Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.

Affected Resources

Aqua Drive, version 2.4.

Description

INCIBE has coordinated the publication of a vulnerability affecting Aqua Drive,  which has been discovered by Ander Martínez (Titanium Industrial Security).

The following code has been assigned to this vulnerability:

**CVE-2023-3701**:

*   CVSS v3.1 base score: 9.9.
*   CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
*   Vulnerability type: CWE-23: Relative Path Traversal.

Solution

Update to version 2.5.

Detail

**CVE-2023-3701:** Aqua Drive is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.

CVE-2023-3701: Relative Path Traversal Aqua Esolutions | INCIBE-CERT

Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP-CopyProtect \[Protect your blog posts\] Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-37995: WordPress WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Optimize Database after Deleting Revisions Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-25980: WordPress Optimize Database after Deleting Revisions plugin <= 5.1 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions.

**Solution**

 Fixed

Update the WordPress Saphali Woocommerce Lite plugin to the latest available version (at least 1.9.0).

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Saphali Woocommerce Lite Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.9.0.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-25788: WordPress Saphali Woocommerce Lite plugin <= 1.8.13 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Update Theme and Plugins from Zip File Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-25489: WordPress Update Theme and Plugins from Zip File plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Location-enabled tech designed to make our lives easier is often exploited by domestic abusers. Refuge, a UK nonprofit, helps women to leave abusive relationships, secure their devices, and stay safe.

Pick up any piece of tech and Emma Pickering knows how it can be used to abuse, harass, and stalk women. Amazon’s Ring home doorbell cameras can monitor when someone leaves the house and who is visiting them. Until recently, Netflix showed the IP addresses where users were logged in, allowing their location to be tracked. Workout apps and websites such as Strava show where and when people are exercising. And abusers often slip small GPS trackers or audio recorders into women’s belongings or attach them to their cars.

“Perpetrators buy them in bulk, and they’ll buy probably 60 very cheaply; they’re very small and discrete,” says Pickering, who works at Refuge, the UK’s largest domestic abuse organization, where she heads a team that helps women secure their devices. Pickering says that in one case “over 200” recording devices were found in a woman’s home.

Refuge launched its Technology-Facilitated Abuse and Economic Empowerment Team in 2017, amid a surge of abusers weaponizing apps, devices, and online services to harm women. The charity helps women and their children leave abusive relationships, providing emergency accommodation, legal help, financial aid, and more. Almost every case now involves technology in some form, Pickering says, and the issue is so serious that every person the organization places into a refuge goes through a tech assessment to secure their accounts. The tech abuse team, which is made up of 11 people, is the only one of its kind in the UK and just one of a handful of similar organizations around the world.

Technology-facilitated abuse can range from harassment via phone call or text message to logging into someone’s social media and email accounts without their permission, which allows abusers to read, delete or send messages. In more extreme cases, they might install “stalkerware” on victims’ phones to monitor every tap and scroll. Nonconsensual image-sharing, commonly known as “revenge porn,” and economic abuse, where money and banking apps may be controlled by an abuser, are also frequent. In August, a report from MPs in the UK concluded that tech abuse is becoming “increasingly common.”

Pickering says her team primarily focuses on helping people in the more severe cases. “Firstly, we need to establish if it’s safe to speak to them on their device,” she says. If it isn’t, Refuge will send women a burner phone and then set them up with a new email address, using the encrypted email service Proton Mail, before sending them extra information. It’s the start of a meticulous process—known as an “attack assessment” by the team—to secure accounts and devices.

“We go through everything,” Pickering says. Refuge will ask the person they are helping to list every device and online account they and any children have. These can easily number into the hundreds. “Within the home, if they’ve fled the relationship, we also need to check anything they’ve left behind to unsync from any devices or accounts that they could still be using back home.” This will include products like Google Home Hubs, and Amazon’s Ring doorbells and Alexa, and it requires checking who set up the devices and is the administrator of the accounts, as well as which names phone contracts are in. From there, a safety plan is created, Pickering says. This can include going through the accounts and checking settings for who has access to them, removing devices connected to accounts, using secure passwords, and setting up measures such as two-factor authentication. On average, Pickering says, it can take three weeks to get through the entire process, although more complex cases take much longer.

“I don’t think people realize how serious it is, the consequences for perpetrators to have access to this information, to see that there’s evidence in someone’s phone that they’re planning to leave a relationship, read emails about financial settlements, child contact orders—it puts someone at really significant risk,” Pickering says. Even for those in nonabusive relationships, the charity has created a digital breakup tool with cybersecurity firm Avast to detail the process of separating everything from delivery apps to gaming accounts from former partners.

