Social Security numbers, death certificates, voter applications, and other personal data were accessible on the open internet, highlighting the ongoing challenges in election security.

Databases containing sensitive voter information from multiple counties in Illinois were openly accessible on the internet, revealing 4.6 million records that included driver's license numbers as well as full and partial Social Security Numbers and documents like death certificates. Longtime security researcher Jeremiah Fowler stumbled upon one of the databases that appeared to contain information from DeKalb County, Illinois, and subsequently discovered another 12 exposed databases. None were password protected nor required any type of authentication to access.

As criminal and state-backed hacking becomes ever more sophisticated and aggressive, threats to critical infrastructure loom. But often, the biggest vulnerabilities come not from esoteric software issues, but from gaping errors that leave the safe door open and the crown jewels exposed. After years of efforts to shore up election security across the United States, state and local awareness about cybersecurity issues has improved significantly. But as this year's US election quickly approaches, the findings reflect the reality that there are always more oversights to catch.

“I’ve found voter databases in the past, so I kind of know if it's a low-level marketing outreach database that someone has purchased,” Fowler tells WIRED. “But here I saw voter applications— there were actually scans of documents, and then screenshots of online applications. I saw voter rolls for active voters, absentee voters with email addresses, some of them military email addresses. And when I saw Social Security numbers and driver’s license numbers and death certificates I was like, ‘OK, those shouldn’t be there.’”

Through public records, Fowler determined that all of the counties appear to contract with an Illinois-based election management service called Platinum Technology Resource, which provides voter registration software and other digital tools along with services like ballot printing. Many counties in Illinois use Platinum Technology Resource as an election services provider, including DeKalb, which confirmed its relationship with Platinum to WIRED.

Fowler reported the unprotected databases to Platinum on July 18, but he says he didn't receive a response and the databases remained exposed. As Fowler dug deeper into public records, he realized that Platinum works with the Illinois-based managed services provider Magenium, so he sent a disclosure to this company as well on July 19. Again, he says he did not receive a response, but shortly after the databases were secured, pulling them from public view. Platinum and Magenium did not return WIRED's multiple requests for comment.

Platinum began distributing a notification, viewed by WIRED, to impacted counties on Friday. “We have evidence of a claim the file storage containing voter registration documents may have been scanned,” Platinum wrote, adding that the exposed databases do not indicate a deeper compromise of its systems. “There was a thorough investigation executed. The findings support our ongoing belief there is no evidence of voter registration forms being leaked or stolen … We used this opportunity to deploy new and additional safeguards around voter registration documents.”

Illinois's data breach notification law requires notification to the state within 45 days of an incident. A standard version of a Champaign County contract for technology services posted publicly through a Freedom of Information Act request requires a contractor to notify the impacted county within 15 minutes of identifying a data breach.

Fowler points out that while the exposed information would potentially make impacted individuals more susceptible to identity theft and other scams, it could also be abused to submit multiple absentee ballot requests or to conduct other suspicious activity that could call a voter's legitimate vote into question and take time to reconcile. But he adds that the death certificates and other documentation contained in the trove reflect the work election officials do all over the country to manage voter registrations and ensure that everyone's vote is accurately counted.

“There’s definitely progress on basic data security, and I don’t see stuff like this very often anymore,” Fowler says. “But I used the open and public internet and no specialized tools to find this. And at the end of the day, this is critical infrastructure that was exposed.”

Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

Joshua Caleb Sutter infiltrated far-right extremist organizations as a confidential FBI informant, all while promoting hateful ideologies that influenced some of the internet's most violent groups.

Listing the Atomwaffen Division and the Order of Nine Angles as a lasting influence, Butcher also disclosed the nature of MKU’s “alliance” with 764, which was forged by the users “Xor” and “Kush” (both of whom are still unidentified). While deriding 764 for not committing enough in-person violence, Butcher said the two groups “might still stay associates because they keep cleansing their own way by making the weak suicide.”

According to victims of 764 members, “Tobbz,” a troubled young German convicted of killing an elderly woman and stabbing a man in 2022, was in the original 764 Discord server along with Almeida and Bradley Cadenhead, 764’s teenage founder who is serving decades in a Texas prison for CSAM offenses. Tobbz also had a Tempel ov Blood trident tattoo and had joined MKU, according to reporting from Der Spiegel and Recorder.

The second issue of _Drums of Tophet_, which its authors describe as “designed for the dark warriors of a doom now imminent on the near horizon,” continues in the same vein with features Q309, an occult sadomasochistic, self-described “art project” that borders on CSAM and prominently features Order of Nine Angles themes and a lengthy interview with a founder of the Satanic Front, a southern occultist organization.

In communications with a former Tempel ov Blood member viewed by WIRED, Sutter openly discussed viewing CSAM with other members of his nexion, and seemed obsessed with conspiracy theories like Project Monarch that involved child abuse. The former ToB member also noted Sutter’s fascination with the case of Belgian serial killer, rapist, and pedophile Marc Dutroux. Shortly before taking the Agony’s Point Press X account offline in March of this year, the account posted a photo of an occult altar featuring a blood-smeared photo of Dutroux next to human and animal skeletal remains, as well as a severed doll’s head inked with lightning bolts and a swastika, on top of a flag featuring a Nazi death’s head and the Nazi slogan “_Meine ehre ist meine treue_” (my honor is my allegiance).

On several occasions in the past year, the Agony’s Point Press account on X posted videos and photos highlighting 764 and its offshoots, particularly MKU and the group’s growing interest in the Order of Nine Angles. The account also routinely posted about 764 and com, occasionally adopting a faux journalistic tone to launder posts from the CSAM distribution and extortion network. Around Christmas 2023, @agonyspoint posted a graphic of MKU's hockey goalie mask insignia with a ToB trident emblazoned in its forehead.

