More stories

  • in

    Apple just fixed a security flaw that allowed malware to take screenshots on Macs

    Apple has released security updates for macOS that patches a flaw in its privacy preferences and “may have been actively exploited”, according to Apple and which could have allowed malicious apps to record a Mac’s screen It’s a rather large update addressing 73 vulnerabilities, including one in Transparency Consent and Control (TCC) framework, which allows malware to bypass system privacy controls.  Apple addressed the TCC bypass in macOS Big Sur version 11.4.

    ZDNet Recommends

    “Apple is aware of a report that this issue may have been actively exploited,” it said of the bug CVE-2021-30713 affecting TCC. SEE: Network security policy (TechRepublic Premium)TCC provides the dialog prompts for security and privacy sensitive actions, such as an application recording a computer’s screen, or when giving apps access to the webcam and microphone.Security firm Jamf has posted a report on the bug and says it found the bypass being actively exploited while analyzing the XCSSET malware. “The detection team noted that once installed on the victim’s system, XCSSET was using this bypass specifically for the purpose of taking screenshots of the user’s desktop without requiring additional permissions,” it said.

    In August, Trend Micro found XCSSET was targeting Mac developers via infected Xcode projects.The malware finds an app on the system and piggybacks on it, inheriting its permissions. “During Jamf’s testing, it was determined that this vulnerability is not limited to screen recording permissions either. Multiple different permissions that have already been provided to the donor application can be transferred to the maliciously created app,” Jamf noted.”The exploit in question could allow an attacker to gain Full Disk Access, Screen Recording, or other permissions without requiring the user’s explicit consent – which is the default behavior.”Apple also released security fixes in the iOS 14.6 update for iPhones and iPads, which included 30 security fixes.SEE: This malware has been rewritten in the Rust programming language to make it harder to spotThe UK’s National Cyber Security Centre (NCSC) contributed one vulnerability report for the bug CVE-2021-30715, which allowed a maliciously crafted message to create a denial of service on an iOS device. Apple’s May 24 updates include Safari 14.1.1, which fixes 10 security flaws that could be exploited by malicious websites.    More

  • in

    Russian national jailed for running stolen data, hijacked account seller platform deer.io

    A Russian national has been jailed for 2.5 years for operating deer.io, a platform designed for the sale of stolen data and accounts.

    This week, the US Department of Justice (DoJ) said that Kirill Victorovich Firsov, 30, will spend 30 months behind bars for acting as the administrator of Deer.io, a now-defunct website that offered a form of ‘Shopify’ front for criminal activity. Deer.io, thought to have been in operation since at least 2013, hosted over 24,000 online stores on a subscription basis over the course of its lifetime, with prices set at approximately $12 per month. According to the DoJ, at the time of its seizure, Deer.io catered to 3,000 active stores with sales exceeding $17 million.  The FBI’s complaint said that despite claims deer.io was only used for legitimate businesses, a search on the website — which did not need any special access privileges — revealed that the bulk of the sales were made by cybercriminals.  Law enforcement found stolen accounts on sale, alongside PII including names, addresses, telephone numbers, and Social Security numbers. Many victims were located in the US and Europe. If a cybercriminal wished to open a deer.io store, they would upload their ‘products’ and link a cryptocurrency wallet to their storefront. The subscription fee, required monthly, was paid through cryptocurrency or payment methods such as WebMoney.  US Attorney Robert Brewer called the platform a “one-stop shopping for criminals.”

