Plus: A whistleblower claims the Biden administration falsified a report on Gaza, “Operation Endgame” disrupts the botnet ecosystem, and more.

If you have a crypto wallet containing a fortune but forgot the password, all may not be lost. This week, a pair of researchers revealed how they cracked an 11-year-old password to a crypto wallet containing roughly $3 million in bitcoins. With a lot of skill and a bit of luck, the researchers uncovered a flaw in how a previous version of the RoboForm password manager generates passwords that allowed them to accurately figure out the missing login and access the buried treasure.

Police in Western countries are using a new tactic to go after cybercriminals who remain physically out of reach of US law enforcement: trolling. The recent takedowns of ransomware groups like LockBit go beyond the traditional disruption of online infrastructure to include messages on seized websites meant to mess with the minds of criminal hackers. Experts say these trollish tactics help sow distrust between cybercriminals—who already have ample reason to distrust one another.

A graduate student at the University of Minnesota has been charged under the Espionage Act for photographing a shipyard in Virginia where the US Navy assembles nuclear submarines and other vessels whose components are classified. What makes the case novel, however, is that he allegedly took the photos with a drone, making his prosecution likely the first of its kind in the US.

It was a big week for cops taking down botnets (as you’ll read more about below). This week, the US announced that it had disrupted what may be the “largest botnet ever,” according to FBI director Christopher Wray. The botnet, called 911 S5, included some 19 million hijacked IP addresses around the world, which authorities say were used to carry out billions of dollars in Covid-19 relief fraud, make bomb threats, traffic in child sexual abuse material, and more.

But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

More than a half-million internet routers were disabled last year in a malware attack carried out by an unknown threat actor targeting a US internet service provider. Launched in late October, the attack—one of the largest ever against the sector—reportedly disrupted internet across several Midwestern states. The attack was first disclosed this week by the security firm Black Lotus Labs, which did not identify the specific company affected. However, Ars Technica reports that the incident appears to have impacted a ISP called Windstream, which provides internet service to 18 states in the US Midwest and South.

Black Lotus Labs researchers say the attacker used off-the-shelf Chalubo malware to gain access to the routers, and that their firmware was eventually overwritten, effectively bricking the devices. The disruption resulted in a flood of complaints on a forum about the damaged routers. “The routers now just sit there with a steady red light on the front,” a user wrote on the DSLReports forum. “They won't even respond to a RESET.”

**Whistleblower Claims US “Falsified” Gaza Report to Protect Arms Sales**

The Biden administration allegedly fabricated the conclusion of a report released in early May which found the United States did not have “complete information to verify” whether US-made weapons had been used by Israel in contravention of international humanitarian law, according to a whistleblower, Stacy Gilbert, a senior civil-military expert who resigned in protest this week from the US State Department. Gilbert says the State Department experts who compiled the report clearly implicated Israel in limiting the amount of food and medical supplies able to reach Gaza; however, the report was reportedly taken out of the experts’ hands and then “edited at a higher level.”

The report consisted of a mandatory national security assessment that, had Israel been found in violation of humanitarian law, would have obligated the US to discontinue its arms sales. At the time of the report’s publishing, critics of the administration’s Gaza policy accused the White House of willfully ignoring the conduct of Israeli forces attempting to disrupt food deliveries to the famine-stricken Palestinian territory. Gilbert is the second US official to publicly resign this week in protest over the US’s involvement in the attacks.

**“Operation Endgame” Knocks Down Botnet Underworld**

An international coalition of law enforcement agencies, cybersecurity firms, and other organizations announced this week the disruption of large swathes of the global botnet ecosystem. Branded “Operation Endgame,” the effort targeted malware “droppers,” or malicious software that’s used to infiltrate a machine so it can be used to infect a machine with additional malware more easily. The droppers Operation Endgame targeted include IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot, according to Europol, which says authorities seized more than 100 servers and 2,000 websites allegedly linked to cybercriminal activity. Law enforcement also arrested four “high-value” individuals; Germany added eight others to its most-wanted list. One of the “main suspects,” according to Europol, amassed a cryptocurrency fortune worth 69 million euros ($74 million) by renting out infrastructure for ransomware attacks. And the action isn’t over: The Operation Endgame website indicates a new announcement coming in the next several days.

**Pro-Israel Influence Op, Driven by AI, Targeted Americans on Meta Apps**

Meta says it has shut down an AI-driven network comprising hundreds of fake Facebook and Instagram accounts linked to an Israeli business intelligence firm. The company, Stoic, is accused of accepting contracts to propagate inauthentic pro-Israel content across the platforms for the purpose of manipulating North American users’ political views. Meta claimed Stoic’s influence operation was still in its “audience building” phase, “before they were able to gain engagement among authentic communities.”

Mysterious Hack Destroyed 600,000 Internet Routers

Drought-stricken hydro dams have led to daily electricity cuts in Ecuador. As weather becomes less predictable die to climate change, experts say other countries need to take notice.

During times of low water, Ecuador has few options to meet its baseline energy demands, because it doesn’t have any other major energy sources, says Proaño Aviles. Colombia and Peru usually trade energy with Ecuador, but they won’t sell their electricity right now because they too have had to ration water for their dams. And trying to plan ahead for this—at least with much confidence—hasn’t been easy either. Studies have projected that between 2000 and 2071, hydropower generation in Ecuador could see anything from a 55 percent drop to a 39 percent increase, depending on the climate change scenario, says Michel.

Other factors have also reduced the function of Ecuador’s power plants. “There’s also increased erosion or sedimentation in the river that then gets into the turbines and decreases their efficiency,” says Michel, with deforestation and forest fires both culprits. In Ecuador, some of the recent outages have been because of the Coca Codo Sinclair dam needing to have sediment removed from its turbine inputs.

Despite hydropower’s vulnerabilities, more capacity is expected to be installed in parts of the world. In Southeast Asia, countries such as Myanmar, Laos, and Cambodia are increasing their hydro capacity to meet rising energy needs. “Hydropower has this tremendous promise for expanding electricity access to underserved populations, generating revenue for states, and for linking regions together in power-sharing agreements and selling electricity across borders,” says Michel. “But these challenges of climate change—what we’re seeing in Ecuador—are also going to be challenges in Southeast Asia.”

Effective management strategies for handling these climate challenges will be essential, and will vary by region. One promising approach for areas with heavy rainfall, according to Michel, is to increase the use of rainwater harvesting systems, which use catchment areas, like a roof, gutters, and storage tanks, to capture and store heavy rainfall in localized systems. This helps replenish groundwater and supports agricultural and municipal needs, reducing the amount of water extracted from rivers, meaning more can be held for electricity generation.

Additionally, modernizing the grid—admittedly a costly, intensive job—can enhance its ability to handle fluctuations in demand, says Proaño Aviles. New infrastructure can both minimize energy losses and optimize the distribution of electricity, so less energy needs to be produced overall, meaning less water is needed.

Countries should also invest in other renewable sources to diversify their power supply, so that when water levels are low, they have a backup. In Ecuador, for example, the government is offering a 100 percent income tax exemption for new investments in renewables, including wind and solar farms. Proaño Aviles notes that private investment will be an essential step, as it can help fund renewable energy projects faster than the government can alone.

