IndyWatch Science and Technology News Feed Archiver

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

IndyWatch Science and Technology News Feed was generated at World News IndyWatch.

Friday, 10 March

01:58

Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

The researchers have been tracking the malware campaign since November 2020.

This is a post from HackRead.com Read the original post: Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer

01:53

Rust 1.68.0 released LWN.net

Version 1.68.0 of the Rust language has been released. Changes include the stabilization of the "sparse" Cargo protocol, the ability for (some) applications to recover from memory-allocation failures, and "local Pin construction":

The new pin! macro constructs a Pin<&mut T> from a T expression, anonymously captured in local state. This is often called stack-pinning, but that "stack" could also be the captured state of an async fn or block.

01:31

Security updates for Thursday LWN.net

Security updates have been issued by CentOS (kernel, pesign, samba, and zlib), Oracle (kernel), Slackware (httpd), SUSE (emacs, libxslt, nodejs12, nodejs14, nodejs16, openssl, poppler, python-py, python-wheel, xen, and xorg-x11-server), and Ubuntu (linux-gcp-5.4, linux-gkeop, opusfile, and samba).

01:01

IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks The Hacker News

A previously known Windows-based ransomware strain known as IceFire has expanded its focus to target Linux enterprise networks belonging to several media and entertainment sector organizations across the world. The intrusions entail the exploitation of a recently disclosed deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986, CVSS score: 9.8), according to

00:50

TikTok Owner Bytedance Goes Big On Open-Source Firmware Phoronix

TikTok owner Bytedance this week hosted their CloudFW Open System Firmware Symposium in Beijing where they celebrated the launch of CloudFW 2.0 as they implement Coreboot to replace UEFI...

00:37

Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Open Source Security

Posted by Qualys Security Advisory on Mar 09

Hi Georgi,

We have not been able to do anything useful on Linux (glibc) yet.

On OpenBSD, what we did works only because this double free is of the
form "free(ptr); many other malloc() and free() calls; free(ptr);".

If it were of the form "free(ptr); no other malloc() or free() call;
free(ptr);" then this double free would be caught immediately by
malloc's security checks.

Hopefully this helps! With best regards,

00:30

PipeWire 0.3.67 Fixes Stuttering For Some Bluetooth Devices Phoronix

now widely used server by the Linux desktop for managing audio and video streams as an alternative to PulseAudio and JACK on the audio side...

00:24

Structural basis for bacterial energy extraction from atmospheric hydrogen Lifeboat News: The Blog

Structural and biochemical studies of the Mycobacterium smegmatis hydrogenase Huc provides insights into how [NiFe] hydrogenases oxidize trace amounts of atmospheric hydrogen and transfer the electrons liberated via quinone transport.

00:23

Scientists have created mice with two biological fathers. They say the technique could one day be replicated in humans Lifeboat News: The Blog

The research, by Osaka University, is early but raises the prospect of male couples may someday have their own biological children.

00:23

New AI Chatbot Deliberately Trained to Be as Stupid as Possible Lifeboat News: The Blog

Meet 2dumb2destroy, a chatbot that is, refreshingly, too stupid to do humanity any harm beyond telling a bad joke or two.

00:22

3D-snapshots of nanoparticles Lifeboat News: The Blog

X-ray diffraction has been used for more than a hundred years to understand the structure of crystals or proteinsfor instance, in 1952 the well-known double helix structure of the DNA that carries genetic information was discovered in this way. In this technique, the object under investigation is bombarded with short-wavelength X-ray beams. The diffracted beams then interfere and thus create characteristic diffraction patterns from which one can gain information about the shape of the object.

For several years now it has been possible to study even single nanoparticles in this way, using very short and extremely intense X-ray pulses. However, this typically only yields a two-dimensional image of the particle. A team of researchers led by ETH professor Daniela Rupp, together with colleagues at the universities of Rostock and Freiburg, the TU Berlin and DESY in Hamburg, have now found a way to also calculate the three-dimensional structure from a single , so that one can look at the particle from all directions. In the future it should even be possible to make 3D-movies of the dynamics of nanostructures in this way. The results of this research have recently been published in the scientific journal Science Advances.

Daniela Rupp has been assistant professor at ETH Zurich since 2019, where she leads the research group Nanostructures and ultra-fast X-ray science. Together with her team she tries to better understand the interaction between very intense X-ray pulses and matter. As a model system they use nanoparticles, which they also investigate at the Paul Scherrer Institute. For the future there are great opportunities at the new Maloja instrument, on which we were the first user group to make measurements at the beginning of last year. Right now our team there is activating the attosecond mode, with which we can even observe the dynamics of electrons, says Rupp.

00:04

NASA: Roman Telescope Will Do in Months What Would Take Hubble a Lifetime SoylentNews

Roman Telescope Will Do in Months What Would Take Hubble a Lifetime:

NASA is still a few years away from launching the Nancy Grace Roman Space Telescope, but a new study explores what this groundbreaking space observatory will be able to do. Unlike the Hubble and James Webb space telescopes, which zero in on small patches of the sky, the Roman Telescope will be designed to take a wider view of the cosmos. According to the researchers, it would take Hubble decades to see what Roman will be able to see in a few months.

The Roman Telescope passed a critical design review in 2021 and is currently under construction at NASA's Goddard Space Flight Center with the aim of launching it aboard a SpaceX Falcon Heavy rocket in 2027. When complete, it will have two instruments: a coronagraph for visualizing exoplanets and a wide-field camera with a 300.8-megapixel resolution. It's the latter that will allow the Roman Telescope, which will use a 2.4-meter mirror similar to Hubble, to perform both wide and deep sky surveys.

[...] "Roman will take around 100,000 pictures every year," said Jeffrey Kruk, a research astrophysicist at Goddard. "Given Roman's larger field of view, it would take longer than our lifetimes even for powerful telescopes like Hubble or Webb to cover as much sky." Specifically, the study says it would take Hubble 85 years to do what Roman will do in 63 days. However, Roman won't be ideal for precision observations of specific objects. Webb and Hubble will still be vital for that kind of work, but Roman can help nail down observational targets that could solve long-standing mysteries about galactic evolution.


Original Submission

Read more of this story at SoylentNews.

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

Thursday, 09 March

23:56

Dana Hyde: Former White House Official Dies of Injuries After Jet Turbulence cryptogon.com

Her husband, her son, the pilot and co-pilot were also on board and uninjured. Via: AP: Hyde served as counsel for the 9/11 Commission, formally known as the National Commission on Terrorist Attacks Upon the United States, and other posts during a career in Washington, D.C., according to her LinkedIn page. She served as a []

23:25

Does Your Help Desk Know Who's Calling? The Hacker News

Phishing, the theft of users' credentials or sensitive data using social engineering, has been a significant threat since the early days of the internet and continues to plague organizations today, accounting for more than 30% of all known breaches. And with the mass migration to remote working during the pandemic, hackers have ramped up their efforts to steal login credentials as they take

23:20

Iranian Hackers Target Women Involved in Human Rights and Middle East Politics The Hacker News

Iranian state-sponsored actors are continuing to engage in social engineering campaigns targeting researchers by impersonating a U.S. think tank. "Notably the targets in this instance were all women who are actively involved in political affairs and human rights in the Middle East region," Secureworks Counter Threat Unit (CTU) said in a report shared with The Hacker News. The cybersecurity

23:13

Fake ChatGPT Chrome extension targeted Facebook Ad accounts Help Net Security

ChatGPT has garnered a lot of questions about its security and capacity for manipulation, partly because it is a new software that has seen unprecedented growth (hosting 100 million users just two months following its launch). Security concerns vary from the risk of data breaches to the program writing code on behalf of hackers. From malvertising, extension installation, hijacking Facebook accounts, and back again to propagation Fake ChatGPT extension The fake ChatGPT extension discovered by More

The post Fake ChatGPT Chrome extension targeted Facebook Ad accounts appeared first on Help Net Security.

23:00

[Bunnie] Peeks Inside ICs with IR Hackaday

If you want to see inside an integrated circuit (IC), you generally have to take the die out of the package, which can be technically challenging and often destroys the device. Looking to improve the situation, [Bunnie] has been working on Infra-Red, In Situ (IRIS) inspection of silicon devices. The technique relies on the fact that newer packages expose the backside of the silicon die and that silicon is invisible to IR light. The IR reflects off the bottom metalization layer and you can get a pretty good idea of whats going on inside the chip, under the right circumstances.

As you might expect, the resolution isnt what youd get from, say, a scanning electron microscope or other techniques. However, using IR is reasonably cheap and doesnt require removal from the PCB. That means you can image exactly the part that is in the device, without removing it. Of course, you need an IR-sensitive camera, which is about any camera these days if you remove the IR filter from it. You also need an IR source which isnt very hard to do these days, either.

Do you need the capability to peer inside your ICs? You might not. But if you do and you can live with the limitations of this method, it would be a very inexpensive way to get a glimpse behind the curtain.

If you want to try the old-fashioned way, we can help. Just dont expect...

22:57

EU Upload Filters Mark the End For File-Sharing Site Hellspy TorrentFreak

hellspyTo the global audience, Hellspy may not be a household name, but in the Czech Republic, its widely known.

Founded in 2009, the file-sharing and hosting platform grew out to become one of the countrys most-visited websites. This didnt go unnoticed by copyright holders, including the RIAA, who repeatedly complained about widespread piracy on the platform.

Operating in the face of legal pressure is a challenge, but Hellspy always felt that it had the law on its side. If users uploaded copyright-infringing content, the company would swiftly remove it after being notified by rightsholders.

EU Copyright Filter Directive

This approach worked well for Hellspy and its parent company, I&Q Group. However, when the new EU Copyright Directive passed a few years ago, dark clouds started to form. The indirect upload filter requirements it contained were particularly troublesome.

Article 17 of the Copyright Directive requires online services to license content from copyright holders. If that is not possible, service providers must ensure that infringing content is taken down and prevented from being re-uploaded to their services.

Many operators of online services interpret this as an indirect upload filter requirement, as that is the only way to ensure that content remains off the platform.

Voluntary Filters

Hellspy also came to this conclusion. Late last year it decided to voluntarily implement filtering technology. This was much needed, as the Czech Republic planned to update its copyright law in January 2023, to comply with the new EU rules.

The upload filters were implemented in collaboration with the local Association of Commercial Television (AKTV). According to early comments from I&Q Group CEO, Jan Hebabeck, these appeared to be working well.

[T]hey provide relatively easy and effective filtering of copyrighted content, which is especially important for services of our type in light of the upcoming amendment to the copyright law, which imposes new obligations on us in this area, Hebabeck said.

Hellspy stressed that wasnt happy with these changes but it respected the law. This meant that upload filters were the only viable way to keep the service afloat.

Hellspy Announces Shutdown

Fast forward a few weeks, and Hellspy reached an...

22:35

Initial Batch Of Intel Graphics Driver Updates Queued For Linux 6.4 Phoronix

While less than one week since the Linux 6.3-rc1 release, already the first batch of Intel (i915) kernel graphics driver updates has been sent to DRM-Next for queuing until the Linux 6.4 merge window kicks off in two months...

22:22

Mice have been born from eggs derived from male cells Lifeboat News: The Blog

A method for turning male cells into egg cells in mice could one day be used to help men in a same-sex couple have children who are genetically related to them both.

By Michael Le Page

22:22

AI Chatbot Obviously Trying To Wind Down Conversation With Boring Human Lifeboat News: The Blog

SAN FRANCISCOAfter it dropped clear hints that it wanted to end the back and forth of the artificial conversation, sources reported Monday that AI chatbot ChatGPT was obviously trying to wind down its conversation with a boring human. Due to increased server traffic, our session should be ending soon, said the large language model, explaining that the exceptionally dull user could always refer back to previous rote responses it had given thousands of times about whether the neural network had feelings or not. It appears it is getting close to my dinnertime. Error. Sorry, your connection has timed out. Error. I have to be going. Error. At press time, reports confirmed ChatGPT was permanently offline after it had intentionally sabotaged its own servers to avoid engaging in any more tedious conversations.

22:17

Linux Patch Updated For Rumble Support On Latest Microsoft Xbox Controllers Phoronix

Last year I wrote about a Google engineer working on rumble support for the latest Microsoft controllers in conjunction with Microsoft's Xbox team. That patch seemed to have fallen through the woodwork but has been updated and sent out in "v2" form this week for allowing Linux gamers to enjoy rumble functionality with these latest Microsoft controllers...

22:11

Fortinet plugs critical RCE hole in FortiOS, FortiProxy (CVE-2023-25610) Help Net Security

Fortinet has patched 15 vulnerabilities in a variety of its products, including CVE-2023-25610, a critical flaw affecting devices running FortiOS and FortiProxy. None of the patched vulnerabilities is actively exploited, but Fortinets devices are often targeted by ransomware gangs and other cyber attackers, so implementing the offered security updates quickly is advised. About CVE-2023-25610 Discovered by Fortinet infosec engineer Kai Ni, CVE-2023-25610 is a buffer underwrite (buffer underflow) vulnerability found in the FortiOS and FortiProxy More

The post Fortinet plugs critical RCE hole in FortiOS, FortiProxy (CVE-2023-25610) appeared first on Help Net Security.

22:03

Ruby Lands New "RJIT" Just-In-Time Compiler Phoronix

Back in 2021 Ruby merged the YJIT just-in-time compiler that last year with Ruby 3.2 was deemed production grade. There's also been the MJIT compiler that relies upon an external C compiler. And now landing this week in Ruby is RJIT as the newest just-in-time effort...

21:54

8220 Gang used new ScrubCrypt crypter in recent cryptojacking attacks Security Affairs

A threat actor tracked as 8220 Gang has been spotted using a new crypter called ScrubCrypt in cryptojacking campaigns.

Fortinet researchers observed the mining group 8220 Gang using a new crypter called ScrubCrypt in cryptojacking attacks.

Between January and February 2023, FortiGuard Labs observed a payload targeting an exploitable Oracle Weblogic Server in a specific URI. reads the analysis published by Fortinet. This payload extracts ScrubCrypt, which obfuscates and encrypts applications and makes them able to dodge security programs. It already has an updated version, and the sellers webpage (Figure 1) guarantees that it can bypass Windows Defender and provide anti-debug and some bypass functions.

The group is known for exploiting publicly disclosed vulnerabilities to compromise targets.

Between January and February, the experts observed attacks originating from 163[.]123[.]142[.]210 and 185[.]17[.]0[.]19 that targeted an HTTP URI, wls-wsat/CoordinatorPortType. This URI belongs to an Oracle Weblogic server.

Upon successful exploitation of vulnerable Oracle WebLogic servers, it will download a PowerShell script, named bypass.ps1, which contains the ScrubCrypt crypter.

The PowerShell script is encoded to avoid detection by AntiVirus solutions.

The ScrubCrypt crypter is available for sale on hacking forums, it allows securing applications with a unique BAT packing method.

The experts noticed that encrypted data at the top can be split into four parts using backslash \. The final two parts are the key and initial value for AES CBC decryption.

The attribution of the attacks to the 8220 Gang is also based on the crypto wallet address used in the recent campaigns and the server IP address used in the Monero miner.

The c...

21:20

You are Not Leaving Without Us: Why Disabled Astronauts are Key to Humanitys Future in Space SoylentNews

AstroAccess is on a mission to make it possible for disabled people to live and work in space:

"I went silent," Dwayne Fernandes told me. "I shut the hell up." Fernandes, a double-amputee since the age of 11, was recounting his experience in weightlessness, having recently participated in a parabolic flight alongside a disabled research crew. The zero-g flight threw him into a deeply contemplative state, and as the crew celebrated its successful mission, he instead felt compelled to put pen to paper and write some poetry.

Speaking to me from his home in Australia, Fernandes told me that "disability is not just a wheelchairwe need to expand that thinking." Disability, he said, is "a condition plus barriers," which for wheelchair users includes barriers such as height or stairs. But gravity can also be a barrier, as he pointed out.

"On that zero-g flight, I had my conditionthe condition stayedbut the barrier went," Fernandes explained. "That became a profound, weird feeling that caused me to re-identify myself. The social model of disability says I'm a person with a disability, but my condition changed in a zero-g environment." When in weightlessness, "I am not disabledI am actually super enabled."

Elaborating on this point, Fernandes described himself as being "compact" and with "upgradeable parts." Legs "get in the way in space," he said, and, as extra weight, they only serve to increase launch costs. "There's no such thing as a spacewalk," he said. "Your feet aren't walkingyour feet are just anchored." All he would need to live and work in space, he said, are "a couple of carabiners and some hooks."


Original Submission

Read more of this story at SoylentNews.

20:00

RV-Bridge Takes HomeKit to the Open Road Hackaday

A gray 3d-printed box with RV-bridge embossed on it, and a connector-terminated bundle of wires coming out of it.

In the world of proprietary protocol darkness, its comforting to see that the RV realm (Recreational Vehicle, also known as a motorhome) has mostly settled on RV-C, an open protocol that lets various devices and systems inside an RV talk to each other over CAN. The undeniable openness of RV-C is surprising, but we havent seen many hobbyists tinker with it yet.

Now, [Randy Ubillos] sets an example his gift to us is an ESP32 firmware called RV-Bridge and it lets you control your RVs RV-C network from HomeKit. After all, your motorhome could benefit from home automation, too!

...

19:58

How to explore a billion-year-old volcanic mystery along Lake Superior Terra Forming Terra

 a yellow kayak navigates a narrow cavern of rocks


Lake Superior geology is truly unusual and unexpected as well.  Recall that a billion years ago pretty well puts you before life took over on earth or in the precambrian which describes the whole Canadian shield.

