This week, we took an exclusive look at the chaos that unfolded inside Twitter in the hours after the accounts of Elon Musk, Bill Gates, and dozens more got hacked. Twitter has since tightened up its internal security—but with the election a little over a month away, has it done enough?
The Justice Department continued its busy month this week, announcing the global arrests of 179 alleged dark web vendors in a coordinated effort with Europol. Authorities credit the takedown of the dark web bazaar Wall Street Market in May of last year with leading them to the suspects. Facebook showed some muscle this week as well, dismantling disinformation networks that originated in China, the Philippines, and most troubling of all Russian military intelligence. And a tip from a kid about a suspicious TikTok profile led researchers to uncover adware in apps that had been collectively downloaded 2.4 million times.
We took a spin through the most important privacy and security features in iOS 14, including new ways to keep apps from snooping your camera or mic. We explained why using the single sign-on features offered by Google, Facebook and Apple may not be the safest choice. And we looked at a few Chrome extensions that will cut down on all those pesky trackers.
Finally, set aside a little time to get comfy and read this tale of a scandal that rocked the poker world. It’ll be worth it.
And there’s more! Every Saturday we round up the security and privacy stories that we didn’t break or report on in depth but think you should know about. Click on the headlines to read them, and stay safe out there.
Windows XP’s refusal to die has caused a multitude of security problems; Microsoft stopped officially providing updates to the operating system in 2014, meaning any vulnerabilities largely don’t get fixed on the millions of computers that still run it. The situation managed to get even worse this week, as Windows XP source code leaked on the file-sharing site Mega, troll forum 4Chan, and beyond. By combing through source code, hackers can identify potential weak points, making it easier to craft malware that Microsoft likely won’t bother defending its zombie OS against. Some reports indicate that the source code has circulated privately for some time now, which may blunt the impact of this wider release. Still, it’s not an encouraging development for anyone who hasn’t updated their PC in half a decade.
The Tribune Publishing Company has weathered a rough few months and beyond, cutting budgets and jobs as the pandemic has ravaged an already at-risk newspaper industry. So employees were surprised to find an email in their inbox celebrating their new bonus of as much as $10,000. The problem? There was no bonus. It was a phishing test to see who would click. Tribune staff broadly decried the move; dangling a false promise of ready cash to people who have seen colleagues let go and may have been anxious about their own futures with the company is certainly one way to trial a phishing scam, but surely there were less cruel options. (Or maybe just give everyone a Yubikey next time?)
The name Luxottica might be foreign to you, but you’ve surely heard of at least one of the brands under the eyewear monolith’s umbrella: Oakley, Ray-Ban, LensCrafters, and dozens more. Last weekend, the company suffered a cyberattack that forced it to shut down its operations in Italy and China. As of Tuesday, according to a report from BleepingComputer, business was still very much not back to normal. It’s just the latest in a trend of ransomware gangs going after “big game” targets that can afford payoffs in the millions of dollars.
Speaking of which! Russian-speaking ransomware gangs typically don’t target Russian businesses, in part because the the lines between state-sponsored and for-profit hacking are so blurred. But a group that researchers call OldGremlin has been targeting big businesses there. In fact, it’s hitting banks, manufacturing, and other firms exclusively in Russia, according to security firm Group-IB. OldGremlin’s methods aren’t especially novel; they use spear-phishing attacks to plant a custom backdoor, which they in turn use to download malware to steal an administrator’s credentials, and then deploy tailored ransomware. Nothing too crazy! But going after Russia so aggressively is certainly one way to stand out.
More Great WIRED Stories
