Month: February 2020

When Iranian-born German academic Erfan Kasraie received an email from The Wall Street Journal requesting an interview, he sensed something was amiss.The Nov. 12 note purportedly came from Farnaz Fassihi, a veteran Iranian-American journalist
who covers the Middle East. Yet it read more like a fan letter, asking Kasraie to share his
“important achievements” to “motivate the youth of our beloved country.””This interview is a great honor for me,” the note gushed.Another red flag: the follow-up email that instructed Kasraie to enter his Google password
to see the interview questions.The phony request was, in reality, an attempt to break into Kasraie’s email account. The
incident is part of a wider effort to impersonate journalists in hacking attempts that three cybersecurity firms said they have tied to the Iranian government, which rejected the claim.The incidents come to light at a time when the U.S. government has warned of Iranian cyber threats in the wake of the U.S. airstrike that killed Iran’s second most powerful official,
Major-General Qassem Soleimani.In a report published Wednesday, London-based cybersecurity company Certfa tied the impersonation of Fassihi to a hacking group nicknamed Charming Kitten, which has long been associated with Iran.Israeli firm ClearSky Cyber Security provided Reuters with documentation of similar
impersonations of two media figures at CNN and Deutsche Welle, a German public broadcaster.ClearSky also linked the hacking attempts to Charming Kitten, describing the individuals
targeted as Israeli academics or researchers who study Iran. ClearSky declined to give the
specific number of people targeted or to name them, citing client confidentiality.FILE – Erfan Kasraie, an Iranian science journalist from Kassel, is pictured in Berlin, Germany, Jan. 30, 2020.Digital threatIran denies operating or supporting any hacking operation. Alireza Miryousefi, the spokesman for the Islamic Republic’s mission to the United Nations, said that firms claiming otherwise “are merely participants in the disinformation campaign against Iran.”Reuters uncovered similar hacking attempts on two other targets, which the two cybersecurity firms, along with a third firm, Atlanta-based Secureworks, said also appeared to be the work of Charming Kitten. Azadeh Shafiee, an anchor for London-based satellite broadcaster Iran International, was impersonated by hackers in attempts to break into the accounts of a relative of hers in London and Prague-based Iranian filmmaker Hassan Sarbakhshian.Sarbakhshian — who fled the Islamic Republic amid a crackdown that saw the arrest of several fellow photojournalists in 2009 — was also targeted with an email that claimed to be from Fassihi. The message asked him to sign a contract to sell some of his pictures to The Wall
Street Journal. Sarbakhshian said in an interview that he was suspicious of the message and
didn’t respond.Neither did the ruse fool Kasraie, an academic who frequently appears on television
criticizing Iran’s government.”I understood 100 percent that it was a trap,” he said in an interview.That’s not surprising given the hackers’ sloppy tactics. For instance, they missed the fact
that Fassihi had left the Journal last year for a new job at The New York Times.The Journal declined to comment. Fassihi referred questions to The Times, which in a
statement called the impersonation “a vivid example of the challenges journalists are facing
around the globe.”U.S. officials and cybersecurity experts see Iran as a digital threat. Earlier this month,
the U.S. Department of Homeland Security and the Federal Bureau of Investigation (FBI) issued alerts about the threat of Iranian cyberattacks following the controversial U.S. attack that killed Soleimani. Microsoft, which tracks attempts to undermine election security, in October accused Charming Kitten of targeting a U.S. presidential campaign; sources told Reuters at the time that the campaign was Donald Trump’s.FILE – Iranian cybersecurity experts and members of Certfa Nariman Gharib, left, and Amin Sabeti check their messages as they work from their office in London, Britain, Jan. 7, 2020.Links to Charming KittenHomeland Security and FBI spokespeople declined to comment on the recent impersonations
identified by Reuters. Certfa, ClearSky, and Secureworks said they could be tied to Charming
Kitten through a study of the tactics, targets, and digital infrastructure involved — including
servers, link shortening services, and domain registration patterns.”This activity does align with prior Iranian cyber operations,” said Allison Wikoff, a Secureworks researcher who has tracked Charming Kitten for years.In early 2019, the United States indicted Behzad Mesri — who ClearSky has linked to Charming Kitten through emails and social media activity — on charges of recruiting a former U.S. Air Force intelligence officer to spy on behalf of Iran. Mesri remains at large and could not be reached for comment.Other impersonated journalists included CNN national security analyst Samantha Vinograd,
whose identity was stolen in August and used in attempts to break into email accounts in Israel, ClearSky said. Another was Michael Hartlep, a Berlin-based videojournalist who has done freelance assignments for Deutsche Welle and Reuters. ClearSky found his name on an email inviting recipients to a bogus Deutsche Welle webinar on Iran’s role in the Middle East. The firm did not find evidence that the Reuters name was used in hacking attempts.In another case, the hackers appear to have invented a journalist — “Keyarash Navidpour” —
to send out a phony invitation on Jan. 4 to an online seminar that it claimed Deutsche Welle
would hold about the killing of Soleimani the day before. No such journalist works for Deutsche Welle, said the news organization’s spokesman Christoph Jumpelt.Vinograd referred questions to CNN, which did not return messages seeking comment. Hartlep told Reuters he worried such stunts might give sources second thoughts about answering a reporter’s queries.”If this becomes the usual way of tricking people,” he said, “definitely it makes our work
very hard.”
 
