Plus: Meta pays $1.4 million in a historic privacy settlement, Microsoft blames a cyberattack for a major Azure outage, and an artist creates a face recognition system to reveal your NYPD “coppelganger.”

If it seems like there’s suddenly a whole lot more data breaches, you may be right. Part of this apparent spike is thanks to the growing popularity of infostealer malware. These types of malicious software are increasingly being used by cybercriminals to scoop up as many login credentials and other sensitive data as possible. That stolen data is then sold on criminal hacker forums, then used to break into victims’ accounts, which can include those of massive corporations. It’s a good reminder to always enable multi-factor authentication anywhere it’s available.

A security researcher this week disclosed the discovery of more than a dozen unsecured databases containing sensitive information on voters in counties across Illinois. The data, which was stored by a government contractor, includes driver’s license numbers, Social Security numbers, death certificates, and more. While election security has generally improved in recent years, the episode illuminates how difficult it can be to protect all voter data all the time.

The history of confidential FBI informants is long and sordid—and ongoing. A WIRED investigation published this week revealed how one informant infiltrated far-right groups and turned over their secrets to the Feds—all while pushing hateful ideologies that helped inspire a new generation of violent extremists online.

Hacking computers with lasers has always been a rich person’s game—until now. Security researchers Sam Beaumont and Larry “Patch” Trowell are releasing an open source laser hacking tool called RayV Lite, which can be produced for just $500, a tiny fraction of the $150,000 price tag of laser equipment historically used for hardware hacking. The pair will be detailing the RayV Lite at the Black Hat security conference next week in Las Vegas. (WIRED will be on the ground for Black Hat and Defcon, the _other_ big security conference happening next week in Vegas, so check back for our full coverage starting on Tuesday.)

Finally, we dove into the fine print of OpenAI’s ChatGPT-4o to lay out the privacy wins and pitfalls of the generative AI tool.

But that’s not all. Each week, we round up the big security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

In a historic prisoner swap between the US and Russia, Wall Street Journal reporter Evan Gershkovich and former Marine Paul Whelan were freed from Russian detention on Thursday. The White House said the secret deal, negotiated for over a year, involved 24 prisoners: 16 moved from Russia to the West and eight from the West to Russia, including two cybercriminals. NBC News reports this is likely the first time the US has released international hackers in a prisoner exchange.

The two Russian hackers are Roman Seleznev and Vladislav Klyushin. Seleznev was sentenced in 2017 to 27 years in prison for racketeering convictions. According to the US Department of Justice, he installed malware on point-of-sale systems software that allowed him to steal millions of credit card numbers from more than 500 US businesses. In September 2023, Klyushin was sentenced to nine years in prison for what US prosecutors described as a “$93 million hack-to-trade conspiracy.”

**Meta Pays $1.4 Billion Over Face Recognition Controversy**

Meta, the parent company of Facebook and Instagram, will pay $1.4 billion to settle a lawsuit brought by the Texas attorney general, whose office accused the social media behemoth of illegally capturing the biometric data of millions of Texans. In 2022, the state sued Meta over its implementation of a feature that used face recognition to automatically suggest people to tag in photos and videos uploaded to Facebook. Prosecutors say the feature, initially called Tag Suggestions, violated a Texas law that makes it illegal for companies to capture and profit from someone’s biometric identifiers without their consent. While Meta did not admit to any wrongdoing as part of the agreement, according to Texas attorney general Ken Paxton's office, it’s the single largest privacy settlement ever obtained by a state.

**Cyberattack Sparks Eight-Hour Microsoft Azure Outage**

A widespread Microsoft Azure outage that impacted a range of services—including Microsoft 365 products such as Office and Outlook—was caused by a cyberattack, the tech company revealed on Wednesday. According to Microsoft’s Azure status history page, the incident lasted approximately eight hours on Tuesday and affected “a subset” of customers globally.

The company described the attack as a distributed denial of service, a malicious attempt by hackers to disrupt a target company’s operations by overwhelming its infrastructure with a flood of internet traffic. According to PCMag, two hacktivist groups have claimed responsibility. Microsoft plans on publishing a review of the incident.

US Hands Over Russian Cybercriminals in WSJ Reporter Prisoner Swap

Social Security numbers, death certificates, voter applications, and other personal data were accessible on the open internet, highlighting the ongoing challenges in election security.

Databases containing sensitive voter information from multiple counties in Illinois were openly accessible on the internet, revealing 4.6 million records that included driver's license numbers as well as full and partial Social Security Numbers and documents like death certificates. Longtime security researcher Jeremiah Fowler stumbled upon one of the databases that appeared to contain information from DeKalb County, Illinois, and subsequently discovered another 12 exposed databases. None were password protected nor required any type of authentication to access.

As criminal and state-backed hacking becomes ever more sophisticated and aggressive, threats to critical infrastructure loom. But often, the biggest vulnerabilities come not from esoteric software issues, but from gaping errors that leave the safe door open and the crown jewels exposed. After years of efforts to shore up election security across the United States, state and local awareness about cybersecurity issues has improved significantly. But as this year's US election quickly approaches, the findings reflect the reality that there are always more oversights to catch.