    During the FBI’s investigation, on March 4, 2020, the agency purchased 1,100 compromised gamer accounts, and then on March 5, the FBI purchased PII belonging to over 3,600 US citizens.  Firsov was arrested in New York City after flying into JFK airport from Moscow, Russia.  On January 21, 2021, Firsov pleaded guilty to the “Unauthorized Solicitation of Access Devices,” a charge which carries a maximum penalty of 10 years in prison and a $250,000 fine.  “At sentencing […] the prosecutor asserted that Firsov knew deer.io was selling stolen and counterfeit accounts, because he built the platform, which included a number of icons for US-based companies that anyone setting up a store on deer.io could click on to then sell stolen accounts from those US companies,” prosecutors say. “Even though it sold stolen accounts, deer.io was not cloaked in secrecy and required no special password for access, because everything was run out of Russia, and American law enforcement could gain no foothold.” While deciding on an appropriate sentence, presiding US District Judge Cynthia Bashant acknowledged that Firsov has already spent 15 months in the US prison system — and during the COVID-19 pandemic — and he would likely remain incarcerated when deportation procedures begin after he has served his term.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    Netgear Nighthawk RAXE500 Tri-Band Wi-Fi 6E Router, hands on: High-performance, high-capacity

    While most of us are deciding whether or not to upgrade to a new router that supports the latest Wi-Fi 6 standard (a.k.a. 802.11ax), it turns out there’s another new flavour of Wi-Fi already on its way. Called Wi-Fi 6E (E for ‘Extended’), this new standard adds the 6GHz frequency band to the 2.4GHz and 5GHz bands currently supported by Wi-Fi 6 and its predecessor, Wi-Fi 5 (formerly known as 802.11ac).   With the 2.4GHz and 5GHz bands becoming increasingly crowded, the new 6GHz band adds additional capacity that, according to the Wi-Fi Alliance, provides strong performance “even in very dense and congested environments”, such as sports arenas and business complexes.  Several networking companies have announced new routers that support Wi-Fi 6E, but Netgear is first off the starting block with its new Nighthawk RAXE500 Tri-Band Wi-Fi 6E Router. Priced at $599.99 (UK pricing TBA), the RAXE500 is very much a top-of-the-range option, boasting a top combined speed of 10.8Gbps, and eight internal antennae designed to stream data to as many as 60 devices simultaneously.   Netgear’s Nighthawk RAXE500 router supports the new 6GHz Wi-Fi 6E standard, delivering combined throughput of up to 10.8Gbps and ‘fast and reliable’ connections for up to 60 devices.
    Image: Netgear
    Netgear states that the new 6GHz band also allows the use of high-bandwidth 160MHz ‘channels’ — rather like sub-bands within the main 6GHz band — that are ideal for high-capacity applications such as streaming 4K or 8K video for entertainment or video conferencing.  The router is powered by a 1.8GHz quad-core processor and supports the latest WPA3 security standard. As well as providing high-performance Wi-Fi, the RAXE500 also includes multiple high-performance wired connections for an office network. There’s a dedicated 2.5Gbps ‘multi-gig’ Ethernet interface for high-speed internet connections, as well as five additional Gigabit Ethernet ports for wired devices, which also provide the ability to combine — or ‘aggregate’ — two ports for higher speed. The router also includes two USB 3.0 ports for connecting USB storage devices that can be shared with other network users.  Ports on the RAXE500 (left to right): 2x USB 3.0, WAN, 4x Gigabit Ethernet, 2.5Gbps Ethernet.
    Image: Netgear
    Netgear’s Nighthawk range tends to be primarily aimed at home users, but with so many people still working from home, Netgear is describing the RAXE500 as an ‘all-purpose’ router that’s suitable for video conferencing and e-learning as well.   Orbi Pro WiFi 6 Mini (SXK30): Affordable Wi-Fi 6 mesh networking.
    Image: Netgear

    Top ZDNET Reviews

    The company hasn’t yet brought Wi-Fi 6E to its business-oriented Orbi Pro mesh systems, but it has just introduced a new Orbi Pro model that aims to provide a more affordable entry-point for Wi-Fi 6 technology.  SEE: Hiring Kit: Computer Hardware Engineer (TechRepublic Premium)Previous models have been expensive tri-band mesh systems aimed at larger businesses, but the new Orbi Pro Wi-Fi 6 Mini is a more affordable dual-band option for home office use and small businesses. There are two options available, both providing Wi-Fi 6 speeds of 1.8Gbps and supporting up to 40 devices. Prices start at $299.99 for a two-piece system suitable for covering areas of up to 2,000 sq.ft, while a three-piece system that can cover 4,000 sq.ft comes in at $399.99. Like other Orbi Pro systems, the Mini allows you to create four separate networks (SSIDs) that can be assigned to different tasks or different groups of users, such as guests, employees, IT staff or admin.  RECENT AND RELATED CONTENT Netgear unveils high-performance network gear Netgear Nighthawk Wi-Fi routers go mesh Netgear releases new managed Wi-Fi access points for SMBs: WAX620 How much internet speed do you really need? Best Wi-Fi router in 2021: Expert reviews of top brands Read more reviews More

