Florida man accused of hacking Disney World menus and changing font to Wingdings

With the 2024 United States presidential election just days away, WIRED reported on documents that revealed the U.S. government's assessments of several components of election security and stability. A report released in October by the U.S. Department of Homeland Security, first obtained by national security transparency nonprofit Property of the People, found that financially motivated cybercriminals and ideologically motivated hacktivists were more likely than state-backed hackers to attack U.S. election infrastructure . Another government memo warned of the risk of insider threats to the election, noting that such internal misconduct “could derail or jeopardize a fair and transparent electoral process.”

With so much at stake in a hyperpolarized and combative climate, U.S. elections have become increasingly militarized, with bulletproof glass, drones, defensive blockades and snipers protecting election offices and election officials bracing for the possibility of violent attacks. A WIRED investigation also revealed a successful CIA hack of Venezuela's military pay system, part of a secret attempt by the Trump administration to overthrow the country's autocratic president, Nicolás Maduro.

In other cybersecurity news, WIRED has taken a deep dive into firewall vendor Sophos' five-year turf war to try to take out — and keep out — Chinese hackers who are running spying operations on some vulnerable devices. And researchers warn that a “critical” zero-click vulnerability in a standard photo app on Synology's network-attached storage devices could be exploited by hackers to steal data or infiltrate networks.

As always, there is more. Every week we round up the security and privacy news that we haven't covered in detail ourselves. Click on the headlines to read the full stories. And stay safe out there.

According to reports from 404 Media and Court Watch, a Disney employee who was fired from the company and still had access to the passwords allegedly hacked into the software used by Walt Disney World restaurants. A criminal complaint against Michael Scheuer alleges that he repeatedly accessed the third-party menu creation system created for Disney and modified menus, including changing the fonts to Windings – a font made entirely of symbols.

“The fonts were renamed by the threat actor to retain the name of the original font, but the actual characters appeared as symbols,” the criminal complaint states. “As a result of this change, all menus in the database were unusable as the font changes propagated throughout the database.”

However, the allegations are not just limited to bizarre vandalism. The federal complaint also details how Scheuer allegedly changed menu items to say that foods containing peanuts were safe for people with allergies, attempted to log into Disney employees' accounts, and 14 employees of theirs Locked out accounts by attempting to log in using an automated login script, kept a folder of personal information about employees, and showed up at a person's home. A lawyer representing Scheuer did not comment on the allegations.

In recent years, infostealers have become a popular tool of choice for hackers, from cybercriminals looking to make money to sophisticated nation-state groups. The malware, often bundled in pirated versions, uses web browsers to collect usernames and passwords, cookies, financial information and other data that you enter into your computer. This week, police officers around the world took down the Redline infostealer, which was used to steal more than 170 million pieces of information and has been linked to large-scale hacks. An almost identical infostealer called Meta was also disrupted. As part of Operation Magnus, US officials identified Russian citizen Maxim Rudometov as responsible for the development of Redline. As TechCrunch reports, Rudometov was identified due to a series of operational security failures, including the reuse of online handles and emails in social media apps and other websites. In its criminal complaint, the US Department of Justice pointed to Rudometov's dating profile, which was apparently “liked” by 89 other users and received no likes in return.

In January 2018, it emerged that GPS data from the running and cycling app Strava could reveal secret military locations and the movements of people exercising around them. Officials warned that it was a clear security risk. Years later, many seem not to have been paying attention. French newspaper Le Monde has revealed in a series of reports that US Secret Service agents are leaking their data through the fitness app, allowing the movements of Joe Biden, Donald Trump and Kamala Harris to be tracked. Security forces linked to French President Emmanuel Macron and Russian President Vladimir Putin are also revealing their movements. Those who shared their details used public profiles and often posted runs that began or ended at the locations they stayed during official trips. The leaks included bodyguards linked to Putin walking near a palace that the Russian leader has denied ownership of.

Italian prosecutors placed four people under house arrest and said they are investigating at least 60 others after the country's intelligence agency allegedly hacked government databases and collected information on more than 800,000 people. The intelligence firm Equalize is said to have collected information on some of Italy's most prominent politicians, entrepreneurs and sports stars, Politico reported. It is claimed that the information accessed included banking transactions, police investigations and more. The hacked information was reportedly sold or possibly used as part of extortion attempts, with those behind it reportedly making €3.1 million. The scandal that has angered Italian politicians could also be broader than just its impact in Italy. Recent reports indicate that Equalize counted Israeli intelligence and the Vatican among its clients.