“I’ve found voter databases in the past, so I kind of know if it's a low-level marketing outreach database that someone has purchased,” Fowler tells WIRED. “But here I saw voter applications— there were actually scans of documents, and then screenshots of online applications. I saw voter rolls for active voters, absentee voters with email addresses, some of them military email addresses. And when I saw Social Security numbers and driver’s license numbers and death certificates I was like, ‘OK, those shouldn’t be there.’”

Through public records, Fowler determined that all of the counties appear to contract with an Illinois-based election management service called Platinum Technology Resource, which provides voter registration software and other digital tools along with services like ballot printing. Many counties in Illinois use Platinum Technology Resource as an election services provider, including DeKalb, which confirmed its relationship with Platinum to WIRED.

Fowler reported the unprotected databases to Platinum on July 18, but he says he didn't receive a response and the databases remained exposed. As Fowler dug deeper into public records, he realized that Platinum works with the Illinois-based managed services provider Magenium, so he sent a disclosure to this company as well on July 19. Again, he says he did not receive a response, but shortly after the databases were secured, pulling them from public view. Platinum and Magenium did not return WIRED's multiple requests for comment.

Platinum began distributing a notification, viewed by WIRED, to impacted counties on Friday. “We have evidence of a claim the file storage containing voter registration documents may have been scanned,” Platinum wrote, adding that the exposed databases do not indicate a deeper compromise of its systems. “There was a thorough investigation executed. The findings support our ongoing belief there is no evidence of voter registration forms being leaked or stolen … We used this opportunity to deploy new and additional safeguards around voter registration documents.”

Illinois's data breach notification law requires notification to the state within 45 days of an incident. A standard version of a Champaign County contract for technology services posted publicly through a Freedom of Information Act request requires a contractor to notify the impacted county within 15 minutes of identifying a data breach.

Fowler points out that while the exposed information would potentially make impacted individuals more susceptible to identity theft and other scams, it could also be abused to submit multiple absentee ballot requests or to conduct other suspicious activity that could call a voter's legitimate vote into question and take time to reconcile. But he adds that the death certificates and other documentation contained in the trove reflect the work election officials do all over the country to manage voter registrations and ensure that everyone's vote is accurately counted.

“There’s definitely progress on basic data security, and I don’t see stuff like this very often anymore,” Fowler says. “But I used the open and public internet and no specialized tools to find this. And at the end of the day, this is critical infrastructure that was exposed.”

Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

Joshua Caleb Sutter infiltrated far-right extremist organizations as a confidential FBI informant, all while promoting hateful ideologies that influenced some of the internet's most violent groups.

Listing the Atomwaffen Division and the Order of Nine Angles as a lasting influence, Butcher also disclosed the nature of MKU’s “alliance” with 764, which was forged by the users “Xor” and “Kush” (both of whom are still unidentified). While deriding 764 for not committing enough in-person violence, Butcher said the two groups “might still stay associates because they keep cleansing their own way by making the weak suicide.”

According to victims of 764 members, “Tobbz,” a troubled young German convicted of killing an elderly woman and stabbing a man in 2022, was in the original 764 Discord server along with Almeida and Bradley Cadenhead, 764’s teenage founder who is serving decades in a Texas prison for CSAM offenses. Tobbz also had a Tempel ov Blood trident tattoo and had joined MKU, according to reporting from Der Spiegel and Recorder.

The second issue of _Drums of Tophet_, which its authors describe as “designed for the dark warriors of a doom now imminent on the near horizon,” continues in the same vein with features Q309, an occult sadomasochistic, self-described “art project” that borders on CSAM and prominently features Order of Nine Angles themes and a lengthy interview with a founder of the Satanic Front, a southern occultist organization.

In communications with a former Tempel ov Blood member viewed by WIRED, Sutter openly discussed viewing CSAM with other members of his nexion, and seemed obsessed with conspiracy theories like Project Monarch that involved child abuse. The former ToB member also noted Sutter’s fascination with the case of Belgian serial killer, rapist, and pedophile Marc Dutroux. Shortly before taking the Agony’s Point Press X account offline in March of this year, the account posted a photo of an occult altar featuring a blood-smeared photo of Dutroux next to human and animal skeletal remains, as well as a severed doll’s head inked with lightning bolts and a swastika, on top of a flag featuring a Nazi death’s head and the Nazi slogan “_Meine ehre ist meine treue_” (my honor is my allegiance).

On several occasions in the past year, the Agony’s Point Press account on X posted videos and photos highlighting 764 and its offshoots, particularly MKU and the group’s growing interest in the Order of Nine Angles. The account also routinely posted about 764 and com, occasionally adopting a faux journalistic tone to launder posts from the CSAM distribution and extortion network. Around Christmas 2023, @agonyspoint posted a graphic of MKU's hockey goalie mask insignia with a ToB trident emblazoned in its forehead.

All this took place as the FBI’s investigation into 764 expanded and new arrests, including those of alleged member Kyle Spitze and Richard Densmore, who pleaded guilty in mid-July, were made in the early months of 2024. Moreover, there is an active FBI investigation on MKU that stems directly from its ties to 764, according to a law enforcement source with knowledge of the matter.

Earlier this year, the Agony's Point account turned back toward older Martinet Press material, with several threads promoting _Bluebird_ and _Iron Gates_, two books that Sutter introduced to the Atomwaffen Division as required reading that celebrate child abuse and rape.

