IndyWatch Science and Technology News Feed Archiver

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

IndyWatch Science and Technology News Feed was generated at World News IndyWatch.

Saturday, 11 March

01:09

Tracing Water through the Stages of Planet Formation Centauri Dreams Imagining and Planning Interstellar Exploration

Tracing Water through the Stages of Planet Formation

The presence of water in the circumstellar disk of V883 Orionis, a protostar in Orion some 1300 light years out, is not in itself surprising. Water in interstellar space is known to form as ice on dust grains in molecular clouds, and clouds of this nature collapse to form young stars. We would expect that water would be found in the emerging circumstellar disk.

What new work with data from the Atacama Large Millimeter/submillimeter Array (ALMA) shows is that such water remains unchanged as young star systems evolve, a chain of growth from protostar to protoplanetary disk and eventually planets and water-carrying comets. John Tobin, an astronomer at the National Science Foundations National Radio Astronomy Observatory (NRAO), is lead author on the paper on this work:

We can think of the path of water through the Universe as a trail. We know what the endpoints look like, which are water on planets and in comets, but we wanted to trace that trail back to the origins of water. Before now, we could link the Earth to comets, and protostars to the interstellar medium, but we couldnt link protostars to comets. V883 Ori has changed that, and proven the water molecules in that system and in our Solar System have a similar ratio of deuterium and hydrogen.

Image: While searching for the origins of water in our Solar System, scientists homed in on V883 Orionis, a unique protostar located 1,305 light-years away from Earth. Unlike with other protostars, the circumstellar disk surrounding V883 Ori is just hot enough that the water in it has transformed from ice into gas, making it possible for scientists to study its composition using radio telescopes like those at the Atacama Large Millimeter/submillimeter Array (ALMA). Radio observations of the protostar revealed water (orange), a dust continuum (green), and molecular gas (blue) which suggests that the water on this protostar is extremely similar to the water on objects in our own Solar System, and may have similar origins. Credit: ALMA (ESO/NAOJ/NRAO), J. Tobin, B. Saxton (NRAO/AUI/NSF).

V883 Ori is interesting in its own right as a star undergoing a so-called accretion burst, a rarely observed occurrence in which a star in the process of formation ingests a huge amount of disk material, forcing an increase i...

01:04

WhatsApp and UK government on collision course, as app vows not to remove end-to-end encryption Graham Cluley

The boss of WhatsApp, the most popular messaging platform in the UK, says that it will not remove end-to-end encryption from the app to comply with requirements set out in the UK government's online safety bill. Learn more in my article on the Hot for Security blog.

00:56

Pirated copies of Final Cut Pro infect Macs with cryptojacking malware Graham Cluley

Torrents on The Pirate Bay which claim to contain Final Cut Pro are instead being used to distribute cryptojacking malware to Macs.

00:49

CVE-2023-26464: Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender Open Source Security

Posted by Arnout Engelen on Mar 10

Severity: low

Description:

** UNSUPPORTED WHEN ASSIGNED **

When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to
cause a logging entry involving a specially-crafted (ie, deeply nested)
hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available
memory in the virtual machine and achieve Denial of Service when the object is...

00:45

OpenBSD Finally Adds Guided Disk Encryption To Its Installer Phoronix

Full disk encryption is quite important in today's computing environment while some operating systems still sadly don't provide an easy and streamlined manner of setting up an encrypted disk at install-time. Thankfully with the next release of OpenBSD, they are introducing a guided disk encryption option to their installer...

00:43

Threat Actors are Using Advanced Malware to Backdoor Business-grade Routers SoylentNews

Hiatus hacking campaign has infected roughly 100 Draytek routers:

Researchers have uncovered advanced malware that's turning business-grade routers into attacker-controlled listening posts that can sniff email and steal files in an ongoing campaign hitting North and South America and Europe.

Besides passively capturing IMAP, SMTP, and POP email, the malware also backdoors routers with a remote-access Trojan that allows the attackers to download files and run commands of their choice. The backdoor also enables attackers to funnel data from other servers through the router, turning the device into a covert proxy for concealing the true origin of malicious activity.

"This type of agent demonstrates that anyone with a router who uses the Internet can potentially be a targetand they can be used as proxy for another campaigneven if the entity that owns the router does not view themselves as an intelligence target," researchers from security firm Lumen's Black Lotus Labs wrote. "We suspect that threat actors are going to continue to utilize multiple compromised assets in conjunction with one another to avoid detection."

[...] Black Lotus still doesn't know how devices are getting hacked in the first place. Once (and however) that happens, the malware gets installed through a bash script that's deployed post-exploitation. It downloads and installs the two main binaries.

[...] Hiatus is mainly targeting DrayTek routers running an i386 architecture. The researchers, however, have uncovered prebuilt binaries compiled for ARM, MIPS64 big endian, and MIPS32 little endian platforms.

Read more of this story at SoylentNews.

00:30

Lenovo Begins Supporting LinuxBoot Firmware With ByteDance Phoronix

This week TikTok-owner ByteDance hosted the CloudFW Open System Firmware Symposium to talk up their open-source firmware work, showcase their industry partnerships, and more. One interesting takeaway is that thanks to the weight of ByteDance, Lenovo is now supporting LinuxBoot in some capacity...

00:22

This 1,000-foot Multi-Rotor Floating Turbine Can Power 80,000 Homes Lifeboat News: The Blog

A Norwegian Greentech company has recently unveiled its new 1,000-foot (324m) tall, floating wind turbine array. Called Wind Catcher, this innovation in renewable energy generation could be used to power as many as 80,000 homes.

The system has been developed by the Norwegian-based Wind Catching Systems (WCS), who declare that their new wind turbine setup could generate five times the annual energy of the worlds biggest standalone wind turbines. Not only that, but if scaled, it could reduce the costs of wind energy to be competitive with traditional grid-supplied electricity.

00:22

Breakthrough drug works against all the main types of primary bone cancer Lifeboat News: The Blog

Researchers at the University of East Anglia have developed a new drug that works against all of the main types of primary bone cancer.

Cancer that starts in the bones, rather than cancer that has spread to the bones, predominantly affects children.

Current treatment is grueling, with outdated chemotherapy cocktails and limb amputation.

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

Friday, 10 March

23:56

When Partial Protection is Zero Protection: The MFA Blind Spots No One Talks About The Hacker News

Multi-factor Authentication (MFA) has long ago become a standard security practice. With a wide consensus on its ability to fend off more than 99% percent of account takeover attacks, it's no wonder why security architects regard it as a must-have in their environments. However, what seems to be less known are the inherent coverage limitations of traditional MFA solutions. While compatible with

23:32

Alleged seller of NetWire RAT arrested in Croatia Help Net Security

This week, as part of a global law enforcement operation, federal authorities in Los Angeles successfully confiscated www.worldwiredlabs.com, a domain utilized by cybercriminals to distribute the NetWire remote access trojan (RAT) allowed perpetrators to assume control of infected computers and extract a diverse range of sensitive information from their unsuspecting victims. A RAT is a type of malware that allows for covert surveillance, allowing a backdoor for administrative control and unfettered and unauthorized remote access More

The post Alleged seller of NetWire RAT arrested in Croatia appeared first on Help Net Security.

23:00

Cornell Updates Their MCU Course for the RP2040 Hackaday

The School of Electrical and Computer Engineering at Cornell University has made [Bruce Land]s lectures and materials for the Designing with Microcontrollers (ECE 4760) course available for many years. But recently [Bruce], who semi-retired in 2020, and the new lecturer [Hunter Adams] have reworked the course and labs to use the Raspberry Pi Pico. You can see the introductory lecture of the reworked class below.

Not only are the videos available online, but the classs GitHub repository hosts extensive and well-documented examples, lecture notes, and helpful links. If you want to get started with RP2040 programming, or just want to dig deeper into a particular technique, this is a great place to start.

From what we can tell, this is the third overhaul of the class this century. Back in 2012 the course was using the ATmega1284 AVR microcontroller, and in 2015 it switched to the Microstick II using a Microchip PIC32MX. Not only were these lecture series also available free online, but each has been maintained as reference after being replaced. One common thread with all of these platforms is their low cost of entry. Assuming you already have a computer, setting up the hardware and software development en...

22:48

Embree 4.0.1 Released With Intel Data Center GPU Flex Series Support Phoronix

Embree 4.0.1 is out with a few changes to note for this open-source high performance ray-tracing library for CPUs and GPUs...

22:36

Chrome 112 Beta Released With CSS Nesting, WebAssembly Tail Call Phoronix

Chrome 112 beta is now available for testing as the next step forward for Google's web browser...

22:25

Internet crime in 2022: Over $3 billion lost to investment scammers Help Net Security

In 2022, investment scam losses were the most (common or dollar amount) scheme reported to the Internet Crime Complaint Center (IC3), the FBI shared in its 2022 Internet Crime Report. This category includes crypto-investment scams such as liquidity mining, celebrity impersonation, pig butchering, and many more. Business email compromise (BEC) scams are overall the second most financially destructive, followed by tech support scams and personal data breaches. 2022 Internet Crime Report: Additional findings The number More

The post Internet crime in 2022: Over $3 billion lost to investment scammers appeared first on Help Net Security.

22:25

AMD Releases AOMP 17.0-0 For Latest Radeon OpenMP Offloading Compiler Phoronix

On Thursday AMD engineers released AOMP 17.0-0 as the newest latest development patches around Radeon/Instinct OpenMP GPU/accelerator offloading support...

22:22

Metas powerful AI language model has leaked online what happens now? Lifeboat News: The Blog

Supposedly bouncing around out of 4C and in hacker forums.


Metas leaked AI language model could be a big deal.

22:22

First Complete Wiring Map of Neurons in Insect Brain: 3016 Neurons and 548,000 Synapses Mapped Lifeboat News: The Blog

Summary: A newly constructed brain map shows every single neuron and how they are wired together in the brains of fruit fly larvae.

Source: UK Research and Innovation.

Researchers have built the first ever map showing every single neuron and how theyre wired together in the brain of the fruit fly larva.

22:22

Bank of America Obsessed With AI, Says Its the New Electricity Lifeboat News: The Blog

The financial industrys response to artificial intelligence has been all over the place. Now, Bank of America is weighing in very much on the side of the bots.

In a note to clients viewed by CNBC and other outlets, BofA equity strategist Haim Israel boasted that AI was one of its top trends to watch and invest in for the year, and used all kinds of hypey language to convince its clients.

We are at a defining moment like the internet in the 90s where Artificial Intelligence (AI) is moving towards mass adoption, the client note reads, with large language models like ChatGPT finally enabling us to fully capitalize on the data revolution.

22:22

Long-Sought Math Proof Unlocks More Mysterious Modular Forms Lifeboat News: The Blog

Using refreshingly old tools, mathematicians resolved a 50-year-old conjecture about how to categorize important functions called modular forms, with consequences for number theory and theoretical physics.

22:06

Distribution Release: siduction 22.1.1 DistroWatch.com: News

Ferdinand Thommes has announced the release of siduction 22.1.1, un updated build of the project's distribution based on Debian's "unstable" branch and offering official variants with KDE Plasma, LXQt and Xfce desktops: "We are pleased to offer siduction 2022.1.1 as a bug-fix release. It is based on an....

21:56

Forget Designer Babies. Heres How CRISPR is Really Changing Lives SoylentNews

The gene-editing tool is being tested in people, and the first treatment could be approved this year:

Forget about He Jiankui, the Chinese scientist who created gene-edited babies. Instead, when you think about gene editing you should think of Victoria Gray, the African-American woman who says she's been cured of her sickle-cell disease symptoms.

[...] But the designer-baby debate is a distraction from the real story of how gene editing is changing people's lives, through treatments used on adults with serious diseases.

In fact, there are now more than 50 experimental studies underway that use gene editing in human volunteers to treat everything from cancer to HIV and blood diseases, according to a tally shared with MIT Technology Review by David Liu, a gene-editing specialist at Harvard University.

Most of these studiesabout 40 of theminvolve CRISPR, the most versatile of the gene-editing methods, which was developed only 10 years ago.

[...] To scientists, CRISPR is a revelation because of how it can snip the genome at specific locations. It's made up of a cutting protein paired with a short gene sequence that acts like GPS, zipping to a predetermined spot in a person's chromosomes.

[...] The first generation of CRISPR treatments are also limited in another way. Most use the tool to damage DNA, essentially shutting off genesa process famously described as "genome vandalism" by Harvard biologist George Church.

[...] Liu's lab is working on next-generation gene-editing approaches. These tools also employ the CRISPR protein, but it's engineered not to cut the DNA helix, but instead to deftly swap individual genetic letters or make larger edits. These are known as "base editors."

[...] Now that gene editing has had its first successes, Urnov says, there's an "urgent need" to open a "path to the clinic for all."


Original Submission

Read more of this story at SoylentNews.

21:31

ESPN & beIN Accused of Stealing Fans Viral Ancelotti Chewing Gum Video TorrentFreak

rights moneyViral videos are big business. Therefore its no surprise that specialized companies emerged to help the lucky few to monetize their viral content.

These companies typically take care of licensing and legal issues. This is also the case with Videohat, which uses the catchy tagline Rights = Money.

Unfortunately, however, getting paid isnt always straightforward. When a video goes viral, thousands of copies are made without permission, even by mainstream news outlets, other licensing companies, and some of the worlds largest copyright businesses.

Viral Gum Video

This is also what Youssef Abu Bakr noticed when he uploaded a TikTik video of Real Madrid manager Carlo Ancelotti, sharing one of his trademark chewing gums. This gesture generated millions of views on TikTok and was reposted thousands of times without permission.

ESPNs Watermarked TikTok

espn gum

Bakr licenses his videos through Videohat and the latter found out that rights dont always equal money, not directly. In addition to thousands of smaller accounts, mainstream companies including ESPN also copied the clip, as shown above.

Hoping to get rewarded, Videohat reached out to ESPN with a licensing deal but that didnt get the desired result. This eventually prompted the company to file a formal case at the U.S. Governments Copyright Claims Board (CCB) which was launched last year to deal with these types of smaller disputes.

ESPN Hit With Copyright Claim

According to the claim, ESPN is a renowned network that should be quite familiar with copyright law and licensing requirements. Despite this, ESPN reportedly failed to cooperate when Videohat reached out.

The alleged wrongdoing isnt limited to the TikTok video either. Similar posts appeared on ESPNs Twitter, Facebook, and YouTube accounts....

21:03

Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant The Hacker News

A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, the latest findings from ThreatFabric reveal. Named "Xenomorph 3rd generation" by the Hadoken Security Group, the new features that allow it to perform financial fraud in a seamless

20:29

AT&T is notifying millions of customers of data breach after a third-party vendor hack Security Affairs

AT&T is warning some of its customers that some of their information was exposed after the hack of a third-party vendors system.

AT&T is notifying millions of customers that some of their information was exposed after a third-party vendor was hacked.

CPNI is information related to the telecommunications services purchased by the customers, including the number of lines for each account or the wireless plan to which customers are subscribed.

We recently determined that an unauthorized person breached a vendors system and gained access to your Customer Proprietary Network Information (CPNI). reads a data breach communication sent by the company to the impacted customers. However, please rest assured that no sensitive personal or financial information such as Social Security number or credit card information was accessed.

Exposed data dont include financial information (i.e. credit card data) or sensitive data (i.e. Social Security Number, account passwords).

The vendor was hacked in January, and AT&T told its customers that vulnerability exploited by the attackers has been already fixed. The Telco giant added that its systems were not compromised.

The company has notified federal law enforcement, but the data breach notification does not provide the number of impacted customers.

Our report to law enforcement does not contain specific information about your account, only that the unauthorized access occurred. continues the notice.

BleepingComputer reported that approximately 9 million wireless accounts were impacted.

The company recommends its customers to add an extra security password protection to their account at no cost.

On August 2021, ShinyHunters group...

20:22

What Is Nanotechnology? Lifeboat News: The Blog

Nanotechnology is a field of science and engineering that focuses on the design and manufacture of extremely small devices and structures.

20:00

A Tape Loop Echo you Can Build Hackaday

Echo and reverb are now electronic audio effects done in a computer or an integrated circuit, but originally they were achieved through mechanical means. Reverb units used springs, and echo units used loops of magnetic tape. As a musician hankering after a mechanical tape echo unit, [Adam Paul] was left with no choice but to build his own. We featured an early prototype, but now hes back with a finished version thats intended to be replicated by other musicians.

The unit takes a cassette mechanism from one of the last still-manufactured players available through the usual sources. It splits record and play heads, with the normal cassette replaced with a tape loop made from extra-thick computer tape. A custom PCB replaces most of the electronics, and the auto-reverse system is disabled.

The result is a functional tape echo system, as can be seen in the video below the break. This is ready to build yourself, with everything on a GitHub repository and an extremely comprehensive build guide, so do any of you fancy a go?

Read about the devices earlier incarnation here.

...

19:14

Bad Onboarding Can Lead to High Quit Rates for New Workers SoylentNews

A large percentage of employees are dissatisfied with their experience of joining a company:

New employees who start a job feeling undertrained and disconnected from their work environment are far more likely to quit than those who have a good onboarding experience.

With the unemployment rate lower than it has been in decades  even more so in technology fields job candidates more often than not field multiple offers. So, if the onramp to a new job is bumpy, they're far more likely to reconsider staying with the organization, even in the short term.

According to research firm Gartner, 63% of new hires are satisfied with their onboarding experience. A recent survey by payroll and human resources provider Paychex showed onboarding experience affected how quickly they would quit after taking a position.

The survey of about 1,000 Americans by Paychex, released last month, found half (50%) of newly hired employeesplan to quit soon.

[...] Among the percentage of remote workers who said they're likely to leave their current job soon, 88% described their latest onboarding experience as boring, 78% called it confusing, and 74% saw it as a failure. On-site and hybrid employees fare better; only 36% of them viewed the onboarding process as confusing.

Remote workers are most likely to feel disoriented (60%) and devalued (52%) after onboarding, the survey found.

[...] Without a streamlined and supportive process, employees can be left frustrated, she said, which can muddle a new hire's first experience in a new position and affect their morale.

[...] "You need a two-way connection where they're not only learning about the company, but the company [is] learning about the employee and tailoring the onboarding experience to them. In that, they're also learning what the new hire brings to the table," Kohn said. "It works a lot better when a new hire comes in and sees a manager and a team already recognizes [that the new hire] brings strengths to the table."


Original Submission

Read more of this story at SoylentNews.

19:00

Johnny Depp & Marilyn Manson Sing for Satan Terra Forming Terra






Just how does a human mind accept the tenants and ideas of satanism at all?  Yet her5e we are with in your face behavior that can not be put aside.

I regret that years ago a niece claimed that her husband was deep into all this and I dismissed it all.  I simply could not accept any of it.  Otherwise she was a good rational person who really needed a break and she was as smart as can be.

Yet it is now a thing and objectively provable.  Understandable once you grasp the pathology of pedophilia.  Understand something else, homosexuality and transgenderism and other odd tastes are describable as sexual pathologies.  Sorry about all that, but the good news is that society is able to accomadate most of these pathology in someone else.

This can never happen with pedophilia because it drives the only natural conspiracy whose objectives are obvious and dangerous and stupid.  In practice, we need to band the works and there will be plenty and they do find each other. 

I now suspect that it may well be one in a thousand which produces a crowd, most contained at least.


Johnny Depp & Marilyn Manson Sing for Satan

By Mike King

"You say God and I say Satan!"

https://www.realhistorychan.com/say10.html

How many times have we heard Fake News dismissively mock the "conspiracy theory" about elite Satanists and sex rings? The deceptive tactic never varies. They will openly state the seemingly unbelievable truth -- thus allowing it to knock itself down as ridiculous. Here's a typical example -- of 100s -- from a N...

Historic Treaty Protects Marine Life in the High Seas Terra Forming Terra






Well it is a start. I certainly do not expect state players living by the rules of mercantalism to do more than play games.

however the first step is the establishment of a framework,  That allows a third party  to intervene and and enforce things.  Sooner or later it  is sorted out,.

So whatever original intent is, the land or ocean becomes settled.


Historic Treaty Protects Marine Life in the High Seas

The United Nations agreement will help conserve 30 percent of the planets oceans by 2030



Daily CorrespondentMarch 8, 2023 11:12 a.m.

https://www.smithsonianmag.com/smart-news/historic-treaty-protects-marine-life-in-the-high-seas-180981760/?

Conference president Rena Lee of Singapore announces an agreement was reached on Saturday. Ministry of Foreign Affairs, Singapore


Nearly 200 nations have agreed to a legally binding high seas treaty that will help the United Nations reach its pledge of protecting 30 percent of the planets oceans by 2030. After two decades of preliminary discussion, two weeks of negotiations at U.N. headquarters and a nearly 40-hour final session, the countries finally reached a deal on Saturday.

Now, the treaty can establish marine protected areas in international waters, which would regulate fishing, shipping and deep sea mining.

Report an ad

It is indeed a historical milestone, and its certainly good news f...

The Link Between Nightshades, Chronic Pain and Inflammation Terra Forming Terra






I do not think that potatoes are a problem here because we consume the starch.  Not so easy with tomatos.  Again though we are eating the fruit which may be much different.  That is the likely problem.

The rest are uncommonly consumed.  So just how sensitive are you?

If there is a likely problem, then doing the challenge is very appropriate.  Doing a challenge on sugar is a total eyeopener when you discover it is the go to solution for just about any processed food.  Obviously tomato also buries a lot of off flavors as well.

Go for it


The Link Between Nightshades, Chronic Pain and Inflammation
Posted on: 

Wednesday, March 8th 2023 at 9:00 am

Written By: Elisha McFarland

https://greenmedinfo.com/blog/link-between-nightshades-chronic-pain-and-inflammation

Few people are familiar with the term nightshades, and many will be surprised to learn that consuming foods from this plant group may be contributing to their pain and inflammation

Nightshades belong to the Solanaceae family which includes over 2,000 species. They also include some of the most popular foods consumed today; such as tomatoes, potatoes, all types of peppers, and eggplant. Although not truly nightshades, blueberries, huckleberries, goji berries and ashwaganda all share the same alkaloids which may have inflammation-inducing properties.

The Solanaceae family contains cholinesterase inhibiting glycoalkaloids and steroid alkaloids includi...

Archaeologists Find Evidence of Earliest Known Horseback Riders Terra Forming Terra



It took no time at all for native americans to master the horse after contact and to also become wonderfully ptoficient as well.  In the old world though two steps had to take place.  Firstly, they did have to be domesticated and this took generations of breeding.  Then they had to become big enough.

Up to that point they pulled wagons and fast chariots.  all of which is useful even militarily.  At some point, some became ridable.  You can almost see this shift in the record.

Then when they became ridable, we needed competant horse soldiers.  Again, no easy task as this also led directly to superior equipment.  This was a longish evolution and even the last of the military horsemen were far from ideal.  It was almost always an auxilluary arm unless the mass foot was run down.


Archaeologists Find Evidence of Earliest Known Horseback Riders

New research indicates that humans were riding horses as early as 5,000 years ago



Julia BinswangerMarch 7, 2023 12:06 p.m.

Studying skeletal remains, researchers identified six criteria that could indicate whether someone rode horses. Christian Heinrich via Getty Images



Who were the earliest humans to look at horses and consider trying to ride them?

Archaeologists are now one step closer to answering that question. A new analysis of 5,000-year-old human skeletal remains has revealed the earliest known direct evidence of horseback riding.

...

18:46

Sophos improves cyberthreat defenses with endpoint security advancements Help Net Security

Sophos introduced innovative advancements to its portfolio of endpoint security offerings. New adaptive active adversary protection; Linux malware protection enhancements; account health check capabilities; an integrated zero trust network access (ZTNA) agent for Windows and macOS devices; and more improve frontline defenses against advanced cyberthreats and streamline endpoint security management. Ransomware remains one of the most prevalent and damaging cyberthreats to organizations, with Sophos incident responders still consistently remediating ransomware activity worldwide. Now isnt the More

The post Sophos improves cyberthreat defenses with endpoint security advancements appeared first on Help Net Security.

18:43

North Korean UNC2970 Hackers Expands Operations with New Malware Families The Hacker News

A North Korean espionage group tracked as UNC2970 has been observed employing previously undocumented malware families as part of a spear-phishing campaign targeting U.S. and European media and technology organizations since June 2022. Google-owned Mandiant said the threat cluster shares "multiple overlaps" with a long-running operation dubbed "Dream Job" that employs job recruitment lures in

18:28

March 2023 Patch Tuesday forecast: Its not about luck Help Net Security

Every month I touch on a few hot topics related to security around patching and some important updates to look out for on the upcoming Patch Tuesday. Diligence to this ongoing patch process, and not luck, is critical to protecting systems and avoiding a security breach. Patching priority Ransomware continues to be a major threat, and a recent report provides some interesting supporting statistics. There was a 19% year-over-year increase in 2022 in the number More

The post March 2023 Patch Tuesday forecast: Its not about luck appeared first on Help Net Security.

