A white hat hacking team has won a life-changing amount of money for completing the world’s first public remote jailbreak of the iPhone 13 Pro.

The feat was performed over the weekend at the fourth annual Tianfu Cup, an international cybersecurity competition held in Chengdu in the People’s Republic of China. The event offers big cash prizes to cybersecurity researchers who can demonstrate their ability to get around the digital defenses of consumer software and devices.

During the Cup, Apple’s newest iPhone, running the latest and fully patched version of iOS 15.0.2, was reportedly hacked not once but twice. 

The first hack was demonstrated live on stage by the Kunlan Lab team. It was achieved in fifteen seconds by exploiting a remote code execution vulnerability.

Another team at the Tianfu Cup that managed to hack into Apple’s latest iPhone was Team Pangu. It was this team that claimed the top prize in the competition for remotely jailbreaking a fully patched iPhone 13 Pro running iOS 15. 

According to Forbes, the details of how Team Pangu achieved the hack have not been publicized. But reports suggest that when a user clicked on a link forged by the team, the Safari web browser was triggered. 

The team was then able to bypass the browser’s protection mechanism and exploit multiple iOS15 kernel vulnerabilities to access the iPhone’s contents. 

The hacking team accessed apps and photo albums and was able to directly delete data on the iPhone and execute other commands.

Three tiers of prizes were up for grabs by teams that hacked the iPhone 13 Pro. A team that broke in using remote code execution could win $120,000, while remote code execution with a sandbox escape could earn the competing team $180,000. For the remote jailbreak, the trickiest feat to pull off, the cash prize was a whopping $300,000.

Other hacking targets featured in the competition included remote code execution attacks against Safari running on both Intel and Apple Silicon MacBook Pro models, the multi-functional Network-Attached Storage server Synology NAS, a Xiaomi Mi 11 smartphone, and Windows 10 and Google Chrome running on notebooks.

South Korea is seeking assistance from the International Criminal Police Organization (Interpol) to arrest two foreign nationals suspected of being cyber-criminal gang leaders.

The two individuals allegedly played a key role in multiple cyber-attacks and a major extortion scam that claimed victims in both South Korea and the United States. 

On Friday, South Korea said that it had asked Interpol to issue a “Red Notice” for the suspects to bring them to the country to face prosecution. 

Red notices, the most consequential type of notice Interpol can issue, “seek the location and arrest of a person wanted by a legal jurisdiction or an international tribunal with a view to his/her extradition.”

The notice isn’t an arrest warrant, but it is a request to law enforcement worldwide to locate and provisionally arrest a person pending extradition, surrender, or similar legal action.

The Korean Police Agency said it has received domestic arrest warrants for the two suspects. However, the names of the two suspects have not been released. But it has been reported that one of the suspects is a Ukrainian national who was detained along with five other people by Ukrainian police in June. 

The detention was part of a joint raid by South Korean and United States authorities on the homes of individuals allegedly linked with the Clop ransomware gang. 

It is alleged by the South Korean police that the detained suspects laundered virtual currency for a hacking organization. The crypto-currency was allegedly the proceeds of ransomware attacks and was later converted into cash. 

South Korean police charged three of the detainees earlier this month with violating South Korea’s laws on communication networks and information protection, extortion and concealing criminal proceeds. 

Choi Jongsang, chief of the South Korean police’s cybercrime investigation division, said that the two red notice suspects played leading roles in cyber-attacks carried out in 2019. The attacks deployed ransomware against a university and three companies in South Korea. 

The victims capitulated to the attackers’ demands, handing over a Bitcoin ransom worth $3.8m. Police in the Ukraine reportedly said that the same gang attacked Stanford Medical School, the University of Maryland, and other educational establishments in the United States.

American media company Sinclair Broadcast Group is in the grips of a ransomware attack.

The Baltimore-based company, which operates and/or provides services to 185 television stations in 86 markets, became aware of a potential security incident on Saturday and launched an investigation. 

In a statement released Monday, the group said: “On October 17, 2021, the Company [Sinclair Broadcast Group] identified that certain servers and workstations in its environment were encrypted with ransomware, and that certain office and operational networks were disrupted.”

Sinclair Broadcast Group said that the unknown attacker(s) took data from its company network. It is not yet known whether any sensitive information was among the data stolen during the attack.

“The Company is working to determine what information the data contained and will take other actions as appropriate based on its review,” said Sinclair Broadcast Group.

In response to the event, the group implemented its incident response plan and took measures to contain the incident.

“Legal counsel, a cybersecurity forensic firm, and other incident response professionals were engaged. The Company also notified law enforcement and other governmental agencies,” said Sinclair Broadcast Group. 

As the forensic investigation into the attack continues, operations at the company remain strange.

The group warned that “the event has caused – and may continue to cause – disruption to parts of the Company’s business, including certain aspects of its provision of local advertisements by its local broadcast stations on behalf of its customers.”

The company added that it is “working diligently to restore operations quickly and securely” and that it will “look for opportunities to enhance its existing security measures.”

The impact of the attack is reportedly being felt far away from the company’s headquarters in Maryland. Kristin Bien, a weekend anchor at Sinclair-owned WSBT 22 in Indiana, tweeted on Sunday: “We don’t have access to our company emails or anything that requires a company login.”

Meanwhile, Nashville, Tennessee’s WZTV uploaded a statement to its website on Monday about “serious technical issues” impacting its ability to stream content.

“We are also currently unable to access our email and your phone calls to the station,” the statement read.

