An anonymous reader quotes a report from KrebsOnSecurity: Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user's text messages and phone calls to another device. The conclusions above are based on an extensive analysis of Telegram chat logs from three distinct cybercrime groups or actors that have been identified by security researchers as particularly active in and effective at "SIM-swapping," which involves temporarily seizing control over a target's mobile phone number.

Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. This means that stealing someone's phone number often can let cybercriminals hijack the target's entire digital life in short order -- including access to any financial, email and social media accounts tied to that phone number. All three SIM-swapping entities that were tracked for this story remain active in 2023, and they all conduct business in open channels on the instant messaging platform Telegram. KrebsOnSecurity is not naming those channels or groups here because they will simply migrate to more private servers if exposed publicly, and for now those servers remain a useful source of intelligence about their activities.

Each advertises their claimed access to T-Mobile systems in a similar way. At a minimum, every SIM-swapping opportunity is announced with a brief "Tmobile up!" or "Tmo up!" message to channel participants. Other information in the announcements includes the price for a single SIM-swap request, and the handle of the person who takes the payment and information about the targeted subscriber. The information required from the customer of the SIM-swapping service includes the target's phone number, and the serial number tied to the new SIM card that will be used to receive text messages and phone calls from the hijacked phone number. Initially, the goal of this project was to count how many times each entity claimed access to T-Mobile throughout 2022, by cataloging the various "Tmo up!" posts from each day and working backwards from Dec. 31, 2022. But by the time we got to claims made in the middle of May 2022, completing the rest of the year's timeline seemed unnecessary. The tally shows that in the last seven-and-a-half months of 2022, these groups collectively made SIM-swapping claims against T-Mobile on 104 separate days -- often with multiple groups claiming access on the same days. In a written statement to KrebsOnSecurity, T-Mobile said this type of activity affects the entire wireless industry.

"And we are constantly working to fight against it," the statement reads. "We have continued to drive enhancements that further protect against unauthorized access, including enhancing multi-factor authentication controls, hardening environments, limiting access to data, apps or services, and more. We are also focused on gathering threat intelligence data, like what you have shared, to help further strengthen these ongoing efforts."

Xiaomi unveiled wireless augmented reality glasses in the latest attempt to build momentum in an arena that has yet to become mainstream. From a report: The concept device from the Chinese phone maker is designed to let users gesture via its embedded camera to select and open apps, swipe through pages and exit apps to return to the start page, without using a smartphone. Dubbed Xiaomi Wireless AR Glass, the headset weighs 126 grams (4.4 ounces) and shows information to the user via two MicroOLED screens, Xiaomi said.

An anonymous reader quotes a report from The Verge: Since Thursday morning, Dish Network has been experiencing a major outage that's taken down the company's main websites, apps, and customer support systems, and employees tell The Verge it's not clear what's going on inside the company. The company's Dish.com website is completely blank save for a notice apologizing for "any disruptions you may be having" while promising that "teams are working hard to restore systems as soon as possible." The Boost Mobile and Boost Infinite sites display a similar message. When we called each brand's customer support lines, there were no humans on the other end -- each call automatically hung up after delivering a recorded message about the outage.

In an ironic twist, the outage started around the time that Dish was set to release its earnings for Q4 and fiscal year 2022. CEO Erik Carlson addressed it during the company's earnings call, saying the company was experiencing an "internal outage that's continuing to affect our internal servers and IT telephony." While Carlson claimed that Dish, Sling, and the company's wireless networks were operating normally, he admitted that "internal communications, customer care functions, Internet sites" were knocked out. Internally, frontline employees have been kept in the dark about what's going on. Two sources tell The Verge that they are being told to stand by for information from their leadership teams, which haven't yet been forthcoming. They say it hasn't even been made clear whether they'll be paid. Employees have also been told that they won't be able to connect to their VPN, keeping remote workers from logging in to work.