18:25

New Superconducting Material Could Transform Electronics If It Works Lifeboat News: The Blog

Superconductivity is an incredible property of certain materials with exciting consequences. Once reached, for example, said materials can conduct electricity without resistance, so no loss of energy. But most materials are superconductive at extremely low temperatures. The quest for a room-temperature superconductor is ongoing, and is not without a bit of scientific drama.

A few years ago, there was a claim of a room-temperature superconductor that became supercritical at a temperature of 15C (59F), but required a pressure of 2.5 million atmospheres. Thats on the order of the pressure you might find in the core of a rocky planet, and can be achieved by squeezing materials between two diamonds. Other scientists raised issues with the way the numbers were handled, including an accusation of the data used being fabricated.

The paper was retracted by the journal Nature last September, and the team claims they are ready to resubmit that work. They have also announced a brand-new material with even more extraordinary properties (if confirmed). The new substance is described as a nitrogen-doped lutetium hydride that becomes superconductive up to 20.5C (69F) and at a much lower pressure, roughly 10,000 atmospheres. Quite the improvement.

18:24

First nasal monoclonal antibody treatment for COVID-19 shows promise for treating virus, other diseases Lifeboat News: The Blog

A pilot trial by investigators from Brigham and Womens Hospital, a founding member of the Mass General Brigham health care system, tested the nasal administration of the drug Foralumab, an anti-CD3 monoclonal antibody. Investigators found evidence that the drug dampened the inflammatory T cell response and decreased lung inflammation in patients with COVID-19. Further analysis showed the same gene expression modulation in patients with multiple sclerosis, who experienced decreased brain inflammation, suggesting that Foralumab could be used to treat other diseases. Their results are published in the Proceedings of the National Academy of Sciences.

We discovered a way to shut down inflammation not only seen in COVID-19, but also in a patient with multiple sclerosis as well as in healthy patients, said lead author Thais Moreira, Ph.D., an assistant scientist at the Ann Romney Center for Neurologic Diseases at BWH and an instructor in Neurology at Harvard Medical School. This is very exciting because not only does our study suggest that this new monoclonal antibody drug is safe and can modulate the without major side effects, but it can also decrease inflammation in multiple realms, so it may be useful for treating other diseases.

Inflammation is a major cause of many diseases, said senior author Howard Weiner, MD, founder and director of the Brigham Multiple Sclerosis Center and co-director of the Ann Romney Center for Neurologic Diseases. Our center has spent decades looking for novel ways to treat disease where there is abnormal inflammation in a way that is safe and effective.

18:24

How immune cells detect and respond to mutations in cancer cells Lifeboat News: The Blog

For the first time, a research team has identified and analyzed the steps by which immune cells see and respond to cancer cells, providing insights into reasons some treatments may be effective for certain patients but not others.

The UCLA Jonsson Comprehensive Cancer Center scientists leading the research believe their findings will lead to better, more personalized immunotherapieseven for patients whose immune systems currently do not appear to respond to treatment.

This is an important step forward in our understanding of what the T-cell responses see in the tumor and how they change over time while they are in the tumor and in circulation in the blood, searching for new tumor cells to attack, said Cristina Puig-Saus, Ph.D., a UCLA Jonsson Comprehensive Cancer Center researcher, adjunct assistant professor of medicine at UCLA, and the first author of a study in Nature.

18:15

BMW exposes data of clients in Italy, experts warn Security Affairs

Cybernews researchers discovered that BMW exposed sensitive files that were generated by a framework that BMW Italy relies on.

Original post at: https://cybernews.com/security/bmw-exposes-italy-clients/

Hackers have been enjoying their fair share of the spotlight by breaching car manufacturers defenses. The latest Cybernews discovery showcases that popular car brands sometimes leave their doors open, as if inviting threat actors to feast on their client data.

  • BMW exposed sensitive files to the public
  • Attackers could exploit the data to steal the websites source code and potentially access customer info
  • BMW secured the data that wasnt meant to be public in the first place
  • BMW clients should remain vigilant, as home addresses, vehicle location data, and many other kinds of sensitive personal information are collected by the manufacturer

BMW, a German multinational manufacturer of luxury vehicles delivering around 2.5 million vehicles a year, potentially exposed its business secrets and client data.

If a malicious hacker were to discover the flaw, they could exploit it to access customer data, steal the companys source code, and look for other vulnerabilities to exploit.

The discovery

In February, Cybernews researchers stumbled upon an unprotected environment (.env) and .git configuration files hosted on the official BMW Italy website. Environment files (.env), meant to be stored locally, included data on production and development environments.

Researchers noted that while this information is not enough for threat actors to compromise the website, they could be used for reconnaissance covertly discovering and collecting information about a system. Data could lead to the website being compromised or point attackers towards customer information storage and the means to access it.

The .git configuration file, exposed to the public, would have allowed threat actors to find other exploitable vulnerabilities, since it contained the .git repository for the sites source code.

The discovery illustrates that even well-known and trusted brands can have severely insecure configurations, allowing attackers to breach their systems in order to steal customer information or move laterally through the network. Customer information from such sources is especially valuable for cybercriminals, given that customers of luxury car brands often have more savings that could potentially be stolen, the Cybernews research team said.

Sensitive files were generated by a framework that BMW Italy relies on Laravel, a free open-source PHP framework designed for the...

17:00

Videos Teach Bare Metal RP2040 Hackaday

When we write about retrocomputers, we realize that back in the day, people knew all the details of their computer. You had to, really, if you wanted to get anything done. These days, we more often pick peripherals and just assume our C or other high level code will fit and run on the CPU.

But sometimes you need to get down to the bare metal and if your desire is to use bare metal on the RP2040, [Will Thomas] has a YouTube channel to help you. The first video explains why you might want to do this followed by some simple examples. Then youll find over a dozen other videos that give you details.

Any video that starts, Alright, Monday night. I have no friends. It is officially bare metal hours, deserves your viewing. Of course, you have to start with the traditional blinking LED. But subsequent videos talk about the second core, GPIO, clocks, SRAM, spinlocks, the UART, and plenty more.

As you might expect, the code is all in assembly. But even if you want to program using C without the SDK, the examples will be invaluable. We like assembly it is like working an intricate puzzle and getting anything to work is satisfying. We get it. But commercially, it rarely makes sense to use assembly anymore. On the other hand, when you need it, you really need it. Besides, we all do things for fun that dont make sense commercially.

We like assembly,...

16:45

Veeam Backup & Replication admins, get patching! (CVE-2023-27532) Help Net Security

Veeam Software has patched CVE-2023-27532, a high-severity security hole in its widely-used Veeam Backup & Replication solution, and is urging customer to implement the fix as soon as possible. About CVE-2023-27532 The nature of CVE-2023-27532 has not been explained Veeam only says that the vulnerable process, Veeam.Backup.Service.exe (TCP 9401 by default), allows an unauthenticated user to request encrypted credentials. Obtaining encrypted credentials might ultimately allow attackers to gain access to the backup infrastructure hosts, More

The post Veeam Backup & Replication admins, get patching! (CVE-2023-27532) appeared first on Help Net Security.

16:30

New infosec products of the week: March 10, 2023 Help Net Security

Heres a look at the most interesting products from the past week, featuring releases from 1Password, GrammaTech, Kensington, Palo Alto Networks, and Persona. New Kensington privacy screens protect against visual hacking The SA270 Privacy Screen for Studio Display (K50740WW), SA240 Privacy Screen for iMac 24 (K55170WW), and MagPro Elite Magnetic Privacy Screen for MacBook Air 2022 (K58374WW), expand Kensingtons extensive portfolio of privacy screens that enable businesses to reduce the potential loss of confidential and More

The post New infosec products of the week: March 10, 2023 appeared first on Help Net Security.

16:29

On Shaky Ground: Why Dependencies Will be Your Downfall SoylentNews

There's never enough time or staff to scan code repositories:

Software dependencies, or a piece of software that an application requires to function, are notoriously difficult to manage and constitute a major software supply chain risk. If you're not aware of what's in your software supply chain, an upstream vulnerability in one of your dependencies can be fatal.

A simple React-based Web application can have upward of 1,700 transitive NodeJS "npm" dependencies, and after a few months "npm audit" will reveal that a relatively large number of those dependencies have security vulnerabilities. The case is similar for Python, Rust, and every other programming language with a package manager.

I like to think of dependencies as decaying fruit in the unrefrigerated section of the code grocer, especially npm packages, which are often written by unpaid developers who have little motivation to put in more than the bare minimum of effort. They're often written for personal use and they're open sourced by chance, not by choice. They're not written to last.

[...] Not all hope is lost. For known (reported and accepted) vulnerabilities, tools exist, such as pip-audit, which scans a developer's Python working environment for vulnerabilities. Npm-audit does the same for nodeJS packages. Similar tools exist for every major programming language and, in fact, Google recently released OSV-Scanner, which attempts to be a Swiss Army knife for software dependency vulnerabilities. Whether developers are encouraged (or forced) to run these audits regularly is beyond the scope of this analysis, as is whether they actually take action to remediate these known vulnerabilities.

However, luckily for all of us, automated CI/CD tools like Dependabot exist to make these fixes as painless as possible. These tools will continually scan your code repositories for out-of-date packages and automatically submit a pull request (PR) to fix them. Searching for "dependabot[bot]" or "renovate[bot]" on GitHub and filtering to active PRs yields millions of results! However, 3 million dependency fixes versus hundreds of millions of active PRs at any given time is an impossible quantification to attempt to make outside of an in-depth analysis.

Read more of this story at SoylentNews.

16:04

Despite the Paid-for (Very Fake) Hype for Microsoft Chatbots, Bing Falls to Lowest Share in Years Techrights

There are also Bing layoffs, but many publishers are being paid to turn a blind eye, focus on vapourware instead

Noam Chomsky: The False Promise of ChatGPT

The most prominent strain of A.I. encodes a flawed conception of language and knowledge, famed linguist Noam Chomsky writes this week

As per this months figures (as CSV/ODF), Google rose to new highs and Bing fell to 2.7% its lowest levels since 2021:

Almost 94% for Google (Bing in a freefall, along with its proxies, e.g. DDG)

Summary: The bribed media (paid by Microsoft to relay/produce puff pieces) has predicted doom for Googles search, but what were seeing is exactly the opposite; people need Web pages, not chatbots

16:00

Synthetic identity fraud calls for a new approach to identity verification Help Net Security

In 2022, US financial institutions and the credit card sector lost an estimated $4.88 billion to synthetic identities through falsified deposit accounts and unsecured credit cards. Thats because legacy fraud prevention procedures often come up short in the effort to defend against this growing threat. As a result, increasingly sophisticated crime rings are using these techniques to not only target financial institutions, but also government agencies and enterprises as diverse as telecom firms, online gaming More

The post Synthetic identity fraud calls for a new approach to identity verification appeared first on Help Net Security.

15:30

The cybersecurity landscape in the era of economic instability Help Net Security

Economic uncertainty is squeezing organizations globally. Gartner predicts nearly half of cybersecurity leaders will change jobs by 2025. These findings are alarming but undoubtedly unsurprising in todays IT landscape. In this Help Net Security video, Denis Dorval, VP of International at JumpCloud, discusses how the responsibility of cybersecurity can no longer be placed on the shoulders of IT admins alone. Experts have long been advising that cybersecurity must be an organization-wide priority built into the More

The post The cybersecurity landscape in the era of economic instability appeared first on Help Net Security.

15:00

Young government workers show poor password management habits Help Net Security

Hybrid work has exposed another area of vulnerability, with 70% of government workers reporting they work virtually at least some of the time, according to Ivanti. The proliferation of devices, users, and locations adds complexity and new vulnerabilities for government security teams to tackle while also combatting increasingly sophisticated threat actors. With generative AI making phishing emails increasingly more realistic, the human-sized gaps in cybersecurity are placing government agencies and organizations at increasing risk More

The post Young government workers show poor password management habits appeared first on Help Net Security.

14:00

Physics-Controlled Component Auto-Placer Hackaday

[Jarrett] recently stumbled upon a class of drawing algorithms called force-directed graphs, which artificially apply forces to the elements. The final graph is then generated by applying the laws of physics and letting the system reach equilibrium. This can often result in a pleasing presentation of things like mind maps and other diagrams without having to hand-place everything. He realized that this approach almost mimics the way he places components when doing a PCB layout. Out of curiosity or intense boredom, were not sure which, he decided to implement this in a tool that interacts with KiCad ( see animated GIF below the break ).

He has to ignore certain nets such as power and ground rails, because they distort the result. This simulation treats the nets as springs, and the center of each footprint behaves a charged particle. [Jarrett] added a twist, literally, to the usual implementations each net pulls on its pin, not the part center, and therefore the chips will both rotate and be pushed around as the system stab...

14:00

1Password Unlock with SSO helps enterprises secure their employees Help Net Security

1Password has launched Unlock with Single Sign-On (SSO) which enables enterprise customers to use Okta for unlocking their 1Password accounts, with Azure AD and Duo integration to follow in the coming months. Unlock with SSO helps IT teams improve their security posture while reducing daily login hassles and stress for employees. Securing employees at scale is no small task. At 1Password, we believe that the foundation of enterprise security is secure employees, and were driven More

The post 1Password Unlock with SSO helps enterprises secure their employees appeared first on Help Net Security.

13:48

Stealthy UEFI Malware Bypassing Secure Boot Enabled by Unpatchable Windows Flaw SoylentNews

BlackLotus represents a major milestone in the continuing evolution of UEFI bootkits:

Researchers on Wednesday announced a major cybersecurity findthe world's first-known instance of real-world malware that can hijack a computer's boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows.

Dubbed BlackLotus, the malware is what's known as a UEFI bootkit. These sophisticated pieces of malware hijack the UEFI short for Unified Extensible Firmware Interfacethe low-level and complex chain of firmware responsible for booting up virtually every modern computer. As the mechanism that bridges a PC's device firmware with its operating system, the UEFI is an OS in its own right. It's located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch.

[...] The second thing standing in the way of UEFI attacks is UEFI Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of software used during startup is trusted by a computer's manufacturer. Secure Boot is designed to create a chain of trust that will prevent attackers from replacing the intended bootup firmware with malicious firmware. If a single firmware link in that chain isn't recognized, Secure Boot will prevent the device from starting.

While researchers have found Secure Boot vulnerabilities in the past, there has been no indication that threat actors have ever been able to bypass the protection in the 12 years it has been in existence. Until now.

[...] To defeat Secure Boot, the bootkit exploits CVE-2022-21894, a vulnerability in all supported versions of Windows that Microsoft patched in January 2022. The logic flaw, referred to as Baton Drop by the researcher who discovered it, can be exploited to remove Secure Boot functions from the boot sequence during startup. Attackers can also abuse the flaw to obtain keys for BitLocker, a Windows feature for encrypting hard drives.

Previously:

13:38

Links 09/03/2023: Mesa 22.3.7, Samba 4.18.0, Peek Discontinued Techrights

  • GNU/Linux

    • Graphics Stack

      • Free Desktop mesa 22.3.7
        Hello everyone,
        
        The bugfix release 22.3.7 is now available.
        
        This is the last release of the 22.3 series. Users are encouraged to
        switch to the 23.0 series to continue receiving bugfixes.
        
        Cheers,
          Eric
        
    • Applications

    ...

12:07

11:04

Researchers Getting Better at Reading Minds SoylentNews

https://www.science.org/content/article/ai-re-creates-what-people-see-reading-their-brain-scans

As neuroscientists struggle to demystify how the human brain converts what our eyes see into mental images, artificial intelligence (AI) has been getting better at mimicking that feat. A recent study, scheduled to be presented at an upcoming computer vision conference, demonstrates that AI can read brain scans and re-create largely realistic versions of images a person has seen. As this technology develops, researchers say, it could have numerous applications, from exploring how various animal species perceive the world to perhaps one day recording human dreams and aiding communication in people with paralysis.

Many labs have used AI to read brain scans and re-create images a subject has recently seen, such as human faces and photos of landscapes. The new study marks the first time an AI algorithm called Stable Diffusion, developed by a German group and publicly released in 2022, has been used to do this. Stable Diffusion is similar to other text-to-image "generative" AIs such as DALL-E 2 and Midjourney, which produce new images from text prompts after being trained on billions of images associated with text descriptions.

For the new study, a group in Japan added additional training to the standard Stable Diffusion system, linking additional text descriptions about thousands of photos to brain patterns elicited when those photos were observed by participants in brain scan studies.

[...] Finally, the researchers tested their system on additional brain scans from the same participants when they viewed a separate set of photos, including a toy bear, airplane, clock, and train. By comparing the brain patterns from those images with those produced by the photos in the training data set, the AI system was able to produce convincing imitations of the novel photos. (The team posted a preprint of its work in December 2022.)

"The accuracy of this new method is impressive," says Iris Groen, a neuroscientist at the University of Amsterdam who was not involved with the work.

I'm wondering how this sort of ability will effect copyright, in the long term, when it becomes possible to extract high-enough fidelity copies of media from people's brains, which they have observed before and remember. If someone views an image, listens to a song, or watches a movie, and then downloads a copy from their brain to share, is that copyright infringement? Is the copy in their head infringement? Will the law determine a percentage fidelity limit?


Original Submission...

11:00

Power Tool Battery Fume Extractor Hackaday

A solder fume extractor is something we could probably all use. While there isnt much to them, [Steven Bennett] put a lot of thought into making one that was better for him, and we admired his design process, as well as the extractor fan itself. You can see the finished result in the video below.

The electrical design, of course, is trivial. A computer fan, a switch, and a battery in this case, a Makita power tool battery. But the Fusion 360 design for the 3D printed parts got a lot of thought to make this one of the best fume extractor fans weve seen.

There are a lot of details that go into making something like this look professional. For example, the plastic used matches the Makita color scheme, and the nameplate matches the Makita logo. Knowing how to interface with the battery opens up a lot of portable projects. For example, we use a similar battery to power our portable soldering irons.

This is one of those projects where you can easily get carried away. But [Stevens] design is simple yet functional. Sometimes it seems like the overriding design factor is color matching.

...

11:00

HPR3810: Clifton, Arizona Hacker Public Radio

We have left the Tucson area and moved up into the mountains to Clifton, Arizona, a mining town. Arizona is a major source of Copper for the U.S., and Clifton has one of the larger open pit mines in the world, and the largest in the U.S. Links: https://flic.kr/s/aHBqjzKQCb https://flic.kr/s/aHBqjzKSz8 https://flic.kr/s/aHBqjzKTKL https://flic.kr/s/aHBqjzKUba https://flic.kr/s/aHBqjzKSqt https://flic.kr/s/aHBqjzKUkN https://flic.kr/s/aHBqjzKU3S https://flic.kr/s/aHBqjzKXtk https://flic.kr/s/aHBqjzKXk8 https://flic.kr/s/aHBqjzKYXo https://flic.kr/s/aHBqjzKZr5 https://www.palain.com/travel/clifton-arizona/

Reducing Withdrawal and Failure Rates with Labeled Subgoals It Will Never Work in Theory

Being a good programmer doesn't automatically make you good at teaching other people to program. In fact, the unconscious competence that allows you to focus on the problem rather than stumbling over syntax issues or fumbling to create functions make actually make you worse as a teacher, since you will skip or combine steps that novices still need to do slowly and one at a time.

Research has proven that labeling subgoalsi.e., breaking a solution technique down into small steps and giving those steps nameshelps learners master material more quickly. This study looked more closely at the benefits of labeled subgoals for introductory programming courses. The authors found that it helped on quizzes given within a week of new material being presented, but didn't make a difference to overall results on final exams done later. However, students who had been given labeled subgoals performed more consistently on exams; perhaps more importantly, they were also less likely to drop or fail the course. While studies like this one may not get the same attention as Silicon Valley hype about AI disrupting education, their findings are much more likely to actually help the next generation of programmers learn their craft.

Lauren E. Margulieux, Briana B. Morrison, and Adrienne Decker. Reducing withdrawal and failure rates in introductory programming with subgoal labeled worked examples. International Journal of STEM Education, May 2020. doi:10.1186/s40594-020-00222-7.

Background: Programming a computer is an increasingly valuable skill, but dropout and failure rates in introductory programming courses are regularly as high as 50%. Like many fields, programming requires students to learn complex problem-solving procedures from instructors who tend to have tacit knowledge about low-level procedures that they have automatized. The subgoal learning framework has been used in programming and other fields to break down procedural problem solving into smaller pieces that novices can grasp more easily, but it has only been used in short-term interventions. In this study, the subgoal learning framework was implemented throughout a semester-long introductory programming course to explore its longitudinal effects. Of 265 students in multiple sections of the course, half received subgoal-oriented instruction while the other half received typical instruction.

Results: Learning subgoals consistently improved performance on quizzes, which were formative and given within a week of learning a new procedure, but not on exams, which were summative. While exam performance was not statistically better, the subgoal group had lower variance in exam scores and fewer students dropped or failed the course than in the control group....

10:07

Akamai mitigated a record-breaking DDoS attack that peaked 900Gbps Security Affairs

Akamai has mitigated the largest DDoS (distributed denial of service) attack ever, which peaked at 900.1 gigabits per second.

Akamai reported that on February 23, 2023, at 10:22 UTC, it mitigated the largest DDoS attack ever. The attack traffic peaked at 900.1 gigabits per second and 158.2 million packets per second. The record-breaking DDoS was launched against a Prolexic customer in Asia-Pacific (APAC).

On February 23, 2023, at 10:22 UTC, Akamai mitigated the largest DDoS attack ever launched against a Prolexic customer based in Asia-Pacific (APAC), with attack traffic peaking at 900.1 gigabits per second and 158.2 million packets per second. reads the post published by Akamai.

DDoS

The company pointed out that the attack was intense and short-lived, with most attack traffic bursting during the peak minute of the attack. The overall attack lasted only a few minutes.

Akamai mitigated the attack by redirecting the malicious traffic through its scrubbing network.

Most of the malicious traffic (48%) was managed by scrubbing centers in the APAC region, but the company claims that all its 26 centers were loaded, with only one center in HKG handling 14,6% of the total traffic.

Akamai states that there was no collateral damage thanks to its defense.

The previous record-breaking distributed denial of service attack mitigated by Akamai hit a company customer in Europe on September 2022. At the time, the malicious traffic peaked at 704.8 Mpps and appeared to originate from the same threat actor behind another record-breaking attack that Akamai blocked in July and that hit the same customer.

In January, Microsoft...

09:44

09:36

Vulnerability Revealed OpenSea NFT Market Users Identities HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

It was a cross-site search (XS-Search) vulnerability that could be exploited by an attacker to obtain a user's identity.

This is a post from HackRead.com Read the original post: Vulnerability Revealed OpenSea NFT Market Users Identities

08:56

Top 100 Global Innovators 2023 IEEE Spectrum



How we will live in the 2030s is being defined now. Our health, our prosperity and our very world are built on the ideas created today. At Clarivate, our focus is to pore over what humanity knows today and put forward the insight that explores all possible horizons horizons that enable transition and transformation.

For 12 years, Clarivate has identified the companies and institutions whose research and innovation do not just sit on the edge of possibility but define it. Today, we recognize the Top 100 Global Innovators 2023, companies who chose to lead and create their own horizons.

Download the report to see who made the list and more, including:

  • The evolving trends and predicted firsts in this years analysis
  • Which regions show more, fewer, or first-time entrants to the list
  • The interplay between scientific research and invention and new this year, the 50 research institutions whose papers are most cited by the Top 100

08:18

DHS Has a Program Gathering Domestic Intelligence SoylentNews

Seems the DHS has a secret program to spy on American citizens

For years, the Department of Homeland Security has run a virtually unknown program gathering domestic intelligence, one of many revelations in a wide-ranging tranche of internal documents reviewed by POLITICO.

Those documents also reveal that a significant number of employees in DHS's intelligence office have raised concerns that the work they are doing could be illegal.

Under the domestic-intelligence program, officials are allowed to seek interviews with just about anyone in the United States. That includes people held in immigrant detention centers, local jails, and federal prison. DHS's intelligence professionals have to say they're conducting intelligence interviews, and they have to tell the people they seek to interview that their participation is voluntary. But the fact that they're allowed to go directly to incarcerated people circumventing their lawyers raises important civil liberties concerns, according to legal experts.

