Podcasts

The Internet Archive was breached twice by the same threat actor — first when an exposed GitLab configuration file (publicly accessible for nearly two years) enabled theft of 33 million users’ records, then again through a Zendesk support token that was among the leaked GitLab secrets and was never rotated, exposing 800,000 support tickets dating to 2018. A concurrent DDoS by a separate pro-Palestinian group initially obscured attribution for the data breach.

Stories Covered

Internet Archive Breached Twice: Unrotated GitLab Tokens Enabled Back-to-Back Compromises

The Internet Archive’s first breach began when a GitLab configuration file was left exposed on a development server (services-hls.dev.archive.org) for approximately two years — confirmed accessible since at least December 2022. The file contained GitLab authentication tokens that gave the threat actor access to pull the organization’s source code repositories. Source code repositories for web applications routinely contain what developers should never store there: hardcoded secrets, API keys, and access tokens checked in alongside the application code. The stolen credentials and secrets enabled the breach that exposed data for 33 million Internet Archive users. A DDoS attack by a separate pro-Palestinian group called SN_BlackMeta occurred simultaneously, causing initial misattribution and frustrating the actual threat actor, who contacted Bleeping Computer through an intermediary to claim credit and explain the actual access chain.

The second breach followed weeks later and was entirely preventable. Among the secrets obtained from the GitLab repositories was a Zendesk API token providing access to Internet Archive’s support ticketing system. Despite Bleeping Computer repeatedly warning the organization that their secrets had been stolen and not rotated, the Zendesk token was still active. The threat actor used it to access 800,000 support tickets submitted to [email protected] since 2018 — including requests for page removal from the Wayback Machine, which in some cases required users to upload government-issued identification documents. The attacker demonstrated this access by sending emails directly to people who had submitted old support tickets, with the messages passing all DKIM, DMARC, and SPF authentication checks — confirming the emails were sent from a legitimate Zendesk server still under attacker control.

The access token failure here is textbook. When an access token is compromised, the correct response is immediate rotation — invalidating the old token and issuing a new one. Unlike a password, a properly rotated token leaves the previous value useless regardless of who holds it. Token rotation is not optional after a known credential compromise; it is the primary remediation. The Internet Archive’s failure to rotate all exposed tokens after the initial breach is what enabled the second compromise — same actor, same stolen credentials, different service. The threat actor’s stated motive was reputation and credit within hacker communities, not financial gain — 7 terabytes reportedly stolen with no data published at time of recording. The Internet Archive’s handling of the incident — delayed response, incomplete credential rotation, failure to act on Bleeping Computer’s repeated warnings — is a failure of incident response fundamentals, not a sophisticated evasion by the attacker.

Listen to the Episode

Chinese state-backed hackers (Salt Typhoon) breached the wiretap systems of AT&T, Lumen (formerly CenturyLink), and Verizon — gaining access through the legally mandated CALEA backdoors that US law has required telecoms to build into their infrastructure since 1994. The breach represents the security community’s long-predicted outcome: a backdoor built for law enforcement becomes a backdoor for anyone who can reach it.

Stories Covered

Salt Typhoon Exploits CALEA Backdoors: Chinese Hackers Inside US Telecom Wiretap Systems

Chinese government-backed APT Salt Typhoon breached the wiretap systems of at least three of the largest US internet service providers — AT&T, Lumen (formerly CenturyLink), and Verizon — accessing the systems those companies use to facilitate lawful intercepts for law enforcement and government agencies. The compromise was first reported by the Wall Street Journal and confirmed by CNN and the Washington Post, with US government investigation in early stages. The wiretap systems are among the most sensitive in any telecom’s network: they grant access to customer internet traffic, browsing histories, and communications content. Analysts believe the access was aimed at intelligence collection and pre-positioning ahead of a potential future conflict, particularly around Taiwan.

