Search Results for “Zack Whittaker”


December 19, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Virtually All GPS-Enabled Smartwatches Used by Parents to Track Children Harbored Common Cloud-Based Flaw Exposing Real-Time Locations, Voice Recordings

Virtually all GPS-enabled smartwatches parents used to keep track of their children were harboring a damaging flaw in a common shared cloud platform used to power millions of smartwatches, exposing millions of real-time locations and voice recordings, researchers at Pen Test Partners discovered. The cloud platform is developed by Chinese white-label electronics maker Thinkrace, one of the largest manufacturers of location-tracking devices and works as a backend system for Thinkrace-made devices, storing and retrieving locations and other device data. Thinktrace also sells its tracking devices to third-party partners. Pen Test Partners found 47 vulnerable devices, which they believe is only the tip of the iceberg. The researchers disclosed their findings to several white-label electronics makers in 2015 and 2017, including Thinkrace and some fixed their vulnerable endpoints. Others, however, ignored the warnings.

Related: Pen Test Partners

Tweets:@zackwhittaker @zackwhittaker @muzhunter


July 26, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
‘Accidental’ WannaCry Hero Marcus Hutchins Sentenced to Supervised Release for His Role in Creating Kronos Banking Trojan

Malware researcher Marcus Hutchins, also known as MalwareTech, who became famous as the “accidental” hero who stopped the WannaCry worm from spreading globally but who was also shortly thereafter arrested in Las Vegas in August 2017 while boarding a flight back to the U.K. following DEFCON for his role in helping to create the Kronos banking trojan, has been sentenced to supervised release by Judge J. P. Stadtmueller in Milwaukee federal court. Hutchins, a UK citizen, was characterized by the judge as a talented” but “youthful offender.” Hutchins’ work on the technology leading to Kronos began in 2014. “It’s going to take the people like [Hutchins] with your skills to come up with solutions because that’s the only way we’re going to eliminate this entire subject of the woefully inadequate security protocols,” said Stadmueller.

Related: ZDNet, emptywheel, Technology Review, Dark Reading, The GuardianBBC News – Home, Cyberscoop, The Register – Security, VICE News, Slashdot, isssource.com, North Devon Gazette, The Next Web, The Hacker News, Security – Computing, AP Breaking News

Tweets:@deviantollum @emptywheel @malwaretechblog @malwaretechblog @zackwhittaker @zackwhittaker @gossithedog @marciahoffman

ZDNet: Marcus ‘MalwareTech’ Hutchins gets no prison time, one year supervised release
emptywheel: After Two Years, MalwareTech Is a Free Man
Technology Review : A light sentence for a famous hacker has actually made the world safer
Dark Reading: Malware Researcher Hutchins Sentenced to Supervised Release
The Guardian: Briton who helped stop 2017 WannaCry virus avoids jail over malware charges
BBC News – Home: Marcus Hutchins spared US jail sentence over malware charges
Cyberscoop : Marcus Hutchins, who stopped WannaCry’s spread, avoids prison time
The Register – Security: He’s coming home, he’s coming home … Hutchins’ coming home: British Wannacry killer held in US on malware dev rap set free by judge
VICE News: MalwareTech, the Security Researcher Who Stopped WannaCry Ransomware, Gets No Prison Time for Hacking Crimes
The Verge: WannaCry hero Marcus Hutchins will avoid prison in banking malware case
Slashdot: Marcus ‘MalwareTech’ Hutchins Gets No Prison Time, One Year Supervised Release
isssource.com: WannaCry Hero Avoids Jail Time
North Devon Gazette : Ilfracombe cyber expert Marcus Hutchins spared jail
The Next Web: WannaCry hero Marcus “MalwareTech” Hutchins isn’t going to jail
The Hacker News: Judge Rules No Jail Time for WannaCry ‘Killer’ Marcus Hutchins, a.k.a. MalwareTech
Security – Computing: WannaCry hero Marcus Hutchins spared jail in the US over links to Kronos banking Trojan
AP Breaking News: No prison for British cyber expert in malware case

