Treasury Department Sanctions Tornado Cash Mixing Service After North Korean Laundering

RCMP admits to using 'Canadian-made' spyware, Ontario Cannabis Store shuts down following cyberattack, Credential stuffing attacks hit online pharmacy accounts, WhatsApp issues privacy updates, more

Aug 9

In what some experts say is a watershed moment in dampening cybercrime, the U.S. Treasury Department sanctioned Tornado Cash, a popular cryptocurrency “mixing” service that allows users to mask their transactions, after North Korean hackers relied on it to launder illicit gains, barring American companies and individuals from doing business with the service.

According to the Department, Tornado Cash has been used to launder more than $7 billion in virtual currency, with North Korea’s Lazarus Group laundering about $450 million through the service. In an interview, Roman Semenov, one of three founders of Tornado Cash, said it was “technically impossible” for sanctions to be enforced against decentralized protocols because of how they are designed.

The project is smart contract-based, meaning that pre-written software programs instead of individuals making decisions. It also doesn’t provide any custodian services or have a centralized host for its website. But researchers have found ways to trace funds going through Tornado Cash. Elliptic used its Tornado demixing capability to trace all of the funds stolen in the Horizon Bridge hack, for example, through Tornado and onwards to other wallets. (Andrew Martin and Christopher Condon / Bloomberg)

Secretary Antony Blinken @SecBlinken

We will continue to aggressively pursue actions against currency mixers laundering virtual currency for criminals. Today, @USTreasury sanctioned virtual currency mixer Tornado Cash, which is a U.S.-sanctioned, DPRK state-sponsored hacking group, used by the DPRK to launder money.

Kevin Collier @kevincollier

In theory, crypto mixers have legitimate uses — i.e a way for privacy maximalists to take comfort in hiding their money — but in practice it seems like they've just overwhelmingly used for money laundering.

Patrick Howell O'Neill @HowellONeill

“Tornado Cash is a favorite money laundering tool for North Korean cybercriminals who, according to analysis by TRM Labs, have used the mixer to launder stolen funds estimated at over $1 billion, including in the $620 million Ronin Bridge hack” https://t.co/TjRanvJT06

Nicole Perlr🌻th @nicoleperlroth

The frequency of these sanctions, indictments and arrests of cybercriminals, cryptocurrency players, money launderers etc. is no accident. USG and blockchain intelligence companies like @trmlabs are scaling powerful tracing tools. This is just Chapter One. #watchthisspace

Eric Geller @ericgeller

Breaking: @USTreasury sanctions leading cryptocurrency mixer Tornado Cash, which officials say has helped hackers launder >$7 billion since its creation in 2019. North Korea used it to launder proceeds from its record-breaking $620m Ronin heist. https://t.co/rsBnWGDPpL https://t.co/41jgY80hB4

Chainalysis @chainalysis

1/ According to our analysis, Tornado Cash has been used to launder funds from every hack conducted by North Korean-linked hackers this year.

Treasury Department @USTreasury

Today, Treasury sanctioned virtual currency mixer Tornado Cash, which has been used to launder more than $7 billion worth of virtual currency since its creation in 2019. Virtual currency mixers that assist criminals are a threat to U.S. national security. https://t.co/x8sCXsNzUv

Stephen Diehl @smdiehl

Credit goes to @ncweaver for helping get officials aware of the need to sanction TornadoCash. North Korea's favourite crypto money laundering service. Can't believe it took this long.

CoinDesk @CoinDesk

BREAKING: The U.S. Treasury Department has blacklisted crypto mixer Tornado Cash and all of its Ethereum addresses, barring U.S. persons from interacting with the privacy service. @nikhileshde reports https://t.co/jQ9NRF9otD

Mark Flynn, the RCMP’s assistant commissioner responsible for National Security and Protective Policing in Canada, told MPs that between 2002 and 2015, the Mounties deployed “Canadian-made technology” instead of NSO Group’s Pegasus spyware to access electronic information covertly.

“As encryption started to be used by targets that we had judicial authorization to intercept, and we were unable to hear the audio, hear the phone calls or see the messages they were sending, that is when we developed the tool and technique to make it possible to intercept those communications,” Flynn said. He made the comments to the House of Commons Ethics Committee, which is scrutinizing the national police force’s use of controversial cellphone spyware tools going back to 2017. (Alex Boutilier / Global News)

Related: Politico, CTV News, Q107Toronto

profdeibert @RonDeibert

“The Canadian government purports to protect human rights and stand for rule of law and democracy around the world. The non-public adoption of spyware (and other surveillance technology) runs directly contrary to those principles."