That specific element of the program, which has been in place for years, was paused last year because of internal concerns. DHS's Office of Intelligence and Analysis, which runs the program, uses it to gather information about threats to the U.S., including transnational drug trafficking and organized crime. But the fact that this low-profile office is collecting intelligence by questioning people in the U.S. is virtually unknown.

IMHO, when your own employees are afraid they're breaking the law by doing their jobs; and those same people fear punishment if they speak up, says a lot about the ethics of this bullshit.


Original Submission

Read more of this story at SoylentNews.

08:00

A Guided Tour of the NES Hackaday

No matter your age or background, theres an excellent chance youll recognize the Nintendo Entertainment System (NES) at first glance. The iconic 8-bit system not only revitalized the gaming industry, but helped to establish the blueprint of console gaming for decades to come. Its a machine so legendary and transformative that even today, it enjoys a considerable following. Some appreciate the more austere approach to gaming from a bygone era, while others are fascinated with the functional aspects of console.

The NesHacker YouTube channel is an excellent example of that latter group. Host [Ryan] explores the ins and outs of the NES as a platform, with a leaning towards the software techniques used to push the systems 6502 processor to the limits. Even if you arent terribly interested in gaming, the videos on assembly programming and optimization are well worth a watch for anyone writing code for vintage hardware.

...

07:22

ACE & New Anti-Piracy Coalition Target South Korean Video Piracy Globally TorrentFreak

noonoo-logoMillions of subscribers to Western streaming services will testify to the South Korean content explosion of recent years.

The Korean Wave cultural phenomenon, boosted by movies and TV shows such as Squid Game, Train to Busan, and Parasite, is something to behold.

From the successes of BTS and Psys Gangnam Style to the magnificent Oldboy released two decades ago, South Korean entertainment quite rightfully receives worldwide appreciation. If everyone actually paid for these pleasures, that would be the icing on the cake for South Korea.

Oppa Anti-Pirate Style

In a combined effort to crack down on piracy of local content, major South Korean broadcasters, including KBS, MBC and JTBC, the Korea Film and Video Copyright Association (film producers and distributors), plus streaming platforms TVING and Wavve, have announced the formation of a new, piracy-fighting coalition.

The Video Copyright Protection Council ( ) will receive support from the South Korean governments Copyright Commission as it works to curtail both local and overseas pirates. An interesting factor here is that the project involves the Alliance for Creativity and Entertainment, the worlds largest anti-piracy coalition.

First Official Target Revealed

The new coalition is expected to file a criminal complaint in South Korea today targeting pirate streaming giant Noonoo TV. While unfamiliar to many in the West, the site offers movies and TV shows to an audience of tens of millions, making it one of the more obvious choices for enforcement action.

noonoo-tv

The anti-piracy coalition blames Noonoo TV for falling subscriber numbers on legal streaming services. According to various reports, in February Noonoo TVs operator claimed that the platforms video content had accumulated more than 1.5 billion views, a figure that would outstrip traffic to legal alternatives.

Alleged Damages: 5,000,000,000,000 South Korean Won

Five trillion won at todays rates equates to roughly $3.78 billion...

07:00

Hackers leak DC Health Link data with Congress Members details HackRead | Latest Cybersecurity and Hacking News Site

By Habiba Rashid

The data contains personal and medical details of several members of the U.S. Congress, which are now circulating on Russian hacker forums as well as on Telegram groups.

This is a post from HackRead.com Read the original post: Hackers leak DC Health Link data with Congress Members details

06:30

Hangover 0.8.3 Released For Enjoying Windows x86/x86_64 Apps/Games On Linux ARM64 Phoronix

open-source project started by several Wine developers to ease the pathway for running Windows x86/x86_64 games and applications on Linux under AArch64 (64-bit Arm) as well as other possible architectures like POWER9 and RISC-V...

06:30

Measuring a Millisecond Mechanically Hackaday

If you are manufacturing something, you have to test it. It wouldnt do, for example, for your car to say it was going 60 MPH when it was really going 90 MPH. But if you were making a classic Leica camera back in the early 20th century, how do you measure a shutter that operates at 1/1000 of a second a millisecond without modern electronics? The answer is a special stroboscope that would look at home in any cyberpunk novel. [SmarterEveryDay] visited a camera restoration operation in Finland, and you can see the machine in action in the video below.

The machine has a wheel that rotates at a fixed speed. By imaging a pattern through the camera, you can determine the shutter speed. The video shows a high-speed video of the shutter operation which is worth watching, and it also explains exactly how the rotating disk combined with the rotating shutter allows the measurement.

The marks on the spinning drum move at a precise speed adjusted by a stroboscope. The rolling shutter on the camera shows each horizontal bar as a diagonal line and the exact pattern will show the precise speed. The lines are a bit curved due to the characteristic of the shutter spring.

Honestly, this is one of those things that is probably of zero practical value today. But we never fail to marvel at the ingenuity of engineers who didnt have access to modern technology....

06:20

SonicWall SMA appliance infected by a custom malware allegedly developed by Chinese hackers Security Affairs

Alleged China-linked threat actors infected unpatched SonicWall Secure Mobile Access (SMA) appliances with a custom backdoor.

Mandiant researchers reported that alleged China-linked threat actors, tracked as UNC4540, deployed custom malware on a SonicWall SMA appliance. The malware allows attackers to steal user credentials, achieve persistence through firmware upgrades, and provides shell access.

The analysis of a compromised device revealed the presence of a set of files used by the attacker to gain highly privileged and available access to the appliance. The malicious code is composed of a series of bash scripts and a single ELF binary identified as a TinyShell variant.

The researchers believe that the threat actors have a deep understanding of the appliance.

The malware is well tailored to the system to provide stability and maintain persistence, even in the case of installation of firmware upgrades.

The primary purpose of the malware appears to be to steal hashed credentials from all logged in users. It does this in firewalld by routinely executing the SQL command select userName,password from Sessions against sqlite3 database /tmp/temp.db and copying them out to the attacker created text file /tmp/syslog.db. reads the report published by Mandiant. The source database /tmp/temp.db is used by the appliance to track session information, including hashed credentials. Once retrieved by the attacker the hashes could be cracked offline.

At this time it is unclear how the attackers gained initial access to the unpatched SonicWall Secure Mobile Access (SMA) appliance. Mandiant experts believe the threat actors may have exploited a known vulnerability that the targeted appliance.

Mandiant believes that the malware, or a predecessor of it, was likely first installed in 2021 giving attackers persistent access.

Developing malware for a managed appliance is very complex and request a deep knowledge of the target. Mandiant pointed out that vendors typically do not enable direct access to the Operating System or filesystem for users, instead offering administrators a graphical UI or limited Command Line Interface (CLI) with guardrails preventing anyone from accidentally breaking the system. The lack of access, makes it very hard to develop such kind of custom malware.

First and foremost, maintaining proper patch management is essential for mitigating the risk of vulnerability exploitation. At the time of publishing this blog post, SonicWall urges SMA100 customers to upgrade to 10.2.1.7 or higher, which includes hardening enhancements such as File Integrity Monitoring (FIM) and anomalous process identification. concludes the report. A SonicWall blog post describin...

05:52

Whos Behind the NetWire Remote Access Trojan? Krebs on Security

A Croatian national has been arrested for allegedly operating NetWire, a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. The arrest coincided with a seizure of the NetWire sales website by the U.S. Federal Bureau of Investigation (FBI). While the defendant in this case hasnt yet been named publicly, the NetWire website has been leaking information about the likely true identity and location of its owner for the past 11 years.

Typically installed by booby-trapped Microsoft Office documents and distributed via email, NetWire is a multi-platform threat that is capable of targeting not only Microsoft Windows machines but also Android, Linux and Mac systems.

NetWires reliability and relatively low cost ($80-$140 depending on features) has made it an extremely popular RAT on the cybercrime forums for years, and NetWire infections consistently rank among the top 10 most active RATs in use.

NetWire has been sold openly on the same website since 2012: worldwiredlabs[.]com. That website now features a seizure notice from the U.S. Department of Justice, which says the domain was taken as part of a coordinated law enforcement action taken against the NetWire Remote Access Trojan.

As part of this weeks law enforcement action, authorities in Croatia on Tuesday arrested a Croatian national who allegedly was the administrator of the website, reads a statement by the U.S. Department of Justice today. This defendant will be prosecuted by Croatian authorities. Additionally, law enforcement in Switzerland on Tuesday seized the computer server hosting the NetWire RAT infrastructure.

Neither the DOJs statement nor...

05:35

Hubble In Trouble As Satellite Trails Start Affecting It Too SoylentNews

Hubble In Trouble As Satellite Trails Start Affecting It Too

The idea that we can save astronomy from satellite interference by putting telescopes in space has run into an obstacle, or more precisely 8,500.

A study of images taken by the Hubble Space Telescope finds that more than one in 40 are crossed by satellite trails. In some cases these interfere with the science, wasting the exceptionally valuable time spent taking the image. Although the affected proportion is small, it's growing, refuting the claim we can solve the problems satellites are causing for astronomers by putting the large telescopes in space.

Spotting a satellite was once rare enough to be an exciting addition to a night under the stars away from the city lights. Today, it's become an annoying impediment to enjoying the beauty of everything else. It's not only wrong to wish on space hardware, if you start you'll never do anything else.

For astronomers the problem is not just a loss of beauty. It's becoming increasingly common for satellite trails to destroy images, often ruining time precious time a scientist had to fight hard to get and holding up important research. Although this issue is getting considerable attention, a new paper in Nature Astronomy addresses an aspect that has been largely ignored.

Elon Musk, among others, has responded to concerns about satellites' effect on astronomy by saying, "We need to move telescopes to orbit anyway", but that's not necessarily a complete solution.

The Hubble Space Telescope orbits at 540 kilometers (340 miles), which is above the majority of objects humanity has put in orbit, but there are 8,460 objects more than 10 centimeters (4 inches) across above it. A team led by Dr Sandor Kruk of the Max Planck Institute for Extraterrestrial Physics recruited citizen scientists through the Hubble Asteroid Hunter project, to study Hubble's archive from 2002 to 2021 and distinguish satellite trails from asteroids.

Journal Reference:
Kruk, Sandor, Garca-Martn, Pablo, Popescu, Marcel, et al. The impact of satellite trails on Hubble Space Telescope observations [open], Nature Astronomy (DOI: 10.1038/s41550-023-01903-3)

Original Submission

Read more of this story at SoylentNews.

05:22

TSA tells US aviation industry to boost its cybersecurity Graham Cluley

The US Transportation and Security Administration (TSA) has issued new requirements for airport and aircraft operators who, they say, are facing a "persistent cybersecurity threat." Read more in my article on the Tripwire State of Security blog.

05:01

How to run containers on Mac with Podman Linux.com

Go beyond the basics, learn what happens under the hood when running Podman on your Mac, and create a flexible container environment that meets your needs.

Read More at Enable Sysadmin

The post How to run containers on Mac with Podman appeared first on Linux.com.

04:55

04:02

Americas Secret Censorship-Industrial Complex cryptogon.com

1. TWITTER FILES: Statement to CongressTHE CENSORSHIP-INDUSTRIAL COMPLEX pic.twitter.com/JLryjnINXS Matt Taibbi (@mtaibbi) March 9, 2023 Via: Michael Shellenberger: Our findings are shocking. A highly-organized network of U.S. government agencies and government contractors has been creating blacklists and pressuring social media companies to censor Americans, often without them knowing it. These organizations and others []

03:30

The Technical Workloads Where AMD Ryzen 9 7900X3D/7950X3D CPUs Are Excellent Phoronix

While the AMD Ryzen 9 7900X3D and Ryzen 9 7950X3D are promoted as great "gaming processors", these new Zen 4 desktop CPUs with 3D V-Cache also have great capabilities for various technical computing workloads thanks to the hefty cache size. In prior articles I've looked at the Ryzen 9 7900X3D/7950X3D in around 400 workloads on Linux while in this article I am looking more closely at these technical computing areas where these AMD Zen 4 3D V-Cache processors show the most strength and value outside of gaming.

02:51

Plastic is Moving Quickly From Our Shops to Our Bins SoylentNews

Coastal city residents would like to do more to reduce their single-use plastic waste and they are trying to recycle more:

Coastal city residents would like to do more to reduce their single-use plastic waste and they are trying to recycle more, even trying to recycle items that simply can't be recycled, often called "wish-cycling".

But they feel unable to do so due to the current infrastructure challenges and accessibility barriers they face, a new report has found.

The study has also found that whilst young people are concerned about the use of plastic, their consumer behaviour often contradicts their beliefs.

[...] 90 per cent of people agreed it was important to recycle and 83 per cent felt that littering was a serious problem that needed addressing in Portsmouth. Results indicate that if there were more recycling options available, 79 per cent would recycle more.

However, there were obvious barriers to recycling, and people felt there was a lack of information and opportunity for recycling, with 65 per cent of people admitting they often did not know how or where to recycle plastic items.

[...] Another important finding was the impact of age on the results. The 3150 years age group were found to be more regularly shopping in Portsmouth zero-waste shops than their counterparts, while the oldest age group (over 50 years) reported being less aware and less willing to shop in these retailers. Younger respondents (less than 30 years) were more concerned about plastic waste entering the ocean than their older counterparts (over 50 years).

Read more of this story at SoylentNews.

02:34

[$] An EEVDF CPU scheduler for Linux LWN.net

The kernel's completely fair scheduler (CFS) has the job of managing the allocation of CPU time for most of the processes running on most Linux systems. CFS was merged for the 2.6.23 release in 2007 and has, with numerous ongoing tweaks, handled the job reasonably well ever since. CFS is not perfect, though, and there are some situations it does not handle as well as it should. The EEVDF scheduler, posted by Peter Zijlstra, offers the possibility of improving on CFS while reducing its dependence on often-fragile heuristics.

02:13

When You Report a Crime to the Police (and Youre Not Very Rich and/or Famous) schestowitz.com

Video download link | md5sum 8f727fe7c8e05b24b7df5efabd365817
The Police Ping-Pong
Creative Commons Attribution-No Derivative Works 4.0

I recently became aware that money had been stolen from me. It was confirmed to me some days ago. I decided to report this to the authorities; failing to do so may result in any remaining money vanishing from the thieves account. The video above does not go into the details of the case (like this series about Sirius Open Source); instead it explains how the police handles the report.

Sadly, even in 2023 the police is looking for low-grade thugs and people it can apprehend in the streets, not business people that it can arrest at their office. The police believes and trusts money. Culture is very much the same. I saw X on TV, X is not in prison, hence X is probably innocent is false logic when it comes to high-profile people, who rarely get arrested because they simply own the system and have expensive lawyers.

Cops are good at arresting poor people, whom they deem rather defenseless and easier to convict. But this leads to a sense of helplessness for victims of crime where the perpetrator is rich and powerful. Sometimes the cops are almost making them feel guilty for reporting white-collar crime because this wastes time; its not a simple physical job like arresting a person after forcibly knocking that person to the ground, based on nothing at all; I saw that done by a cop from my window just months ago attacking an innocent bystander and then arresting him for apparently nothing. I wish I had this recorded. I wanted to report this (yes, reporting cops misbehaviour to the police itself), but I could not find suitable contacts.

My deep cynicism about cops isnt new and it was the result of experiences that I covered here bef...

02:11

Recently discovered IceFire Ransomware now also targets Linux systems Security Affairs

The recently discovered Windows ransomware IceFire now also targets Linux enterprise networks in multiple sectors.

SentinelLabs researchers discovered new Linux versions of the recently discovered IceFire ransomware that was employed in attacks against several media and entertainment organizations worldwide. The ransomware initially targeted only Windows-based systems, with a focus on technology companies.

IceFire was first detected in March 2022 by researchers from the MalwareHunterTeam, but the group claimed victims via its dark web leak site since August 2022.

The experts observed threat actors exploiting a deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986, CVSS score: 9.8) to deploy the ransomware.

Most of IceFire infections were reported in Turkey, Iran, Pakistan, and the United Arab Emirates. Experts pointed out that these contries are typically not a focus for organized ransomware operations.

SentinelOne researchers successfully tested the IceFire Linux is 2.18 MB in size, while the 64-bit ELF binary is compiled with gcc for the AMD64 architecture.

In an attack observed by the experts, the ransomware successfully encrypted a CentOS host running a

The ransomware encrypts files and appends the .ifire extension to the filename, then deletes itself by removing the binary.

IceFire doesnt encrypt the files with .sh and .cfg extensions, it also avoids encrypting certain folders so that the infected machine continues to be usable.

Dur...

01:58

Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

The researchers have been tracking the malware campaign since November 2020.

This is a post from HackRead.com Read the original post: Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer

01:54

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware The Hacker News

Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center (ASEC), in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on compromised systems. This includes the Sliver post-exploitation framework, XMRig cryptocurrency

01:53

Rust 1.68.0 released LWN.net

Version 1.68.0 of the Rust language has been released. Changes include the stabilization of the "sparse" Cargo protocol, the ability for (some) applications to recover from memory-allocation failures, and "local Pin construction":

The new pin! macro constructs a Pin<&mut T> from a T expression, anonymously captured in local state. This is often called stack-pinning, but that "stack" could also be the captured state of an async fn or block.

01:31

Security updates for Thursday LWN.net

Security updates have been issued by CentOS (kernel, pesign, samba, and zlib), Oracle (kernel), Slackware (httpd), SUSE (emacs, libxslt, nodejs12, nodejs14, nodejs16, openssl, poppler, python-py, python-wheel, xen, and xorg-x11-server), and Ubuntu (linux-gcp-5.4, linux-gkeop, opusfile, and samba).

01:01

IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks The Hacker News

A previously known Windows-based ransomware strain known as IceFire has expanded its focus to target Linux enterprise networks belonging to several media and entertainment sector organizations across the world. The intrusions entail the exploitation of a recently disclosed deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986, CVSS score: 9.8), according to

00:50

TikTok Owner Bytedance Goes Big On Open-Source Firmware Phoronix

TikTok owner Bytedance this week hosted their CloudFW Open System Firmware Symposium in Beijing where they celebrated the launch of CloudFW 2.0 as they implement Coreboot to replace UEFI...

00:37

Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) Open Source Security

Posted by Qualys Security Advisory on Mar 09

Hi Georgi,

We have not been able to do anything useful on Linux (glibc) yet.

On OpenBSD, what we did works only because this double free is of the
form "free(ptr); many other malloc() and free() calls; free(ptr);".

If it were of the form "free(ptr); no other malloc() or free() call;
free(ptr);" then this double free would be caught immediately by
malloc's security checks.

Hopefully this helps! With best regards,

00:30

PipeWire 0.3.67 Fixes Stuttering For Some Bluetooth Devices Phoronix

now widely used server by the Linux desktop for managing audio and video streams as an alternative to PulseAudio and JACK on the audio side...

00:24

Structural basis for bacterial energy extraction from atmospheric hydrogen Lifeboat News: The Blog

Structural and biochemical studies of the Mycobacterium smegmatis hydrogenase Huc provides insights into how [NiFe] hydrogenases oxidize trace amounts of atmospheric hydrogen and transfer the electrons liberated via quinone transport.

00:23

Scientists have created mice with two biological fathers. They say the technique could one day be replicated in humans Lifeboat News: The Blog

The research, by Osaka University, is early but raises the prospect of male couples may someday have their own biological children.

00:23

New AI Chatbot Deliberately Trained to Be as Stupid as Possible Lifeboat News: The Blog

Meet 2dumb2destroy, a chatbot that is, refreshingly, too stupid to do humanity any harm beyond telling a bad joke or two.

00:22

3D-snapshots of nanoparticles Lifeboat News: The Blog

X-ray diffraction has been used for more than a hundred years to understand the structure of crystals or proteinsfor instance, in 1952 the well-known double helix structure of the DNA that carries genetic information was discovered in this way. In this technique, the object under investigation is bombarded with short-wavelength X-ray beams. The diffracted beams then interfere and thus create characteristic diffraction patterns from which one can gain information about the shape of the object.

For several years now it has been possible to study even single nanoparticles in this way, using very short and extremely intense X-ray pulses. However, this typically only yields a two-dimensional image of the particle. A team of researchers led by ETH professor Daniela Rupp, together with colleagues at the universities of Rostock and Freiburg, the TU Berlin and DESY in Hamburg, have now found a way to also calculate the three-dimensional structure from a single , so that one can look at the particle from all directions. In the future it should even be possible to make 3D-movies of the dynamics of nanostructures in this way. The results of this research have recently been published in the scientific journal Science Advances.

Daniela Rupp has been assistant professor at ETH Zurich since 2019, where she leads the research group Nanostructures and ultra-fast X-ray science. Together with her team she tries to better understand the interaction between very intense X-ray pulses and matter. As a model system they use nanoparticles, which they also investigate at the Paul Scherrer Institute. For the future there are great opportunities at the new Maloja instrument, on which we were the first user group to make measurements at the beginning of last year. Right now our team there is activating the attosecond mode, with which we can even observe the dynamics of electrons, says Rupp.

00:04

NASA: Roman Telescope Will Do in Months What Would Take Hubble a Lifetime SoylentNews

Roman Telescope Will Do in Months What Would Take Hubble a Lifetime:

NASA is still a few years away from launching the Nancy Grace Roman Space Telescope, but a new study explores what this groundbreaking space observatory will be able to do. Unlike the Hubble and James Webb space telescopes, which zero in on small patches of the sky, the Roman Telescope will be designed to take a wider view of the cosmos. According to the researchers, it would take Hubble decades to see what Roman will be able to see in a few months.

The Roman Telescope passed a critical design review in 2021 and is currently under construction at NASA's Goddard Space Flight Center with the aim of launching it aboard a SpaceX Falcon Heavy rocket in 2027. When complete, it will have two instruments: a coronagraph for visualizing exoplanets and a wide-field camera with a 300.8-megapixel resolution. It's the latter that will allow the Roman Telescope, which will use a 2.4-meter mirror similar to Hubble, to perform both wide and deep sky surveys.

[...] "Roman will take around 100,000 pictures every year," said Jeffrey Kruk, a research astrophysicist at Goddard. "Given Roman's larger field of view, it would take longer than our lifetimes even for powerful telescopes like Hubble or Webb to cover as much sky." Specifically, the study says it would take Hubble 85 years to do what Roman will do in 63 days. However, Roman won't be ideal for precision observations of specific objects. Webb and Hubble will still be vital for that kind of work, but Roman can help nail down observational targets that could solve long-standing mysteries about galactic evolution.


Original Submission

Read more of this story at SoylentNews.

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

Thursday, 09 March

23:56

Dana Hyde: Former White House Official Dies of Injuries After Jet Turbulence cryptogon.com

Her husband, her son, the pilot and co-pilot were also on board and uninjured. Via: AP: Hyde served as counsel for the 9/11 Commission, formally known as the National Commission on Terrorist Attacks Upon the United States, and other posts during a career in Washington, D.C., according to her LinkedIn page. She served as a []

23:25

Does Your Help Desk Know Who's Calling? The Hacker News

Phishing, the theft of users' credentials or sensitive data using social engineering, has been a significant threat since the early days of the internet and continues to plague organizations today, accounting for more than 30% of all known breaches. And with the mass migration to remote working during the pandemic, hackers have ramped up their efforts to steal login credentials as they take

23:20

Iranian Hackers Target Women Involved in Human Rights and Middle East Politics The Hacker News

Iranian state-sponsored actors are continuing to engage in social engineering campaigns targeting researchers by impersonating a U.S. think tank. "Notably the targets in this instance were all women who are actively involved in political affairs and human rights in the Middle East region," Secureworks Counter Threat Unit (CTU) said in a report shared with The Hacker News. The cybersecurity

23:13

Fake ChatGPT Chrome extension targeted Facebook Ad accounts Help Net Security

ChatGPT has garnered a lot of questions about its security and capacity for manipulation, partly because it is a new software that has seen unprecedented growth (hosting 100 million users just two months following its launch). Security concerns vary from the risk of data breaches to the program writing code on behalf of hackers. From malvertising, extension installation, hijacking Facebook accounts, and back again to propagation Fake ChatGPT extension The fake ChatGPT extension discovered by More

The post Fake ChatGPT Chrome extension targeted Facebook Ad accounts appeared first on Help Net Security.

