Connect with us

Published

on

Iranians protest to demand justice and highlight the death of Mahsa Amini, who was arrested by morality police and subsequently died in hospital in Tehran under suspicious circumstances.

Mike Kemp | In Pictures via Getty Images

Iranians are turning to virtual private networks to bypass widespread internet disruptions as the government tries to conceal its crackdown on mass protests.

Outages first started hitting Iran’s telecommunications networks on Sept 19., according to data from internet monitoring companies Cloudflare and NetBlocks, and have been ongoing for the last two and a half weeks.

Internet monitoring groups and digital rights activists say they’re seeing “curfew-style” network disruptions every day, with access being throttled from around 4 p.m. local time until well into the night.

Tehran blocked access to WhatsApp and Instagram, two of the last remaining uncensored social media services in Iran. Twitter, Facebook, YouTube and several other platforms have been banned for years.

As a result, Iranians have flocked to VPNs, services that encrypt and reroute their traffic to a remote server elsewhere in the world to conceal their online activity. This has allowed them to restore connections to restricted websites and apps.

On Sept. 22, a day after WhatsApp and Instagram were banned, demand for VPN services skyrocketed 2,164% compared to the 28 days prior, according to figures from Top10VPN, a VPN reviews and research site.

Iran shuts down the internet as government cracks down on protests

By Sept. 26, demand peaked at 3,082% above average, and it has continued to remain high since, at 1,991% above normal levels, Top10VPN said.

“Social media plays a crucial role in protests all around the world,” Simon Migliano, head of research at Top10VPN, told CNBC. “It allows protesters to organize and ensure the authorities can’t control the narrative and suppress evidence of human rights abuses.”

“The Iranian authorities’ decision to block access to these platforms as the protests erupted has caused demand for VPNs to skyrocket,” he added.

Demand is much higher than during the uprisings of 2019, which were triggered by rising fuel prices and led to a near-total internet blackout for 12 days. Back then, peak demand was only around 164% higher than usual, according to Migliano.

Nationwide protests over Iran’s strict Islamic dress code began on Sept. 16 following the death of Mahsa Amini, a 22-year-old woman. Amini died under suspicious circumstances after being detained — and allegedly struck — by Iran’s so-called “morality police” for wearing her hijab too loosely. Iranian authorities denied any wrongdoing and claimed Amini died of a heart attack.

At least 154 people have been killed in the protests, including children, according to the nongovernmental group Iran Human Rights. The government has reported 41 deaths. Tehran has sought to prevent the sharing of images of its crackdown and hamper communication aimed at organizing further demonstrations.

The Iranian Foreign Ministry did not immediately respond to a CNBC request for comment.

Why VPNs are popular in Iran

VPNs are a common way for people under regimes with strict internet controls to access blocked services. In China, for instance, they’re often used as a workaround to restrictions on Western platforms blocked by Beijing, including Google, Facebook and Twitter. Homegrown platforms like Tencent’s WeChat are extremely limited in terms of what can be said by users.

Russia saw a similar rise in demand for VPNs in March after Moscow tightened internet curbs following the invasion of Ukraine.

Swiss startup Proton said it saw daily signups to its VPN service balloon as much as 5,000% at the peak of the Iran protests compared to average levels. Proton is best known as the creator of ProtonMail, a popular privacy-focused email service.

“Since the killing of Mahsa Amini, we have seen a huge uptick in demand for Proton VPN,” Proton CEO and founder Andy Yen told CNBC. “Even prior to that, though, VPN usage is high in Iran due to censorship and fears of surveillance.”

“Historically, we have seen internet crackdowns during periods of unrest in Iran which lead to a rise in VPN usage.”

The most popular VPN services during the protests in Iran have been Lantern, Mullvad and Psiphon, according to Top10VPN, with ExpressVPN also seeing big increases. Some VPNs are free to use, while others require a monthly subscription.

Not a silver bullet

The use of VPNs in tightly restricted countries like Iran hasn’t been without its challenges.

“It is fairly easy for regimes to block the IP addresses of the VPN servers as they can be found quite easily,” said Deryck Mitchelson, field chief information security officer for the EMEA region at Check Point Software.

“For that reason you will find that open VPNs are only available for a short duration before they are identified and blocked.”

Periodic internet outages in Iran have “continued daily in a curfew-style rolling manner,” said NetBlocks, in a blog post. The disruption “affects connectivity at the network layer,” NetBlocks said, meaning they’re not  easily solved through the use of VPNs. 

Mahsa Alimardani, a researcher at free speech campaign group Article 19, said a contact she’s been communicating with in Iran showed his network failing to connect to Google, despite having installed a VPN.

“This is new refined deep packet inspection technology that they’ve developed to make the network extremely unreliable,” she said. Such technology allows internet service providers and governments to monitor and block data on a network.