While the technology itself isn’t usually the problem—it’s how abusers use it to harass their victims that creates the issues—Pickering says tech companies don’t put enough thought into how their services can be used maliciously. They also don’t put enough effort into preventing such abuses. They’re not “considering having features built in that can mitigate these risks,” she says.

For instance, Apple launched its small AirTag GPS tracker without many safety features, and dozens of people have subsequently reported being tracked by the devices. (The company has made some improvements and is now working with other tracker manufacturers to make it easier to identify trackers someone has placed on your belongings). One of the biggest issues currently, Pickering says, is satellite navigation systems within cars. “My car, for instance, if I drive it somewhere, it’s connected to an app, and I don’t know how many people are on my app, it doesn’t give me notifications,” she says. There are also boundary settings that can alert a vehicle’s owner if it travels beyond a specific set of locations.

Aside from designing products better, tech companies need to make it easier for people to understand the settings on their phone and digital accounts. “Many people come to us and their confidence around tech is very limited,” Pickering says. “We have to do a lot of work with them initially to make them feel comfortable.”

While tech abuse is rising, Pickering aims to increase understanding around the problem and tackle some of the issues at its roots. “We’ve got a really big ambition to train the police,” she says, adding that officers often don’t know what to look for in cases of tech abuse and may not take issues seriously. The Refuge team has already worked with one tech company, which she says she cannot name due to an NDA, to advise on safety. “Amazon and Google could work with us,” Pickering says. “And we could help make sure that their products are developed with safety in mind.”

_This article first appeared in the November/December 2023 issue of WIRED UK._

The Team Helping Women Fight Digital Domestic Abuse

Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through a SQL Server instance.
"The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report.
"This allowed the

Cloud Security / Cyber Threat

Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through a SQL Server instance.

"The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen said in a Tuesday report.

"This allowed the attacker to gain access and elevated permissions on a Microsoft SQL Server instance deployed in Azure Virtual Machine (VM)."

In the next stage, the threat actors leveraged the new permissions to attempt to move laterally to additional cloud resources by abusing the server's cloud identity, which may possess elevated permissions to likely carry out various malicious actions in the cloud that the identity has access to.

Microsoft said it did not find any evidence to suggest that the attackers successfully moved laterally to the cloud resources using the technique.

"Cloud services like Azure use managed identities for allocating identities to the various cloud resources," the researchers said. "Those identities are used for authentication with other cloud resources and services."

The starting point of the attack chain is an SQL injection against the database server that allows the adversary to run queries to gather information about the host, databases, and network configuration.

In the observed intrusions, it's suspected that the application targeted with the SQL injection vulnerability had elevated permissions, which permitted the attackers to enable the xp\_cmdshell option to launch operating system commands to proceed to the next phase.

This included conducting reconnaissance, downloading executables and PowerShell scripts, and setting up persistence via a scheduled task to start a backdoor script.

Data exfiltration is achieved by taking advantage of a publicly accessible tool called webhook\[.\]site in an effort to stay under the radar, since outgoing traffic to the service is deemed legitimate and unlikely to be flagged.

"The attackers tried utilizing the cloud identity of the SQL Server instance by accessing the \[instance metadata service\] and obtaining the cloud identity access key," the researchers said. "The request to IMDS identity's endpoint returns the security credentials (identity token) for the cloud identity."

The ultimate goal of the operation appears to have been to abuse the token to perform various operations on cloud resources, including lateral movement across the cloud environment, although it ended in failure due to an unspecified error.

The development underscores the growing sophistication of cloud-based attack techniques, with bad actors constantly on the lookout for over-privileged processes, accounts, managed identities, and database connections to conduct further malicious activities.

"This is a technique we are familiar with in other cloud services such as VMs and Kubernetes cluster but haven't seen before in SQL Server instances," the researchers concluded.

"Not properly securing cloud identities can expose SQL Server instances and cloud resources to similar risks. This method provides an opportunity for the attackers to achieve greater impact not only on the SQL Server instances but also on the associated cloud resources."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

New research has found that some streaming devices and dozens of Android and iOS apps are secretly being used for fraud and other cybercrime.

When you buy a TV streaming box, there are certain things you wouldn’t expect it to do. It shouldn’t secretly be laced with malware or start communicating with servers in China when it’s powered up. It definitely should not be acting as a node in an organized crime scheme making millions of dollars through fraud. However, that’s been the reality for thousands of unknowing people who own cheap Android TV devices.