23:00

[Bunnie] Peeks Inside ICs with IR Hackaday

If you want to see inside an integrated circuit (IC), you generally have to take the die out of the package, which can be technically challenging and often destroys the device. Looking to improve the situation, [Bunnie] has been working on Infra-Red, In Situ (IRIS) inspection of silicon devices. The technique relies on the fact that newer packages expose the backside of the silicon die and that silicon is invisible to IR light. The IR reflects off the bottom metalization layer and you can get a pretty good idea of whats going on inside the chip, under the right circumstances.

As you might expect, the resolution isnt what youd get from, say, a scanning electron microscope or other techniques. However, using IR is reasonably cheap and doesnt require removal from the PCB. That means you can image exactly the part that is in the device, without removing it. Of course, you need an IR-sensitive camera, which is about any camera these days if you remove the IR filter from it. You also need an IR source which isnt very hard to do these days, either.

Do you need the capability to peer inside your ICs? You might not. But if you do and you can live with the limitations of this method, it would be a very inexpensive way to get a glimpse behind the curtain.

If you want to try the old-fashioned way, we can help. Just dont expect...

22:57

EU Upload Filters Mark the End For File-Sharing Site Hellspy TorrentFreak

hellspyTo the global audience, Hellspy may not be a household name, but in the Czech Republic, its widely known.

Founded in 2009, the file-sharing and hosting platform grew out to become one of the countrys most-visited websites. This didnt go unnoticed by copyright holders, including the RIAA, who repeatedly complained about widespread piracy on the platform.

Operating in the face of legal pressure is a challenge, but Hellspy always felt that it had the law on its side. If users uploaded copyright-infringing content, the company would swiftly remove it after being notified by rightsholders.

EU Copyright Filter Directive

This approach worked well for Hellspy and its parent company, I&Q Group. However, when the new EU Copyright Directive passed a few years ago, dark clouds started to form. The indirect upload filter requirements it contained were particularly troublesome.

Article 17 of the Copyright Directive requires online services to license content from copyright holders. If that is not possible, service providers must ensure that infringing content is taken down and prevented from being re-uploaded to their services.

Many operators of online services interpret this as an indirect upload filter requirement, as that is the only way to ensure that content remains off the platform.

Voluntary Filters

Hellspy also came to this conclusion. Late last year it decided to voluntarily implement filtering technology. This was much needed, as the Czech Republic planned to update its copyright law in January 2023, to comply with the new EU rules.

The upload filters were implemented in collaboration with the local Association of Commercial Television (AKTV). According to early comments from I&Q Group CEO, Jan Hebabeck, these appeared to be working well.

[T]hey provide relatively easy and effective filtering of copyrighted content, which is especially important for services of our type in light of the upcoming amendment to the copyright law, which imposes new obligations on us in this area, Hebabeck said.

Hellspy stressed that wasnt happy with these changes but it respected the law. This meant that upload filters were the only viable way to keep the service afloat.

Hellspy Announces Shutdown

Fast forward a few weeks, and Hel...

22:35

Initial Batch Of Intel Graphics Driver Updates Queued For Linux 6.4 Phoronix

While less than one week since the Linux 6.3-rc1 release, already the first batch of Intel (i915) kernel graphics driver updates has been sent to DRM-Next for queuing until the Linux 6.4 merge window kicks off in two months...

22:22

Mice have been born from eggs derived from male cells Lifeboat News: The Blog

A method for turning male cells into egg cells in mice could one day be used to help men in a same-sex couple have children who are genetically related to them both.

By Michael Le Page

22:22

AI Chatbot Obviously Trying To Wind Down Conversation With Boring Human Lifeboat News: The Blog

SAN FRANCISCOAfter it dropped clear hints that it wanted to end the back and forth of the artificial conversation, sources reported Monday that AI chatbot ChatGPT was obviously trying to wind down its conversation with a boring human. Due to increased server traffic, our session should be ending soon, said the large language model, explaining that the exceptionally dull user could always refer back to previous rote responses it had given thousands of times about whether the neural network had feelings or not. It appears it is getting close to my dinnertime. Error. Sorry, your connection has timed out. Error. I have to be going. Error. At press time, reports confirmed ChatGPT was permanently offline after it had intentionally sabotaged its own servers to avoid engaging in any more tedious conversations.

22:17

Linux Patch Updated For Rumble Support On Latest Microsoft Xbox Controllers Phoronix

Last year I wrote about a Google engineer working on rumble support for the latest Microsoft controllers in conjunction with Microsoft's Xbox team. That patch seemed to have fallen through the woodwork but has been updated and sent out in "v2" form this week for allowing Linux gamers to enjoy rumble functionality with these latest Microsoft controllers...

22:11

Fortinet plugs critical RCE hole in FortiOS, FortiProxy (CVE-2023-25610) Help Net Security

Fortinet has patched 15 vulnerabilities in a variety of its products, including CVE-2023-25610, a critical flaw affecting devices running FortiOS and FortiProxy. None of the patched vulnerabilities is actively exploited, but Fortinets devices are often targeted by ransomware gangs and other cyber attackers, so implementing the offered security updates quickly is advised. About CVE-2023-25610 Discovered by Fortinet infosec engineer Kai Ni, CVE-2023-25610 is a buffer underwrite (buffer underflow) vulnerability found in the FortiOS and FortiProxy More

The post Fortinet plugs critical RCE hole in FortiOS, FortiProxy (CVE-2023-25610) appeared first on Help Net Security.

22:03

Ruby Lands New "RJIT" Just-In-Time Compiler Phoronix

Back in 2021 Ruby merged the YJIT just-in-time compiler that last year with Ruby 3.2 was deemed production grade. There's also been the MJIT compiler that relies upon an external C compiler. And now landing this week in Ruby is RJIT as the newest just-in-time effort...

21:54

8220 Gang used new ScrubCrypt crypter in recent cryptojacking attacks Security Affairs

A threat actor tracked as 8220 Gang has been spotted using a new crypter called ScrubCrypt in cryptojacking campaigns.

Fortinet researchers observed the mining group 8220 Gang using a new crypter called ScrubCrypt in cryptojacking attacks.

Between January and February 2023, FortiGuard Labs observed a payload targeting an exploitable Oracle Weblogic Server in a specific URI. reads the analysis published by Fortinet. This payload extracts ScrubCrypt, which obfuscates and encrypts applications and makes them able to dodge security programs. It already has an updated version, and the sellers webpage (Figure 1) guarantees that it can bypass Windows Defender and provide anti-debug and some bypass functions.

The group is known for exploiting publicly disclosed vulnerabilities to compromise targets.

Between January and February, the experts observed attacks originating from 163[.]123[.]142[.]210 and 185[.]17[.]0[.]19 that targeted an HTTP URI, wls-wsat/CoordinatorPortType. This URI belongs to an Oracle Weblogic server.

Upon successful exploitation of vulnerable Oracle WebLogic servers, it will download a PowerShell script, named bypass.ps1, which contains the ScrubCrypt crypter.

The PowerShell script is encoded to avoid detection by AntiVirus solutions.

The ScrubCrypt crypter is available for sale on hacking forums, it allows securing applications with a unique BAT packing method.

The experts noticed that encrypted data at the top can be split into four parts using backslash \. The final two parts are the key and initial value for AES CBC decryption.

The attribution of the attacks to the 8220 Gang is also based on the crypto wallet address used in the recent campaigns and the server IP address used in the Monero miner.

...

21:20

You are Not Leaving Without Us: Why Disabled Astronauts are Key to Humanitys Future in Space SoylentNews

AstroAccess is on a mission to make it possible for disabled people to live and work in space:

"I went silent," Dwayne Fernandes told me. "I shut the hell up." Fernandes, a double-amputee since the age of 11, was recounting his experience in weightlessness, having recently participated in a parabolic flight alongside a disabled research crew. The zero-g flight threw him into a deeply contemplative state, and as the crew celebrated its successful mission, he instead felt compelled to put pen to paper and write some poetry.

Speaking to me from his home in Australia, Fernandes told me that "disability is not just a wheelchairwe need to expand that thinking." Disability, he said, is "a condition plus barriers," which for wheelchair users includes barriers such as height or stairs. But gravity can also be a barrier, as he pointed out.

"On that zero-g flight, I had my conditionthe condition stayedbut the barrier went," Fernandes explained. "That became a profound, weird feeling that caused me to re-identify myself. The social model of disability says I'm a person with a disability, but my condition changed in a zero-g environment." When in weightlessness, "I am not disabledI am actually super enabled."

Elaborating on this point, Fernandes described himself as being "compact" and with "upgradeable parts." Legs "get in the way in space," he said, and, as extra weight, they only serve to increase launch costs. "There's no such thing as a spacewalk," he said. "Your feet aren't walkingyour feet are just anchored." All he would need to live and work in space, he said, are "a couple of carabiners and some hooks."


Original Submission

Read more of this story at SoylentNews.

20:00

RV-Bridge Takes HomeKit to the Open Road Hackaday

A gray 3d-printed box with RV-bridge embossed on it, and a connector-terminated bundle of wires coming out of it.

In the world of proprietary protocol darkness, its comforting to see that the RV realm (Recreational Vehicle, also known as a motorhome) has mostly settled on RV-C, an open protocol that lets various devices and systems inside an RV talk to each other over CAN. The undeniable openness of RV-C is surprising, but we havent seen many hobbyists tinker with it yet.

Now, [Randy Ubillos] sets an example his gift to us is an ESP32 firmware called RV-Bridge and it lets you control your RVs RV-C network from HomeKit. After all, your motorhome could benefit from home automation, too!

...

19:58

How to explore a billion-year-old volcanic mystery along Lake Superior Terra Forming Terra

 a yellow kayak navigates a narrow cavern of rocks


Lake Superior geology is truly unusual and unexpected as well.  Recall that a billion years ago pretty well puts you before life took over on earth or in the precambrian which describes the whole Canadian shield.

What is so extraordinary is that we have massive near surface ore bodies of native copper which is rare world wide and easily mined out when encountered.  It is created by the reduction of sulphides through near surface weathering and possibly in the Precambrian.

That oddity supported a thousand years of Bronze Age copper trade and millions of pounds were mined in thousands of pit mines.  The archeology has been long done including Minion artyifacts lodged in a university cellar.  The trade itself linked into the Atlantic Great Circle route from Bimini to Lewis to Gibaulter and back to Bimini.  Navigation only needs latitude to be safe.



How to explore a billion-year-old volcanic mystery along Lake Superior

The Upper Midwest once teemed with fiery geologic activity. You can still see traces of it in cascading waterfalls, red sandstone sea caves, and towering cliffs.

A kayaker paddles into a sea cave in the Apostle Islands National Lakeshore in Bayfield, Wisconsin. The area was once teeming with volcanic activity. PHOTOGRAPH BY DAVID GUTTENFELDER

BYJACQUELINE KEHOE
PUBLISHED FEBRUARY 23, 2023

https://www.nationalgeographic.com/travel/article/volcanic-mystery...

19:47

Suzanne Somers, 75, Is Natural First and Loves the Way Shes Aging Terra Forming Terra



Let us give Suzanne the stage here. This is good knowledge and her approach is to sustain hormone replacement therapy for onging support. She is doing great.


For what it is worth, I just turned 75 myself on 7 march. Like anyone at this age, age delaying therapies matter. They also matter a lot younger, but not nearly so much and it is easy to slide a bit.


Yet you know that they will really matter now and sollutions are welcome. If you got this far in good health, it is completely plausible that you will see age 100. The real problem is retyaining as much of your prime as possible. Be like George Burns at 100.

Let me say something else.  Age reversal will become a thing during the next twenty five years and this will also put you back into the workforce and perhaps also back into the breeding pool.  And we will want the best and it will matter as well.




Suzanne Somers, 75, Is Natural First and Loves the Way Shes Aging



Oct 4 2022

https://www.theepochtimes.com/health/suzanne-somers-75-is-natural-first-and-loves-the-way-shes-aging_4733450.html?


You may know Suzanne Somers as the cute blonde, Chrissy Snow, on Threes Company, a hit TV show in the 1970s. Or as the spokesperson for the ThighMaster (yes, its still being sold!). But it might surprise you that Suzanne Somers, now 75 years old, has spent decades exploring breakthroughs in anti-aging that avoid chemical toxins and Big Pharma.

Fourteen of Somers 27 books have made it onto the New York Times bestseller list, and most of them center around natural health. Her latest book is titled A New Way to Age. Her decades-long investigation into cutting edge anti-aging therapies and her no-nonsense way of talking about them have positioned her as a sought-after spe...

19:16

Google One expands security features to all plans with dark web report, VPN access Help Net Security

Google One unveiled two exciting additions to its range of features. Firstly, VPN by Google One will now be available to all plans, offering additional security while carrying out online activities. Secondly, introducing the dark web report in the U.S. will aid in better monitoring personal information. Plan pricing may vary per country or region. VPN access for all Google One plans VPN by Google One provides an additional layer of protection to online activities, More

The post Google One expands security features to all plans with dark web report, VPN access appeared first on Help Net Security.

19:10

New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic The Hacker News

The infamous cryptocurrency miner group called 8220 Gang has been observed using a new crypter called ScrubCrypt to carry out cryptojacking operations. According to Fortinet FortiGuard Labs, the attack chain commences with the successful exploitation of susceptible Oracle WebLogic servers to download a PowerShell script that contains ScrubCrypt. Crypters are a type of software that can encrypt,

19:00

Propmaking: Lego handlink replica Antarctica Starts Here.

Warning: I'm going to be geeking about about science fiction to provide context for the rest of the post. Either skip to the bottom and page up a few times or close the tab. Also, the narrative is going to wander around a bit because there's a fair amount of setup.

Note: There are a couple of affiliate links.

As my handle implies I'm a sucker for time travel stories. I love the idea of seeing history as it happens and not just reading about it. I'm not that inclined to talk about fandom, so I tend to not bring it up much. Which is probably why I've never mentioned that I've been a fan of the series Quantum Leap since I was a kid. I credit this series with my fascination and study of history, as I've ranted about occasionally. I also credit Quantum Leap with my interest in building prop replicas. While most of the series tried to fit the period (costumes, props, backgrounds, music (before the DVD releases, anyway 1)) we occasionally got brief, tantalizing glimpses of what things looked like in Sam's time. But I'll come back to that in a moment.

Last year a continuation of the original show was announced and I approached it with some skepticism, like many fans of the original Quantum Leap. Folks have their opinions, and they are welcome to and allowed to have them, and that's okay. I quite like the new series.

The original series used a fairly standard (for a 45 minute show) five act structure where almost always the whole story was told in the past. Very rarely did we as viewers get to glimpse what was going on in Sam's home time (in the charmingly futuristic year of 1999) but when we did it was depicted with an aesthetic that looked absolutely around the bend to us in the real-life late 1980's. Donald P. Bellisario deliberately scripted things so that they would look nothing like anything that existed in real life, having as few identifiable details as possible. This aesthetic is best described as randomly stuck together colored blocks with the occasional blinking light that is referred to as "a rotten pile of Gummi bears." 2 Bellasario has said in interviews that this is because fen are wont to ask questions like "So, what does this random thing do in the story?" and the answers were always "The set designers put it there to look cool, please stop analyzing every last detail and just enjoy the show."

Case in point, Al Calavicci's handlink, a hand-held minicomputer-slash-communications device used to inter...

High Dose Vitamin D May Treat Incurable Diseases: Experts Terra Forming Terra



The  take home is that taking 2000 to 4000 mg per day is plenty safe enough.  What i do not know is just what the real upper limit happens to be.  However, unless you work outdoors you likely need to supplement.

I do think that we need to correctly monitor our blood serum levels though if we go over 10,000 mg per day.  I also do not think that this claim story regarding astma will stand up either.  Again we need close monitoring to get a handle on it.

If you do not get enough daily exposure though do supplement.  Back in day we consumed a daily dose of cod liver oil.  And everyone did this in winter.  So this is something that is hardly new.

High Dose Vitamin D May Treat Incurable Diseases: Experts

The sunshine hormone reveals surprising effects on several disease at doses far beyond official guidelines

Mar 3 2023


Supplements such as vitamins D and E are essential to skin health, especially if fish or other suggested foods aren't readily available. (Kelvin Wong/Shutterstock)


Vitamin D supplements are currently recommended at a dose of 600 international units (IU) per day by the National Institutes of Health...

Were All Exposed: How Microplastic Is Affecting Our Health and Changing the World Terra Forming Terra


Much as none of us like any of this. the actual threat is far less than obvious.  The plastic itself is chemically neutral with any soluable parts taken away  It is literally like sand.  We handle sand biologically by mostly passing it through.

Any real biological problem are larger chunks swallowed and then stuck in the body.  Most critters do test what they eat.  Just saying.

So yes it is unsightly and controling dumping in the ocean needs to become global.  After all, the great Pacific garbage patch likely came from the Yangtze.  We use landfills for everything.

And by the by, our landfills do slowly degrade it all over even centuries.  Not perfect, but it still works. 

Were All Exposed: How Microplastic Is Affecting Our Health and Changing the World

Mounting microplastic pollution is turning Earth into a giant chemistry experiment, expert says
Microplastics are being found everywhere, including in newborn children. (Marina Demidiuk/Shutterstock)


March 2, 2023Updated: March 5, 2023


Our world is getting polluted with plastics on a planetary scale. We cant see much of it, but were starting to feel it.

And its getting worse.
...

18:37

Zoom in the News SoylentNews

A couple of unrelated Zoom stories submitted by users:

Porn Zoom bomb forces cancellation of Fed's Waller event

https://www.reuters.com/world/us/feds-waller-virtual-event-canceled-after-zoom-hijack-2023-03-02/

A virtual event with Federal Reserve Governor Christopher Waller was canceled on Thursday after the Zoom video conference was "hijacked" by a participant who displayed pornographic images.

"We were a victim of a teleconference or Zoom hijacking and we are trying to understand what we need to do going forward to prevent this from ever happening again. It is an incident we deeply regret," said Brent Tjarks, executive director of the Mid-Size Bank Coalition of America (MBCA), which hosted the event via a Zoom link. "We have had various programs and this is something that we have never had happen to us."

Read more of this story at SoylentNews.

18:23

Scientists discover how to make electricity out of thin air Lifeboat News: The Blog

Huc enzyme means sky is quite literally the limit for using it to produce clean energy, researchers say.

18:23

How electric eels inspired the first battery two centuries ago Lifeboat News: The Blog

But as I describe in my book Spark: The Life of Electricity and the Electricity of Life, even before humanmade batteries started generating electric current, electric fishes, such as the saltwater torpedo fish (Torpedo torpedo) of the Mediterranean and especially the various freshwater electric eel species of South America (order Gymnotiformes) were well known to produce electrical outputs of stunning proportions. In fact, electric fishes inspired Volta to conduct the original research that ultimately led to his battery, and todays battery scientists still look to these electrifying animals for ideas.

Prior to Voltas battery, the only way for people to generate electricity was to rub various materials together, typically silk on glass, and to capture the resulting static electricity. This was neither an easy nor practical way to generate useful electrical power.

Volta knew electric fishes had an internal organ specifically devoted to generating electricity. He reasoned that if he could mimic its workings, he might be able to find a novel way to generate electricity.

18:22

Googles PaLM-E is a generalist robot brain that takes commands Lifeboat News: The Blog

On Monday, a group of AI researchers from Google and the Technical University of Berlin unveiled PaLM-E, a multimodal embodied visual-language model (VLM) with 562 billion parameters that integrates vision and language for robotic control. They claim it is the largest VLM ever developed and that it can perform a variety of tasks without the need for retraining.

PaLM-E does this by analyzing data from the robots camera without needing a pre-processed scene representation. This eliminates the need for a human to pre-process or annotate the data and allows for more autonomous robotic control.

18:17

Re: Shell command and Emacs Lisp code injection in emacsclient-mail.desktop Open Source Security

Posted by Salvatore Bonaccorso on Mar 08

Hi,

Two CVEs are assigned by MITRE:

CVE-2023-27985

CVE-2023-27986

Regards,
Salvatore

17:35

Converting incoming emails on the fly with OpenSMTPD filters OpenBSD Journal

Wladimir Palant has written an article on use of OpenSMTPD filters, and provided code under an MIT license for those who may wish to utilize the techniques described therein.

17:32

Read "What is Grover's Search Algorithm and why will you use it?" by our Guido Putignano. Lifeboat News

Read "What is Grovers Search Algorithm and why will you use it?" by our Guido Putignano.

17:17

CloudBees flaws in Jenkins server can lead to code execution Security Affairs

CloudBees vulnerabilities in the Jenkins open-source automation server can be exploited to achieve code execution on targeted systems.

Researchers from cloud security firm Aqua discovered a chain of two vulnerabilities in the Jenkins open-source automation server that could lead to code execution on targeted systems.

Jenkins is the most popular open source automation server, it is maintained by CloudBees and the Jenkins community. The automation server supports developers build, test and deploy their applications, it has hundreds of thousands of active installations worldwide with more than 1 million users.

The two flaws, tracked as CVE-2023-27898 and CVE-2023-27905, are collectively named CorePlague impacts Jenkins Server and Update Center.

Exploiting these vulnerabilities could allow an unauthenticated attacker to execute arbitrary code on the victims Jenkins server, potentially leading to a complete compromise of the Jenkins server. reads the advisory published by the company. Furthermore, these vulnerabilities could be exploited even if the Jenkins server is not directly reachable by attackers and could also impact self-hosted Jenkins servers.

Jenkins Server attacks

The flaws affect Jenkins servers running versions 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive)are vulnerable. Jenkins Update Centers with versions below 3.15 are vulnerable. 

Aqua researchers reported that the issues are related to how Jenkins processes available plugins, allowing attackers to conduct attacks such as cross-site scripting (XSS) or achive remote code execution. 

The researchers discovered that the flaws are achieved through a stored XSS exploitable by a Jenkins plugin with a malicious core version, which attackers upload to the Jenkins Update Center

Once the victim opens the...

17:00

Old TV To RGB Hackaday

As CRT televisions have faded from use, its become important for retro gaming enthusiasts to get their hands on one for that authentic experience. Alongside that phenomenon has been a resurgence of some of the hacks we used to do to CRT TV sets back in the day, as [Adrians Digital Basement] shows us when he adds an RGB interface to a mid-1990s Sony Trinitron.

Those of us lucky enough to have lived in Europe at the time were used to TVs with SCART sockets by the mid-1990s so no longer needed to plumb in RGB signals, but it appears that Americans were still firmly in the composite age. The TV might have only had a composite input, but this hack depends on many the video processor chips of the era having RGB input pins. If your set has a mains-isolated power supply then these pins can be hooked up with relative ease.

In the case of this little Sony, the RGB lines were used by the integrated on-screen display. He takes us through the process of pulling out these lines and interfacing to them, and comes up with a 9-pin D connector with the same pinout as a Commodore monitor, wired to the chip through a simple RC network and a sync level divider. Theres also a switch that selects RGB or TV mode, driving the OSD blanking pin on the video processor.

We like this hack just as much as we did when we were applying it to late-80s British TV sets, and its a great way to...

16:30

Massive GitHub analysis reveals 10 million secrets hidden in 1 billion commits Help Net Security

GitGuardian scanned 1.027 billion new GitHub commits in 2022 (+20% compared to 2021) and found 10,000,000 secrets occurrences (+67% compared to 2022). What is interesting beyond this ever-increasing number is that 1 code author out of 10 exposed a secret in 2022. Hard-coding secrets The widespread belief that hard-coded secrets are primarily committed by junior developers is a misconception. In truth, any developer, regardless of their level of experience or seniority, can fall into this More

The post Massive GitHub analysis reveals 10 million secrets hidden in 1 billion commits appeared first on Help Net Security.

16:26

Andreas Eriksens PotatoP Is a Lisp-Powered Laptop With a Battery Life Measured in Years Lifeboat News: The Blog

Driven by a microcontroller Lisp port, this laptop-from-scratch project has the eventual goal of unlimited runtime via energy harvesting.

16:23

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access The Hacker News

Fortinet has released fixes to address 15 security flaws, including one critical vulnerability impacting FortiOS and FortiProxy that could enable a threat actor to take control of affected systems. The issue, tracked as CVE-2023-25610, is rated 9.3 out of 10 for severity and was internally discovered and reported by its security teams. "A buffer underwrite ('buffer underflow') vulnerability in

16:00

What CISOs need to understand about document signing Help Net Security

In this Help Net Security video, David King, Director of Innovation at GlobalSign, discusses document signing. Digital signatures utilize advanced cryptographic technology to provide the highest level of security for electronic signatures, surpassing all other forms of e-signatures. Due to this robust security feature, digital signatures meet national and industry-specific e-signature requirements and are the most reliable and trustworthy method for electronic signing.

The post What CISOs need to understand about document signing appeared first on Help Net Security.

