It’s been a week since the world avoided a potentially catastrophic cyberattack. On March 29, Microsoft developer Andres Freund announced his discovery of a backdoor in XZ Utils, a compression tool widely used in Linux distributions and therefore in countless computer systems around the world. The backdoor was placed in the open source tool by someone operating under the persona “Jia Tan” after years of patiently working to build a reputation as a reliable volunteer developer. Security experts believe Jia Tan is the work of a nation-state actor, with clues largely pointing to Russia, although the final attribution for the attack remains unclear.
In early 2022, a hacker operating under the name “P4x” brought down North Korea’s internet after the country’s hackers targeted him. This week, WIRED revealed P4x’s true identity as Alejandro Caceres, a 38-year-old Colombian American. After his successful attack on North Korea, Caceres placed the US military in a special forces-style offensive hacking team that would conduct operations similar to the one that made P4x famous. The Pentagon ultimately declined, but Caceres has launched a startup, Hyperion Gray, and plans to further pursue his controversial approach to cyberwarfare.
In mid-February, millions of people lost internet access after three submarine cables were damaged in the Arabian Sea. Some blamed Yemen’s Houthi rebels for attacking ships in the region, but the group denied sabotaging the cables. But rebel attacks are still likely to blame, albeit in a bizarre way. A WIRED analysis of satellite images, maritime data and more found that the cables were likely damaged by the aft anchor of a cargo ship that the Houthi rebels had bombed. The ship drifted for two weeks before finally sinking, crossing paths with the cables at the time they were damaged.
The myth that Google Chrome’s Incognito Mode provides sufficient privacy protection may finally be debunked. As part of a settlement over Google’s incognito privacy claims and practices, the company has agreed to delete “billions” of data collected while users browsed in incognito mode. It will also further clarify how much user data can be collected by Google and third parties while incognito is enabled, and take further steps to protect user privacy. There are other privacy-focused browsers that can replace Chrome. But if you are still using it, make sure you update it to fix some serious security flaws.
But that is not everything. Every week we round up the security and privacy news that we haven’t covered in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.
A 58-year-old hospital system administrator pleaded guilty this week to U.S. federal charges after he was caught using another man’s name for more than 30 years. Matthew David Keirans allegedly stole William Woods’ identity in 1988, when the two men worked at a hot dog cart in Albuquerque, New Mexico. U.S. Attorney’s Office for the Northern District of Iowa. Over the decades, Keirans have obtained work, bank accounts, loans and insurance, and paid taxes under Wood’s name. Keirans even had a child whose last name is Woods.
The real William Woods, meanwhile, reportedly found out that someone else was using his identity in 2019. Woods was unhoused and living in Los Angeles at the time. He contacted a bank where “William Woods” had an account and provided his real Social Security card and California identification card to prove his identity. However, he was unable to answer the security questions to gain access. The bank called Keirans – posing as Woods – and Keirans convinced the bank employee that the real Woods should not have access to the accounts. Los Angeles police subsequently arrested the real Woods and charged him with identity theft after Keiran’s officers provided false documents and information.
In a nightmarish twist, the real Woods meticulously insisted during a court proceeding that “William Donald Woods” was his true identity, prompting the court to send him to a mental institution. The real Woods ultimately spent 428 days in jail and 147 days in a psychiatric hospital before being released.