The Cybersecurity Stories that Made Us Green with Envy in 2023

In 2018, Lorenzo Franceschi-Bicchierai and Joseph Cox of VICE Motherboard started publishing a list of the best cybersecurity stories from other publications. This year, we at TechCrunch continue the tradition, recognizing the very best in our competitors’ work. From an incredible story about young hackers causing widespread internet disruption in 2016 to in-depth investigations on Russian cybercrime, Indian hacking-for-hire operations and shocking findings on the failures of facial recognition systems, here is our list of the top cybersecurity stories of the year that we couldn’t help but be jealous of. A Comprehensive Look at the Best Cybersecurity Stories of 2023 If you were on the internet in October 2016 and lived on the U.S. east coast, you probably remember that day when major websites like Twitter, Spotify, Netflix, PayPal, Slack, and hundreds of others stopped working for a couple of hours. As it turned out, that was the work of three enterprising young hackers, who had built one of the most effective distributed denial-of-service tools ever created. In this lengthy piece, Andy Greenberg profiles the three young hackers and tells the untold story of their lives, from teenage computer nerds, to accomplished cybercriminals — and, in the end, to reformed cybersecurity professionals. Sit on a comfy chair and get engrossed in this must-read. In September, an unholy alliance of Russian cybercriminals and Western teenagers with exceptional social engineering skills allegedly hacked and took down MGM’s casinos in Las Vegas, causing widespread disruption. This was one of the most talked about cyberattacks of the year and several publications stayed on the story. Jason Koebler, former editor in chief of VICE Motherboard and now one of the co-founders of the workers-owned outlet 404 Media had the smart idea of flying to Las Vegas and seeing the chaos with his own eyes. The result of his trip was a piece that showed just how bad MGM was hit, resulting in a “nightmare” for casino workers, as Koebler put it. NPR’s cybersecurity correspondent Jenna McLaughlin reported from Kyiv documenting a series of excellent news and audio stories about life in wartime Ukraine from those defending the country after Russia’s invasion. Cyberwarfare has played a significant role in the war, with cyberattacks hitting Ukraine’s energy sector and its military operations. McLaughlin’s dispatches spanned meetings with top cyber defenders to reporting on Ukraine’s defensive (and offensive) operations against its Russian aggressors, spliced with highlights of normal everyday Ukrainian life featuring soccer, of course. In an astonishing about-face, electronics maker Anker admitted that its supposably always-encrypted cameras weren’t always encrypted. In short, a security researcher found a bug that showed it was possible to access unencrypted streams of customer videos, despite Anker’s claims that its Eufy cameras were end-to-end encrypted. The Verge verified and reproduced the security researcher’s findings and Anker eventually admitted that its cameras were not end-to-end encrypted as it claimed and had in fact produced unencrypted streams. Hats off to The Verge for its impressive and dogged reporting getting to the bottom of Anker’s misrepresentations and botched attempt to cover it up. In 2020, Russian government hackers sneaked malicious code into the supply chain of software made by SolarWinds, a tech company whose customers range from giant corporations to federal government agencies. The hack was stealthy and incredibly effective, giving the Russians the chance to steal secrets from their rival country. Veteran cybersecurity reporter Kim Zetter spoke with the people who helped investigate the incident and reconstructed the stealthy hack almost blow-by-blow in an incredibly detailed and deep investigation. Zetter also published a handy and thorough timeline of events on her Substack, which is worth subscribing to if you haven’t already. Two years ago the SolarWinds hack made history as the boldest, most sophisticated supply chain hack ever pulled off. I dug into the detailed story about the ingenious way the hackers pulled it off – and then got caught – in this tale for WIRED magazine https://t.co/mxgJBIP26L — Kim Zetter (@KimZetter) May 2, 2023 For years, very few people were aware of the existence of an Indian firm called Appin. But thanks to an investigation based on “interviews with hundreds of people, thousands of documents, and research from several cybersecurity firms,” as Reuters put it, its team of journalists reported and published evidence that shows Appin as a hacking-for-hire operation that helped to obtain information on executives, politicians, military officials, and wealthy people all over the world. This is one of the most detailed and exhaustive looks inside the shadowy world of hacking-for-hire companies, who don’t work for governments like Hacking Team or NSO Group, but instead for wealthy private customers. The story itself made headlines when Reuters was forced to take down the story to comply with a New Delhi court order. Reuters said in an editor’s note it stands by the reporting. Trickbot is one of the most active and damaging Russian cybercrime syndicates, having hit thousands of companies, hospitals, and governments in the last few years. In this investigation, based on interviews with cybersecurity experts as well as an analysis of a trove of data from the ransomware gang that leaked online, WIRED’s Matt Burgess and Lily Hay Newman unmask one of Trickbot’s “key personas.” The journalists identify him as a Russian man who says he’s “fucking addicted” to Metallica, and likes the classic movie Hackers. A week later after the reporters published, the U.S. and U.K. governments announced sanctions against 11 people for their alleged involvement in Trickbot — including the man identified in the original WIRED story. Today US and UK officials sanctioned 11 alleged Trickbot members and DoJ unsealed 3 indictments against alleged Trickbot and Conti members. The only person indicted in all 3 is Maksim Galochkin, who @WIRED publicly identified last week in an investigation https://t.co/3BbjkdMTJ9 — Lily Hay Newman (@lilyhnewman) September 7, 2023 “I was floored by how easily someone could steal my phone,” wrote Business Insider’s Avery Hartmans, whose phone number was hijacked by someone who tricked her carrier, Verizon, into thinking they were her. Our phone numbers are connected to our bank accounts, password resets, and more, so SIM swapping can result in frighteningly damaging access to a person’s life. In this case, by exploiting this single point of failure, the hacker was able to rack up thousands of dollars in fraudulent purchases in Hartmans’ name. Hartmans’ breathtakingly detailed first-hand account of tracking down her SIM swapper with unwavering determination — with help along the way — was an incredible way to raise awareness to these kinds of targeted SIM swapping hacks, and not least to show how useless most companies can be to help. Last summer, my phone was hacked and my identity and credit card were stolen in an attack that’s both complex and unpreventable. I’ve spent the past 8 months investigating what happened and how they did it, and today, that story is finally here (!!) https://t.co/pIuz26i2QM — Avery Hartmans (@averyhartmans) April 2, 2023 Data containing close to a year’s worth of facial recognition requests obtained by Politico reporter Alfred Ng show that in the year after police in New Orleans began using facial recognition, the practice failed to identify suspects most of the time and was used almost exclusively against Black people. The use of facial recognition by police, law enforcement and government agencies remains a highly controversial practice across the United States. While critics say facial recognition is deeply flawed at a technical level because it is nearly always trained on white faces, Ng’s reporting confirms what civil rights advocates have also argued for years: that facial recognition amplifies the human biases of the authorities that use this technology. Or, in the words of one New Orleans council member who voted against facial recognition, that New Orleans’ use of facial recognition is “wholly ineffective and pretty obviously racist.” Just as last year came to a close, password manager LastPass confirmed that cybercriminals stole its customers’ encrypted password vaults…