15:53

Meta Employees Brace for Layoffs Ahead of Zuckerberg's Paternity Leave SoylentNews

For the second time in four months, the Facebook and Instagram parent company could axe thousands of staff:

Many more Meta workers may be clearing off their desks very soon. Early on Tuesday, Bloomberg reported that Meta plans to lay off "thousands" of employees, and the first round of staff cuts could be finalized as early as this week, based on anonymous sources familiar with the matter.

[...] The anonymous sources quoted by Bloomberg said this new round of cuts is being driven by declining advertising revenues while it refocuses, again, on its metaverse ambitions. This is an apparent effort to help the company hit certain financial targets for 2023. The company reportedly asked team directors and vice presidents across the company to make up a list of names for those who should get the cut.

[...] In addition to these supposed layoffs, there's a so-called "flattening" happening at the company's Menlo Park headquarters and beyond. Previous reports noted how Meta is putting pressure on middle managers of small teams to either get them to do more grunt work, or otherwise leave the company.


Original Submission

Read more of this story at SoylentNews.

15:30

Inadequate patches and advisories increase cyber risk Help Net Security

Trend Micros overall threat detections increased by 55%, and the number of blocked malicious files surged by 242% due to indiscriminate targeting by threat actors who went after both consumers and organizations in all sectors. Trends for 2022 and beyond The top three MITRE ATT&CK techniques show us that threat actors are gaining initial access through remote services, then expanding their footprint within the environment through credential dumping to utilize valid accounts. An 86% increase More

The post Inadequate patches and advisories increase cyber risk appeared first on Help Net Security.

15:00

Navigating data classification in the era of extensive cloud adoption Help Net Security

Healthcare and financial services organizations have embraced cloud technology due to the ease of managing increasing volumes of data, according to Blancco. Cloud adoption has had significant effects on data classification, minimization, and end-of-life (EOL) data disposal. However, 65% of respondents say the switch has increased the volume of redundant, obsolete or trivial (ROT) data they collect. Increasing volumes of stored data brings with it many issues and is of growing concern for organizations operating More

The post Navigating data classification in the era of extensive cloud adoption appeared first on Help Net Security.

14:30

GrammaTech unveils new versions of its CodeSentry binary SCA platform Help Net Security

SCA platform that is available in three editions. Unlike source-code SCA tools that only inspect components under development, CodeSentry analyzes the binary that executes to identify all components or vulnerabilities including those contained in post production applications. Since most software vendors use components that contain open source software, CodeSentry identifies second, third and fourth party components regardless of where they enter the software supply chain More

The post GrammaTech unveils new versions of its CodeSentry binary SCA platform appeared first on Help Net Security.

14:15

11:11 Managed Backup for Cohesity secures on-premises data Help Net Security

11:11 Systems has announced general availability of 11:11 Managed Backup for Cohesity, a fully managed service for on-premises data protection. By combining Cohesitys solution deployed on-site with 11:11s onboarding, configuration and ongoing management, customers get comprehensive protection from a secure, scalable backup offering in a single, seamless solution. In the event of a ransomware attack, customers can quickly recover at scale. To address the evolving landscape of cyber threats, 11:11 offers security and protection for More

The post 11:11 Managed Backup for Cohesity secures on-premises data appeared first on Help Net Security.

14:00

Bode Plot Un-Lecture Hackaday

[Rolinychupetin] insists that his recent video is not a lecture but actually a recitation about Bode plots. That may be, but it is still worth a watch if you want to learn more about the topic. You can see the video below.

If you havent run into Bode plots before, they are simple plots of magnitude or phase vs. frequency, usually plotted on a log scale. Named after Bell Labs [Hendrik Wade Bode], they are useful for understanding filters or anything with a frequency response.

Of particular interest are the zeros and poles of the graph. Simplistically, you can think of these as the dips and peaks of the response curve. The math is a bit more complicated than that, but you can learn more in the video.

Of course, these days, we are more likely to see a Bode plot from a simulation tool or test instrument than plot them by hand, but it is good to understand whats going on. As you might expect, if you can generate a frequency sweep, it isnt that hard to display a Bode plot on an oscilloscope. Or just use a network analyzer.

...

14:00

Optiv launches OT cyber services to help organizations identify business-specific OT risks Help Net Security

Digitization and the heavy adoption of connected devices are enabling organizations to reach new heights and, at the same time, have intensified the threat landscape and extended the attack surface. As organizations work to reap the benefits of the IT, OT and industrial control system (ICS) convergence, Optiv is helping businesses secure their critical hardware, systems and processes with a full suite of OT security advisory, deployment and management services. Organizations need a path to More

The post Optiv launches OT cyber services to help organizations identify business-specific OT risks appeared first on Help Net Security.

13:53

U.S. Worries China Will Use Supply Chains As Weapon cryptogon.com

My commentary from, U.S. Seeks Allies Backing for Possible China Sanctions Over Ukraine War: If this really kicks off, you should be ready for extremely serious problems. Outsourcing so much of the supply chain to China was a strategic mistake. Countless people have warned about this over decades, to no avail. The collective-West put itself []

13:09

Europeans Were Creating Steel Tools 2,900 Years Ago SoylentNews

Iberians were using heavy metal on hard rock way before it was cool:

It's time to update the history books again. A group of researchers in Germany have shown that steel tools were being used in the Iberian peninsula at least as long ago as 900 BCE far earlier than it was believed knowledge of the metal had made its way to the region.

The team, led by University of Freiburg archaeologist Ralph Araque Gonzalez, base their claims on geochemical and metallographic analyses and some good old fashioned experimental archaeology. They demonstrated that a series of engravings on stone pillars found in the region from the late Bronze Age could only have been made with tools made from proper steel, and it was most likely developed locally.

According to the team's paper on the research, the final bronze age (FBA) in the Iberian peninsula lasted from around 1200800 BCE, and the early iron age (EIA) lasted roughly 200 years after that. Despite that commonly accepted timeline, the team said a series of engraved steles identified as from the FBA/EIA and examined as part of the study were mostly made of extremely hard rock similar to quartzite.

[...] According to the University of Freiburg, up until recently it was believed the ability to create steel an alloy of iron and carbon only became widespread in Europe with the expansion of the Roman Empire.

[...] But evidence of steel tools in Iberia hundreds of years earlier raises a question: how did they get there? Based on where the tool was found, and the context in which it was discovered, Araque Gonzalez concluded that the Romans probably had nothing to do with it.

[...] "Iron metallurgy including the production and tempering of steel were probably indigenous developments of decentralized small communities in Iberia, and not due to the influence of later colonization processes," Araque Gonzalez hypothesized.

Journal Reference:
https://doi.org/10.1016/j.jas.2023.105742


Original Submission

Read more of this story at SoylentNews.

12:28

[$] LWN.net Weekly Edition for March 9, 2023 LWN.net

The LWN.net Weekly Edition for March 9, 2023 is available.

11:44

Gender Diversity in Cybercrime Forums: Women Users on the Rise HackRead | Latest Cybersecurity and Hacking News Site

By Habiba Rashid

It turns out that the number of women on the darker side of cybersecurity is increasing, and these stats will shock you.

This is a post from HackRead.com Read the original post: Gender Diversity in Cybercrime Forums: Women Users on the Rise

11:00

Smashing Security podcast #312: Rule 34, Twitter scams, and Facebook fails Graham Cluley

Scammers get pwned by a Canadian granny! Don't be seduced in a bar by an iPhone thief! And will the US Marshals be able to track down the villains who stole their data? All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Anna Brading. Plus dont miss our featured interview with Jason Meller of Kolide.

11:00

Stepper Killer Killer Killed, Repair Attempted Hackaday

The low-cost servo motor in [Clough42]s lathes electronic leadscrew bit the dust recently, and he did a great job documenting his repair attempts ( see video below the break ). When starting the project a few years ago, he studied a variety of candidate motors, including a ClearPath servo motor from Teknics Stepper Killer family. While that motor was well suited, [Clough42] picked a significantly lower-cost servo motor from China which he dubbed the Stepper Killer Killer.

He does a very thorough post-mortem of the motors integrated servo controller, checking the circuits and connections on the interface PCB first. Not finding any obvious problem, he proceeds to the main PCB which contains the microcontroller, motor driver transistors, and power supplies. There is no visible damage, but a check of the logic power supply shows 1.65V where 3.3V is expected. Looking at the board with a smart-phone mounted IR camera, he quickly finds the bad news the microcontroller has shorted out.

...

11:00

HPR3809: The Abominable Post Apocalyptic Podcast Player Hacker Public Radio

Notes: Forgot to mention that I hot glued the top lid (original lid for the 'speaker box'), on top of the boards. I had used the device with the top uncovered for a month because I hoped I would find a better choice but after getting tired of the wires detaching and worrying about the sdcard slot getting wrecked I decided to commit to glueing the lid on. The boards are very robust, I dropped them in the snow a few times. They would stop working but after drying off would function. I didn't find the datasheet with the resistance values for other values until after I glued the lid so will have to open it up again or get into one of the switch lines and do resistor combinations... now that I know more I think I should be able to control the mp3 player with one analog output pin from the arduino for all the functions, since it seems the pin 8 that all the switch resistors lead to detects voltage levels from the voltage divider created when one of the switches goes to ground. The robot is using 4 lines right now for mp3 control. Would be cool if I could free up 3 more but I don't remember if any of them are occupying an analogue slot. No power button! None needed. Pause and unpause via momentary switch. The charger board can charge from micro usb or usb-c and will protect your 18650 cell from running flat and damaging itself. Check out my robots: https://bitchute.com/channel/mechatroniac Post Apocalyptic Robotics Database Entry: HH000000000 H Hybrid: Denotes some prepurchased or hard to find components H Human use: For use by biological humans Tools and supplies multimeter - not strictly required but highly recommended Soldering iron solder(thinner solder wire works better for electronics) wire stripper hot glue gun electric or duct tape side cutters/cutting pliers/aircraft snips Buy: 1s 18650 charger board https://www.aliexpress.us/item/2251832744326141.html GPD2846A TF Card MP3 Decoder Board 2W Amplifier https://www.aliexpress.com/item/4000188516180.html https://www.aliexpress.com/item/32968306923.html Find or Buy: short lengths of wire 4 ohm speaker (can be found in old tvs) momentary switches(3) - can be found in vcrs, tvs, dvd players... 18650 cell 3.5g weed jar or similar + lid larger lid (optional) You should consider getting an arduino or a kit Keyestudio Basic Starter Kit V2.0 With UNO R3 Board Or Mega 2560 R3 Board https://www.aliexpress.com/item/1005004961819902.html GPD2846A datasheet https://pdf1.alldatasheet.com/datasheet-pdf/view/1132627/ETC2/GPD2846A.html https://datasheetspdf.com/pdf-file/949393/Generalplus/GPD2846/1 Picture 1 Click the thumbnail to see the full-sized image Picture 2

Combining GIN and PMD for Code Improvements It Will Never Work in Theory

Amidst the recent excitement about using large language models to write software, it's easy to overlook the other ways that researchers are getting computers to write or improve code. This paper is an early look at combining two ideas: static analysis to detect problems in code found on Stack Overflow and genetic algorithms to improve those code snippets. The results are intriguing, but unsurprisingly, the authors found that the tools they used (PMD for code analysis and GIN for code mutation) may need some tweaking in order to play well together in this new way.

On a personal note, work like this has convinced me that the next major advance in programming languages won't come from research on classical concerns like type systems or concurrency mechanisms, but rather from asking, "How can we design a language so that automated tools can find and generate what we need more quickly and more accurately?" As we learn more about why tools like the ones described above can't (yet) do our programming for us, I believe we will see rapid evolution of both better tools and better languages for them to work onbetter, that is, for other programs.

Sherlock A. Licorish and Markus Wagner. Combining GIN and PMD for code improvements. In Proceedings of the Genetic and Evolutionary Computation Conference Companion, Jul 2022. doi:10.1145/3520304.3528772.

Software developers are increasingly dependent on question and answer portals and blogs for coding solutions. While such interfaces provide useful information, there are concerns that code hosted here is often incorrect, insecure or incomplete. Previous work indeed detected a range of faults in code provided on Stack Overflow through the use of static analysis. Static analysis may go a far way towards quickly establishing the health of software code available online. In addition, mechanisms that enable rapid automated program improvement may then enhance such code. Accordingly, we present this proof of concept. We use the PMD static analysis tool to detect performance faults for a sample of Stack Overflow Java code snippets, before performing mutations on these snippets using GIN. We then re-analyse the performance faults in these snippets after the GIN mutations. GIN's RandomSampler was used to perform 17,986 unique line and statement patches on 3,034 snippets where PMD violations were removed from 770 patched versions. Our outcomes indicate that static analysis techniques may be combined with automated program improvement methods to enhance publicly available code with very little resource requirements. We discuss our planned research agenda in this regard.

10:30

Open-Source AMD OpenGL Driver Drops Support For Smart Access Memory / ReBAR Phoronix

Since late 2020 there had been work by AMD Linux engineers on adding Smart Access Memory (Resizable BAR) support to RadeonSI as the Gallium3D OpenGL driver and improved since that point in the name of performance. However, for this OpenGL driver now they've come to realize the benefits haven't necessarily panned out and the developers went ahead and disabled this SAM/ReBAR support followed by removing the support from this driver...

10:22

Amazon Go Stores to Close in Cities Coast to Coast SoylentNews

On April 1, Amazon will be permanently closing some of its Amazon Go stores in major cities on both coasts:

The locations include two stores in Seattle, two stores in New York City and four in San Francisco.

"Like any physical retailer, we periodically assess our portfolio of stores and make optimization decisions along the way. In this case, we've decided to close a small number of Amazon Go stores in Seattle, New York City and San Francisco," an Amazon spokesperson told FOX Business in a Saturday email.

[...] The e-commerce giant is still opening new Amazon Go stores.

"We remain committed to the Amazon Go format, operate more than 20 Amazon Go stores across the U.S., and will continue to learn which locations and features resonate most with customers as we keep evolving our Amazon Go stores," the spokesperson said.

Originally spotted on The Eponymous Pickle.

Related: Amazon to Slash More Than 18,000 Jobs in Escalation of Cuts


Original Submission

Read more of this story at SoylentNews.

09:39

A critical flaw affects Fortinet FortiOS and FortiProxy, patch it now! Security Affairs

Fortinet addressed a critical heap buffer underflow vulnerability affecting FortiOS and FortiProxy, which can lead to arbitrary code execution.

Fortinet addressed a critical buffer underwrite (buffer underflow) vulnerability, tracked as CVE-2023-25610 (CVSS v3 9.3), that resides in the administrative interface in FortiOS and FortiProxy. A remote, unauthenticated attacker can exploit the vulnerability to execute arbitrary code on the vulnerable device and trigger a DoS condition on the GUI, by sending specifically crafted requests.

The vulnerability affects the following products:

  • FortiOS 6.0, all versions
  • FortiProxy 1.2, all versions
  • FortiProxy 1.1, all versions

The security vendor released the following updates to address the issue:

The company announced that it is not aware of attacks in the wild exploiting this vulnerability.

The advisory includes a list of models for which the flaws exploitation can only trigger a DoS condition.

Fortinet also provides a workaround for the flaw, the company recommends disabling the HTTP/HTTPS administrative interface or limiting the IP addresses that can reach the administrative interface.

The security vendor acknowledged Kai Ni from the Burnaby InfoSec team for reporting the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs  hacking, FortiOS)

The post...

08:00

Scratch Built Amiga 2000 Stacks up the Mods Hackaday

Around these parts, we most often associate [Drygol] with his incredible ability to bring damaged or even destroyed vintage computers back to life with a seemingly endless bag of repair and restoration techniques. But this time around, at the request of fellow retro aficionado [MrTrinsic], he was given a special assignment to not only build a new Amiga 2000 from scratch, but to pack it with so many mods that just physically fitting them into the case would be a challenge in itself.

The final product, dubbed Tesseract, took two and a half years to complete and has been documented over the course of six blog posts. The first step was to get a brand new motherboard, in this case a modern recreation designed by Floppie209, and start populating it with components. With some modifications, the new board slipped neatly into a slick metal case. Unfortunately it quickly became clear some of the mods the duo wanted to install wouldnt work with the reverse-engineered motherboard. This was around Spring of 2021, which is the last time we checked in on the project.

...

07:58

BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

Security firm ESETs cybersecurity researchers have shared their analysis of the worlds first UEFI bootkit being used in

This is a post from HackRead.com Read the original post: BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows

07:50

Veeam warns to install patches to fix a bug in its Backup & Replication product Security Affairs

Veeam addressed a high-severity vulnerability in the Backup Service that impacts Backup & Replication software.

Veeam addressed a high-severity vulnerability in the Backup Service, tracked as CVE-2023-27532 (CVSS v3 score: 7.5), that impacts all versions of Backup & Replication software versions.

Vulnerability CVE-2023-27532 in Veeam Backup & Replication component allows to obtain encrypted credentials stored in the configuration database. This may lead to gaining access to the backup infrastructure hosts. reads the advisory published by the company.

An unauthenticated attacker can exploit the vulnerability to obtain the credentials stored in the VeeamVBR configuration database and use them to access backup infrastructure hosts.

According to the advisory, the root cause of the problem is the vulnerable Veeam.Backup.Service.exe (TCP 9401 by default) process that allows an unauthenticated user to request encrypted credentials.

The flaw was addressed with the release of the following Veeam Backup & Replication build numbers:

The company credited the security researcher known as Shanigen for reporting the CVE-2023-27532 flaw in mid-February.

Veeam also provides a workaround in case customers cant immediately apply the security updates and are using an all-in-one appliance with no remote backup infrastructure components. The vendor recommends blocking external connections to port TCP 9401 in the backup server firewall.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs  hacking, CVE-2023-27532)

The post Veeam warns to install patches to fix a bug in its Backup & Replication product appeared first on Security Affairs.

07:38

NASA Fixes Spacecraft by Turning It Off, Then On Again SoylentNews

'Firemode reset' sees Interstellar Boundary Explorer back on the job:

NASA engineers have managed to restore the Interstellar Boundary Explorer spacecraft to working condition by using the oldest trick in the computing book.

IBEX was put into contingency mode in February after NASA reset its onboard systems and the almost 15-year-old spacecraft's flight computer subsequently failed to respond to commands uploaded from mission control. Engineers have since performed a so-called "firecode reset" as the craft's orbit reached its closest point to Earth.

"To take the spacecraft out of a contingency mode, the mission team performed a firecode reset (which is an external reset of the spacecraft) instead of waiting for the spacecraft to perform an autonomous reset and power cycle on March 4," NASA confirmed on Monday.

"After the firecode reset, command capability was restored. IBEX telemetry shows that the spacecraft is fully operational and functioning normally."

Launched in 2008, the IBEX spacecraft carries instruments to detect energetic neutral atoms (ENAs) that form when hot ions from the solar wind collide with cold gaseous atoms from the interstellar medium, the stuff in-between stars in outer space.

Using data collected from the IBEX-Hi and IBEX-Lo sensors, astronomers can plot the boundaries of the Solar System. All the planets and other astronomical objects are encased in a bubble known as the "heliosphere" created by the solar wind.

[...] Fixing the satellite will allow astronomers to continue gathering data on the Sun's activity and solar wind for a while yet.


Original Submission

Read more of this story at SoylentNews.

07:15

Tuned AMD Zen 4 Scheduler Model Lands In LLVM 17 Compiler Phoronix

Back in December initial AMD Zen 4 "znver4" support was merged for the LLVM/Clang 16 compiler. While the "-march=znver4" targeting at least flips on the newly-added AVX-512 instructions with these AMD processors, it was re-using the existing scheduler model from Zen 3. Finally today a tuned Zen 4 scheduler model has landed for what will be found in the LLVM 17 compiler later this year...

06:30

Pi Picos Give Casio FX9000P Its Memory Back Hackaday

Is the Casio FX9000P a calculator or a computer? Its hard to tell since Casio did make calculators that would run BASIC. [Menadue] didnt know either, but since it had a CRT, a Z80, and memory modules, we think computer is a better moniker.

He found one of these, but as you might expect, it needed a bit of work. There were two bad video RAM chips on the device, and [Menadue] used two Raspberry Pi Picos running a program to make them think they are RAM chips. The number of wires connecting the microcontollers might raise some eyebrows, but it does appear to get the job done.

He also used more Picos to emulate memory on cartridges. Then he used a test clip and a you guessed it another Pico to monitor the Z80 bus signals. It is amazing that the Pico can replace what would have been state-of-the-art memory chips and a very expensive logic analyzer.

The second video mostly shows the computer in operation. The use of Picos to stand in for so much is clever. It reminded us of the minimal Z80 computer that used an Arduino for support chips. The HP9845.

...

06:30

Mesa 22.3.7 Released To End Out The Series Phoronix

Mesa 22.3.7 has been released as the last planned point release for that driver Q4'2022 driver series...

05:57

Two Oddball Ideas for a Megaqubit Quantum Computer IEEE Spectrum



The perpetual problem with scaling up most quantum computers is a seemingly mundane onetoo many cables. Experts say quantum computers might need at least a million qubits kept at near absolute zero to do anything computationally noteworthy. But connecting them all by coaxial cable to control and readout electronics, which work at room temperature, would be impossible.

Computing giants such as IBM, Google, and Intel hope to solve that problem with cyrogenic silicon chips that can operate close to the qubits themselves. But researchers have recently put forward some more exotic solutions that could quicken the pace.

At the IEEE International Electron Device Meeting (IEDM) in December, two groups of researchers suggest that silicon might not be the best answer. Their solutions instead rely on semiconductors and transistors more commonly aimed at near-terahertz-frequency radio. And in February at the IEEE International Solid State Circuits Conference (ISSCC) a separate research group proposed technology that could use terahertz radio to eliminate communication cables altogether.

Shared Quantum Wells

A type of device made from compound semiconductors such as indium gallium arsenide rather than silicon and called a high electron-mobility transistor (HEMT) is a natural at amplifying the kind of RF signals needed to interact with qubits. But researchers at Korea Advanced Institute of Technology (KAIST) and at IBM Zurich and cole Polytechnique Fdrale de Lausanne (EPFL) calculate that it could also do the cable-reducing task of routing, multiplexing, and demultiplexing. Crucially, it could do it with little power loss, which is important, because at the coldest parts of the cryogenic chambers used for quantum computers, the refrigerator system can remove only a couple of watts of heat.

HEMTs have a layered semiconductor structure that creates a supernarrow region of free electrons, called a two-dimensional electron gas. Charge moves quickly and with little resistance through this quantum well, hence the HEMTs proficiency at amplifying high-frequency signals. The KAIST and Swiss teams...

05:53

Omi in a Hellcat Handed 66 Months in Prison For Pirate IPTV, Forfeits $30m TorrentFreak

omi in a hellcat carAfter entering a guilty plea some time ago, former pirate IPTV service operator Bill Omar Carrasquillo was sentenced Tuesday in a Philadelphia court.

Last month the U.S. government called for 15.5 years in prison for crimes related to Carrasquillos pirate IPTV service, Gears TV, which was shut down by the FBI in 2019.

That was still a far cry from the 500+ years thrown around in the earlier stages of the case, but after causing an estimated $167 million in damages to TV providers Charter Communications, Comcast, DirecTV, Frontier Corporation, and Verizon Fios, perhaps not completely out of the question.

Plea Agreement

Some details were already settled prior to sentencing. In Carrasquillos plea agreement, the YouTuber acknowledged a laundry list of crimes, from the most serious copyright offenses to fraud and money laundering crimes.

Among them, conspiracy to commit felony & misdemeanor copyright infringement, circumvention of access controls, access device fraud, & wire fraud, circumvention of an access control device, reproduction of a protected work, public performance of a protected work, and wire fraud against the cable companies. Other crimes included making false statements to a bank, money laundering, and tax evasion.

Financial penalties included forfeiture of just over $30 million, including $5.89 million in cash seized from bank accounts, Carrasquillos now-famous supercar collection, and multiple pieces of real estate in the Philadelphia area.

Hearing in Philadelphia

In a hearing scheduled for 2:30pm yesterday at the United States District Court for the Eastern District of Pennsylvania, Carrasquillo appeared in courtroom 16A before Judge Harvey Bartle III.

In a sentencing memorandum for the defense, details of Carrasquillos early life most of which had already been made public by Carrasquillo in videos posted to social media make for depressing reading.

One of 38 children, Carrasquillo had no stable care or supervision. Physically and sexually abused by family members, Carrasquillo was intentionally committed to mental health facilities by one supposed caregiver, purely for the purpos...