**“A Deal With the Devil”**

The FBI has never addressed Sutter’s role in fueling violent far-right ideology. But the blowback from Sutter’s actions over the past decade is a feature, not a bug, of American law enforcement’s use of confidential informants, says Alexandra Natapoff, a professor at Harvard Law School who has studied the topic extensively for more than 15 years. “The informant market is run on this tacit, uncomfortable understanding that the cure sometimes might be worse than the disease,” Natapoff tells WIRED. By utilizing people with criminal or extremist histories to infiltrate hard-to-penetrate milieus like gangs, organized crime, or terrorist groups, she explains, the US government rewards such people for continuing to swim in the same waters.

“Baked into that arrangement is the well-understood, avoidable phenomenon that these individuals are going to commit criminal acts,” Natapoff says. “The FBI has authorized criminal and unauthorized criminal activity by confidential human sources, and the mere fact that those guidelines have those definitions is a recognition about the nature of informants.”

He Was an FBI Informant—and Inspired a Generation of Violent Extremists

The RayV Lite will make it hundreds of times cheaper for anyone to carry out physics-bending feats of hardware hacking.

In modern microchips, where some transistors have been shrunk to less than a 10th of the size of a Covid-19 virus, it doesn't take much to mess with the minuscule electrical charges that serve as the 0s and 1s underpinning all computing. A few photons from a stray beam of light can be enough to knock those electrons out of place and glitch a computer's programming. Or that same optical glitching can be achieved more purposefully—say, with a very precisely targeted and well timed blast from a laser. Now that physics-bending feat of computer exploitation is about to become available to far more hardware hackers than ever before.

At the Black Hat cybersecurity conference in Las Vegas next week, Sam Beaumont and Larry “Patch” Trowell, both hackers at the security firm NetSPI, plan to present a new laser hacking device they're calling the RayV Lite. Their tool, whose design and component list they plan to release open source, aims to let anyone achieve arcane laser-based tricks to reverse engineer chips, trigger their vulnerabilities, and expose their secrets—methods that have historically only been available to researchers inside of well-funded companies, academic labs, and government agencies.

State-of-the-art commercial tools for light-based hacking techniques, such as the Riscure Laser Station, have typically cost as much as $150,000, and even lower-budget versions cost closer to $10,000. Yet through a combination of 3D printing, commodity component choices, and clever physics tricks, Beaumont and Trowell built theirs for less than $500.

Their goal in creating and releasing the designs for that ultra-cheap chip-hacking gadget, they say, is to make clear that laser-based exploitation techniques (known as laser fault injection or laser logic state imaging) are far more possible than many hardware designers—including clients for whom Beaumont and Trowell sometimes perform security testing at NetSPI—believe them to be. By demonstrating how inexpensively those methods can now be pulled off, they hope to both put a new tool in the hands of DIY hackers and researchers worldwide, and to push hardware manufacturers to secure their products against an obscure but surprisingly practical form of hacking.

“If we come to clients and say, ‘Your chip is vulnerable to laser fault injection,’ they tell us nobody's going to be able to do that because it's infeasible and it costs too much. We don't actually think that's true. So that got us started tinkering,” Beaumont says. “We're not discovering anything new, in the sense that other people have used lasers this way before. We're doing it at a lower cost, so that people can do this in their homes.”

The RayV Lite, shown here with no target chip mounted. Its laser and lens are visible in the circular opening on top.Photograph: Courtesy of NetSPI

Beaumont describes the RayV Lite as part of a larger trend she calls the “domestication of tooling”: Devices like the ChipWhisperer and HackRF have made electromagnetic or radio-based hacking techniques vastly cheaper and more accessible. The RayV Lite, she hopes, will do the same for lasers. “It’s significant,” says Adam Laurie, a longtime hardware hacker and current head of product security at electric vehicle charging firm Alpitronic, who reviewed Beaumont and Trowell's laser hacking work. “It moves the tools from the super-expensive academic or state-actor platform to the garage, where the really inventive stuff happens.”

As they built the RayV Lite, Beaumont and Trowell focused on two distinct laser hacking methods. One is laser fault injection, or LFI, which uses a brief blast of light to mess with the charges of a processor's transistors, “flipping bits” from 1 to 0 or vice versa. In some cases, carefully triggering those bit flips can cause far larger effects. For one automotive chip that Beaumont tested, for instance, glitching the chip with a laser at a certain moment can prevent a security check that puts the chip's firmware in a protected state, thus leaving it unprotected and letting her scan through its otherwise obfuscated code to find vulnerabilities.

Many cryptocurrency wallets, too, are vulnerable to forms of LFI, Beaumont and Trowell say, such as glitching the chip at the moment it's asking for a PIN to unlock the cryptographic key to access the owner's funds. “You take the chip off the crypto wallet, hit it with a laser at the right time, and it will just assume you have the PIN,” says Trowel. “It just jumps through the instructions and gives the key back.”

A second laser-hacking technique, known as laser logic state imaging, focuses instead on surveilling a chip's architecture and activity in real time, bouncing laser light off of it, and capturing the results (much like a camera or microscope), and then analyzing them—in Beaumont and Trowell's work, this was often done with the help of machine learning tools. Because a laser's light bounces off silicon differently based on its electrical charge, that trick allows hackers to map out not only the physical layout of a processor but also the data its transistors store, essentially vivisecting the chip to pull out hints about the data and code it's handling, which could include sensitive secrets.

