As a result, the device is in over 2 million cars, about half of whose owners told dealers they didn't want it, by UCSD's estimate. They may not have any idea it's inside their vehicle. Yet it's beaconing and can be "activated" instantly by a hacker and hijacked for theft or chaotic effects.

UCSD warned KARR's manufacturer, who has now pushed out a fix. The complication: KARR is typically installed by dealers to prevent theft from their lots. If a buyer doesn't want it as an add-on, the dealer still leaves it wired in under the hood anyway in a "deactivated" state.

One of the types of code it appears designed to target is the modeling program LS-DYNA. Significantly, LS-DYNA has been used by Iranian research scientists who may have contributed to nuclear weapons research. Problems like modeling the properties of different explosives that can trigger warheads.

Fast16 has been a mystery since it was named in the ShadowBrokers leak of NSA tools in 2017: A program that advised agency hackers how to deal with other malware they encountered merely notes for Fast16: "NOTHING TO SEE HERE - CARRY ON," suggesting it was a created by the US or a friendly country.

New book coming next year. Working title, THE GRAYSCALE: True Stories of Hackers, Outlaws and Rogues From the Digital Underground. Thanks to @wired.com and @mitpress.bsky.social for making this one possible!

Join me + actor/author/crypto skeptic Ben McKenzie (@benmckenzie.bsky.social) next week for WIRED's first WIRED@NIGHT live event. We'll talk about his doc "Everyone is Lying to You for Money," crypto, scams...and whether crypto is a scam? 4/16, 6pm, Brooklyn, tickets: events.wired.com/at-night/home

Red Bull was determined to expose everything he could about his captors: their scamming systems, scripts, guides, org chart, photos, even videos he secretly recorded. This clip inside the office shows colored flags on teams of workers' desks, connoting whether they met their scam quotas that month.

Crypto romance scams are the most lucrative form of cybercrime in the world today, stealing tens of billions of dollars a year from victims. But the scammers, workers enslaved in Chinese-mafia-run compounds, are victims too. My new source was one of them. He asked me to call him Red Bull.

It's tempting to think of Phreeli as a phone carrier where every phone is a burner phone. But Merrill resists that description. Instead, he argues that anonymous cell service should be as normal as curtains on your home's windows.

Phreeli's founder is Nicholas Merrill, who became famous in the privacy world for refusing to comply with a warrantless FBI surveillance order sent to his internet service provider in 2004, demanding a customer's information. He spent a decade-plus in court fighting the order—and won.

Incredible impact from @mattburgess1.bsky.social whose work put a spotlight on Starlink’s use in scam compounds in February.

That means a dish in a different place would pick up entirely different data. Probably an entirely different stream of unencrypted secrets. As cryptographer Matt Blaze told me:

A lot of this data, such as the T-Mobile leak, is now encrypted thanks to the researchers' work. But all of it was obtained from a single dish on the roof of a building in San Diego. These findings are based on just 15% of geostationary satellite signals over the US and Mexico.

Most striking to me was that the data included phone calls and text messages from several US and Mexican phone carriers. Remote cell towers connect to core carrier networks via satellite, relaying conversations via space—sometimes with no encryption.

Their study, out today, reveals that roughly half of geostationary satellite communications they monitored were unencrypted. A flood of secrets pouring down from space, available to anyone with an $800 receiver setup. (And there's no doubt spy agencies have been listening, too.)

A source shares some screenshots of the Lapsus ransomware gang celebrating the government shutdown as a disruption to the FBI investigations tracking them. They also refer to Trump as "my king."

The Secret Service isn't claiming it foiled any plot targeting the UN General Assembly. Just that a big collection of SIMs (probably used for fraud) could have *potentially* disrupted NYC cell service. The SIMs were in a *35 MILE* radius of the UN. These headlines are all pretty egregiously wrong:

In 3 days a slick new UK edition of Sandworm comes out with a new cover and new foreword: www.amazon.co.uk/Operation-Sa... The publisher has tweaked the title to "Operation Sandworm" for UK reasons I don't entirely understand, but it's the same book, and hopefully will now reach a new audience.

Somehow it's considered antisemitic to protest this in America or suggest it should be resisted. In fact, it's antisemitic to think that this has anything to do with judaism rather than a murderous regime's campaign of conquest. www.haaretz.com/israel-news/...

Two of my most memorable moments with Young were his first answer to me when we sat down for an interview (I had asked him where he was from!) and then his final comment as we said goodbye.

Cryptome.org is an incredible archive of leaked documents, historic internet artifacts and other strange finds. Another favorite quote from Young (and Cryptome's co-administrator, his wife Deborah Natsios) is the site's privacy policy:

Sad to learn of the death of John Young, creator of Cryptome, cypherpunk, shit-stirrer, progenitor of the transparency movement that included WikiLeaks and Snowden. I profiled him in my book, This Machine Kills Secrets, which ended with a comment he wrote in 2012 about Assange and his early work:

Then the feds got onto his trail. To skip ahead (spoilers) Akasha read my book about crypto crime, Tracers in the Dark, in prison, and got in touch with me when he got out. In the 18 months since, I've been reporting out his life story—part Breaking Bad, part Electric Kool-Aid Acid Test.

(He also owned a pet lemur.)

Akasha Song made DMT by the kilogram in labs across the Western US. He traveled into the Brazilian forest to find a source to import literal tons of the jurema preta tree bark from which DMT can be extracted. He wholesaled DMT by the pound to an LSD cartel. At one point, one of his labs exploded.

DMT is the active ingredient in ayahuasca, but those who vape a few dozen milligrams of it in its pure, crystalline form describe traveling to other dimensions, meeting sentient inhabitants of those realms, communing with God, and achieving transcendental states of being.

To capture how this new, anarchic form of firearm is continuing to defy gun control even as the weapons become more powerful and practical, we also put together an interactive timeline of the evolution of 3D printed guns over the last dozen-plus years.

To see how our clone of Mangione's (alleged) ghost gun performed at a firing range, read our story and watch the video: www.wired.com/story/luigi-... (I'll spoil the ending: the gun performed exactly as well as the one shown in the surveillance footage of Brian Thompson's murder.)

3D printers are much better now, and MUCH cheaper. The entire shopping list for making Mangione's (alleged) Glock-style 9mm 3D-printed gun was $1,144.67 plus shipping—including a $650 3D printer. The printer alone in 2015 cost nearly $3,000.

Despite state laws and even a recent Supreme Court ruling banning some "ghost guns," this was 100% legal. Other than 3D printing the silencer (as Mangione allegedly did), I made this fully lethal firearm in total privacy without a background check or showing anyone ID—no gun control at all.