Smashing Security How not to steal $46 million from the US government
14 snips
Mar 12, 2026 Tricia Howard, cybersecurity practitioner known for hands-on work in crypto and investigations. She discusses alleged theft of $46 million from US Marshals-managed crypto and the Telegram recordings tied to it. They also cover a dormant JavaScript worm that vandalized Wikipedia and how it spread across projects. Short, sharp stories about custody failures, blockchain tracing, and a real-world web worm.
AI Snips
Chapters
Books
Transcript
Episode notes
Staff Review Accidentally Unleashed A Worm
- A Wikimedia security engineer accidentally executed dormant malicious user script and triggered a self-propagating JavaScript worm.
- The worm injected into global common.js and into ~85 user scripts, vandalising thousands of pages with 5,000px woodpecker images before containment in 23 minutes.
Least Privilege Prevents Accidental Platform Worms
- Principle of least privilege matters because overprivileged staff accounts can amplify accidents into platform-wide incidents.
- Graham highlights that staff should avoid high-privilege logins during routine reviews and use test environments to limit blast radius.
Audit User Scripts And Use Test Environments
- Audit user-generated scripts for dormant malicious code and run reviews in isolated test environments.
- Wikimedia plans further mitigations after cleaning thousands of files, showing proactive post-incident hardening is essential.
