Again in 2018, my former colleague at VICE Motherboard Joseph Cox and I began publishing a listing of the very best cybersecurity tales that have been printed elsewhere. It wasn’t only a option to tip our hats at our pleasant rivals; by pointing to different publications’ tales, we have been giving our readers a fuller image of what had occurred on the planet of cybersecurity, privateness, and surveillance within the 12 months that was simply ending.
Our authentic inspiration was Bloomberg Businessweek’s Jealousy List, an ongoing compendium of the very best tales printed in different retailers as picked by Bloomberg reporters and editors.
Now that each Cox and I’ve moved on from Motherboard, we at TechCrunch are choosing up the cyber jealousy checklist to as soon as once more checklist the very best cybersecurity tales of the 12 months — and those we have been probably the most jealous of. — Lorenzo Franceschi-Bicchierai.
For those who have been on the web in October 2016 and lived on the U.S. east coast, you most likely keep in mind that day when main web sites like Twitter, Spotify, Netflix, PayPal, Slack, and tons of of others stopped working for a few hours. Because it turned out, that was the work of three enterprising younger hackers, who had constructed one of the vital efficient distributed denial-of-service instruments ever created.
On this prolonged piece, Andy Greenberg profiles the three younger hackers and tells the untold story of their lives, from teenage laptop nerds, to completed cybercriminals — and, ultimately, to reformed cybersecurity professionals. Sit on a snug chair and get engrossed on this must-read.
In September, an unholy alliance of Russian cybercriminals and Western youngsters with distinctive social engineering expertise allegedly hacked and took down MGM’s casinos in Las Vegas, inflicting widespread disruption. This was one of the vital talked about cyberattacks of the 12 months and several other publications stayed on the story. Jason Koebler, former editor in chief of VICE Motherboard and now one of many co-founders of the workers-owned outlet 404 Media had the sensible concept of flying to Las Vegas and seeing the chaos together with his personal eyes. The results of his journey was a bit that confirmed simply how unhealthy MGM was hit, leading to a “nightmare” for on line casino employees, as Koebler put it.
NPR’s cybersecurity correspondent Jenna McLaughlin reported from Kyiv documenting a sequence of fantastic information and audio tales about life in wartime Ukraine from those defending the country after Russia’s invasion. Cyberwarfare has performed a big function within the conflict, with cyberattacks hitting Ukraine’s energy sector and its military operations. McLaughlin’s dispatches spanned meetings with top cyber defenders to reporting on Ukraine’s defensive (and offensive) operations towards its Russian aggressors, spliced with highlights of normal everyday Ukrainian life that includes soccer, in fact.
In an astonishing about-face, electronics maker Anker admitted that its supposably always-encrypted cameras weren’t at all times encrypted. In brief, a safety researcher discovered a bug that confirmed it was possible to access unencrypted streams of customer videos, regardless of Anker’s claims that its Eufy cameras have been end-to-end encrypted. The Verge verified and reproduced the safety researcher’s findings and Anker eventually admitted that its cameras were not end-to-end encrypted because it claimed and had in actual fact produced unencrypted streams. Hats off to The Verge for its spectacular and dogged reporting attending to the underside of Anker’s misrepresentations and botched attempt to cover it up.
In 2020, Russian authorities hackers sneaked malicious code into the availability chain of software program made by SolarWinds, a tech firm whose clients vary from large companies to federal authorities businesses. The hack was stealthy and extremely efficient, giving the Russians the prospect to steal secrets and techniques from their rival nation. Veteran cybersecurity reporter Kim Zetter spoke with the individuals who helped examine the incident and reconstructed the stealthy hack nearly blow-by-blow in an extremely detailed and deep investigation. Zetter additionally printed a handy and thorough timeline of events on her Substack, which is worth subscribing to should you haven’t already.
For years, only a few individuals have been conscious of the existence of an Indian agency referred to as Appin. However because of an investigation primarily based on “interviews with hundreds of people, thousands of documents, and research from several cybersecurity firms,” as Reuters put it, its crew of journalists reported and printed proof that reveals Appin as a hacking-for-hire operation that helped to acquire data on executives, politicians, navy officers, and rich individuals everywhere in the world. This is among the most detailed and exhaustive seems contained in the shadowy world of hacking-for-hire corporations, who don’t work for governments like Hacking Staff or NSO Group, however as an alternative for rich non-public clients. The story itself made headlines when Reuters was forced to take down the story to comply with a New Delhi court order. Reuters mentioned in an editor’s note it stands by the reporting.
Trickbot is among the most lively and damaging Russian cybercrime syndicates, having hit 1000’s of corporations, hospitals, and governments in the previous couple of years. On this investigation, primarily based on interviews with cybersecurity consultants in addition to an evaluation of a trove of knowledge from the ransomware gang that leaked on-line, WIRED’s Matt Burgess and Lily Hay Newman unmask one among Trickbot’s “key personas.” The journalists determine him as a Russian man who says he’s “fucking addicted” to Metallica, and likes the traditional film Hackers. Every week later after the reporters printed, the U.S. and U.K. governments announced sanctions against 11 people for his or her alleged involvement in Trickbot — together with the person recognized within the authentic WIRED story.
“I was floored by how easily someone could steal my phone,” wrote Enterprise Insider’s Avery Hartmans, whose cellphone quantity was hijacked by somebody who tricked her provider, Verizon, into considering they have been her. Our cellphone numbers are linked to our financial institution accounts, password resets, and extra, so SIM swapping may end up in frighteningly damaging entry to an individual’s life. On this case, by exploiting this single level of failure, the hacker was capable of rack up 1000’s of {dollars} in fraudulent purchases in Hartmans’ identify. Hartmans’ breathtakingly detailed first-hand account of monitoring down her SIM swapper with unwavering dedication — with assist alongside the way in which — was an unbelievable option to elevate consciousness to those sorts of focused SIM swapping hacks, and never least to point out how ineffective most corporations may be to assist.
Information containing near a 12 months’s value of facial recognition requests obtained by Politico reporter Alfred Ng present that within the 12 months after police in New Orleans started utilizing facial recognition, the observe didn’t determine suspects more often than not and was used nearly completely towards Black individuals. Using facial recognition by police, regulation enforcement and authorities businesses stays a highly controversial practice throughout the US. Whereas critics say facial recognition is deeply flawed at a technical degree as a result of it’s almost at all times skilled on white faces, Ng’s reporting confirms what civil rights advocates have additionally argued for years: that facial recognition amplifies the human biases of the authorities that use this expertise. Or, within the phrases of 1 New Orleans council member who voted towards facial recognition, that New Orleans’ use of facial recognition is “wholly ineffective and pretty obviously racist.”
Simply as final 12 months got here to an in depth, password manager LastPass confirmed that cybercriminals stole its customers’ encrypted password vaults storing its clients’ passwords and different secrets and techniques throughout an earlier information breach. The total affect of this theft remained unknown till September 2023 when cybersecurity reporter Brian Krebs reported that a number of researchers had recognized a “highly reliable set of clues” that seemingly linked greater than 150 victims of crypto thefts linked to stolen LastPass password vaults. In line with Kreb’s in depth reporting, over $35 million in crypto had been stolen to this point. One of many victims, who had been utilizing LastPass for greater than a decade, informed Krebs they have been robbed of roughly $3.4 million value of various cryptocurrencies.