Finally, energy and water conservation are essential tools, no matter the region. Proaño Aviles has seen small businesses in Ecuador adhering to efficient energy-management standards to prepare for future events. In some places, resource-use regulations are even mandated by government. Michel points to Las Vegas as a case study: The city has strict water-conservation measures, including incentives for residents to replace grass lawns with desert-friendly landscaping and restrictions on watering schedules. The city also uses a tiered water-pricing system that charges higher rates as water use increases, and an advanced water-recycling system that treats and reuses wastewater.

“I think it has a powerful demonstration effect because it raises the visibility for policymakers in other cities and for consumers around the country who can see what’s happening,” Michel says. “It stands as a signal that, yeah, we do have policies and approaches that can help answer these challenges.”

As climate change alters weather patterns and increases the frequency of extreme events, proactive and comprehensive management are crucial to prevent widespread energy crises—whether in South America, the US, or Asia. For Ecuador, its energy future hinges on the ability to address immediate challenges but also plan for long-term resilience. “I think we’re moving in the right direction, but I don’t know if it is at the right pace,” says Proaño Aviles. “I don’t know if it’s fast enough.”

Ecuador Is Literally Powerless in the Face of Drought

In seemingly the first case of its kind, the US Justice Department has charged a Chinese national with using a drone to photograph a Virginia shipyard where the US Navy was assembling nuclear submarines.

The United States Department of Justice is quietly prosecuting a novel Espionage Act case involving a drone, a Chinese national, and classified nuclear submarines.

The case is such a rarity that it appears to be the first known prosecution under a World War II–era law that bans photographing vital military installations using aircraft, showing how new technologies are leading to fresh national security and First Amendment issues.

“This is definitely not something that the law has addressed to any significant degree,” Emily Berman, a law professor at the University of Houston who specializes in national security, tells WIRED. “There’s definitely no reported cases.”

On January 5, 2024, Fengyun Shi flew to Virginia while on leave from his graduate studies at the University of Minnesota and rented a Tesla at the airport. His research focused on using AI to detect signs of crop disease in photos. Shi’s subject that week wasn’t plants, however, but allegedly the local shipyards—the only ones manufacturing the latest generation of Navy carrier ships in the country, and nuclear submarines as well.

According to an affidavit filed by FBI special agent Sara Shalowitz in February, a shipyard security officer alerted the Naval Criminal Investigative Service to Shi’s actions. The affidavit alleges that on January 6, Shi was flying a drone in “inclement weather” before it got stuck in a neighbor’s tree. When Shi, who is a Chinese citizen, approached the neighbor for help, he was questioned about his nationality and purpose for being in the area. The unnamed resident took photos of Shi, his license plate, and his ID, and called the police. The affidavit alleges that Shi was “very nervous” when questioned by police and “did not have any real reasons” for flying a drone in bad weather. The police gave Shi the number for the fire department and said he would need to stay on the scene. Instead, he returned the rental car an hour later and left Hampton Roads, Virginia, abandoning the drone.

When the FBI seized the drone and pulled the photos off its memory card, they discovered images that special agent Shalowitz said she recognized as being taken at Newport News Shipyard and BAE Systems, which is a 45-minute drive away. The affidavit states that on the day Shi took the photos, the Newport News Shipyard was “actively manufacturing” aircraft carriers and Virginia class nuclear submarines.

“Naval aircraft carriers have classified and sensitive systems throughout the carriers,” the affidavit states. “The nuclear submarines present on that date also have highly classified and sensitive Navy Nuclear Propulsion Information (‘NNPI’) and those submarines even in the design and construction phase are sensitive and classified.”

The DOJ is charging Shi with six Espionage Act misdemeanors under two statutes: one banning photographing a vital military installation and one banning the use of an aircraft to do so. Each misdemeanor can result in up to a year in prison upon conviction. While he awaits trial, Shi is restricted to living in Virginia under probation. He was forced to surrender his passport. According to court filings, he appears to require a translator.

Shi’s case, filed in federal court in Virginia’s Eastern District, was first spotted by Court Watch in February. Its rarity became apparent in March, after prosecutors filed a motion for a time extension. The judge agreed, writing that it was justified because the case is “so unusual due to the nature of the prosecution and the novel questions of both law and fact.”

Indeed, Shi is being charged “under two statutes which have been rarely prosecuted” to the degree that “the Court has been able to only find one reported case,” the judge wrote. That case, _Genovese v. Town of Southampton,_ centered on just one of the two statutes Shi is being charged under—photographing a military installation, without an aircraft.

The DOJ declined to comment when WIRED posed questions about Shi’s case, including whether the Chinese government is being engaged on the issue.

According to a filing from US prosecutors, both parties wish to end the case in a plea agreement. Shi’s attorney did not respond to multiple requests for comment.

WIRED found multiple social media accounts connected to Shi. He appears to have a small online footprint and few interactions with others online, portraying a life of quiet normalcy. He appears to be a soccer fan who enjoys campus and is a devoted _League of Legends_ player. He even attended the competitive online game’s 2022 World Championship tournament in San Francisco. In fact, according to online records, he often plays _League of Legends_ multiple times a day while awaiting trial in Virginia. His university research is similarly innocuous: He’s developing an app for detecting crop diseases in photos called Gopher Eye, which is being funded by the National Science Foundation, and has applied for a patent. He describes himself as a “startup manager” on LinkedIn.

One of Shi’s colleagues at the University of Minnesota, who spoke to WIRED under the condition of anonymity, says that he was a “typical” kid who was “very passionate” about his research. In the fall of 2023, however, financial and familial strife compounded by mounting pressure from lagging grades led to a break. The colleague said that Shi soon all but disappeared, taking leave from his studies and “basically hiding from all of his normal relationships.” He’s been difficult to contact since then, they say, adding that they did not know that Shi is currently in the US—much less embroiled in a rare national security case.

“From my point of view, he’s had very bad luck,” they say. “I don’t think that he did anything wrong intentionally.”

The question of why the DOJ is prosecuting Shi in the first place looms large over his case. After all, satellites originating in China photograph the US daily, including military sites and aircraft carriers. The degree to which Shi’s nationality played a role in the DOJ’s decision to prosecute the case isn’t clear. The case is proceeding amid rising animosity between China and the US, but Shi isn’t being charged under any laws related to collecting intelligence for a foreign government. He is not being accused of acting as a spy. His only alleged crime is taking photos with a drone.

“The Justice Department has guidelines that say \[nationality\] is not supposed to play a role in a criminal investigation, but there are exceptions to that rule for national security and border-related investigations,” Berman says. “It certainly seems likely that the fact Shi is a Chinese national raises red flags for investigators that wouldn't necessarily go up in the same way if he was an American citizen, rightly or wrongly.”

Cases prosecuted under statutes banning photographing military bases can have implications for First Amendment rights, Berman says. Photographing in a public place is a constitutionally protected activity.