The legal context is critical. The Communications Assistance for Law Enforcement Act (CALEA), passed in 1994 when cell phones were rare and the internet was nascent, requires telecoms and internet service providers to build wiretapping capability into their infrastructure — or encrypt communications in a way that leaves a backdoor accessible to law enforcement. This created a third-party industry of wiretapping compliance vendors that help carriers satisfy the legal requirement. The post-9/11 surveillance expansion under the Patriot Act significantly extended the use of these systems. Security researchers and technologists have warned for decades that a backdoor built for authorized use is structurally identical to a backdoor that any sufficiently capable attacker can exploit — the access mechanisms do not distinguish between a valid law enforcement request and a compromise by a nation-state adversary. The Salt Typhoon intrusion is the materialization of that warning.

The implications are significant in both directions. For individuals: SMS messages have never been end-to-end encrypted — they transit carrier infrastructure in plaintext, stored in databases during routing. Any carrier-level access exposes that data. For broader national security: the systems breached are not narrow point-access tools; they are administrative interfaces with broad, privileged visibility into customer traffic. The distinction between a government-authorized wiretap and a Chinese intelligence collection operation becomes meaningless once a threat actor gains authenticated access to the same interface. Stanford encryption policy expert Riana Pfefferkorn’s observation is accurate: the system designed to protect citizens through surveillance is, in this instance, the mechanism through which they are being surveilled by an adversary. Signal and similar end-to-end encrypted platforms sit outside this exposure by design — encrypted content intercepted at the carrier level is ciphertext without the keys, which remain on user devices.

Listen to the Episode

Kaspersky quietly uninstalled itself from US customers’ computers on September 19, 2024 — and silently installed UltraAV in its place. No consent prompt. No opt-out. Users woke up to find a different antivirus on their machines. The cause: a US government ban on Kaspersky’s Russian-linked operations, which forced the company out of the American market and into a controversial exit that raised serious questions about software consent and the national security logic behind the ban.

Stories Covered

Kaspersky Auto-Removes Itself, Auto-Installs UltraAV: US Ban Forces a Consent-Free Software Swap

The US Commerce Department banned Kaspersky from operating in the United States, citing national security concerns over the company’s Russian origins and the potential for the Russian government to influence or access its products. The ban forced Kaspersky to exit the US market entirely. Its response was to partner with UltraAV, a product of the Pango Group — a US-based cybersecurity company — and transition its paid subscribers automatically. On September 19, 2024, a Kaspersky update rolled out that silently uninstalled Kaspersky and installed UltraAV in its place. Users who had paid for Kaspersky found an unfamiliar antivirus on their systems the next morning, without ever being asked if they wanted it.

The notification defense offered by both companies is weak. Kaspersky sent emails in early September indicating that users would continue receiving protection through UltraAV, their US-based partner. Pango Group told Mashable that “all users with valid email addresses received direct communications.” But receiving a notice that a partner will provide future services is not the same as consenting to a silent auto-install. There is a meaningful difference between “you can choose to switch to UltraAV” and “UltraAV is being installed on your machine tonight.” The backlash on social media was immediate — users confused by an unknown antivirus that appeared without warning, some treating it as malware. The complaint is not unfounded: software that self-installs without explicit consent is exactly the behavior legitimate security tools are supposed to prevent.

On the product comparison: UltraAV has some features Kaspersky lacked, including up to $1 million in identity theft insurance, high-risk transaction monitoring, and social security number alerts. Kaspersky had features UltraAV does not, including webcam protection and online payment protection. Neither product is obviously superior. The national security case for the ban parallels the TikTok situation — the concern is not that Kaspersky has done anything demonstrably malicious, but that as a Russian company it remains subject to Russian government influence or compulsion. Whether that risk justifies banning the product for ordinary consumers (rather than just government networks) is a harder call. Critical infrastructure and government systems are a legitimate concern. For a home user with no connection to sensitive systems, the risk calculus looks different. What is harder to defend is the manner of the exit — users who paid for Kaspersky deserved a real choice about what replaced it.