  • in

    Court finds GCHQ breached citizen's privacy with its bulk surveillance regime

    The UK Government Communications Headquarters (GCHQ) used bulk interception to unlawfully breach citizens’ privacy and free expression rights, Europe’s highest human rights court has ruled. The ruling is the culmination of three lawsuits that had accused the GCHQ’s bulk interception regime of being incompatible with the right for people to have privacy, which arose in 2013 following revelations from Edward Snowden that the GCHQ was running a bulk interception operation to tap into and store huge volumes of data, which included people’s private communications. In addition to wrapping up those three lawsuits, the landmark judgment also marks the first ruling on UK mass surveillance since Snowden’s revelations. Bulk interception is the process of targeting and collecting communications from targeted bearers through simple selectors, such as an email address. Any communications which match the simple selectors are collected from that bulk interception process, with those that do not match the simple selectors being automatically discarded.  According to the Grand Chamber of the European Court of Human Rights, the bulk interception regime contained “fundamental deficiencies”, such as lacking independent authorisation as bulk interception was approved by UK’s secretary of state; the GCHQ did not have to include categories of search terms defining what communications they would examine when applying for a search warrant; and search terms linked to an individual did not require prior internal authorisation to be used. As such, the Grand Chamber found the regime did not contain sufficient “end-to-end” safeguards and was incompatible with the right to privacy. With the decision, the Grand Chamber has ordered for bulk surveillance in the UK and across Europe to now require independent authorisation from the outset, which checks for adequate end-to-end safeguards, from the initial collection of data to the selection of items for storage.

    The court has also ordered for all bulk interception operations to be subject to supervision and independent ex post facto review, as well as assessments at “each stage of the process” of the necessity and proportionality of the measures being taken. While the court concluded that there was considerable potential for bulk interception, in its current form, to be abused, it disagreed with the applicants’ claim that bulk interception should be banned altogether. Instead, it accepted the UK’s government’s claim that bulk interception is of vital importance in helping states for identifying threats to national security, a claim that was backed by the French, Dutch, and Norwegian governments in third party submissions. In a dissenting opinion, Judge Pinto de Alburquerque said non-targeted bulk interception should be scrapped as it could target anyone as a potential suspect. “Admitting non-targeted bulk interception involves a fundamental change in how we view crime prevention and investigation and intelligence gathering in Europe, from targeting a suspect who can be identified to treating everyone as a potential suspect, whose data must be stored, analysed, and profiled,” he said. “A society built upon such foundations is more akin to a police state than to a democratic society. This would be the opposite of what the founding fathers wanted for Europe when they signed the Convention in 1950.” Big Brother Watch director Silkie Carlo said the judgment confirmed that the UK has been mass spying citizens for decades and vindicated Snowden’s whistleblowing.  “Mass surveillance damages democracies under the cloak of defending them, and we welcome the Court’s acknowledgement of this. As one judge put it, we are at great risk of living in an electronic ‘Big Brother’ in Europe,”  he said. Liberty lawyer, Megan Goulding, who represented the applicants of the lawsuit, called the judgment a victory as it recognises that governments have to respect the right to privacy and freedom of expression. “Bulk surveillance powers allow the State to collect data that can reveal a huge amount about any one of us — from our political views to our sexual orientation. These mass surveillance powers do not make us safer,” Goulding said. “Our right to privacy protects all of us. Today’s decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected.” Related Coverage More

  • in

    Slender robotic finger senses buried items

    Over the years, robots have gotten quite good at identifying objects — as long as they’re out in the open.