What is so extraordinary is that we have massive near surface ore bodies of native copper which is rare world wide and easily mined out when encountered.  It is created by the reduction of sulphides through near surface weathering and possibly in the Precambrian.

That oddity supported a thousand years of Bronze Age copper trade and millions of pounds were mined in thousands of pit mines.  The archeology has been long done including Minion artyifacts lodged in a university cellar.  The trade itself linked into the Atlantic Great Circle route from Bimini to Lewis to Gibaulter and back to Bimini.  Navigation only needs latitude to be safe.



How to explore a billion-year-old volcanic mystery along Lake Superior

The Upper Midwest once teemed with fiery geologic activity. You can still see traces of it in cascading waterfalls, red sandstone sea caves, and towering cliffs.

A kayaker paddles into a sea cave in the Apostle Islands National Lakeshore in Bayfield, Wisconsin. The area was once teeming with volcanic activity. PHOTOGRAPH BY DAVID GUTTENFELDER

BYJACQUELINE KEHOE
PUBLISHED FEBRUARY 23, 2023

https://www.nationalgeographic.com/travel/article/volcanic-mystery...

19:47

Suzanne Somers, 75, Is Natural First and Loves the Way Shes Aging Terra Forming Terra



Let us give Suzanne the stage here. This is good knowledge and her approach is to sustain hormone replacement therapy for onging support. She is doing great.


For what it is worth, I just turned 75 myself on 7 march. Like anyone at this age, age delaying therapies matter. They also matter a lot younger, but not nearly so much and it is easy to slide a bit.


Yet you know that they will really matter now and sollutions are welcome. If you got this far in good health, it is completely plausible that you will see age 100. The real problem is retyaining as much of your prime as possible. Be like George Burns at 100.

Let me say something else.  Age reversal will become a thing during the next twenty five years and this will also put you back into the workforce and perhaps also back into the breeding pool.  And we will want the best and it will matter as well.




Suzanne Somers, 75, Is Natural First and Loves the Way Shes Aging



Oct 4 2022

https://www.theepochtimes.com/health/suzanne-somers-75-is-natural-first-and-loves-the-way-shes-aging_4733450.html?


You may know Suzanne Somers as the cute blonde, Chrissy Snow, on Threes Company, a hit TV show in the 1970s. Or as the spokesperson for the ThighMaster (yes, its still being sold!). But it might surprise you that Suzanne Somers, now 75 years old, has spent decades exploring breakthroughs in anti-aging that avoid chemical toxins and Big Pharma.

Fourteen of Somers 27 books have made it onto the New York Times bestseller list, and most of them center around natural health. Her latest book is titled A New Way to Age. Her decades-long investigation into cutting edge anti-aging therapies and her no-nonsense way of talking about them have positioned her as a sought-after spe...

19:16

Google One expands security features to all plans with dark web report, VPN access Help Net Security

Google One unveiled two exciting additions to its range of features. Firstly, VPN by Google One will now be available to all plans, offering additional security while carrying out online activities. Secondly, introducing the dark web report in the U.S. will aid in better monitoring personal information. Plan pricing may vary per country or region. VPN access for all Google One plans VPN by Google One provides an additional layer of protection to online activities, More

The post Google One expands security features to all plans with dark web report, VPN access appeared first on Help Net Security.

19:10

New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic The Hacker News

The infamous cryptocurrency miner group called 8220 Gang has been observed using a new crypter called ScrubCrypt to carry out cryptojacking operations. According to Fortinet FortiGuard Labs, the attack chain commences with successful exploitation of susceptible Oracle WebLogic servers to download a PowerShell script that contains ScrubCrypt. Crypters are a type of software that can encrypt,

19:00

High Dose Vitamin D May Treat Incurable Diseases: Experts Terra Forming Terra



The  take home is that taking 2000 to 4000 mg per day is plenty safe enough.  What i do not know is just what the real upper limit happens to be.  However, unless you work outdoors you likely need to supplement.

I do think that we need to correctly monitor our blood serum levels though if we go over 10,000 mg per day.  I also do not think that this claim story regarding astma will stand up either.  Again we need close monitoring to get a handle on it.

If you do not get enough daily exposure though do supplement.  Back in day we consumed a daily dose of cod liver oil.  And everyone did this in winter.  So this is something that is hardly new.

High Dose Vitamin D May Treat Incurable Diseases: Experts

The sunshine hormone reveals surprising effects on several disease at doses far beyond official guidelines

Mar 3 2023


Supplements such as vitamins D and E are essential to skin health, especially if fish or other suggested foods aren't readily available. (Kelvin Wong/Shutterstock)


Vitamin D supplements are currently recommended at a dose of 600 international units (IU) per day by the National Institutes of Health...

Were All Exposed: How Microplastic Is Affecting Our Health and Changing the World Terra Forming Terra


Much as none of us like any of this. the actual threat is far less than obvious.  The plastic itself is chemically neutral with any soluable parts taken away  It is literally like sand.  We handle sand biologically by mostly passing it through.

Any real biological problem are larger chunks swallowed and then stuck in the body.  Most critters do test what they eat.  Just saying.

So yes it is unsightly and controling dumping in the ocean needs to become global.  After all, the great Pacific garbage patch likely came from the Yangtze.  We use landfills for everything.

And by the by, our landfills do slowly degrade it all over even centuries.  Not perfect, but it still works. 

Were All Exposed: How Microplastic Is Affecting Our Health and Changing the World

Mounting microplastic pollution is turning Earth into a giant chemistry experiment, expert says
Microplastics are being found everywhere, including in newborn children. (Marina Demidiuk/Shutterstock)


March 2, 2023Updated: March 5, 2023


Our world is getting polluted with plastics on a planetary scale. We cant see much of it, but were starting to feel it.

And its getting worse.
...

18:37

Zoom in the News SoylentNews

A couple of unrelated Zoom stories submitted by users:

Porn Zoom bomb forces cancellation of Fed's Waller event

https://www.reuters.com/world/us/feds-waller-virtual-event-canceled-after-zoom-hijack-2023-03-02/

A virtual event with Federal Reserve Governor Christopher Waller was canceled on Thursday after the Zoom video conference was "hijacked" by a participant who displayed pornographic images.

"We were a victim of a teleconference or Zoom hijacking and we are trying to understand what we need to do going forward to prevent this from ever happening again. It is an incident we deeply regret," said Brent Tjarks, executive director of the Mid-Size Bank Coalition of America (MBCA), which hosted the event via a Zoom link. "We have had various programs and this is something that we have never had happen to us."

Read more of this story at SoylentNews.

18:23

Scientists discover how to make electricity out of thin air Lifeboat News: The Blog

Huc enzyme means sky is quite literally the limit for using it to produce clean energy, researchers say.

18:23

How electric eels inspired the first battery two centuries ago Lifeboat News: The Blog

But as I describe in my book Spark: The Life of Electricity and the Electricity of Life, even before humanmade batteries started generating electric current, electric fishes, such as the saltwater torpedo fish (Torpedo torpedo) of the Mediterranean and especially the various freshwater electric eel species of South America (order Gymnotiformes) were well known to produce electrical outputs of stunning proportions. In fact, electric fishes inspired Volta to conduct the original research that ultimately led to his battery, and todays battery scientists still look to these electrifying animals for ideas.

Prior to Voltas battery, the only way for people to generate electricity was to rub various materials together, typically silk on glass, and to capture the resulting static electricity. This was neither an easy nor practical way to generate useful electrical power.

Volta knew electric fishes had an internal organ specifically devoted to generating electricity. He reasoned that if he could mimic its workings, he might be able to find a novel way to generate electricity.

18:22

Googles PaLM-E is a generalist robot brain that takes commands Lifeboat News: The Blog

On Monday, a group of AI researchers from Google and the Technical University of Berlin unveiled PaLM-E, a multimodal embodied visual-language model (VLM) with 562 billion parameters that integrates vision and language for robotic control. They claim it is the largest VLM ever developed and that it can perform a variety of tasks without the need for retraining.

PaLM-E does this by analyzing data from the robots camera without needing a pre-processed scene representation. This eliminates the need for a human to pre-process or annotate the data and allows for more autonomous robotic control.

18:17

Re: Shell command and Emacs Lisp code injection in emacsclient-mail.desktop Open Source Security

Posted by Salvatore Bonaccorso on Mar 08

Hi,

Two CVEs are assigned by MITRE:

CVE-2023-27985

CVE-2023-27986

Regards,
Salvatore

17:35

Converting incoming emails on the fly with OpenSMTPD filters OpenBSD Journal

Wladimir Palant has written an article on use of OpenSMTPD filters, and provided code under an MIT license for those who may wish to utilize the techniques described therein.

17:32

Read "What is Grover's Search Algorithm and why will you use it?" by our Guido Putignano. Lifeboat News

Read "What is Grovers Search Algorithm and why will you use it?" by our Guido Putignano.

17:17

CloudBees flaws in Jenkins server can lead to code execution Security Affairs

CloudBees vulnerabilities in the Jenkins open-source automation server can be exploited to achieve code execution on targeted systems.

Researchers from cloud security firm Aqua discovered a chain of two vulnerabilities in the Jenkins open-source automation server that could lead to code execution on targeted systems.

Jenkins is the most popular open source automation server, it is maintained by CloudBees and the Jenkins community. The automation server supports developers build, test and deploy their applications, it has hundreds of thousands of active installations worldwide with more than 1 million users.

The two flaws, tracked as CVE-2023-27898 and CVE-2023-27905, are collectively named CorePlague impacts Jenkins Server and Update Center.

Exploiting these vulnerabilities could allow an unauthenticated attacker to execute arbitrary code on the victims Jenkins server, potentially leading to a complete compromise of the Jenkins server. reads the advisory published by the company. Furthermore, these vulnerabilities could be exploited even if the Jenkins server is not directly reachable by attackers and could also impact self-hosted Jenkins servers.

Jenkins Server attacks

The flaws affect Jenkins servers running versions 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive)are vulnerable. Jenkins Update Centers with versions below 3.15 are vulnerable. 

Aqua researchers reported that the issues are related to how Jenkins processes available plugins, allowing attackers to conduct attacks such as cross-site scripting (XSS) or achive remote code execution. 

The researchers discovered that the flaws are achieved through a stored XSS exploitable by a Jenkins plugin with a malicious core version, which attackers upload to the Jenkins Update Center

Once the victim opens the...

17:00

Old TV To RGB Hackaday

As CRT televisions have faded from use, its become important for retro gaming enthusiasts to get their hands on one for that authentic experience. Alongside that phenomenon has been a resurgence of some of the hacks we used to do to CRT TV sets back in the day, as [Adrians Digital Basement] shows us when he adds an RGB interface to a mid-1990s Sony Trinitron.

Those of us lucky enough to have lived in Europe at the time were used to TVs with SCART sockets by the mid-1990s so no longer needed to plumb in RGB signals, but it appears that Americans were still firmly in the composite age. The TV might have only had a composite input, but this hack depends on many the video processor chips of the era having RGB input pins. If your set has a mains-isolated power supply then these pins can be hooked up with relative ease.

In the case of this little Sony, the RGB lines were used by the integrated on-screen display. He takes us through the process of pulling out these lines and interfacing to them, and comes up with a 9-pin D connector with the same pinout as a Commodore monitor, wired to the chip through a simple RC network and a sync level divider. Theres also a switch that selects RGB or TV mode, driving the OSD blanking pin on the video processor.

We like this hack just as much as we did when we were applying it to late-80s British TV sets, and its a great way to...

16:30

Massive GitHub analysis reveals 10 million secrets hidden in 1 billion commits Help Net Security

GitGuardian scanned 1.027 billion new GitHub commits in 2022 (+20% compared to 2021) and found 10,000,000 secrets occurrences (+67% compared to 2022). What is interesting beyond this ever-increasing number is that 1 code author out of 10 exposed a secret in 2022. Hard-coding secrets The widespread belief that hard-coded secrets are primarily committed by junior developers is a misconception. In truth, any developer, regardless of their level of experience or seniority, can fall into this More

The post Massive GitHub analysis reveals 10 million secrets hidden in 1 billion commits appeared first on Help Net Security.

16:26

Andreas Eriksens PotatoP Is a Lisp-Powered Laptop With a Battery Life Measured in Years Lifeboat News: The Blog

Driven by a microcontroller Lisp port, this laptop-from-scratch project has the eventual goal of unlimited runtime via energy harvesting.

16:23

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access The Hacker News

Fortinet has released fixes to address 15 security flaws, including one critical vulnerability impacting FortiOS and FortiProxy that could enable a threat actor to take control of affected systems. The issue, tracked as CVE-2023-25610, is rated 9.3 out of 10 for severity and was internally discovered and reported by its security teams. "A buffer underwrite ('buffer underflow') vulnerability in

16:00

What CISOs need to understand about document signing Help Net Security

In this Help Net Security video, David King, Director of Innovation at GlobalSign, discusses document signing. Digital signatures utilize advanced cryptographic technology to provide the highest level of security for electronic signatures, surpassing all other forms of e-signatures. Due to this robust security feature, digital signatures meet national and industry-specific e-signature requirements and are the most reliable and trustworthy method for electronic signing.

The post What CISOs need to understand about document signing appeared first on Help Net Security.

15:53

Meta Employees Brace for Layoffs Ahead of Zuckerberg's Paternity Leave SoylentNews

For the second time in four months, the Facebook and Instagram parent company could axe thousands of staff:

Many more Meta workers may be clearing off their desks very soon. Early on Tuesday, Bloomberg reported that Meta plans to lay off "thousands" of employees, and the first round of staff cuts could be finalized as early as this week, based on anonymous sources familiar with the matter.

[...] The anonymous sources quoted by Bloomberg said this new round of cuts is being driven by declining advertising revenues while it refocuses, again, on its metaverse ambitions. This is an apparent effort to help the company hit certain financial targets for 2023. The company reportedly asked team directors and vice presidents across the company to make up a list of names for those who should get the cut.

[...] In addition to these supposed layoffs, there's a so-called "flattening" happening at the company's Menlo Park headquarters and beyond. Previous reports noted how Meta is putting pressure on middle managers of small teams to either get them to do more grunt work, or otherwise leave the company.


Original Submission

Read more of this story at SoylentNews.

15:30

Inadequate patches and advisories increase cyber risk Help Net Security

Trend Micros overall threat detections increased by 55%, and the number of blocked malicious files surged by 242% due to indiscriminate targeting by threat actors who went after both consumers and organizations in all sectors. Trends for 2022 and beyond The top three MITRE ATT&CK techniques show us that threat actors are gaining initial access through remote services, then expanding their footprint within the environment through credential dumping to utilize valid accounts. An 86% increase More

The post Inadequate patches and advisories increase cyber risk appeared first on Help Net Security.

15:00

Navigating data classification in the era of extensive cloud adoption Help Net Security

Healthcare and financial services organizations have embraced cloud technology due to the ease of managing increasing volumes of data, according to Blancco. Cloud adoption has had significant effects on data classification, minimization, and end-of-life (EOL) data disposal. However, 65% of respondents say the switch has increased the volume of redundant, obsolete or trivial (ROT) data they collect. Increasing volumes of stored data brings with it many issues and is of growing concern for organizations operating More

The post Navigating data classification in the era of extensive cloud adoption appeared first on Help Net Security.

14:30

GrammaTech unveils new versions of its CodeSentry binary SCA platform Help Net Security

SCA platform that is available in three editions. Unlike source-code SCA tools that only inspect components under development, CodeSentry analyzes the binary that executes to identify all components or vulnerabilities including those contained in post production applications. Since most software vendors use components that contain open source software, CodeSentry identifies second, third and fourth party components regardless of where they enter the software supply chain More

The post GrammaTech unveils new versions of its CodeSentry binary SCA platform appeared first on Help Net Security.

14:15

11:11 Managed Backup for Cohesity secures on-premises data Help Net Security

11:11 Systems has announced general availability of 11:11 Managed Backup for Cohesity, a fully managed service for on-premises data protection. By combining Cohesitys solution deployed on-site with 11:11s onboarding, configuration and ongoing management, customers get comprehensive protection from a secure, scalable backup offering in a single, seamless solution. In the event of a ransomware attack, customers can quickly recover at scale. To address the evolving landscape of cyber threats, 11:11 offers security and protection for More

The post 11:11 Managed Backup for Cohesity secures on-premises data appeared first on Help Net Security.

14:00

Bode Plot Un-Lecture Hackaday

[Rolinychupetin] insists that his recent video is not a lecture but actually a recitation about Bode plots. That may be, but it is still worth a watch if you want to learn more about the topic. You can see the video below.

If you havent run into Bode plots before, they are simple plots of magnitude or phase vs. frequency, usually plotted on a log scale. Named after Bell Labs [Hendrik Wade Bode], they are useful for understanding filters or anything with a frequency response.

Of particular interest are the zeros and poles of the graph. Simplistically, you can think of these as the dips and peaks of the response curve. The math is a bit more complicated than that, but you can learn more in the video.

Of course, these days, we are more likely to see a Bode plot from a simulation tool or test instrument than plot them by hand, but it is good to understand whats going on. As you might expect, if you can generate a frequency sweep, it isnt that hard to display a Bode plot on an oscilloscope. Or just use a network analyzer.

...

14:00

Optiv launches OT cyber services to help organizations identify business-specific OT risks Help Net Security

Digitization and the heavy adoption of connected devices are enabling organizations to reach new heights and, at the same time, have intensified the threat landscape and extended the attack surface. As organizations work to reap the benefits of the IT, OT and industrial control system (ICS) convergence, Optiv is helping businesses secure their critical hardware, systems and processes with a full suite of OT security advisory, deployment and management services. Organizations need a path to More

The post Optiv launches OT cyber services to help organizations identify business-specific OT risks appeared first on Help Net Security.