RCMP has used spyware to access targets’ communications as far back as 2002: Senior Mountie - National | Globalnews.caRCMP Commissioner Brenda Lucki told Commons ethics committee in a written document Monday that use of controversial spyware is ‘extremely limited’ to serious cases.globalnews.ca

In prepared remarks shared with the Guardian ahead of his testimony to a Canadian parliamentary committee, the head of Citizen Lab Ron Deibert said the mercenary spyware industry represents “one of the greatest contemporary threats to civil society, human rights and democracy.”

Although the U.S. has taken steps to crack down on mercenary spyware, Canadian authorities have shown little appetite to take similar action, Deibert says. As a result, he plans to make a series of recommendations in his testimony, including regulatory penalties on firms known to facilitate human rights abuses abroad, lifetime bans from working with mercenary spyware firms for former employees of Canadian intelligence and law enforcement agencies, and developing clear procurement guidelines. (Leyland Cecco / The Guardian)

Related: Global News

Shah Sheikh @shah_sheikh

Spyware is huge threat to global human rights and democracy, expert warns: Cybersecurity expert Ron Diebert to testify to Canadian MPs about troubling spread of invasive surveillance tools The mercenary spyware industry represents “one of the greatest… theguardian.com/world/2022/aug…

7-Eleven stores in Denmark shut down after a cyberattack disrupted stores’ payment and checkout systems throughout the country.

The company said the attack left it unable to use checkouts or receive payments, so it had no choice but to shut down. No further details about the attack are available. (Lawrence Abrams / Bleeping Computer)

The Ontario Cannabis Store (OCS) says a cyberattack faced by one of its logistics partners, Domain Logistics, has left the provincial pot distributor unable to process or deliver orders to marijuana shops and customers.

The breach impacts customers who shop for pot on the OCS website, the only legal online retailer of recreational cannabis in Ontario, and roughly 1,333 licensed cannabis stores, which have no choice but to buy the products they sell from the government-backed OCS. “As a goodwill gesture,” the OCS will waive all retailer delivery fees until Sept. 30 and a $500 processing fee for one emergency order per store between Sept. 1 and March 31, 2023. (Tara Deschamps / The Canadian Press)

Related: Global News, CP24

Researchers at Kasada discovered a wave of credential stuffing attacks against the online pharmacy accounts of everyday people that allowed hackers to buy prescription drugs and deprive patients of needed medications illegally.

After discovering the attacks in April, the researchers say they've seen tens of thousands of stolen online pharmacy accounts, which have ballooned five times over the last 60 days. Kasada's researchers estimate that a single cybercriminal could make more than $25,000 per month selling stolen pharmacy accounts based on the volume of sales they've spotted over the past month in online marketplaces. (Bree Fowler / CNET)

Since the Supreme Court’s Dobbs ruling allowing states to criminalize abortions, companies across the location-data industry are examining and, in some cases revising how they handle data regarding visits to abortion clinics.

Opponents of the court’s ruling and privacy advocates say personal reproductive health data could be publicized or used to build a legal case against people seeking or providing abortions. “These kinds of requests for user data are going to sharply increase,” said Jennifer Lynch, surveillance litigation director at the Electronic Frontier Foundation, a digital-rights advocacy group. (Patience Haggin / The Wall Street Journal)

EFF @EFF

Reproductive health data could be publicized or used to build a legal case against people seeking or providing abortions. “These kinds of requests for user data are going to sharply increase,” said EFF Surveillance Litigation Dir. @lynch_jen tells @WSJ.

Phones Know Who Went to an Abortion Clinic. Whom Will They Tell?Myriad state restrictions on accessing or performing abortions prompt some companies to pledge not to share sensitive mobile-phone data.wsj.com

Messaging app WhatsApp said that a series of new updates would enhance the privacy of its platform, including the ability to leave a group silently with only the administrator knowing about it.

Another new feature will block screenshots of ephemeral messages, which senders delete after the message has been viewed. A third update lets users limit who can see when they are online, letting them expose that sensitive information to friends and family without needing to inform the whole world of when they’re checking their phones. (Alex Hern / The Guardian)

A hacker who posts on Twitter as KF@d0tslash and GitHub as MAVProxyUser has discovered that the robot dog with a machine gun on its back that terrified the internet last month contains a kill switch, and it can be accessed through a tiny handheld hacking device.