    Discerning buried items in granular material like sand is a taller order. To do that, a robot would need fingers that were slender enough to penetrate the sand, mobile enough to wriggle free when sand grains jam, and sensitive enough to feel the detailed shape of the buried object.

    MIT researchers have now designed a sharp-tipped robot finger equipped with tactile sensing to meet the challenge of identifying buried objects. In experiments, the aptly named Digger Finger was able to dig through granular media such as sand and rice, and it correctly sensed the shapes of submerged items it encountered. The researchers say the robot might one day perform various subterranean duties, such as finding buried cables or disarming buried bombs.

    Play video

    The research will be presented at the next International Symposium on Experimental Robotics. The study’s lead author is Radhen Patel, a postdoc in MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL). Co-authors include CSAIL PhD student Branden Romero, Harvard University PhD student Nancy Ouyang, and Edward Adelson, the John and Dorothy Wilson Professor of Vision Science in CSAIL and the Department of Brain and Cognitive Sciences.

    Seeking to identify objects buried in granular material — sand, gravel, and other types of loosely packed particles — isn’t a brand new quest. Previously, researchers have used technologies that sense the subterranean from above, such as Ground Penetrating Radar or ultrasonic vibrations. But these techniques provide only a hazy view of submerged objects. They might struggle to differentiate rock from bone, for example.

    “So, the idea is to make a finger that has a good sense of touch and can distinguish between the various things it’s feeling,” says Adelson. “That would be helpful if you’re trying to find and disable buried bombs, for example.” Making that idea a reality meant clearing a number of hurdles.

    The team’s first challenge was a matter of form: The robotic finger had to be slender and sharp-tipped.

    In prior work, the researchers had used a tactile sensor called GelSight. The sensor consisted of a clear gel covered with a reflective membrane that deformed when objects pressed against it. Behind the membrane were three colors of LED lights and a camera. The lights shone through the gel and onto the membrane, while the camera collected the membrane’s pattern of reflection. Computer vision algorithms then extracted the 3D shape of the contact area where the soft finger touched the object. The contraption provided an excellent sense of artificial touch, but it was inconveniently bulky.

    For the Digger Finger, the researchers slimmed down their GelSight sensor in two main ways. First, they changed the shape to be a slender cylinder with a beveled tip. Next, they ditched two-thirds of the LED lights, using a combination of blue LEDs and colored fluorescent paint. “That saved a lot of complexity and space,” says Ouyang. “That’s how we were able to get it into such a compact form.” The final product featured a device whose tactile sensing membrane was about 2 square centimeters, similar to the tip of a finger.

    With size sorted out, the researchers turned their attention to motion, mounting the finger on a robot arm and digging through fine-grained sand and coarse-grained rice. Granular media have a tendency to jam when numerous particles become locked in place. That makes it difficult to penetrate. So, the team added vibration to the Digger Finger’s capabilities and put it through a battery of tests.

    “We wanted to see how mechanical vibrations aid in digging deeper and getting through jams,” says Patel. “We ran the vibrating motor at different operating voltages, which changes the amplitude and frequency of the vibrations.” They found that rapid vibrations helped “fluidize” the media, clearing jams and allowing for deeper burrowing — though this fluidizing effect was harder to achieve in sand than in rice.

    They also tested various twisting motions in both the rice and sand. Sometimes, grains of each type of media would get stuck between the Digger-Finger’s tactile membrane and the buried object it was trying to sense. When this happened with rice, the trapped grains were large enough to completely obscure the shape of the object, though the occlusion could usually be cleared with a little robotic wiggling. Trapped sand was harder to clear, though the grains’ small size meant the Digger Finger could still sense the general contours of target object.

    Patel says that operators will have to adjust the Digger Finger’s motion pattern for different settings “depending on the type of media and on the size and shape of the grains.” The team plans to keep exploring new motions to optimize the Digger Finger’s ability to navigate various media.

    Adelson says the Digger Finger is part of a program extending the domains in which robotic touch can be used. Humans use their fingers amidst complex environments, whether fishing for a key in a pants pocket or feeling for a tumor during surgery. “As we get better at artificial touch, we want to be able to use it in situations when you’re surrounded by all kinds of distracting information,” says Adelson. “We want to be able to distinguish between the stuff that’s important and the stuff that’s not.”