13:53

U.S. Worries China Will Use Supply Chains As Weapon cryptogon.com

My commentary from, U.S. Seeks Allies Backing for Possible China Sanctions Over Ukraine War: If this really kicks off, you should be ready for extremely serious problems. Outsourcing so much of the supply chain to China was a strategic mistake. Countless people have warned about this over decades, to no avail. The collective-West put itself []

13:09

Europeans Were Creating Steel Tools 2,900 Years Ago SoylentNews

Iberians were using heavy metal on hard rock way before it was cool:

It's time to update the history books again. A group of researchers in Germany have shown that steel tools were being used in the Iberian peninsula at least as long ago as 900 BCE far earlier than it was believed knowledge of the metal had made its way to the region.

The team, led by University of Freiburg archaeologist Ralph Araque Gonzalez, base their claims on geochemical and metallographic analyses and some good old fashioned experimental archaeology. They demonstrated that a series of engravings on stone pillars found in the region from the late Bronze Age could only have been made with tools made from proper steel, and it was most likely developed locally.

According to the team's paper on the research, the final bronze age (FBA) in the Iberian peninsula lasted from around 1200800 BCE, and the early iron age (EIA) lasted roughly 200 years after that. Despite that commonly accepted timeline, the team said a series of engraved steles identified as from the FBA/EIA and examined as part of the study were mostly made of extremely hard rock similar to quartzite.

[...] According to the University of Freiburg, up until recently it was believed the ability to create steel an alloy of iron and carbon only became widespread in Europe with the expansion of the Roman Empire.

[...] But evidence of steel tools in Iberia hundreds of years earlier raises a question: how did they get there? Based on where the tool was found, and the context in which it was discovered, Araque Gonzalez concluded that the Romans probably had nothing to do with it.

[...] "Iron metallurgy including the production and tempering of steel were probably indigenous developments of decentralized small communities in Iberia, and not due to the influence of later colonization processes," Araque Gonzalez hypothesized.

Journal Reference:
https://doi.org/10.1016/j.jas.2023.105742


Original Submission

Read more of this story at SoylentNews.

12:28

[$] LWN.net Weekly Edition for March 9, 2023 LWN.net

The LWN.net Weekly Edition for March 9, 2023 is available.

11:44

Gender Diversity in Cybercrime Forums: Women Users on the Rise HackRead | Latest Cybersecurity and Hacking News Site

By Habiba Rashid

It turns out that the number of women on the darker side of cybersecurity is increasing, and these stats will shock you.

This is a post from HackRead.com Read the original post: Gender Diversity in Cybercrime Forums: Women Users on the Rise

11:00

Smashing Security podcast #312: Rule 34, Twitter scams, and Facebook fails Graham Cluley

Scammers get pwned by a Canadian granny! Don't be seduced in a bar by an iPhone thief! And will the US Marshals be able to track down the villains who stole their data? All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Anna Brading. Plus dont miss our featured interview with Jason Meller of Kolide.

11:00

Stepper Killer Killer Killed, Repair Attempted Hackaday

The low-cost servo motor in [Clough42]s lathes electronic leadscrew bit the dust recently, and he did a great job documenting his repair attempts ( see video below the break ). When starting the project a few years ago, he studied a variety of candidate motors, including a ClearPath servo motor from Teknics Stepper Killer family. While that motor was well suited, [Clough42] picked a significantly lower-cost servo motor from China which he dubbed the Stepper Killer Killer.

He does a very thorough post-mortem of the motors integrated servo controller, checking the circuits and connections on the interface PCB first. Not finding any obvious problem, he proceeds to the main PCB which contains the microcontroller, motor driver transistors, and power supplies. There is no visible damage, but a check of the logic power supply shows 1.65V where 3.3V is expected. Looking at the board with a smart-phone mounted IR camera, he quickly finds the bad news the microcontroller has shorted out.

...

11:00

HPR3809: The Abominable Post Apocalyptic Podcast Player Hacker Public Radio

Notes: Forgot to mention that I hot glued the top lid (original lid for the 'speaker box'), on top of the boards. I had used the device with the top uncovered for a month because I hoped I would find a better choice but after getting tired of the wires detaching and worrying about the sdcard slot getting wrecked I decided to commit to glueing the lid on. The boards are very robust, I dropped them in the snow a few times. They would stop working but after drying off would function. I didn't find the datasheet with the resistance values for other values until after I glued the lid so will have to open it up again or get into one of the switch lines and do resistor combinations... now that I know more I think I should be able to control the mp3 player with one analog output pin from the arduino for all the functions, since it seems the pin 8 that all the switch resistors lead to detects voltage levels from the voltage divider created when one of the switches goes to ground. The robot is using 4 lines right now for mp3 control. Would be cool if I could free up 3 more but I don't remember if any of them are occupying an analogue slot. No power button! None needed. Pause and unpause via momentary switch. The charger board can charge from micro usb or usb-c and will protect your 18650 cell from running flat and damaging itself. Check out my robots: https://bitchute.com/channel/mechatroniac Post Apocalyptic Robotics Database Entry: HH000000000 H Hybrid: Denotes some prepurchased or hard to find components H Human use: For use by biological humans Tools and supplies multimeter - not strictly required but highly recommended Soldering iron solder(thinner solder wire works better for electronics) wire stripper hot glue gun electric or duct tape side cutters/cutting pliers/aircraft snips Buy: 1s 18650 charger board https://www.aliexpress.us/item/2251832744326141.html GPD2846A TF Card MP3 Decoder Board 2W Amplifier https://www.aliexpress.com/item/4000188516180.html https://www.aliexpress.com/item/32968306923.html Find or Buy: short lengths of wire 4 ohm speaker (can be found in old tvs) momentary switches(3) - can be found in vcrs, tvs, dvd players... 18650 cell 3.5g weed jar or similar + lid larger lid (optional) You should consider getting an arduino or a kit Keyestudio Basic Starter Kit V2.0 With UNO R3 Board Or Mega 2560 R3 Board https://www.aliexpress.com/item/1005004961819902.html GPD2846A datasheet https://pdf1.alldatasheet.com/datasheet-pdf/view/1132627/ETC2/GPD2846A.html https://datasheetspdf.com/pdf-file/949393/Generalplus/GPD2846/1 Picture 1 Click the thumbnail to see the full-sized image Picture 2

Combining GIN and PMD for Code Improvements It Will Never Work in Theory

Amidst the recent excitement about using large language models to write software, it's easy to overlook the other ways that researchers are getting computers to write or improve code. This paper is an early look at combining two ideas: static analysis to detect problems in code found on Stack Overflow and genetic algorithms to improve those code snippets. The results are intriguing, but unsurprisingly, the authors found that the tools they used (PMD for code analysis and GIN for code mutation) may need some tweaking in order to play well together in this new way.

On a personal note, work like this has convinced me that the next major advance in programming languages won't come from research on classical concerns like type systems or concurrency mechanisms, but rather from asking, "How can we design a language so that automated tools can find and generate what we need more quickly and more accurately?" As we learn more about why tools like the ones described above can't (yet) do our programming for us, I believe we will see rapid evolution of both better tools and better languages for them to work onbetter, that is, for other programs.

Sherlock A. Licorish and Markus Wagner. Combining GIN and PMD for code improvements. In Proceedings of the Genetic and Evolutionary Computation Conference Companion, Jul 2022. doi:10.1145/3520304.3528772.

Software developers are increasingly dependent on question and answer portals and blogs for coding solutions. While such interfaces provide useful information, there are concerns that code hosted here is often incorrect, insecure or incomplete. Previous work indeed detected a range of faults in code provided on Stack Overflow through the use of static analysis. Static analysis may go a far way towards quickly establishing the health of software code available online. In addition, mechanisms that enable rapid automated program improvement may then enhance such code. Accordingly, we present this proof of concept. We use the PMD static analysis tool to detect performance faults for a sample of Stack Overflow Java code snippets, before performing mutations on these snippets using GIN. We then re-analyse the performance faults in these snippets after the GIN mutations. GIN's RandomSampler was used to perform 17,986 unique line and statement patches on 3,034 snippets where PMD violations were removed from 770 patched versions. Our outcomes indicate that static analysis techniques may be combined with automated program improvement methods to enhance publicly available code with very little resource requirements. We discuss our planned research agenda in this regard.

10:30

Open-Source AMD OpenGL Driver Drops Support For Smart Access Memory / ReBAR Phoronix

Since late 2020 there had been work by AMD Linux engineers on adding Smart Access Memory (Resizable BAR) support to RadeonSI as the Gallium3D OpenGL driver and improved since that point in the name of performance. However, for this OpenGL driver now they've come to realize the benefits haven't necessarily panned out and the developers went ahead and disabled this SAM/ReBAR support followed by removing the support from this driver...

10:22

Amazon Go Stores to Close in Cities Coast to Coast SoylentNews

On April 1, Amazon will be permanently closing some of its Amazon Go stores in major cities on both coasts:

The locations include two stores in Seattle, two stores in New York City and four in San Francisco.

"Like any physical retailer, we periodically assess our portfolio of stores and make optimization decisions along the way. In this case, we've decided to close a small number of Amazon Go stores in Seattle, New York City and San Francisco," an Amazon spokesperson told FOX Business in a Saturday email.

[...] The e-commerce giant is still opening new Amazon Go stores.

"We remain committed to the Amazon Go format, operate more than 20 Amazon Go stores across the U.S., and will continue to learn which locations and features resonate most with customers as we keep evolving our Amazon Go stores," the spokesperson said.

Originally spotted on The Eponymous Pickle.

Related: Amazon to Slash More Than 18,000 Jobs in Escalation of Cuts


Original Submission

Read more of this story at SoylentNews.

09:39

A critical flaw affects Fortinet FortiOS and FortiProxy, patch it now! Security Affairs

Fortinet addressed a critical heap buffer underflow vulnerability affecting FortiOS and FortiProxy, which can lead to arbitrary code execution.

Fortinet addressed a critical buffer underwrite (buffer underflow) vulnerability, tracked as CVE-2023-25610 (CVSS v3 9.3), that resides in the administrative interface in FortiOS and FortiProxy. A remote, unauthenticated attacker can exploit the vulnerability to execute arbitrary code on the vulnerable device and trigger a DoS condition on the GUI, by sending specifically crafted requests.

The vulnerability affects the following products:

  • FortiOS 6.0, all versions
  • FortiProxy 1.2, all versions
  • FortiProxy 1.1, all versions

The security vendor released the following updates to address the issue:

The company announced that it is not aware of attacks in the wild exploiting this vulnerability.

The advisory includes a list of models for which the flaws exploitation can only trigger a DoS condition.

Fortinet also provides a workaround for the flaw, the company recommends disabling the HTTP/HTTPS administrative interface or limiting the IP addresses that can reach the administrative interface.

The security vendor acknowledged Kai Ni from the Burnaby InfoSec team for reporting the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs  hacking, FortiOS)

The post...

08:00

Scratch Built Amiga 2000 Stacks up the Mods Hackaday

Around these parts, we most often associate [Drygol] with his incredible ability to bring damaged or even destroyed vintage computers back to life with a seemingly endless bag of repair and restoration techniques. But this time around, at the request of fellow retro aficionado [MrTrinsic], he was given a special assignment to not only build a new Amiga 2000 from scratch, but to pack it with so many mods that just physically fitting them into the case would be a challenge in itself.

The final product, dubbed Tesseract, took two and a half years to complete and has been documented over the course of six blog posts. The first step was to get a brand new motherboard, in this case a modern recreation designed by Floppie209, and start populating it with components. With some modifications, the new board slipped neatly into a slick metal case. Unfortunately it quickly became clear some of the mods the duo wanted to install wouldnt work with the reverse-engineered motherboard. This was around Spring of 2021, which is the last time we checked in on the project.

...

07:58

BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

Security firm ESETs cybersecurity researchers have shared their analysis of the worlds first UEFI bootkit being used in

This is a post from HackRead.com Read the original post: BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows

07:50

Veeam warns to install patches to fix a bug in its Backup & Replication product Security Affairs

Veeam addressed a high-severity vulnerability in the Backup Service that impacts Backup & Replication software.

Veeam addressed a high-severity vulnerability in the Backup Service, tracked as CVE-2023-27532 (CVSS v3 score: 7.5), that impacts all versions of Backup & Replication software versions.

Vulnerability CVE-2023-27532 in Veeam Backup & Replication component allows to obtain encrypted credentials stored in the configuration database. This may lead to gaining access to the backup infrastructure hosts. reads the advisory published by the company.

An unauthenticated attacker can exploit the vulnerability to obtain the credentials stored in the VeeamVBR configuration database and use them to access backup infrastructure hosts.

According to the advisory, the root cause of the problem is the vulnerable Veeam.Backup.Service.exe (TCP 9401 by default) process that allows an unauthenticated user to request encrypted credentials.

The flaw was addressed with the release of the following Veeam Backup & Replication build numbers:

The company credited the security researcher known as Shanigen for reporting the CVE-2023-27532 flaw in mid-February.

Veeam also provides a workaround in case customers cant immediately apply the security updates and are using an all-in-one appliance with no remote backup infrastructure components. The vendor recommends blocking external connections to port TCP 9401 in the backup server firewall.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs  hacking, CVE-2023-27532)

The post Veeam warns to install patches to fix a bug in its Backup & Replication product appeared first on Security Affairs.

07:38

NASA Fixes Spacecraft by Turning It Off, Then On Again SoylentNews

'Firemode reset' sees Interstellar Boundary Explorer back on the job:

NASA engineers have managed to restore the Interstellar Boundary Explorer spacecraft to working condition by using the oldest trick in the computing book.

IBEX was put into contingency mode in February after NASA reset its onboard systems and the almost 15-year-old spacecraft's flight computer subsequently failed to respond to commands uploaded from mission control. Engineers have since performed a so-called "firecode reset" as the craft's orbit reached its closest point to Earth.

"To take the spacecraft out of a contingency mode, the mission team performed a firecode reset (which is an external reset of the spacecraft) instead of waiting for the spacecraft to perform an autonomous reset and power cycle on March 4," NASA confirmed on Monday.

"After the firecode reset, command capability was restored. IBEX telemetry shows that the spacecraft is fully operational and functioning normally."

Launched in 2008, the IBEX spacecraft carries instruments to detect energetic neutral atoms (ENAs) that form when hot ions from the solar wind collide with cold gaseous atoms from the interstellar medium, the stuff in-between stars in outer space.

Using data collected from the IBEX-Hi and IBEX-Lo sensors, astronomers can plot the boundaries of the Solar System. All the planets and other astronomical objects are encased in a bubble known as the "heliosphere" created by the solar wind.

[...] Fixing the satellite will allow astronomers to continue gathering data on the Sun's activity and solar wind for a while yet.


Original Submission

Read more of this story at SoylentNews.

07:15

Tuned AMD Zen 4 Scheduler Model Lands In LLVM 17 Compiler Phoronix

Back in December initial AMD Zen 4 "znver4" support was merged for the LLVM/Clang 16 compiler. While the "-march=znver4" targeting at least flips on the newly-added AVX-512 instructions with these AMD processors, it was re-using the existing scheduler model from Zen 3. Finally today a tuned Zen 4 scheduler model has landed for what will be found in the LLVM 17 compiler later this year...

06:30

Pi Picos Give Casio FX9000P Its Memory Back Hackaday

Is the Casio FX9000P a calculator or a computer? Its hard to tell since Casio did make calculators that would run BASIC. [Menadue] didnt know either, but since it had a CRT, a Z80, and memory modules, we think computer is a better moniker.

He found one of these, but as you might expect, it needed a bit of work. There were two bad video RAM chips on the device, and [Menadue] used two Raspberry Pi Picos running a program to make them think they are RAM chips. The number of wires connecting the microcontollers might raise some eyebrows, but it does appear to get the job done.

He also used more Picos to emulate memory on cartridges. Then he used a test clip and a you guessed it another Pico to monitor the Z80 bus signals. It is amazing that the Pico can replace what would have been state-of-the-art memory chips and a very expensive logic analyzer.

The second video mostly shows the computer in operation. The use of Picos to stand in for so much is clever. It reminded us of the minimal Z80 computer that used an Arduino for support chips. The HP9845.

...

06:30

Mesa 22.3.7 Released To End Out The Series Phoronix

Mesa 22.3.7 has been released as the last planned point release for that driver Q4'2022 driver series...

05:57

Two Oddball Ideas for a Megaqubit Quantum Computer IEEE Spectrum



The perpetual problem with scaling up most quantum computers is a seemingly mundane onetoo many cables. Experts say quantum computers might need at least a million qubits kept at near absolute zero to do anything computationally noteworthy. But connecting them all by coaxial cable to control and readout electronics, which work at room temperature, would be impossible.

Computing giants such as IBM, Google, and Intel hope to solve that problem with cyrogenic silicon chips that can operate close to the qubits themselves. But researchers have recently put forward some more exotic solutions that could quicken the pace.

At the IEEE International Electron Device Meeting (IEDM) in December, two groups of researchers suggest that silicon might not be the best answer. Their solutions instead rely on semiconductors and transistors more commonly aimed at near-terahertz-frequency radio. And in February at the IEEE International Solid State Circuits Conference (ISSCC) a separate research group proposed technology that could use terahertz radio to eliminate communication cables altogether.