Despite Carlson's comments that Dish's services should be working normally, Downdetector shows an increase in reports of issues using Dish Network's services, which include satellite TV and Boost Mobile's wireless network. Customers are reporting on social media that they're unable to activate new equipment or SIM cards received from the company, and alleged technicians say they can't complete installs and upgrades for customers. Customers have also said that the outage is preventing them from paying their bills. Some of the company's sites, like dishwireless.com and launch.5gmobilegenesis.com, are currently completely down and don't even display an error message. The good news is that the outage doesn't appear to be the result of a cyberattack, according to The Desk, though Dish likely hasn't concluded its investigation yet.

Starry, an ISP that launched in 2016 with a focus on delivering home internet with wireless antennas instead of cables, has declared bankruptcy. The Verge reports: In a press release (PDF), the company says that it intends to quickly restructure and that it'll continue providing internet service in its "five core operating markets." Those are Boston, New York City, Los Angeles, Denver, and Washington, DC. The ISP has clearly been struggling over the past few months. In October 2022, it announced that it was laying off around 500 people, which amounted to about half of its staff. A few months later, Starry announced it was leaving Columbus, Ohio, in a bid to focus more on its five "core" markets. All the while, it was burning millions of dollars in cash, and its stock was dropping after a special purpose acquisition company-backed IPO in March -- it started at around $10 a share but is now worth $0.012, down from last week when it was approximately $0.02 per share.

The company also defaulted on its Rural Digital Opportunity Fund bids after it won awards from the FCC to work on providing internet to underserved areas in the US. Had it completed the work, it stood to receive almost $269 million, according to Light Reading. Starry has asked the United States Bankruptcy Court for the District of Delaware to approve a plan that would give it $43 million in funding from lenders, which it says would provide "the necessary liquidity to continue its normal business operations and meet its post-filing obligations to its employees, customers and vendors." "With the support of our lenders, we feel confident in our ability to successfully exit this process as a stronger company, well-positioned to continue" providing internet to customers, said Starry CEO Chet Kanojia in the company's press release.

Ryan Grewell, who runs a small wireless Internet service provider in Ohio, last month received an email that confirmed some of his worst suspicions about cable companies. From a report: Grewell, founder and general manager of Smart Way Communications, had heard from some of his customers that the Federal Communications Commission's new broadband map falsely claimed fiber Internet service was available at their homes from another company called Jefferson County Cable. Those customer reports spurred Grewell to submit a number of challenges to the FCC in an attempt to correct errors in Smart Way's service area.

One of Grewell's challenges elicited a response from Jefferson County Cable executive Bob Loveridge, who apparently thought Grewell was a resident at the challenged address rather than a competitor. "You challenged that we do not have service at your residence and indeed we don't today," Loveridge wrote in a January 9 email that Grewell shared with Ars. "With our huge investment in upgrading our service to provide xgpon we reported to the BDC [Broadband Data Collection] that we have service at your residence so that they would not allocate addition [sic] broadband expansion money over [the] top of our private investment in our plant."

The email is reminiscent of our November 2022 article about a cable company accidentally telling a rival about its plan to block government grants to competitors. Speaking to Ars in a phone interview, Grewell said, "This cable company happened to just say the quiet part out loud." He called it "a blatant attempt at blocking anyone else from getting funding in an area they intend to serve." It's not clear when Jefferson County Cable plans to serve the area. Program rules do not allow ISPs to claim future coverage in their map submissions. Jefferson County Cable ultimately admitted to the FCC that it filed incorrect data and was required to submit a correction. The challenge that the ISP conceded was for an address on State Route 43 in Bergholz, Ohio. The town is not one of the coverage areas listed on Jefferson County Cable's website.

Razer announced its lightest gaming mouse today, the Viper Mini Signature Edition. From a report: It only weighs 49g, making it 16 percent lighter than the company's Viper V2 Pro and one of the most lightweight mice we've seen from a large company. The mouse uses a magnesium alloy exoskeleton with a semi-hollow interior (bearing a slight resemblance to the SteelSeries Aerox 3 Wireless). "We wanted to push beyond the traditional honeycomb design, and this required a material with an outstanding strength-to-weight ratio," said Razer's Head of Industrial Design, Charlie Bolton. "After evaluating plastics, carbon fiber and even titanium, we ultimately chose magnesium alloy for its exceptional properties." Razer says the mouse uses its fastest wireless tech and will be among its best-performing wireless mice. Price: $280.