    Funding for this research was provided, in part, by the Toyota Research Institute through the Toyota-CSAIL Joint Research Center; the Office of Naval Research; and the Norwegian Research Council. More

  • in

    Anti-money laundering regulation for all crypto exchanges on Austrac's wish list

    The Australian Transaction Reports and Analysis Centre (Austrac) in late 2017 gained authorisation to extend anti-money laundering and counter-terrorism financing (AML/CTF) regulation to cryptocurrency exchanges.Exchanges are required to enrol with Austrac and register on the Digital Currency Exchange (DCE) Register and adopt and maintain a program to identify, mitigate, and manage the money laundering and terrorism financing risks they may face. Similar to a bank, the exchange must also identify and verify the identities of their customers, and report suspicious matters, international transactions, and transactions involving physical currency that exceeds AU$10,000 to Austrac.Appearing before Senate Estimates on Tuesday, Austrac CEO Nicole Rose said her agency was expecting about 30 exchanges to register; that figure is currently 456.She said Austrac is currently looking into how it can extend regulation to the DCE space.”Austrac’s not responsible for regulating digital currencies, just in the way it’s not responsible for regulating physical currency — ie the Australian dollar — we’re interested in businesses that exchange fiat currency to digital currency, and visa versa,” Rose explained.”We register those, but that’s only one part of the cryptocurrency environment, so we’re working with the RBA and the other regulators — ASIC, APRA, and a range of other regulators in Treasury — to actually work out how broader regulation could be done throughout the regulator population, and then what possible legislative change we might need to look at to grapple with some of these issues that obviously no one had even thought about five years ago.”

    Rose said her agency and its colleagues are interested in regulating the exchanges that “turn cash into cryptocurrency” because they want the AML/CTF procedures to be in place to ensure money laundering is not occurring at that junction.Austrac deputy CEO Peter Soros said while he couldn’t guarantee that all 17,000 entities his agency deals with are fully complying, he said cryptocurrency exchanges are a sector that is “working quite hard” and is “quite enthusiastic” about ensuring compliance with their arrangements.Soros also confirmed Austrac has not taken any formal investigations against DCE’s, but that it has conducted compliance checks and supervision activities to “identify areas where they need to improve”.”It wouldn’t be a usual practice within a couple of years of a new sector coming onboard, unless the failures were so egregious or had such a massive risk to money laundering that we would be looking to be very heavy handed,” he said.The Financial Action Task Force (FATF) earlier this year began consultation on proliferation financing risk, and on digital currencies and digital currency exchange providers. FATF is the global standard-setting body for AML/CTF. One of the recommendations it has put forward is the “travel rule”.”Recommendation 16 was developed with the objective of preventing terrorists and other criminals from having unfettered access to electronically-facilitated funds transfers for moving their funds and for detecting such misuse when it occurs,” the FATF said in a consultation document [PDF]. “At the time of drafting, the FATF termed such transfers ‘wire transfers’. In accordance with the functional approach of the FATF Recommendations, the requirements relating to wire transfers and related messages under Recommendation 16 apply to all providers of such services. This includes VASPs [virtual asset service providers] that provide services or engage in activities, such as VA [virtual asset] transfers, that are functionally analogous to wire transfers.””It gives us visibility of the payer and payee primarily, which at the moment we don’t have,” Rose clarified.FINTEL ALLIANCE KICKING GOALSAustrac in early 2017 stood up a public-private initiative to follow the money trail in a bid to “harness and turbo-charge the collective knowledge of government and industry”.There are currently 29 members comprising the alliance, including ASIC, Border Force, the ACCC, the Crime Commission, AFP, ATO, Home Affairs, NSW Police Force, ANZ Bank, Bendigo and Adelaide Bank, the Commonwealth Bank, HSBC Australia, MoneyGram, Macquarie, NAB, Paypal, Tabcorp, Western Union, and Westpac.The Australian Financial Crimes exchange also shares fraud data with the alliance and it also draws on expertise of specialists from Deakin University.Austrac chief operations officer Dr John Moss said the alliance now boasts two operation hubs, one each in Sydney and Melbourne, where around 30 analysts frequent Austrac’s officers to work alongside the agency.He said in this current financial year, 4,200 suspicious matter reports have been generated by the team.”There’s a 55% increase on previous reporting from those Fintel Alliance partners,” Moss said. “We receive about 850 of those a day … we focus on wildlife trafficking, fraud against government programs, highest-risk criminal targets such as outlaw motorcycle gangs or at the highest priority, organised crime targets and professional money laundering syndicates. “We’ve also done recently a lot of work on COVID-19 in initiatives such as fraud against early release or superannuation, and Jobkeeper and Jobseeker payments.”Work of the Fintel Alliance has this year resulted in the rescue of around 14 children from the Philippines.”That intelligence actually came from Austrac in the first instance, working with Fintel Alliance partners, looking at remittance-type payments from Australia into the Philippines, and matching that with other law enforcement data,” Rose explained. “And once we had that information, we provided actionable intelligence so that Border Force and AFP then picked up that job and went further to investigate and it resolved in arrest last week.”The federal government has provided Austrac with AU$2.9 million in the 21-22 Budget to strengthen financial intelligence efforts to disrupt the cash flow behind child sexual abuse, part of an AU$11.9 million four-year package.”AU$2.9 million over four years will fund five FTE specialist analysts who will work with the Australian Centre for Child Exploitation to counter it,” Moss said. “It will allow us to do deeper analysis of our data holdings to support active law enforcement investigations.”Austrac also received AU$104 million to modernise its reporting systems and to enhance industry compliance. “That’s going to be a new IT system interacting with all of our registered entities, to nearly 17,000 entities,” Rose said. “The system that Austrac currently uses was set up about 20 years ago, and didn’t have any consideration, of course, about the huge increase in data that we would be ingesting from all of those entities.”It will also fund five offshore placements in the United Kingdom, United States, Kuala Lumpur, and China, as well as an additional intelligence team to help support the increased data flows, Moss said.MORE FROM AUSTRAC More