“It would be a good thing to litigate some of these cases and clarify what the rules actually are about what you can and can't do,” she says. “Any time there is uncertainty, that may make people hesitant to do things that they are constitutionally entitled to do.”

The few occasions where statutes banning photographing military installations have come up illustrate this concern. In _Genovese v. Town of Southampton,_ Nancy Genovese sued law enforcement officials who arrested her for photographing an airport—part of which was a military base—while having guns in her car. A jury agreed that law enforcement was maliciously prosecuting Genovese, and she landed a settlement amounting to more than $1 million in 2016. In another incident, in 2014, reporters for The Blade in Ohio filed a federal lawsuit after they were unlawfully detained for taking photos outside a military base. In that case, too, the law favored the plaintiffs, and the reporters were awarded $18,000.

Shi’s case is scheduled to start on June 20.

The Unusual Espionage Act Case Against a Drone Photographer

The US says a Chinese national operated the “911 S5” botnet, which included computers worldwide and was used to file hundreds of thousands of fraudulent Covid claims and distribute CSAM, among other crimes.

The United States Department of Justice on Wednesday announced charges against a 35-year-old Chinese national, Yunhe Wang, accused of operating a massive botnet allegedly linked to billions of dollars in fraud, child exploitation, and bomb threats, among other crimes.

Wang, identified by numerous pseudonyms—Tom Long and Jack Wan, among others—was arrested on May 24 and is accused of distributing malware through various pop-up VPN services, such as “ProxyGate” and “MaskVPN,” and by embedding viruses in internet files distributed via peer-to-peer networks known as torrents.

The malware is said to have compromised computers located in nearly every country in the world, turning them into proxies through which criminals were able to hide their identities while committing countless crimes. According to prosecutors in the US, this included the theft of billions of dollars slated for Covid-19 pandemic relief—funds allegedly stolen by foreign actors posing as unemployed US citizens.

According to an indictment, the infected computers allegedly provided Wang’s customers with a persistent backdoor, allowing them to disguise themselves as any one of the victims of Wang’s malware. This illicit proxy service, known as “911 S5,” launched as early as 2014, the US government says.

“The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation,” says FBI director Christopher Wray, who described the illicit service as “likely the world’s largest botnet ever.”

The US Treasury Department has also sanctioned Wang and two other individuals allegedly tied to 911 S5.

Wang is said to have amassed access to nearly 614,000 IP addresses in the US and more than 18 million others worldwide—collectively forming the botnet. 911 S5’s customers were able to filter the IPs geographically to choose where they’d like to appear to be located, down to a specific US zip code, the DOJ claims.

The indictment states that of the 150 dedicated servers used to manage the botnet, as many as 76 were leased by US-based service providers, including the one hosting 911 S5’s client interface, which allowed criminals overseas to purchase goods using stolen credit cards, in many cases for the alleged purpose of circumventing US export laws.

More than half a million fraudulent claims lodged with pandemic relief programs in the United States are allegedly tied to 911 S5. According to the indictment, nearly $6 billion in losses have been linked to IP addresses captured by 911 S5. Many of the IP addresses have been reportedly tied to more insidious crimes, including bomb threats and the trafficking of child sexual abuse material, or CSAM.

“Proxy services like 911 S5 are pervasive threats that shield criminals behind the compromised IP addresses of residential computers worldwide,” says Damien Diggs, the US attorney for the Eastern District of Texas, where the charges against Wang were brought by a grand jury earlier this month.

Adds Nicole Argentieri, head of the Justice Department’s Criminal Division: “These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking.”

At the time of writing, it is unclear whether these virtual impersonations resulted in any criminal investigations or charges against US-based victims whose IP addresses were hijacked as part of the 911 S5 botnet. WIRED is awaiting a response from the Department of Justice regarding this concern.

According to the Justice Department, law enforcement agencies in Singapore, Thailand, and Germany collaborated with US authorities to effect Wang’s arrest.

Wang faces charges of conspiracy, computer fraud, conspiracy to commit wire fraud, and conspiracy to money laundering, with a maximum penalty of 65 years in prison. The US is also seeking to seize a mountain of luxury cars and goods allegedly owned by Wang, including a 2022 Ferrari Spider valued at roughly half a million dollars as well as a Patek Philippe watch worth potentially several times that amount.

‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds

Thanks to a flaw in a decade-old version of the RoboForm password manager and a bit of luck, researchers were able to unearth the password to a crypto wallet containing a fortune.

Two years ago when “Michael,” an owner of cryptocurrency, contacted Joe Grand to help recover access to about $2 million worth of bitcoin he stored in encrypted format on his computer, Grand turned him down.

Michael, who is based in Europe and asked to remain anonymous, stored the cryptocurrency in a password-protected digital wallet. He generated a password using the RoboForm password manager and stored that password in a file encrypted with a tool called TrueCrypt. At some point, that file got corrupted and Michael lost access to the 20-character password he had generated to secure his 43.6 BTC (worth a total of about €4,000, or $5,300, in 2013). Michael used the RoboForm password manager to generate the password but did not store it in his manager. He worried that someone would hack his computer and obtain the password.

“At \[that\] time, I was really paranoid with my security,” he laughs.

Grand is a famed hardware hacker who in 2022 helped another crypto wallet owner recover access to $2 million in cryptocurrency he thought he’d lost forever after forgetting the PIN to his Trezor wallet. Since then, dozens of people have contacted Grand to help them recover their treasure. But Grand, known by the hacker handle “Kingpin,” turns down most of them, for various reasons.

Grand is an electrical engineer who began hacking computing hardware at age 10 and in 2008 cohosted the Discovery Channel’s _Prototype This_ show. He now consults with companies that build complex digital systems to help them understand how hardware hackers like him might subvert their systems. He cracked the Trezor wallet in 2022 using complex hardware techniques that forced the USB-style wallet to reveal its password.

But Michael stored his cryptocurrency in a software-based wallet, which meant none of Grand’s hardware skills were relevant this time. He considered brute-forcing Michael’s password—writing a script to automatically guess millions of possible passwords to find the correct one—but determined this wasn’t feasible. He briefly considered that the RoboForm password manager Michael used to generate his password might have a flaw in the way it generated passwords, which would allow him to guess the password more easily. Grand, however, doubted such a flaw existed.

Michael contacted multiple people who specialize in cracking cryptography; they all told him “there’s no chance” of retrieving his money. But last June he approached Grand again, hoping to convince him to help, and this time Grand agreed to give it a try, working with a friend named Bruno in Germany who also hacks digital wallets.

Grand and Bruno spent months reverse engineering the version of the RoboForm program that they thought Michael had used in 2013 and found that the pseudo-random number generator used to generate passwords in that version—and subsequent versions until 2015—did indeed have a significant flaw that made the random number generator not so random. The RoboForm program unwisely tied the random passwords it generated to the date and time on the user’s computer—it determined the computer’s date and time, and then generated passwords that were predictable. If you knew the date and time and other parameters, you could compute any password that would have been generated on a certain date and time in the past.