@deviantollum: A wonderful day for @MalwareTechBlog thanks to his loving parents as well as @marciahofmann , @brianeklein , Emily, @Doctor_Tran , @Tarah , and all of you around the world who showed endless support.
@emptywheel: In Milwaukee for @MalwareTechBlog sentencing hearing, that begins in 7 minutes. Most of the sentencing materials are sealed, but here's the govt filing.
@malwaretechblog: I’d like to also dedicate a tweet to thanking my amazing lawyers: @brianeklein , @marciahofmann , and Daniel Stiller. They provided this help pro bono; I’m forever indebt.
@malwaretechblog: Sentenced to time served! Incredibly thankful for the understanding and leniency of the judge, the wonderful character letter you all sent, and everyone who helped me through the past two years, both financially and emotionally.
@zackwhittaker: In a verbal statement, @MalwareTechBlog said he made some "bad decisions" as a teenager. "I deeply regret my conduct and the harm that was caused," he said. "I have no desire to go back to that life," he said.
@zackwhittaker: Judge: "Marcus Hutchins turned a corner in regards to further conduct that would be remotely connected to what led to the charges in this case." "There are just too many positives on the other side of the ledger."
@gossithedog: “That’s when what every lawyer watching in the courtroom I spoke with called unprecedented. The Judge suggested Hutchins should get a pardon”
@marciahoffman: .@MalwareTechBlog is going home a free man. @brianeklein and I are thrilled that Judge Stadtmueller recognized Marcus’ important contributions to society and sentenced him to time served, even suggesting Marcus should seek a pardon.


February 11, 2020
Bojan Pancevski / Wall Street Journal

Bojan Pancevski / Wall Street Journal  
U.S. Officials Say They Have Known for More Than a Decade That Huawei Can Secretly Access Mobile Phone Networks Through Back Doors Designed for Law Enforcement, Sources

On the heels of the U.K. government’s decision to allow controversial Chinese telecom giant Huawei to provide gear for non-core portions of the country’s 5G network, U.S. officials are saying that Huawei can covertly access mobile phone networks around the world through “back doors” designed for use by law enforcement, a secret that has purportedly been maintained for more than a decade.  Long reluctant to reveal the evidence behind the government’s contention that Huawei spies on behalf of China, the U.S. kept the intelligence highly classified until late last year, when American officials provided details to allies including the U.K. and Germany, according to officials from the three countries. Only law-enforcement officials or authorized officials at each carrier are allowed into backdoors built into telecom gear, known as “lawful interception interfaces,” usually with the telecom carriers’ permission. Huawei, however, has made equipment that secretly preserves the manufacturer’s ability to access networks through these interfaces without the carriers’ knowledge, officials say.

Related: Ars Technica, IBTimes India, The Times of Israel, WashingtonExaminer.com, ExtremeTech, BBC NewsHomeland Security Today, Haaretz.com, Stars and Stripes, The Register, WCCFtech, Tech Insider, Channel News Asia, SecurityWeek, Digital Journal, DAILYSABAH, Boing Boing, Slashdot, Deutsche Welle, Daily Dot, Reuters: World News, The Guardian, AP Top News

Tweets:@bopanc @OKnox @ericgeller @zackwhittaker @zackwhittaker @zackwhittaker @alexstamos @Bing_Chris @josephfcox @evacide @kimzetter