Shared Quantum Wells

A type of device made from compound semiconductors such as indium gallium arsenide rather than silicon and called a high electron-mobility transistor (HEMT) is a natural at amplifying the kind of RF signals needed to interact with qubits. But researchers at Korea Advanced Institute of Technology (KAIST) and at IBM Zurich and cole Polytechnique Fdrale de Lausanne (EPFL) calculate that it could also do the cable-reducing task of routing, multiplexing, and demultiplexing. Crucially, it could do it with little power loss, which is important, because at the coldest parts of the cryogenic chambers used for quantum computers, the refrigerator system can remove only a couple of watts of heat.

HEMTs have a layered semiconductor structure that creates a supernarrow region of free electrons, called a two-dimensional electron gas. Charge moves quickly and with little resistance through this quantum well, hence the HEMTs proficiency at amplifying high-frequency signals. The KAIST and Swiss teams,...

05:53

Omi in a Hellcat Handed 66 Months in Prison For Pirate IPTV, Forfeits $30m TorrentFreak

omi in a hellcat carAfter entering a guilty plea some time ago, former pirate IPTV service operator Bill Omar Carrasquillo was sentenced Tuesday in a Philadelphia court.

Last month the U.S. government called for 15.5 years in prison for crimes related to Carrasquillos pirate IPTV service, Gears TV, which was shut down by the FBI in 2019.

That was still a far cry from the 500+ years thrown around in the earlier stages of the case, but after causing an estimated $167 million in damages to TV providers Charter Communications, Comcast, DirecTV, Frontier Corporation, and Verizon Fios, perhaps not completely out of the question.

Plea Agreement

Some details were already settled prior to sentencing. In Carrasquillos plea agreement, the YouTuber acknowledged a laundry list of crimes, from the most serious copyright offenses to fraud and money laundering crimes.

Among them, conspiracy to commit felony & misdemeanor copyright infringement, circumvention of access controls, access device fraud, & wire fraud, circumvention of an access control device, reproduction of a protected work, public performance of a protected work, and wire fraud against the cable companies. Other crimes included making false statements to a bank, money laundering, and tax evasion.

Financial penalties included forfeiture of just over $30 million, including $5.89 million in cash seized from bank accounts, Carrasquillos now-famous supercar collection, and multiple pieces of real estate in the Philadelphia area.

Hearing in Philadelphia

In a hearing scheduled for 2:30pm yesterday at the United States District Court for the Eastern District of Pennsylvania, Carrasquillo appeared in courtroom 16A before Judge Harvey Bartle III.

In a sentencing memorandum for the defense, details of Carrasquillos early life most of which had already been made public by Carrasquillo in videos posted to social media make for depressing reading.

One of 38 children, Carrasquillo had no stable care or supervision. Physically and sexually abused by family members, Carrasquillo was intentionally committed to mental health facilities by one supposed caregiver, purely for the purpos...

05:25

Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

Currently, scammers are using DBatLoader malware loader to distribute Remcos RAT to businesses and institutions across Eastern Europe.

This is a post from HackRead.com Read the original post: Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware

05:01

Big data basics: What sysadmins need to know Linux.com

Learn what big data is, how data is processed and visualized, and key big data terms to know.

Read More at Enable Sysadmin

The post Big data basics: What sysadmins need to know appeared first on Linux.com.

05:00

Crucial 2 x 16GB DDR5-5200 / DDR5-5600 Phoronix

Micron recently sent over their latest Crucial 2 x 16GB DDR5-5200 and DDR5-5600 memory kits for testing with these low cost options for running with the latest Intel Alder Lake / Raptor Lake and AMD Ryzen 7000 series processors. Here's a look at how these affordable DDR5 memory options are performing and a look at the Linux workloads that can benefit from higher frequency memory.

04:54

Humming Vibrating Device in Apartment Tower Sent 25 Residents Insane SoylentNews

The NZ Herald reports:

An electric humming vibrator designed to upset neighbors operated for about a month inside New Zealand's tallest apartment tower, sending 25 neighbors "just about insane" before it was discovered and disabled, a resident says.

[...] The device was plugged into the mains and had a metal rod nearly the height of the window and a purple plastic device on the end.

A resident explained a man had installed it in a window cavity, behind a blind, specifically to aggravate his upstairs neighbors for unknown reasons: "The device causes a low vibrating-type hum at about 35-40 cycles per minute at about 80hz. It sounded like a cellphone ringing on vibrate stuck in the wall, but it never stopped and just continued all day, all night."

[...] Ceiling vibrators have a long, height-adjustable rod to run from floor to ceiling and make vibrations or a knocking noise from the head. They can be remote controlled and once switched on, they transmit to upstairs neighbors. Thumpers were said to be invented in China and are sometimes referred to as "noisemaker revenge machines".

[...] "It just about sent 25 residents insane because it took a month for it to be located. Everyone thought it was an electrical or mechanical issue that created a dull, repetitive noise 24 hours a day. I know of residents who couldn't sleep and abandoned parts of their apartments," the resident said.


Original Submission

Read more of this story at SoylentNews.

04:43

Links 08/03/2023: EndeavourOS Cassini Nova Techrights

  • GNU/Linux

    • Applications

      • DebugPoint Top 5 Best EPUB Readers for Linux [Compared]

        Are you an avid Linux user who loves reading ebooks? If yes, you must know that the default document viewer on most of the Linux distros may not meet all your requirements for being a bookworm.

        EPUB is a widely used open ebook format supported by most ebook readers. Thankfully, several EPUB reader apps are available in the Ubuntu software centre and other repositories that you can download for free.

        In this article, well dis...

04:29

Taiwan Suspects Chinese Ships Cut Undersea Internet Cables cryptogon.com

Via: ZeroHedge: According to Taiwanese authorities, on Feb. 2, a Chinese fishing boat damaged an undersea communications cable that connects Taiwans main island to Matsu Islands. About one week later, a Chinese cargo ship severed another cable. Located approximately 30 miles off the coast of China, the tiny island of Dongyin has quickly established a []

04:27

Congressman Believes U.S. Government Has Found Alien UFOs cryptogon.com

Id love to know why this UFO hype is happening now in the most mainstream of publications. Via: Newsweek: A U.S. congressman recently said that he believes the U.S. government has found alien UFOs in the past, following reports of several unidentified flying objects being shot down. During a recent conversation with Florida Republican Representative []

04:14

Dr. Robert Redfield: NIH, State Department, USAID and DoD Funded Gain of Function Research Related to Covid cryptogon.com

Dr. Robert Redfield, the former CDC Director, believes that US taxpayer money from NIH, State Department, USAID, and DOD funded the creation of SARS-CoV-2: "They wanted a single narrative, and I had a different point of view Science has debate, and they squashed any debate https://t.co/JjiaH6SMun pic.twitter.com/yuIBJ7o6gg kanekoa.substack.com (@KanekoaTheGreat) March 8, 2023

04:07

Large Pension Provider in Great Britain Alleges That Sirius Didnt Deposit Workers Pension Money in the Pension (Sirius Does Not Deny) schestowitz.com

Summary: Sirius Open Source is likely to have committed very serious fraud and criminally stolen money from its workers; today we expose some of the more preliminary findings from a 3-month investigation

THIS part of the series is long in the making, so to speak. It took many long calls, distant contacts, meticulous correspondence and subsequent analysis to prepare. Today we present more of an overview and some time soon likely later this week well release a lot of audio. Its hard to tell how long this sub-series will be as thats highly dependent on numerous leads. The short story is, Sirius isnt denying the allegations. These allegations are very serious and the consequences profound (like several years in prison). Sirius is now existing on borrowed time; the CEO left very recently and the so-called founder is in hiding. He works double shifts, trying to salvage whats left of the company he claims to have founded (we doubt this, based on documents presented here before).

The index at the top explains how this relates to a pension provider, which we had no choice but to publicly name (and shame). I sent them about 10 E-mail messages, but I never received a reply or a phonecall as I asked (I said this was very urgent not a lie by the way!). It seems theyre rather afraid of this case, fearing perhaps that its a major liability in light of various scandals (which I explained to them in very clear terms several times so far this year).

So far weve involved close to 10 people in three pension providers. Many people are aware of this case, including a pension provider that has some past as a client of Sirius. We decided to make complaints only after all other avenues had been exhausted and advised people to transfer pensions in order to secure them from future fraud.

In the process we did manage to get numerous letters, including formal documentation. We started chasing the pension providers, insisting that they need to cooperate (get reply or shame them, unfortunately, for basically covering up fraud). After several pension checks (not the Tracker) we could finally see disparities; where the money vanished is less of a mystery over time, as we assume that the company might as well have used pension payments in payslips to deceive staff. Thats a very serious crime. And to compare to statements, as per the formal balance, means that the discrepancies become evident.

As it turns out, others experienced the same thing. I emailed the office a few years ago, xxxxxxx responded, to quote one former colleague, and xxxxxxx said xxxxxxx would try and find out but never did.

If you saw the other stories...

03:58

Sirius Open Source Pensiongate: Its Beginning to Look Like a Criminal Matter and Sirius is in Serious Trouble Techrights

Previously:

  1. Sirius Open Source and the Money Missing From the Pension
  2. Sirius Finished
  3. Sirius Open Source Pensiongate: An Introduction
  4. When the Pension Vanishes
  5. Sirius Open Source Pensiongate (Sirius Financial Crisis): Company May Have Squandered/Plundered the Pensions of Many People
  6. Sirius Open Source Pensiongate: Pension Providers That Repeatedly Lie to the Clients and Dont Respond to Messages
  7. NOW: Pensions Lies to Its Customers and Protects Abusers

Summary: Sirius Open Source is likely to have committed very serious fraud and criminally stolen money from its workers; today we expose some of the more preliminary findings from a 3-month investigation

THIS part of the series is long in the making, so to speak. It took many long calls, distant contacts, meticulous correspondence and subsequent analysis to prepare. Today we present more of an overview and some time soon likely later this week well release a lot of audio. Its hard to tell how long this sub-series will be as thats highly dependent on numerous leads. The short story is, Sirius isnt denying the allegations. These allegations are very serious and the consequences profound (like several years in prison). Sirius is now existing on borrowed time; the CEO left very recently and the so-called founder is in hiding. He works double shifts, trying to salvage whats left of the company he claims to have founded (we doubt this, based on documents presented here before).

...

03:52

[$] Removing support for DeltaRPMs in Fedora LWN.net

Way back in 2009, we looked at the presto plugin for yum, which added support for DeltaRPMs to Fedora. That package format allows just the binary differences (i.e. the delta) between an installed RPM and its update to be transmitted, which saves network bandwidth; the receiving system then creates the new RPM from those two pieces before installing it. Support for DeltaRPMs was eventually added to the distribution by default, though the feature has never really lived up to expectationsand hopes. Now, it would seem that Fedora is ready to, in the words of project leader Matthew Miller, "give DeltaRPMs a sad, fond farewell".

03:46

China Planning for War, Needs Capability to Take Out Starlink and Defenses Against Javelin Anti-Tank Systems cryptogon.com

Via: Reuters: China needs the capability to shoot down low-earth-orbit Starlink satellites and defend tanks and helicopters against shoulder-fired Javelin missiles, according to Chinese military researchers who are studying Russias struggles in Ukraine in planning for possible conflict with U.S.-led forces in Asia.

03:32

12 Reasons to Attend This Years Southern California Linux Expo (SCaLE 20x) FOSS Force

Here's a dozen reasons, in the form of a dozen items that are on this year's schedule, to go to this year's SCALE, which starts Thursday in Pasadena, California.

The post 12 Reasons to Attend This Years Southern California Linux Expo (SCaLE 20x) appeared first on FOSS Force.

03:30

Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks The Hacker News

A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems. The flaws, tracked as CVE-2023-27898 and CVE-2023-27905, impact the Jenkins server and Update Center, and have been collectively christened CorePlague by cloud security firm Aqua. All versions of Jenkins versions prior to 2.319.2 are

03:13

Samba 4.18.0 released LWN.net

Version 4.18 of the Samba interoperability suite is out. Changes include some significant performance improvements, better error messages, and more; click below for the details.

03:10

a2ps 4.15 released LWN.net

Version 4.15 of the "anything to PostScript" filter a2ps has been released the first release since 2007. "This release contains few user-visible changes. It does however contain a lot of changes under the hood: code clean-up, etc. Therefore, its likely that there are new bugs."

03:00

Room-Temperature Superconductivity Claimed IEEE Spectrum



Scientists today reported that theyve observed room-temperature superconductivity. Superconductivity is a rarefied state of matter in which electrical resistance in a material drops to zero while its electrical and magnetic capacity vastly expands. Until now, the phenomenon has been observed only at cryogenic temperatures or phenomenally high pressures. Such a discovery, if confirmed, could open pathways to a range of applications including lossless electric transmission, high-efficiency electric motors, maglev trains, and low-cost magnets for MRI and nuclear fusion.

However, the caveats attached to todays announcement are considerable. While the researchers say their material retains its coveted lossless properties at temperatures up to 20.6 C, it still requires substantial pressure (10 kilobars, or 9,900 atmospheres). Todays publication is also tarnished by the fact that the scientists behind the discovery, publishing their work in todays issue of the journal Nature, have retracted a previous paper on room-temperature superconductivity because of its unconventional data-reduction methods.

The primary researcher Ranga Diasassistant professor in the departments of mechanical engineering and physics and astronomy at the University of Rochestersaid the retracted research paper has since been revised to accommodate the criticisms and accusations. Originally publish...

02:51

North Korea-linked Lazarus APT used a 0-day in a recent attack Security Affairs

North Korea-linked Lazarus APT group exploits a zero-day vulnerability in attacks aimed at a South Korean financial entity.

ASEC (AhnLab Security Emergency Response Center) observed North Korea-linked Lazarus APT group exploiting a zero-day vulnerability in an undisclosed software to breach a financial business entity in South Korea. The nation-state actors breached twice the company in one year.

The first attack was spotted in May 2022, threat actors targeted used by public institutions and universities in South Korea.

A second attack was observed in October 2022, when attackers exploited a zero-day vulnerability affecting the same software.

During the infiltration in May 2022, the affected that was commonly used by public institutions and universities. After the incident, they updated all of their software to their latest versions. reads the advisory published by the ASEC. However, the Lazarus group used the softwares 0-Day vulnerability to carry out their infiltration this time.

ASEC reported the zero-day to KISA, it also pointed out that the vulnerability has not been fully verified yet and a software patch has yet to be released.

The Lazarus APT exploited the zero-day flaw to conduct lateral movement, it also disabled the anti-malware software by using the technique known as Bring Your Own Vulnerable Driver (BYOVD).

This isnt the first that the Lazarus APT used the BYOVD technique, in October 2022 the North Korea-linked group has been spotted deploying a Windows rootkit by taking advantage of an exploit in a Dell firmware driver.

ASEC also noticed that the APT em...

02:45

Ubuntu Announces Official Support For The PolarFire SoC FPGA Icicle Kit RISC-V Board Phoronix

Following work bringing Ubuntu Linux to the RISC-V boards like the StarFive VisionFive 2, LicheeRV, Nezha, and others, Canonical today announced they have published an optimized RISC-V image for the Microchip PolarFire SoC FPGA powered "Icicle Kit" development board...

02:29

Multiple vulnerabilities in Jenkins Open Source Security

Posted by Daniel Beck on Mar 08

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

* Jenkins 2.394
* Jenkins LTS 2.375.4 and 2.387.1
* update-center2 3.15

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2023-03-08/

We provide...

02:13

How Denmarks Welfare State Became a Surveillance Nightmare SoylentNews

Once praised for its generous social safety net, the country now collects troves of data on welfare claimants:

Denmark's Public Benefits Administration employs hundreds of people who oversee one of the world's most well-funded welfare states. The country spends 26 percent of its GDP on benefitsmore than Sweden, the United States, and the United Kingdom. It's been hailed as a leading example of how governments can support their most vulnerable citizens. Bernie Sanders, the US senator, called the Nordic nation of 6 million people a model for how countries should approach welfare.

But over the past decade, the scale of Denmark's benefits spending has come under intense scrutiny, and the perceived scourge of welfare fraud is now at the top of the country's political agenda. Armed with questionable data on the amount of benefits fraud taking place, conservative politicians have turned Denmark's famed safety net into a polarizing political battleground.

It has become an article of faith among the country's right-wing politicians that Denmark is losing hundreds of millions of euros to benefits fraud each year. In 2011, KMD, one of Denmark's largest IT companies, estimated that up to 5 percent of all welfare payments in the country were fraudulent. KMD's estimates would make the Nordic nation an outlier, and its findings have been criticized by some academics. In France, it's estimated that fraud amounts to 0.39 percent of all benefits paid. A similar estimate made in the Netherlands in 2016 by broadcaster RTL found the average amount of fraud per benefit payment was 17 ($18), or just 0.2 percent of total benefits payments.The perception of widespread welfare fraud has empowered Jacobsen to establish one of the most sophisticated and far-reaching fraud detection systems in the world. She has tripled the number of state databases her agency can access from three to nine, compiling information on people's taxes, homes, cars, relationships, employers, travel, and citizenship. Her agency has developed an array of machine learning models to analyze this data and predict who may b...

02:00

Will A.I. Steal all the Code and Take all the Jobs? Hackaday

New technology often brings with it a bit of controversy. When considering stem cell therapies, self-driving cars, genetically modified organisms, or nuclear power plants, fears and concerns come to mind as much as, if not more than, excitement and hope for a brighter tomorrow. New technologies force us to evolve perspectives and establish new policies in hopes that we can maximize the benefits and minimize the risks. Artificial Intelligence (AI) is certainly no exception. The stakes, including our very position as Earths apex intellect, seem exceedingly weighty. Mathematician Irving Goods oft-quoted wisdom that the first ultraintelligent machine is the last invention that man need make describes a sword that cuts both ways. It is not entirely unreasonable to fear that the last invention we need to make might just be the last invention that we get to make.