If Michael knew the day or general time frame in 2013 when he generated it, as well as the parameters he used to generate the password (for example, the number of characters in the password, including lower- and upper-case letters, figures, and special characters), this would narrow the possible password guesses to a manageable number. Then they could hijack the RoboForm function responsible for checking the date and time on a computer and get it to travel back in time, believing the current date was a day in the 2013 time frame when Michael generated his password. RoboForm would then spit out the same passwords it generated on the days in 2013.

There was one problem: Michael couldn’t remember when he created the password.

According to the log on his software wallet, Michael moved bitcoin into his wallet for the first time on April 14, 2013. But he couldn’t remember if he generated the password the same day or some time before or after this. So, looking at the parameters of other passwords he generated using RoboForm, Grand and Bruno configured RoboForm to generate 20-character passwords with upper- and lower-case letters, numbers, and eight special characters from March 1 to April 20, 2013.

It failed to generate the right password. So Grand and Bruno lengthened the time frame from April 20 to June 1, 2013, using the same parameters. Still no luck.

Michael says they kept coming back to him, asking if he was sure about the parameters he’d used. He stuck to his first answer.

“They really annoyed me, because who knows what I did 10 years ago,” he recalls. He found other passwords he generated with RoboForm in 2013, and two of them did not use special characters, so Grand and Bruno adjusted. Last November, they reached out to Michael to set up a meeting in person. “I thought, ‘Oh my God, they will ask me again for the settings.”

Instead, they revealed that they had finally found the correct password—no special characters. It was generated on May 15, 2013, at 4:10:40 pm GMT.

“We ultimately got lucky that our parameters and time range was right. If either of those were wrong, we would have … continued to take guesses/shots in the dark,” Grand says in an email to WIRED. “It would have taken significantly longer to precompute all the possible passwords.”

Grand and Bruno created a video to explain the technical details more thoroughly.

RoboForm, made by US-based Siber Systems, was one of the first password managers on the market, and currently has more than 6 million users worldwide, according to a company report. In 2015, Siber seemed to fix the RoboForm password manager. In a cursory glance, Grand and Bruno couldn’t find any sign that the pseudo-random number generator in the 2015 version used the computer’s time, which makes them think they removed it to fix the flaw, though Grand says they would need to examine it more thoroughly to be certain.

Siber Systems confirmed to WIRED that it did fix the issue with version 7.9.14 of RoboForm, released June 10, 2015, but a spokesperson wouldn’t answer questions about how it did so. In a changelog on the company’s website, it mentions only that Siber programmers made changes to “increase randomness of generated passwords,” but it doesn’t say how they did this. Siber spokesman Simon Davis says that “RoboForm 7 was discontinued in 2017.”

Grand says that, without knowing how Siber fixed the issue, attackers may still be able to regenerate passwords generated by versions of RoboForm released before the fix in 2015. He’s also not sure if current versions contain the problem.

“I'm still not sure I would trust it without knowing how they actually improved the password generation in more recent versions,” he says. “I'm not sure if RoboForm knew how bad this particular weakness was.”

Customers may also still be using passwords that were generated with the early versions of the program before the fix. It doesn’t appear that Siber ever notified customers when it released the fixed version 7.9.14 in 2015 that they should generate new passwords for critical accounts or data. The company didn’t respond to a question about this.

If Siber didn’t inform customers, this would mean that anyone like Michael who used RoboForm to generate passwords prior to 2015—and are still using those passwords—may have vulnerable passwords that hackers can regenerate.

“We know that most people don't change passwords unless they're prompted to do so,” Grand says. “Out of 935 passwords in my password manager (not RoboForm), 220 of them are from 2015 and earlier, and most of them are \[for\] sites I still use.”

Depending on what the company did to fix the issue in 2015, newer passwords may also be vulnerable.

Last November, Grand and Bruno deducted a percentage of bitcoins from Michael’s account for the work they did, then gave him the password to access the rest. The bitcoin was worth $38,000 per coin at the time. Michael waited until it rose to $62,000 per coin and sold some of it. He now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin.

Michael says he was lucky that he lost the password years ago because, otherwise, he would have sold off the bitcoin when it was worth $40,000 a coin and missed out on a greater fortune.

“That I lost the password was financially a good thing.”

How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet

Police are using subtle psychological operations against ransomware gangs to sow distrust in their ranks—and trick them into emerging from the shadows.

Russian cybercriminals are almost untouchable. For years, hackers based in the country have launched devastating ransomware attacks against hospitals, critical infrastructure, and businesses, causing billions in losses. But they’re out of reach of Western law enforcement and largely ignored by the Russian authorities. When police do take the criminals’ servers and websites offline, they’re often back hacking within weeks.

Now investigators are increasingly adding a new dimension to their disruption playbook: messing with cybercriminals’ minds. To put it bluntly, they’re trolling the hackers.

In recent months, Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystem. These nascent psyops include efforts to erode the limited trust the criminals have in each other, driving subtle wedges between fragile hacker egos, and sending offenders personalized messages showing they’re being watched.

“We’re never going to get to the kernel of these organized criminal gangs, but if we can minimize the impact they have by reducing their ability to scale, then that's a good thing,” says Don Smith, vice president of threat research at security firm Secureworks. “All of these little things, which in themselves may not be a killer blow, they all add friction,” he says. “You can look for cracks, amplify them, and create further discord and mistrust so it slows down what the bad guys are doing.”

Take Operation Cronos. In February, a global law enforcement operation, led by the UK’s National Crime Agency (NCA), infiltrated the LockBit ransomware group, which authorities say has extorted more than $500 million from victims, and took its systems offline. Investigators at the NCA redesigned LockBit’s leak website, where it published its victims’ stolen data, and used the site to publish LockBit’s inner workings.

Demonstrating the control and data they had, law enforcement published images of LockBit’s administration system and internal conversations. Investigators also published the usernames and login details of 194 LockBit “affiliate” members. This was expanded in May to include the members’ surnames.

The policing operation also teased the unveiling of “LockBitSupp,” the mastermind behind the group, and said they had been “engaging” with law enforcement. Russian national Dmitry Yuryevich Khoroshev was charged with running LockBit in May, following a multiday countdown clock being published on the seized LockBit website and bold graphics naming him as the group’s organizer.

“LockBit prided itself on its brand and anonymity, valuing these things above anything else," says Paul Foster, director of threat leadership at the NCA. “Our operation has shattered that anonymity and completely undermined the brand, driving cybercriminals away from using their services.” The NCA says it carefully considered the operation, with its efforts to rebuild LockBit's site leading to the group being widely mocked online and making its brand “toxic” to cybercriminals who had worked with it.

“We recognized that a technical disruption in isolation wouldn’t necessarily destroy LockBit, therefore our additional infiltration and control, alongside arrests and sanctions in partnership with our international partners, has enhanced our impact on LockBit and created a platform for more law enforcement action in the future,” Foster says.

When LockBit members logged in to the group’s administration systems, they received a personalized message saying authorities had gathered their username, cryptocurrency wallet details, internal chats and chats with victims, and IP addresses. As noted by researchers at cybersecurity firm Analyst1, these “psychological tactics” targeted two areas: “brand reputation and interpersonal relationships among actors.”