Ars Technica: US says it can prove Huawei has backdoor access to mobile-phone networks
IBTimes India: Did CIA spy on India’s top-secret communications for years? Confidential documents make shocking revelations
The Times of Israel: US, German spies plundered global secrets via Swiss encryption firm – report
WashingtonExaminer.com: ‘Intelligence coup of the century’: CIA secretly owned encryption firm used by other countries to communicate
ExtremeTech: The CIA Secretly Ran One of the World’s Largest Encryption Firms for Decades
BBC News : Swiss machines used to spy on governments for decades
Homeland Security Today: Investigation Opened into Swiss Encryption Firm Linked to CIA
Haaretz.com: CIA owned encryption world leader, read secret comms for years, report reveals
Stars and Stripes: For decades, the CIA read the encrypted communications of allies and adversaries
The Register: Crypto AG backdooring rumours were true, say German and Swiss news orgs after explosive docs leaked
WCCFtech: Intelligence Coup of the Century: How CIA Secretly Sold Compromised Encryption Devices Through a Swiss Company to Over 120 Countries
Tech Insider: Leaked documents reportedly show the CIA secretly bought an encryption company and used it to spy on clients — while turning a profit
Channel News Asia: US, German spies plundered global secrets via Swiss encryption firm: Report
SecurityWeek: US, German Spies Plundered Global Secrets Via Swiss Encryption Firm: Report
Digital Journal: US, German spies plundered global secrets via Swiss encryption firm: report
DAILYSABAH: Coup of the century: How US, German spies looted global secrets via Swiss Crypto AG
Boing Boing: CIA secretly owned world’s top encryption supplier, read enemy and ally messages for decades
Slashdot: The CIA Secretly Bought a Company That Sold Encryption Devices Across the World. Then, Its Spies Read Everything.
Boing Boing: CIA secretly owned world’s top encryption supplier, read enemy and ally messages for decades
Deutsche Welle: Report: US, Germany spied on countries for decades via Swiss encryption firm
Daily Dot: The CIA was secretly in control of an encrypted software sold to foreign governments
Reuters: World News: Swiss investigate report that firm helped CIA break codes
The Guardian: CIA controlled global encryption company for decades, says report
AP Top News: Switzerland investigating alleged CIA, German front company

@bopanc: Exclusive: ? @Huawei ? can covertly access mobile networks through back doors meant for law enforcement, U.S. tells allies in bid to show firm poses security threat. My report via ? @WSJ
@OKnox: So the US government, which has argued that law enforcement needs backdoors into secured/encryptic tech, is warning allies that backdoors for law enforcement into secured/encrypted tech can compromise communications?
@ericgeller: In which the U.S. strategy on Huawei undermines the U.S. strategy on encryption. Quote Tweet
@zackwhittaker: Just to be clear, this story doesn't paint a very clear picture of what's going on — if the matter is classified, there's always the risk of misinterpreting the information. Proceed with caution, etc.
@zackwhittaker: The U.S. said it has observed Huawei's alleged access since 2009 but Huawei has denied the claims. That said, a backdoor can be used for both good and bad. Maybe having no backdoors for anyone would be the way forward (hinty hint hint).
@zackwhittaker: This seems to be the evidence that the U.S. has been holding onto. Feds say that Huawei can access cell networks through (what sounds like) CALEA-like lawful intercept points — which no device maker is supposed to be able to access.
@alexstamos: Between the Huawei accusation and the blockbuster story on the CIA backdooring Crypto AG for decades, it’s a good day for all the wild-eyed supply chain risk experts who are often treated like cranks by the rest of InfoSec.
@Bing_Chris: Also: the national counter intel strategy published yesterday listed supply chain security as one of five focus areas moving forward
@josephfcox: German officials reportedly said the U.S. had a "smoking gun" when it came to Huawei being able to leverage their products for spying. https://wsj.com/articles/u-s-officials-say-huawei-can-covertly-access-telecom-networks-11581452256
@evacide: Gee, maybe back doors for law enforcement aren’t a good idea.
@kimzetter: This story is vague and fuzzy. Needs more verification and details.


