Anyone keeping track of world news in the early 2010s, and reports on tech in particular, has probably heard about Stuxnet. That malware spawned a large number of conspiracy theories — with the kicker that some of them were actually true. The malware targeted Iranian nuclear facilities and is believed to be the first digital worm to cause direct physical damage in meatspace. An unknown security researcher has now published a source code reverse-engineering of Stuxnet in all its glory.
The worm's ultimate target, allegedly a successful one, were industrial controllers from Siemens that were reportedly used in Iranian's Natanz nuclear enrichment plant. Once it reached the target, Stuxnet's payload manipulated the frequency converters in industrial centrifuges, in a bid to subtly damage the rotors — all while keeping the plant staff in the dark by reporting normal operation.
The repository contains build instructions so interested techies can try it out for themselves and learn all about its inner workings. You'll need a Windows XP or Windows 7 virtual machine, and for obvious reasons, you shouldn't configure any network connectivity for it. To witness the full effects of the payload rather than just the spreading mechanisms, you'll need the appropriate Siemens software, and ideally hardware — though we figure that industrial-scale centrifuges aren't exactly common in techies' cable drawers.
In its heyday, Stuxnet spread via three mechanisms. The primary infection vector was USB sticks with Windows shortcuts and autorun.inf files. Upon plugging one of those sticks in, just viewing the drive's contents would immediately trigger infection thanks to a zero-day vulnerability.
Infected systems then autonomously tried to spread the worm further via the network using a zero-day Windows Print Spooler vulnerability that would let an attacker write system files into any machine sharing a printer. It would also copy itself into accessible network shares. To evade Windows driver signature checks, Stuxnet used two digital certificates stolen from Realtek and JMicron.
The worm also had code to inject itself into Siemens software, by way of the WinCC SQL Server database, and embedding its code in Step 7 project files that automatically ran when engineers opened them. Since those files were almost guaranteed to be shared among more than one engineer, it made for an excellent internal infection vector that didn't depend on having network share control.
The final step was taking charge of the DLL that communicated with the actual centrifuges and injecting malicious code into the PLCs (Programmable Logic Controllers) of those machines to stealthily mess with the rotors.
Stuxnet was part of Operation Olympic Games, an alleged coordinated effort between the U.S. and Israel to try and curb Iran's purported progress in creating nuclear weapons at its Natanz facility. The initiative seemingly ran under both the Bush and Obama administrations, and was supposedly a way to dissuade Israel from launching its own preemptive strike against Iran. The software was allegedly developed by both the Pentagon and Israel's Unit 8200, and was reportedly successful in bringing down about 10% of Natanz' centrifuges by ultimately seriously damaging their rotors.
However, the worm had a nasty bug: it didn't have sufficient checks about which environment it was in, and failed to notice it was no longer in a local network environment. When engineers took their laptops home, it escaped out to the internet at large, at which point security researchers worldwide let out a collective "huh, that's odd" and proceeded to investigate. Mercifully, the worm contained a hard-coded self-destruct date set for June 24, 2012.
Talking to an AI chatbot can feel like confiding in a mirror, a private exchange equivalent to brainstorming in a Word document. Yet when it comes to the most popular AI chatbots, that mirror is really one-way glass — and you might be shocked to learn how many different people can watch from the other side.
Since the rise of easily accessible AI chatbots, untold millions of people have happily fed AI models their deepest, darkest secrets. According to a recent survey conducted by browser company DuckDuckGo and flagged by CNET, a full third of all AI users admit to having told their chatbots a secret they wouldn’t tell the “trusted people” in their lives.
There’s a grim irony there, because by telling an AI chatbot those closely guarded secrets, you may inadvertently be sharing intimate details with tech companies, police departments, lawyers, and even your boss. That’s according to new reporting by the Washington Post, which notes that there have been a dozen court cases where chatbot transcripts were cited in the public record over the last two years.