The efforts go beyond the LockBit takedown. In April, London’s Metropolitan Police disrupted LabHost, a service that allowed scammers to create phishing websites to trick people into handing over their emails and passwords. Around 800 criminal LabHost users were sent personalized video messages by the police detailing “all the data we have about you.” Countries where they targeted victims were included, as well as IP addresses they had used. “We’ve been watching you every time you visited us,” the voiceover in the video says.

“These messages aren't just for the existing participants in the criminal ecosystem,” says Secureworks’ Smith. “These are messages for people who maybe are on the edge of deciding to participate.” Within the sprawling cybercrime ecosystem, there’s not much trust between thieves who can con each other out of millions of dollars, but reinforcing and amplifying the divisions has the potential to make it harder to organize efficient criminal enterprises.

Understanding how much of an impact psychological operations have is difficult, but researchers say the criminals are always watching. Of 194 LockBit affiliates, only 69 have returned to the platform since the law enforcement action in February, the NCA says. The hackers read the news and cybersecurity research, discussing it on Russian-language cybercrime forums, researchers say. The XSS forum has one thread called “Juicy arrests” that has more than 1,000 posts since 2017, says Victoria Kivilevich, director of threat research at security firm KELA, which monitors the cybercriminal underground.

Opinions on the LockBit takedown were divided among XSS users, Kivilevich says. In one post in February, Kivilevich says, a cybercriminal questioned why the group’s leader had not been named or sanctioned at that point. “They have that much information, they must have at least something about him,” a translated post reads. “Or maybe he works with them.” Another urged people not to make memes or joke about the situation. “You understand that at some point this may affect you too,” they wrote.

Kivilevich points to other instances where cybercriminals on forums have become disillusioned or disgruntled by law enforcement targeting some members. When members of the Conti and Trickbot ransomware groups were sanctioned in February 2023, LockBitSupp asked where the sanctions were for the Trickbot leader “Stern” and other high-profile actor “Baddie.” As a further 11 members of Conti and Trickbot were sanctioned in September 2023, days after WIRED named one of the members, a cybercriminal complained that some of those sanctioned “never have had high profiles.” They went on to say there is a feeling of “injustice”: “What was the point of adding fucking managers who didn’t decide much in the business.”

Andréanne Bergeron, director of research at security firm GoSecure who specializes in criminal behavior and police intervention, says there may be two outcomes from naming some criminals and not others. Those that are named may “feel it is unjust to be punished while others go free” and may end up cooperating or working with law enforcement as a result.

Bergeron also says malicious hackers often “crave recognition” for their actions. “When their colleagues receive all the ‘credit,’ even if it includes being sanctioned, these unnamed individuals may feel compelled to reveal themselves to gain recognition,” Bergeron says. “This desire for recognition can drive them to engage in risky behaviors, potentially exposing themselves to authorities in their pursuit of validation.”

While law enforcement may be using some psychological tactics alongside more traditional technical takedowns and sanctions, there’s also scientific research looking at the ways in which cyber psychology can disrupt criminal hackers. The US Intelligence Community's research agency, the Intelligence Advanced Research Projects Activity (Iarpa), has started work on a project to create new cybersecurity defenses by exploiting the human weaknesses of attackers.

Psychology can be used as a way to “understand, anticipate, and influence” the behavior of cyberattackers, says Kimberly Ferguson-Walter, the Iarpa program manager leading the project. The research, which is in its early stages, is looking to build tools and methods to capitalize on the human weaknesses of cybercriminals based on established psychology principles. For instance, if an attacker can be made to feel like they are safe when they are compromising a system, they may engage in riskier behavior and expose themselves.

“If you can deter somebody from attacking your network, that’s about as good as it gets,” Ferguson-Walter says. “I think the more scared or uncertain they are about how the defenses work, the better your odds for doing that are."

Cops Are Just Trolling Cybercriminals Now

Plus: US surveillance reportedly targets pro-Palestinian protesters, the FBI arrests a man for AI-generated CSAM, and stalkerware targets hotel computers.

Sex, drugs, and … Eventbrite? A WIRED investigation published this week uncovered a network of spammers and scammers pushing the illegal sale of controlled substances like Xanax and oxycodone, escort services, social media accounts, and personal information on the event management platform. Making matters worse, Eventbrite’s recommendation algorithm promoted posts for opioids alongside addiction recovery events. The good news is, the company appears to have removed most of the more than 7,400 illicit posts WIRED uncovered.

If you drive a Tesla Model 3, make sure to enable your PIN-to-drive feature or your car could be easily stolen within seconds. While the company has added new ultra-wideband radio tech to its keyless system, which can prevent “relay attacks,” researchers at Beijing-based security firm GoGoByte found that Model 3s (as well as other unnamed makes and models of vehicles) are still vulnerable. Relay attacks use inexpensive radios to transmit the signal from someone’s key fob or phone app that can then be used to unlock and start an impacted vehicle. Tesla says its adoption of ultra-wideband radio was not meant to stop relay attacks (even though it technically could), but it’s possible the automaker will add that protection in the future.

Police busting people for running illicit online markets is nearly as old a tale as the dark web itself. But this week’s takedown offered a new twist. The FBI recently arrested Lin Rui-siang, a 23-year-old accused of operating Incognito Market, which authorities claim facilitated $100 million in sales of narcotics on the dark web. US prosecutors claim Lin then extorted Incognito’s users by threatening to expose them unless they paid up. Curiously, Lin’s professional experience includes teaching police how to catch cybercriminals by tracing cryptocurrency on blockchains. If the US Justice Department is correct about his alleged involvement in Incognito Market, that would make him one of the most unusual cybercriminals we’ve ever encountered.

Leaks don’t just impact people on the wrong side of the law, of course. An unsecured database recently exposed biometric data of police officers in India, including face scans, fingerprints, and more. The incident reveals the dangers of collecting sensitive biometrics in the first place.

Finally, the saga of WikiLeaks founder Julian Assange inched forward again this week, with a British court ruling that he can appeal his extradition to the US, where he faces 18 charges under the Espionage Act for WikiLeaks’ publication of classified US military information. The judges said that Assange can appeal US prosecutors’ assurances about how his trial would be conducted and on First Amendment grounds. The appeals process will inevitably push back any final decision about his potential extradition for months.

But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Following the trend of tech companies in the AI race throwing privacy and caution to the wind, Microsoft unveiled plans this week to launch a tool on its forthcoming Copilot+ PCs called Recall that takes screenshots of its customers’ computers every few seconds. Microsoft says the tool is meant to give people the ability to “find the content you have viewed on your device.” The company also claims to have a range of protections in place and says the images are only stored locally in an encrypted drive, but the response has been roundly negative nonetheless, with some watchdogs reportedly calling it a possible “privacy nightmare.” The company notes that an intruder would need a password and physical access to the device to view any of the screenshots, which should rule out the possibility of anyone with legal concerns ever adopting the system. Ironically, Recall’s description sounds eerily reminiscent of computer monitoring software the FBI has used in the past. Microsoft even acknowledges that the system takes no steps to redact passwords or financial information.