January 28, 2020
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Second Security Incident Affecting LabCorp Over the Past Year Exposes At Least 10,000 Medical Documents

A security flaw found in clinical laboratory company LabCorp’s website exposed at least 10,000 medical documents, such as test results containing sensitive health data. An error in an internal customer relationship management system website left the website address visible to search engines. It allowed the exposed documents to be cached, making the materials accessible to anyone who knew where to look. The bug is now fixed. This exposure is the second serious security flaw incident afflicting the company during the past year. LabCorp said in June 2019 that 7.7 million patients had been affected by a credit card data breach of a third-party payments processor, a breach that also encompassed several other diagnostic companies, including Quest Diagnostics.

September 18, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Documents Discovered on Nokia Network Employee’s Unprotected Drive Offer Details on Russia’s ‘Lawful Intercept’ Phone and Internet Capabilities

Documents found on an unprotected backup drive owned by an employee of Nokia Networks offer new insight into the scope and scale of the Russian surveillance system known as SORM (Russian: COPM) and how Russian authorities gain access to the calls, messages, and data of customers of the country’s largest phone provider, Mobile TeleSystems (MTS), Chris Vickery, director of cyber risk research at security firm UpGuard, discovered. The documents, nearly two terabytes in size, reveal Nokia’s involvement in providing “lawful intercept” capabilities to phone and internet providers, which Russia mandates by law. They also spell out how, between 2016 and 2017, Nokia planned and proposed changes to MTS’s network as part of the telecom giant’s “modernization” effort. The documents discovered by Vickery include several floor plans, photos and network diagrams for the local phone exchanges. One set of documents show how “modernized” SORM capabilities on MTS’s network also allow the government access to the telecom’s home location register (HLR) database, which contains records on each subscriber allowed to use the cell network, including their international mobile subscriber identity (IMSI) and SIM card details. Vickery informed Nokia of the exposure and the company closed the hole four days later.

Related: Upguard, TechradarGizmodo, Boing Boing

Tweets:@profcarroll @vickerysec @zackwhittaker @zackwhittaker


September 20, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Online Developer Education Site Thinkful Confirms Data Breach Just Days After Announcing Its Acquisition by Chegg

Online developer education site Thinkful confirmed a data breach, just days after it confirmed it would be acquired by education tech giant Chegg for $80 million. Thinkful said that the credentials stolen in the breach could not have granted the hacker access to certain information, such as government-issued IDs and Social Security numbers, or financial information. Thinkful is requiring all users to change their passwords.

June 25, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Suspected Chinese Hackers Targeted More Than Ten Telcos Globally to Steal Selected Customers’ Call Records

An advanced, persistent attack group likely associated with the Chinese-affiliated threat actor APT10 targeted more than ten mobile telecommunications providers around the world over the past seven years to steal massive amounts of highly prized call records, including times and dates of calls, and their cell-based locations, on at least 20 individuals researchers at Cybereason report. The attackers were able to track the physical location of any customer of the hacked telcos, including spies and politicians, using the call records.  They were also capable of controlling the targeted networks through a series of exploits. Cybereason said it had not seen the hackers targeting North American mobile companies.

Related: Wall Street Journal, CNET, Wired, The Register, Cyberscoop, Cybereason, AP Breaking News, TechNadu, NS Tech, Computer Business Review, Gadgets Now, The Verge, Fast Company, Apple Insider

Tweets:@snlyngaas @zackwhittaker @alfredwkng

Wall Street Journal: Global Telecom Carriers Attacked by Suspected Chinese Hackers
CNET: Hackers hit over a dozen mobile carriers and could shut down networks, researchers find
Wired: A LIKELY CHINESE HACKER CREW TARGETED 10 PHONE CARRIERS TO STEAL METADATA
The Register: What the cell…? Telcos around the world were so severely pwned, they didn’t notice the hackers setting up VPN points
Cyberscoop: Chinese spies have been sucking up call records at multinational telecoms, researchers say
Cybereason: OPERATION SOFT CELL: A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS
AP Breaking News: Report: Hackers using telecoms like ‘global spy system’
TechNadu: Chinese Hackers Stealing Data From Global Telecommunications Providers
NS Tech: State-sponsored hackers have compromised several major telcos
Computer Business Review: 10 Major Global Telcos “Completely Penetrated” by Chinese APT
Gadgets Now: Suspected Chinese hackers attack global telecom providers: Report
The Verge: Hackers steal call records from cell providers in ‘massive-scale’ espionage
Fast Company: “Massive-scale” espionage campaign sees hackers infiltrate cellular networks around the world
AppleInsider: Chinese hackers suspected of attacking global telecoms carriers