A Welsh branch of McDonald's has started playing classical music and rationing wi-fi in a bid to deter anti-social behavior. The BBC reports: The fast-food restaurant has taken action after incidents at its Wrexham branch and elsewhere in the city which led to police issuing dispersal orders. North Wales Police said a group of 20 to 30 youngsters had caused "upset" but progress had been made recently. McDonald's said it was committed to being a good neighbor in the area. [...] McDonald's said: "We are aware of anti-social behavior affecting the wider area, and have introduced a number of measures in our Wrexham restaurant to support the police in tackling this issue. These include playing classical music from 17:00 GMT and turning off the wi-fi at certain points in the evening."

Frontier, an internet service provider (ISP) that services 25 US states, has just launched 5 Gig fiber internet service across its entire network. The Verge reports: Frontier launched 2 Gig fiber internet service less than a year ago, and the 5 Gig plan is currently available in all of Frontier's fiber-connected markets, with no phased rollouts. Compared to the cable-bound internet that most of us are familiar with, Frontier's 5 Gig internet is reported to have upload speeds that are up to 125 times faster and up to five times faster downloads, all delivered with less latency. The new 5 Gig network is one of the fastest internet options currently available in the US, with other fiber-enabled ISPs like Verizon Fios and Google Fiber still capped at around 2Gbps.

Right now, the only other 5 Gig network currently available in the US is through AT&T, which offers 2 Gig and 5 Gig plans. Google Fiber is also slated to add 5-gig and 8-gig plans to its lineup sometime this year, despite its numerous setbacks.

The UK government will provide direct taxpayer funding to support British semiconductor companies as part of a strategy for a sector that has become a lightning rod in global geopolitics, Bloomberg reported Wednesday, citing people familiar with the plans. From the report: This will include seed money for startups, help for existing firms to scale up, as well as providing new incentives for private venture capital, the officials said. Ministers will set up a semiconductor task force to coordinate public and private support to ramp up UK manufacturing of compound semiconductors in the next three years, they added. An overall figure has not been agreed with the Treasury but it is expected to be single figure billions of pounds, one person familiar with the plans said.

Chips are vital components in everything from mobile phones to cars, and shortages have the potential to cause significant disruption to supply chains. Companies already affected by the Covid-19 pandemic are reconsidering their investments in the UK due to frustrations over delays in formulating a strategy. Compound semiconductors are based on different materials to conventional "silicon" chips and are used in newer technologies like 5G wireless and electric vehicles. A UK push to develop local semiconductor manufacturing would echo US efforts to restrict exports of the technology to China and hobble its push into the chips industry. The Netherlands and Japan, key chip-making countries, are close to joining with the US to curb links with Beijing.

The nation's second-largest wireless carrier on Thursday disclosed that a "bad actor" took advantage of one of its application programming interfaces to gain data on "approximately 37 million current postpaid and prepaid customer accounts." CNET reports: In an 8K filing with the US Securities and Exchange Commission, the carrier says that it was able to trace and stop the "malicious activity" within a day of learning about it. T-Mobile also says that the API that was used does not allow for access to "any customer payment card information, Social Security numbers/tax IDs, driver's license or other government ID numbers, passwords/PINs or other financial account information." According to the filing, the carrier believes that the breach first occurred "on or around" Nov. 25, 2022. The carrier didn't learn that a "bad actor" was getting data from its systems until Jan. 5.

The company's API, however, did reveal other user information, including names, billing addresses, email addresses, phone numbers and birth dates of its customers, their T-Mobile account numbers, and information on which plan features they have with the carrier and the number of lines on their accounts. The company said in the SEC filing that it has "begun notifying customers whose information may have been obtained by the bad actor in accordance with applicable state and federal requirements." In 2021, T-Mobile suffered a data breach that exposed data of roughly 76.6 million people. "T-Mobile agreed to a $500 million settlement in the case in July, with $350 million going to settle customer claims from a class action lawsuit and $150 million going to upgrade its data protection system," adds CNET.