Even if your transcripts don’t end up in the hands of Johnny Law, they can easily be obtained by your boss, assuming you’re using a company-provided AI service. And of course, there’s no telling how long AI companies like OpenAI and Anthropic might hold onto details of your conversations, as WaPo notes numerous scenarios in which they may be required to hold onto your chatlogs by law.
There’s also the grim possibility of leaks from the AI companies themselves. In July, it was revealed that a whole trove of chats with Anthropic’s chatbot Claude had been exposed to the open web — and not for the first time.
“Unless you are having a chat with a service that has a temporary chat or, basically, an incognito version… [and] you’re also having it within a browser that’s not tracking you, the answer is no,” Jen King, a privacy researcher at the Stanford Institute for Human-Centered Artificial Intelligence told WaPo. “You can’t be sure that it’ll be totally private.”
And though users are remarkably comfortable divulging those details to their favorite bot, fewer are aware of those myriad ways their chat logs might live on in perpetuity. According to the DuckDuckGo poll, 53 percent of regular users said they didn’t know that AI chatbots are training on data obtained through their conversation, while 75 percent didn’t realize that conversations with large language models (LLMs) can easily be subpoenaed by police.
So when in doubt about whether to tell ChatGPT about your intimate relationship troubles, keep in mind that the internet is forever; and that goes double for AI chatbots.
The digital scans of more than 153 million drivers licenses of individuals from the United States and Canada are being sold on the dark web through an easily accessible service called Nexus.
As noted cybersecurity journalist Brian Krebs noted on his blog this week, the sale has now caught the attention of the FBI, which has launched an official inquiry.
On the same day Krebs published his post, the service mysteriously vanished from the dark web, which could make tracking down the people behind the hack more difficult.
Nonetheless, the scale of the leak is staggering, and includes not just drivers licenses, but 10 million ID cards, over three million travel documents, and over half a million medical cards as well, representing over 170 million individuals total. That’s pushing half of the United States’ and Canada’s combined populations.
The ID scans appear to have been taken from a widely-used ID verification company based out of Louisiana and even include the license of US defense secretary Pete Hegseth.
The incident highlights the dangers of having little regulatory oversight over identity verification services — a thorny subject, considering regulators continue to push for age limits for content online, rules that could put people at risk of having their identity stolen by bad agents.
The ID scans first appeared on a Russian cybercrime forum. The owner of the files caught Krebs’ attention after showing the journalist a scan of his Virginia drivers license, strongly supporting the leak’s validity.
Before it was taken down, the shadowy dark web service called Nexus allowed virtually anybody to peruse identity documents of over 170 million people in the US and Canada.
“We have been continuously exfiltrating new data for over a year into our private database,” the service boasted in a post on the Russian forum. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”
According to the people behind Nexus, the source of the leak is a “major identity verification company” that’s in business with several Fortune 500 companies, Krebs writes.
While the feds are starting their own investigation, Krebs dug a little deeper and found a fascinating common thread: many of those, whose identity cards showed up in the database had rented cars from the company Hertz.
“I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine,” Krebs wrote. “That’s notable because we both handed our licenses to the Hertz rental car representative at the same time.”
Other individuals the reporter talked to recalled giving their driver’s license to a dispensary, which struck a deal in 2022 with ID verification company idscan.net — which also provides services to other big brands, including Hertz.
The New Orleans-based firm told Krebs that it’s now investigating the matter. The FBI has also confirmed that it’s also officially looking into the company.
Patel lacked virtually any degree of relevant working experience for the job before the Senate confirmed him — and now, the agency is opening the doors for even more highly questionable hirings.
As inside sources told CBS News, the FBI has quietly lowered standards of its background checks for potential federal agents and other personnel. The bureau is now officially looking the other way when it comes to prostitution, for instance — as long as recruits didn’t hire sex workers over three times.
