publication "in a way which could undermine trust in vaccines," @riptari reports. No attribution was made, but it's a similar effort seen before where hackers have carried out "hack and leak" operations with altered information. In 2017, Russia's Fancy Bear was blamed for publishing and manipulating emails stolen from Emmanuel Macron's presidential campaign.
More: Ars Technica | @lukOlejnik
~ ~

A big thanks to everyone who reads this newsletter! If you can spare $1/month (or more for perks!), it helps to cover the server and email costs. You can contribute to the Patreon or send a one-time donation via PayPal or Venmo
~ ~


WhatsApp to delay privacy policy change after backlash
Reuters: Well that was a mess. After Facebook flubbed its messaging on how it plans to change its privacy policy, the social media giant backed down — for now. WhatsApp users were alerted with a popup this month saying it reserved the right to share some user data with Facebook, which owns WhatsApp. The update "does not expand our ability to share data with Facebook," per a statement. That's largely true, because Wired ($) previously noted that WhatsApp had already been sharing your data with Facebook for years unless you opted out some time in 2016 (you no longer can). No wonder so many are confused and are flocking to Signal — some 40 million people by the looks of it.
Biden to restore White House cybersecurity role
The New York Times ($): Anne Neuberger, who for the past year headed NSA's Cybersecurity Directorate, will soon serve as the new cybersecurity chief on the National Security Council under the Biden-Harris administration, heading the government's cybersecurity efforts and likely leading the response into the SolarWinds breach. @natashabertrand first broke the news last week, but it was only confirmed on Wednesday. Neuberger previously ran the Russia Small Group at the NSA, which launched a preemptive cyberattack on the Kremlin's hackers during the 2018 midterm elections. Meanwhile, Rob Joyce will return from the U.K. and replace Neuberger as NSA's cybersecurity director.

Amazon’s Ring Neighbors app exposed users’ precise locations and home addresses
TechCrunch: Amazon-owned Ring fixed a security bug that allowed any user to siphon off other Ring users' precise locations and home addresses directly from Ring's servers, thanks to a leaky and easily enumerable API. The app was pulling in people's real-world locations, even if it wasn't displaying the data on screen. Gizmodo found a similar (if not the same) bug last year. Ring didn't fix it then, instead it just made it difficult to detect the leaking data. (Disclosure: I wrote this story.)
Apple removes feature that allowed its apps to bypass macOS firewalls and VPNs
ZDNet: Good news! Apple has removed a controversial feature from macOS that allowed dozens of Apple's own apps to bypass third-party firewalls and VPN apps installed by users. That meant apps like App Store, Maps, and iCloud were communicating directly with Apple servers, but security tools couldn't filter or inspect the traffic. @patrickwardle, who discovered the issue to begin with, explained more.

A profile of Jason A. Donenfeld, who develops the WireGuard VPN procotol
Business Insider ($): @yaelwrites is back with her latest, a profile on WireGuard VPN creator @zx2c4. WireGuard is an open-source VPN protocol that's been lauded for its high security. This profile looks at the creator's life and why WireGuard is praised by security folks across the globe.
~ ~


Hacker locks internet-connected chastity cage, demands ransom
A few months ago I wrote about a buggy internet-connected chastity cage that left users at risk of permanent lock-in. The remotely-exploitable bug was mostly fixed. One victim says his device was hacked — it wasn't on at the time, thankfully — but whoever remotely locked the device demanded a ransom of about $750 to release it.
Capcom confirms at least 16,000 people affected by November data breach
Games aker Capcom said in November that 350,000 people may have had their data exposed by ransomware on its systems. Now it's saying that number has gone up to 390,000, including 16,000 whose information was confirmed compromised. Most of those victims are Capcom business partners and current and former employees.

Period app tracker Flo slapped by FTC for sharing user data
Flo, a period and fertility tracker with over 100 million users, has settled with the FTC after the agency accused the startup of sharing its users' health data with third-party companies — including analytics and marketing firms — when it promised privacy. The slapdown came after a 2019 investigation by the Wall Street Journal ($) that revealed some of these health apps were sharing data with others. The FTC said Flo must comply with the settlement, which includes obtaining an independent review of its privacy practices and obtaining app users' permission before sharing their health data with others.

How law enforcement gets around your smartphone's encryption
We touched on this a few weeks ago, sparked a really good thread by @matthew_d_green. Now, the final report is out. @lilyhnewman breaks the report down well. In the end, you'll wonder why governments are calling for encryption backdoors to begin with.
~ ~


Turns out the kids are alright, as evidenced this week.

First up, a 12-year-old helped to get at least 10,000 users signed up to Signal after cloning the open-source encrypted messaging app. These clones happen a lot — some are modified simply to change the font, but others pack with trackers and ads to make money. In this case, the 12-year-old just wanted to build an app. The newly-created app is basically just Signal with a "different coat of paint." Adding 10,000 users to Signal might seem like a drop in the ocean to the 50 million+ now using the app, but it's 10,000 users who otherwise might not be using an encrypted messaging app at all.

Meanwhile, if you're wondering how to make Signal more secure and private, follow this ZDNet guide. Don't forget to enable disappearing messages!

And, also this week, two kids found a bug that made it possible to bypass the screen lock on Linux Mint desktops. The bug was reported through GitHub, where it was tracked down and found in the on-screen keyboard component that ships with Cinnamon, the user interface used by Linux Mint. All it took was someone pressing the "ē" key on the on-screen keyboard to unlock the screen.
Incredible. Those kids beat whatever I did this week, that's for sure.
If you want to nominate some good news from the week, feel free to reach out.
~ ~


Meet this week's cyber cat, Ellie, who's keeping an eye out for mice hackers. A big thanks to Ellie's human, @Recurzion, for the submission!
Please keep sending in your cyber cats (and friends)! The more the merrier. Yes, you can also now send in your non-feline friends too. Send them in here!
~ ~


That's it for this week. As usual, you can always drop your feedback in the suggestion box. Don't forget to send in your cyber animals! Have a great week, and see you next Sunday.