All this took place as the FBI’s investigation into 764 expanded and new arrests, including those of alleged member Kyle Spitze and Richard Densmore, who pleaded guilty in mid-July, were made in the early months of 2024. Moreover, there is an active FBI investigation on MKU that stems directly from its ties to 764, according to a law enforcement source with knowledge of the matter.

Earlier this year, the Agony's Point account turned back toward older Martinet Press material, with several threads promoting _Bluebird_ and _Iron Gates_, two books that Sutter introduced to the Atomwaffen Division as required reading that celebrate child abuse and rape.

**“A Deal With the Devil”**

The FBI has never addressed Sutter’s role in fueling violent far-right ideology. But the blowback from Sutter’s actions over the past decade is a feature, not a bug, of American law enforcement’s use of confidential informants, says Alexandra Natapoff, a professor at Harvard Law School who has studied the topic extensively for more than 15 years. “The informant market is run on this tacit, uncomfortable understanding that the cure sometimes might be worse than the disease,” Natapoff tells WIRED. By utilizing people with criminal or extremist histories to infiltrate hard-to-penetrate milieus like gangs, organized crime, or terrorist groups, she explains, the US government rewards such people for continuing to swim in the same waters.

“Baked into that arrangement is the well-understood, avoidable phenomenon that these individuals are going to commit criminal acts,” Natapoff says. “The FBI has authorized criminal and unauthorized criminal activity by confidential human sources, and the mere fact that those guidelines have those definitions is a recognition about the nature of informants.”

He Was an FBI Informant—and Inspired a Generation of Violent Extremists

The RayV Lite will make it hundreds of times cheaper for anyone to carry out physics-bending feats of hardware hacking.

In modern microchips, where some transistors have been shrunk to less than a 10th of the size of a Covid-19 virus, it doesn't take much to mess with the minuscule electrical charges that serve as the 0s and 1s underpinning all computing. A few photons from a stray beam of light can be enough to knock those electrons out of place and glitch a computer's programming. Or that same optical glitching can be achieved more purposefully—say, with a very precisely targeted and well timed blast from a laser. Now that physics-bending feat of computer exploitation is about to become available to far more hardware hackers than ever before.

At the Black Hat cybersecurity conference in Las Vegas next week, Sam Beaumont and Larry “Patch” Trowell, both hackers at the security firm NetSPI, plan to present a new laser hacking device they're calling the RayV Lite. Their tool, whose design and component list they plan to release open source, aims to let anyone achieve arcane laser-based tricks to reverse engineer chips, trigger their vulnerabilities, and expose their secrets—methods that have historically only been available to researchers inside of well-funded companies, academic labs, and government agencies.

State-of-the-art commercial tools for light-based hacking techniques, such as the Riscure Laser Station, have typically cost as much as $150,000, and even lower-budget versions cost closer to $10,000. Yet through a combination of 3D printing, commodity component choices, and clever physics tricks, Beaumont and Trowell built theirs for less than $500.

Their goal in creating and releasing the designs for that ultra-cheap chip-hacking gadget, they say, is to make clear that laser-based exploitation techniques (known as laser fault injection or laser logic state imaging) are far more possible than many hardware designers—including clients for whom Beaumont and Trowell sometimes perform security testing at NetSPI—believe them to be. By demonstrating how inexpensively those methods can now be pulled off, they hope to both put a new tool in the hands of DIY hackers and researchers worldwide, and to push hardware manufacturers to secure their products against an obscure but surprisingly practical form of hacking.

“If we come to clients and say, ‘Your chip is vulnerable to laser fault injection,’ they tell us nobody's going to be able to do that because it's infeasible and it costs too much. We don't actually think that's true. So that got us started tinkering,” Beaumont says. “We're not discovering anything new, in the sense that other people have used lasers this way before. We're doing it at a lower cost, so that people can do this in their homes.”

The RayV Lite, shown here with no target chip mounted. Its laser and lens are visible in the circular opening on top.Photograph: Courtesy of NetSPI

Beaumont describes the RayV Lite as part of a larger trend she calls the “domestication of tooling”: Devices like the ChipWhisperer and HackRF have made electromagnetic or radio-based hacking techniques vastly cheaper and more accessible. The RayV Lite, she hopes, will do the same for lasers. “It’s significant,” says Adam Laurie, a longtime hardware hacker and current head of product security at electric vehicle charging firm Alpitronic, who reviewed Beaumont and Trowell's laser hacking work. “It moves the tools from the super-expensive academic or state-actor platform to the garage, where the really inventive stuff happens.”

As they built the RayV Lite, Beaumont and Trowell focused on two distinct laser hacking methods. One is laser fault injection, or LFI, which uses a brief blast of light to mess with the charges of a processor's transistors, “flipping bits” from 1 to 0 or vice versa. In some cases, carefully triggering those bit flips can cause far larger effects. For one automotive chip that Beaumont tested, for instance, glitching the chip with a laser at a certain moment can prevent a security check that puts the chip's firmware in a protected state, thus leaving it unprotected and letting her scan through its otherwise obfuscated code to find vulnerabilities.

Many cryptocurrency wallets, too, are vulnerable to forms of LFI, Beaumont and Trowell say, such as glitching the chip at the moment it's asking for a PIN to unlock the cryptographic key to access the owner's funds. “You take the chip off the crypto wallet, hit it with a laser at the right time, and it will just assume you have the PIN,” says Trowel. “It just jumps through the instructions and gives the key back.”

