Andy Greenberg

Two security researchers shipped me a pink plastic kid's smartwatch from Amazon. When I wore it, they tracked my movements, surreptitiously took photos of me, even listened to my conversations.

The same backend they hacked is used by 30+ watch brands for kids. 🧵👇
https://www.wired.com/story/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids/

As the TeamPCP cybercrime group carried out an unprecedented spree of software supply chain hacking this year, it had been infiltrated by an undercover analyst from Google's threat intel division. Google watched from inside, warned victims, even disrupted extortions. https://www.wired.com/story/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/

A hacking device the size of a quarter can be plugged into a port accessible from the exterior of a Boeing 737 to change its autopilot navigation or tamper with values used to calculate its takeoff speed, a group of security researchers has shown. 🧵👇 https://www.wired.com/story/this-coin-sized-device-can-hack-a-boeing-737/

San Francisco police accidentally livestreamed their drones’ video and data on the open web. The hours of footage—including several apparent arrests—should never have been made public, but now offer a revelatory glimpse of modern aerial urban surveillance. Watch: https://www.wired.com/story/sfpd-drone-video-leak-surveillance/

I sat in on a close-door war game where the insurance industry simulated a cyberattack against US water utilities by Volt Typhoon, Chinese state hackers who have been penetrating US critical infrastructure since at least 2023. The results were catastrophic. https://www.wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon/

I spoke with Andy Yen, CEO of Proton, which has encrypted the daily online work/comms a hundred million-plus people.

We talked in particular about Proton's surprising embrace of AI, like its chatbot Lumo. Yen says "AI is surveillance." He also says it's "unavoidable." https://www.wired.com/story/the-big-interview-podcast-andy-yen-proton/

A Minnesota state fusion center report ties the cyberattacks on 30+ Minnesota water utilities to Iranian-affiliated hackers, according to a water utility information sharing group's memo I obtained.

https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-on-minnesota-water-utilities-to-iran/

Developers from Signal (including its protocol's co-creator) along with Microsoft and Harvard unveil Encrypted Spaces, an open-source codebase for a new generation of private collaboration apps. Think Slack, Discord, Google Docs, all end-to-end encrypted. https://www.wired.com/story/signal-alums-release-encrypted-spaces-a-new-system-for-building-private-collaboration-apps/

Last year, a human trafficking victim trapped in a crypto scam compound in the Golden Triangle region of Laos contacted me. He proceeded to leak to me a huge collection of the compound's internal materials.

Then he had to get out alive. This is his story.

🧵👇
https://www.wired.com/story/he-leaked-the-secrets-southeast-asian-scam-compound-then-had-to-get-out-alive/

After this week's Github breach, we checked in on hacker group TeamPCP's victim count: their supply chain attacks have tainted more than 500 pieces of software (a thousand-plus different version) and breached hundreds of companies. This is out of control.

https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/

As Trump threatens scorched-earth attacks on Iran, a joint advisory from US agencies warns Iran-linked hackers have hit US critical infrastructure: "In a few cases, this activity has resulted in operational disruption and financial loss." https://www.wired.com/story/iran-linked-hackers-are-sabotaging-us-energy-and-water-infrastructure/

New book coming next year. Working title, THE GRAYSCALE: True Stories of Hackers, Outlaws and Rogues From the Digital Underground.

Mohammad Muzahir, aka Red Bull, the scam compound whistleblower and human trafficking victim whose incredible bravery made possible this story...https://www.wired.com/story/he-leaked-the-secrets-southeast-asian-scam-compound-then-had-to-get-out-alive/... now has a GoFundMe.

I'm in touch with the creator, who is legit. Grateful to her and to anyone who can donate:

https://www.gofundme.com/f/support-whistleblower-journey-to-a-cybersecurity-degree

@campuscodi@mastodon.social @mmuller@infosec.exchange damn I thought the glasses would work like on Clark Kent

Red Bull, the scam compound whistleblower and human trafficking survivor whose story I told earlier this year, is struggling to rebuild his life in a new country. He desperately needs tuition funds to keep his student visa, avoid deportation and stay safe.

Anything you can give would go a long way: https://www.gofundme.com/f/support-whistleblower-journey-to-a-cybersecurity-degree (I have vetted this GoFundMe.)

Thank you!

I don’t think I’ve ever had so many people writing to me to ask about encrypted/secure/private tools for comms, collaboration, and organizing. So @lhn@mastodon.online and I talked to experts and assembled this: the Wired guide to organizing in an age of surveillance. https://www.wired.com/story/how-to-organize-safely-in-the-age-of-surveillance/

Feds just took down 4 botnets, including the Aisuru and Kimwolf botnets that carried out record-breaking DDOS attacks peaking at 30+ terabits per second, nearly three times the previous record. DOJ says the botnets had hijacked more than three million devices. https://www.wired.com/story/us-takes-down-botnets-used-in-record-breaking-cyberattacks/

A security researcher using Claude Opus 4.7 found the AI tool could independently code an exploit to hack into Front Gate Tickets, the ticketing platform for almost every major US music festival from Lollapalooza to Bonnaroo. He could then issue any tickets at will. https://www.wired.com/story/claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-festival/

Hacking internet-connected civilian security cameras for recon has become a standard operating procedure of modern warfare. First for Russia and Ukraine, now for Israel and Iran.

Your insecure internet-of-things surveillance system is now their targeting system. https://www.wired.com/story/from-ukraine-to-iran-hacking-security-cameras-is-now-part-of-wars-playbook/