@snlyngaas: Chinese spies have been sucking up call records at multinational telecoms, researchers say -
@zackwhittaker: New: Security researchers say they've found a "massive-scale" espionage operation of hackers breaking into at least 10 cell networks around the world and stealing hundreds of gigabytes of call records at a time
@alfredwkng: Just in: Security researchers found that hackers infiltrated over a dozen mobile carriers, stealing hundreds of gigabytes of call records, including location data


July 3, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Three Security Flaws in Zipato Smart Home Hubs Could Allow Attacker to Open Front Door Locks

Three security flaws which, when chained together, could be abused to open a front door with a smart lock, were discovered in the ZipaMicro Z-Wave Controller Model #:  ZM.ZWUS and the Zipabox Z-Wave Controller Model #: 2AAU7-ZBZWUS by security researchers Chase Dardaman and Jason Wheeler. The researchers found they could extract the hub’s private SSH key for “root” from the memory cards in the popular smart home hubs developed by Croatian firm Zipato. The researchers discovered that the SSH key was hardcoded in every hub sold to customers. Using the “pass-the-hash” authentication system in the hubs, the researchers could use scrambled passwords to control the door lock. Zipato fixed the vulnerabilities within a few weeks of the researchers’ disclosure.

June 19, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Lofgren-Amash Amendment Seeks to Curb NSA’s Section 702 Data Collection on Americans

Two House lawmakers, Representative Justin Amash (R-MI) and Zoe Lofgren (D-CA), are pushing an amendment that would pull the plug on so-called Section 702 data collection on Americans, effectively ending a massive data collection program run by the National Security Agency unless the government promises to not intentionally collect data of Americans. The amendment would compel the government to not knowingly collect communications on Americans without a warrant. Civil liberties and rights groups, including the ACLU, the EFF, FreedomWorks, New America, and the Sunlight Foundation, and some tech giants, including Apple, Facebook, Google and Microsoft, are pushing for the amendment. The NSA has used Section 702 of the FISA Amendments Act allows the government to collect and store the communications of foreign intelligence targets outside of the U.S if a significant purpose is to collect “foreign intelligence” information. But the NSA has swept up billions of communications involving people not explicitly targeted, including Americans, using its Section 702 powers.

June 14, 2019
Zack Whittaker / TechCrunch

Zack Whittaker / TechCrunch  
Black Hat’s Pick of Will Hurd as Keynote Speaker Angers Some Cybersecurity Professionals Due to Lawmaker’s Poor Record on Women’s Rights

Some longtime attendees of one of the cybersecurity industry’s top conferences, Black Hat, are angered at the organizers’ decision to confirm Representative Will Hurd (R-TX) as the keynote speaker because of his dismal voting record on women’s rights. Hurd, a former CIA officer with cybersecurity expertise, is a self-described “pro-life” or anti-choice lawmaker with a record of voting against bills that support women’s rights. He has voted against a bill that would financially support women in STEM fields, voted in favor of allowing states to restrict access and coverage to abortions, and voted to defund Planned Parenthood. The decision to invite Hurd as keynote speaker comes at a time when women still make up a small fraction of cybersecurity professionals and efforts are continually underway to promote greater gender diversity in the field.

Related: Black Hat, ProChoice America

Tweets: @TechCrunch, @zackwhittaker, @bcrypt, @michaelclayberg