Listen to the Episode

Apple is dropping its three-year-old lawsuit against NSO Group, the Israeli maker of Pegasus spyware — not because it won, but because winning no longer matters. The spyware market has proliferated so dramatically that eliminating NSO would simply clear space for dozens of competitors who would continue the same attacks, potentially armed with detection-evasion insights gleaned from Apple’s own court filings.

Stories Covered

Apple Drops NSO Lawsuit: Spyware Market Too Fragmented to Win Through Courts

Apple filed suit against NSO Group in 2021 after Pegasus spyware was found exploiting zero-day vulnerabilities in iOS to conduct surveillance on journalists, activists, and political dissidents. The suit was seen as a significant legal counteroffensive against commercial spyware vendors. Three years later, Apple’s executives are seeking to withdraw — citing two interconnected problems. First, the legal discovery process would require Apple to disclose details about how it detects and responds to zero-day exploits, effectively handing a roadmap to every spyware vendor in the market. Second, NSO itself has been fighting to shield its proprietary processes from disclosure, creating an asymmetric situation where Apple shows its hand while NSO stays covered. The calculus turned negative.

The second problem is the more fundamental one. When Apple filed in 2021, NSO Group was the dominant player in the commercial spyware space. A court victory would have materially reduced the threat. By 2024, Google’s Threat Analysis Group reported that 75% of known zero-day exploits against Google products and Android-based systems came from commercial surveillance vendors — plural. Of 37 zero-day vulnerabilities in browsers and mobile devices discovered in one recent year, more than 60% were attributed to spyware vendors selling to governments. The Atlantic Council’s analysis of the Intellexa Consortium documented a complex web of holding companies, developers, and distribution networks that make the spyware market more like an industry than a single threat actor. Apple’s filing acknowledged the shift directly: even a complete victory against NSO would leave a growing list of unaffiliated competitors untouched, each of whom could benefit from the exposed court documents.

The strategic reorientation toward technical countermeasures over legal ones reflects a realistic read of the threat landscape. Apple’s security surface — spanning iPhone hardware, iCloud, iOS across multiple generations, Apple Pay, and device authentication — is vast. Spyware vendors profit precisely from the gap between vulnerability discovery and patch deployment. The commercial surveillance market is growing because it is profitable: government agencies worldwide pay significant sums for capabilities that were once the exclusive domain of national intelligence services. The private sector has largely overtaken government programs in offensive capability development, driven by contract revenue. In that environment, a legal strategy targeting one company is a whack-a-mole approach — costly in disclosure and time, with diminishing returns as the market fragments. Apple’s decision to redirect those resources into its internal threat intelligence program is the correct call.

Listen to the Episode

ESET researchers discovered NGate — an Android malware that weaponizes NFC technology to steal tap-to-pay data from physical credit and debit cards and relay it to an attacker’s device. The attack chains social engineering, phishing, and NFC relay together, ending with fraudulent ATM withdrawals using a victim’s cloned card — no physical card theft required.

Stories Covered

NGate Android Malware: NFC Relay Attack Clones Tap-to-Pay Cards Without Touching Them

NGate is built on NFCGate, a legitimate research tool developed by students at Germany’s University of Darmstadt for capturing, analyzing, and relaying Near Field Communication traffic between devices. ESET, who discovered and named the malware, called it the first of its kind observed in the wild exploiting NFC relay for financial fraud. The attack begins with an SMS to potential victims — typically claiming a tax-related issue — that redirects them to a Progressive Web App (PWA) or web APK. These fake apps mimic bank interfaces and harvest banking credentials including account ID, birthdate, and card PIN. A follow-up phone call from a fake bank employee instructs the victim to enable NFC on their phone and hold their payment card against the back of the device. NGate captures the card’s NFC data and relays it through a server to the attacker. Czech authorities arrested a 22-year-old suspect in connection with the campaign.