In January, security researcher Daniel Milisic discovered that a cheap Android TV streaming box called the T95 was infected with malware right out of the box, with multiple other researchers confirming the findings. But it was just the tip of the iceberg. Today, cybersecurity firm Human Security is revealing new details about the scope of the infected devices and the hidden, interconnected web of fraud schemes linked to the streaming boxes.

Human Security researchers found seven Android TV boxes and one tablet with the backdoors installed, and they’ve seen signs of 200 different models of Android devices that may be impacted, according to a report shared exclusively with WIRED. The devices are in homes, businesses, and schools across the US. Meanwhile, Human Security says it has also taken down advertising fraud linked to the scheme, which likely helped pay for the operation.

“They’re like a Swiss Army knife of doing bad things on the internet,” says Gavin Reid, the CISO at Human Security who leads the company’s Satori Threat Intelligence and Research team. “This is a truly distributed way of doing fraud.” Reid says the company has shared details of facilities where the devices may have been manufactured with law enforcement agencies.

Human Security’s research is divided into two areas: Badbox, which involves the compromised Android devices and the ways they are involved in fraud and cybercrime. And the second, dubbed Peachpit, is a related ad fraud operation involving at least 39 Android and iOS apps. Google says it has removed the apps following Human Security’s research, while Apple says it has found issues in several of the apps reported to it.

First, Badbox. Cheap Android streaming boxes, usually costing less than $50, are sold online and in brick-and-mortar shops. These set-top boxes often are unbranded or sold under different names, partly obscuring their source. In the second half of 2022, Human Security says in its report, its researchers spotted an Android app that appeared to be linked to inauthentic traffic and connected to the domain flyermobi.com. When Milisic posted his initial findings about the T95 Android box in January, the research also pointed to the flyermobi domain. The team at Human purchased the box and multiple others, and started diving in.

In total the researchers confirmed eight devices with backdoors installed—seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W. (Some of these have also been identified by other security researchers looking into the issue in recent months). The company’s report, which has data scientist Marion Habiby as its lead author, says Human Security spotted at least 74,000 Android devices showing signs of a Badbox infection around the world—including some in schools across the US.

The TV devices are built in China. Somewhere before they reach the hands of resellers—researchers don’t exactly know where—a firmware backdoor is added to them. This backdoor, which is based on the Triada malware first spotted by security firm Kaspersky in 2016, modifies one element of the Android operating system, allowing itself to access apps installed on the devices. Then it phones home. “Unbeknownst to the user, when you plug this thing in, it goes to a command and control (C2) in China and downloads an instruction set and starts doing a bunch of bad stuff,” Reid says.

Human Security tracked multiple types of fraud linked to the compromised devices. This includes advertising fraud; residential proxy services, where the group behind the scheme sell access to your home network; the creation of fake Gmail and WhatsApp accounts using the connections; and remote code installation. Those behind the scheme were selling access to residential networks commercially, the company’s report says, claiming to have access to more than 10 million home IP addresses and 7 million mobile IP addresses.

The findings tally with those of other researchers and ongoing investigations. Fyodor Yarochkin, a senior threat researcher at security firm Trend Micro, says the company has seen two Chinese threat groups that have used backdoored Android devices—one it has researched deeply, the other is the one Human Security looked at. “The infection of devices is quite similar,” Yarochkin says.

Trend Micro has found a “front end company” for the group it investigated in China, Yarochkin says. “They were claiming that they have over 20 million devices infected worldwide, with up to 2 million devices being online at any point of time,” he says. Based on Trend Micro’s network data, Yarochkin believes these figures to be credible. “There was a tablet in one of the museums somewhere in Europe,” Yarochkin says, adding he believes it is possible that swaths of Android systems may have been impacted, including in cars. “It’s easy for them to infiltrate the supply chain,” he says. “And for manufacturers, it's really difficult to detect.”

Then there’s what Human Security calls Peachpit. This is an app-based fraud element, which has been present on both the TV boxes as well as Android phones and iPhones, Reid says. The company identified 39 Android, iOS, and TV box apps that were involved. “These are template-based applications—not very high quality,” says Joao Santos, a security researcher at the company. Apps about developing six-pack abs and logging the amount of water a person drinks were included.