A second laser-hacking technique, known as laser logic state imaging, focuses instead on surveilling a chip's architecture and activity in real time, bouncing laser light off of it, and capturing the results (much like a camera or microscope), and then analyzing them—in Beaumont and Trowell's work, this was often done with the help of machine learning tools. Because a laser's light bounces off silicon differently based on its electrical charge, that trick allows hackers to map out not only the physical layout of a processor but also the data its transistors store, essentially vivisecting the chip to pull out hints about the data and code it's handling, which could include sensitive secrets.

In the first iteration of RayV Lite, Beaumont and Trowell are building designs for the tool in two different versions, one for each of those two laser hacking techniques. They're releasing only the laser fault injection model for now, and hope to debut the laser logic state imaging version in a matter of months. Both will use the same fundamental components and the same DIY cost-cutting tricks. The body of the tool, for instance, is ba

sed on an open source 3D-printable microscope model called OpenFlexure, which uses the flexibility of 3D-printable PLA plastic to achieve precise aiming of the laser. The target chip is mounted on a chassis fixed to printed plastic levers that are bent to small degrees by stepper motors, allowing tiny, precise movements in three dimensions. With that plastic bending trick and a laser focused through a lens, Beaumont and Trowell say, the RayV can target transistors—or rather, groups of them—down to the nanometer scale. (PLA plastic does wear out, Beaumont admits. But she also notes that the entire body of the RayV Lite can simply be printed again for a few dollars.)

Another innovation that allowed Beaumont and Trowell to vastly reduce the RayV Lite's cost, first implemented by a group of academic researchers at Royal Holloway University of London who built their own low-cost laser fault injection tool, was the discovery that laser-based chip hacking can be performed with far cheaper lasers than previously believed. That's in part because a lower-powered laser fired at a chip for a longer time interval—still so quick as to be measured in milliseconds—can have an equivalent effect to a higher-powered laser fired for a shorter time, just as a traditional camera can expose film to less light for a longer time to achieve the same exposure.

The RayV Lite with a target chip attached to a circuit board mounted on top of its 3D-printed chassis.Photograph: Courtesy of NetSPI

That realization allowed Beaumont and Trowell to use a laser in the RayV Lite that costs less than $20 and also saves enormously on the equipment and electricity used for powering the laser. “People don't have freaking massive lasers sitting around,” says Beaumont. “But you can do this with a laser pointer, which is actually what we're doing right now.” (Beaumont and Trowell nonetheless warn that anyone using even lower-powered lasers should be careful to wear eye protection.)

In fact, the most expensive components of the RayV Lite are the lens used for focusing its relatively cheap laser and an FPGA chip that serves as its timing mechanism, each of which costs close to $100, as well as the $68 Raspberry Pi minicomputer that allows it to be controlled and programmed.

Aside from the general sense that “lasers are cool,” as Trowell puts it, it was the growing body of research in more accessible laser hacking techniques that drove her and Trowell to conceive the RayV Lite, as well as what they saw as a disconnect between that accessibility and their clients' out-of-date perceptions of the difficulty of laser-based hacking. Some highly sensitive devices used in industrial control systems, automobiles, and medical devices will be vulnerable to laser fault injection of laser logic state imaging, they say. And those manufacturers need to understand that the notion of hacking the chips inside those critical devices with lasers isn't as arcane or out-of-reach as they might believe.

“Security through obfuscation isn't something we can kind of rely upon over time, especially when we're working with critical infrastructure, or when we're working with devices that are literally in our homes and our hearts,” says Beaumont.

More practically, she says, the RayV Lite will make her own job—and no doubt that of many other hardware hackers who will use her optical exploitation toolkit—far easier. “Selfishly, it's very nice,” she says. “Especially when I have to do expense reports.”

A $500 Open-Source Tool Lets Anyone Hack Computer Chips With Lasers

OpenAI’s newest model is “a data hoover on steroids,” says one expert—but there are still ways to use it while minimizing risk.

Open AI says this data is used to train the AI model and improve its responses, but the terms allow the firm to share your personal information with affiliates, vendors, service providers, and law enforcement. “So it’s hard to know where your data will end up,” says Love.

OpenAI’s privacy policy states that ChatGPT does collect information to create an account or communicate with a business, says Bharath Thota, a data scientist and chief solutions officer of analytics practice at management consulting firm Kearney, which advises firms on managing and using AI data to power new revenue streams.

Part of this data collection includes full names, account credentials, payment card information, and transaction history, he says. “Personal information can also be stored, particularly if images are uploaded as part of prompts. Likewise, if a user decides to connect with any of the company’s social media pages like Facebook, LinkedIn, or Instagram, personal information may be collected if they’ve shared their contact details.”

OpenAI uses consumer data like other big tech and social media companies, but it does not sell advertising. Instead, it provides tools—an important difference, says Jeff Schwartzentruber, senior machine learning scientist at security firm eSentire. “The user input data is not used directly as a commodity. Instead, it is used to improve the services that benefit the user—but it also increases the value of OpenAI’s intellectual property.”

****Privacy Controls****

Since its launch in 2020 and amid criticism and privacy scandals, OpenAI has introduced tools and controls you can use to lock down your data. OpenAI says it is “committed to protecting people's privacy.”

For ChatGPT specifically, OpenAI says it understands users may not want their information used to improve its models and therefore provides ways for them to manage their data. “ChatGPT Free and Plus users can easily control whether they contribute to future model improvements in their settings,” the firm writes on its website, adding that it does not train on API, ChatGPT Enterprise, and ChatGPT Team customer data by default.

“We provide ChatGPT users with a number of privacy controls, including giving them an easy way to opt out of training our AI models and a temporary chat mode that automatically deletes chats on a regular basis,” OpenAI spokesperson Taya Christianson tells WIRED.