  • in

    Patch immediately: VMware warns of critical remote code execution hole in vCenter

    Image: MaboHH / Getty Images
    VMware is urging its vCenter users to update vCenter Server versions 6.5, 6.7, and 7.0 immediately, after a pair of vulnerabilities were reported privately to the company. The most pressing is CVE-2021-21985, which relates to a remote code execution vulnerability in a vSAN plugin enabled by default in vCenter that an attacker could use to run whatever they wished on the underlying host machine, provided they can access port 443. Even if users do not use vSAN, they are likely to be affected because the vSAN plugin is enabled by default. “The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,” VMware described the issue in an advisory. In its FAQ, VMware warned that since the attacker only needs to be able to hit port 443 to conduct the attack, firewall controls are the last line of defence for users. “Organisations who have placed their vCenter Servers on networks that are directly accessible from the internet may not have that line of defence and should audit their systems for compromise,” the company states. “They should also take steps to implement more perimeter security controls (firewalls, ACLs, etc.) on the management interfaces of their infrastructure.”

    To fix the issue, VMware recommends users update vCenter, or if not possible, the company has provided instructions on how to disable vCenter Server plugins. “While vSAN will continue operating, manageability and monitoring are not possible while the plugin is disabled. A customer who is using vSAN should only consider disabling the plugin for short periods of time, if at all,” VMware warned. Users are warned that the patches provide better plugin authentication, and some third-party plugins may break and users are directed to contact the plugin vendor. “This needs your immediate attention if you are using vCenter Server,” VMware said in a blog post. “In this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible.” Even having perimeter controls may not be enough, and VMware suggested users look at better network separation. “Ransomware gangs have repeatedly demonstrated to the world that they are able to compromise corporate networks while remaining extremely patient, waiting for a new vulnerability in order to attack from inside a network,” it said. “This is not unique to VMware products, but it does inform our suggestions here. Organisations may want to consider additional security controls and isolation between their IT infrastructure and other corporate networks as part of an effort to implement modern zero-trust security strategies.” The second vulnerability, CVE-2021-21986, would allow an attacker to perform actions allowed by plugins without authentication. “The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins,” VMware said. In terms of CVSSv3 scores, CVE-2021-21985 hit an 9.8, while CVE-2021-21986 was scored as 6.5. Earlier this year, a pair of ESXi vulnerabilities were being used ransomware gangs to take over virtual machines and encrypt virtual hard drives. Related Coverage More