The apps performed a range of fraudulent behavior, including hidden advertisements, spoofed web traffic, and malvertising. The research says that while those behind Peachpit appear different from those behind Badbox, it is likely they are working together in some way. “They have this SDK that did the ad fraud part, and we found a version of this SDK that matches the name of the module that was being dropped on the Badbox,” Santos says, referring to a software development kit. “That was another level of connection that we found.”

Human Security’s research says the ads involved were making 4 billion ad requests per day, with 121,000 Android devices impacted and 159,000 iOS devices impacted. There had been 15 million downloads in total for the Android apps, the researchers calculate. (The Badbox backdoor was found only on Android, not on any iOS devices.) Reid says that based on the data the company has, which isn’t a complete picture due to the complexity of the ad industry, those behind the scheme could have easily earned $2 million in one month alone.

Google spokesperson Ed Fernandez confirms the 20 Android apps reported by Human Security have been removed from the Play Store. “The off-brand devices discovered to be Badbox-infected were not Play Protect–certified Android devices,” Fernandez says, referring to Google’s security testing system for Android devices. “If a device isn't Play Protect certified, Google doesn’t have a record of security and compatibility test results.” The company has a list of certified Android TV partners. Apple spokesperson Archelle Thelemaque says that it found five of the apps Human reported breaching its guidelines, and the developers were given 14 days to make them follow the rules. Four of them have done so, as of publication.

Toward the end of 2022 and in the first part of this year, Reid says, Human Security took action against the advertising fraud elements of Badbox and Peachpit. According to data shared by the company, the amount of fraudulent ad requests from the schemes taking place now has completely dropped off. But the attackers adapted to the disruption in real time. Santos says when the countermeasures were first deployed, those behind the schemes started by sending out an update to obfuscate what they were doing. Then, he says, those behind Badbox took down the C2 servers powering the firmware backdoor.

While the attackers have been slowed, the boxes are still in people’s homes and on their networks. And unless someone has technical skills, the malware is very hard to remove. “You can think of these Badboxes as kind of like sleeper cells. They're just sitting there waiting for instruction sets,” Reid says. Ultimately, for people buying TV streaming boxes, the advice is to buy branded devices, where the manufacturer is clear and trusted. As Reid says, “Friends don't let friends plug in weird IoT devices into their home networks.”

Your Cheap Android TV Streaming Box May Have a Dangerous Backdoor

Elon Musk’s brain-chip startup conducted years of tests at UC Davis, a public university. A WIRED investigation reveals how Neuralink and the university keep the grisly images of test subjects hidden.

The tan macaque with the hairless pink face could do little more than sit and shiver as her brain began to swell. The California National Primate Center staff observing her via livestream knew the signs. Whatever had been done had left her with a “severe neurological defect,” and it was time to put the monkey to sleep. But the client protested; the Neuralink scientist whose experiment left the 7-year-old monkey’s brain mutilated wanted to wait another day. And so they did.

As the attending staff sat back and observed, the monkey seized and vomited. Her pupils reacted less and less to the light. Her right leg went limp, and she could no longer support the weight of her 15-pound body without gripping the bars of her cage. One attendant moved a heat lamp beside her to try to stop her shaking. Sometimes she would wake and scratch at her throat, retching and gasping for air, before collapsing again, exhausted.

An autopsy would later reveal that the mounting pressure inside her skull had deformed and ruptured her brain. A toxic adhesive around the Neuralink implant bolted to her skull had leaked internally. The resulting inflammation had caused painful pressure on a part of the brain producing cerebrospinal fluid, the slick, translucent substance in which the brain sits normally buoyant. The hind quarter of her brain visibly poked out of the base of her skull.

Elon Musk says no primates died as a result of Neuralink’s implants. A WIRED investigation now reveals the grisly specifics of their deaths as US authorities have been asked to investigate Musk’s claims.

On September 13, 2018, she was euthanized, records obtained by WIRED show. This episode, regulators later acknowledged, was a violation of the US Animal Welfare Act; a federal law meant to set minimally acceptable standards for the handling, housing, and feeding of research animals. There would be no consequences, however. Between 2016 and 2021, the United States Department of Agriculture (USDA) enforced the humane treatment of animals through what it called “teachable moments.” Because the center—home to a colony of nearly 5,000 primates run by the University of California–Davis—had proactively reported the violation, it could not be legally cited.

And neither could Neuralink. “If you want to split hairs,” a former employee tells WIRED, “the implant itself did not cause death. We sacrificed her to end her suffering.” The employee, who signed a confidentiality agreement, asked not to be identified.