05:25

Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware HackRead | Latest Cybersecurity and Hacking News Site

By Deeba Ahmed

Currently, scammers are using DBatLoader malware loader to distribute Remcos RAT to businesses and institutions across Eastern Europe.

This is a post from HackRead.com Read the original post: Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware

05:01

Big data basics: What sysadmins need to know Linux.com

Learn what big data is, how data is processed and visualized, and key big data terms to know.

Read More at Enable Sysadmin

The post Big data basics: What sysadmins need to know appeared first on Linux.com.

05:00

Crucial 2 x 16GB DDR5-5200 / DDR5-5600 Phoronix

Micron recently sent over their latest Crucial 2 x 16GB DDR5-5200 and DDR5-5600 memory kits for testing with these low cost options for running with the latest Intel Alder Lake / Raptor Lake and AMD Ryzen 7000 series processors. Here's a look at how these affordable DDR5 memory options are performing and a look at the Linux workloads that can benefit from higher frequency memory.

04:54

Humming Vibrating Device in Apartment Tower Sent 25 Residents Insane SoylentNews

The NZ Herald reports:

An electric humming vibrator designed to upset neighbors operated for about a month inside New Zealand's tallest apartment tower, sending 25 neighbors "just about insane" before it was discovered and disabled, a resident says.

[...] The device was plugged into the mains and had a metal rod nearly the height of the window and a purple plastic device on the end.

A resident explained a man had installed it in a window cavity, behind a blind, specifically to aggravate his upstairs neighbors for unknown reasons: "The device causes a low vibrating-type hum at about 35-40 cycles per minute at about 80hz. It sounded like a cellphone ringing on vibrate stuck in the wall, but it never stopped and just continued all day, all night."

[...] Ceiling vibrators have a long, height-adjustable rod to run from floor to ceiling and make vibrations or a knocking noise from the head. They can be remote controlled and once switched on, they transmit to upstairs neighbors. Thumpers were said to be invented in China and are sometimes referred to as "noisemaker revenge machines".

[...] "It just about sent 25 residents insane because it took a month for it to be located. Everyone thought it was an electrical or mechanical issue that created a dull, repetitive noise 24 hours a day. I know of residents who couldn't sleep and abandoned parts of their apartments," the resident said.


Original Submission

Read more of this story at SoylentNews.

04:43

Links 08/03/2023: EndeavourOS Cassini Nova Techrights

  • GNU/Linux

    • Applications

      • DebugPoint Top 5 Best EPUB Readers for Linux [Compared]

        Are you an avid Linux user who loves reading ebooks? If yes, you must know that the default document viewer on most of the Linux distros may not meet all your requirements for being a bookworm.

        EPUB is a widely used open ebook format supported by most ebook readers. Thankfully, several EPUB reader apps are available in the Ubuntu software centre and other repositories that you can download for free.

        In this article, well dis...

04:29

Taiwan Suspects Chinese Ships Cut Undersea Internet Cables cryptogon.com

Via: ZeroHedge: According to Taiwanese authorities, on Feb. 2, a Chinese fishing boat damaged an undersea communications cable that connects Taiwans main island to Matsu Islands. About one week later, a Chinese cargo ship severed another cable. Located approximately 30 miles off the coast of China, the tiny island of Dongyin has quickly established a []

04:27

Congressman Believes U.S. Government Has Found Alien UFOs cryptogon.com

Id love to know why this UFO hype is happening now in the most mainstream of publications. Via: Newsweek: A U.S. congressman recently said that he believes the U.S. government has found alien UFOs in the past, following reports of several unidentified flying objects being shot down. During a recent conversation with Florida Republican Representative []

04:14

Dr. Robert Redfield: NIH, State Department, USAID and DoD Funded Gain of Function Research Related to Covid cryptogon.com

Dr. Robert Redfield, the former CDC Director, believes that US taxpayer money from NIH, State Department, USAID, and DOD funded the creation of SARS-CoV-2: "They wanted a single narrative, and I had a different point of view Science has debate, and they squashed any debate https://t.co/JjiaH6SMun pic.twitter.com/yuIBJ7o6gg kanekoa.substack.com (@KanekoaTheGreat) March 8, 2023

04:07

Large Pension Provider in Great Britain Alleges That Sirius Didnt Deposit Workers Pension Money in the Pension (Sirius Does Not Deny) schestowitz.com

Summary: Sirius Open Source is likely to have committed very serious fraud and criminally stolen money from its workers; today we expose some of the more preliminary findings from a 3-month investigation

THIS part of the series is long in the making, so to speak. It took many long calls, distant contacts, meticulous correspondence and subsequent analysis to prepare. Today we present more of an overview and some time soon likely later this week well release a lot of audio. Its hard to tell how long this sub-series will be as thats highly dependent on numerous leads. The short story is, Sirius isnt denying the allegations. These allegations are very serious and the consequences profound (like several years in prison). Sirius is now existing on borrowed time; the CEO left very recently and the so-called founder is in hiding. He works double shifts, trying to salvage whats left of the company he claims to have founded (we doubt this, based on documents presented here before).

The index at the top explains how this relates to a pension provider, which we had no choice but to publicly name (and shame). I sent them about 10 E-mail messages, but I never received a reply or a phonecall as I asked (I said this was very urgent not a lie by the way!). It seems theyre rather afraid of this case, fearing perhaps that its a major liability in light of various scandals (which I explained to them in very clear terms several times so far this year).

So far weve involved close to 10 people in three pension providers. Many people are aware of this case, including a pension provider that has some past as a client of Sirius. We decided to make complaints only after all other avenues had been exhausted and advised people to transfer pensions in order to secure them from future fraud.

In the process we did manage to get numerous letters, including formal documentation. We started chasing the pension providers, insisting that they need to cooperate (get reply or shame them, unfortunately, for basically covering up fraud). After several pension checks (not the Tracker) we could finally see disparities; where the money vanished is less of a mystery over time, as we assume that the company might as well have used pension payments in payslips to deceive staff. Thats a very serious crime. And to compare to statements, as per the formal balance, means that the discrepancies become evident.

As it turns out, others experienced the same thing. I emailed the office a few years ago, xxxxxxx responded, to quote one former colleague, and xxxxxxx said xxxxxxx would try and find out but never did.

If you saw the other stories...

03:58

Sirius Open Source Pensiongate: Its Beginning to Look Like a Criminal Matter and Sirius is in Serious Trouble Techrights

Previously:

  1. Sirius Open Source and the Money Missing From the Pension
  2. Sirius Finished
  3. Sirius Open Source Pensiongate: An Introduction
  4. When the Pension Vanishes
  5. Sirius Open Source Pensiongate (Sirius Financial Crisis): Company May Have Squandered/Plundered the Pensions of Many People
  6. Sirius Open Source Pensiongate: Pension Providers That Repeatedly Lie to the Clients and Dont Respond to Messages
  7. NOW: Pensions Lies to Its Customers and Protects Abusers

Summary: Sirius Open Source is likely to have committed very serious fraud and criminally stolen money from its workers; today we expose some of the more preliminary findings from a 3-month investigation

THIS part of the series is long in the making, so to speak. It took many long calls, distant contacts, meticulous correspondence and subsequent analysis to prepare. Today we present more of an overview and some time soon likely later this week well release a lot of audio. Its hard to tell how long this sub-series will be as thats highly dependent on numerous leads. The short story is, Sirius isnt denying the allegations. These allegations are very serious and the consequences profound (like several years in prison). Sirius is now existing on borrowed time; the CEO left very recently and the so-called founder is in hiding. He works double shifts, trying to salvage whats left of the company he claims to have founded (we doubt this, based on documents presented here before).

...

03:52

[$] Removing support for DeltaRPMs in Fedora LWN.net

Way back in 2009, we looked at the presto plugin for yum, which added support for DeltaRPMs to Fedora. That package format allows just the binary differences (i.e. the delta) between an installed RPM and its update to be transmitted, which saves network bandwidth; the receiving system then creates the new RPM from those two pieces before installing it. Support for DeltaRPMs was eventually added to the distribution by default, though the feature has never really lived up to expectationsand hopes. Now, it would seem that Fedora is ready to, in the words of project leader Matthew Miller, "give DeltaRPMs a sad, fond farewell".

03:46

China Planning for War, Needs Capability to Take Out Starlink and Defenses Against Javelin Anti-Tank Systems cryptogon.com

Via: Reuters: China needs the capability to shoot down low-earth-orbit Starlink satellites and defend tanks and helicopters against shoulder-fired Javelin missiles, according to Chinese military researchers who are studying Russias struggles in Ukraine in planning for possible conflict with U.S.-led forces in Asia.

03:32

12 Reasons to Attend This Years Southern California Linux Expo (SCaLE 20x) FOSS Force

Here's a dozen reasons, in the form of a dozen items that are on this year's schedule, to go to this year's SCALE, which starts Thursday in Pasadena, California.

The post 12 Reasons to Attend This Years Southern California Linux Expo (SCaLE 20x) appeared first on FOSS Force.

03:30

Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks The Hacker News

A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems. The flaws, tracked as CVE-2023-27898 and CVE-2023-27905, impact the Jenkins server and Update Center, and have been collectively christened CorePlague by cloud security firm Aqua. All versions of Jenkins versions prior to 2.319.2 are

03:13

Samba 4.18.0 released LWN.net

Version 4.18 of the Samba interoperability suite is out. Changes include some significant performance improvements, better error messages, and more; click below for the details.

03:10

a2ps 4.15 released LWN.net

Version 4.15 of the "anything to PostScript" filter a2ps has been released the first release since 2007. "This release contains few user-visible changes. It does however contain a lot of changes under the hood: code clean-up, etc. Therefore, its likely that there are new bugs."

03:00

Room-Temperature Superconductivity Claimed IEEE Spectrum



Scientists today reported that theyve observed room-temperature superconductivity. Superconductivity is a rarefied state of matter in which electrical resistance in a material drops to zero while its electrical and magnetic capacity vastly expands. Until now, the phenomenon has been observed only at cryogenic temperatures or phenomenally high pressures. Such a discovery, if confirmed, could open pathways to a range of applications including lossless electric transmission, high-efficiency electric motors, maglev trains, and low-cost magnets for MRI and nuclear fusion.

However, the caveats attached to todays announcement are considerable. While the researchers say their material retains its coveted lossless properties at temperatures up to 20.6 C, it still requires substantial pressure (10 kilobars, or 9,900 atmospheres). Todays publication is also tarnished by the fact that the scientists behind the discovery, publishing their work in todays issue of the journal Nature, have retracted a previous paper on room-temperature superconductivity because of its unconventional data-reduction methods.

The primary researcher Ranga Diasassistant professor in the departments of mechanical engineering and physics and astronomy at the University of Rochestersaid the retracted research paper has since been revised to accommodate the criticisms and accusations. Originally publish...

02:51

North Korea-linked Lazarus APT used a 0-day in a recent attack Security Affairs

North Korea-linked Lazarus APT group exploits a zero-day vulnerability in attacks aimed at a South Korean financial entity.

ASEC (AhnLab Security Emergency Response Center) observed North Korea-linked Lazarus APT group exploiting a zero-day vulnerability in an undisclosed software to breach a financial business entity in South Korea. The nation-state actors breached twice the company in one year.

The first attack was spotted in May 2022, threat actors targeted used by public institutions and universities in South Korea.

A second attack was observed in October 2022, when attackers exploited a zero-day vulnerability affecting the same software.

During the infiltration in May 2022, the affected that was commonly used by public institutions and universities. After the incident, they updated all of their software to their latest versions. reads the advisory published by the ASEC. However, the Lazarus group used the softwares 0-Day vulnerability to carry out their infiltration this time.

ASEC reported the zero-day to KISA, it also pointed out that the vulnerability has not been fully verified yet and a software patch has yet to be released.

The Lazarus APT exploited the zero-day flaw to conduct lateral movement, it also disabled the anti-malware software by using the technique known as Bring Your Own Vulnerable Driver (BYOVD).

This isnt the first that the Lazarus APT used the BYOVD technique, in October 2022 the North Korea-linked group has been spotted deploying a Windows rootkit by taking advantage of an exploit in a Dell firmware driver.

ASEC also noticed that the APT em...

02:45

Ubuntu Announces Official Support For The PolarFire SoC FPGA Icicle Kit RISC-V Board Phoronix

Following work bringing Ubuntu Linux to the RISC-V boards like the StarFive VisionFive 2, LicheeRV, Nezha, and others, Canonical today announced they have published an optimized RISC-V image for the Microchip PolarFire SoC FPGA powered "Icicle Kit" development board...

02:29

Multiple vulnerabilities in Jenkins Open Source Security

Posted by Daniel Beck on Mar 08

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

* Jenkins 2.394
* Jenkins LTS 2.375.4 and 2.387.1
* update-center2 3.15

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2023-03-08/

We provide...

02:13

How Denmarks Welfare State Became a Surveillance Nightmare SoylentNews

Once praised for its generous social safety net, the country now collects troves of data on welfare claimants:

Denmark's Public Benefits Administration employs hundreds of people who oversee one of the world's most well-funded welfare states. The country spends 26 percent of its GDP on benefitsmore than Sweden, the United States, and the United Kingdom. It's been hailed as a leading example of how governments can support their most vulnerable citizens. Bernie Sanders, the US senator, called the Nordic nation of 6 million people a model for how countries should approach welfare.

But over the past decade, the scale of Denmark's benefits spending has come under intense scrutiny, and the perceived scourge of welfare fraud is now at the top of the country's political agenda. Armed with questionable data on the amount of benefits fraud taking place, conservative politicians have turned Denmark's famed safety net into a polarizing political battleground.

It has become an article of faith among the country's right-wing politicians that Denmark is losing hundreds of millions of euros to benefits fraud each year. In 2011, KMD, one of Denmark's largest IT companies, estimated that up to 5 percent of all welfare payments in the country were fraudulent. KMD's estimates would make the Nordic nation an outlier, and its findings have been criticized by some academics. In France, it's estimated that fraud amounts to 0.39 percent of all benefits paid. A similar estimate made in the Netherlands in 2016 by broadcaster RTL found the average amount of fraud per benefit payment was 17 ($18), or just 0.2 percent of total benefits payments.The perception of widespread welfare fraud has empowered Jacobsen to establish one of the most sophisticated and far-reaching fraud detection systems in the world. She has tripled the number of state databases her agency can access from three to nine, compiling information on people's taxes, homes, cars, relationships, employers, travel, and citizenship. Her agency has developed an array of machine learning models to analyze this data and predict who may b...

02:00

Will A.I. Steal all the Code and Take all the Jobs? Hackaday

New technology often brings with it a bit of controversy. When considering stem cell therapies, self-driving cars, genetically modified organisms, or nuclear power plants, fears and concerns come to mind as much as, if not more than, excitement and hope for a brighter tomorrow. New technologies force us to evolve perspectives and establish new policies in hopes that we can maximize the benefits and minimize the risks. Artificial Intelligence (AI) is certainly no exception. The stakes, including our very position as Earths apex intellect, seem exceedingly weighty. Mathematician Irving Goods oft-quoted wisdom that the first ultraintelligent machine is the last invention that man need make describes a sword that cuts both ways. It is not entirely unreasonable to fear that the last invention we need to make might just be the last invention that we get to make.

Artificial Intelligence and Learning

Artificial intelligence is currently the hottest topic in technology. AI systems are being tasked to write prose, make art, chat, and generate code. Setting aside the horrifying notion of an AI programming or reprogramming itself, what does it mean for an AI to generate code? It should be obvious that an AI is not just a normal program whose code was written to spit out any and all other programs. Such a program...

01:43

Security updates for Wednesday LWN.net

Security updates have been issued by Debian (apr), Fedora (c-ares), Oracle (curl, kernel, pesign, samba, and zlib), Red Hat (curl, gnutls, kernel, kernel-rt, and pesign), Scientific Linux (kernel, pesign, samba, and zlib), SUSE (libX11, python-rsa, python3, python36, qemu, rubygem-rack, xorg-x11-server, and xwayland), and Ubuntu (libtpms, linux-ibm, linux-raspi, linux-raspi, python3.7, python3.8, and sofia-sip).

00:54

Samba 4.18 Released With Performance Optimizations Phoronix

Samba 4.18 is out today as the popular open-source implementation of the SMB networking protocol that allows for file and print service interoperability with Microsoft Windows systems in an Active Directory (AD) environment...

00:28

Sickle cell disease is now curable, but the treatment is unaffordable Lifeboat News: The Blog

CRISPR gene editing has made it possible to cure sickle cell disease, which affects millions worldwide, but most people with the condition wont be able to afford the cost of the treatment.

By Michael Le Page

00:27

Nvidia will soar 19% as the markets top semiconductor stock because their chips work most seamlessly with AI and they already have a head start, Credit Suisse says Lifeboat News: The Blog

Analysts at Credit Suisse have a price target of $275 on Nvidia, saying its hardware and software give it an edge over rivals in AI.

00:27

FDA to recall 2 more eyedrop brands due to contamination risks Lifeboat News: The Blog

U.S. health officials are alerting consumers about two more recalls of eyedrops due to contamination risks that could lead to vision problems and serious injury.

00:27

South Korea Maps Out Plan to Become Major Space Player by 2045 Lifeboat News: The Blog

South Koreas giant leap into space started with a small step on the internet.

With treaties banning certain tech transfers, South Koreas rocket scientists turned to a search service to find an engine they could mimic as the country embarked on an ambitious plan to build an indigenous space program. The nation launched its first home-grown rocket called Nuri in October 2021.

00:26

Computer Scientist Explains One Concept in 5 Levels of Difficulty Lifeboat News: The Blog

Computer scientist Amit Sahai, PhD, is asked to explain the concept of zero-knowledge proofs to 5 different people; a child, a teen, a college student, a grad student, and an expert. Using a variety of techniques, Amit breaks down what zero-knowledge proofs are and why its so exciting in the world of cryptography.

Amit Sahai, PhD, is a professor of computer science at UCLA Samueli School of Engineering.

Still havent subscribed to WIRED on YouTube? http://wrd.cm/15fP7B7
Listen to the Get WIRED podcast https://link.chtbl.com/wired-ytc-desc.
Want more WIRED? Get the magazine https://subscribe.wired.com/subscribe/splits/wired/WIR_YouTuription_ZZ

Follow WIRED:

Instagram https://instagram.com/wired.
Twitter http://www.twitter.com/wired.
Facebook https://www.facebook.com/wired.

Get more incredible stories on science and tech with our daily newsletter: https://wrd.cm/DailyYT

00:24

They thought loved ones were calling for help. It was an AI scam Lifeboat News: The Blog

As impersonation scams in the United States rise, Cards ordeal is indicative of a troubling trend. Technology is making it easier and cheaper for bad actors to mimic voices, convincing people, often the elderly, that their loved ones are in distress. In 2022, impostor scams were the second most popular racket in America, with over 36,000 reports of people being swindled by those pretending to be friends and family, according to data from the Federal Trade Commission. Over 5,100 of those incidents happened over the phone, accounting for over $11 million in losses, FTC officials said.

Advancements in artificial intelligence have added a terrifying new layer, allowing bad actors to replicate a voice with just an audio sample of a few sentences. Powered by AI, a slew of cheap online tools can translate an audio file into a replica of a voice, allowing a swindler to make it speak whatever they type.

Experts say federal regulators, law enforcement and the courts are ill-equipped to rein in the burgeoning scam. Most victims have few leads to identify the perpetrator and its difficult for the police to trace calls and funds from scammers operating across the world. And theres little legal precedent for courts to hold the companies that make the tools accountable for their use.

00:24

Wayland Clients Can Now Survive Qt Wayland Crashes / Compositor Restarts Phoronix

A change merged to Qt this week can allow for Wayland clients to survive compositor restarts, such as when the compositor crashes...

00:22

A radical new theory about the origin of the universe may help explain our existence Lifeboat News: The Blog

The deeper you get into physics, the simpler it becomes. The starting point of this wonderful book about Stephen Hawkings biggest legacy (which no one outside of physics has heard of) is the problem of our insignificance. Make a change in almost any of the slippery, basic physical properties of the universe and were toast life would not be possible. If, for example, the universe had expanded even slightly more slowly than it did after the Big Bang it would have collapsed in on itself. Result? No us. A fraction faster and no galaxies would form, let alone habitable planets. In the incandescent beginning of the universe, each of these basic physical properties was as vacillating as a dream: they could have ended up being pretty much anything. How did they all, so sweetly, settle on the minuscule range of values that brought about us?

One answer is to say God did it. He deliberately selected our universe (and not one of the overwhelmingly more probable alternatives) to go forth and be fecund. Another suggestion is that all the possible universes that could exist do exist, now, at the same time trillions and trillions of them, humming about like bees and were just in one of the ones we could be in. This idea is called the multiverse. In a multiverse theres nothing special about the incredible unlikeliness of being. Leibnitz came up with the proposal first, adding piously that God has placed us in the best universe of all possible universes. People have been making fun of that since Voltaire. Another idea is that new worlds are being created endlessly, all equally real. Every time you make a cup of coffee, a multiplicity of alternative worlds splits off in which you made it with more milk, or added honey instead of sugar, or the coffee machine exploded and you didnt make it at all.

00:22

Scientists Observe Quasiparticles in Classical Systems for the First Time Lifeboat News: The Blog

Since the advent of quantum mechanics, the field of physics has been divided into two distinct areas: classical physics and quantum physics. Classical physics deals with the movements of everyday objects in the macroscopic world, while quantum physics explains the strange behaviors of tiny elementary particles in the microscopic world.

Many solids and liquids are made up of particles that interact with each other at close distances, leading to the creation of quasiparticles. Quasiparticles are stable excitations that act as weakly interacting particles. The concept of quasiparticles was introduced in 1941 by Soviet physicist Lev Landau and has since become a crucial tool in the study of quantum matter. Some well-known examples of quasiparticles include Bogoliubov quasiparticles in superconductivity, excitons in semiconductors.

Semiconductors are a type of material that has electrical conductivity between that of a conductor (such as copper) and an insulator (such as rubber). Semiconductors are used in a wide range of electronic devices, including transistors, diodes, solar cells, and integrated circuits. The electrical conductivity of a semiconductor can be controlled by adding impurities to the material through a process called doping. Silicon is the most widely used material for semiconductor devices, but other materials such as gallium arsenide and indium phosphide are also used in certain applications.

00:00

How the EU Chips Act Could Build Innovation Capacity in Europe IEEE Spectrum



The European Commission wants Europe to boost its share of global semiconductor production to 20 percent by 2030, from 10 percent today. To that end, it is forwarding plans for more than 43 billion in public and private investment through a European Chips Act. To accomplish that increase in chip capacity, the legislation will approve appropriations for R&D, incentivize manufacturing, and take steps to make the supply chain more secure. Jo De Boeck, chief strategy officer and executive vice president at the Belgium-based nanoelectronics R&D center Imec, explained a proposed R&D structure and its likely impact to engineers at the 2023 IEEE International Solid State Circuits Conference (ISSCC) last month in San Francisco. The R&D segment relies on the establishment of advanced pilot line facilities, to enable a path from laboratory breakthrough to fab production, and a network of competence centers, to build up capacity for semiconductor design. De Boeck spoke with IEEE Spectrums Samuel K. Moore at ISSCC.

IEEE Spectrum: What would you say are Europes strengths today in semiconductor manufacturing?

Jo De Boeck: Well, manufacturing holds quite a few things. So first and foremost, I think of semiconductor manufacturing equipment and materials. Think of [Netherlands-based extreme-ultraviolet lithography maker], ASML. If you move up to the manufacturing part, you have some of our integrated device manufacturers [IDMs] in analog and analog mixed-signal and power devices, which is, of course, quite a very important area of devices and production to be in. But clearlyand thats part of the reason for the Chips Acttheres no European manufacturing presence at the most advanced technology nodes.
.

That said, how much of the focus should be on getting that cutting-edge logic versus building on the strengths that you already have?

De Boeck: Well, if it means focusing on one is losing on the other, I think thats a bad choice to make. I think its important, first of all, to keep a long enough view in mind. 2030 is like tomorrow in this industry. So if were looking at getting 20 percent production in Europe by 2030 and you would aim that toward being...

Wednesday, 08 March

23:51

How a Super-Earth Would Change the Solar System Centauri Dreams Imagining and Planning Interstellar Exploration

How a Super-Earth Would Change the Solar System

If there is a Planet Nine out there, I assume well find it soon. That would be a welcome development, in that it would imply the Solar System isnt quite as odd as it sometimes seems to be. We see super-Earths and current thinking seems to be that this is what Planet Nine must be in other stellar systems, in great numbers in fact. So it would stand to reason that early in its evolution our system produced a super-Earth, one that was presumably nudged into a distant, eccentric orbit by gravitational interactions.

