Anyone keeping track of world news in the early 2010s, and reports on tech in particular, has probably heard about Stuxnet. That malware spawned a large number of conspiracy theories — with the kicker that some of them were actually true. The malware targeted Iranian nuclear facilities and is believed to be the first digital worm to cause direct physical damage in meatspace. An unknown security researcher has now published a source code reverse-engineering of Stuxnet in all its glory.
The worm's ultimate target, allegedly a successful one, were industrial controllers from Siemens that were reportedly used in Iranian's Natanz nuclear enrichment plant. Once it reached the target, Stuxnet's payload manipulated the frequency converters in industrial centrifuges, in a bid to subtly damage the rotors — all while keeping the plant staff in the dark by reporting normal operation.
The repository contains build instructions so interested techies can try it out for themselves and learn all about its inner workings. You'll need a Windows XP or Windows 7 virtual machine, and for obvious reasons, you shouldn't configure any network connectivity for it. To witness the full effects of the payload rather than just the spreading mechanisms, you'll need the appropriate Siemens software, and ideally hardware — though we figure that industrial-scale centrifuges aren't exactly common in techies' cable drawers.
In its heyday, Stuxnet spread via three mechanisms. The primary infection vector was USB sticks with Windows shortcuts and autorun.inf files. Upon plugging one of those sticks in, just viewing the drive's contents would immediately trigger infection thanks to a zero-day vulnerability.
Infected systems then autonomously tried to spread the worm further via the network using a zero-day Windows Print Spooler vulnerability that would let an attacker write system files into any machine sharing a printer. It would also copy itself into accessible network shares. To evade Windows driver signature checks, Stuxnet used two digital certificates stolen from Realtek and JMicron.
The worm also had code to inject itself into Siemens software, by way of the WinCC SQL Server database, and embedding its code in Step 7 project files that automatically ran when engineers opened them. Since those files were almost guaranteed to be shared among more than one engineer, it made for an excellent internal infection vector that didn't depend on having network share control.
The final step was taking charge of the DLL that communicated with the actual centrifuges and injecting malicious code into the PLCs (Programmable Logic Controllers) of those machines to stealthily mess with the rotors.
Stuxnet was part of Operation Olympic Games, an alleged coordinated effort between the U.S. and Israel to try and curb Iran's purported progress in creating nuclear weapons at its Natanz facility. The initiative seemingly ran under both the Bush and Obama administrations, and was supposedly a way to dissuade Israel from launching its own preemptive strike against Iran. The software was allegedly developed by both the Pentagon and Israel's Unit 8200, and was reportedly successful in bringing down about 10% of Natanz' centrifuges by ultimately seriously damaging their rotors.
However, the worm had a nasty bug: it didn't have sufficient checks about which environment it was in, and failed to notice it was no longer in a local network environment. When engineers took their laptops home, it escaped out to the internet at large, at which point security researchers worldwide let out a collective "huh, that's odd" and proceeded to investigate. Mercifully, the worm contained a hard-coded self-destruct date set for June 24, 2012.
Talking to an AI chatbot can feel like confiding in a mirror, a private exchange equivalent to brainstorming in a Word document. Yet when it comes to the most popular AI chatbots, that mirror is really one-way glass — and you might be shocked to learn how many different people can watch from the other side.
Since the rise of easily accessible AI chatbots, untold millions of people have happily fed AI models their deepest, darkest secrets. According to a recent survey conducted by browser company DuckDuckGo and flagged by CNET, a full third of all AI users admit to having told their chatbots a secret they wouldn’t tell the “trusted people” in their lives.
There’s a grim irony there, because by telling an AI chatbot those closely guarded secrets, you may inadvertently be sharing intimate details with tech companies, police departments, lawyers, and even your boss. That’s according to new reporting by the Washington Post, which notes that there have been a dozen court cases where chatbot transcripts were cited in the public record over the last two years.
Even if your transcripts don’t end up in the hands of Johnny Law, they can easily be obtained by your boss, assuming you’re using a company-provided AI service. And of course, there’s no telling how long AI companies like OpenAI and Anthropic might hold onto details of your conversations, as WaPo notes numerous scenarios in which they may be required to hold onto your chatlogs by law.
There’s also the grim possibility of leaks from the AI companies themselves. In July, it was revealed that a whole trove of chats with Anthropic’s chatbot Claude had been exposed to the open web — and not for the first time.
“Unless you are having a chat with a service that has a temporary chat or, basically, an incognito version… [and] you’re also having it within a browser that’s not tracking you, the answer is no,” Jen King, a privacy researcher at the Stanford Institute for Human-Centered Artificial Intelligence told WaPo. “You can’t be sure that it’ll be totally private.”