In the first iteration of RayV Lite, Beaumont and Trowell are building designs for the tool in two different versions, one for each of those two laser hacking techniques. They're releasing only the laser fault injection model for now, and hope to debut the laser logic state imaging version in a matter of months. Both will use the same fundamental components and the same DIY cost-cutting tricks. The body of the tool, for instance, is ba

sed on an open source 3D-printable microscope model called OpenFlexure, which uses the flexibility of 3D-printable PLA plastic to achieve precise aiming of the laser. The target chip is mounted on a chassis fixed to printed plastic levers that are bent to small degrees by stepper motors, allowing tiny, precise movements in three dimensions. With that plastic bending trick and a laser focused through a lens, Beaumont and Trowell say, the RayV can target transistors—or rather, groups of them—down to the nanometer scale. (PLA plastic does wear out, Beaumont admits. But she also notes that the entire body of the RayV Lite can simply be printed again for a few dollars.)

Another innovation that allowed Beaumont and Trowell to vastly reduce the RayV Lite's cost, first implemented by a group of academic researchers at Royal Holloway University of London who built their own low-cost laser fault injection tool, was the discovery that laser-based chip hacking can be performed with far cheaper lasers than previously believed. That's in part because a lower-powered laser fired at a chip for a longer time interval—still so quick as to be measured in milliseconds—can have an equivalent effect to a higher-powered laser fired for a shorter time, just as a traditional camera can expose film to less light for a longer time to achieve the same exposure.

The RayV Lite with a target chip attached to a circuit board mounted on top of its 3D-printed chassis.Photograph: Courtesy of NetSPI

That realization allowed Beaumont and Trowell to use a laser in the RayV Lite that costs less than $20 and also saves enormously on the equipment and electricity used for powering the laser. “People don't have freaking massive lasers sitting around,” says Beaumont. “But you can do this with a laser pointer, which is actually what we're doing right now.” (Beaumont and Trowell nonetheless warn that anyone using even lower-powered lasers should be careful to wear eye protection.)

In fact, the most expensive components of the RayV Lite are the lens used for focusing its relatively cheap laser and an FPGA chip that serves as its timing mechanism, each of which costs close to $100, as well as the $68 Raspberry Pi minicomputer that allows it to be controlled and programmed.

Aside from the general sense that “lasers are cool,” as Trowell puts it, it was the growing body of research in more accessible laser hacking techniques that drove her and Trowell to conceive the RayV Lite, as well as what they saw as a disconnect between that accessibility and their clients' out-of-date perceptions of the difficulty of laser-based hacking. Some highly sensitive devices used in industrial control systems, automobiles, and medical devices will be vulnerable to laser fault injection of laser logic state imaging, they say. And those manufacturers need to understand that the notion of hacking the chips inside those critical devices with lasers isn't as arcane or out-of-reach as they might believe.

“Security through obfuscation isn't something we can kind of rely upon over time, especially when we're working with critical infrastructure, or when we're working with devices that are literally in our homes and our hearts,” says Beaumont.

More practically, she says, the RayV Lite will make her own job—and no doubt that of many other hardware hackers who will use her optical exploitation toolkit—far easier. “Selfishly, it's very nice,” she says. “Especially when I have to do expense reports.”

A $500 Open-Source Tool Lets Anyone Hack Computer Chips With Lasers

OpenAI’s newest model is “a data hoover on steroids,” says one expert—but there are still ways to use it while minimizing risk.

Open AI says this data is used to train the AI model and improve its responses, but the terms allow the firm to share your personal information with affiliates, vendors, service providers, and law enforcement. “So it’s hard to know where your data will end up,” says Love.

OpenAI’s privacy policy states that ChatGPT does collect information to create an account or communicate with a business, says Bharath Thota, a data scientist and chief solutions officer of analytics practice at management consulting firm Kearney, which advises firms on managing and using AI data to power new revenue streams.

Part of this data collection includes full names, account credentials, payment card information, and transaction history, he says. “Personal information can also be stored, particularly if images are uploaded as part of prompts. Likewise, if a user decides to connect with any of the company’s social media pages like Facebook, LinkedIn, or Instagram, personal information may be collected if they’ve shared their contact details.”

OpenAI uses consumer data like other big tech and social media companies, but it does not sell advertising. Instead, it provides tools—an important difference, says Jeff Schwartzentruber, senior machine learning scientist at security firm eSentire. “The user input data is not used directly as a commodity. Instead, it is used to improve the services that benefit the user—but it also increases the value of OpenAI’s intellectual property.”

****Privacy Controls****

Since its launch in 2020 and amid criticism and privacy scandals, OpenAI has introduced tools and controls you can use to lock down your data. OpenAI says it is “committed to protecting people's privacy.”

For ChatGPT specifically, OpenAI says it understands users may not want their information used to improve its models and therefore provides ways for them to manage their data. “ChatGPT Free and Plus users can easily control whether they contribute to future model improvements in their settings,” the firm writes on its website, adding that it does not train on API, ChatGPT Enterprise, and ChatGPT Team customer data by default.

“We provide ChatGPT users with a number of privacy controls, including giving them an easy way to opt out of training our AI models and a temporary chat mode that automatically deletes chats on a regular basis,” OpenAI spokesperson Taya Christianson tells WIRED.

The firm says it does not seek out personal information to train its models, and it does not use public information on the internet to build profiles about people, advertise to them, or target them—or to sell user data.