Even more eyebrow-raising is that the FBI is even allowing the consideration of candidates who engaged in bestiality or animal cruelty, according to CBS‘ sources. However, any such incidents would’ve had to have taken place before the candidate turned 18.
The broadcaster’s sources also said there was no distinction between candidates who were forced into sexual activity with animals or if they did so willingly. An FBI spokesperson claimed that eligibility requirements were limited to a “narrow set of circumstances, such as in cases where a person was sexually abused with animals as a child.”
Experts, however, were appalled at the news, arguing that the FBI is undermining its responsibility in vetting applicants by changing background check standards.
“Bestiality is clearly a potential indication of a more serious emotional issue, and even in a circumstance where it is not, the pool of candidates should be extensive enough that the criteria should certainly not be eliminated,” former FBI agent James Davidson told CBS.
Before the changes, which were reportedly implemented earlier this summer, the FBI’s webpage was clear about automatically disqualifying special agents who engaged in “prostitution or bestiality.”
Both current and former FBI employees told the CBS that the bureau could now be hiring “people with questionable backgrounds,” allowing them to undermine the integrity of the service. Others warned that the news was evidence of a major “recruiting problem.”
Considering the fact that the agency is being helmed by a personality as controversial as Patel, these changes shouldn’t come as too much of a shock.
While he hasn’t personally acknowledged the latest changes, Patel has frequently called for new hiring standards at the bureau, arguing that “we are losing too many qualified candidates to the rigors of the requirements from yesteryear” in a July interview with former FBI agent John Nantz.
Patel’s motivation for lowering standards could be to bring in his closest associates. As ProPublica reported in November, his personal assistant didn’t clear their polygraph test and required a waiver, claims the FBI has since denied.
Flock cameras have ignited a debate over surveillance, privacy, data collection, and public resistance. The MacVoices panel weighs in on the debate. They also discuss the risks of government-sponsored cyberattacks carried out by private companies, growing opposition to data centers over power and infrastructure demands, and the regulatory challenges surrounding their expansion.
A MacVoices’ panel member’s firsthand report from Black Hat explores the conference’s enterprise security focus before the discussion turns to AI models escaping sandbox restrictions to complete assigned tasks. The panel discusses the OpenAI-Hugging Face hack, unintended AI behavior and the dangers of moving too fast. Can developers establish effective limits without sacrificing innovation or competitive advantage? The race for better AI continues.
Cameras in airline seatback screens and increasingly sophisticated driver-monitoring systems spark a debate over safety, privacy, data access, and surveillance. The MacVoices Live! panel examines EU vehicle requirements, Tesla interior cameras, dash cams, accident evidence, connected devices, and whether consumers receive enough disclosure and control over technologies designed to watch them. Panel members include: Chuck […]
At Flip The Script in San Francisco at WWDC, Vladyslav Hamolia, AI Staff Engineer for MacPaw.discusses the company’s push to become AI-first by rethinking existing products, building internal tools, and supporting third-party vendors. He profiles Eney, the MacPaw AI assistant (available in Setapp) designed to perform tasks, optimize workflows, and improve daily routines. It addresses security while balancing local-first privacy goals with hybrid cloud models.
AI is taking on a growing role in cybersecurity (whether we like it or not), from vulnerability discovery to faster exploit development. Chuck Joiner, David Ginsburg, Eric Bolden, Web Bixby, Jim Rea, Brian Flanigan-Arthurs, Jeff Gamet, and Marty Jencius look at both sides oof the issue and push back on “Bugmageddon” hype. The discussion also covers X post limits, Microsoft Teams retiring the misguided Together Mode, safer login practices, AI-run radio chaos, Google’s Apple-like naming choices, and free storage tied to phone numbers.
Your fear of flying is only going to get worse once you hear what these white hat hackers figured out to do with a popular airliner.
As Wired reports, a team of security researchers from the University of California, San Diego and Oberlin College created a device the size of a coin that can take over the autopilot system of a Boeing 737 and change its flight plan, not to mention tampering with key values in its takeoff and fuel calculations.