  • in

    ACIC clarifies that it's not actually interested in your WhatsApp or Signal chat

    The Australian Criminal Intelligence Commission (ACIC) has taken the opportunity to revise the claims it made in a submission earlier this month around the unlawful use of encrypted communications, saying it has its sights on devices that are specifically used for illegal purposes rather than encrypted messaging apps, such as WhatsApp or Signal.In a submission to the Parliamentary Joint Committee on Intelligence and Security (PJCIS) as part of its inquiry into the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020, the commission said, “ACIC observation shows there is no legitimate reason for a law-abiding member of the community to own or use an encrypted communication platform”. Also: Cops are the only ones being lawful on the dark web, AFP declaresFacing Senate Estimates on Tuesday, ACIC CEO Mike Phelan was questioned on ZDNet’s article that highlighted the claims the submission made and said in response, “That’s not true”. “I mean, we all need encryption,” he said. “The legislation as designed — and it is absolutely our intention to not go after over-the-top apps, so I’m not after WhatsApp, Signal, Telegram, all those sorts of things. What we’re after is to get deep inside criminal networks that exist on the platforms within Australia.”Phelan clarified what he’s after are dedicated encrypted devices on closed networks, specifically, those that are only designed for criminal communications.”So, you know, it’s public, where we are after things like Cipher and also similar networks that were taken down overseas; EncroChat, Phantom Secure, Sky ECC, these are dedicated devices — you can’t even make phone calls on, only text messages within a closed network,” he said.

    See also: Police take down encrypted criminal chat platform EncroChat | Phantom Secure criminals indicted in global joint law enforcement ‘smash'”That’s what we’re after and that’s my understanding of what the legislation will enable us to do — to get behind and try and get into the encryption for intelligence purposes, not to get into networks that are, quite frankly, if it’s WhatApp or whatever.””I don’t think any legislation is going to give us the ability to do that nor could I get in behind it anyway.”The Bill, if passed, would hand the Australian Federal Police (AFP) and ACIC three new computer warrants for dealing with online crime.The first of the warrants is a data disruption one; the second is a network activity warrant; and the third is an account takeover warrant.Phelan further clarified that what he considers as illegitimate are not encrypted messaging apps, but encrypted devices.”The devices that we’re talking about — so far, the commission, through law enforcement in Australia and overseas, has not found one of them in the hands of a legitimate person,” he said.”However, I can envision a time when the technology can be used for encrypted communications legitimately, of course … It’s just that the ones — the dedicated networks — that we’re after, we haven’t seen any in the hands of people like you and me.”Devices, he reiterated, that you can’t walk into a shop and purchase.”These are networks that are financed by criminals — imported devices, imported by criminals, resold by criminal networks,” he said. “You can’t walk into a Telstra store and say I want [a] Cipher device please.”  Earlier in the day, the head of the Australian Security Intelligence Organisation (ASIO), Mike Burgess, lashed out at tech giants for running interference and handing a free pass to Australia’s adversaries and “some of the worst people in our society”.”Through the use of encryption social media and tech companies are, in effect, creating a maintaining a safe space for terrorists and spies,” Burgess said.”Encryption is a fundamental force for good as a society, we need to be able to shop, bank, and communicate online with confidence. But even a force for good can be hijacked exploited and abused.”In the case of encryption, we need to recognise how it is being used by terrorist and spies. End to end encryption is degrading our ability to protect Australia and Australians from threats, from the greatest threats.”MORE ON THE ‘HACKING BILL’ More