Fraud victims suffer well-being costs of £9.3bn per year, according to a new study by Which?

The consumer group made the calculation after conducting an analysis of the psychological harms experienced by people who lose money to scammers. The research conducted with consultancy firm Simetrica found that scam victims have a lower life satisfaction on average than the general population. This includes higher levels of anxiety, lower levels of happiness and to a lesser extent, worse general health.

To make their findings, the researchers analyzed over 17,000 responses to a survey by the Office for National Statistics’ Crime Survey for England and Wales, which asked respondents about the impact on well-being of being scammed.

They applied these results to a social impacts model approved by the UK government earlier this year. This model translates well-being changes into monetary terms.

Which? then calculated that the average drop in well-being for fraud victims equates to £2509 per year. The value is even higher for online fraud, at £3684. These figures are significantly higher than the average financial fraud losses, estimated by Which? to be around £600 per incident.

By applying these calculations to the 3.7 million fraud incidents in 2019/20, the researchers concluded that the overall well-being loss associated with fraud is £9.3bn.

Interestingly, online fraud alone was associated with well-being losses of £7.2bn, highlighting how scammers have increasingly targeted digital consumers in recent years, particularly amid the digital shift since COVID-19.

In July, an analysis by money.co.uk found that Brits lost more than £1bn to fraud and cybercrime in the first six months of 2021.

Which? is now calling on the UK government to include scam adverts in its Online Safety Bill, announced earlier this year.

Rocio Concha, director of policy and advocacy at Which?, outlined: “Our research shows that scam victims suffer a significant drop in well-being when they are targeted by criminals. This brings home the scale of the emotional and psychological harm that victims suffer when they are defrauded.

“The government must not ignore the huge impact an epidemic of fraud is having on our society. Scam adverts must be included in the Online Safety Bill and ministers must set out plans for laws and regulations that will make online platforms use their highly sophisticated technology to effectively tackle harmful content on their sites.”

Commenting on the research, Tim Sadler, co-Founder and CEO for Tessian, said: “Of course, we must recognize the emotional and mental toll online fraud has on people, in addition to the financial damage. Online scams have surged during the pandemic, with cyber-criminals impersonating trusted organizations and institutions over email or text to successfully con people into sharing sensitive data, payment information or login credentials. And this has left people feeling anxious, scared and helpless.”

European police have announced a major operation designed to tackle a wave of anticipated fraud linked to the disbursement of the EU’s COVID-19 recovery fund.

The €807bn ($935bn) in NextGenerationEU loans and grants will be split between 19 member states and is designed to support investment in more sustainable and resilient societies – to correct some of the economic and social damage wrought by the pandemic.

However, the fund will also be a magnet for fraudsters, which is why Europol has announced Operation Sentinel. The initiative will also receive support from four EU entities and authorities from all participating member states.

“Recent experience from the evolution of the criminal landscape during the COVID-19 pandemic suggests these efforts will attract criminal groups active in the EU and beyond. Criminals have shown themselves to be quick in adapting to the pandemic and its impact, and they are using every opportunity to maximize illegal profits,” said Europol.

“For this purpose, Europol will establish a dedicated internal mechanism to process operational data, steer information exchanges and support ongoing cases. The joint activities will target fraud, as well as tax evasion, excise fraud, corruption, embezzlement, misappropriation and money laundering.”

The experience of the US could be instructive in this regard. The country experienced widespread fraud targeting individuals who received COVID-19 stimulus checks and exploiting the fact that businesses were eligible for various hand-outs and loans.

The Federal Trade Commission (FTC) claimed it received double the number of identity theft reports than usual during 2020.

It also estimated back in March that pandemic-related fraud may have cost Americans around $382m, although the true figure is likely to be much higher as it only relates to consumer fraud reported to the agency.

Paycheck Protection Program (PPP) loans were another central area of fraud as business owners, and criminal gangs tried to take advantage of government largesse.

One report estimated that as many as 15% of PP loans may have been fraudulent, at a potential cost to the taxpayer of $76bn.

A massive breach at one of the world’s biggest gaming platforms earlier this month may not be as bad as first thought, with the firm claiming that no passwords were exposed in the incident.

Security experts roundly criticized Amazon-owned Twitch after an anonymous user posted a 125GB torrent link to 4Chan, and claimed to have leaked every digital property owned by the firm.

However, in an update on Friday, Twitch claimed that user passwords were not impacted.

“We are also confident that systems that store Twitch login credentials, which are hashed with bcrypt, were not accessed, nor were full credit card numbers or ACH / bank information,” it added.

“The exposed data primarily contained documents from Twitch’s source code repository, as well as a subset of creator pay-out data. We’ve undergone a thorough review of the information included in the files exposed and are confident that it only affected a small fraction of users and the customer impact is minimal. We are contacting those who have been impacted directly.”

At the time, the attacker claimed to have all of the firm’s source code; mobile, desktop and console clients; proprietary SDKs and internal AWS services; and “every other property” it owns, including IGDB, CurseForge and an unreleased Steam competitor, dubbed “Vapor.”

Also reportedly compromised were red teaming tools used by the Twitch’s SecOps function and information on how much the firm paid its most popular streamers.

That prompted some to argue the incident was “as bad as it gets” from an infosecurity perspective. Others were dumbfounded that an individual could have stolen so much sensitive information without setting off any internal alarms.

Although only a small number of users appear to have been impacted by the incident, the scale of the IP breach would still indicate that Twitch’s security posture was not up to par. 

The unauthorized third party in question was able to access the data after a server misconfiguration, according to Twitch.