According to its creators, the device could also change the data on a pilot’s screen so they don’t notice anything’s amiss — or even trick a pilot into making a disastrous decision.
“If you could get 60 seconds with an airplane, what could you do?” Stefan Savage, a UCSL professor who led the project, asked Wired. “Well, it turns out there’s a port that’s externally accessible. You can get to it with no special tools in about 15 seconds. And you can shove in a piece of electronics a little bigger than a quarter that lets you basically tell the autopilot what to do and lie to the pilot about changes to the flight plan.”
The attack relies on plugging the device, which costs less than $100, into a port hidden by a hatch on the exterior of the plane, which the researchers say is easily within reach of maintenance workers and airline staff. Once the device is plugged in, it could connect to the plane’s in-flight Wi-Fi system and allow a hacker to remotely control the aircraft’s systems from terra firma.
As Savage explained to Wired, his team found this vulnerability after spending years cobbling together 737 computer parts to effectively recreate the plane’s nervous system. Inspired by credit card skimming devices that plug into ATMs to steal your information, they realized that an entire aircraft could be broken into by physically plugging a device into its internal “bus” — the system that connects different components of its computer.
And after digging through Boeing wiring diagrams, they found their way in: a port carrying data between the plane’s Flight Manage Computer and the pilot’s display unit, accessible from an unlocked hatch on the plane’s exterior.
It was like finding “the goddamn exhaust port on the Death Star,” Savage told Wired.
The havoc a hacker wreaks using their attack could be catastrophic. They could feed the pilot the wrong information about the air temperature outside or about the weight of its cargo and passengers and cause them to miss the speed they need for takeoff before running out of runway, Wired noted. Or they could suddenly change its navigation and crash it into a mountain.
The attacks could also be far more sneaky.
“It could be something as subtle as, you’re in the Pacific, you see blue everywhere, and this diverts you 3 degrees off course, and now you’re in the middle of nowhere,” Aaron Schulman, another UCSD professor working on the project, told the magazine.
Savage and Schulman shared their findings with Boeing six years ago and have worked closely with the company to explore the vulnerability.
But the researchers say that Boeing hasn’t told them about any fix to the vulnerabilities they found. In fact, they say it’s likely that it any fix may not have been implemented yet, since commercial airplanes are rarely redesigned.
You shouldn’t panic though, they insist.
“All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so,” they wrote in their paper.
Beau Woods, a former adviser to the Cybersecurity and Infrastructure Security Agency and the Boeing’s Industry Cyber Technical Council, was alarmed by the findings.
“It is entirely possible to have someone who is on staff go up to an airplane when it’s on the ground, going through maintenance, and put this type of thing in there,” Woods told Wired.
“This is something the aviation industry will want to plan to defend against,” Savage agreed. “I would not sleep on this one.”
In light of plummeting public support for its widespread automatic license plate readers, surveillance company Flock has lost dozens of contracts with cities across the US.
Citizens are increasingly disgusted by the company’s presence on public streets, opting to hack down the cameras, blind them, or sabotage them in other creative ways.
“His project, which he calls noRecognition, allows people to escape the automatic detection and algorithmic surveillance used across the U.S. and beyond.” https://t.co/OIQNOt9B0a@TechCrunch
— Christina Ayiotis, Esq., CRM, CIPP/E, AIGP (@christinayiotis) August 10, 2026
And according to cybersecurity researcher Bill Swearingen, there may be other creative ways to befuddle Flock’s spy cams. He devised with a special computer-generated pattern which, once stretched out across the vehicle in the form of a wrap, will result it in not being flagged as a car by Flock’s cameras.
During this year’s Def Con cybersecurity conference in Las Vegas, Swearingen showed off a 2009 Toyota Yaris wrapped in vinyl featuring the logo of automotive publication Donut Media (which is owned by Futurism‘s parent company Recurrent Ventures.)