**US Surveillance Reportedly Targets Pro-Palestinian Protesters**

Federal authorities are reportedly working quietly to establish ties between antiwar demonstrators on US campuses and any foreign groups or individuals overseas, according to journalist Ken Klippenstein, formerly of the Intercept, who says the National Counterterrorism Center is at the center of the effort. Evidence of overseas ties would lend further ammunition to politicians, university officials, and police, who’ve widely claimed “outside agitators” are to blame for the demonstrations—an allegation that’s routinely lobbed at protesters in the United States, often meant to imply that the protesters themselves are dupes. Incidentally, authorities may also overcome constitutional hurdles to surveillance by establishing a foreign target to spy on; someone unprotected by the country’s Fourth Amendment. Republicans in Congress—representatives Mark Green and August Pfluger—have, meanwhile, asked the FBI and Department of Homeland Security to supply congressional committees with records about the government’s surveillance of the protesters, including any efforts to infiltrate them using “online covert employees or confidential human sources.”

**FBI Arrests Man for AI-Generated CSAM**

The FBI has nabbed a 42-year-old Wisconsin man for using Stable Diffusion, the text-to-image generative AI software, to manufacture child sexual abuse material. The man was reportedly caught with “thousands of realistic images” of children, some featuring them nude or partially clothed with men. Court records indicate the evidence includes more than 13,000 gen-AI images as well as the prompts he used to create the images. “Using AI to produce sexually explicit depictions of children is illegal, and the Justice Department will not hesitate to hold accountable those who possess, produce, or distribute AI-generated child sexual abuse material,” Nicole Argentieri, head of the Justice Department’s Criminal Division, says in a statement. The arrest is part of Project Safe Childhood, a collaboration between the government and corporations reportedly targeting online offenders.

**Stalkerware Targets US Hotel Computer Systems**

Security researchers this week disclosed to TechCrunch that they’d discovered consumer-grade spyware—often known as “stalkerware”—on the computers of “at least three” Wyndham hotels in the United States, potentially exposing travelers’ personal details. The stalkerware, called pcTattletale, can be installed on Android and Windows devices, giving whoever has control of the sneaky app the ability to access data on the targeted machine and monitor users’ activity. The presence of pcTattletale was discovered thanks to a security flaw in the spyware that exposed screenshots of infected machines to the open internet, according to the researchers. Although the researchers found pcTattletale on Wyndham computers, the hotel company says each of its locations are franchises, suggesting that the spyware infection could be limited to just a few locations.

Microsoft’s New Recall AI Tool May Be a ‘Privacy Nightmare’

The strange journey of Lin Rui-siang, the 23-year-old accused of running the Incognito black market, extorting his own site’s users—and then refashioning himself as a legit crypto crime expert.

Two months ago, Lin Rui-siang, a young Taiwanese man wearing black-rimmed glasses and a white polo shirt, stood behind a lectern emblazoned with the crest of the St. Lucia police, giving a presentation titled “Cyber Crime and Cryptocurrency” in nearly fluent English to a roomful of cops from the tiny Caribbean country.

The St. Lucia government would later issue a press release lauding the success of Lin's training course, which had been organized by the Taiwanese embassy, where Lin worked as a diplomatic specialist in IT. The statement boasted that 30 officers had learned “nuances of the dark web" and cryptocurrency tracing skills from Lin, who had “used his professional background and qualifications in the field" to teach them how to better combat cybercrime.

Only earlier this week did it become clear exactly what Lin's “professional background and qualifications in the field” allegedly entailed, seemingly unbeknownst to either his Taiwanese employers or his St. Lucian law enforcement trainees. For nearly four years, according to the US Justice Department, 23-year-old Lin ran a dark-web drug market called Incognito that authorities say enabled the sale of at least $100 million worth of narcotics, ranging from MDMA to heroin for cryptocurrencies including bitcoin and monero. That was before Lin's alleged theft of his own users' funds earlier this year and then his arrest last week by the FBI in New York's JFK airport.

Over his years working as a cryptocurrency-focused intern at Cathay Financial Holdings in Taipei and then as a young IT staffer at St. Lucia's Taiwanese embassy, Lin allegedly lived a double life as a dark-web figure who called himself “Pharoah" or “faro”—a persona whose track record qualifies as remarkably strange and contradictory even for the dark web, where secret lives are standard issue. In his short career, Pharoah launched Incognito, built it into a popular crypto black market with some of the dark web's better safety and security features, then abruptly stole the funds of the market's customers and drug dealers in a so-called “exit scam” and, in a particularly malicious new twist, extorted those users with threats of releasing their transaction details.

During those same busy years, Pharoah also launched a web service called Antinalysis, designed to defeat crypto money laundering countermeasures—only for Lin, who prosecutors say controlled that Pharoah persona, to later refashion himself as a crypto-focused law enforcement trainer. Finally, despite his supposed expertise in cryptocurrency tracing and digital privacy, it was Lin's own relatively sloppy money trails that, the DOJ claims, helped the FBI to trace his real identity.

An April post on Lin Rui-siang’s LinkedIn account about his cybercrime and cryptocurrency training course for police in St. Lucia.

Among all those incongruities, though, it's the image of Lin giving his cryptocurrency crime training in St. Lucia—which Lin proudly posted to his LinkedIn account—that shocked Tom Robinson, a cofounder of the blockchain analysis firm Elliptic, who has long tracked Lin's alleged Pharoah alter ego. “This is an alleged dark-net market admin standing in front of police officers, showing them how to use blockchain analytics tools to track down criminals online,” says Robinson. “Assuming he is who the FBI says he is, it's incredibly ironic and brazen.”

**Pharoah the Kingpin—and Extortionist**

Lin has been charged with not only narcotics conspiracy and money laundering but also running a “continuing criminal enterprise,” the so-called “kingpin statute” reserved for organized crime leaders who allegedly oversaw at least five employees. For that charge alone, he faces a potential life sentence.

In the DOJ's criminal complaint against Lin, it points to a handwritten document the FBI pulled from his email, which appears to sketch out a flow chart for a dark-web market's mechanics. The complaint's FBI affidavit says Lin emailed himself the sketch in March 2020 when he was at most 19 years old. It describes functionality such as how “vendors” and “buyers” would register, make purchases, and encrypt shipping addresses. Seven months later, Lin would allegedly launch Incognito Market.

A sketch of a dark-web market's infrastructure that Lin emailed to himself eight months before allegedly creating Incognito Market, according to the DOJ.

According to the FBI, the market took nearly a year to catch on, with virtually no sales during that time. But by late 2021, Incognito had started to attract users, and by the middle of 2022, the market had drawn enough vendors and sellers to generate more than $1.5 million a month in sales.

A 2022 Twitter thread about Incognito posted by Eileen Ormsby, an author of several dark-web-focused books including _The Darkest Web_, shows how the market by that time had added features that may have helped it to catch the attention of security- and safety-conscious users. It required that new users demonstrate they could use the encryption tool PGP before entering the market, prompted them to take a security quiz, allowed buyers to spend the more privacy-focused cryptocurrency monero as well as bitcoin, encouraged dealers to post results from a fentanyl test to certify their product was “fent free,” and even experimented with democratic voting for market-wide decisions.