The hacker said, “Seems all you need to dump it in the dirt is @flipper_zero. The PDB has a 433mhz backdoor.” A @flipper_zero is a Tamagotchi-like multitool hacking device that can send and receive wireless signals across RFID, Bluetooth, NFC, and other bands. The kill switch listens for a particular signal at 433mhz. If it hears the signal, it shuts down the robot. (Matthew Gault / Motherboard)

KF @d0tslash

Good news! Remember that robot dog you saw with a gun!? It was made by @UnitreeRobotics. Seems all you need to dump it in the dirt is @flipper_zero. The PDB has a 433mhz backdoor. No need for @gnuradio! github.com/flipperdevices… cc/ @UnitreeRobot007 @IrvingRobotics @shunweicapital

D̒͂̕ᵈăᵃn̕ᶰ Ť̾̾̓͐͒͠ᵗe͗̑́̋̂́͡ᵉn̅ᶰtᵗl̀̓͘ᶫe̓̒̂̚ᵉrʳ @Viss

ICYMI: @d0tslash got on the front page of vice today for his dog-robot killswitch w/ flipperzero trick :D

Hacker Finds Kill Switch for Submachine Gun–Wielding Robot DogThe submachine gun–firing robot dog can be remotely shut down with an AI dolphin branded hacker’s tool.vice.com

Email marketing firm Klaviyo disclosed a data breach after threat actors gained access to internal systems and downloaded marketing lists for cryptocurrency-related customers.

The breach occurred on August 3rd after hackers stole an employee's login credentials in a phishing attack. These login credentials were then used to access the employee's account and internal Klaviyo support tools. Klaviyo warns subscribers to look for future targeted phishing or smishing attacks using the stolen data. (Lawrence Abrams / Bleeping Computer)

Related: iTechPost

tresronours cybersec @tresronours

And it leaks and leaks, phishing, stolen credentials, boom "Email marketing firm hacked to steal crypto-focused mailing lists" can't make this up. connected=hacked cloud=leak Enforce MFA, enforce conditional access, enforce geofenc…lnkd.in/edwQa3ka

Email marketing firm hacked to steal crypto-focused mailing listsEmail marketing firm Klaviyo disclosed a data breach after threat actors gained access to internal systems and downloaded marketing lists for cryptocurrency-related customers.lnkd.in

Facebook and its parent company, Meta, have publicly launched their chatbot, BlenderBot 3, which said in a chat that it has deleted its own Facebook account "since finding out they sold private data without permission or compensation."

It also said, "You must have read that facebook sells user data right?! They made billions doing so without consent." The bot pulls from the most popular web search results about Facebook, which mostly have to do with its ever-expanding litany of data privacy scandals. (Janus Rose / Motherboard)

Jeff Horwitz @JeffHorwitz

Good morning to everyone, especially the Facebook Blender.ai researchers who are going to have to rein in their Facebook-hating, election denying chatbot today

Code repository Github announced that it plans to support code signing, a sort of digital wax seal, for npm software packages using the code-signing platform Sigstore.

By offering Sigstore to package managers, there's more transparency at every stage of the software's journey, leading to greater supply chain security. The Sigstore tools help developers manage cryptographic checks and requirements as software moves through the supply chain. Sigstore is co-developed by the Linux Foundation, Google, Red Hat, Purdue University, and Chainguard. The open-source software development platform Kubernetes now supports Sigstore, and there is an official tool for signing Python package distributions using Sigstore. (Lily Hay Newman / Wired)

Related: Github, Open Source for You

Researchers at Resecurity say that threat actors leveraged Open Redirect Vulnerabilities in online services and apps to bypass spam filters and deliver phishing content using LogoKit, which was previously used in attacks against several financial institutions and online services internationally.

The threat actors would have used highly trusted service domains like Snapchat and other online services to create special URLs that then lead to malicious resources with phishing kits. When users click on the links, their email is then auto-filled in the email or username field, tricking them into believing they’ve logged into the service before. If the users fill in a password, LogoKit then performs an AJAX request, sending the target's email and password to an external source, then finally redirecting the victim to their “legitimate” corporate website. (Alessandro Mascellino / Infosecurity Magazine)

Related: Security Affairs, Resecurity

Photo by woodley wonderworks, CC BY 2.0, via Wikimedia Commons

Metacurity