Google is launching its final Stadia game today and is promising to release a tool next week to enable Bluetooth connections on its Stadia Controller. The Verge reports: The last Stadia game to launch on the service is Worm Game, a test game that was technically available on Stadia before Stadia launched publicly in November 2019. Developers at Google have decided to release the game just before the streaming service disappears next week. [...] Alongside the new game, Google is also committing to enabling Bluetooth on Stadia controllers. Google Stadia owners will be pleased to hear there's a self-serve tool coming next week that will enable Bluetooth on the Stadia Controller. "We'll share details next week on how to enable this feature," says a Google Stadia community manager in a forum post.

Google originally launched the Stadia Controller as a device that connects directly to Stadia services and had the Bluetooth chip disabled. After news broke of the Stadia shutdown, fans have been finding ways to save the controller from an e-waste fate by using workarounds to connect it wirelessly to other devices. Workarounds like connecting to an Android device will no longer be required thanks to this new tool. It means that most Stadia players that purchased a Founders or Premiere edition will have been effectively gifted a free Bluetooth controller thanks to Google's refunds.

All.health, a medical care startup that rose from the ashes of once-hot wearable company Jawbone, is being sued in San Francisco by one of its investors for alleged fraud, misrepresentation and breach of contract. From a report: All.health's co-founders, the former Jawbone Chief Executive Officer Hosain Rahman and Michael Luna, are also named in the complaint. While All.health, Rahman and Luna deny the claims, the dispute is an illustration of the rancor that can envelop fledgling tech companies at a suddenly volatile time for startup funding. Jawbone was a Silicon Valley darling -- most famous for its wireless earpieces -- until the startup dramatically folded in 2017 and sold off its assets. As Jawbone was disintegrating, Rahman salvaged the company's medical device business. The resulting startup, now called All.health, developed wearable monitoring hardware and technology for people with chronic illnesses like diabetes.

In a complaint filed this summer, Polymath Holdings, a Dubai-based investment company and All.health backer, claimed that the startup overpromised, took millions of dollars and under-delivered on a commitment to manufacture thousands of health-monitoring devices. The suit, which was recently largely unredacted by a San Francisco court, alleges that the startup was a "classic 'fake-it-until-you-make it' tale of fraud."

Apple is planning to start using its own custom displays in mobile devices as early as 2024, an effort to reduce its reliance on technology partners like Samsung and LG and bring more components in-house. From a report: The company aims to begin by swapping out the display in the highest-end Apple Watches by the end of next year, according to people with knowledge of the matter. The screens upgrade the current OLED -- organic light-emitting diode -- standard to a technology called microLED, and Apple plans to eventually bring the displays to other devices, including the iPhone. The changes are part of a sweeping effort to replace Apple supplies with homegrown parts, an undertaking that will give the company more control over the design and capabilities of its products. The tech giant has dropped Intel chips in its Mac computers in favor of in-house designs and plans to do the same with the key wireless components in its iPhones.

Meta is dropping support for its first Meta Quest VR headset. The device will no longer receive future content updates, and by 2024 it will no longer get any bug fixes or security patches. Gizmodo reports: Notably, users will no longer have significant functionality. Though Meta promised you will still be able to use the headset and its installed games and apps, Quest 1 users will no longer be able to join parties, and they will also lose access to Meta's feature product Horizon Home on March 5 this year. Users will no longer be able to invite others to their homes or travel over to another user's home.

Meta CEO Mark Zuckerberg announced what was originally called the Oculus Quest in 2018 as the premiere wireless VR headset. The company released the headset in 2019 (so Meta is a little off in their letter when they said they launched the device "over four years ago"), and this was all before Meta officially renamed the devices and its various services in 2021. So the Quest 1 is working off four-year-old tech, and it would make some sense why Meta would not want to support aging hardware.