****Got a Tip?****

Missing from the veterinary records released by the university are hundreds of photographs taken by the primate center’s staff between 2018 and 2020 of Neuralink’s test subjects. Though publicly funded, thus bound by California’s open records law, UC Davis has fought disclosure of the photographs for more than a year. Releasing them, it says, would not serve the public’s interest.

Meanwhile, videos of the experiments have seemingly vanished. Documents obtained by WIRED show that the primate center’s staff wrote about reviewing a “tape” of the aforesaid monkey hours before they stopped her heart. The school has not acknowledged that such a tape exists, and Neuralink, whose partnership with the school ended three years ago, was permitted to store its own footage and remove it from the property when it wished.

“They provided their own computing infrastructure, and they had their own network connection, and they have removed their computing infrastructure from the premises,” the school said in a September 2021 email to the Physicians Committee for Responsible Medicine, which is suing UC Davis for the release of images and videos of Neuralink’s experiments there. “The IT staff at the California National Primate Research Center were in no way involved with any aspects of the creation or storage of Neuralink’s video content,” the school added.

Records show that the school ordered Neuralink to request permission before recording any of the animals. And the school reserved the right to view the footage.

Internal emails reviewed by WIRED show that Neuralink, founded and owned by Elon Musk, had tight control over what UC Davis was allowed to divulge about the experiments. Interviews with sources familiar with the tests shed light on the tensions between the school and outside groups over the public’s right to know about research it’s subsidizing.

The sources say secrecy is given top priority, not merely because of the proprietary research being conducted at the center, but also out of fear that the public will respond poorly—perhaps violently—to images of the macaques being experimented on. Though the school’s protocols work effectively to prevent images of the experiments from getting out, it could not legally keep hidden all the written records of Neuralink’s procedures.

Macaques procured for Neuralink from UC Davis’ colony were trained months and even years before going under the knife, a former Neuralink employee recently told WIRED. But the prospect for survival was abysmal for some, they say, due in part to “poor planning and poor procedure.” Early on, the Neuralink researcher says, the company lacked personnel crucial to the operation. “We didn’t have any surgical techs. We didn’t even have a veterinary pathologist on staff at the time.”

After an animal was “sacrificed,” few if any records were created. The former employee claims Neuralink worked purposely to keep records of its work out of UC Davis’ hands—specifically to shield them from public records requests. The products under development at the center are proprietary and created for profit, the researcher says, not to “further the knowledge of mankind.”

Emails obtained by WIRED through a public records request show Davis’s staff scrambling in February 2018—the earliest days of the partnership—to get Neuralink’s equipment up and running. The university had agreed to provide the firm with a dedicated on-site network with a secure uplink to a remote facility. In one email, a faculty member noted that Neuralink had been warned against “live streaming” or producing any “recording of actual monkeys.” Asked if the same rules would apply after Neuralink’s equipment was set up, another Davis official said once installed “they can do whatever they want.”

Neuralink did not respond to WIRED’s request to comment. UC Davis spokesperson Andy Fell maintains that the university has complied with the California Public Records Act, having supplied the “vast majority of records” requested by the Physicians Committee. “Some requested items were not provided because they are exempt from disclosure under the law for various reasons set out in court filings,” he says. “All animal research at UC Davis, including contract research like that performed by Neuralink, is conducted under the same rules and regulations and overseen by the UC Davis Institutional Animal Care and Use Committee (IACUC),” Fell adds.

UC Davis’ Institutional Animal Care and Use Committee did not respond to a request for comment.

Davis has released hundreds of pages of emails, contractual documents, memos, and other veterinary records detailing the public university’s work for Neuralink between 2018 and 2020. The descriptions of botched surgeries and the suffering of the subjects was enough to provoke media investigations and coax comments of concern from a handful of lawmakers.

Hundreds of files remain under lock and key—including photographs of the neurological damage that resulted from Neuralink’s work with the macaques. The experiments involved drilling a hole roughly the size of a US dime into the monkey’s skulls, placing electrodes inside their brains, and screwing titanium plates to their skulls. UC Davis says the value of the photos of these operations now lies exclusively in “informing future research and clinical practices,” or what it calls “the refinement of surgical techniques.”

In October 2022, the Physicians Committee sued UC Davis—a public institution, funded in part by US taxpayers—in an attempt to gain access to records of Neuralink’s work. The Physicians Committee, which aims to promote alternatives to animal testing, has many detractors in the scientific community. The American Medical Association, which supports the use of animals in biomedical research, is one of the largest.