The firm says it does not seek out personal information to train its models, and it does not use public information on the internet to build profiles about people, advertise to them, or target them—or to sell user data.

OpenAI does not train your models on audio clips from voice chats—unless you choose to share your audio “to improve voice chats for everyone,” the Voice Chat FAQ on OpenAI’s website notes.

“If you share your audio with us, then we may use audio from your voice chats to train our models,” Open AI says in its Voice Chats FAQ. Meanwhile, transcribed chats may be used to train models depending on your choices and plan.

Can GPT-4o Be Trusted With Your Private Data?

This year’s Intelligence Authorization Act would mandate penetration testing for federally certified voting machines and allow independent researchers to work on exposing vulnerabilities.

Congress is moving closer to putting US election technology under a stricter cybersecurity microscope.

Embedded inside this year’s Intelligence Authorization Act, which funds intelligence agencies like the CIA, is the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, which would require penetration testing of federally certified voting machines and ballot scanners, and create a pilot program exploring the feasibility of letting independent researchers probe all manner of election systems for flaws.

The SECURE IT Act—originally introduced by US senators Mark Warner, a Virginia Democrat, and Susan Collins, a Maine Republican—could significantly improve the security of key election technology in an era when foreign adversaries remain intent on undermining US democracy.

“This legislation will empower our researchers to think the way our adversaries do, and expose hidden vulnerabilities by attempting to penetrate our systems with the same tools and methods used by bad actors,” says Warner, who chairs the Senate Intelligence Committee.

The new push for these programs highlights the fact that even as election security concerns have shifted to more visceral dangers such as death threats against county clerks, polling-place violence, and AI-fueled disinformation, lawmakers remain worried about the possibility of hackers infiltrating voting systems, which are considered critical infrastructure but are lightly regulated compared to other vital industries.

Russia’s interference in the 2016 election shined a spotlight on threats to voting machines, and despite major improvements, even modern machines can be flawed. Experts have consistently pushed for tighter federal standards and more independent security audits. The new bill attempts to address those concerns in two ways.

The first provision would codify the US Election Assistance Commission’s recent addition of penetration testing to its certification process. (The EAC recently overhauled its certification standards, which cover voting machines and ballot scanners and which many states require their vendors to meet.)

While previous testing simply verified whether machines contained particular defensive measures—such as antivirus software and data encryption—penetration testing will simulate real-world attacks meant to find and exploit the machines’ weaknesses, potentially yielding new information about serious software flaws.

“People have been calling for mandatory \[penetration\] testing for years for election equipment,” says Edgardo Cortés, a former Virginia elections commissioner and an adviser to the election security team at New York University’s Brennan Center for Justice.

The bill’s second provision would require the EAC to experiment with a vulnerability disclosure program for election technology—including systems that are not subject to federal testing, such as voter registration databases and election results websites.

Vulnerability disclosure programs are essentially treasure hunts for civic-minded cyber experts. Vetted participants, operating under clear rules about which of the organizer’s computer systems are fair game, attempt to hack those systems by finding flaws in how they are designed or configured. They then report any flaws they discover to the organizer, sometimes for a reward.

By allowing a diverse group of experts to hunt for bugs in a wide range of election systems, the Warner–Collins bill could dramatically expand scrutiny of the machinery of US democracy.

The pilot program would be a high-profile test of the relationship between election vendors and researchers, who have spent decades clashing over how to examine and disclose flaws in voting systems. The bill attempts to assuage vendors’ concerns by requiring the EAC to vet prospective testers and by prohibiting testers from publicly disclosing any vulnerabilities they find for 180 days. (They would also have to immediately report vulnerabilities to the EAC and the Department of Homeland Security.)

Still, one provision could spark concern. The bill would require manufacturers to patch or otherwise mitigate serious reported vulnerabilities within 180 days of confirming them. The EAC—which must review all changes to certified voting software—would have 90 days to approve fixes; any fix not approved within that timetable would be “deemed to be certified,” though the commission could review it later.

A vendor might not be able to fix a problem, get that fix approved, and get all of its customers to deploy that fix before the nondisclosure period expires.

“Updates to equipment in the field can take many weeks, and modifying equipment close to an election date is a risky operation,” says Ben Adida, the executive director of the vendor VotingWorks.

Some vendors might also chafe at the bill’s legal protections for researchers. The legislation includes a “safe harbor” clause that exempts testing activities from the prohibitions of the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act, and bars vendors from suing researchers under those laws for accidental violations of the program’s terms.

There is also a funding question. The SECURE IT Act doesn’t authorize any new money for the EAC to run these programs.

“I hope Congress accounts for the necessary funding needed to support the increased responsibilities the EAC will take on,” says EAC chair Ben Hovland. “Investments in programs like this are critical to maintaining and strengthening the security of our elections.”

Meanwhile, the bill’s prospects are unclear. Even if it passes the Senate, there is no sign of similar momentum in the House.

A Senate Bill Would Radically Improve Voting Machine Security

Long-distance cables were severed across France in a move that disrupted internet connectivity.

Long-distance internet cables in France have been cut in an act of sabotage, causing disruption to internet services across the country. This is the second disruption during the Olympic Games in Paris, after high-speed train lines were targeted in a series of arson attacks hours before the Games kicked off.

Marina Ferrari, France’s junior minister for digital affairs, said on X that in the early hours of Monday morning, multiple locations around France were affected by several “damages” that impacted telecommunications providers and have resulted in “localized consequences” to fiber optic services as well mobile internet connectivity. Internet companies confirmed the damage.

The French Ministry of the Interior, which oversees policing agencies in the country, did not immediately respond to a request for comment. French cybersecurity agency ANSSI told WIRED the problems are not linked to a cybersecurity incident.