OpenAI does not train your models on audio clips from voice chats—unless you choose to share your audio “to improve voice chats for everyone,” the Voice Chat FAQ on OpenAI’s website notes.

“If you share your audio with us, then we may use audio from your voice chats to train our models,” Open AI says in its Voice Chats FAQ. Meanwhile, transcribed chats may be used to train models depending on your choices and plan.

Can GPT-4o Be Trusted With Your Private Data?

This year’s Intelligence Authorization Act would mandate penetration testing for federally certified voting machines and allow independent researchers to work on exposing vulnerabilities.

Congress is moving closer to putting US election technology under a stricter cybersecurity microscope.

Embedded inside this year’s Intelligence Authorization Act, which funds intelligence agencies like the CIA, is the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, which would require penetration testing of federally certified voting machines and ballot scanners, and create a pilot program exploring the feasibility of letting independent researchers probe all manner of election systems for flaws.

The SECURE IT Act—originally introduced by US senators Mark Warner, a Virginia Democrat, and Susan Collins, a Maine Republican—could significantly improve the security of key election technology in an era when foreign adversaries remain intent on undermining US democracy.

“This legislation will empower our researchers to think the way our adversaries do, and expose hidden vulnerabilities by attempting to penetrate our systems with the same tools and methods used by bad actors,” says Warner, who chairs the Senate Intelligence Committee.

The new push for these programs highlights the fact that even as election security concerns have shifted to more visceral dangers such as death threats against county clerks, polling-place violence, and AI-fueled disinformation, lawmakers remain worried about the possibility of hackers infiltrating voting systems, which are considered critical infrastructure but are lightly regulated compared to other vital industries.

Russia’s interference in the 2016 election shined a spotlight on threats to voting machines, and despite major improvements, even modern machines can be flawed. Experts have consistently pushed for tighter federal standards and more independent security audits. The new bill attempts to address those concerns in two ways.

The first provision would codify the US Election Assistance Commission’s recent addition of penetration testing to its certification process. (The EAC recently overhauled its certification standards, which cover voting machines and ballot scanners and which many states require their vendors to meet.)

While previous testing simply verified whether machines contained particular defensive measures—such as antivirus software and data encryption—penetration testing will simulate real-world attacks meant to find and exploit the machines’ weaknesses, potentially yielding new information about serious software flaws.

“People have been calling for mandatory \[penetration\] testing for years for election equipment,” says Edgardo Cortés, a former Virginia elections commissioner and an adviser to the election security team at New York University’s Brennan Center for Justice.

The bill’s second provision would require the EAC to experiment with a vulnerability disclosure program for election technology—including systems that are not subject to federal testing, such as voter registration databases and election results websites.

Vulnerability disclosure programs are essentially treasure hunts for civic-minded cyber experts. Vetted participants, operating under clear rules about which of the organizer’s computer systems are fair game, attempt to hack those systems by finding flaws in how they are designed or configured. They then report any flaws they discover to the organizer, sometimes for a reward.

By allowing a diverse group of experts to hunt for bugs in a wide range of election systems, the Warner–Collins bill could dramatically expand scrutiny of the machinery of US democracy.

The pilot program would be a high-profile test of the relationship between election vendors and researchers, who have spent decades clashing over how to examine and disclose flaws in voting systems. The bill attempts to assuage vendors’ concerns by requiring the EAC to vet prospective testers and by prohibiting testers from publicly disclosing any vulnerabilities they find for 180 days. (They would also have to immediately report vulnerabilities to the EAC and the Department of Homeland Security.)

Still, one provision could spark concern. The bill would require manufacturers to patch or otherwise mitigate serious reported vulnerabilities within 180 days of confirming them. The EAC—which must review all changes to certified voting software—would have 90 days to approve fixes; any fix not approved within that timetable would be “deemed to be certified,” though the commission could review it later.

A vendor might not be able to fix a problem, get that fix approved, and get all of its customers to deploy that fix before the nondisclosure period expires.

“Updates to equipment in the field can take many weeks, and modifying equipment close to an election date is a risky operation,” says Ben Adida, the executive director of the vendor VotingWorks.

Some vendors might also chafe at the bill’s legal protections for researchers. The legislation includes a “safe harbor” clause that exempts testing activities from the prohibitions of the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act, and bars vendors from suing researchers under those laws for accidental violations of the program’s terms.

There is also a funding question. The SECURE IT Act doesn’t authorize any new money for the EAC to run these programs.

“I hope Congress accounts for the necessary funding needed to support the increased responsibilities the EAC will take on,” says EAC chair Ben Hovland. “Investments in programs like this are critical to maintaining and strengthening the security of our elections.”

Meanwhile, the bill’s prospects are unclear. Even if it passes the Senate, there is no sign of similar momentum in the House.

A Senate Bill Would Radically Improve Voting Machine Security

Long-distance cables were severed across France in a move that disrupted internet connectivity.

Long-distance internet cables in France have been cut in an act of sabotage, causing disruption to internet services across the country. This is the second disruption during the Olympic Games in Paris, after high-speed train lines were targeted in a series of arson attacks hours before the Games kicked off.

Marina Ferrari, France’s junior minister for digital affairs, said on X that in the early hours of Monday morning, multiple locations around France were affected by several “damages” that impacted telecommunications providers and have resulted in “localized consequences” to fiber optic services as well mobile internet connectivity. Internet companies confirmed the damage.

