Storm clouds are gathering in the world of cybersecurity. Russian hackers likely targeted Burisma, the Ukrainian oil company at the center of Donald Trump’s various Biden conspiracies. If so, you can bet good money that they’ll selectively leak politically damaging documents ahead of the 2020 election. The Department of Justice is pressuring Apple to undermine iPhone encryption again, which you can expect to turn into another high-stakes court battle. And the NSA found a Windows 10 bug so bad they went ahead and told Microsoft—which means exploits won’t be far behind.
The timing is especially auspicious for Microsoft, which also stopped supporting Windows 7 this week, meaning an operating system used by millions of people isn’t getting any more security patches. So, update! Right now! Do it!
In piracy news, we took a look at how illicit sports livestreams have flooded Twitch. We also explained how a single cut undersea cable disrupted internet connectivity in the Red Sea region, including a days-long outage in Yemen. We explored all the ways Facebook tracks you, and your (limited) options for slowing it down. And we dug into how California’s privacy law has affected not just online stores but brick and mortars as well.
Lastly, you owe it to yourself to read the week’s most important analysis: The Mandalorian is the only smart soldier in the Star Wars galaxy.
And that’s not all! Every Saturday we round up the security and privacy stories that we didn’t break or report on in depth but think you should know about nonetheless. Click on the headlines to read them, and stay safe out there.
We’ve written lots about the site Have I Been Pwned, which maintains a massive database of leaked credentials so that victims can see if they’re affected. The bizarro world version of that is sites like WeLeakInfo, which takes that same data breach data and sells it for rock bottom prices to hackers who want to exploit it. This week, the FBI announced that it had seized WeLinkInfo, which brokered access to what it claimed was 12 billion records; as ZDNet points out, it cost only a couple of bucks a day to search that entire trove as much as you wanted. Dutch and Northern Irish police have arrested two men in connection with the site. The feds had previously taken down LeakedSource, which ran a similar playbook, but a handful of other comparable operations remain online.
The FBI disclosed this week that nation-state hackers exploited a widely publicized vulnerability in Pulse Secure VPN to break into the networks of two municipal governments and a US financial institution. The specific victims haven’t been named, but the intruders were able to “enumerate and exfiltrate user accounts, host configuration information, and session identifiers that could allow them to gain further access to the internal network,” according to an FBI bulletin. Fortunately, it appears that they were unable to break into Outlook accounts or grab additional data.
Turkey has not allowed Wikipedia since 2017. But the country’s high court decided in December that blocking access violated its citizens’ rights, and this week it was finally restored. It’s a win for free expression in a country that has seen a broad crackdown in recent years, but by no means a complete one; the Turkish government still blocks tens of thousands of sites.
Pete Buttigieg’s Democratic presidential campaign was for several months the only one with an official cybersecurity advisor on staff. Now, none of them has one. This week Mick Baccio left his post over “differences with campaign leadership over how to manage information security,” according to a report in the Wall Street Journal. The campaign has instead enlisted an outside firm for its cybersecurity needs. If 2016 proved anything, it’s that candidates are a core focus of outside hacking efforts. Russia in particular has a keen interest in obtaining internal documents and selectively leaking them for political advantage. It seems prudent for every campaign to get all the help they can get.
More Great WIRED Stories