By the summer of 2023, Incognito had spiked in popularity and was approaching $5 million a month in sales. Then in March of this year, the site suddenly dropped offline, taking all the funds stored in buyers' and sellers' wallets with it. A few days later, the site reappeared with a new message on its homepage. “Expecting to hear the last of us yet?” it read. “We got one final little nasty surprise for y'all.”

The message explained that Incognito was now essentially blackmailing its former users: It had stored their messages and transaction records, it said, and added that it would be creating a “whitelist portal” where users could pay a fee—which for some dealers would later be set as high as $20,000—to remove their data before all the incriminating information was leaked online at the end of this month. “YES THIS IS AN EXTORTION!!!” the message added.

In retrospect, Ormsby says that the site's apparent user-friendliness and its security features were perhaps a multiyear con laying the groundwork for its endgame, a kind of user extortion never seen before in dark-web drug markets. “Maybe the whole thing was set up to create a false sense of security,” Ormsby says. “The extorting thing is completely new to me. But if you've lulled people into a sense of security, I guess it's easier to extort them.”

In total, Incognito Market promised to leak more than half a million drug transaction records if buyers and sellers didn't pay to remove them from the data dump. It's still not clear whether the market's administrator—Lin, according to prosecutors, whom they accuse of personally carrying out the extortion campaign—planned to follow through on the threat: He appears to have been arrested before the deadline set for the victims of the Incognito blackmail.

**An Expert in ‘Anti Anti-Money Laundering’**

At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme. In the summer of 2021, during Incognito Market's relatively quiet first year, Lin's alleged alter ego, Pharoah, launched a service called Antinalysis, a website designed to analyze blockchains and let users check—for a fee—whether their cryptocurrency could be connected to criminal transactions.

In a post to the dark-web market forum Dread, Pharoah made clear that Antinalysis was designed not to help anti-money-laundering investigators, but rather those who sought to evade them—presumably including his own dark-web market's users. “Our goals do not lie in aiding the surveillance autocracy of state-sponsored agencies,” Pharoah's post read. “This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent's point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.”

After independent cybersecurity reporter Brian Krebs wrote about the Antinalysis service in August 2021, describing it as an “anti anti-money laundering service for crooks,” Pharoah posted another message complaining that Antinalysis had lost access to its blockchain data source, which Krebs had identified as the anti-money-laundering tool AMLBot, and that it would be going offline. “Stay posted and fuck LE," Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa.

Meanwhile, Lin appears to have maintained his obsession with cryptocurrency tracing and blockchain analysis: His final LinkedIn post last week before his arrest in New York announced that he had become a certified user of Reactor, the crypto tracing tool sold by blockchain analysis firm Chainalysis. “I'm excited to share that I've completed Chainalysis's new qualification: Chainalysis Reactor Certification (CRC)!” Lin wrote in Mandarin. His last X post shows a Chainalysis diagram of money flows between dark-web markets and cryptocurrency exchanges.

It's not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. But it raises the troubling possibility that a former dark-web kingpin—one who was still extorting his own users—was perhaps playing both sides of the crypto tracing game, says Elliptic's Tom Robinson.

“There’s a larger issue here about bad actors accessing blockchain analytics tools,” says Robinson. “That is a potentially risky situation, where someone who’s in the process of laundering proceeds of crime can check in commercially available tools whether they have laundered them such that they can get away with it.” Running certain checks in those tools might even allow someone to determine if they're being actively investigated by law enforcement, Robinson says.

WIRED reached out to Chainalysis to ask about Lin's Reactor certification and what sort of safeguards prevent criminals from using the company's software, but the company declined to comment.

If Lin did hope to evade law enforcement by becoming an expert in crypto tracing himself, he was far too late to avoid creating his own blockchain trail of evidence: In January of this year, the FBI says it somehow identified a central Incognito server and obtained a search warrant for its contents. That allowed investigators to identify a bitcoin wallet stored there, which the FBI says Lin had also carelessly used to pay web registrar Namecheap for four web domains—including one that tracked which dark-web markets were online or down—and register them under his own name.

Although the FBI says Lin tried to swap his bitcoins for harder-to-trace monero before cashing out the cryptocurrency at an exchange, the criminal complaint points to timing and amount correlations that nonetheless allowed the FBI to follow his funds to a crypto exchange where he allegedly liquidated the dirty funds. That exchange account, too, was registered in Lin's real name, according to the DOJ.

The operational security mistakes the FBI describes suggest that, regardless of which side of the cryptocurrency cat-and-mouse game Lin intended to end up on, he was far from a criminal mastermind. His brief, strange journey from alleged kingpin to crypto crime expert ultimately provides plenty of lessons to criminals and law enforcement alike—though probably not the ones he intended.

He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market

Thousands of fingerprints and facial images linked to police in India have been exposed online. Researchers say it’s a warning of what will happen as the collection of biometric data increases.

Thousands of law enforcement officials and people applying to be police officers in India have had their personal information leaked online—including fingerprints, facial scan images, signatures, and details of tattoos and scars on their bodies. If that wasn’t alarming enough, at around the same time, cybercriminals have started to advertise the sale of similar biometric police data from India on messaging app Telegram.

Last month, security researcher Jeremiah Fowler spotted the sensitive files on an exposed web server linked to ThoughtGreen Technologies, an IT development and outsourcing firm with offices in India, Australia, and the US. Within a total of almost 500 gigabytes of data spanning 1.6 million documents, dated from 2021 until when Fowler discovered them in early April, was a mine of sensitive personal information about teachers, railway workers, and law enforcement officials. Birth certificates, diplomas, education certificates, and job applications were all included.

Fowler, who shared his findings exclusively with WIRED, says within the heaps of information, the most concerning were those that appeared to be verification documents linked to Indian law enforcement or military personnel. While the misconfigured server has now been closed off, the incident highlights the risks of companies collecting and storing biometric data, such as fingerprints and facial images, and how they could be misused if the data is accidentally leaked.

“You can change your name, you can change your bank information, but you can't change your actual biometrics,” Fowler says. The researcher, who also published the findings on behalf of Website Planet, says this kind of data could be used by cybercriminals or fraudsters to target people in the future, a risk that’s increased for sensitive law enforcement positions.

Within the database Fowler examined were several mobile applications and installation files. One was titled “facial software installation,” and a separate folder contained 8 GB of facial data. Photographs of people’s faces included computer-generated rectangles that are often used for measuring the distance between points of the face in face recognition systems.

There were 284,535 documents labeled as Physical Efficiency Tests that related to police staff, Fowler says. Other files included job application forms for law enforcement officials, profile photos, and identification documents with details such as “mole at nose” and “cut on chin.” At least one image shows a person holding a document with a corresponding photo of them included on it. “The first thing I saw was thousands and thousands of fingerprints,” Fowler says.