The French Ministry of the Interior, which oversees policing agencies in the country, did not immediately respond to a request for comment. French cybersecurity agency ANSSI told WIRED the problems are not linked to a cybersecurity incident.

At the time of writing, nobody has claimed responsibility for either attack. Officials have yet to identify any suspects involved in the cable-cutting sabotage, but they believe the disruption to train services could have been committed by people with “ultra-left” political leanings.

The incidents around the Olympics come at a time when Russia has been blamed for a string of disinformation targeting France and has also been linked to a series of potential sabotage attacks in Europe.

The second largest French telecoms company, SFR, appeared to be one of the most impacted by the vandalism. “Our long-distance fiber network was sabotaged between 1 am and 3 am last night in five different locations,” a spokesperson from SFR told WIRED. SFR says its maintenance teams are working on repairing the damage and said the impact on its customers was “limited.”

“Also, between three and eight other operators are impacted since they use our long-distance network,” the spokesperson said.

Nicolas Guillaume, the CEO of telecom firm Nasca Group, which owns the ISP company Netalis, told WIRED he believed the damage was “deliberate” and that ISPs serving both customers and businesses have been impacted. Several of the damaged cables, according to images shared on X by the CEO, appear to have clean cuts across them. Guillaume says it is likely that people opened the ducts where cables are stored and cut them. Internet company Free 1337 also confirmed it was working on fixing the damage.

While billions of people around the world use wireless connections, the underlying internet backbone is made up of cables traversing across countries and under seas. This infrastructure, which is able to automatically reroute traffic to limit outages, can be fragile and vulnerable to attack or disruption. EU politicians have called for internet infrastructure security to be improved.

But the sabotage is not the first time that internet cables in France have been damaged in potentially deliberate acts. At the end of April 2022, crucial long-distance internet cables around Paris were deliberately cut and damaged—causing outages that impacted around 10 internet and infrastructure companies.

In that instance, according to photographs published by telecoms companies, the cables appeared to have been surgically cut, all at around the same time, in three locations, to the north, south, and east of Paris. Thousands of people around Paris—and also some farther away from the French capital—were plunged into a temporary internet blackout as network operators rerouted traffic. “It is the work of professionals,” Guillaume said at the time.

Arthur PB Laudrain, a postdoctoral research associate in cyber diplomacy at King’s College London, says the most recent incident seems “less serious” than the 2022 outages. “Such actions are within the capabilities of ultra-left or ecologist and anarchist groups, especially if they benefited from insider assistance or knowledge (current or former rail or network workers),” Laudrain says. “However, we cannot rule out the fact that a state actor is encouraging, supporting, or directing such domestic groups to create plausible deniability of their involvement.”

Saboteurs Cut Internet Cables in Latest Disruption During Paris Olympics

Infostealer malware is swiping millions of passwords, cookies, and search histories. It’s a gold mine for hackers—and a disaster for anyone who becomes a target.

For the past two months, cybercriminals have advertised for sale hundreds of millions of customer records from major companies like Ticketmaster, Santander Bank, and AT&T. And while massive data breaches have been a fact of life for more than a decade now, these recent examples are significant, because they are all connected. Each victim company was a customer of the cloud data storage firm Snowflake and was compromised not through a sophisticated hack, but because attackers had login credentials for each victim company’s Snowflake accounts—a data-stealing spree that impacted at least 165 Snowflake customers.

Attackers didn’t grab this trove of logins by directly breaching Snowflake or through a targeted supply chain attack. Instead, they found the credentials in a hodgepodge of stolen data grabbed haphazardly by “infostealer” malware.

After years of operation, infostealers are having a moment. The malware, which often finds its way onto people’s machines through downloads of pirated software, can steal usernames and passwords, cookies, search history, financial information, and more from web browsers. This data collected by infostealers is increasingly being used by all kinds of hackers to compromise companies—and cybersecurity experts warn of more high-profile data breaches to come.

“We’ve seen nation-states leverage infostealers, we’ve seen criminals leverage infostealers, and we’ve seen teenage hacking crews leverage infostealers,” says Charles Carmakal, chief technology officer of Google-owned cybersecurity firm Mandiant. Russia’s APT29 hackers and cybercriminal gangs such as Lapsus$ and Scattered Spider are among the many hackers using infostealers. Just days after the global CrowdStrike outage, hackers created a new infostealer in an attempt to capitalize on the chaos.

Infostealers are defined less by their technical capabilities and more by their role in the malicious hacker ecosystem. Of course, to minimally qualify, they must be designed to steal information. But what separates infostealers from spyware or other malware used in espionage or targeted data breaches is that infostealers are spread opportunistically and indiscriminately. They grab data from the browsers of whatever computers they end up infecting. Then the attackers who run them compile and organize this chaotic and largely random assemblage of data—often on a marketplace or in a public forum like a Telegram channel. It is only then that infostealer operators or their customers comb their haul for valuable credentials and access tokens amidst the massive amount of junk. Ian Gray, director of analysis and research at the security firm Flashpoint, says there are likely hundreds of variants of infostealers in circulation.

