Day: September 19, 2025

This Week In Security: The Shai-Hulud Worm, ShadowLeak, And Inside The Great Firewall

September 19, 2025 by 7 Comments

Hardly a week goes by that there isn’t a story to cover about malware getting published to a repository. Last week it was millions of downloads on NPM, but this week it’s something much more concerning. Malware published on NPM is now looking for NPM tokens, and propagating to other NPM packages when found. Yes, it’s a worm, jumping from one NPM package to another, via installs on developer machines.

It does other things too, like grabbing all the secrets it can find when installed on a machine. If the compromised machine has access to a Github account, a new repo is created named Shai-Hulud, borrowed from the name of the sandworms from Dune. The collected secrets and machine info gets uploaded here, and a workflow also uploads any available GitHub secrets to the webhook.site domain.

How many packages are we talking about? At least 187, with some reports of over 500 packages compromised. The immediate attack has been contained, as NPM has worked to remove the compromised packages, and apparently has added filtering code that blocks the upload of compromised packages.

So far there hasn’t been an official statement on the worm from NPM or its parent companies, GitHub or Microsoft. Malicious packages uploaded to NPM is definitely nothing new. But this is the first time we’ve seen a worm that specializes in NPM packages. It’s not a good step for the trustworthiness of NPM or the direct package distribution model.

Continue reading “This Week In Security: The Shai-Hulud Worm, ShadowLeak, And Inside The Great Firewall” →

The Inside Story Of The UK’s Great CB Petrol Scam

September 19, 2025 by 28 Comments

Looking at gasoline prices today, it’s hard to believe that there was a time when 75 cents a gallon seemed outrageous. But that’s the way it was in the 70s, and when it tripped over a dollar, things got pretty dicey. Fuel theft was rampant, both from car fuel tanks — remember lockable gas caps? — and even from gas stations, where drive-offs became common, and unscrupulous employees found ways to trick the system into dispensing free gas.

But one method of fuel theft that escaped our attention was the use of CB radios to spoof petrol pumps, which [Ringway Manchester] details in his new video. The scam happened in the early 80s, only a few years after CB became legal in the UK but quite a while since illegal use had exploded. The trick involved a CB transceiver equipped with a so-called “burner,” a high-power and highly illegal linear amplifier used to boost the radiated power of the signal. When keyed up in the vicinity of dispensers with digital controls, the dispensing rate on the display would appear to slow down markedly, while the pump itself stayed at the same speed. The result was more fuel dispensed than the amount reported to the cashier.

If this sounds apocryphal, [Ringway] assures us that it wasn’t. When the spoofing was reported, authorities up to and including Scotland Yard investigated and found that it was indeed plausible. The problem appeared to be the powerful RF signal interfering with the pulses from the flowmeter on the dispenser. The UK had both 27 MHz and 934 MHz CB at the time; [Ringway] isn’t clear which CB band was used for the exploit, but we’d guess it was the former, in which case we can see how the signals would interfere. Another thing to keep in mind is that CB radios in the UK were FM, as opposed to AM and SSB in the United States. So we wonder if the same trick would have worked here.

At the end of the day, no matter how clever you are about it, theft is theft, and things probably aren’t going to go well for you if you try to pull this off today. Besides, it’s not likely that pumps haven’t been hardened against these sorts of attacks. Still, if you want a look inside a modern pump to see if you can find any weaknesses, have at it. Just don’t tell them where you heard about it.

Continue reading “The Inside Story Of The UK’s Great CB Petrol Scam” →

Dirty Pots, Meet Power Tools!

September 19, 2025 by 26 Comments

Let’s face it, nobody likes scrubbing, but what option do you have? You can’t exactly break out the grinder to clean off the remains of last nights dinner… right? Well, maybe not a grinder, but thanks to this hack by [Markus Opitz], you can use an oscillating tool.

It’s a simple enough hack: [Markus] modeled the attachment for his Bosch oscillating tool in Tinkercad, and created a bracket to hold a large metal binder clip. The clip attaches with a screw, and can hold whatever scrubbing pad your carpel-tunnel afflicted hands can’t bear to hold on to. He’s using a self-cleaning stainless-steel sponge.

One nice touch is a pair of protective lips on the jaws of the metal clip, to keep it from accidentally scratching the delicate surface under care. Of course if you have a drill or a Dremel handy you can buy attachments for polishing disks of various grits, but what’s the fun in that? Doing the dishes with a hacked-together oscillating tool just somehow seems more fun. Plus this way you can’t accidentally produce an engine-turning pattern.

We don’t seem to have featured many hacks for these fun, buzzing, multi-purpose tools, so if you’ve got one send us a tip. We did feature an oscillating cutter for CNC once, but that was fully DIY.