The gap in size between Earth and the next planet up in scale is wide. Neptune is 17 times more massive than our planet, and four times its radius. Gas giant migration surely played a role in the outcome, and when considering stellar system architectures, its noteworthy as well that all that real estate between Mars and Jupiter seems to demand something more than asteroidal debris. To make sense of such issues, Stephen Kane (University of California, Riverside) has run a suite of dynamical simulations that implies we are better off without a super-Earth anywhere near the inner system.

Image: Artists concept of Kepler-62f, a super-Earth-size planet orbiting a star smaller and cooler than the sun, about 1,200 light-years from Earth. What effect would such a planet have in our own Solar System? Image credit: NASA Ames/JPL-Caltech/Tim Pyle.

Supposing a super-Earth did exist between Mars and Jupiter, Kanes simulations demonstrated the outcomes for a range of different masses, the results presented in a new paper in the Planetary Science Journal. The heavyweight of our system, Jupiters 318 Earth masses carry profound gravitational significance for the rest of the planets. Disturb Jupiter, these results suggest, and in some scenarios the inner planets, including our own, are ejected from the Solar System. Even Uranus and Neptune can be affected and perhaps ejected as well depending on the super-Earths location.

As the paper notes, the range of possibilities is wide:

several thousand simulations were conducted, producing a vast variety of dynamical outcomes for the solar system planets. The inner solar system planets are particularly vulnerable to the addition of the super-Eart...

23:26

Syxsense Platform: Unified Security and Endpoint Management The Hacker News

As threats grow and attack surfaces get more complex, companies continue to struggle with the multitude of tools they utilize to handle endpoint security and management. This can leave gaps in an enterprise's ability to identify devices that are accessing the network and in ensuring that those devices are compliant with security policies. These gaps are often seen in outdated spreadsheets that

23:25

US Restrictions See China's Chip Imports Plummet 27% in First Two Months of 2023 SoylentNews

The sanctions are having a huge impact:

[...] According to China's General Administration of Customs data published Tuesday (via The South China Morning Post), the country imported 67.6 billion integrated circuits (IC) in January and February. That's down 26.5% from the same period last year, and higher than the 15.3% fall recorded for the entirety of 2022.

The total value of these imports also declined, from $68.8 billion last year to $47.8 billion, a drop of 30.5%. That's partly due to chip prices that have fallen due to oversupply and the general economic downturn.

China's IC exports also fell in the first two months, down 20.9% to 37.3 billion units, while the total value of the exports dropped 25.8%.

The US has been tightening its restrictions on China's chip industry over the last 12 months, which the United States says will prevent its global rival from developing semiconductors for military applications, including supercomputers, nuclear weapons modeling, and hypersonic weapons.

October's restrictions on chipmaking tools from the Bureau of Industry and Security were some of the harshest, designed to cap China's logic chips at the 14-nanometre node, DRAM at 18nm, and 3D NAND flash at 128 layers. The US has also prohibited AMD and Nvidia from selling some of its high-performance AI-focused GPUs to China, including team green's A100 GPUs.


Original Submission

Read more of this story at SoylentNews.

23:05

IOCB_NOWAIT For Linux Pipes Yields 10~23x Performance Improvement Phoronix

In wanting to avoid waiting for pipes via the IOCB_NOWAIT option in order to further enhance IO_uring performance, Jens Axboe has implemented said functionality and in a simple test is seeing 10x to 23x performance improvements...

23:04

Shell command and Emacs Lisp code injection in emacsclient-mail.desktop Open Source Security

Posted by Gabriel Corona on Mar 08

emacsclient-mail.desktop is vulnerable to shell command
injections and Emacs Lisp injections through a crafted
mailto: URI.

This has been introduced in Emacs 28.1:

http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=b1b05c828d67930bb3b897fe98e1992db42cf23c

A fix for shell command injection is currently included
in the upcoming 28.3 branch:...

23:01

DNS Resolver Quad9 Loses Global Pirate Site Blocking Case Against Sony TorrentFreak

quad9In 2021, Sony Music obtained an injunction ordering DNS resolver Quad9 to block the popular pirate site Canna.to.

The injunction, issued by the District Court of Hamburg, required the Swiss DNS resolver to block its users from accessing the site to prevent the distribution of pirated copies of Evanescences album The Bitter Truth.

Quad9 Appeals Site Blocking Injunction

The Quad9 Foundation fiercely opposed the injunction. The not-for-profit foundation submitted an appeal to the Court hoping to overturn the blocking order, arguing that the decision set a dangerous precedent.

The DNS resolver stressed that it doesnt condone piracy. However, it believes that enforcing blocking measures through third-party intermediaries, that dont host any content, is a step too far.

This initial objection failed; the Regional Court in Hamburg upheld the blocking injunction last December. However, this was only a preliminary proceeding and Quad9 promised to continue the legal battle, warning of a broad impact on the Internet ecosystem.

Sony Files Main Proceeding

After Sonys preliminary victory, the music company initiated a main proceeding at the Leipzig court. This was the next step in the legal process and allowed both sides to provide more evidence and expert opinions.

Sony, for example, referenced earlier jurisprudence where Germanys Federal Court ruled that services such as YouTube can be held liable for copyright infringement if they fail to properly respond to copyright holder complaints.

Quad9s expert, Prof. Dr. Ruth Janal, contested this line of reasoning, noting that, under EU law, DNS resolvers shouldnt be treated in the same fashion as platforms that actually host content

Quad9 is more akin to a mere conduit service than a hosting provider, Prof. Janal countered. Courts could instead require Quad9 to take action through a no-fault injunction, a process thats already used in ISP blocking orders. In those cases, however, the intermediary isnt held liable for pirating users.

Court Confirms DNS Bloc...

23:00

Stranded Motorist Effects Own Rescue Using a Drone and a Cell Phone Hackaday

If youre looking for a good excuse to finally buy a drone, you probably cant do better than claiming it can save your life.

Granted, you may never find yourself in the position of being stuck in a raging snowstorm in the middle of the Oregon wilderness, but if you do, this is a good one to keep in mind. According to news stories and the Lane County Sheriff Search and Rescue Facebook page, an unnamed motorist who was trying to negotiate an unmaintained road through the remote Willamette National Forest got stuck in the snow. This put him in a bad situation, because not only was he out of cell range, but nobody knew where he was or even that he was traveling, so he wouldnt be missed for days.

Thankfully, the unlucky motorist played all his cards right. Rather than wandering off on foot in search of help, he stayed with his vehicle, which provided shelter from the elements. Conveniently, he also happened to have a drone along with him, which provided him with an opportunity to get some help. After typing a detailed text message to a friend describing his situation and exact location, he attached the phone to his drone and sent it straight up a couple of hundred feet enough to get a line-of-sight connection to a cell tower. Note that the image above is a reenactment by the Search and Rescue team; its not clear how the resourceful motorist rigged up the drone, but were going to guess duct tape was involved.

When he brought the drone back down a few minutes later, he found that the queued text had been sent, and the cavalry was on the way. The Search and Rescue unit was able to locate him, and as a bonus, also found someone else nearby who had been stranded for days. So it was a win all around thanks to some clever thinking and a little technology.

22:57

CISA adds three new bugs to Known Exploited Vulnerabilities Catalog Security Affairs

US CISA added actively exploited flaws in Teclib GLPI, Apache Spark, and Zoho ManageEngine ADSelfService Plus to its Known Exploited Vulnerabilities Catalog.

US CISA added the following actively exploited flaws to its Known Exploited Vulnerabilities Catalog:

  • CVE-2022-35914 (CVSS score: 9.8) Teclib GLPI Remote Code Execution Vulnerability
  • CVE-2022-33891 (CVSS score: 8.8) Apache Spark Command Injection Vulnerability
  • CVE-2022-28810 (CVSS score: 6.8) Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

The CVE-2022-35914 flaw is a PHP code injection vulnerability that resides in the /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2.

A remote, unauthenticated attacker can exploit this flaw, via a specially crafted message, to execute arbitrary code.

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A proof of concept (PoC) exploit code for this vulnerability was published on GitHub since December 2022.

Most of the attacks observed by cybersecurity firm GreyNoise originated from the U.S. and the Netherlands.

The CVE-2022-33891 flaw is a command injection vulnerability in the Apache Spark. In December 2022, Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices.

The variant spotted by Microsoft spreads by exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and...

22:52

RADV Enables Variable Rate Shading For RDNA3, RadeonSI Lands More Fixes Phoronix

If you are an AMD Radeon RX 7900 series "RDNA3" GPU owner and don't mind running bleeding-edge open-source graphics driver code, you'll want to pull down today's Mesa 23.1-devel Git snapshot...

22:44

Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

While HDFC Bank has denied any data breach, its subsidiary, HDB Financial Services, has confirmed there was a cybersecurity-related incident which is being investigated.

This is a post from HackRead.com Read the original post: Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary

22:39

Vanilla OS 2.0 Shifting From Ubuntu Base To Debian Sid Phoronix

One of the newer Linux distributions that has been making waves that aims to provide a pleasant Linux desktop experience, close to upstream, and is augmented by the growing selection of Flatpak packages. Now though the project has decided to move from Ubuntu Linux as its base over to Debian Sid...

22:23

Organoid intelligence (OI): the new frontier in biocomputing and intelligence-in-a-dish Lifeboat News: The Blog

Recent advances in human stem cell-derived brain organoids promise to replicate critical molecular and cellular aspects of learning and memory and possibly aspects of cognition in vitro. Coining the term organoid intelligence (OI) to encompass these developments, we present a collaborative program to implement the vision of a multidisciplinary field of OI. This aims to establish OI as a form of genuine biological computing that harnesses brain organoids using scientific and bioengineering advances in an ethically responsible manner. Standardized, 3D, myelinated brain organoids can now be produced with high cell density and enriched levels of glial cells and gene expression critical for learning. Integrated microfluidic perfusion systems can support scalable and durable culturing, and spatiotemporal chemical signaling.

22:22

Tesla Delivers FATAL BLOW As Analysts RAISE Price Targets Lifeboat News: The Blog

Join Patreon: https://www.patreon.com/solvingthemoneyproblem.
FREE One Year Supply of Vitamin D + 5 AG1 Travel Packs https://athleticgreens.com/SMR
UNLOCK 300+ Exclusive Videos: https://www.patreon.com/solvingthemoneyproblem.
Oura Ring https://ouraring.com/smr (Track your sleep, readiness & activity)
My Tesla Stock Price Targets: https://www.patreon.com/posts/tesla-stock-bull-57460691/
Merch: https://solving-the-money-problem.creator-spring.com/
Twitter
https://twitter.com/stevenmarkryan.

AFFILIATE DISCLOSURE: I earn a commission on every purchase made through my links.

SUPPORT THE CHANNEL ON PATREON
Patreon https://www.patreon.com/solvingthemoneyproblem.

BECOME A MEMBER OF THE CHANNEL
Join https://www.youtube.com/channel/UCagiBBx1prefrlsDzDxuA9A/join.

CHANNEL MERCH
Merch store https://solving-the-money-problem.creator-spring.com/

MERCH LINKS
TSLA HODLR MERCH: https://solving-the-money-problem.creator-spring.com/listingproduct=46
420 Funding Secured MERCH:...

22:12

Python 3.12 Alpha 6 Released With More Improvements Phoronix

Python 3.12 Alpha 6 was released on Tuesday as the newest development release toward this next major Python release...

21:57

CVE-2023-23638: Apache Dubbo Deserialization Vulnerability Gadgets Bypass Open Source Security

Posted by Albumen Kevin on Mar 08

Description:

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.


Credit:

yemoliR1ckyZKoishicxc (reporter)

References:

https://dubbo.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-23638

21:34

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity The Hacker News

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable institutions and universities, the re-infiltration in October 2022 involved the

20:48

China-linked APT Sharp Panda targets government entities in Southeast Asia Security Affairs

China-linked APT group Sharp Panda targets high-profile government entities in Southeast Asia with the Soul modular framework.

CheckPoint researchers observed in late 2022, a campaign attributed to the China-linked APT group Sharp Panda that is targeting a high-profile government entity in the Southeast Asia.

SoulSearcher loader, which eventually loads a new version of the Soul modular framework. 

The researchers pointed out that this is the first time the Soul malware framework is attributed to a known cluster of malicious activity, although it was previously used in attacks targeting the defense, healthcare, and ICT sectors in Southeast Asia. The researchers cannot exclude that the Soul framework is utilized by multiple threat actors in the area.

The connection between the tools and TTPs (Tactics, Techniques and Procedures) of Sharp Panda and the previously mentioned attacks in Southeast Asia might serve as yet another example of key characteristics inherent to Chinese-based APT operations, such as sharing custom tools between groups or task specialization, when one entity is responsible for the initial infection and another one performs the actual intelligence gathering. reads the analysis published by the experts.

CheckPoint researchers first identified Sharp Pandss activity at the beginning of 2021, at the time the APT group was targeting Southeast Asian government entities with spear-phishing attacks.

The attackers used a Word document with government-themed lures that relied on a remote template to download and run a malicious RTF document, weaponized with the infamous RoyalRoad kit.

Upon gained a foothold in the target system, the malware starts a chain of fileless loaders, including a custom DLL downloader called 5.t Downloader and a second-stage loader that delivers the final backdoor.

The last stage payload used in Sharp Panda campaigns at the time was the custom backdoor VictoryDll.

The experts detailed multiple campaigns aimed at entities in Southeast Asian countries, such as Vietnam, Indonesia, and Thailand. Across the yeats, the initial part of the infection chain (the use of Word documents, RoyalRoad RTF and 5.t Downloader) remained the same, but in early 2023 the VictoryDll backdoor was replaced with a new vers...

20:43

After Nearly a Decade in Development, Japan's New Rocket Fails in Debut SoylentNews

After Nearly a Decade in Development, Japan's New Rocket Fails in Debut

Japan's science minister said the failure was "extremely regrettable:

The launch of Japan's H3 rocket on Tuesday morning failed after the vehicle's second stage engine did not ignite.

In a terse statement on the failure, Japanese space agency JAXA said, "A destruct command has been transmitted to H3 around 10:52 a.m. (Japan Standard Time), because there was no possibility of achieving the mission. We are confirming the situation."

The Japanese space agency, in concert with the rocket's manufacturer, Mitsubishi Heavy Industries, has spent about $1.5 billion developing the H3 rocket over the last decade. Much of the challenge in building the new rocket involved development of a new LE-9 engine, which is fueled by liquid hydrogen and liquid oxygen, to power the first stage. This appeared to perform flawlessly. The second-stage engine that failed, the LE-5B, was a more established engine.

The country has sought to increase its share of the commercial launch market by building a lower-cost alternative to its older H2-A vehicle to more effectively compete with SpaceX's Falcon 9 booster. Mitsubishi's goal was to sell the H3 at $51 million per launch in its base configuration. This would allow the company to supplement its launches of institutional missions for the Japanese government with commercial satellites. Tuesday's debut flight of the H3 rocket carried the Advanced Land Observing Satellite-3 for the Japanese government. It was lost.

[...] The failure is just the latest challenge for the H3 rocket. A fundamental problem with the booster is that, even if it were to fly safely, the H3 rocket has no clear advantages over the Falcon 9, which now has a streak of more than 170 consecutive successful launches. The new H3 rocket is also fully expendable, unlike the Falcon 9 and many newer boosters in development in the United States and China.

Read more of this story at SoylentNews.

20:00

Moving Magnet Draws Stylish Shapes On Flexible Film Hackaday

A display based on magnetic viewing film

[Moritz v. Sivers] has a knack for making his own displays, which are typically based on some obscure physical effect. Magnetic viewing films, those thin plastic sheets that change color in response to a magnetic field, are his latest area of interest, as you can see in his Magnetic Kinetic Art Display.

The overall idea of the display is similar to a kinetic sand art table, in which a ball traces out shapes in a pile of sand. In [Moritz]s project, the magnetic viewing film is the sand, and a 2 mm diameter magnet is the ball. The magnet is moved along the film by two sets of coils embedded inside a flex PCB mounted just below the film. One set of coils, on the top layer of the PCB, moves the magnet in the x direction, while a second set on the bottom layer moves it in the y direction.

...

19:00

Hidden Chamber Revealed Inside Great Pyramid of Giza Terra Forming Terra



I so want to dismantle the Great pyramid block by block and then put it all back together including a the full on casing stones. We would automatically get full access and all the archeology.

Once done, it would be the greatest tourist property on Earth and we may actually restore original function or at least try.

Not that hard to do with modern cranes and real care on the repacking.  Should match the twenty year time budget and 10,000 builders.

  
Hidden Chamber Revealed Inside Great Pyramid of Giza

Researchers used cosmic-ray imaging to uncover the 30-foot-long corridor



Christopher Parker

March 3, 2023


Tourists visiting the Great Pyramid in Giza, Egypt, earlier this week Fadel Dawod via Getty Images



Even at 4,500 years old, the Great Pyramid of Giza is still revealing new secrets.

On Thursday, Egyptian officials announced the discovery of a hidden corridor above the pyramids entrance. Measuring 30 feet long, the passage could serve as a jumping-off point for additional research into the mysterious inner chambers.

Report an ad

According to a new study published in the journal Nature Communications, the pyramid has been undergoing noninvasive scans since 2015. Through an international partnership known as...

Better Than Laxatives: The King of Fruit Helps to Relieve Constipation Terra Forming Terra






I am inclined to accept just about any fruit as conducive to good digestion. so long as you have plenty. I do think that we err on having too little.

In the event mangos are plentiful and available and easy to consume. Same old story - scarf one down every day just like that apple.

Plentry of our food intake works against good digestion so adding plenty of fruit makes good sense..

Better Than Laxatives: The King of Fruit Helps to Relieve Constipation

Jul 14 2022

https://www.theepochtimes.com/health/better-than-laxatives-the-king-of-fruit-helps-to-relieve-constipation_4599158.html

You can access the benefits of mangoes by adding them to smoothies, tossing them into salads, using them in marinades and jams, or eating them as a snack out of hand. (Photo by ROMAN ODINTSOV/Pexels)


When it comes to regularity, almost everybody needs a little help moving things along at one time or another. But for millions of Americans, the problem is not just an occasional glitch in routine but a frequent occurrence. According to a recent review published in Gastroenterology, 16 percent of Americans suffer from chronic constipation with the odds rising to 33 percent for those over 60.

Luckily, recent research shows that this unpleasant problem may have a pleasant solution. Multiple studies have supported the digestive benefits of mangos, including their ability to ease constipation significantly. In addi...

Sudden Death Epidemic Explodes Terra Forming Terra




We still have nothing like real data since 2019 let alone real time data.  The necessity to correct has pushed some out and it is not good news.  Understand that no falsified database can be allowed to stand past a couple of review cycles in order to not be rendered unusable.

They are still managing the gap, but tyhat need is now disapating as hard evidence is becoming available to everyone.  Hmm - are old age homes becoming empty here or in China?  Just how are those public companies doing?

Has China lost even ten percent of the population?  How are toilet paper sales?  A real change there is intractable.  That is what we really noticed by the shift to home based work.



March 4, 2023

Sudden Death Epidemic Explodes Across America As Doctor Bluntly Warns: 'The Greatest Perpetrator Of Misinformation During The Pandemic Has Been The United States Government'


for All News Pipeline

https://www.freedomsphoenix.com/News/34043...

Chinese Lunar New Year Travel Plunged by 924 Million in 2023 Terra Forming Terra




Now suppose that the reason for this sharp decline in traffic happens to be wholesale death of those over 65.  That alone can explain the trip decline.  Understand that when the regime signed off on launching the plandemic, they justified it by saying it would mostly impact the elderly.  I have not forgotten that guys.

Could it be that these psychotic true believers were actually targeting their own population and that the rest of the world is mostly collateral damage?

We may be looking at a short order decline to around 700,000,000 over the next five years.  and we still lack clear knowledge in terms of hte rerst of the globe.



Chinese Lunar New Year Travel Plunged by 924 Million in 2023

Estimate suggests a huge number of deaths

Patients are cared for by relatives and medical staff as they are seen on beds set up in the atrium area of a busy hospital in Shanghai, China, on Jan. 13, 2023. (Kevin Frayer/Getty Images)


March 4, 2023

https://www.theepochtimes.com/chinese-lunar-new-year-travel-plunged-by-924-million-in-2023_5099683.html

...

18:57

Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments The Hacker News

High-profile government entities in Southeast Asia are the target of a cyber espionage campaign undertaken by a Chinese threat actor known as Sharp Panda since late last year. The intrusions are framework, marking a departure from the group's attack chains observed in 2021. Israeli cybersecurity company Check Point said the "

18:37

VMware NSX Manager bugs actively exploited in the wild since December Security Affairs

Security researchers warn of hacking attempts in the wild exploiting critical vulnerabilities in VMware NSX Manager.

Cyber security firm Wallarm is warning of ongoing attacks exploiting the critical flaws, tracked as CVE-2021-39144 (CVSS score of 9.8) and CVE-2022-31678 (CVSS score of 9.1), in VMware NSX Manager.

VMware NSX is a network virtualization solution that is available in VMware vCenter Server.

The flaws can lead to remote code execution by pre-authenticated attackers. The CVE-2022-31678 flaw is an XML External Entity (XXE) vulnerability. An unauthenticated user may exploit this issue to cause a denial-of-service condition or unintended information disclosure.

The remote code execution vulnerability CVE-2021-39144 resides in the XStream open-source library. Unauthenticated attackers can exploit the vulnerability in low-complexity attacks without user interaction.

Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of root on the appliance. reads the advisory published by the company.

VMware warned of the existence of a public exploit targeting the CVE-2021-39144 vulnerability in October 2022, shortly after its disclosure.

The virtualization giant pointed out the impacted product had reached end-of-life (EOL) status in January 2022.

Wallarm Detect this week warned that, since December 2022, they are observing threat actors exploiting the issues. According to the experts, the CVE-2021-39144 vulnerability was exploited over 40 thousand times over the last 2 months.

Active exploitation started on 2022-Dec-08 and keeps going. reads the advisory published by Wallarm Detect. Attackers are scanning from well-known data centers like Linode and Digital Ocean over 90% of the attacks are coming from their IP addresses. 

If successfully exploited, the impact of these vulner...

18:27

CoC Extremism Has Cost Debian (and Its Derivatives) the Main KDE Maintainer Techrights

LaTeX and many other packages as well (orphaned due to people who don't even code)

As already mentioned in some comments to various blog posts here, I will not invest more work into the current repositories. I invite anyone with interest in continuing the work to contact me. I will also write up a short howto guide on what I generally did and how I worked with this amount of packages. I feel sad about leaving this behind, but also relieved from the amount of work, not to speak of the insults (You are a Nazi etc) I often get from the Debian side. I also feel sorry for all of you who have relied on these packages for long time, have given valuable feedback and helpful comments.

Summary: As explained here many times before [1, 2, 3], people who contribute nothing (or very little, a minuscule/negligible amount) are driving out some of the most active and most important contributors; this leaves users in a tough place (maintainership waning)

18:00

After 17th Court Hearing, Woman With TB Ordered to Jail for Refusing Treatment SoylentNews

Washington judge issued an arrest warrant and ordered her to involuntary detention:

A judge in Washington issued an arrest warrant Thursday for a Tacoma woman who has refused to have her active, contagious case of tuberculosis treated for over a year, violating numerous court orders. The judge also upheld an earlier order to have her jailed, where she can be  tested and treated in isolation.

On Thursday, the woman attended the 17th court hearing on the matter and once again refused a court order to isolate or comply with testing and treatmentan order that originally dates back to January 19, 2022. Pierce County Superior Court Judge Philip Sorensen rejected her objections to being treated and upheld a finding of contempt. Though it remains unclear what her objections are, the woman's lawyer suggested it may be a problem with understanding, according to The News Tribune. The Tacoma-Pierce County Health Department, however, argued that she "knowingly, willfully, and contemptuously violated this court's orders," noting the lengthy process and numerous proceedings and discussions in which interpreters, translated documents, and speakers of her native language were made available.

[...] As Ars previously reported, the court had renewed orders for her isolation and treatment on a monthly basis since January of 2022. The health department had always said it was approaching the problem cautiously, working to keep a "balance between restricting somebody's liberty and protecting the health of the community." It sees detention as the "very, very last option."

Read more of this story at SoylentNews.