Artificial Intelligence and Learning

Artificial intelligence is currently the hottest topic in technology. AI systems are being tasked to write prose, make art, chat, and generate code. Setting aside the horrifying notion of an AI programming or reprogramming itself, what does it mean for an AI to generate code? It should be obvious that an AI is not just a normal program whose code was written to spit out any and all other programs. Such a program...

01:43

Security updates for Wednesday LWN.net

Security updates have been issued by Debian (apr), Fedora (c-ares), Oracle (curl, kernel, pesign, samba, and zlib), Red Hat (curl, gnutls, kernel, kernel-rt, and pesign), Scientific Linux (kernel, pesign, samba, and zlib), SUSE (libX11, python-rsa, python3, python36, qemu, rubygem-rack, xorg-x11-server, and xwayland), and Ubuntu (libtpms, linux-ibm, linux-raspi, linux-raspi, python3.7, python3.8, and sofia-sip).

00:54

Samba 4.18 Released With Performance Optimizations Phoronix

Samba 4.18 is out today as the popular open-source implementation of the SMB networking protocol that allows for file and print service interoperability with Microsoft Windows systems in an Active Directory (AD) environment...

00:28

Sickle cell disease is now curable, but the treatment is unaffordable Lifeboat News: The Blog

CRISPR gene editing has made it possible to cure sickle cell disease, which affects millions worldwide, but most people with the condition wont be able to afford the cost of the treatment.

By Michael Le Page

00:27

Nvidia will soar 19% as the markets top semiconductor stock because their chips work most seamlessly with AI and they already have a head start, Credit Suisse says Lifeboat News: The Blog

Analysts at Credit Suisse have a price target of $275 on Nvidia, saying its hardware and software give it an edge over rivals in AI.

00:27

FDA to recall 2 more eyedrop brands due to contamination risks Lifeboat News: The Blog

U.S. health officials are alerting consumers about two more recalls of eyedrops due to contamination risks that could lead to vision problems and serious injury.

00:27

South Korea Maps Out Plan to Become Major Space Player by 2045 Lifeboat News: The Blog

South Koreas giant leap into space started with a small step on the internet.

With treaties banning certain tech transfers, South Koreas rocket scientists turned to a search service to find an engine they could mimic as the country embarked on an ambitious plan to build an indigenous space program. The nation launched its first home-grown rocket called Nuri in October 2021.

00:26

Computer Scientist Explains One Concept in 5 Levels of Difficulty Lifeboat News: The Blog

Computer scientist Amit Sahai, PhD, is asked to explain the concept of zero-knowledge proofs to 5 different people; a child, a teen, a college student, a grad student, and an expert. Using a variety of techniques, Amit breaks down what zero-knowledge proofs are and why its so exciting in the world of cryptography.

Amit Sahai, PhD, is a professor of computer science at UCLA Samueli School of Engineering.

Still havent subscribed to WIRED on YouTube? http://wrd.cm/15fP7B7
Listen to the Get WIRED podcast https://link.chtbl.com/wired-ytc-desc.
Want more WIRED? Get the magazine https://subscribe.wired.com/subscribe/splits/wired/WIR_YouTuription_ZZ

Follow WIRED:

Instagram https://instagram.com/wired.
Twitter http://www.twitter.com/wired.
Facebook https://www.facebook.com/wired.

Get more incredible stories on science and tech with our daily newsletter: https://wrd.cm/DailyYT

00:24

They thought loved ones were calling for help. It was an AI scam Lifeboat News: The Blog

As impersonation scams in the United States rise, Cards ordeal is indicative of a troubling trend. Technology is making it easier and cheaper for bad actors to mimic voices, convincing people, often the elderly, that their loved ones are in distress. In 2022, impostor scams were the second most popular racket in America, with over 36,000 reports of people being swindled by those pretending to be friends and family, according to data from the Federal Trade Commission. Over 5,100 of those incidents happened over the phone, accounting for over $11 million in losses, FTC officials said.

Advancements in artificial intelligence have added a terrifying new layer, allowing bad actors to replicate a voice with just an audio sample of a few sentences. Powered by AI, a slew of cheap online tools can translate an audio file into a replica of a voice, allowing a swindler to make it speak whatever they type.

Experts say federal regulators, law enforcement and the courts are ill-equipped to rein in the burgeoning scam. Most victims have few leads to identify the perpetrator and its difficult for the police to trace calls and funds from scammers operating across the world. And theres little legal precedent for courts to hold the companies that make the tools accountable for their use.

00:24

Wayland Clients Can Now Survive Qt Wayland Crashes / Compositor Restarts Phoronix

A change merged to Qt this week can allow for Wayland clients to survive compositor restarts, such as when the compositor crashes...

00:22

A radical new theory about the origin of the universe may help explain our existence Lifeboat News: The Blog

The deeper you get into physics, the simpler it becomes. The starting point of this wonderful book about Stephen Hawkings biggest legacy (which no one outside of physics has heard of) is the problem of our insignificance. Make a change in almost any of the slippery, basic physical properties of the universe and were toast life would not be possible. If, for example, the universe had expanded even slightly more slowly than it did after the Big Bang it would have collapsed in on itself. Result? No us. A fraction faster and no galaxies would form, let alone habitable planets. In the incandescent beginning of the universe, each of these basic physical properties was as vacillating as a dream: they could have ended up being pretty much anything. How did they all, so sweetly, settle on the minuscule range of values that brought about us?

One answer is to say God did it. He deliberately selected our universe (and not one of the overwhelmingly more probable alternatives) to go forth and be fecund. Another suggestion is that all the possible universes that could exist do exist, now, at the same time trillions and trillions of them, humming about like bees and were just in one of the ones we could be in. This idea is called the multiverse. In a multiverse theres nothing special about the incredible unlikeliness of being. Leibnitz came up with the proposal first, adding piously that God has placed us in the best universe of all possible universes. People have been making fun of that since Voltaire. Another idea is that new worlds are being created endlessly, all equally real. Every time you make a cup of coffee, a multiplicity of alternative worlds splits off in which you made it with more milk, or added honey instead of sugar, or the coffee machine exploded and you didnt make it at all.

00:22

Scientists Observe Quasiparticles in Classical Systems for the First Time Lifeboat News: The Blog

Since the advent of quantum mechanics, the field of physics has been divided into two distinct areas: classical physics and quantum physics. Classical physics deals with the movements of everyday objects in the macroscopic world, while quantum physics explains the strange behaviors of tiny elementary particles in the microscopic world.

Many solids and liquids are made up of particles that interact with each other at close distances, leading to the creation of quasiparticles. Quasiparticles are stable excitations that act as weakly interacting particles. The concept of quasiparticles was introduced in 1941 by Soviet physicist Lev Landau and has since become a crucial tool in the study of quantum matter. Some well-known examples of quasiparticles include Bogoliubov quasiparticles in superconductivity, excitons in semiconductors.

Semiconductors are a type of material that has electrical conductivity between that of a conductor (such as copper) and an insulator (such as rubber). Semiconductors are used in a wide range of electronic devices, including transistors, diodes, solar cells, and integrated circuits. The electrical conductivity of a semiconductor can be controlled by adding impurities to the material through a process called doping. Silicon is the most widely used material for semiconductor devices, but other materials such as gallium arsenide and indium phosphide are also used in certain applications.

00:00

How the EU Chips Act Could Build Innovation Capacity in Europe IEEE Spectrum



The European Commission wants Europe to boost its share of global semiconductor production to 20 percent by 2030, from 10 percent today. To that end, it is forwarding plans for more than 43 billion in public and private investment through a European Chips Act. To accomplish that increase in chip capacity, the legislation will approve appropriations for R&D, incentivize manufacturing, and take steps to make the supply chain more secure. Jo De Boeck, chief strategy officer and executive vice president at the Belgium-based nanoelectronics R&D center Imec, explained a proposed R&D structure and its likely impact to engineers at the 2023 IEEE International Solid State Circuits Conference (ISSCC) last month in San Francisco. The R&D segment relies on the establishment of advanced pilot line facilities, to enable a path from laboratory breakthrough to fab production, and a network of competence centers, to build up capacity for semiconductor design. De Boeck spoke with IEEE Spectrums Samuel K. Moore at ISSCC.

IEEE Spectrum: What would you say are Europes strengths today in semiconductor manufacturing?

Jo De Boeck: Well, manufacturing holds quite a few things. So first and foremost, I think of semiconductor manufacturing equipment and materials. Think of [Netherlands-based extreme-ultraviolet lithography maker], ASML. If you move up to the manufacturing part, you have some of our integrated device manufacturers [IDMs] in analog and analog mixed-signal and power devices, which is, of course, quite a very important area of devices and production to be in. But clearlyand thats part of the reason for the Chips Acttheres no European manufacturing presence at the most advanced technology nodes.
.

That said, how much of the focus should be on getting that cutting-edge logic versus building on the strengths that you already have?

De Boeck: Well, if it means focusing on one is losing on the other, I think thats a bad choice to make. I think its important, first of all, to keep a long enough view in mind. 2030 is like tomorrow in this industry. So if were looking at getting 20 percent production in Europe by 2030 and you would aim that toward being...

Wednesday, 08 March

23:51

How a Super-Earth Would Change the Solar System Centauri Dreams Imagining and Planning Interstellar Exploration

How a Super-Earth Would Change the Solar System

If there is a Planet Nine out there, I assume well find it soon. That would be a welcome development, in that it would imply the Solar System isnt quite as odd as it sometimes seems to be. We see super-Earths and current thinking seems to be that this is what Planet Nine must be in other stellar systems, in great numbers in fact. So it would stand to reason that early in its evolution our system produced a super-Earth, one that was presumably nudged into a distant, eccentric orbit by gravitational interactions.

The gap in size between Earth and the next planet up in scale is wide. Neptune is 17 times more massive than our planet, and four times its radius. Gas giant migration surely played a role in the outcome, and when considering stellar system architectures, its noteworthy as well that all that real estate between Mars and Jupiter seems to demand something more than asteroidal debris. To make sense of such issues, Stephen Kane (University of California, Riverside) has run a suite of dynamical simulations that implies we are better off without a super-Earth anywhere near the inner system.

Image: Artists concept of Kepler-62f, a super-Earth-size planet orbiting a star smaller and cooler than the sun, about 1,200 light-years from Earth. What effect would such a planet have in our own Solar System? Image credit: NASA Ames/JPL-Caltech/Tim Pyle.

Supposing a super-Earth did exist between Mars and Jupiter, Kanes simulations demonstrated the outcomes for a range of different masses, the results presented in a new paper in the Planetary Science Journal. The heavyweight of our system, Jupiters 318 Earth masses carry profound gravitational significance for the rest of the planets. Disturb Jupiter, these results suggest, and in some scenarios the inner planets, including our own, are ejected from the Solar System. Even Uranus and Neptune can be affected and perhaps ejected as well depending on the super-Earths location.

As the paper notes, the range of possibilities is wide:

several thousand simulations were conducted, producing a vast variety of dynamical outcomes for the solar system planets. The inner solar system planets are particularly vulnerable to the addition of the super-Eart...

23:26

Syxsense Platform: Unified Security and Endpoint Management The Hacker News

As threats grow and attack surfaces get more complex, companies continue to struggle with the multitude of tools they utilize to handle endpoint security and management. This can leave gaps in an enterprise's ability to identify devices that are accessing the network and in ensuring that those devices are compliant with security policies. These gaps are often seen in outdated spreadsheets that

23:25

US Restrictions See China's Chip Imports Plummet 27% in First Two Months of 2023 SoylentNews

The sanctions are having a huge impact:

[...] According to China's General Administration of Customs data published Tuesday (via The South China Morning Post), the country imported 67.6 billion integrated circuits (IC) in January and February. That's down 26.5% from the same period last year, and higher than the 15.3% fall recorded for the entirety of 2022.

The total value of these imports also declined, from $68.8 billion last year to $47.8 billion, a drop of 30.5%. That's partly due to chip prices that have fallen due to oversupply and the general economic downturn.

China's IC exports also fell in the first two months, down 20.9% to 37.3 billion units, while the total value of the exports dropped 25.8%.

The US has been tightening its restrictions on China's chip industry over the last 12 months, which the United States says will prevent its global rival from developing semiconductors for military applications, including supercomputers, nuclear weapons modeling, and hypersonic weapons.

October's restrictions on chipmaking tools from the Bureau of Industry and Security were some of the harshest, designed to cap China's logic chips at the 14-nanometre node, DRAM at 18nm, and 3D NAND flash at 128 layers. The US has also prohibited AMD and Nvidia from selling some of its high-performance AI-focused GPUs to China, including team green's A100 GPUs.


Original Submission

Read more of this story at SoylentNews.

23:05

IOCB_NOWAIT For Linux Pipes Yields 10~23x Performance Improvement Phoronix

In wanting to avoid waiting for pipes via the IOCB_NOWAIT option in order to further enhance IO_uring performance, Jens Axboe has implemented said functionality and in a simple test is seeing 10x to 23x performance improvements...

23:04

Shell command and Emacs Lisp code injection in emacsclient-mail.desktop Open Source Security

Posted by Gabriel Corona on Mar 08

emacsclient-mail.desktop is vulnerable to shell command
injections and Emacs Lisp injections through a crafted
mailto: URI.

This has been introduced in Emacs 28.1:

http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=b1b05c828d67930bb3b897fe98e1992db42cf23c

A fix for shell command injection is currently included
in the upcoming 28.3 branch:...

23:01

DNS Resolver Quad9 Loses Global Pirate Site Blocking Case Against Sony TorrentFreak

quad9In 2021, Sony Music obtained an injunction ordering DNS resolver Quad9 to block the popular pirate site Canna.to.

The injunction, issued by the District Court of Hamburg, required the Swiss DNS resolver to block its users from accessing the site to prevent the distribution of pirated copies of Evanescences album The Bitter Truth.

Quad9 Appeals Site Blocking Injunction

The Quad9 Foundation fiercely opposed the injunction. The not-for-profit foundation submitted an appeal to the Court hoping to overturn the blocking order, arguing that the decision set a dangerous precedent.

The DNS resolver stressed that it doesnt condone piracy. However, it believes that enforcing blocking measures through third-party intermediaries, that dont host any content, is a step too far.

This initial objection failed; the Regional Court in Hamburg upheld the blocking injunction last December. However, this was only a preliminary proceeding and Quad9 promised to continue the legal battle, warning of a broad impact on the Internet ecosystem.

Sony Files Main Proceeding

After Sonys preliminary victory, the music company initiated a main proceeding at the Leipzig court. This was the next step in the legal process and allowed both sides to provide more evidence and expert opinions.

Sony, for example, referenced earlier jurisprudence where Germanys Federal Court ruled that services such as YouTube can be held liable for copyright infringement if they fail to properly respond to copyright holder complaints.

Quad9s expert, Prof. Dr. Ruth Janal, contested this line of reasoning, noting that, under EU law, DNS resolvers shouldnt be treated in the same fashion as platforms that actually host content

Quad9 is more akin to a mere conduit service than a hosting provider, Prof. Janal countered. Courts could instead require Quad9 to take action through a no-fault injunction, a process thats already used in ISP blocking orders. In those cases, however, the intermediary isnt held liable for pirating users.

Court Confirms DNS Bloc...

23:00

Stranded Motorist Effects Own Rescue Using a Drone and a Cell Phone Hackaday

If youre looking for a good excuse to finally buy a drone, you probably cant do better than claiming it can save your life.

Granted, you may never find yourself in the position of being stuck in a raging snowstorm in the middle of the Oregon wilderness, but if you do, this is a good one to keep in mind. According to news stories and the Lane County Sheriff Search and Rescue Facebook page, an unnamed motorist who was trying to negotiate an unmaintained road through the remote Willamette National Forest got stuck in the snow. This put him in a bad situation, because not only was he out of cell range, but nobody knew where he was or even that he was traveling, so he wouldnt be missed for days.

Thankfully, the unlucky motorist played all his cards right. Rather than wandering off on foot in search of help, he stayed with his vehicle, which provided shelter from the elements. Conveniently, he also happened to have a drone along with him, which provided him with an opportunity to get some help. After typing a detailed text message to a friend describing his situation and exact location, he attached the phone to his drone and sent it straight up a couple of hundred feet enough to get a line-of-sight connection to a cell tower. Note that the image above is a reenactment by the Search and Rescue team; its not clear how the resourceful motorist rigged up the drone, but were going to guess duct tape was involved.

When he brought the drone back down a few minutes later, he found that the queued text had been sent, and the cavalry was on the way. The Search and Rescue unit was able to locate him, and as a bonus, also found someone else nearby who had been stranded for days. So it was a win all around thanks to some clever thinking and a little technology.

22:57

CISA adds three new bugs to Known Exploited Vulnerabilities Catalog Security Affairs

US CISA added actively exploited flaws in Teclib GLPI, Apache Spark, and Zoho ManageEngine ADSelfService Plus to its Known Exploited Vulnerabilities Catalog.

US CISA added the following actively exploited flaws to its Known Exploited Vulnerabilities Catalog:

  • CVE-2022-35914 (CVSS score: 9.8) Teclib GLPI Remote Code Execution Vulnerability
  • CVE-2022-33891 (CVSS score: 8.8) Apache Spark Command Injection Vulnerability
  • CVE-2022-28810 (CVSS score: 6.8) Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

The CVE-2022-35914 flaw is a PHP code injection vulnerability that resides in the /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2.

A remote, unauthenticated attacker can exploit this flaw, via a specially crafted message, to execute arbitrary code.

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A proof of concept (PoC) exploit code for this vulnerability was published on GitHub since December 2022.