At the time of writing, nobody has claimed responsibility for either attack. Officials have yet to identify any suspects involved in the cable-cutting sabotage, but they believe the disruption to train services could have been committed by people with “ultra-left” political leanings.

The incidents around the Olympics come at a time when Russia has been blamed for a string of disinformation targeting France and has also been linked to a series of potential sabotage attacks in Europe.

The second largest French telecoms company, SFR, appeared to be one of the most impacted by the vandalism. “Our long-distance fiber network was sabotaged between 1 am and 3 am last night in five different locations,” a spokesperson from SFR told WIRED. SFR says its maintenance teams are working on repairing the damage and said the impact on its customers was “limited.”

“Also, between three and eight other operators are impacted since they use our long-distance network,” the spokesperson said.

Nicolas Guillaume, the CEO of telecom firm Nasca Group, which owns the ISP company Netalis, told WIRED he believed the damage was “deliberate” and that ISPs serving both customers and businesses have been impacted. Several of the damaged cables, according to images shared on X by the CEO, appear to have clean cuts across them. Guillaume says it is likely that people opened the ducts where cables are stored and cut them. Internet company Free 1337 also confirmed it was working on fixing the damage.

While billions of people around the world use wireless connections, the underlying internet backbone is made up of cables traversing across countries and under seas. This infrastructure, which is able to automatically reroute traffic to limit outages, can be fragile and vulnerable to attack or disruption. EU politicians have called for internet infrastructure security to be improved.

But the sabotage is not the first time that internet cables in France have been damaged in potentially deliberate acts. At the end of April 2022, crucial long-distance internet cables around Paris were deliberately cut and damaged—causing outages that impacted around 10 internet and infrastructure companies.

In that instance, according to photographs published by telecoms companies, the cables appeared to have been surgically cut, all at around the same time, in three locations, to the north, south, and east of Paris. Thousands of people around Paris—and also some farther away from the French capital—were plunged into a temporary internet blackout as network operators rerouted traffic. “It is the work of professionals,” Guillaume said at the time.

Arthur PB Laudrain, a postdoctoral research associate in cyber diplomacy at King’s College London, says the most recent incident seems “less serious” than the 2022 outages. “Such actions are within the capabilities of ultra-left or ecologist and anarchist groups, especially if they benefited from insider assistance or knowledge (current or former rail or network workers),” Laudrain says. “However, we cannot rule out the fact that a state actor is encouraging, supporting, or directing such domestic groups to create plausible deniability of their involvement.”

Saboteurs Cut Internet Cables in Latest Disruption During Paris Olympics

Infostealer malware is swiping millions of passwords, cookies, and search histories. It’s a gold mine for hackers—and a disaster for anyone who becomes a target.

For the past two months, cybercriminals have advertised for sale hundreds of millions of customer records from major companies like Ticketmaster, Santander Bank, and AT&T. And while massive data breaches have been a fact of life for more than a decade now, these recent examples are significant, because they are all connected. Each victim company was a customer of the cloud data storage firm Snowflake and was compromised not through a sophisticated hack, but because attackers had login credentials for each victim company’s Snowflake accounts—a data-stealing spree that impacted at least 165 Snowflake customers.

Attackers didn’t grab this trove of logins by directly breaching Snowflake or through a targeted supply chain attack. Instead, they found the credentials in a hodgepodge of stolen data grabbed haphazardly by “infostealer” malware.

After years of operation, infostealers are having a moment. The malware, which often finds its way onto people’s machines through downloads of pirated software, can steal usernames and passwords, cookies, search history, financial information, and more from web browsers. This data collected by infostealers is increasingly being used by all kinds of hackers to compromise companies—and cybersecurity experts warn of more high-profile data breaches to come.

“We’ve seen nation-states leverage infostealers, we’ve seen criminals leverage infostealers, and we’ve seen teenage hacking crews leverage infostealers,” says Charles Carmakal, chief technology officer of Google-owned cybersecurity firm Mandiant. Russia’s APT29 hackers and cybercriminal gangs such as Lapsus$ and Scattered Spider are among the many hackers using infostealers. Just days after the global CrowdStrike outage, hackers created a new infostealer in an attempt to capitalize on the chaos.

Infostealers are defined less by their technical capabilities and more by their role in the malicious hacker ecosystem. Of course, to minimally qualify, they must be designed to steal information. But what separates infostealers from spyware or other malware used in espionage or targeted data breaches is that infostealers are spread opportunistically and indiscriminately. They grab data from the browsers of whatever computers they end up infecting. Then the attackers who run them compile and organize this chaotic and largely random assemblage of data—often on a marketplace or in a public forum like a Telegram channel. It is only then that infostealer operators or their customers comb their haul for valuable credentials and access tokens amidst the massive amount of junk. Ian Gray, director of analysis and research at the security firm Flashpoint, says there are likely hundreds of variants of infostealers in circulation.

There are some account access tokens that would have obvious value for many types of cybercriminals. If a data dump included working login credentials for a corporate employee’s enterprise accounts, a ransomware gang, business email compromise scammer, or state-backed actor could use the access as a jumping off point to launch their attacks. But in addition to selling these prized details, infostealer operators maximize the value of the data they collect simply by making their stolen data available. Platforms like Genesis Market, which was taken down by law enforcement last year, and Russian Market, organize infostealer logs and even make them somewhat searchable so hackers who are looking to target more niche organizations or those who don’t have financial motivations can potentially find exactly what they need.

These platforms take cues in how they are designed and marketed from legitimate information and ecommerce services. Many markets and forums charge a subscription fee to access the platform and then have different pricing structures for data depending on how valuable it might be. Currently, Gray says, Russian Market has so much stolen data available from infostealers that it has been charging a low flat rate, typically no more than $10, for any subset of data users want to download.