Authorities are being much more aggressive in seeking to thwart new VPN connections, she added.

Yen said Proton has “anti-censorship technologies” built into its VPN software to “ensure connectivity even under challenging network conditions.”

VPNs aren’t the only techniques citizens can use to circumvent internet censorship. Volunteers are setting up so-called Snowflake proxy servers, or “proxies,” on their browsers to allow Iranians access to Tor — software that routes traffic through a “relay” network around the world to obfuscate their activity.

“As well as VPNs, Iranians have also been downloading Tor in significantly greater numbers than usual,” said Yen.

Meanwhile, encrypted messaging app Signal compiled a guide on how Iranians can use proxies to bypass censorship and access the Signal app, which was blocked in Iran last year. Proxies serve a similar purpose as Tor, tunneling traffic through a community of computers to help users in countries where online access is restricted preserve anonymity.

Continue Reading

Technology

Why it’s time to take warnings about using public Wi-Fi, in places like airports, seriously

Published

on

By

Why it's time to take warnings about using public Wi-Fi, in places like airports, seriously

Over the years, travelers have repeatedly been warned to avoid public Wi-Fi in places like airports and coffee shops. Airport Wi-Fi, in particular, is known to be a hacker honeypot, due to what is typically relatively lax security. But even though many people know they should stay away from free Wi-Fi, it proves as irresistible to travelers as it is to hackers, who are now updating an old cybercrime tactic to take advantage.

An arrest in Australia over the summer set off alarm bells in the United States that cybercriminals are finding new ways to profit from what are called “evil twin” attacks. Also classified within a type of cybercrime called “Man in the Middle” attacks, evil twinning occurs when a hacker or hacking group sets up a fake Wi-Fi network, most often in public settings where many users can be expected to connect.

In this instance, an Australian man was charged with conducting a Wi-Fi attack on domestic flights and airports in Perth, Melbourne, and Adelaide. He allegedly set up a fake Wi-Fi network to steal email or social media credentials.

“As the general population becomes more accustomed to free Wi-Fi everywhere, you can expect evil twinning attacks to become more common,” said Matt Radolec, vice president of incident response and cloud operations at data security firm Varonis, adding that no one reads the terms and conditions or checks the URLs on free Wi-Fi.

“It’s almost a game to see how fast you can click “accept” and then ‘sign in’ or ‘connect.’ This is the ploy, especially when visiting a new location; a user might not even know what a legitimate site should look like when presented with a fake site,” Radolec said.

Today’s ‘evil twins’ can more easily hide

One of the dangers of today’s twinning attacks is that the technology is much easier to disguise. An evil twin can be a tiny device and can be tucked behind a display in a coffee shop, and the small device can have a significant impact.

“A device like this can serve up a compelling copy of a valid login page, which could invite unwary device users to enter their username and password, which would then be collected for future exploitation,” said Cincinnati-based IT consultant Brian Alcorn. 

The site doesn’t even have to actually log you in. “Once you’ve entered your information, the deed is done,” Alcorn said, adding that a harried, weary traveler probably would just think the airport Wi-Fi is having issues and not give it another thought.  

People who are not careful with passwords, such as use of pet’s names or favorite sports teams as their password for everything, are even more vulnerable to an evil twin attack. Alcorn says for individuals who reuse username and password combinations online, once the credentials are obtained they can be fed into AI, where its power can quickly give cybercriminals the key.

“You are susceptible to exploitation by someone with less than $500 in equipment and less skill than you might imagine,” Alcorn said. “The attacker just has to be motivated with basic IT skills.”

How to avoid becoming a victim of this cybercrime

When in public places, experts say it’s best to use alternatives to public WiFi networks.

“My favorite way to avoid evil twin attacks is to use your phone’s mobile hotspot if possible,” said Brian Callahan, Director of the Rensselaer Cybersecurity Collaboratory at Rensselaer Polytechnic Institute.

Users would be able to spot an attack if through a phone relying on its mobile data and sharing it via a mobile hotspot.

“You will know the name of that network since you made it, and you can put a strong password that only you know on it to connect,” Callahan said.

If a hotspot isn’t an option, a VPN can also provide some protection, Callahan said, as traffic should be encrypted to and from the VPN.

“So even if someone else can see the data, they can’t do anything about it,” he said.

Airport, airline internet security issues

At many airports, the responsibility for WiFi is outsourced and the airport itself has little if any involvement in safeguarding it. At Dallas Fort Worth International Airport, for example, Boingo is the Wi-Fi provider.

“The airport’s IT team does not have access to their systems, nor can we see usage and dashboards,” For said an airport spokesman. “The network is isolated from DAL’s systems as it is a separate standalone system with no direct connection to any of the City of Dallas’ networks or systems internally.” 

