Tim Starks
banner
timstarks.bsky.social
Tim Starks
@timstarks.bsky.social
Senior reporter, CyberScoop, covering spyware, cyber policy and more. Russia-sanctioned. Former Washington Post, POLITICO, CQ Roll Call. @timstarks.02 on Signal. [email protected]. Mastodon [email protected], X timstarks, Threads tstarks2.
Reposted by Tim Starks
A researcher who discovered the vulnerability said it was fixed in December, after he first reported it to the agency in September. via @timstarks.bsky.social cyberscoop.com/cisa-secure-...
CISA’s secure-software buying tool had a simple XSS vulnerability of its own
A Cybersecurity and Infrastructure Security Agency tool dedicated to helping government agencies buy secure software turned out to have a cybersecurity vulnerability of its own.
cyberscoop.com
January 16, 2026 at 3:19 PM
Reposted by Tim Starks
This was caused by flawed implementations of Google's Fast Pair one-tap Bluetooth protocol. But it doesn't just affect Android users. Anyone (yes, iPhone users) with audio accessories from Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech, and Google itself may be vulnerable.
Hundreds of millions of earbuds, headphones and speakers need a security update (yes, you need to update your earbuds) to prevent a wireless hacking technique that can hijack audio, eavesdrop via mics, and in some cases remotely track the accessory’s location. www.wired.com/story/google...
Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking
Flaws in how 17 models of headphones and speakers use Google’s one-tap Fast Pair Bluetooth protocol have left devices open to eavesdroppers and stalkers.
www.wired.com
January 15, 2026 at 5:16 PM
Reposted by Tim Starks
Court axes investor lawsuit over CrowdStrike software update-triggered outage
www.databreachtoday.com/court-axes-i...
Court Axes Investor Lawsuit Over CrowdStrike Software Update
A U.S. district judge tossed most claims from investors accusing CrowdStrike of misrepresenting its software testing rigor before a July 2024 outage. The judge said
www.databreachtoday.com
January 15, 2026 at 5:44 PM
Reposted by Tim Starks
When we say "explicitly neo-Nazi" we mean channels that fly swastikas and praise Hitler. That's the zone of internet where DHS is apparently finding inspiration for their X posts. It's ultra unlikely they would have ever encountered that song if they weren't in that space, imo.
Our researchers found at least 450 posts on Telegram dating back to 2020 that shared the song mentioned in this reporting.

Nearly all the posts we found were from explicitly neo-Nazi and white supremacist channels. And a review of our datasets found it hasn't circulated much outside those circles.
January 14, 2026 at 8:13 PM
Reposted by Tim Starks
Asked what he was doing to convince senators to lift holds, Plankey answered,“The support, the priority that the White House puts on it is the priority that I’ll get in there I’m doing the best I can to perform, to deliver for the country and I look forward to the Senate confirming me.”
January 14, 2026 at 9:09 PM
Sources: DHS finalizing replacement for disbanded critical infrastructure security council by @derekbjohnson.bsky.social cyberscoop.com/dhs-anchor-c...
Sources: DHS finalizing replacement for disbanded critical infrastructure security council
DHS is finalizing ANCHOR, a proposed replacement for CIPAC to restore government–industry threat discussions on critical infrastructure.
cyberscoop.com
January 14, 2026 at 8:27 PM
Reposted by Tim Starks
BREAKING: Hundreds of sensitive U.S. records obtained by WIRED undercut the Trump administration’s claims portraying Venezuela’s Tren de Aragua as a unified terrorist force invading the country. Intelligence agencies spent much of 2025 unsure TdA even functioned as an organization on U.S. soil.
Trump Warned of a Tren de Aragua ‘Invasion.’ US Intel Told a Different Story
Hundreds of records obtained by WIRED show thin intelligence on the Venezuelan gang in the United States, describing fragmented, low-level crime rather than a coordinated terrorist threat.
www.wired.com
January 14, 2026 at 4:02 PM
Reposted by Tim Starks
How the definition of "doxxing" is being twisted into a weapon of anonymity
How the Definition of 'Doxxing' Is Being Twisted Into a Weapon of Anonymity
From a journalist's tweet about Venezuela to the identity of the ICE agent who shot Renee Good, the debate over doxxing seems to be everywhere.
gizmodo.com
January 14, 2026 at 3:58 PM
Reposted by Tim Starks
EXCLUSIVE | Sensitive details of around 4,500 ICE and Border Patrol employees—including almost 2,000 frontline agents—have allegedly been released by a DHS whistleblower.