Most of the attacks observed by cybersecurity firm GreyNoise originated from the U.S. and the Netherlands.

The CVE-2022-33891 flaw is a command injection vulnerability in the Apache Spark. In December 2022, Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices.

The variant spotted by Microsoft spreads by exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and...

22:52

RADV Enables Variable Rate Shading For RDNA3, RadeonSI Lands More Fixes Phoronix

If you are an AMD Radeon RX 7900 series "RDNA3" GPU owner and don't mind running bleeding-edge open-source graphics driver code, you'll want to pull down today's Mesa 23.1-devel Git snapshot...

22:44

Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

While HDFC Bank has denied any data breach, its subsidiary, HDB Financial Services, has confirmed there was a cybersecurity-related incident which is being investigated.

This is a post from HackRead.com Read the original post: Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary

22:39

Vanilla OS 2.0 Shifting From Ubuntu Base To Debian Sid Phoronix

One of the newer Linux distributions that has been making waves that aims to provide a pleasant Linux desktop experience, close to upstream, and is augmented by the growing selection of Flatpak packages. Now though the project has decided to move from Ubuntu Linux as its base over to Debian Sid...

22:23

Organoid intelligence (OI): the new frontier in biocomputing and intelligence-in-a-dish Lifeboat News: The Blog

Recent advances in human stem cell-derived brain organoids promise to replicate critical molecular and cellular aspects of learning and memory and possibly aspects of cognition in vitro. Coining the term organoid intelligence (OI) to encompass these developments, we present a collaborative program to implement the vision of a multidisciplinary field of OI. This aims to establish OI as a form of genuine biological computing that harnesses brain organoids using scientific and bioengineering advances in an ethically responsible manner. Standardized, 3D, myelinated brain organoids can now be produced with high cell density and enriched levels of glial cells and gene expression critical for learning. Integrated microfluidic perfusion systems can support scalable and durable culturing, and spatiotemporal chemical signaling.

22:22

Tesla Delivers FATAL BLOW As Analysts RAISE Price Targets Lifeboat News: The Blog

Join Patreon: https://www.patreon.com/solvingthemoneyproblem.
FREE One Year Supply of Vitamin D + 5 AG1 Travel Packs https://athleticgreens.com/SMR
UNLOCK 300+ Exclusive Videos: https://www.patreon.com/solvingthemoneyproblem.
Oura Ring https://ouraring.com/smr (Track your sleep, readiness & activity)
My Tesla Stock Price Targets: https://www.patreon.com/posts/tesla-stock-bull-57460691/
Merch: https://solving-the-money-problem.creator-spring.com/
Twitter
https://twitter.com/stevenmarkryan.

AFFILIATE DISCLOSURE: I earn a commission on every purchase made through my links.

SUPPORT THE CHANNEL ON PATREON
Patreon https://www.patreon.com/solvingthemoneyproblem.

BECOME A MEMBER OF THE CHANNEL
Join https://www.youtube.com/channel/UCagiBBx1prefrlsDzDxuA9A/join.

CHANNEL MERCH
Merch store https://solving-the-money-problem.creator-spring.com/

MERCH LINKS
TSLA HODLR MERCH: https://solving-the-money-problem.creator-spring.com/listingproduct=46
420 Funding Secured MERCH:...

22:12

Python 3.12 Alpha 6 Released With More Improvements Phoronix

Python 3.12 Alpha 6 was released on Tuesday as the newest development release toward this next major Python release...

21:57

CVE-2023-23638: Apache Dubbo Deserialization Vulnerability Gadgets Bypass Open Source Security

Posted by Albumen Kevin on Mar 08

Description:

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.


Credit:

yemoliR1ckyZKoishicxc (reporter)

References:

https://dubbo.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-23638

21:34

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity The Hacker News

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable institutions and universities, the re-infiltration in October 2022 involved the

20:48

China-linked APT Sharp Panda targets government entities in Southeast Asia Security Affairs

China-linked APT group Sharp Panda targets high-profile government entities in Southeast Asia with the Soul modular framework.

CheckPoint researchers observed in late 2022, a campaign attributed to the China-linked APT group Sharp Panda that is targeting a high-profile government entity in the Southeast Asia.

SoulSearcher loader, which eventually loads a new version of the Soul modular framework. 

The researchers pointed out that this is the first time the Soul malware framework is attributed to a known cluster of malicious activity, although it was previously used in attacks targeting the defense, healthcare, and ICT sectors in Southeast Asia. The researchers cannot exclude that the Soul framework is utilized by multiple threat actors in the area.

The connection between the tools and TTPs (Tactics, Techniques and Procedures) of Sharp Panda and the previously mentioned attacks in Southeast Asia might serve as yet another example of key characteristics inherent to Chinese-based APT operations, such as sharing custom tools between groups or task specialization, when one entity is responsible for the initial infection and another one performs the actual intelligence gathering. reads the analysis published by the experts.

CheckPoint researchers first identified Sharp Pandss activity at the beginning of 2021, at the time the APT group was targeting Southeast Asian government entities with spear-phishing attacks.

The attackers used a Word document with government-themed lures that relied on a remote template to download and run a malicious RTF document, weaponized with the infamous RoyalRoad kit.

Upon gained a foothold in the target system, the malware starts a chain of fileless loaders, including a custom DLL downloader called 5.t Downloader and a second-stage loader that delivers the final backdoor.

The last stage payload used in Sharp Panda campaigns at the time was the custom backdoor VictoryDll.

The experts detailed multiple campaigns aimed at entities in Southeast Asian countries, such as Vietnam, Indonesia, and Thailand. Across the yeats, the initial part of the infection chain (the use of Word documents, RoyalRoad RTF and 5.t Downloader) remained the same, but in early 2023 the VictoryDll backdoor was replaced with a new vers...

20:43

After Nearly a Decade in Development, Japan's New Rocket Fails in Debut SoylentNews

After Nearly a Decade in Development, Japan's New Rocket Fails in Debut

Japan's science minister said the failure was "extremely regrettable:

The launch of Japan's H3 rocket on Tuesday morning failed after the vehicle's second stage engine did not ignite.

In a terse statement on the failure, Japanese space agency JAXA said, "A destruct command has been transmitted to H3 around 10:52 a.m. (Japan Standard Time), because there was no possibility of achieving the mission. We are confirming the situation."

The Japanese space agency, in concert with the rocket's manufacturer, Mitsubishi Heavy Industries, has spent about $1.5 billion developing the H3 rocket over the last decade. Much of the challenge in building the new rocket involved development of a new LE-9 engine, which is fueled by liquid hydrogen and liquid oxygen, to power the first stage. This appeared to perform flawlessly. The second-stage engine that failed, the LE-5B, was a more established engine.

The country has sought to increase its share of the commercial launch market by building a lower-cost alternative to its older H2-A vehicle to more effectively compete with SpaceX's Falcon 9 booster. Mitsubishi's goal was to sell the H3 at $51 million per launch in its base configuration. This would allow the company to supplement its launches of institutional missions for the Japanese government with commercial satellites. Tuesday's debut flight of the H3 rocket carried the Advanced Land Observing Satellite-3 for the Japanese government. It was lost.

[...] The failure is just the latest challenge for the H3 rocket. A fundamental problem with the booster is that, even if it were to fly safely, the H3 rocket has no clear advantages over the Falcon 9, which now has a streak of more than 170 consecutive successful launches. The new H3 rocket is also fully expendable, unlike the Falcon 9 and many newer boosters in development in the United States and China.

Read more of this story at SoylentNews.

20:00

Moving Magnet Draws Stylish Shapes On Flexible Film Hackaday

A display based on magnetic viewing film

[Moritz v. Sivers] has a knack for making his own displays, which are typically based on some obscure physical effect. Magnetic viewing films, those thin plastic sheets that change color in response to a magnetic field, are his latest area of interest, as you can see in his Magnetic Kinetic Art Display.

The overall idea of the display is similar to a kinetic sand art table, in which a ball traces out shapes in a pile of sand. In [Moritz]s project, the magnetic viewing film is the sand, and a 2 mm diameter magnet is the ball. The magnet is moved along the film by two sets of coils embedded inside a flex PCB mounted just below the film. One set of coils, on the top layer of the PCB, moves the magnet in the x direction, while a second set on the bottom layer moves it in the y direction.

...

19:00

Hidden Chamber Revealed Inside Great Pyramid of Giza Terra Forming Terra



I so want to dismantle the Great pyramid block by block and then put it all back together including a the full on casing stones. We would automatically get full access and all the archeology.

Once done, it would be the greatest tourist property on Earth and we may actually restore original function or at least try.

Not that hard to do with modern cranes and real care on the repacking.  Should match the twenty year time budget and 10,000 builders.

  
Hidden Chamber Revealed Inside Great Pyramid of Giza

Researchers used cosmic-ray imaging to uncover the 30-foot-long corridor



Christopher Parker

March 3, 2023


Tourists visiting the Great Pyramid in Giza, Egypt, earlier this week Fadel Dawod via Getty Images



Even at 4,500 years old, the Great Pyramid of Giza is still revealing new secrets.

On Thursday, Egyptian officials announced the discovery of a hidden corridor above the pyramids entrance. Measuring 30 feet long, the passage could serve as a jumping-off point for additional research into the mysterious inner chambers.

Report an ad

According to a new study published in the journal Nature Communications, the pyramid has been undergoing noninvasive scans since 2015. Through an international partnership known as...

Better Than Laxatives: The King of Fruit Helps to Relieve Constipation Terra Forming Terra






I am inclined to accept just about any fruit as conducive to good digestion. so long as you have plenty. I do think that we err on having too little.

In the event mangos are plentiful and available and easy to consume. Same old story - scarf one down every day just like that apple.

Plentry of our food intake works against good digestion so adding plenty of fruit makes good sense..

Better Than Laxatives: The King of Fruit Helps to Relieve Constipation

Jul 14 2022

https://www.theepochtimes.com/health/better-than-laxatives-the-king-of-fruit-helps-to-relieve-constipation_4599158.html

You can access the benefits of mangoes by adding them to smoothies, tossing them into salads, using them in marinades and jams, or eating them as a snack out of hand. (Photo by ROMAN ODINTSOV/Pexels)


When it comes to regularity, almost everybody needs a little help moving things along at one time or another. But for millions of Americans, the problem is not just an occasional glitch in routine but a frequent occurrence. According to a recent review published in Gastroenterology, 16 percent of Americans suffer from chronic constipation with the odds rising to 33 percent for those over 60.

Luckily, recent research shows that this unpleasant problem may have a pleasant solution. Multiple studies have supported the digestive benefits of mangos, including their ability to ease constipation significantly. In addi...

Sudden Death Epidemic Explodes Terra Forming Terra




We still have nothing like real data since 2019 let alone real time data.  The necessity to correct has pushed some out and it is not good news.  Understand that no falsified database can be allowed to stand past a couple of review cycles in order to not be rendered unusable.

They are still managing the gap, but tyhat need is now disapating as hard evidence is becoming available to everyone.  Hmm - are old age homes becoming empty here or in China?  Just how are those public companies doing?

Has China lost even ten percent of the population?  How are toilet paper sales?  A real change there is intractable.  That is what we really noticed by the shift to home based work.



March 4, 2023

Sudden Death Epidemic Explodes Across America As Doctor Bluntly Warns: 'The Greatest Perpetrator Of Misinformation During The Pandemic Has Been The United States Government'


for All News Pipeline

https://www.freedomsphoenix.com/News/34043...

Chinese Lunar New Year Travel Plunged by 924 Million in 2023 Terra Forming Terra




Now suppose that the reason for this sharp decline in traffic happens to be wholesale death of those over 65.  That alone can explain the trip decline.  Understand that when the regime signed off on launching the plandemic, they justified it by saying it would mostly impact the elderly.  I have not forgotten that guys.

Could it be that these psychotic true believers were actually targeting their own population and that the rest of the world is mostly collateral damage?

We may be looking at a short order decline to around 700,000,000 over the next five years.  and we still lack clear knowledge in terms of hte rerst of the globe.



Chinese Lunar New Year Travel Plunged by 924 Million in 2023

Estimate suggests a huge number of deaths

Patients are cared for by relatives and medical staff as they are seen on beds set up in the atrium area of a busy hospital in Shanghai, China, on Jan. 13, 2023. (Kevin Frayer/Getty Images)


March 4, 2023

https://www.theepochtimes.com/chinese-lunar-new-year-travel-plunged-by-924-million-in-2023_5099683.html

...

18:57

Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments The Hacker News

High-profile government entities in Southeast Asia are the target of a cyber espionage campaign undertaken by a Chinese threat actor known as Sharp Panda since late last year. The intrusions are framework, marking a departure from the group's attack chains observed in 2021. Israeli cybersecurity company Check Point said the "

18:37

VMware NSX Manager bugs actively exploited in the wild since December Security Affairs

Security researchers warn of hacking attempts in the wild exploiting critical vulnerabilities in VMware NSX Manager.

Cyber security firm Wallarm is warning of ongoing attacks exploiting the critical flaws, tracked as CVE-2021-39144 (CVSS score of 9.8) and CVE-2022-31678 (CVSS score of 9.1), in VMware NSX Manager.

VMware NSX is a network virtualization solution that is available in VMware vCenter Server.

The flaws can lead to remote code execution by pre-authenticated attackers. The CVE-2022-31678 flaw is an XML External Entity (XXE) vulnerability. An unauthenticated user may exploit this issue to cause a denial-of-service condition or unintended information disclosure.

The remote code execution vulnerability CVE-2021-39144 resides in the XStream open-source library. Unauthenticated attackers can exploit the vulnerability in low-complexity attacks without user interaction.

Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of root on the appliance. reads the advisory published by the company.

VMware warned of the existence of a public exploit targeting the CVE-2021-39144 vulnerability in October 2022, shortly after its disclosure.

The virtualization giant pointed out the impacted product had reached end-of-life (EOL) status in January 2022.

Wallarm Detect this week warned that, since December 2022, they are observing threat actors exploiting the issues. According to the experts, the CVE-2021-39144 vulnerability was exploited over 40 thousand times over the last 2 months.

Active exploitation started on 2022-Dec-08 and keeps going. reads the advisory published by Wallarm Detect. Attackers are scanning from well-known data centers like Linode and Digital Ocean over 90% of the attacks are coming from their IP addresses. 

If successfully exploited, the impact of these vulner...

18:27

CoC Extremism Has Cost Debian (and Its Derivatives) the Main KDE Maintainer Techrights

LaTeX and many other packages as well (orphaned due to people who don't even code)

As already mentioned in some comments to various blog posts here, I will not invest more work into the current repositories. I invite anyone with interest in continuing the work to contact me. I will also write up a short howto guide on what I generally did and how I worked with this amount of packages. I feel sad about leaving this behind, but also relieved from the amount of work, not to speak of the insults (You are a Nazi etc) I often get from the Debian side. I also feel sorry for all of you who have relied on these packages for long time, have given valuable feedback and helpful comments.

Summary: As explained here many times before [1, 2, 3], people who contribute nothing (or very little, a minuscule/negligible amount) are driving out some of the most active and most important contributors; this leaves users in a tough place (maintainership waning)

18:00

After 17th Court Hearing, Woman With TB Ordered to Jail for Refusing Treatment SoylentNews

Washington judge issued an arrest warrant and ordered her to involuntary detention:

A judge in Washington issued an arrest warrant Thursday for a Tacoma woman who has refused to have her active, contagious case of tuberculosis treated for over a year, violating numerous court orders. The judge also upheld an earlier order to have her jailed, where she can be  tested and treated in isolation.

On Thursday, the woman attended the 17th court hearing on the matter and once again refused a court order to isolate or comply with testing and treatmentan order that originally dates back to January 19, 2022. Pierce County Superior Court Judge Philip Sorensen rejected her objections to being treated and upheld a finding of contempt. Though it remains unclear what her objections are, the woman's lawyer suggested it may be a problem with understanding, according to The News Tribune. The Tacoma-Pierce County Health Department, however, argued that she "knowingly, willfully, and contemptuously violated this court's orders," noting the lengthy process and numerous proceedings and discussions in which interpreters, translated documents, and speakers of her native language were made available.

[...] As Ars previously reported, the court had renewed orders for her isolation and treatment on a monthly basis since January of 2022. The health department had always said it was approaching the problem cautiously, working to keep a "balance between restricting somebody's liberty and protecting the health of the community." It sees detention as the "very, very last option."

Read more of this story at SoylentNews.

17:31

Initial support for guided disk encryption in the installer OpenBSD Journal

The OpenBSD installer now has basic support for configuring disk encryption during the regular installation process. Previously, disk encryption needed to be set up manually by dropping to the shell from the installer.

Initial support, likely to be expanded upon, was committed by Klemens Nanni (kn@) on . The commit reads,

Subject:    CVS: cvs.openbsd.org: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>
Date:       

Read more

17:30

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 (CVSS score: 9.8) - Teclib GLPI Remote Code Execution Vulnerability CVE-2022-33891 (CVSS score: 8.8) - Apache Spark Command Injection Vulnerability

17:02

Dynamic host configuration, please OpenBSD Journal

Another piece from Florian Obser (florian@) just came out, titled Dynamic host configuration, please.

In the article, Florian details the steps to modern OpenBSD dynamic host configuration, including interface configuration, name resolution, routing and more.

We also get an explanation of the various userland programs (most of them portable, some OpenBSD-specific) that make a modern OpenBSD laptop shine.

You can read the full piece here, Dynamic host configuration, please.