“Organizations have become very good with their security, and people have also gotten more savvy, so they're not the best targets now,” for traditional tailored attacks, Gray says. “So attackers need something that’s less targeted and more based on what they can make use of. Infostealers are modular and often sold on a subscription basis, and that evolution probably aligns with the rise of modern subscription services like video streaming.”

Infostealers have been especially effective with the rise of remote work and hybrid work, as companies adapt to allowing employees to access work services from personal devices and personal accounts from work devices. This creates opportunities for infostealers to randomly compromise individuals on, say, their home computers but still end up with corporate access credentials because the person was logged into some of their work systems as well. It also makes it easier for infostealing malware to get around corporate protections, even on enterprise devices, if employees are able to have their personal email or social media accounts open.

“I started paying attention to this once it became an enterprise problem,” Mandiant’s Carmakal says. “And particularly around 2020, because I started seeing more intrusions of enterprises first starting from compromises of home computers—through phishing of people's Yahoo accounts, Gmail accounts, and Hotmail accounts that were totally unrelated to any enterprise targeting, but to me look very opportunistic.”

Victoria Kivilevich, director of threat research at security firm KELA, says that in some instances criminals can use cybercrime markets to search for the domain of potential targets and see if any credentials are available. Kivilevich says the sale of infostealer data can be considered as the “supply chain” for various types of cyberattacks, including ransomware operators looking for the details of potential victims, those involved in business email compromise, and even initial access brokers who can sell the details along again to other cybercriminals.

On various cybercrime marketplaces and Telegram, Kivilevich says, there have been more than 7,000 compromised credentials linked to Snowflake accounts being shared. In one instance, a criminal has been touting access to 41 companies from the education sector; another cybercriminal claims to be selling access to US companies with revenues between $50 million and $8 billion, according to Kivilevich’s analysis.

“I don’t think there was one company that came to us and had zero accounts compromised by infostealer malware,” Kivilevich says of the threat that infostealer logs provide to businesses, with KELA saying infostealer-related activity jumped in 2023. Irina Nesterovsky, KELA's chief research officer, says millions of credentials have been collected by infostealing malware in recent years. “This is a real threat,” Nesterovsky says.

Carmakal says there are multiple steps companies and individuals can take to protect themselves from the threat of infostealers and their aftereffects, including using antivirus or EDR products to detect malicious activity. Companies should be strict on enforcing multifactor authentication across their users, he says. “We try to encourage people to not synchronize passwords on their corporate devices with their personal devices,” Carmakal adds.

The use of infostealers has been working so well that it is all but inevitable that cybercriminals will look to replicate the success of compromise sprees like Snowflake and get creative about other enterprise software services that they can use as entry points for access to an array of different customer companies. Carmakal warns that he expects to see this result in more breaches in the coming months. “There’s no ambiguity about this,” he says. “Threat actors will start hunting for infostealer logs, and looking for other SaaS providers, similar to Snowflake, where they log in and steal data, and then extort those companies.”

How Infostealers Pillaged the World’s Passwords

Plus: More Pegasus spyware controversy, a major BIOS controversy, and more of the week’s top security news.

The fallout from CrowdStrike’s deleterious software update came into full view this week as system administrators and IT staffers scrambled to get digital systems back online and return operations to normal. Elsewhere, the Olympics began this week, and Paris is ready with a controversial new surveillance system that hints at a future of ubiquitous CCTV camera coverage. And researchers revealed new findings this week about the innovative malware Russia used in January to sabotage a heating utility in Lviv and cut heat to 600 Ukrainian buildings at the coldest point in the year.

The US Department of Defense has a $141 billion idea to modernize US intercontinental ballistic missiles and their silos around the country. Meanwhile, the European Commission is allocating €7.3 billion for defense research—from drones and tanks to battleships and space intelligence—over the next seven years. And hackers have established a “ghost” network to quietly spread malware on the Microsoft-owned developer platform GitHub.

In more encouraging news, a former Google engineer has built a prototype search engine, dubbed webXray, meant to allow users to find specific privacy violations online, determine which sites are tracking you, and see where all that data goes.

And there’s more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

**Israel Reportedly Worked to Keep Info on Pegasus Spyware Out of US Courts**

Leaked files obtained by The Guardian reveal that the Israeli government took extraordinary measures to prevent information about the Pegasus spyware system from falling into the hands of US courts, including seizing files directly from the company to prevent legal disclosure. The spyware is the product of the Israel-based NSO Group. It allows users to infect smartphones, extract messages and photos, record calls, and secretly activate microphones. NSO Group faces legal action in the US brought by WhatsApp, which claims the company engineered Pegasus to target users of its messaging software. According to WhatsApp, more than 1,400 of its users were targeted. NSO, whose software has been allegedly tied to the harassment and murder of journalist Jamal Khashoggi, has denied any wrongdoing.

**Massive Screwup Leaves BIOS on 200+ Computer Models Vulnerable**

In an effort to thwart BIOS-based threats, prompted in part by the rollout of a powerful rootkit designed by a Chinese researcher in 2007, Secure Boot became a widely adopted tool. Unfortunately, researchers at the security firm Binarly have revealed that Secure Boot is now “completely compromised” on more than 200 device models, affecting major hardware manufacturers like Dell, Acer, and Intel. The incident was the result of a weak cryptographic key used to establish trust between hardware and firmware systems. AMI, the key's owner, says it was meant to be used for testing and should never have made its way into production.