trib.al/AQEJlIa
Personal Details of Thousands of Border Patrol and ICE Goons Allegedly Leaked in Huge Data Breach
A DHS whistleblower appears to have exposed data on federal immigration workers after the shooting of Renee Good.
trib.al
January 13, 2026 at 5:04 PM
Reposted by Tim Starks
Reposted by Tim Starks
Exclusive: Beijing tells Chinese firms to stop using US and Israeli cybersecurity software, sources say - www.reuters.com/world/china/...
Exclusive: Beijing tells Chinese firms to stop using US and Israeli cybersecurity software, sources say
Chinese authorities have told domestic companies to stop using cybersecurity software made by roughly a dozen firms from the U.S. and Israel due to national security concerns, two people briefed on th...
www.reuters.com
January 14, 2026 at 12:34 PM
Reposted by Tim Starks
New: A coalition of advocacy groups — from the National Organization for Women to MoveOn — is calling on Apple and Google to yank X and Grok from their respective app stores.

www.reuters.com/sustainabili...
Women's, advocacy groups call on Apple, Google to drop X and Grok from app stores
A coalition of women's groups, tech watchdogs, and progressive activists is calling on Alphabet owner Google and Apple to remove the social media site X and its related chatbot, Grok, from their app s...
www.reuters.com
January 14, 2026 at 1:04 PM
Reposted by Tim Starks
FBI executes search warrant at a @washingtonpost.com reporter’s home as part of an investigation into a government contractor accused of illegally retaining classified material. Agents search her home and seize her phone and Garmin watch @perrystein.bsky.social www.washingtonpost.com/national-sec...
FBI executes search warrant at Washington Post reporter’s home
The reporter, Hannah Natanson, covers the federal workforce and has been part of The Post’s most sensitive coverage of the first year of the second Trump administration.
www.washingtonpost.com
January 14, 2026 at 2:18 PM
Reposted by Tim Starks
Check out my latest CSO piece, which looks at the setbacks created by Plankey's confirmation delay and the other key priorities left dangling in Congress. Many thanks to Jim Lewis of CSIS, Ari Schwartz of Venable, Megan Stifel of the IST, and others. 1/4

www.csoonline.com/article/4116...
US cybersecurity weakened by congressional delays despite Plankey renomination
Sean Plankey’s renomination as CISA director offers some relief, but stalled legislation on cyber threat information sharing and state and local grants continues to strain the nation’s ability to coun...
www.csoonline.com
January 14, 2026 at 2:53 PM
Reposted by Tim Starks
A House hearing weighed the pros and cons from the Trump administration and some lawmakers to step up cyber offensive operations. via @timstarks.bsky.social cyberscoop.com/us-offensive...
Hill warning: Don’t put cyber offense before defense
A House hearing weighed the pros and cons from the Trump administration and some lawmakers to step up cyber offensive operations.
cyberscoop.com
January 14, 2026 at 12:09 AM
Reposted by Tim Starks
President Donald Trump resubmitted his nomination Tuesday after it stalled in the Senate last year. via @timstarks.bsky.social cyberscoop.com/sean-plankey...
Sean Plankey re-nominated to lead CISA
President Donald Trump re-nominated Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency on Tuesday, after Plankey’s bid for the position ended last year stuck in the Senate.
cyberscoop.com
January 14, 2026 at 12:10 AM
Reposted by Tim Starks
These peaceful observers I spoke to had ICE show up at their homes in what they see as attempts at intimidation. ICE has somehow been accessing Minnesotans' private data in likely violation of state law, according to privacy advocates.

share.google/J00lpWzPzOu2...
Privacy advocates: ICE using private data to intimidate observers and activists
MPR News has looked into reports that federal agents have accessed private data to track and intimidate anti-ICE activists since the immigration crackdown surged in Minnesota in December. Privacy advo...
share.google
January 13, 2026 at 1:02 PM
I know there are more important things happening, but petition to take the word "heterodox" away from journalists/columnists right now.
January 13, 2026 at 3:43 PM
Reposted by Tim Starks
The Trump regime's withdrawal from international "cyber" orgs will weaken cybersecurity coordination and help spread authoritarianism.

[precisely what they probably want to happen]

My comments to @timstarks.bsky.social @cyberscoop.bsky.social

cyberscoop.com/trump-pulls-...
Trump pulls US out of international cyber orgs
The Trump administration is withdrawing the United States from a handful of international organizations that work to strengthen cybersecurity.
cyberscoop.com
January 9, 2026 at 12:38 AM
Reposted by Tim Starks
Among the 66 international organizations the administration withdrew from are a handful that work on cybersecurity topics. via @timstarks.bsky.social cyberscoop.com/trump-pulls-...
Trump pulls US out of international cyber orgs
The Trump administration is withdrawing the United States from a handful of international organizations that work to strengthen cybersecurity.
cyberscoop.com
January 8, 2026 at 5:48 PM
Reposted by Tim Starks
For those keeping score, Bellingcat, The New York Times Visual Investigation Team, & Washington Post's Visual Forensic team have all published analysis showing the ICE shooter wasn't in the path of Renee Nicole Good’s vehicle when he shot her, contradicting statements by the President & his cronies
January 8, 2026 at 3:35 PM
Reposted by Tim Starks