Prateek Waghre, executive director of Indian digital rights organization Internet Freedom Foundation, says there is “vast” biometric data collection happening across India, but there are added security risks for people involved in law enforcement. “A lot of times, the verification that government employees or officers use also relies on biometric systems,” Waghre says. “If you have that potentially compromised, you are in a position for someone to be able to misuse and then gain access to information that they shouldn’t.”

It appears that some biometric information about law enforcement officials may already be shared online. Fowler says after the exposed database was closed down he also discovered a Telegram channel, containing a few hundred members, which was claiming to sell Indian police data, including of specific individuals. “The structure, the screenshots, and a couple of the folder names matched what I saw,” says Fowler, who for ethical reasons did not purchase the data being sold by the criminals so could not fully verify it was exactly the same data.

A Leak of Biometric Police Data Is a Sign of Things to Come

Ultra-wideband radio has been heralded as the solution for “relay attacks” that are used to steal cars in seconds. But researchers found Teslas equipped with it are as vulnerable as ever.

For at least a decade, a car theft trick known as a “relay attack” has been the modern equivalent of hot-wiring: a cheap and relatively easy technique to steal hundreds of models of vehicles. A more recent upgrade to the radio protocol in cars' keyless entry systems known as ultra-wideband communications, rolled out to some high-end cars including the latest Tesla Model 3, has been heralded as the fix for that ubiquitous form of grand theft auto. But when one group of Chinese researchers actually checked whether it's still possible to perform relay attacks against the latest Tesla and a collection of other cars that support that next-gen radio protocol, they found that they're as stealable as ever.

In a video shared with WIRED, researchers at the Beijing-based automotive cybersecurity firm GoGoByte demonstrated that they could carry out a relay attack against the latest Tesla Model 3 despite its upgrade to an ultra-wideband keyless entry system, instantly unlocking it with less than a hundred dollars worth of radio equipment. Since the Tesla 3's keyless entry system also controls the car's immobilizer feature designed to prevent its theft, that means a radio hacker could start the car and drive it away in seconds—unless the driver has enabled Tesla's optional, off-by-default PIN-to-drive feature that requires the owner to enter a four-digit code before starting the car.

Jun Li, GoGoByte's founder and a longtime car-hacking researcher, says that his team's successful hack of the latest Model 3's keyless entry system means Tesla owners need to turn on that PIN safeguard despite any rumor that Tesla's radio upgrade would protect their vehicle. “It's a warning for the mass public: Simply having ultra-wideband enabled doesn't mean your vehicle won't be stolen,” Li says. “Using relay attacks, it's still just like the good old days for the thieves.”

Relay attacks work by tricking a car into detecting that an owner's key fob—or, in the case of many Tesla owners, their smartphone with an unlocking app installed—is near the car and that it should therefore unlock. Instead, a hacker's device near the car has, in fact, relayed the signal from the owner's real key, which might be dozens or hundreds of feet away. Thieves can cross that distance by placing one radio device near the real key and another next to the target car, relaying the signal from one device to the other.

Thieves have used the relay technique to, for instance, pick up the signal of a car key inside a house where the owner is sleeping and transmit it to a car in the driveway. Or, as GoGoByte researcher Yuqiao Yang describes, the trick could even be carried out by the person behind you in line at a café where your car is parked outside. “They may be holding a relay device, and then your car may just be driven away,” Yang says. “That's how fast it can happen, maybe just a couple seconds.” The attacks have become common enough that some car owners have taken to keeping their keys in Faraday bags that block radio signals—or in the freezer.

Security researchers have long recommended that carmakers prevent relay attacks by developing keyless entry systems that more precisely measure the timing between a key fob or phone sending a signal and the car receiving it. So when Tesla rolled out its ultra-wideband radio upgrade to its keyless entry system, Tesla owners had every reason to think that the new protocol represented that long-awaited security fix. Ultra-wideband is, after all, capable of far more precise range measurement—it's the radio protocol that makes possible the distance tracking in Apple's AirTags, for instance.

In 2020, Tesla even wrote in a filing to the US Federal Communications Commission that it would be implementing ultra-wideband in its keyless entry systems, and that the ability to far more precisely measure the distance of a key fob or smartphone from a car would—or at least _could_—prevent its vehicles from being stolen via relay attacks. “The distance estimate is based on a Time of Flight measurement, which is immune to relay attacks,” Tesla's filing read. That document, first turned up by the Verge, led to widespread reports and social media comments suggesting that the upcoming ultra-wideband version of Tesla's keyless entry system would spell the end of relay attacks against its vehicles.

Yet the GoGoByte researchers found they were able to carry out their relay attack against the latest Tesla Model 3 over Bluetooth, just as they had with earlier models, from a distance as far as 15 feet between their device and the owner's key or phone. While the cars do appear to use ultra-wideband communications, they don't apparently use them for a distance check to prevent keyless entry theft.

Tesla has not yet responded to WIRED's requests for comment.

When the GoGoByte researchers shared their findings with Tesla earlier this month, the company's product security team immediately responded in an email dispelling any rumor that ultra-wideband, or “UWB,” was even intended to prevent theft. “This behavior is expected, as we are currently working on improving the reliability of UWB,” read Tesla's email in response to GoGoByte's description of its relay attack. “UWB ranging will be enforced when reliability improvements are complete.”

That answer shouldn't necessarily come as a surprise, says Josep Rodriguez, a researcher for security firm IOActive who has previously demonstrated relay attacks against Tesla vehicles. Tesla never explicitly said it had started using the ultra-wideband feature for security, after all—instead, the company has touted ultra-wideband features like detecting that someone's phone is next to the trunk to open it hands-free—and using it as a security check may still produce too many false positives.

“My understanding is that it can take engineering teams time to find a sweet spot where relay attacks can be prevented but also not affect the user experience,” Rodriguez wrote in an email to WIRED. “I wasn’t expecting that the first implementation of UWB in vehicles would solve the relay attacks.”

Automakers' slow adoption of ultra-wideband security features isn't just limited to Tesla, the GoGoByte researchers note. They found that two other carmakers whose keys support ultra-wideband communications are also still vulnerable to relay attacks. In one case, the company hadn't even written any software to implement ultra-wideband communications in its cars' locking systems, despite upgrading to hardware that supports it. (The researchers aren't yet naming those other carmakers since they're still working through the vulnerability disclosure process with them.)

Despite Teslas' high price tag and continuing vulnerability to relay attacks, some studies have found that the cars are far less likely to be stolen than other cars due to their default GPS tracking—though some car theft rings have targeted them anyway using relay attacks to sell the vehicles for parts.

GoGoByte notes that Tesla, unlike many other carmakers, does have the ability to push out over-the-air updates to its cars and might still use that feature to implement a relay attack fix via ultra-wideband communications. Until then, though, the GoGoByte researchers say they want Tesla owners to understand they're far from immune. “I think Tesla will be able to fix this because they have the hardware in place,” says Li. “But I think the public should be notified of this issue before they release the secure version.”

Until then, in other words, keep your Tesla's PIN-to-drive protection in place. Better that than keeping your keys and smartphone in the freezer—or waking up to find a vacant driveway and your car sold for parts.

Source

Wired