**Musk’s AI system, Grok, Is Now Feeding on All Your Tweets**

Following in Meta's footsteps, Elon Musk's X quietly adjusted its settings this week to give the company's AI system—known as Grok—access to all of its users' posts. There is a way to prevent Grok from ingesting your posts; however, you cannot perform this action from the mobile app. You'll need to access X's **Settings** using a desktop computer; select **Privacy and Safety**, then select **Grok**, and then uncheck the box. Or just head straight here to go directly to the right settings page. (You can also delete your conversation history with Grok, if you have one, by clicking **Delete conversation history**.)

Stop X’s Grok AI From Training on Your Tweets

KnowBe4 detailed the incident in a recent blog post as a warning for other potential targets.

KnowBe4, a US-based security vendor, revealed that it unwittingly hired a North Korean hacker who attempted to load malware into the company's network. KnowBe4 CEO and founder Stu Sjouwerman described the incident in a blog post this week, calling it a cautionary tale that was fortunately detected before causing any major problems.

"First of all: No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems," Sjouwerman wrote. “This is not a data breach notification, there was none. See it as an organizational learning moment I am sharing with you. If it can happen to us, it can happen to almost anyone. Don't let it happen to you.”

KnowBe4 said it was looking for a software engineer for its internal IT AI team. The firm hired a person who, it turns out, was from North Korea and was "using a valid but stolen US-based identity" and a photo that was "enhanced" by artificial intelligence. There is now an active FBI investigation amid suspicion that the worker is what KnowBe4's blog post called "an Insider Threat/Nation State Actor."

KnowBe4 operates in 11 countries and is headquartered in Florida. It provides security awareness training, including phishing security tests, to corporate customers. If you occasionally receive a fake phishing email from your employer, you might be working for a company that uses the KnowBe4 service to test its employees' ability to spot scams.

**Person Passed Background Check and Video Interviews**

KnowBe4 hired the North Korean hacker through its usual process. "We posted the job, received résumés, conducted interviews, performed background checks, verified references, and hired the person. We sent them their Mac workstation, and the moment it was received, it immediately started to load malware," the company said.

Even though the photo provided to HR was fake, the person who was interviewed for the job apparently looked enough like it to pass. KnowBe4's HR team "conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application," the post said. "Additionally, a background check and all other standard pre-hiring checks were performed and came back clear due to the stolen identity being used. This was a real person using a valid but stolen US-based identity. The picture was AI 'enhanced.'"

The two images at the top of this story are a stock photo and what KnowBe4 says is the AI fake based on the stock photo. The stock photo is on the left, and the AI fake is on the right.

The employee, referred to as "XXXX" in the blog post, was hired as a principal software engineer. The new hire's suspicious activities were flagged by security software, leading KnowBe4's Security Operations Center (SOC) to investigate:

> On July 15, 2024, a series of suspicious activities were detected on the user beginning at 9:55 pm EST. When these alerts came in KnowBe4's SOC team reached out to the user to inquire about the anomalous activity and possible cause. XXXX responded to SOC that he was following steps on his router guide to troubleshoot a speed issue and that it may have caused a compromise.
> 
> The attacker performed various actions to manipulate session history files, transfer potentially harmful files, and execute unauthorized software. He used a Raspberry Pi to download the malware. SOC attempted to get more details from XXXX including getting him on a call. XXXX stated he was unavailable for a call and later became unresponsive. At around 10:20 pm EST SOC contained XXXX's device.

**“Fake IT Worker From North Korea”**

The SOC analysis indicated that the loading of malware "may have been intentional by the user," and the group "suspected he may be an Insider Threat/Nation State Actor," the blog post said.

"We shared the collected data with our friends at Mandiant, a leading global cybersecurity expert, and the FBI, to corroborate our initial findings. It turns out this was a fake IT worker from North Korea," Sjouwerman wrote.

KnowBe4 said it can't provide much detail because of the active FBI investigation. But the person hired for the job may have logged into the company computer remotely from North Korea, Sjouwerman explained:

> How this works is that the fake worker asks to get their workstation sent to an address that is basically an "IT mule laptop farm." They then VPN in from where they really physically are (North Korea or over the border in China) and work the night shift so that they seem to be working in US daytime. The scam is that they are actually doing the work, getting paid well, and give a large amount to North Korea to fund their illegal programs. I don't have to tell you about the severe risk of this. It's good we have new employees in a highly restricted area when they start, and have no access to production systems. Our controls caught it, but that was sure a learning moment that I am happy to share with everyone.

_This story originally appeared on_ _Ars Technica._

A North Korean Hacker Tricked a US Security Vendor Into Hiring Him—and Immediately Tried to Hack Them

The European Commission is allocating €7.3 billion for defense research over the next seven years. From drones and tanks of the future to battleships and space intelligence, here's what it funds.

From €142 million to €1 billion ($1.1 billion) a year. The European Commission is pressing the accelerator on investment in weapons and defense technologies. From a total €590 million invested between 2017 and 2020, Brussels has moved to a €7.3 billion ($7.9 billion) package for the 2021 to 2027 period. This year alone, the European Defense Fund (EDF) has put €1.1 billion on the plate, divided into 34 calls for as many military-related research topics. From developing new drone models to sensors to increase radar capabilities. From systems to counter hypersonic missile attacks to enhancements in the analysis of images collected by satellites. From “smart weapons” to advanced communication technologies. The bidding process opened in late June, and there is time until November 5 to share a slice of the pie—and then a year to deliver the project.