The Physicians Committee has argued in California state court that the public has the right to know about any suffering resulting from taxpayer-funded animal tests. “Disclosure of the footage is particularly important because Neuralink actively misleads the public about, and downplays the gruesome nature of, the experiments,” Corey Page, an attorney with Evans and Page who is representing the Physicians Committee in the lawsuit, tells WIRED.

The Physicians Committee’s suit against UC Davis, filed in California state court in Yolo County, is ongoing.

As it is a public records law that UC Davis is fighting, its arguments against greater transparency are centered around what’s best for the public. According to the school's attorneys, that means the public should not see images of Neuralink’s work.

One researcher familiar with the photos conceded they are particularly gruesome. “A macaque skull with the flesh torn out of it is not a pretty image,” they say. The school routinely deals with protesters, the source says. As a result, any visual evidence of experiments or animal subjects are tightly controlled. Filming the monkeys without the permission of the facility’s director is forbidden. Davis exercises the right to “pre-review” any media it allows to be captured.

A typical request for a recording at the colony, approved in August 2019, aimed to capture how a monkey’s breathing caused “vibration and movement” in a brain implant. Neuralink’s researchers emphasized in paperwork obtained by WIRED that the subject would “NOT be in focus” herself.

Court records show Davis’s attorneys have argued that the most likely outcome of releasing the photos is that its own pathologists will simply stop taking them. While losing a “useful note‐taking and memory‐jogging” tool, they say, refusing to take photos at the necropsy stage of the experiments may also run afoul of federal regulatory guidelines, enforced by the USDA and the campus’s own “animal use” committee. Compliance with this committee, incidentally, is a prerequisite of the center’s federal funding.

A document known as a Vaughn index relays the school’s specific rationale for withholding more than 370 photos, which may be subject to release under the 1968 California Public Records Act. The index lays out the theory that viewing the images would have such a visceral impact on the public that fears of reprisal among Davis’ researchers would be detrimental to their work ethic.

It centers on the belief that the public is too naive at large to distinguish between scientific inquiry and senseless butchery. In its own words, there is a high risk of “non‐contextual misinterpretation of the photos by persons who are not privy to the contextual facts.”

“The interest in protecting the safety of public employees and ensuring research that benefits the public can proceed without risk of violence clearly outweighs the public's interest in viewing said photographs,” the document says.

The risk of public officials being harassed is a factor addressed by most, if not all, open records laws in the United States, which are traditionally built on a presumption that favors disclosure. In most cases, being a mid- to low-level employee is enough to warrant redaction by default–a rule that is generally observed, as well, by professional news organizations. In veterinary records reviewed by WIRED, Davis has consistently censored the names of all of its staff, including those at director level. The university has even redacted identifying information about the animals, including their names and other identifiable information.

In part, Davis argues that the photos represent what’s called a “deliberative” work product. Public officials are often protected from disclosing information that reflects meditations on policies that have yet to become rule or law. The object is to encourage debate and consideration of all ideas—not just the ones assumed to be good from the start. This privilege, however, does not extend to documents related to policies actually enacted. And the school states clearly that the photos it’s choosing to withhold have been kept only to inform future policy.

History shows there are other consequences to the release of photographs specifically with regards to animal treatment. The creation of the US Animal Welfare Act can be tied to the public’s reaction to evidence of animal abuse published more than 60 years ago in _Life_ magazine. Without being able to see what _Life_ audaciously called “concentration camps for dogs,” it’s difficult to predict just how long it would have been before the United States finally adopted a law to protect animals that are bought, sold, and experimented upon.

Neuralink ended its partnership with UC Davis in September 2020, but the Physicians Committee claims that it continues to employ the same neurosurgeon and many of the staff responsible for the experiments that poisoned, maimed, and ultimately killed at least 12 macaque monkeys.

Last month, the company announced that it is preparing to start human trials after receiving a green light from the US Food and Drug Administration. Since ending its partnership with Davis, Neuralink has brought its testing in-house—far from the prying eyes of journalists, animal welfare groups, and the jurisdiction whose records laws first shed light on its practices.

How Neuralink Keeps Dead Monkey Photos Secret

A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.

**Commit f0dac5ff** authored Sep 15, 2023 by  **Art Cancro**

Browse files

**webcit: sanitize instant messages against XSS type stuff**

parent 08ba8022

*   Changes 2

Hide whitespace changes

Inline Side-by-side

Supports Markdown

0% or .

You are about to add **0 people** to the discussion. Proceed with caution.

Finish editing this message first!

Please register or sign in to comment

Tag

#auth