…

Twitter said on Monday that it had discovered attempts by possible state actors to access the phone numbers associated with user accounts, after a security researcher unearthed a flaw in the company’s “contacts upload” feature.In a statement published on its privacy blog, Twitter said it had identified a “high volume of requests” to use the feature coming from IP addresses in Iran, Israel and Malaysia. It said, without elaborating, that “some of these IP addresses may have ties to state-sponsored actors.”A company spokeswoman declined to say how many user phone numbers had been exposed, saying Twitter was unable to identify all of the accounts that may have been impacted.She said Twitter suspected a possible connection to state-backed actors because the attackers in Iran appeared to have had unrestricted access to Twitter, even though the network is banned there.Tech publication TechCrunch reported on Dec. 24 that a security researcher, Ibrahim Balic, had managed to match 17 million phone numbers to specific Twitter user accounts by exploiting a flaw in the contacts feature of its Android app. TechCrunch said it was able to identify a senior Israeli politician by matching a phone number through the tool.The feature, which allows people with a user’s phone number to find and connect with that user on Twitter, is off by default for users in the European Union where stringent privacy rules are in place. It is switched on by default for all other users globally, the spokeswoman said.Twitter said in its statement that it has changed the feature so it no longer reveals specific account names in response to requests. It has also suspended any accounts believed to have been abusing the tool.However, the company is not sending individual notifications to users whose phone numbers were accessed in the data leak, which information security experts consider a best practice.
…

Irish regulators have launched separate inquiries into Google and dating app Tinder over how they process user data, in a new round of regulatory scrutiny aimed at tech companies.Ireland’s Data Protection Commission said Tuesday that it decided to look into how Google handles location data after a number of consumer groups across the European Union filed complaints.The commission opened an investigation into Google’s Irish subsidiary to determine whether the U.S. search giant “has a legal basis for processing the location data of its users” and whether it meets transparency obligations under the EU’s strict General Data Protection Regulation, or GDPR.Google “will cooperate fully with the office of the Data Protection Commission in its inquiry, and continue to work closely with regulators and consumer associations across Europe,” the company said in a statement. “In the last year, we have made a number of product changes to improve the level of user transparency and control over location data.”The regulator is also investigating Tinder after people in Ireland and elsewhere in the EU raised concerns about issues surrounding U.S. parent company Match Group’s “ongoing processing of users’ personal data” related to Tinder, transparency and compliance with GDPR.“Transparency and protecting our users’ personal data is of utmost importance to us,” Match Group said. “We are fully cooperating with the Data Protection Commission, and will continue to abide by GDPR and all applicable laws.”Ireland’s Data Privacy Commission is the lead EU regulator for both companies because their European headquarters are based in Dublin. Under GDPR, regulators can fine companies up to 20 million euros, or 4% of global turnover, whichever is higher, for any breaches as well as require changes to follow the law.The commission now has a total of 23 inquiries into big U.S. tech companies, which also include Facebook and Twitter. It launched a separate investigation of Google last year over personalized online advertising.
…