The project for a common defense has distant origins and was formalized in 2015, but it was Russia's invasion of Ukraine that accelerated the European Commission's march to spend on arms, ammunition, and military technology. One only has to scroll through the list of projects vying for 2024 funding to get an idea of what Brussels is looking for. On the plate is €100 million to develop a new long-range, medium-altitude drone equipped with advanced intelligence, surveillance, target acquisition, and recognition systems (or Istar) and piloted remotely. On a similar project, the European Union has already invested, allocating €98 million of the total €290 million needed to develop a similar aircraft, dubbed Eurodrone, to a consortium consisting of France's Airbus and Dassault Aviation plus Italy's Leonardo. Another €11 million from the EDF goes to the prototype of a small, autonomously guided aerial drone.

**Telecommunications and AI**

Much of the resources go to strengthening communication and data exchange channels—in order to prevent, for example, someone from taking over the controls of the remotely piloted drone. The EDF allocates €25 million to a 5G network intended for the military sphere, the same amount to prototypes for satellite communications, and €24 million to develop dedicated systems for undersea drones. Information needed to feed algorithms and automatic analysis tools will have to be transferred through these secure channels. One grant awards €45 million for an AI software prototype that would make automated means and operations centers operated by live personnel talk to each other.

According to an article by Anthony King, professor at the University of Exeter, published in the Journal of Global Security Studies, so far in the military, “AI has not been used primarily to produce robotic or autonomous weapon systems. Over the past two decades, the military has sought to leverage big data to generate a richer and deeper understanding of the battlefield by tracking the footprints left in cyberspace by their adversaries. Because there is such a vast amount of digital data in cyberspace, the armed forces have begun to leverage the potential of AI, algorithms, and machine learning to identify patterns and signatures, thereby improving their awareness and so that crucial pieces of information are not missed.”

It's a pattern also pursued by European investments. Already last year, the EDF supported with €4 million a communication model to command swarms of autonomous vehicles, and as much went to strengthening undersea cables, the backbone of the internet and a military target. To make sure the data collected from space “speaks,” and provides a real-time and accurate representation of potential risks, there is a €157 million project, run by Leonardo, Airbus, and ArianeGroup (an aerospace company), to integrate information on a single platform, following in the footsteps of two previous projects. But if we add up all the intelligence programs through sensors, satellites, and other digital sources, the 2023 plan alone has deployed another €70 million on the subject. With another €6 million, the EU also tries to guard against communications blackouts, supporting an Estonian-driven plan for drone navigation technology that works even without satellite signals, relying on real-time analysis of what the machine sees.

**New Weapons**

The European Defense Fund, however, is also hunting for prototypes of new weapons. There is €25 million for the next generation of armored vehicles, €30 million for the creation of smart and increasingly accurate weapons, and €20 million earmarked for identifying at least four potential solutions for navigating a drone in “non-permissive” environments, which, translated from diplomatic jargon, means areas of war or those characterized by great instability.

Another €50 million concerns the creation of a new ground drone, equipped with “lethal functions.” What kind? This is best explained in an annex to the Commission's green light for EDF 2024. It says the program is to study a “fully autonomous process of targeting against different targets and solutions for mobility and engagement,” but also to produce an analysis of the “ethical and legal aspects of integrating autonomous combat drones into European armed forces.” With a clarification: “If necessary, research should be included to support recommendations and decisions” on these aspects. As in: Give us material to plead the case.

In the case of smart weapons, on the other hand, the EU calls for greater accuracy of missiles and rockets, but also refers to “loitering munitions,” i.e., suicide drones, which circle a defined area until they locate the target and hit it, bringing it down—a controversial military technology. The EU is also interested in copying the Iron Dome model, Israel's missile shield.

**Tanks and Corvettes of the Future**

Shortly before opening the new calls for proposals, the Commission also announced the 54 winning projects for the 2023 program. These include Marte, or the Main ARmored Tank of Europe, a program to develop new technologies to be integrated on a tank. Sharing the €20 million in funding is a string of some 40 companies, including the two defense champions from Italy and Germany, Leonardo and Rheinmetall, respectively. Just as much has been received by a similar project, again to upgrade the tank's architecture, which France's Thales is leading instead. From Brussels, €154 million will help fund the approximately €288 million needed to develop the new EU patrol corvette (Epc2), with Italy's Fincantieri among the project leaders. Another €25 million is earmarked for the construction of a prototype self-driving boat, 12 meters long, that rides on hydrofoils (i.e., with the hull out of the water).

Leonardo is spearheading a project to develop counter-aircraft systems for military drones, exploiting sensors, disturbances in telecommunications networks, and other technologies. France's Cilas, on the other hand, is spearheading a program to develop Europe's first laser weapon, backed by €25 million. A prototype electro-magnetic-propelled missile launcher has grossed €4 million, €26 million for an artificial intelligence agent called to autonomously manage protection and counterattack in response to cyber aggression, €80 million for a study on defense from hypersonic weapons. Another €27 million will support the creation of a new missile system with a range of 150 kilometers, €40 million is going to a military cargo ship, and €44 million is allocated for offensive technologies on undersea drones.

**Funds and Alliances**

But the channels for fueling Europe's military industry are varied. Alongside the EDF is Eudis, a scheme worth €2 billion for the seven-year period that supports the acceleration of startups and small and medium-size enterprises (target: 400 per year). There's also the European Investment Fund (EIF), managed by the European Investment Bank (EIB), which helps fund the defense sphere, particularly when it comes to dual (civilian and military) technologies. Its aim is to act as a key investor, consequently attracting other players willing to share the risk, but until 2027 it has €175 million to spend. The European Security Industry Bank can mobilize another €8 billion, also over the next three years.

Seven deals have already been signed. These include €10 million to Germany's Quantum Systems for vertical-takeoff drones, €30 million to Spain's Skydweller for its solar-powered self-driving aircraft, and €600 million on two space communications programs. Italy's Leonardo also benefited from EIB loans, which provided €260 million for research and development activities in various technological fields.

Source

Wired