17:00

Pulling Data From HDMI RF leakage Hackaday

A long-running story in the world of electronic security has been the reconstruction of on-screen data using RF interference from monitors or televisions. From British TV detector vans half a century ago to 1980s scare stories about espionage, it was certainly easy enough to detect an analogue CRT with nothing more than an AM broadcast radio receiver. But can this still be done in the digital age? Its something [Windytan] has looked into, as she reconstructs images using leakage from HDMI cables.

...

16:42

Microsoft Employees Run for Board of the OSI, Forget to Disclose Working Full Time for Microsoft Techrights

Not even the first time. Later they write official blog posts on behalf of the OSI. Entryism defined.

osi-board
Two of them are Linux Foundation, i.e. an openwashing front group of proprietary software companies (the OSI is also a front group of Microsoft since taking money from Microsoft)

No disclosure
Microsoft not mentioned even once

Aeva Black
Overt conflict of interest (Microsoft is attacking Open Source)

Summary: As noted in the last batch of Daily Links, OSI is a lost cause because it attacks the concept of Open Source in exchange for bribes from Microsoft. It even helps Microsoft in a lawsuit where Microsofts GPL violations are tackled.

16:30

Three crucial moments when founding a cybersecurity startup Help Net Security

With 10% of startups failing in the first year, making wise and future-proof decisions for your new cybersecurity venture is essential. Building the perfect cybersecurity startup As society adapts to an increasingly digital world, opportunities for cybercrime and attacks are also mounting. Consequently, more and more cybersecurity businesses are popping up, and the market is becoming more saturated with each quarter that passes. While theres no blueprint for building the perfect cybersecurity startup, there are More

The post Three crucial moments when founding a cybersecurity startup appeared first on Help Net Security.

16:00

How STEM education can solve talent shortages, improve cybersecurity Help Net Security

In this Help Net Security video, Avani Desai, CEO at Schellman, talks about how teaching STEM subjects like cybersecurity is essential for addressing the staffing crisis and ensuring that organizations have the talent to protect themselves from cyber threats in the years to come. In addition, teaching STEM subjects like cybersecurity can help promote diversity and inclusion in the tech industry. By providing opportunities for underrepresented groups to learn about cybersecurity and pursue careers in More

The post How STEM education can solve talent shortages, improve cybersecurity appeared first on Help Net Security.

15:30

Attackers exploit APIs faster than ever before Help Net Security

After combing through 350,000 reports to find 650 API-specific vulnerabilities from 337 different vendors and tracking 115 published exploits impacting these vulnerabilities, the results clearly illustrate that the API threat landscape is becoming more dangerous, according to Wallarm. API attack analysis for 2022 Researchers came to this conclusion based on the 2022 data, specifically these three trends: Attack growth In 2022 there was a huge increase in attacks against Wallarms customers APIs, which ballooned over More

The post Attackers exploit APIs faster than ever before appeared first on Help Net Security.

15:15

50 Years Later, Were Still Living in the Xerox Altos World SoylentNews

50 Years Later, We're Still Living in the Xerox Alto's World:

[...] I'm talking about the Xerox Alto, which debuted in the early spring of 1973 at the photocopying giant's newly established R&D laboratory, the Palo Alto Research Center (PARC). The reason it is so uncannily familiar today is simple: We are now living in a world of computing that the Alto created.

The Alto was a wild departure from the computers that preceded it. It was built to tuck under a desk, with its monitor, keyboard, and mouse on top. It was totally interactive, responding directly to its single user.

[...] The people who developed the Alto came to Xerox PARC from universities, industrial labs, and commercial ventures, bringing with them diverse experiences and skills. But these engineers and programmers largely shared the same point of view. They conceived and developed the Alto in a remarkable burst of creativity, used it to develop diverse and pathbreaking software, and then moved out of Xerox, taking their achievements, design knowledge, and experiences into the wider world, where they and others built on the foundation they had established.

[...] The type of computing they envisioned was thoroughly interactive and personal, comprehensively networked, and completely graphicalwith high-resolution screens and high-quality print output.

[...] Oddly, at the time, an expensive new laboratory was also immediately financially attractive: R&D expenditures were frequently counted as assets instead of business expenses, all with Wall Street's approval. The more you spent, the better your balance sheet looked.

Read more of this story at SoylentNews.

15:00

AI is taking phishing attacks to a whole new level of sophistication Help Net Security

92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress. Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it. The growing sophistication of phishing emails is a major threat to organizations and More

The post AI is taking phishing attacks to a whole new level of sophistication appeared first on Help Net Security.

14:30

Persona Graph proactively surfaces and blocks hidden fraud rings Help Net Security

Persona has launched Graph to help businesses stop online identity fraud. Leveraging advanced link analysis technology and a configurable query, Graph detects risky connections between users, enabling organizations to uncover and proactively block hard-to-detect fraud. Risk and compliance teams now have expert-level investigation capabilities to spot fraudsters and bad actors at scale, more quickly adapt to evolving fraud techniques, and stop incidents before they happen and take real-time actionall without requiring heavy engineering resources. As More

The post Persona Graph proactively surfaces and blocks hidden fraud rings appeared first on Help Net Security.

14:00

Powercore Aims to Bring the Power of EDM to Any 3D Printer Hackaday

The desktop manufacturing revolution has been incredible, unleashing powerful technologies that once were strictly confined to industrial and institutional users. If you doubt that, just look at 3D printing; with a sub-$200 investment, you can start making parts that have never existed before.

Sadly, though, most of this revolution has been geared toward making stuff from one or another type of plastic. Wouldnt it be great if you could quickly whip up an aluminum part as easily and as cheaply as you can print something in PLA? That day might be at hand thanks to Powercore, a Kickstarter project that aims to bring the power of electric discharge machining (EDM) to the home gamer. The principle of EDM is simple electric arcs can easily erode metal from a workpiece. EDM machines put that...

14:00

Akamai unveils new service and tools to help users reduce attack surface Help Net Security

Akamai Technologies has introduced the Akamai Hunt security service that enables customers to capitalize on the infrastructure of Akamai Guardicore Segmentation, Akamais global attack visibility, and expert security researchers to hunt and remediate the most evasive threats and risks in their environments. Akamai also released Agentless Segmentation, helping Akamai Guardicore Segmentation customers extend the benefits of zero trust to connected IoT and OT devices that arent capable of running host-based security software. As organizations embrace More

The post Akamai unveils new service and tools to help users reduce attack surface appeared first on Help Net Security.

13:30

New Kensington privacy screens protect against visual hacking Help Net Security

Kensington has expanded its robust portfolio of data protection solutions with the launch of three new privacy screens. The SA270 Privacy Screen for Studio Display (K50740WW), SA240 Privacy Screen for iMac 24 (K55170WW), and MagPro Elite Magnetic Privacy Screen for MacBook Air 2022 (K58374WW), expand Kensingtons extensive portfolio of privacy screens that enable businesses to reduce the potential loss of confidential and sensitive data through visual hacking from laptops and computer screens. Hybrid and remote More

The post New Kensington privacy screens protect against visual hacking appeared first on Help Net Security.

12:32

Why do Businesses Need to Focus More on Cybersecurity HackRead | Latest Cybersecurity and Hacking News Site

By Owais Sultan

As technology continues to evolve, the need for businesses to focus more on cybersecurity is becoming increasingly important

This is a post from HackRead.com Read the original post: Why do Businesses Need to Focus More on Cybersecurity

12:29

Dutch Officials Warn That Big Telecom's Plan to Tax Big Tech is a Dangerous Dud SoylentNews

Dutch Officials Warn That Big Telecom's Plan To Tax 'Big Tech' Is A Dangerous Dud:

For much of the last year, European telecom giants have been pushing for a tax on Big Tech company profits. They've tried desperately to dress it up as a reasonable adult policy proposal, but it's effectively just the same thing we saw during the U.S. net neutrality wars: telecom monopolies demanding other people pay them an additional troll toll for no coherent reason.

To sell captured lawmakers on the idea, telecom giants have falsely claimed that Big Tech companies get a "free ride" on the Internet (just as they did during the U.S. net neutrality wars). To fix this problem they completely made up, Big Telecom argues Big Tech should be forced to help pay for the kind of broadband infrastructure upgrades the telecoms have routinely neglected for years.

It's a big, dumb con. But yet again, telecom lobbyists have somehow convinced regulators that this blind cash grab is somehow sensible, adult policy. Dutifully, European Commission's industry chief Thierry Breton (himself a former telecom exec) said last September he would launch a consultation on this "fair share" payment scheme in early 2023, ahead of any proposed legislation.

[...] But they're often not looking at the real problem. Both in the EU and North America, regulators routinely and mindlessly let telecom giants consolidate and monopolize an essential utility. Those monopolies then work tirelessly to drive up rates and crush competition. And, utilizing their lobbying power, they've also routinely gleamed billions in subsidies for networks they routinely half-complete.

[...] If the EU successfully implements such a scheme, you can be absolutely sure the next step will be the U.S., with captured regulators like Brendan Carr (who has been beating this idiotic drum for a few years now) at the front of the parade at Comcast's and AT&T's behest.


Original Submission

Read more of this story...

12:23

NEW 'Off The Wall' ONLINE 2600 - 2600: The Hacker Quarterly

NEW 'Off The Wall' ONLINE

Posted 08 Mar, 2023 1:23:55 UTC

The new edition of Off The Wall from 03/07/2023 has been archived and is now available online.

11:48

4 Things You May Not Know About Performance Analytics Technology HackRead | Latest Cybersecurity and Hacking News Site

By Owais Sultan

Managers are aware that they are being held accountable for their teams performance. How well their teams do

This is a post from HackRead.com Read the original post: 4 Things You May Not Know About Performance Analytics Technology

11:20

SANS Institute and Google collaborate to launch Cloud Diversity Academy Help Net Security

SANS Institute has launched the SANS Cloud Diversity Academy (SCDA) in collaboration with Google. This academy provides training and certifications to Black, Indigenous, and People of Color (BIPOC), women, and other underrepresented groups who are passionate about pursuing a technical career in cybersecurity. The SCDA aims to reduce the skills gap in the industry, with a particular focus on cloud security, while also creating a more diverse and inclusive workforce. Empowering communities that have been More

The post SANS Institute and Google collaborate to launch Cloud Diversity Academy appeared first on Help Net Security.

11:17

11:00

A Ground Source Heat Pump From an Air Conditioner Hackaday

When it comes to lower-energy home heating, its accurate in all senses to say that heat pumps are the new hotness. But unless you happen to work with them professionally, its fair to say their inner workings are beyond most of us. Help is at hand though courtesy of [petey53], who made his own ground source heat pump for his Toronto house using a pair of window-mounted air conditioning units.

...

11:00

HPR3808: Funkwhale A social platform to enjoy and share music Hacker Public Radio

Funkwhale is a community-driven project that lets you listen and share music and audio within a decentralized, open network https://funkwhale.audio/ https://funkwhale.audio/en_US/faqs https://funkwhale.audio/en_US/apps/ https://en.wikipedia.org/wiki/Grooveshark https://vuejs.org/ https://musicbrainz.org/ https://picard.musicbrainz.org/ https://www.subsonic.org/pages/index.jsp https://open.audio/ https://www.castopod.com/en https://tanukitunes.com https://castopod.org/ https://fosstodon.org/@funkwhale https://blog.funkwhale.audio https://dev.funkwhale.audio/funkwhale/funkwhale

Can Static Analysis Tools Find More Defects? It Will Never Work in Theory

Sorting algorithms, data compression, engine efficiency: in each case, we can compare how well we're doing to a provable optimum. In situations where we don't know what the upper bound is, we can still sometimes estimate how much room there is for improvement. This paper does that for static analysis tools that look for patterns (or anti-patterns) in code that indicate bugs. By reformulating issues found in manual code review as rules, the authors show that static analysis might be able to detect as much as three quarters of all bugs, which is considerably better than what current-generation linters do. Work like this can guide development of better tools, but it also tells us how much we still have to gain from them.

Sahar Mehrpour and Thomas D. LaToza. Can static analysis tools find more defects? Empirical Software Engineering, Nov 2022. doi:10.1007/s10664-022-10232-4.

Static analysis tools find defects in code, checking code against rules to reveal potential defects. Many studies have evaluated these tools by measuring their ability to detect known defects in code. But these studies measure the current state of tools rather than their future potential to find more defects. To investigate the prospects for tools to find more defects, we conducted a study where we formulated each issue raised by a code reviewer as a violation of a rule, which we then compared to what static analysis tools might potentially check. We first gathered a corpus of 1323 defects found through code review. Through a qualitative analysis process, for each defect we identified a violated rule and the type of Static Analysis Tool (SAT) which might check this rule. We found that SATs might, in principle, be used to detect as many as 76% of code review defects, considerably more than current tools have been demonstrated to successfully detect. Among a variety of types of SATs, Style Checkers and AST Pattern Checkers had the broadest coverage of defects, each with the potential to detect 25% of all code review defects. We found that static analysis tools might be able to detect more code review defects by better supporting the creation of project-specific rules. We also investigated the characteristics of code review defects not detectable by traditional static analysis techniques, which to detect might require tools which simulate human judgements about code.

10:30

Intel Releases x86-simd-sort v1.0 Library For High Performance AVX-512 Sorting Phoronix

Last month you may recall the news of Intel having an extremely fast AVX-512 sorting library they published as open-source and found adoption already by the popular Numpy Python library. In the case of Numpy it could deliver some 10~17x speed-ups. That

10:19

Sued by Meta, Freenom Halts Domain Registrations Krebs on Security

The domain name registrar Freenom, whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes just days after the Dutch registrar was sued by Meta, which alleges the company ignores abuse complaints about phishing websites while monetizing traffic to those abusive domains.

Freenoms website features a message saying it is not currently allowing new registrations.

Freenom is the domain name registry service provider for five so-called country code top level domains (ccTLDs), including .cf for the Central African Republic; .ga for Gabon; .gq for Equatorial Guinea; .ml for Mali; and .tk for Tokelau.

Freenom has always waived the registration fees for domains in these country-code domains, presumably as a way to encourage users to pay for related services, such as registering a .com or .net domain, for which Freenom does charge a fee.

On March 3, 2023, social media giant Meta sued Freenom in a Northern California court, alleging cybersquatting violations and trademark infringement. The lawsuit also seeks information about the identities of 20 different John Does Freenom customers that Meta says have been particularly active in phishing attacks against Facebook, Instagram, and WhatsApp users.

The lawsuit points to a 2021 study (PDF) on the abuse of domains conducted by Interisle Consulting Group, which discovered that those ccTLDs operated by Freenom made up five of the Top Ten TLDs most abused by phishers.

The five ccTLDs to which Freenom provides its services are th...

09:53

Microsoft Found Shein App Copying Clipboard Content on Android Phones HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

copying clipboard content on Android devices before being detected and reported by Microsoft to Google.

This is a post from HackRead.com Read the original post: Microsoft Found Shein App Copying Clipboard Content on Android Phones

09:41

Reverse-Engineering the ModR/M Addressing Microcode in the Intel 8086 Processor SoylentNews

https://www.righto.com/2023/02/8086-modrm-addressing.html

One interesting aspect of a computer's instruction set is its addressing modes, how the computer determines the address for a memory access. The Intel 8086 (1978) used the ModR/M byte, a special byte following the opcode, to select the addressing mode.1 The ModR/M byte has persisted into the modern x86 architecture, so it's interesting to look at its roots and original implementation.

In this post, I look at the hardware and microcode in the 8086 that implements ModR/M2 and how the 8086 designers fit multiple addressing modes into the 8086's limited microcode ROM. One technique was a hybrid approach that combined generic microcode with hardware logic that filled in the details for a particular instruction. A second technique was modular microcode, with subroutines for various parts of the task.

I've been reverse-engineering the 8086 starting with the silicon die. The die photo below shows the chip under a microscope. The metal layer on top of the chip is visible, with the silicon and polysilicon mostly hidden underneath. Around the edges of the die, bond wires connect pads to the chip's 40 external pins. I've labeled the key functional blocks; the ones that are important to this discussion are darker and will be discussed in detail below. Architecturally, the chip is partitioned into a Bus Interface Unit (BIU) at the top and an Execution Unit (EU) below. The BIU handles bus and memory activity as well as instruction prefetching, while the Execution Unit (EU) executes instructions and microcode. Both units play important roles in memory addressing.


Original Submission

Read more of this story at SoylentNews.

09:38

SYS01 stealer targets critical government infrastructure Security Affairs

Researchers discovered a new info stealer dubbed SYS01 stealer targeting critical government infrastructure and manufacturing firms.

Cybersecurity researchers from Morphisec discovered a new, advanced information stealer, dubbed SYS01 stealer, that since November 2022 was employed in attacks aimed at critical government infrastructure employees, manufacturing companies, and other sectors.

The experts found similarities between the SYS01 stealer and another info stealing malware, tracked as S1deload, that was discovered by Bitdefender researchers.  

We have seen SYS01 stealer attacking critical government infrastructure employees, manufacturing companies, and other industries. reads the analysis published by Morphisec. The threat actors behind the campaign are targeting Facebook business accounts by using Google ads and fake Facebook profiles that promote things like games, adult content, and cracked software, etc. to lure victims into downloading a malicious file. The attack is designed to steal sensitive information, including login data, cookies, and Facebook ad and business account information. 

The experts reported that the campaign was first uncovered in May 2022 that Zscaler researchers linked to the Ducktail operation by Zscaler. The DUCKTAIL campaign was first analyzed by researchers from WithSecure (formerly F-Secure Business) in July 2022, it was targeting individuals and organizations that operate on Facebooks Business and Ads platform.

The attack chain starts by luring a victim to click on a URL from a fake Facebook profile or advertisement to download a ZIP file that pretends to have a cracked software, game, movie, etc.  