There are some account access tokens that would have obvious value for many types of cybercriminals. If a data dump included working login credentials for a corporate employee’s enterprise accounts, a ransomware gang, business email compromise scammer, or state-backed actor could use the access as a jumping off point to launch their attacks. But in addition to selling these prized details, infostealer operators maximize the value of the data they collect simply by making their stolen data available. Platforms like Genesis Market, which was taken down by law enforcement last year, and Russian Market, organize infostealer logs and even make them somewhat searchable so hackers who are looking to target more niche organizations or those who don’t have financial motivations can potentially find exactly what they need.

These platforms take cues in how they are designed and marketed from legitimate information and ecommerce services. Many markets and forums charge a subscription fee to access the platform and then have different pricing structures for data depending on how valuable it might be. Currently, Gray says, Russian Market has so much stolen data available from infostealers that it has been charging a low flat rate, typically no more than $10, for any subset of data users want to download.

“Organizations have become very good with their security, and people have also gotten more savvy, so they're not the best targets now,” for traditional tailored attacks, Gray says. “So attackers need something that’s less targeted and more based on what they can make use of. Infostealers are modular and often sold on a subscription basis, and that evolution probably aligns with the rise of modern subscription services like video streaming.”

Infostealers have been especially effective with the rise of remote work and hybrid work, as companies adapt to allowing employees to access work services from personal devices and personal accounts from work devices. This creates opportunities for infostealers to randomly compromise individuals on, say, their home computers but still end up with corporate access credentials because the person was logged into some of their work systems as well. It also makes it easier for infostealing malware to get around corporate protections, even on enterprise devices, if employees are able to have their personal email or social media accounts open.

“I started paying attention to this once it became an enterprise problem,” Mandiant’s Carmakal says. “And particularly around 2020, because I started seeing more intrusions of enterprises first starting from compromises of home computers—through phishing of people's Yahoo accounts, Gmail accounts, and Hotmail accounts that were totally unrelated to any enterprise targeting, but to me look very opportunistic.”

Victoria Kivilevich, director of threat research at security firm KELA, says that in some instances criminals can use cybercrime markets to search for the domain of potential targets and see if any credentials are available. Kivilevich says the sale of infostealer data can be considered as the “supply chain” for various types of cyberattacks, including ransomware operators looking for the details of potential victims, those involved in business email compromise, and even initial access brokers who can sell the details along again to other cybercriminals.

On various cybercrime marketplaces and Telegram, Kivilevich says, there have been more than 7,000 compromised credentials linked to Snowflake accounts being shared. In one instance, a criminal has been touting access to 41 companies from the education sector; another cybercriminal claims to be selling access to US companies with revenues between $50 million and $8 billion, according to Kivilevich’s analysis.

“I don’t think there was one company that came to us and had zero accounts compromised by infostealer malware,” Kivilevich says of the threat that infostealer logs provide to businesses, with KELA saying infostealer-related activity jumped in 2023. Irina Nesterovsky, KELA's chief research officer, says millions of credentials have been collected by infostealing malware in recent years. “This is a real threat,” Nesterovsky says.

Carmakal says there are multiple steps companies and individuals can take to protect themselves from the threat of infostealers and their aftereffects, including using antivirus or EDR products to detect malicious activity. Companies should be strict on enforcing multifactor authentication across their users, he says. “We try to encourage people to not synchronize passwords on their corporate devices with their personal devices,” Carmakal adds.

The use of infostealers has been working so well that it is all but inevitable that cybercriminals will look to replicate the success of compromise sprees like Snowflake and get creative about other enterprise software services that they can use as entry points for access to an array of different customer companies. Carmakal warns that he expects to see this result in more breaches in the coming months. “There’s no ambiguity about this,” he says. “Threat actors will start hunting for infostealer logs, and looking for other SaaS providers, similar to Snowflake, where they log in and steal data, and then extort those companies.”

How Infostealers Pillaged the World’s Passwords

Plus: More Pegasus spyware controversy, a major BIOS controversy, and more of the week’s top security news.

The fallout from CrowdStrike’s deleterious software update came into full view this week as system administrators and IT staffers scrambled to get digital systems back online and return operations to normal. Elsewhere, the Olympics began this week, and Paris is ready with a controversial new surveillance system that hints at a future of ubiquitous CCTV camera coverage. And researchers revealed new findings this week about the innovative malware Russia used in January to sabotage a heating utility in Lviv and cut heat to 600 Ukrainian buildings at the coldest point in the year.

The US Department of Defense has a $141 billion idea to modernize US intercontinental ballistic missiles and their silos around the country. Meanwhile, the European Commission is allocating €7.3 billion for defense research—from drones and tanks to battleships and space intelligence—over the next seven years. And hackers have established a “ghost” network to quietly spread malware on the Microsoft-owned developer platform GitHub.

In more encouraging news, a former Google engineer has built a prototype search engine, dubbed webXray, meant to allow users to find specific privacy violations online, determine which sites are tracking you, and see where all that data goes.

And there’s more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

**Israel Reportedly Worked to Keep Info on Pegasus Spyware Out of US Courts**

Leaked files obtained by The Guardian reveal that the Israeli government took extraordinary measures to prevent information about the Pegasus spyware system from falling into the hands of US courts, including seizing files directly from the company to prevent legal disclosure. The spyware is the product of the Israel-based NSO Group. It allows users to infect smartphones, extract messages and photos, record calls, and secretly activate microphones. NSO Group faces legal action in the US brought by WhatsApp, which claims the company engineered Pegasus to target users of its messaging software. According to WhatsApp, more than 1,400 of its users were targeted. NSO, whose software has been allegedly tied to the harassment and murder of journalist Jamal Khashoggi, has denied any wrongdoing.