A spokeswoman for Boingo, which provides service to approximately 60 airports in North America, said it can identify rogue Wi-Fi access points through its network management. “The best way passengers can be protected is by using Passpoint, which uses encryption to automatically connect users to authenticated Wi-Fi for a safe online experience,” she said, adding that Boingo has offered Passpoint since 2012 to enhance Wi-Fi security and eliminate the risk of connecting to malicious hotspots.

Alcorn says evil twin attacks are “definitely” occurring with regularity in the United States, it’s just rare for someone to get caught because they are such stealth attacks.  And sometimes hackers use these attacks as a learning model. “Many evil twin attacks may be experimental by individuals with novice-to-intermediate skills just to see if they can do it and get away with it, even if they don’t use the collected information right away,” he said.

The surprise in Australia wasn’t the evil twinning attack itself, but the arrest.

“This incident isn’t unique, but it is unusual that the suspect was arrested,” said Aaron Walton, threat analyst at Expel, a managed services security company. “Generally, airlines are not equipped and prepared to handle or mediate hacking accusations. The typical lack of arrests and punitive action should motivate travelers to exercise caution with their own data, knowing what a tempting and usually unguarded -target it is — especially at the airport.”

In the Australian case, according to Australian Federal Police, dozens of people had their credentials stolen.

According to a press release from the AFP, “When people tried to connect their devices to the free WiFi networks, they were taken to a fake webpage requiring them to sign in using their email or social media logins. Those details were then allegedly saved to the man’s devices.”  

Once those credentials were harvested, they could be used to extract more information from the victims, including bank account information.

For hackers to be successful, they don’t have to dupe everyone. If they can persuade only a handful of people – statistically easy to do when thousands of harried and hurried people are milling around an airport – they will succeed.

“We expect WI-Fi to be everywhere. When you go to a hotel, or an airport, or a coffee shop, or even just out and about, we expect there to be Wi-Fi and often freely available WI-FI,” Callahan said. “After all, what’s yet another network name in the long list when you’re at an airport? An attacker doesn’t need everyone to connect to their evil twin, only some people who go on to put credentials into websites that can be stolen.”

The next time you’re at the airport, the only way to be 100% sure you’re safe is to bring your own Wi-Fi.

Continue Reading

Technology

Inside one of the first all-female hacker houses in San Francisco

Published

on

By

Inside one of the first all-female hacker houses in San Francisco

For Molly Cantillon, living in a hacker house wasn’t just a dream, but a necessity.

“I had lived in a few hacker houses before and wanted to replicate that energy,” said Cantillon, 20, co-founder of HackHer House and founder of the startup NOX. “A place where really energetic, hardcore people came together to solve problems. But every house I lived in was mostly male. It was obvious to me that I wanted to do the inverse and build an all-female hacker house that created the same dynamic but with women.”

Cantillon, who has lived in several hacker houses over the years, saw a need for a space dedicated exclusively to women. That’s why she co-founded HackHer House, the first all-female hacker house in the San Francisco Bay Area.

“A hacker house is a shared living space where builders and innovators come together to work on their own projects while collaborating with others,” said Jennifer Li, General Partner at Andreessen Horowitz and sponsor of the HackHer House. “It’s a community that thrives on creativity and resource sharing, making it a cost-effective solution for those in high-rent areas like Silicon Valley, where talented founders and engineers can easily connect and support each other.”

Founded by Cantillon, Zoya Garg, Anna Monaco and Anne Brandes, this house was designed to empower women in a tech world traditionally dominated by men. 

“We’re trying to break stereotypes here,” said Garg, 21, a rising senior at Stanford University. “This house isn’t just about living together; it’s about creating a community where women can thrive in tech.”

Located in North Beach, HackHer House was home this summer to seven women, all of whom share the goal of launching successful ventures in tech. 

Venture capital played a key role in making HackHer House possible. With financial backing, the house offered subsidized rent, allowing the women to focus on their projects instead of struggling with the Bay Area’s notoriously high living costs.

“New grad students face daunting living expenses, with campus costs reaching the high hundreds to over a thousand dollars a month,” said Li. “In the Bay Area, finding a comfortable room typically starts at $2,000, and while prices may have eased slightly, they remain significantly higher than the rest of the U.S. This reality forces many, including founders, to share rooms or crash on friends’ couches just to make ends meet.” 

Hacker houses aren’t new to the Bay Area or cities like New York and London. These live-in incubators serve as homes and workspaces, offering a collaborative environment where tech founders and innovators can share ideas and resources. In a city renowned for tech advancements, hacker houses are viewed as critical for driving the next wave of innovation. By providing affordable housing and a vibrant community, these spaces enable entrepreneurs to thrive in an otherwise cutthroat and expensive market.