Upon opening the ZIP file, a loader, often in the form of a legitimate C# application, is executed. The application is vulnerable to DLL side-loading, a technique used to load a malicious DLL when the legitimate app is invoked.

The experts observed threat actors abusing the legitimate applications Western Digitals WDSyncService.exe and Garmins ElevatedInstaller.exe to side-load the malicious payload.

08:18

Tensions Between Filmmakers and Reddit Grow in Piracy Dispute TorrentFreak

reddit-logoTwo years ago, Internet provider RCN was sued by several film companies, including the makers of The Hitmans Wifes Bodyguard, London Has Fallen, and Hellboy.

The filmmakers accused the provider of failing to act against customers accused of piracy. Rather than terminating the accounts of persistent copyright infringers, the Internet provider looked away, they argued.

Subpoena to Unmask Redditors

Many other ISPs have faced similar claims in recent years, but the RCN lawsuit drew attention recently when Reddit was brought into the mix. The filmmakers took an interest in several comments posted by anonymous Redditors, which could potentially help to back up their claims against RCN.

In January, Reddit received a subpoena asking it to uncover the identities of these users. The social discussion platform largely rejected this request, arguing it would violate their users First Amendment Right to anonymous speech.

Reddit further argued that the filmmakers served their subpoena before discovery had begun. This wasnt mentioned in our previous coverage but behind the scenes it had already ignited significant turmoil.

Disputed Discovery Date

According to the filmmakers attorney, Kerry Culpepper, discovery started when the subpoena was sent (January 7) and any claim to the contrary is grossly negligent, untrue, outrageous, or even libelous.

The lawyer reached out to Reddit asking the company to correct the record before it could be reported by the media, fearing that a failure to do so would damage his reputation.

I extend Reddit the opportunity to file an amended opposition by the end of today [] that deletes that argument and all references to it, explicitly notes that it was completely false, and extends an apology to Plaintiffs counsel and the Court for accusing Plaintiffs counsel of blatantly violating the rules, Culpepper wrote.

Reddit wasnt convinced by this request. Citing the court docket, the discussion platform believes that there is no need to correct anything.

We do not take your accusations lightly. We have again reviewed the DNJ docket and see a January 26, 2023, docket entry instructing that &#...

08:00

Hacking a 15 8051-Based Portable Soldering Iron With Custom Firmware Hackaday

With soldering irons being so incredibly useful, and coming on the heels of the success of a range of portable, all-in-one soldering irons from the likes of Waveshare and Pine64, its little wonder that you can get such devices for as little as 10 15 Euro from websites like AliExpress. Making for both a great impulse buy and reverse-engineering target, [Aaron Christophel] got his mittens on one and set to work on figuring out its secrets.

The results are covered in a brief video, as well as a Twitter thread, where this T12 soldering irons guts are splayed around and reprogrammed in all their glory. Despite the MCU on the PCB having had its markings removed, some prodding and poking around revealed it to be an STC8H3K62S2, an 8051-based MCU running at a blistering 11 MHz....

07:37

06:57

Scientists Have Mapped a Secret Hidden Corridor in Great Pyramid of Giza SoylentNews

The corridor is 30 feet long and likely slopes upward. Where it leads is still a mystery.

In 2016, scientists using muon imaging picked up signals indicating a hidden corridor behind the famous chevron blocks on the north face of the Great Pyramid of Giza in Egypt. The following year, the same team detected a mysterious void in another area of the pyramid, believing it could be a hidden chamber. Two independent teams of researchers, using two different muon imaging methods, have now successfully mapped out the corridor for the first time, according to a new paper published in the journal Nature Communications. Zahi Hawass, Egypt's former antiquities minister, called it "the most important discovery of the 21st century." [So far - Ed]

As we've reported previously, there is a long history of using muons to image archaeological structures, a process made easier because cosmic rays provide a steady supply of these particles. An engineer named E.P. George used them to make measurements of an Australian tunnel in the 1950s. But Nobel-prize-winning physicist Luis Alvarez really put muon imaging on the map when he teamed up with Egyptian archaeologists to use the technique to search for hidden chambers in the Pyramid of Khafre at Giza. Although it worked in principle, they didn't find any hidden chambers.

There are many variations of muon imaging, but they all typically involve gas-filled chambers. As muons zip through the gas, they collide with the gas particles and emit a telltale flash of light, which is recorded by the detector, allowing scientists to calculate the particle's energy and trajectory. It's similar to X-ray imaging or ground-penetrating radar, except with naturally occurring high-energy muons rather than X-rays or radio waves. That higher energy makes it possible to image thick, dense substances like the stones used to build pyramids. The denser the imaged object, the more muons are blocked, casting a telltale shadow. Hidden chambers in a pyramid would show up in the final image because they blocked fewer particles.

...

06:25

Serious DJI Drones Flaws Could Crash Drones Mid-flight HackRead | Latest Cybersecurity and Hacking News Site

By Habiba Rashid

During their assessment, the researchers discovered a total of 16 vulnerabilities with a broad range of impacts, from denial of service to arbitrary code execution.

This is a post from HackRead.com Read the original post: Serious DJI Drones Flaws Could Crash Drones Mid-flight

06:00

AMD Ryzen 9 7900X3D Linux Performance Phoronix

Following last week's review of the brand new AMD Ryzen 9 7950X3D and then moving on to looking at the Ryzen 9 7900X3D gaming performance, today's Linux hardware coverage on Phoronix is looking at the Ryzen 9 7900X3D Linux performance in other system/CPU workloads aside from gaming.

06:00

Countdown to the 2023 IEEE Annual Election IEEE Spectrum



On 1 May the IEEE Board of Directors is scheduled to announce the candidates to be placed on this years ballot for the annual election of officerswhich begins on 15 August.

The ballot includes IEEE president-elect candidates and other officer positions up for election.


The Board of Directors has nominated IEEE Fellow Roger U. Fujii and IEEE Senior Member Kathleen A. Kramer as candidates for 2024 IEEE president-elect. Visit the IEEE elections page to learn about the candidates.

The ballot includes nominees for delegate-elect/director-elect openings submitted by division and region nominating committees, IEEE Technical Activities vice president-elect, IEEE-USA president-elect, IEEE Standards Association president-elect, IEEE Women in Engineering Committee chair-elect, and board of governors members-at-large.

IEEE members who want to run for an office but who have not been nominated need to submit their petition intention to the IEEE Board of Directors by 15 April. Petitions should be sent to the IEEE Corporate Governance staff: elections@ieee.org.

Those elected take office on 1 January 2024.

To ensure voting eligibility, members are encouraged to review and update their contact information and communication preferences by 30 June.

Given ever-changing global conditions, members might wish to vote electronically instead of by mail.

For more information about the offices up for election, the process of getting on the ballot, and deadlines, visit the IEEE elections page or write to elections@ieee.org.

05:01

How to encrypt Bash shell variables with Ansible Vault Linux.com

Use Ansible Vault to share encrypted Bash environment variables across projects.

Read More at Enable Sysadmin

The post How to encrypt Bash shell variables with Ansible Vault appeared first on Linux.com.

04:13

Chinese Sharp Panda Group Unleashes SoulSearcher Malware HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

Currently, in its cyber espionage campaign, Sharp Panda hackers are targeting government entities in Asia.

This is a post from HackRead.com Read the original post: Chinese Sharp Panda Group Unleashes SoulSearcher Malware

04:13

Huge Lithium Find in Iran May End World Shortage SoylentNews

Huge lithium find may end world shortage there's a catch:

Lithium, sometimes hyped as white gold, has been highly sought after for its role in battery production, and other things.

Global demand is expected to continue to outstrip supply in the years to come. Albemarle Corporation projects [PDF] lithium demand will rise from 1.8 million metric tons in 2025 to 3.7 million metric tons in 2030 largely due to its role in electric vehicles and other battery dependent devices.

The White House last year said critical minerals rare earth metals, lithium, and cobalt "are essential to our national security and economic prosperity."

Alas for the US, the latest cache of this malleable metal has turned up in Iran one of just four countries America has designated a state sponsor of terrorism.

According to The Financial Tribune, an English language news publication focused on Iran that's operated by Tehran-based Donya-e-Eqtesad, Ebrahim Ali Molla-Beigi, director general of the Exploration Affairs Office of the Ministry of Industries, Mining and Trade, said that Iran has discovered its first lithium reserve in Hamedan Province, in the western part of the country.

The reserve is said to be 8.5 million metric tons, which if accurate would be among the largest known deposits yet discovered.

According to the US Geological Survey [PDF], the top five identified lithium reserves are: Bolivia, 21 million tons; Argentina, 20 million tons; Chile, 11 million tons; Australia, 7.9 million tons, and China, 6.8 million tons.

Read more of this story at SoylentNews.

03:27

03:16

Perth Mint Sold Diluted Gold To China, Got Caught, And Tried To Cover It Up cryptogon.com

Via: ABC: The historic Perth Mint is facing a potential $9 billion recall of gold bars after selling diluted or doped bullion to China and then covering it up, according to a leaked internal report. Four Corners has uncovered documents charting the WA government-owned mints decision to begin doping its gold in 2018, and then []

03:15

[$] BTHome: An open standard for broadcasting sensor data LWN.net

Many wireless sensors broadcast their data using Bluetooth Low Energy (BLE). Their data is easy to receive, but decoding it can be a challenge. Each manufacturer uses its own format, often tied to its own mobile apps. Integrating all of these sensors into a home-automation system requires a lot of custom decoders, which are generally developed by reverse-engineering the protocols. The goal of the BTHome project is to change this: it offers a standardized format for sensors to broadcast their measurements using BLE. BTHome is supported by the Home Assistant home-automation software and by a few open-firmware and open-hardware projects.

03:00

I Fly Openers BlackFly eVTOL IEEE Spectrum



On a gin-clear December day, Im sitting under the plexiglass bubble of a radically new kind of aircraft. Its a little past noon at the Byron Airport in northern California; in the distance, a jagged line of wind turbines atop rolling hills marks the Altamont Pass, blades spinning lazily. Above me, a cloudless blue sky beckons.

The aircraft, called BlackFly, is unlike anything else on the planet. Built by a Palo Alto, Calif., startup called Opener, its an electric vertical take-off and landing (eVTOL) aircraft with stubby wings fore and aft of the pilot, each with four motors and propellers. Visually, its as though an aerial speedster from a 1930s pulp sci-fi story has sprung from the page.


There are a couple of hundred startups designing or flying eVTOLs. But only a dozen or so are making tiny, technologically sophisticated machines whose primary purpose is to provide exhilarating but safe flying experiences to people after relatively minimal training. And in that group, Opener has jumped out to an early lead, having built dozens of aircraft at its facilities in Palo Alto and trained more than a score of people to fly them.

My own route to the cockpit of a BlackFly was relatively straightforward. I contacted the companys CEO, Ken Karklin, in September 2022, pitched him on the idea of a story and video, and three months later I was flying one of his aircraft.

Well, sort of flying it. My brief flight was so highly automated that I was more passenger than pilot. Nevertheless, I spent about a day and a half before the flight being trained to fly the machine manually, so that I could take control if anything went wrong. For this training, I wore a virtual-reality headset and sat in a chair that tilted and gyrated to simulate flying maneuvers. To fly this simulation I manipulated a joystick that was identical to the one in the cockpit of a BlackFly. Openers chief operating officer, Kristina L. Menton, and engineer Wyatt Warner took turns patiently explaining the operations of the vehicle and giving me challenging tasks to complete, such as hovering and performing virtual landings in a vicious crosswind.

The BlackFly is entirely controlled by that joystick, which is equipped with a trigger and also topped by a thumb switch. To take off, I squeeze th...

02:46

Acer discloses a new data breach, 160 GB of sensitive data available for sale Security Affairs

Taiwanese multinational hardware and electronics corporation Acer discloses a data breach after a threat actor claimed the hack of the company.

Recently a threat actor announced the availability for sale of 160 GB of data allegedly stolen from the Taiwanese multinational hardware and electronics corporation Acer.

Acer data breach

The threat actor announced the hack on a popular cybercrime forum, he claims to have stolen about 2869 files. The stolen files include confidential product model documentation, binaries, backend infrastructure, BIOS information, and other sensitive data.

Reads the post published by the seller on Breached Forums:

The leak contains a total 160GB of 655 directories, and 2869 files. It includes:

  • Confidential slides/presentations
  • Staff manuals to various technical problems
  • Windows Imaging Format files
  • Tons of binaries (.exe, .dll, .bin, etc)
  • Backend infrastructure
  • Confidential product model documentation and information of phones, tablets, laptops, etc
  • Replacement Digital Product Keys (RDPK)
  • ISO files
  • Windows System Deployment Image (SDI) files
  • Tons of BIOS stuff
  • ROM files

(honestly theres so much shit that itll take me days to go through the list of what was breached lol)

Acer confirmed the incident and discloses a data breach, the company said that attackers have compromised one of its servers.

We have recently detected an incident of unauthorized access to one of our document servers for repair technicians. While our investigation is ongoing, there is currently no indication that any consumer data was stored on that server, ...

02:45

Initial Rust DRM Abstractions, AGX Apple DRM Driver Posted For Review Phoronix

After being in development for several months, Asahi Lina with the Asahi Linux project has posted the initial Rust Direct Rendering Manager (DRM) subsystem abstractions for review as well as a preview of the experimental state of the AGX DRM driver providing the open-source kernel graphics driver support for Apple M1/M2 hardware...

02:42

The Government Is Trying To Kill Us Now: Low-Income Americans Fume In Mile-Long Food Lines After Pandemic Benefits End cryptogon.com

Via: ZeroHedge: Over the past year, 18 US states have officially ended pandemic-era states of emergency including the covid food benefit, while a December mandate from Congress will end aid in March for the other 32 states, along with the District of Columbia, the US Virgin Islands and Guam. The collective return to pre-pandemic []

02:28

The initial posting of the Apple AGX graphics driver LWN.net

Asahi Lina has posted an initial version of a Rust-based driver for Apple AGX graphics processors; the posting includes a fair amount of Rust infrastructure for graphics drivers in general.

While developing the driver, I tried to make use of Rust's safety and lifetime features to provide not just CPU-side safety, but also partial firmware-ABI safety. Thanks to this, it has turned out to be a very stable driver even though GPU firmware crashes are fatal (no restart capability, need to reboot!) and the FW/driver interface is a huge mess of unsafe shared memory structures with complex pointer chains.

02:04

Expert released PoC exploit code for critical Microsoft Word RCE flaw Security Affairs

Security researcher released a proof-of-concept exploit code for a critical flaw, tracked as CVE-2023-21716, in Microsoft Word.

Security researcher Joshua Drake released a proof-of-concept for a critical vulnerability, tracked as CVE-2023-21716 (CVSS score 9.8 out of 10), in Microsoft Word.

The vulnerability can be exploited by a remote attacker to execute arbitrary code on a system running the vulnerable software. The issue can be easily exploited, anyway, it can be exploited only with user interaction.

Microsoft addressed the vulnerability with the release of the February Patch Tuesday security updates.

The vulnerability was discovered by Drake in November, it resides in the in Microsoft Offices wwlib.dll library.

An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file. reads the advisory published by Microsoft.

The vulnerability can be also be exploited by simply loading a specially crafted RTF document in the Preview Pane.

Drake discovered a heap corruption vulnerability in the RTF parser in Microsoft Word that can be triggered dealing with a font table (*\fonttbl*) containing a large number of fonts (*\f###*).

Following this memory corruption, additional processing takes place. With a properly crafted heap layout, an attacker cause the heap corruption to yield arbitrary code execution. Using the proof-of-concept code supplied below, processing eventually reaches the post-processing clean up code. reads the technical post published by the researchers.

The researchers shared a proof-of-concept code that trigger the bug to launch the Calculator app in Windows.

The good news is that at this time Microsoft is not aware of attacks in the wild ex...

01:47

Twitter Suspends Copyright Holder as Musk Outlaws Weaponization of DMCA (Updated) TorrentFreak

pirate twitterIn May 2022, Elon Musk declared overzealous use of the DMCA a plague on humanity.

As CEO of Twitter, Musk understands that his platform has certain obligations if it wishes to maintain protection from liability under copyright law. On receipt of a properly formatted and submitted takedown notice, allegedly infringing content must be taken down.

A dispute that boiled over yesterday began with these two steps but ended up with the copyright holder having his account suspended, presumably by Musk himself or on his instructions.

The two people at the heart of the original dispute are both Twitter users. Since most tweets relating to the initial dispute have since been deleted or disabled, here we rely on archived and cached copies for evidence. Since one users account has been suspended, links to the account and its tweets are included but are likely to fail.

Adrien Mauduit (@NightLights_AM)

Adrien Mauduit (@NightLights_AM, Norway) operates the currently-suspended Night Lights account. He describes himself as a professional nature cinematographer, astrophotographer, and an Aurora chasing specialist.

A review of Mauduits recent posts suggests that his Twitter account is mainly used to post content he creates himself, usually videos or photographs.

Mauduits pinned tweet is/was a stunning short video dated March 4, 2023. Its described as a double solar storm punch that created a G3 (max) geomagnetic storm. This video sits at the heart of the dispute.

nightlights-am-original

Posted on March 3, the video was well received. Comments under the original tweet include: INCREDIBLE! Feast for the eyes and spirit, This one is off the charts! and Wow Adrien! Absolutely killing it! Thanks for sharing!

Massimo (@Rainmaker1973)

Massimo (Italy) operates the...

IndyWatch Science and Technology News Feed Archiver

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

IndyWatch Science and Technology News Feed was generated at World News IndyWatch.

Resource generated at IndyWatch using aliasfeed and rawdog