And though users are remarkably comfortable divulging those details to their favorite bot, fewer are aware of those myriad ways their chat logs might live on in perpetuity. According to the DuckDuckGo poll, 53 percent of regular users said they didn’t know that AI chatbots are training on data obtained through their conversation, while 75 percent didn’t realize that conversations with large language models (LLMs) can easily be subpoenaed by police.
So when in doubt about whether to tell ChatGPT about your intimate relationship troubles, keep in mind that the internet is forever; and that goes double for AI chatbots.
The digital scans of more than 153 million drivers licenses of individuals from the United States and Canada are being sold on the dark web through an easily accessible service called Nexus.
As noted cybersecurity journalist Brian Krebs noted on his blog this week, the sale has now caught the attention of the FBI, which has launched an official inquiry.
On the same day Krebs published his post, the service mysteriously vanished from the dark web, which could make tracking down the people behind the hack more difficult.
Nonetheless, the scale of the leak is staggering, and includes not just drivers licenses, but 10 million ID cards, over three million travel documents, and over half a million medical cards as well, representing over 170 million individuals total. That’s pushing half of the United States’ and Canada’s combined populations.
The ID scans appear to have been taken from a widely-used ID verification company based out of Louisiana and even include the license of US defense secretary Pete Hegseth.
The incident highlights the dangers of having little regulatory oversight over identity verification services — a thorny subject, considering regulators continue to push for age limits for content online, rules that could put people at risk of having their identity stolen by bad agents.
The ID scans first appeared on a Russian cybercrime forum. The owner of the files caught Krebs’ attention after showing the journalist a scan of his Virginia drivers license, strongly supporting the leak’s validity.
Before it was taken down, the shadowy dark web service called Nexus allowed virtually anybody to peruse identity documents of over 170 million people in the US and Canada.
“We have been continuously exfiltrating new data for over a year into our private database,” the service boasted in a post on the Russian forum. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”
According to the people behind Nexus, the source of the leak is a “major identity verification company” that’s in business with several Fortune 500 companies, Krebs writes.
While the feds are starting their own investigation, Krebs dug a little deeper and found a fascinating common thread: many of those, whose identity cards showed up in the database had rented cars from the company Hertz.
“I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine,” Krebs wrote. “That’s notable because we both handed our licenses to the Hertz rental car representative at the same time.”
Other individuals the reporter talked to recalled giving their driver’s license to a dispensary, which struck a deal in 2022 with ID verification company idscan.net — which also provides services to other big brands, including Hertz.
The New Orleans-based firm told Krebs that it’s now investigating the matter. The FBI has also confirmed that it’s also officially looking into the company.
Patel lacked virtually any degree of relevant working experience for the job before the Senate confirmed him — and now, the agency is opening the doors for even more highly questionable hirings.
As inside sources told CBS News, the FBI has quietly lowered standards of its background checks for potential federal agents and other personnel. The bureau is now officially looking the other way when it comes to prostitution, for instance — as long as recruits didn’t hire sex workers over three times.
Even more eyebrow-raising is that the FBI is even allowing the consideration of candidates who engaged in bestiality or animal cruelty, according to CBS‘ sources. However, any such incidents would’ve had to have taken place before the candidate turned 18.
The broadcaster’s sources also said there was no distinction between candidates who were forced into sexual activity with animals or if they did so willingly. An FBI spokesperson claimed that eligibility requirements were limited to a “narrow set of circumstances, such as in cases where a person was sexually abused with animals as a child.”
Experts, however, were appalled at the news, arguing that the FBI is undermining its responsibility in vetting applicants by changing background check standards.
“Bestiality is clearly a potential indication of a more serious emotional issue, and even in a circumstance where it is not, the pool of candidates should be extensive enough that the criteria should certainly not be eliminated,” former FBI agent James Davidson told CBS.
Before the changes, which were reportedly implemented earlier this summer, the FBI’s webpage was clear about automatically disqualifying special agents who engaged in “prostitution or bestiality.”
Both current and former FBI employees told the CBS that the bureau could now be hiring “people with questionable backgrounds,” allowing them to undermine the integrity of the service. Others warned that the news was evidence of a major “recruiting problem.”
Considering the fact that the agency is being helmed by a personality as controversial as Patel, these changes shouldn’t come as too much of a shock.
While he hasn’t personally acknowledged the latest changes, Patel has frequently called for new hiring standards at the bureau, arguing that “we are losing too many qualified candidates to the rigors of the requirements from yesteryear” in a July interview with former FBI agent John Nantz.
Patel’s motivation for lowering standards could be to bring in his closest associates. As ProPublica reported in November, his personal assistant didn’t clear their polygraph test and required a waiver, claims the FBI has since denied.
Flock cameras have ignited a debate over surveillance, privacy, data collection, and public resistance. The MacVoices panel weighs in on the debate. They also discuss the risks of government-sponsored cyberattacks carried out by private companies, growing opposition to data centers over power and infrastructure demands, and the regulatory challenges surrounding their expansion.
Login