Watch this video to see how Hacker House is shaping the future of women in tech.

Continue Reading

Technology

Elon Musk’s X will be allowed back online in Brazil after paying one more fine

Published

on

By

Elon Musk's X will be allowed back online in Brazil after paying one more fine

The Federal Supreme Court (STF) in Brazil suspends Elon Musk’s social network after it fails to comply with orders from Minister Alexandre de Moraes to block accounts of those being investigated by the Brazilian justice system. 

Cris Faga | Nurphoto | Getty Images

X has to pay one last fine before the social network owned by Elon Musk is allowed back online in Brazil, according to a decision out Friday from the country’s top justice, Alexandre de Moraes.

The platform was suspended nationwide at the end of August, a decision upheld by a panel of judges on Sept. 2. Earlier this month, X filed paperwork informing Brazil’s supreme court that it is now in compliance with orders, which it previously defied.

As Brazil’s G1 Globo reported, X must now pay a new fine of 10 million reals (about $2 million) for two additional days of non-compliance with the court’s orders. X’s legal representative in Brazil, Rachel de Oliveira, is also required to pay a fine of 300,000 reals.

The case dates back to April, when de Moraes, the minister of Brazil’s supreme court, known as Supremo Tribunal Federal (STF), initiated a probe into Musk and X over alleged obstruction of justice.

Musk had vowed to defy the court’s orders to take down certain accounts in Brazil. He called the court’s actions “censorship,” and railed online against de Moraes, describing the judge as a “criminal” and encouraging the U.S. to end foreign aid to Brazil.

In mid-August, Musk closed down X offices in Brazil. That left his company without a legal representative in the country, a federal requirement for all tech platforms to do business there.

By Aug. 28, de Moraes’ court threatened a ban and fines if X didn’t appoint a legal representative within 24 hours, and if it didn’t comply with takedown requests for accounts the court said had engaged in plots to dox or harm federal agents, among other things.

Earlier this month, the STF froze the business assets of Musk companies, including both X and satellite internet business Starlink, operating in Brazil. The STF said in court filings that it viewed Starlink parent SpaceX and X as companies that worked together as related parties.

Musk wrote in a post on X at that time that, “Unless the Brazilian government returns the illegally seized property of and SpaceX, we will seek reciprocal seizure of government assets too.”

On August 29, 2024, in Brazil, the Minister of the Supreme Court, STF Minister Alexandre de Moraes, orders the blocking of the accounts of another company, Starlink, of Elon Musk, to guarantee the payment of fines imposed by the STF due to the lack of representatives of X in Brazil. 

Ton Molina | Nurphoto | Getty Images

As head of the STF, de Moraes has long supported federal regulations to rein in hate speech and misinformation online. His views have garnered pushback from tech companies and far-right officials in the country, along with former President Jair Bolsonaro and his supporters.

Bolsonaro is under investigation, suspected of orchestrating a coup in Brazil after losing the 2022 presidential election to current President Luiz Inacio Lula da Silva.

While Musk has called for retribution against de Moraes and Lula, he has worked with and praised Bolsonaro for years. The former president of Brazil authorized SpaceX to deliver satellite internet services commercially in Brazil in 2022.

Musk bills himself as a free speech defender, but his track record suggests otherwise. Under his management, X removed content critical of ruling parties in Turkey and India at the government’s insistence. X agreed to more than 80% of government take-down requests in 2023 over a comparable period the prior year, according to analysis by the tech news site Rest of World.

X faces increased competition in Brazil from social apps like Meta-owned Threads, and Bluesky, which have attracted users during its suspension.

Starlink also faces competition in Brazil from eSpace, a French-American firm that gained permission this year from the National Telecommunications Agency (Anatel) to deliver satellite internet services in the country.

Lukas Darien, an attorney and law professor at Brazil’s Facex University Center, told CNBC that the STF’s enforcement actions against X are likely to change the way large technology companies will view the court.

“There is no change to the law here,” Darien wrote in a message. “But specifically, big tech companies are now aware that the laws will be applied regardless of the size of a business and the magnitude of its reach in the country.”

Musk and representatives for X didn’t immediately respond to a request for comment on Friday.

Late Thursday, X Global Government Affairs posted the following statement:

“X is committed to protecting free speech within the boundaries of the law and we recognize and respect the sovereignty of the countries in which we operate. We believe that the people of Brazil having access to X is essential for a thriving democracy, and we will continue to defend freedom of expression and due process of law through legal processes.”

WATCH: X is a financial ‘disaster’

Elon Musk's X is a financial 'disaster,' co-authors of new book 'Character Limit' say

Continue Reading

Trending