**Massive Screwup Leaves BIOS on 200+ Computer Models Vulnerable**

In an effort to thwart BIOS-based threats, prompted in part by the rollout of a powerful rootkit designed by a Chinese researcher in 2007, Secure Boot became a widely adopted tool. Unfortunately, researchers at the security firm Binarly have revealed that Secure Boot is now “completely compromised” on more than 200 device models, affecting major hardware manufacturers like Dell, Acer, and Intel. The incident was the result of a weak cryptographic key used to establish trust between hardware and firmware systems. AMI, the key's owner, says it was meant to be used for testing and should never have made its way into production.

**Musk’s AI system, Grok, Is Now Feeding on All Your Tweets**

Following in Meta's footsteps, Elon Musk's X quietly adjusted its settings this week to give the company's AI system—known as Grok—access to all of its users' posts. There is a way to prevent Grok from ingesting your posts; however, you cannot perform this action from the mobile app. You'll need to access X's **Settings** using a desktop computer; select **Privacy and Safety**, then select **Grok**, and then uncheck the box. Or just head straight here to go directly to the right settings page. (You can also delete your conversation history with Grok, if you have one, by clicking **Delete conversation history**.)

Stop X’s Grok AI From Training on Your Tweets

KnowBe4 detailed the incident in a recent blog post as a warning for other potential targets.

KnowBe4, a US-based security vendor, revealed that it unwittingly hired a North Korean hacker who attempted to load malware into the company's network. KnowBe4 CEO and founder Stu Sjouwerman described the incident in a blog post this week, calling it a cautionary tale that was fortunately detected before causing any major problems.

"First of all: No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems," Sjouwerman wrote. “This is not a data breach notification, there was none. See it as an organizational learning moment I am sharing with you. If it can happen to us, it can happen to almost anyone. Don't let it happen to you.”

KnowBe4 said it was looking for a software engineer for its internal IT AI team. The firm hired a person who, it turns out, was from North Korea and was "using a valid but stolen US-based identity" and a photo that was "enhanced" by artificial intelligence. There is now an active FBI investigation amid suspicion that the worker is what KnowBe4's blog post called "an Insider Threat/Nation State Actor."

KnowBe4 operates in 11 countries and is headquartered in Florida. It provides security awareness training, including phishing security tests, to corporate customers. If you occasionally receive a fake phishing email from your employer, you might be working for a company that uses the KnowBe4 service to test its employees' ability to spot scams.

**Person Passed Background Check and Video Interviews**

KnowBe4 hired the North Korean hacker through its usual process. "We posted the job, received résumés, conducted interviews, performed background checks, verified references, and hired the person. We sent them their Mac workstation, and the moment it was received, it immediately started to load malware," the company said.

Even though the photo provided to HR was fake, the person who was interviewed for the job apparently looked enough like it to pass. KnowBe4's HR team "conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application," the post said. "Additionally, a background check and all other standard pre-hiring checks were performed and came back clear due to the stolen identity being used. This was a real person using a valid but stolen US-based identity. The picture was AI 'enhanced.'"

The two images at the top of this story are a stock photo and what KnowBe4 says is the AI fake based on the stock photo. The stock photo is on the left, and the AI fake is on the right.

The employee, referred to as "XXXX" in the blog post, was hired as a principal software engineer. The new hire's suspicious activities were flagged by security software, leading KnowBe4's Security Operations Center (SOC) to investigate:

> On July 15, 2024, a series of suspicious activities were detected on the user beginning at 9:55 pm EST. When these alerts came in KnowBe4's SOC team reached out to the user to inquire about the anomalous activity and possible cause. XXXX responded to SOC that he was following steps on his router guide to troubleshoot a speed issue and that it may have caused a compromise.
> 
> The attacker performed various actions to manipulate session history files, transfer potentially harmful files, and execute unauthorized software. He used a Raspberry Pi to download the malware. SOC attempted to get more details from XXXX including getting him on a call. XXXX stated he was unavailable for a call and later became unresponsive. At around 10:20 pm EST SOC contained XXXX's device.

**“Fake IT Worker From North Korea”**

The SOC analysis indicated that the loading of malware "may have been intentional by the user," and the group "suspected he may be an Insider Threat/Nation State Actor," the blog post said.

"We shared the collected data with our friends at Mandiant, a leading global cybersecurity expert, and the FBI, to corroborate our initial findings. It turns out this was a fake IT worker from North Korea," Sjouwerman wrote.

KnowBe4 said it can't provide much detail because of the active FBI investigation. But the person hired for the job may have logged into the company computer remotely from North Korea, Sjouwerman explained:

> How this works is that the fake worker asks to get their workstation sent to an address that is basically an "IT mule laptop farm." They then VPN in from where they really physically are (North Korea or over the border in China) and work the night shift so that they seem to be working in US daytime. The scam is that they are actually doing the work, getting paid well, and give a large amount to North Korea to fund their illegal programs. I don't have to tell you about the severe risk of this. It's good we have new employees in a highly restricted area when they start, and have no access to production systems. Our controls caught it, but that was sure a learning moment that I am happy to share with everyone.

_This story originally appeared on_ _Ars Technica._

Source

Wired