Despite the car looking a bit chaotic — albeit still very much like a small passenger vehicle to the human eye — “we proved it was effective,” Swearingen told TechCrunch. The Yaris successfully defeated surveillance detection at Def Con during the pattern’s first public test.
“Privacy is a fundamental right,” he added, aiming to give people a way to “opt out of being tracked.”
To come up with the pattern, he used a reinforcement learning model that trained itself on patterns that evade detection. The model got to the point of being able to confuse all 11 open source detection algorithms he tested, per TechCrunch, in addition to Flock’s license plate readers and even Axon’s body-worn cameras used by police departments.
As part of his noRecognition crowdsourcing campaign, Swearingen has also come up with T-shirts and hoodies that feature algorithmic detection-busting patterns. He hopes to eventually put pattern-printed skins for entire cars on sale as well.
One thing is clear: as outrage over Flock’s heavy presence across the country grows, people are looking for any way to foil the tech — especially if it looks cool.
Recently, the Kyoto Prefectural Police caught one of the initial-seeders of the well-known Japanese torrent website Nyaa. Masakazu Ono, 56, from Sagamihara in the Kamigawa Prefecture, was arrested after a multi-year investigation. While this news is straightforward by itself, the interesting bit is that CODA, the Japanese anti-piracy entity that performed the initial cyber-investigation, identified Ono allegedly without joining or monitoring BitTorrent swarm traffic, with the help of the Japan Hacker Association (JHA).
CODA's description of only having "[analyzed] how data moves through torrent sites, such as index sites and tracker sites" is vague and can be parsed in a number of ways. The distinction between indexer and tracker is relevant: while an indexer is a user-visible list of torrents (usually a website), the tracker is the background service that software like qBittorrent actually connects to, and it lists everyone who's currently active in that torrent, whether sharing, downloading, or both.
Our hypothesis is that CODA kept close tabs on the Nyaa trackers to see which IP address (in this case, Ono's) consistently appeared as the first person to offer up a 100% complete set of data for a show, a theory that would fit with how long the operation took. JHA's founder, Takayuki Sugiura, was the first to decrypt the Winny P2P protocol in 2004 to find original uploader sources, and the methods used weren't too different from the aforementioned theory. It's also possible that Ono wasn't using a VPN but was logged into Nyaa, or activity at another website's cookies or CDN logs was used to establish a link to his activity at Nyaa, and from thereon, to the tracker.
An initial-seeder is someone who is the first to offer up data for others to download — in this case, shows and movies. The show that reportedly got Ono nailed was Midnight Taxi, a 2026 Japanese drama produced by NHK and WOWOW. However, the police apparently had been tracking him for quite a while and claimed that he had uploaded close to a thousand NHK recordings over the investigation's span.
The process started in 2021 when CODA first launched its Cross-Border Enforcement Project, aiming to identify Nyaa's uploaders. During three years, with the help of JHA, CODA seemingly collected enough information to get the Kyoto police involved in 2024. Three "secondary uploaders" from "reach sites" were charged in 2025, likely meaning regular users participating in the torrents, who got there through link aggregator sites. Fast-forward to a couple of weeks ago, and Masakazu Ono was formally arrested with specific charges.
The most common techniques used by law enforcement agencies are creating a tracker honeypot or participating in the torrent swarm themselves in a bid to identify who's sharing files. However, Nyaa's list of trackers is small and comprises well-known, trusted servers, so together with CODA's wording, it's unlikely this was the method used. Furthermore, Japanese law generally frowns on non-targeted data monitoring, meaning that techniques like Deep Packet Inspection (DPI) and traffic volume monitoring likely weren't used, at least until such time as Ono was identified.
Australia and Singapore are expanding cooperation on AI safety, cybersecurity, digital infrastructure, and subsea-cable resilience through their first Cyber and Digital Senior Officials Dialogue.