According to Windows Central's Zac Bowden, Microsoft's next foldable Surface phone will feature "a more traditional foldable design, with a 180-degree hinge, internal foldable screen and external cover display." Bowden writes: I'm told this new foldable device came about after the company had already finalized a dual-screen design for Surface Duo 3. This original dual-screen design was supposed to ship at the end of 2023 as the next Surface Duo, featuring narrower and taller edge-to-edge displays, wireless charging, and other improvements. That dual-screen design has now been scrapped, and the Surface team is now focused on delivering this new "true" foldable design. Microsoft began exploring single-screen foldable designs as a potential successor to the Surface Duo 2 in late 2021 after it launched and was met with mixed reviews.

It's still too early to know the exact specs that this new foldable device is going to feature hardware wise, or whether or not Microsoft plans to simulate a dual-screen experience via a software feature or mode. My sources say there's no concrete shipping window for the device in place yet either, meaning it's unlikely to be ready in time for this fall. [...] Of course, with the change in form factor may also come a change in name. It's still too early to tell, but given this device isn't a traditional Duo in form factor, perhaps the company will take this opportunity to rebrand the line, similar to what it did with the Surface Book and Surface Laptop Studio. Regardless, sources tell me this device is still considered a third-generation Duo internally. Bowden goes on to say that Microsoft remains "all-in" on delivering its own Android hardware and software. There's a larger software effort ongoing internally that aims to "deliver an ecosystem experience between Microsoft's Android hardware and Windows PCs similar to that between an iPhone and Mac."

The company has also been "exploring different form factors to ship in addition to a foldable device."

US aviation safety regulators intend to require passenger and cargo aircraft to meet requirements by early next year for navigation gear to deal with potentially unsafe interference from 5G mobile-phone signals. Bloomberg reports: The equipment is needed because the newer wireless signals are on frequencies near those used by planes' radio altimeters, which determine altitude over ground and can cause them to malfunction, the Federal Aviation Administration has found. Wireless companies are eager for a solution because they paid the government more than $80 billion for the new airwaves. The changes would need to be made by Feb. 1, 2024, the agency said in a notice (PDF) Monday.

The FAA said it couldn't rule out interference from 5G signals for about 100 incidents of aircraft navigation equipment issuing erroneous data. Such situations will increase as telecommunications providers expand 5G coverage throughout the US, the FAA said. [...] The FAA estimates that out of 7,993 US-registered aircraft that would need revisions, approximately 180 would require radio altimeter replacements and 820 would require the addition of filters to comply with the proposed order, at an estimated cost of as much as $26 million.

Apple is working on a new in-house chip that would power cellular, Wi-Fi, and Bluetooth functionality on its devices, according to a report from Bloomberg. The Verge reports: The company is also developing its own chip that would replace the Wi-Fi and Bluetooth chip it currently uses from Broadcom, Bloomberg says, which it wants to begin using in devices in 2025. Bloomberg also shared some new information about Apple's efforts to develop its own cellular modems to replace Qualcomm's. While Qualcomm recently said it expects to have the "vast majority" of 5G modems for 2023 iPhones, Bloomberg says Apple will use its own modems "by the end of 2024 or early 2025." It will apparently start by using its custom modem in one product and fully transition them over the course of approximately three years.

The WPC announced during CES 2023 that the next generation of the Qi standard, named "Qi2," was built with Apple's help. 9to5Mac reports: The new standard aims to improve the efficiency and interoperability of the technology, which is why it will have a "Magnetic Power Profile" at its core. As explained by WPC, this Magnetic Power Profile essentially works like Apple's MagSafe. As a result, Qi2 accessories will be perfectly aligned with the devices, thus improving energy efficiency and fast charging. And of course, since it was developed in partnership with Apple, the Qi2 standard will also work with MagSafe by default.