The technical mechanism exploits how contactless payment tokenization works. When a card is registered with Google Pay or Apple Pay, a token is generated and stored on the device — not the raw card number. That token is what the phone transmits to payment terminals and ATMs. NGate captures the NFC signals from the victim’s physical card (which also broadcasts tokenized payment data), relays those signals to the attacker’s Android device, and injects them into the device’s secure memory. The attacker’s phone needs to be rooted to access the secure memory areas where payment tokens are stored — once it is, the attacker can present the phone at any NFC-enabled ATM and impersonate the victim’s card. Combined with the PIN captured during phishing, the attacker has everything needed for a full ATM withdrawal. If the NFC relay fails, the fallback is a direct bank transfer using the credential data already stolen.

The attack succeeds because it requires the victim to do almost nothing unusual — holding a card against a phone is a normal behavior that people already associate with tap-to-pay setup. The defense is straightforward: banks do not call customers and ask them to install apps or hold cards against their phone. Any unsolicited call instructing you to download something or enable a phone feature for “verification” should be hung up on immediately. If in doubt, call the bank back using the number on the card — not the number the caller provides. NGate also demonstrates why sideloaded apps (installed outside the Play Store or App Store) remain dangerous even when the social engineering story is plausible. Official app stores are not perfect, but they present a meaningfully higher barrier than a link in an SMS.

Listen to the Episode

OpenAI banned accounts linked to Iran’s covert influence operation Storm 2035, which used ChatGPT to generate social media content targeting the US presidential election from both sides of the political spectrum. Simultaneously, Google disrupted APT42 (linked to Iran’s IRGC) spear-phishing campaigns aimed at US presidential campaign accounts. Nation-state actors are using AI to scale election interference operations — though with limited engagement so far.

Stories Covered

OpenAI Blocks Storm 2035: Iran Used ChatGPT to Generate US Election Propaganda

OpenAI identified and shut down a cluster of ChatGPT accounts tied to Storm 2035, an Iranian covert influence operation that used the AI model to generate social media content about the US presidential election, the conflict in Gaza, Israel’s participation at the Olympic Games, Venezuelan politics, and the Latin X community. Content was produced in English and Spanish and distributed across approximately a dozen accounts on X (formerly Twitter) and one on Instagram. The operation’s tactics included using AI to re-spin comments posted by real social media users, interspersing political content with posts about fashion and beauty to appear authentic, and building fake influencer personas with manufactured interaction history before activating them for influence purposes. OpenAI noted that despite the scale of content generation, the posts received negligible engagement — minimal likes, shares, or comments — and found little evidence the long-form articles generated using ChatGPT were meaningfully distributed.

The parallel threat from Russia is more mature and operationally evolved. Microsoft has tracked an uptick in Russian foreign influence activity targeting the US election. The Doppelganger network (also tracked as Rooza Flood), Storm 1516, and Storm 1841 (Rybar) have all been active. Doppelganger’s particular innovation is link obfuscation: social media posts contain links that initiate multi-hop redirect chains — including URL shorteners like TinyURL — to conceal the final destination and evade automated link-checking bots. Meta reported that the network has disrupted 39 Russian, 30 Iranian, and 11 Chinese influence operations across its platforms since 2017. The ongoing cat-and-mouse is exactly what one would expect: as platforms improve detection, operators shift to nonpolitical cover content (entertainment, lifestyle) and additional redirect layers to avoid tripping automated defenses.

Google’s Threat Analysis Group simultaneously disclosed that it detected and disrupted spear-phishing campaigns by APT42 — an Iranian state-sponsored threat actor affiliated with the Islamic Revolutionary Guard Corps, overlapping with the group also known as Charming Kitten and Mint Sandstorm — targeting personal accounts of high-profile individuals in Israel and the US, including those associated with presidential campaigns. APT42’s approach exploits trusted cloud services: malicious files and phishing pages hosted on Google Drive, Google Sites, OneDrive, and Dropbox to reduce suspicion before redirecting to attacker infrastructure. The broader picture is that influence operations and account-compromise operations are two tracks of the same program — one generates propaganda at scale, the other seeks to take over high-reach accounts to amplify it through an audience that trusts the hijacked identity.

Listen to the Episode