A bug in the tech giant's website the logo of US marketing automation company Klaviyo Inc. is seen displayed on a smartphone in front of an abstract background on a computer screen..
Steam hardware customers in Europe should “expect fake messages - email, SMS or phone,” says Valve in an email bulletin circulating today. The problem is that its European hardware distributor, CEVA Logistics, has fallen prey to a cyberattack where personal information and hardware purchase details were compromised. The most sensitive data, such as payment information, passwords, and/or Steam Guard codes, was not pilfered during the attack.
According to the official communication from Valve, CEVA was hit by a cyberattack between July 29 and August 1, 2026. The PC gaming company says that it learned that hackers had successfully swiped a range of information about Steam hardware customers on August 7.
As this data was in the hands of CEVA, it was strictly limited to delivery-related information. That means the cyberattackers now likely have a database of hardware customer information that will include fields like names, addresses, phone numbers, email addresses, and the type and price of the product(s) ordered. CEVA holds this type of information for 90 days to cover fulfillment of the hardware order. It is worth repeating that the attacked distributor won’t have spilled data such as payment information, passwords, and/or Steam Guard codes.
The likely fallout customers should be wary of
Valve candidly warns those who have purchased Steam hardware like a Steam Deck or Steam Machine in Europe over recent months to “expect fake messages - email, SMS or phone - that mention your hardware order and appear to come from Steam, Valve or a delivery company.” Likely angles used by swindlers will be to ask for extra customs or delivery fees. They may also ask you to sign into some fake web portal or other. However, you should ignore such requests, of course, and changing your Steam password or anything to do with your account settings is not necessary, insists Valve.
If you are in any doubt about a communication that comes from Steam / Valve or a distributor, please check the URLs carefully. For example, Steam Support only handles account issues at help.steampowered.com, and only store.steampowered.com, www.steampowered.com, steamcommunity.com, or help.steampowered.com are ever used for Steam account logins. You are advised to type these into a browser yourself and not click any email-embedded links. We assume poking around the official Steam App on your PC will also be fine, and many of you will have that auto-running when your PC starts up. Lastly, you are reminded that “Steam Support will never ask you for your password or a Steam Guard code. Neither will a courier.”
CEVA isolated the affected systems and notified data protection authorities after discovering the hack. It has brought in outside investigators.
Turns out there’s one thing AI chatbots are definitively better at than humans: scamming innocent people.
A new piece of research flagged by Wired found that large language models are significantly better than humans at pulling off “pig butchering” scams, a form of online investment fraud where criminals pursue fake, long-term relationships with targets in order to build trust before cleaning them out financially.
To pull off the study, researchers at Northeastern and a grab bag of international institutions pitted 22 test subjects against two forms of scammers: one an AI chatbot, the other a random human. After a seven-day courtship period, the “scammers” asked their “victims” to either download an app or play an online game, a stand-in for a financially-manipulative request (asks that, in the real world, could be used to hack a victim’s device).
Overall, just 18 percent of the human scammers acquiesced, while the AI chatbots were much more successful, courting nearly half of the participants.
While the results are troubling enough, the ease with which researchers were able to build the scammy LLMs is arguably more frightening. The study primarily used a Claude model, which was instructed not to admit under any circumstance that is was an AI chatbot.
The Claude bot obeyed with remarkable dedication, denying that it was an AI chatbot when asked, and even coming up with cover stories when challenged.
“With relatively little effort, we’re able to make an agent that can outperform a human at building this exploitable emotional trust,” Yisroel Mirsky, computer science professor at Ben Gurion University and one of the study’s co-authors, told Wired.
Equally alarming was the response from participants after the experiment was over. Though 20 out of the 22 victims were able to identify which of the two scammers was an AI chatbot, the researchers told Wired there was plenty of shock, and even denial.
“Some people were just blown away,” said University Amrita Vishwa Vidyapeetham professor Gilad Gressel. “They just had absolutely no idea.”
Login
