Security Now 1015: Spatial-Domain Wireless Jamming Released on March 5, 2025

Hosts:

• Leo Laporte
• Steve Gibson

Introduction

In Episode 1015 of Security Now, hosted by Leo Laporte and featuring recurring guest Steve Gibson, the discussion delves into pressing issues in the realm of cybersecurity, including Firefox's updated privacy policies, Signal's contention with Swedish legislation, the aftermath of the Bybit Ethereum heist, and an exploration of groundbreaking technology in wireless jamming.

Firefox's Privacy Policy Changes

Timestamp: 28:04

One of the episode's key discussions centers around Mozilla's recent amendments to Firefox's privacy policy. Steve Gibson expresses his support and understanding of Mozilla's position despite listener backlash.

Steve Gibson (28:04): "Mozilla's updated statement reads, 'We still put a lot of work into making sure that the data that we share with our partners... is stripped of any identifying information.' I believe them. These are the people who said they would never sell our data."

Highlights:

• Old vs. New Policy: The previous Firefox FAQ explicitly stated that Mozilla would never sell user data. The updated policy reframes this stance due to broader legal definitions of "sale" in certain jurisdictions.

• User Concerns: Users on platforms like GitHub and Reddit criticized Mozilla for the language change, feeling uneasy about the potential for data usage beyond mere functionality.

• Mozilla's Defense: Mozilla clarified that the license is necessary to operate Firefox's basic functions, emphasizing that data shared with partners is anonymized or aggregated.

• Steve's Stance: Despite understanding the legal necessities, Steve remains committed to using Firefox over browsers like Chrome, viewing Firefox as a vital alternative in the battle against surveillance capitalism.

Signal's Threat to Leave Sweden Over Surveillance Legislation

Timestamp: 38:31

The conversation shifts to Signal Foundation's President Meredith Whittaker's announcement that Signal might withdraw from Sweden if new legislation mandating backdoors is passed.

Steve Gibson (38:31): "Meredith Whitaker, Signal Foundation's president, immediately responded... saying that Signal will pull out of Sweden if the government there passes such a surveillance bill."

Highlights:

• Swedish Legislation: The Swedish government is considering laws that would compel communication providers to grant police and security services access to message content.

• Signal's Response: Meredith Whittaker has previously threatened to leave other countries like the UK over similar demands, underscoring Signal's commitment to user privacy.

• Adoption in Military: Interestingly, despite the potential exit, Signal remains popular within Sweden's armed forces, highlighting its trusted security features.

• Implications for Other Platforms: Concerns arise about how other platforms like Apple's iMessage and Google Messenger would respond to such legislation.

Aftermath of the Bybit Ethereum Heist

Timestamp: 43:12

The episode addresses the significant cryptocurrency heist involving Bybit, where approximately $1.5 billion in Ethereum was stolen by North Korean hackers. Steve Gibson provides an in-depth analysis of the incident and its repercussions.

Steve Gibson (59:37): "It's looking like the bad guys are going to largely get away with this."

Highlights:

• Attack Origin: Initial reports suggested Bybit was at fault, but later evidence points to a breach at SafeWallet, a service provider utilized by Bybit. The hackers infiltrated SafeWallet, injecting malicious code that targeted Bybit's smart contracts.

• Recovery Efforts: Out of the $1.5 billion stolen, Chainalysis reports that only $42 million has been recovered. The complexity of laundering such a vast amount in the transparent blockchain ecosystem poses significant challenges.

• Lazarus Bounty Initiative: In response, Bybit established the Lazarus Bounty, offering a 10% reward for the recovery of stolen funds. As of the episode, $140,000 is available, with $4,286 already awarded to 17 participants. The leaderboard shows minimal progress, indicating the difficulty in tracing and reclaiming the funds.

• Chainalysis Insights: The movement of Ethereum through various exchanges and token swaps demonstrates the sophisticated methods employed by the hackers to obscure the trail, making recovery arduous.

Mozilla's Commitment to Manifest V2

Timestamp: 60:03

Amidst Chrome's transition to Manifest V3, Mozilla reaffirms its support for Manifest V2, allowing Firefox users to continue utilizing extensions like uBlock Origin.

Steve Gibson (60:03): "Mozilla took the opportunity to reaffirm. Yay. Their commitment to remaining V2 compatible."

Highlights:

• Manifest V3 vs. V2: Chrome's enforcement of Manifest V3 has led to the removal of uBlock Origin from its web store, significantly impacting users reliant on robust ad-blocking tools.

• Mozilla's Stance: Unlike Chrome, Firefox continues to support both Manifest V2 and V3, ensuring that extensions dependent on V2 features remain functional.

• User Impact: This decision preserves the full strength of uBlock Origin for Firefox users, maintaining a high level of privacy and ad-blocking effectiveness.

• Steve's Advice: Given the challenges with Chrome, Steve encourages listeners to consider alternatives like Firefox to retain control over their browsing experience.

Spatial-Domain Wireless Jamming: A New Frontier

Timestamp: 145:19

The episode culminates with Steve Gibson introducing a pioneering study on Spatial-Domain Wireless Jamming, a technology poised to revolutionize cyber-espionage and defense mechanisms.

Steve Gibson (145:19): "Spatial Domain Wireless Jamming with Reconfigurable Intelligent Surfaces... it's just so cool...."

Highlights:

• Research Overview: Presented at the NDSS Symposium 2025 in San Diego, the study explores the use of Reconfigurable Intelligent Surfaces (RIS) to achieve precise, targeted wireless jamming without affecting neighboring devices.

• Technology Mechanics: RIS are engineered surfaces that can digitally control the reflection of radio waves. By adjusting the phase of reflected signals, RIS can focus jamming attacks on specific devices, rendering them inoperative while leaving others untouched.

• Advantages Over Traditional Jamming: Unlike reactive jamming, which requires real-time analysis and is position-dependent, spatial-domain jamming using RIS is proactive, allowing attackers to disable target devices without broad-spectrum interference.

• Practical Implications: The technology enables low-power, undetectable attacks, posing significant threats to wireless communications by making targeted jamming both feasible and stealthy.

• Countermeasures: The study also discusses potential defenses against RIS-based jamming, emphasizing the need for advancements in wireless security protocols to mitigate such sophisticated threats.

Conclusion: Spatial-Domain Wireless Jamming represents a significant advancement in cyber-attack methodologies, highlighting the necessity for continuous research and development in cybersecurity defenses to stay ahead of emerging threats.

Closing Remarks

Throughout the episode, Leo Laporte and Steve Gibson interweave discussions on technical topics with anecdotes and listener feedback, maintaining an engaging and informative dialogue. They emphasize the importance of staying informed and adaptable in the ever-evolving landscape of cybersecurity.

Leo Laporte (173:06): "Security."

The episode serves as a comprehensive exploration of current security challenges and innovations, offering listeners valuable insights into both policy shifts and technological breakthroughs shaping the future of digital security.

Notable Quotes:

• Steve Gibson (02:17): "It's an astonishing new technology."

• Steve Gibson (28:04): "I believe them. These are the people who said they would never sell our data."

• Steve Gibson (145:19): "This is just astonishing technology and it'll... be very useful in a movie theater."

Resources Mentioned:

• Memory Safety Standardization: memory-safety.org
• Lazarus Bounty Site: GRC_SC1015
• Reconfigurable Intelligent Surfaces (RIS): Detailed in the NDSS Symposium 2025 paper

Note: For more detailed insights and visuals, interested listeners are encouraged to visit GRC.com where show notes, transcripts, and related resources are available.