Currently, MagSafe is a proprietary standard from Apple, and even accessory manufacturers have to pay to use such a standard. While Apple can still technically limit some features to MagSafe certified accessories, the announcement of the Qi2 standard is good news to ensure that this type of accessory is compatible with different phones. The new Qi2 standard will replace its Qi predecessor once it becomes available. WPC says that one billion Qi devices are expected to be sold globally by 2023. The first Qi2 certified devices and accessories are expected to be introduced by the end of the year.

Fierce Wireless reports: Verizon is telling customers that if they're still using a 3G CDMA or 4G (non-VoLTE) phone that does not support its newer network technologies, "your line will be suspended without billing and will lose the ability to call, text, or use data."

Verizon is the last of the Big 3 wireless carriers in the U.S. to shut down a 3G network and repurpose the spectrum for newer technology. AT&T was first, shutting its 3G network down in February. T-Mobile's shuttered its 3G network over the summer.... Verizon has been working with customers — both consumers and businesses — since 2016 to ensure customers have "every opportunity" to get a device that uses either 4G or 5G, including direct outreach to customers and even sending some customers updated devices proactively, according to Karen Schulz of Verizon's Global Network & Technology Communications team.

Indeed, the company initially said it was closing its 3G network in 2019. Then they extended it to the end of 2020 and finally, to the end of 2022. In March 2021, Verizon made it clear they were sticking with the 2022 end date and advised customers still accessing the 3G network that they may experience a degradation or complete loss of service.
"Even after that, until the day before their February billing cycle, they'll still be able to use the phones for two things: calling 911 and Verizon customer service," reports the Verge: While 3G will still exist in other countries for quite a few more years, Verizon's deadline is pretty much the end of the line for it here in the US. The tech hasn't gone gentle into that good night; carriers delayed their shutdowns several times, there were tiffs between Dish and T-Mobile, and you can't just turn a network that had been around for years off without things starting to break. (Some notable examples: some connected cars and trucks have been pushed offline, as have parking meters and older Kindles. AT&T's shutdown was even blamed for delays in reporting voting results in Michigan this year.)

Part of the reason carriers are decommissioning their networks is to help build their new ones. As we saw earlier this month, T-Mobile's latest and greatest 5G tech makes use of spectrum that was once part of its 3G network.
The Verge's conclusion? "Spare a thought for the tech that helped build the mobile-first world we live in; even if this ends up being the last time you ever think about it."

A Boston Globe tech reporter checked last year's performance for the region's tech companies: A list of the worst local performers includes some truly bottom-of-the-barrel returns. Cannabis tech company Agrify in Billerica suffered a 99.6 percent stock drop in 2022. Wireless Internet service Starry and diet-device maker Gelesis were close behind with losses of 99.5 and 99.3 percent, respectively. (All stock prices are as of Dec. 28.)

Agrify suffered a recent sales drop and growing losses while ending the year facing a customer lawsuit and possible hostile takeover. Starry was unable to raise the funds needed to continue building its network and put itself up for sale last month. And Gelesis fell far short of its sales forecast, bringing in about $30 million of revenue compared to a projection of $171 million presented when its merger with Capstar Special Purpose Acquisition Corp. was announced in 2021....

Companies like Starry and Gelesis that went public by merging with blank-check firms had a particularly tough year, as investors flipped from euphoria to panic on the so-called SPAC boom. The average 2022 return for 21 such stocks tracked by the Globe was a loss of 70 percent. Of tech companies that went public the traditional way, the average loss was 45 percent. Toast, which did a standard IPO at the same time Ginkgo Bioworks completed its SPAC deal, lost 51 percent for the year while Ginkgo plunged 80 percent.
In the wider market of tech stocks, the article notes that the S&P 500 index dropped 20%, while the Nasdaq Composite plunged 34 percent, "and tech giants such as Apple, Amazon, and Meta shed hundreds of billions of dollars of market value."

"Of 60 local tech stocks tracked by the Globe, only two posted positive returns: robotics maker Symbotic in Wilmington and payments company WEX in Portland, Maine.... Perhaps in 2023, the winners column will be a little longer."