17:31

Initial support for guided disk encryption in the installer OpenBSD Journal

The OpenBSD installer now has basic support for configuring disk encryption during the regular installation process. Previously, disk encryption needed to be set up manually by dropping to the shell from the installer.

Initial support, likely to be expanded upon, was committed by Klemens Nanni (kn@) on . The commit reads,

Subject:    CVS: cvs.openbsd.org: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>
Date:       

Read more

17:30

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 (CVSS score: 9.8) - Teclib GLPI Remote Code Execution Vulnerability CVE-2022-33891 (CVSS score: 8.8) - Apache Spark Command Injection Vulnerability

17:02

Dynamic host configuration, please OpenBSD Journal

Another piece from Florian Obser (florian@) just came out, titled Dynamic host configuration, please.

In the article, Florian details the steps to modern OpenBSD dynamic host configuration, including interface configuration, name resolution, routing and more.

We also get an explanation of the various userland programs (most of them portable, some OpenBSD-specific) that make a modern OpenBSD laptop shine.

You can read the full piece here, Dynamic host configuration, please.

17:00

Pulling Data From HDMI RF leakage Hackaday

A long-running story in the world of electronic security has been the reconstruction of on-screen data using RF interference from monitors or televisions. From British TV detector vans half a century ago to 1980s scare stories about espionage, it was certainly easy enough to detect an analogue CRT with nothing more than an AM broadcast radio receiver. But can this still be done in the digital age? Its something [Windytan] has looked into, as she reconstructs images using leakage from HDMI cables.

...

16:42

Microsoft Employees Run for Board of the OSI, Forget to Disclose Working Full Time for Microsoft Techrights

Not even the first time. Later they write official blog posts on behalf of the OSI. Entryism defined.

osi-board
Two of them are Linux Foundation, i.e. an openwashing front group of proprietary software companies (the OSI is also a front group of Microsoft since taking money from Microsoft)

No disclosure
Microsoft not mentioned even once

Aeva Black
Overt conflict of interest (Microsoft is attacking Open Source)

Summary: As noted in the last batch of Daily Links, OSI is a lost cause because it attacks the concept of Open Source in exchange for bribes from Microsoft. It even helps Microsoft in a lawsuit where Microsofts GPL violations are tackled.

16:30

Three crucial moments when founding a cybersecurity startup Help Net Security

With 10% of startups failing in the first year, making wise and future-proof decisions for your new cybersecurity venture is essential. Building the perfect cybersecurity startup As society adapts to an increasingly digital world, opportunities for cybercrime and attacks are also mounting. Consequently, more and more cybersecurity businesses are popping up, and the market is becoming more saturated with each quarter that passes. While theres no blueprint for building the perfect cybersecurity startup, there are More

The post Three crucial moments when founding a cybersecurity startup appeared first on Help Net Security.

16:00

How STEM education can solve talent shortages, improve cybersecurity Help Net Security

In this Help Net Security video, Avani Desai, CEO at Schellman, talks about how teaching STEM subjects like cybersecurity is essential for addressing the staffing crisis and ensuring that organizations have the talent to protect themselves from cyber threats in the years to come. In addition, teaching STEM subjects like cybersecurity can help promote diversity and inclusion in the tech industry. By providing opportunities for underrepresented groups to learn about cybersecurity and pursue careers in More

The post How STEM education can solve talent shortages, improve cybersecurity appeared first on Help Net Security.

15:30

Attackers exploit APIs faster than ever before Help Net Security

After combing through 350,000 reports to find 650 API-specific vulnerabilities from 337 different vendors and tracking 115 published exploits impacting these vulnerabilities, the results clearly illustrate that the API threat landscape is becoming more dangerous, according to Wallarm. API attack analysis for 2022 Researchers came to this conclusion based on the 2022 data, specifically these three trends: Attack growth In 2022 there was a huge increase in attacks against Wallarms customers APIs, which ballooned over More

The post Attackers exploit APIs faster than ever before appeared first on Help Net Security.

15:15

50 Years Later, Were Still Living in the Xerox Altos World SoylentNews

50 Years Later, We're Still Living in the Xerox Alto's World:

[...] I'm talking about the Xerox Alto, which debuted in the early spring of 1973 at the photocopying giant's newly established R&D laboratory, the Palo Alto Research Center (PARC). The reason it is so uncannily familiar today is simple: We are now living in a world of computing that the Alto created.

The Alto was a wild departure from the computers that preceded it. It was built to tuck under a desk, with its monitor, keyboard, and mouse on top. It was totally interactive, responding directly to its single user.

[...] The people who developed the Alto came to Xerox PARC from universities, industrial labs, and commercial ventures, bringing with them diverse experiences and skills. But these engineers and programmers largely shared the same point of view. They conceived and developed the Alto in a remarkable burst of creativity, used it to develop diverse and pathbreaking software, and then moved out of Xerox, taking their achievements, design knowledge, and experiences into the wider world, where they and others built on the foundation they had established.

[...] The type of computing they envisioned was thoroughly interactive and personal, comprehensively networked, and completely graphicalwith high-resolution screens and high-quality print output.

[...] Oddly, at the time, an expensive new laboratory was also immediately financially attractive: R&D expenditures were frequently counted as assets instead of business expenses, all with Wall Street's approval. The more you spent, the better your balance sheet looked.

Read more of this story at SoylentNews.

15:00

AI is taking phishing attacks to a whole new level of sophistication Help Net Security

92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress. Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it. The growing sophistication of phishing emails is a major threat to organizations and More

The post AI is taking phishing attacks to a whole new level of sophistication appeared first on Help Net Security.

14:30

Persona Graph proactively surfaces and blocks hidden fraud rings Help Net Security

Persona has launched Graph to help businesses stop online identity fraud. Leveraging advanced link analysis technology and a configurable query, Graph detects risky connections between users, enabling organizations to uncover and proactively block hard-to-detect fraud. Risk and compliance teams now have expert-level investigation capabilities to spot fraudsters and bad actors at scale, more quickly adapt to evolving fraud techniques, and stop incidents before they happen and take real-time actionall without requiring heavy engineering resources. As More

The post Persona Graph proactively surfaces and blocks hidden fraud rings appeared first on Help Net Security.

14:00

Powercore Aims to Bring the Power of EDM to Any 3D Printer Hackaday

The desktop manufacturing revolution has been incredible, unleashing powerful technologies that once were strictly confined to industrial and institutional users. If you doubt that, just look at 3D printing; with a sub-$200 investment, you can start making parts that have never existed before.

Sadly, though, most of this revolution has been geared toward making stuff from one or another type of plastic. Wouldnt it be great if you could quickly whip up an aluminum part as easily and as cheaply as you can print something in PLA? That day might be at hand thanks to Powercore, a Kickstarter project that aims to bring the power of electric discharge machining (EDM) to the home gamer. The principle of EDM is simple electric arcs can easily erode metal from a workpiece. EDM machines put that...

14:00

Akamai unveils new service and tools to help users reduce attack surface Help Net Security

Akamai Technologies has introduced the Akamai Hunt security service that enables customers to capitalize on the infrastructure of Akamai Guardicore Segmentation, Akamais global attack visibility, and expert security researchers to hunt and remediate the most evasive threats and risks in their environments. Akamai also released Agentless Segmentation, helping Akamai Guardicore Segmentation customers extend the benefits of zero trust to connected IoT and OT devices that arent capable of running host-based security software. As organizations embrace More

The post Akamai unveils new service and tools to help users reduce attack surface appeared first on Help Net Security.

13:30

New Kensington privacy screens protect against visual hacking Help Net Security

Kensington has expanded its robust portfolio of data protection solutions with the launch of three new privacy screens. The SA270 Privacy Screen for Studio Display (K50740WW), SA240 Privacy Screen for iMac 24 (K55170WW), and MagPro Elite Magnetic Privacy Screen for MacBook Air 2022 (K58374WW), expand Kensingtons extensive portfolio of privacy screens that enable businesses to reduce the potential loss of confidential and sensitive data through visual hacking from laptops and computer screens. Hybrid and remote More

The post New Kensington privacy screens protect against visual hacking appeared first on Help Net Security.

12:32

Why do Businesses Need to Focus More on Cybersecurity HackRead | Latest Cybersecurity and Hacking News Site

By Owais Sultan

As technology continues to evolve, the need for businesses to focus more on cybersecurity is becoming increasingly important

This is a post from HackRead.com Read the original post: Why do Businesses Need to Focus More on Cybersecurity

12:29

Dutch Officials Warn That Big Telecom's Plan to Tax Big Tech is a Dangerous Dud SoylentNews

Dutch Officials Warn That Big Telecom's Plan To Tax 'Big Tech' Is A Dangerous Dud:

For much of the last year, European telecom giants have been pushing for a tax on Big Tech company profits. They've tried desperately to dress it up as a reasonable adult policy proposal, but it's effectively just the same thing we saw during the U.S. net neutrality wars: telecom monopolies demanding other people pay them an additional troll toll for no coherent reason.

To sell captured lawmakers on the idea, telecom giants have falsely claimed that Big Tech companies get a "free ride" on the Internet (just as they did during the U.S. net neutrality wars). To fix this problem they completely made up, Big Telecom argues Big Tech should be forced to help pay for the kind of broadband infrastructure upgrades the telecoms have routinely neglected for years.

It's a big, dumb con. But yet again, telecom lobbyists have somehow convinced regulators that this blind cash grab is somehow sensible, adult policy. Dutifully, European Commission's industry chief Thierry Breton (himself a former telecom exec) said last September he would launch a consultation on this "fair share" payment scheme in early 2023, ahead of any proposed legislation.

[...] But they're often not looking at the real problem. Both in the EU and North America, regulators routinely and mindlessly let telecom giants consolidate and monopolize an essential utility. Those monopolies then work tirelessly to drive up rates and crush competition. And, utilizing their lobbying power, they've also routinely gleamed billions in subsidies for networks they routinely half-complete.

[...] If the EU successfully implements such a scheme, you can be absolutely sure the next step will be the U.S., with captured regulators like Brendan Carr (who has been beating this idiotic drum for a few years now) at the front of the parade at Comcast's and AT&T's behest.


Original Submission

Read more of this story...

12:23

NEW 'Off The Wall' ONLINE 2600 - 2600: The Hacker Quarterly

NEW 'Off The Wall' ONLINE

Posted 08 Mar, 2023 1:23:55 UTC

The new edition of Off The Wall from 03/07/2023 has been archived and is now available online.

11:48

4 Things You May Not Know About Performance Analytics Technology HackRead | Latest Cybersecurity and Hacking News Site

By Owais Sultan

Managers are aware that they are being held accountable for their teams performance. How well their teams do

This is a post from HackRead.com Read the original post: 4 Things You May Not Know About Performance Analytics Technology

11:20

SANS Institute and Google collaborate to launch Cloud Diversity Academy Help Net Security

SANS Institute has launched the SANS Cloud Diversity Academy (SCDA) in collaboration with Google. This academy provides training and certifications to Black, Indigenous, and People of Color (BIPOC), women, and other underrepresented groups who are passionate about pursuing a technical career in cybersecurity. The SCDA aims to reduce the skills gap in the industry, with a particular focus on cloud security, while also creating a more diverse and inclusive workforce. Empowering communities that have been More

The post SANS Institute and Google collaborate to launch Cloud Diversity Academy appeared first on Help Net Security.

11:17

11:00

A Ground Source Heat Pump From an Air Conditioner Hackaday

When it comes to lower-energy home heating, its accurate in all senses to say that heat pumps are the new hotness. But unless you happen to work with them professionally, its fair to say their inner workings are beyond most of us. Help is at hand though courtesy of [petey53], who made his own ground source heat pump for his Toronto house using a pair of window-mounted air conditioning units.

...

11:00

HPR3808: Funkwhale A social platform to enjoy and share music Hacker Public Radio

Funkwhale is a community-driven project that lets you listen and share music and audio within a decentralized, open network https://funkwhale.audio/ https://funkwhale.audio/en_US/faqs https://funkwhale.audio/en_US/apps/ https://en.wikipedia.org/wiki/Grooveshark https://vuejs.org/ https://musicbrainz.org/ https://picard.musicbrainz.org/ https://www.subsonic.org/pages/index.jsp https://open.audio/ https://www.castopod.com/en https://tanukitunes.com https://castopod.org/ https://fosstodon.org/@funkwhale https://blog.funkwhale.audio https://dev.funkwhale.audio/funkwhale/funkwhale

Can Static Analysis Tools Find More Defects? It Will Never Work in Theory

Sorting algorithms, data compression, engine efficiency: in each case, we can compare how well we're doing to a provable optimum. In situations where we don't know what the upper bound is, we can still sometimes estimate how much room there is for improvement. This paper does that for static analysis tools that look for patterns (or anti-patterns) in code that indicate bugs. By reformulating issues found in manual code review as rules, the authors show that static analysis might be able to detect as much as three quarters of all bugs, which is considerably better than what current-generation linters do. Work like this can guide development of better tools, but it also tells us how much we still have to gain from them.

Sahar Mehrpour and Thomas D. LaToza. Can static analysis tools find more defects? Empirical Software Engineering, Nov 2022. doi:10.1007/s10664-022-10232-4.

Static analysis tools find defects in code, checking code against rules to reveal potential defects. Many studies have evaluated these tools by measuring their ability to detect known defects in code. But these studies measure the current state of tools rather than their future potential to find more defects. To investigate the prospects for tools to find more defects, we conducted a study where we formulated each issue raised by a code reviewer as a violation of a rule, which we then compared to what static analysis tools might potentially check. We first gathered a corpus of 1323 defects found through code review. Through a qualitative analysis process, for each defect we identified a violated rule and the type of Static Analysis Tool (SAT) which might check this rule. We found that SATs might, in principle, be used to detect as many as 76% of code review defects, considerably more than current tools have been demonstrated to successfully detect. Among a variety of types of SATs, Style Checkers and AST Pattern Checkers had the broadest coverage of defects, each with the potential to detect 25% of all code review defects. We found that static analysis tools might be able to detect more code review defects by better supporting the creation of project-specific rules. We also investigated the characteristics of code review defects not detectable by traditional static analysis techniques, which to detect might require tools which simulate human judgements about code.

10:30

Intel Releases x86-simd-sort v1.0 Library For High Performance AVX-512 Sorting Phoronix

Last month you may recall the news of Intel having an extremely fast AVX-512 sorting library they published as open-source and found adoption already by the popular Numpy Python library. In the case of Numpy it could deliver some 10~17x speed-ups. That

10:19

Sued by Meta, Freenom Halts Domain Registrations Krebs on Security

The domain name registrar Freenom, whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes after the Dutch registrar was sued by Meta, which alleges the company ignores abuse complaints about phishing websites while monetizing traffic to those abusive domains.

Freenoms website features a message saying it is not currently allowing new registrations.

Freenom is the domain name registry service provider for five so-called country code top level domains (ccTLDs), including .cf for the Central African Republic; .ga for Gabon; .gq for Equatorial Guinea; .ml for Mali; and .tk for Tokelau.

Freenom has always waived the registration fees for domains in these country-code domains, presumably as a way to encourage users to pay for related services, such as registering a .com or .net domain, for which Freenom does charge a fee.

On March 3, 2023, social media giant Meta sued Freenom in a Northern California court, alleging cybersquatting violations and trademark infringement. The lawsuit also seeks information about the identities of 20 different John Does Freenom customers that Meta says have been particularly active in phishing attacks against Facebook, Instagram, and WhatsApp users.

The lawsuit points to a 2021 study (PDF) on the abuse of domains conducted by Interisle Consulting Group, which discovered that those ccTLDs operated by Freenom made up five of the Top Ten TLDs most abused by phishers.

The five ccTLDs to which Freenom provides its services a...

09:53

Microsoft Found Shein App Copying Clipboard Content on Android Phones HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

copying clipboard content on Android devices before being detected and reported by Microsoft to Google.

This is a post from HackRead.com Read the original post: Microsoft Found Shein App Copying Clipboard Content on Android Phones

09:41

Reverse-Engineering the ModR/M Addressing Microcode in the Intel 8086 Processor SoylentNews

https://www.righto.com/2023/02/8086-modrm-addressing.html

One interesting aspect of a computer's instruction set is its addressing modes, how the computer determines the address for a memory access. The Intel 8086 (1978) used the ModR/M byte, a special byte following the opcode, to select the addressing mode.1 The ModR/M byte has persisted into the modern x86 architecture, so it's interesting to look at its roots and original implementation.

In this post, I look at the hardware and microcode in the 8086 that implements ModR/M2 and how the 8086 designers fit multiple addressing modes into the 8086's limited microcode ROM. One technique was a hybrid approach that combined generic microcode with hardware logic that filled in the details for a particular instruction. A second technique was modular microcode, with subroutines for various parts of the task.

I've been reverse-engineering the 8086 starting with the silicon die. The die photo below shows the chip under a microscope. The metal layer on top of the chip is visible, with the silicon and polysilicon mostly hidden underneath. Around the edges of the die, bond wires connect pads to the chip's 40 external pins. I've labeled the key functional blocks; the ones that are important to this discussion are darker and will be discussed in detail below. Architecturally, the chip is partitioned into a Bus Interface Unit (BIU) at the top and an Execution Unit (EU) below. The BIU handles bus and memory activity as well as instruction prefetching, while the Execution Unit (EU) executes instructions and microcode. Both units play important roles in memory addressing.


Original Submission

Read more of this story at SoylentNews.

09:38

SYS01 stealer targets critical government infrastructure Security Affairs

Researchers discovered a new info stealer dubbed SYS01 stealer targeting critical government infrastructure and manufacturing firms.

Cybersecurity researchers from Morphisec discovered a new, advanced information stealer, dubbed SYS01 stealer, that since November 2022 was employed in attacks aimed at critical government infrastructure employees, manufacturing companies, and other sectors.

The experts found similarities between the SYS01 stealer and another info stealing malware, tracked as S1deload, that was discovered by Bitdefender researchers.  

We have seen SYS01 stealer attacking critical government infrastructure employees, manufacturing companies, and other industries. reads the analysis published by Morphisec. The threat actors behind the campaign are targeting Facebook business accounts by using Google ads and fake Facebook profiles that promote things like games, adult content, and cracked software, etc. to lure victims into downloading a malicious file. The attack is designed to steal sensitive information, including login data, cookies, and Facebook ad and business account information. 

The experts reported that the campaign was first uncovered in May 2022 that Zscaler researchers linked to the Ducktail operation by Zscaler. The DUCKTAIL campaign was first analyzed by researchers from WithSecure (formerly F-Secure Business) in July 2022, it was targeting individuals and organizations that operate on Facebooks Business and Ads platform.

The attack chain starts by luring a victim to click on a URL from a fake Facebook profile or advertisement to download a ZIP file that pretends to have a cracked software, game, movie, etc.  

Upon opening the ZIP file, a loader, often in the form of a legitimate C# application, is executed. The application is vulnerable to DLL side-loading, a technique used to load a malicious DLL when the legitimate app is invoked.

The experts observed threat actors abusing the legitimate applications Western Digitals WDSyncService.exe and Garmins ElevatedInstaller.exe to side-load the malicious payload.

08:18

Tensions Between Filmmakers and Reddit Grow in Piracy Dispute TorrentFreak

reddit-logoTwo years ago, Internet provider RCN was sued by several film companies, including the makers of The Hitmans Wifes Bodyguard, London Has Fallen, and Hellboy.

The filmmakers accused the provider of failing to act against customers accused of piracy. Rather than terminating the accounts of persistent copyright infringers, the Internet provider looked away, they argued.

Subpoena to Unmask Redditors

Many other ISPs have faced similar claims in recent years, but the RCN lawsuit drew attention recently when Reddit was brought into the mix. The filmmakers took an interest in several comments posted by anonymous Redditors, which could potentially help to back up their claims against RCN.

In January, Reddit received a subpoena asking it to uncover the identities of these users. The social discussion platform largely rejected this request, arguing it would violate their users First Amendment Right to anonymous speech.

Reddit further argued that the filmmakers served their subpoena before discovery had begun. This wasnt mentioned in our previous coverage but behind the scenes it had already ignited significant turmoil.

Disputed Discovery Date

According to the filmmakers attorney, Kerry Culpepper, discovery started when the subpoena was sent (January 7) and any claim to the contrary is grossly negligent, untrue, outrageous, or even libelous.

The lawyer reached out to Reddit asking the company to correct the record before it could be reported by the media, fearing that a failure to do so would damage his reputation.

I extend Reddit the opportunity to file an amended opposition by the end of today [] that deletes that argument and all references to it, explicitly notes that it was completely false, and extends an apology to Plaintiffs counsel and the Court for accusing Plaintiffs counsel of blatantly violating the rules, Culpepper wrote.

Reddit wasnt convinced by this request. Citing the court docket, the discussion platform believes that there is no need to correct anything.

We do not take your accusations lightly. We have again reviewed the DNJ docket and see a January 26, 2023, docket entry instructing that &#...

08:00

Hacking a 15 8051-Based Portable Soldering Iron With Custom Firmware Hackaday

With soldering irons being so incredibly useful, and coming on the heels of the success of a range of portable, all-in-one soldering irons from the likes of Waveshare and Pine64, its little wonder that you can get such devices for as little as 10 15 Euro from websites like AliExpress. Making for both a great impulse buy and reverse-engineering target, [Aaron Christophel] got his mittens on one and set to work on figuring out its secrets.

The results are covered in a brief video, as well as a Twitter thread, where this T12 soldering irons guts are splayed around and reprogrammed in all their glory. Despite the MCU on the PCB having had its markings removed, some prodding and poking around revealed it to be an STC8H3K62S2, an 8051-based MCU running at a blistering 11 MHz....

07:37

06:57

Scientists Have Mapped a Secret Hidden Corridor in Great Pyramid of Giza SoylentNews

The corridor is 30 feet long and likely slopes upward. Where it leads is still a mystery.

In 2016, scientists using muon imaging picked up signals indicating a hidden corridor behind the famous chevron blocks on the north face of the Great Pyramid of Giza in Egypt. The following year, the same team detected a mysterious void in another area of the pyramid, believing it could be a hidden chamber. Two independent teams of researchers, using two different muon imaging methods, have now successfully mapped out the corridor for the first time, according to a new paper published in the journal Nature Communications. Zahi Hawass, Egypt's former antiquities minister, called it "the most important discovery of the 21st century." [So far - Ed]

As we've reported previously, there is a long history of using muons to image archaeological structures, a process made easier because cosmic rays provide a steady supply of these particles. An engineer named E.P. George used them to make measurements of an Australian tunnel in the 1950s. But Nobel-prize-winning physicist Luis Alvarez really put muon imaging on the map when he teamed up with Egyptian archaeologists to use the technique to search for hidden chambers in the Pyramid of Khafre at Giza. Although it worked in principle, they didn't find any hidden chambers.

There are many variations of muon imaging, but they all typically involve gas-filled chambers. As muons zip through the gas, they collide with the gas particles and emit a telltale flash of light, which is recorded by the detector, allowing scientists to calculate the particle's energy and trajectory. It's similar to X-ray imaging or ground-penetrating radar, except with naturally occurring high-energy muons rather than X-rays or radio waves. That higher energy makes it possible to image thick, dense substances like the stones used to build pyramids. The denser the imaged object, the more muons are blocked, casting a telltale shadow. Hidden chambers in a pyramid would show up in the final image because they blocked fewer particles.

...

06:25

Serious DJI Drones Flaws Could Crash Drones Mid-flight HackRead | Latest Cybersecurity and Hacking News Site

By Habiba Rashid

During their assessment, the researchers discovered a total of 16 vulnerabilities with a broad range of impacts, from denial of service to arbitrary code execution.

This is a post from HackRead.com Read the original post: Serious DJI Drones Flaws Could Crash Drones Mid-flight

06:00

AMD Ryzen 9 7900X3D Linux Performance Phoronix

Following last week's review of the brand new AMD Ryzen 9 7950X3D and then moving on to looking at the Ryzen 9 7900X3D gaming performance, today's Linux hardware coverage on Phoronix is looking at the Ryzen 9 7900X3D Linux performance in other system/CPU workloads aside from gaming.

06:00

Countdown to the 2023 IEEE Annual Election IEEE Spectrum



On 1 May the IEEE Board of Directors is scheduled to announce the candidates to be placed on this years ballot for the annual election of officerswhich begins on 15 August.

The ballot includes IEEE president-elect candidates and other officer positions up for election.


The Board of Directors has nominated IEEE Fellow Roger U. Fujii and IEEE Senior Member Kathleen A. Kramer as candidates for 2024 IEEE president-elect. Visit the IEEE elections page to learn about the candidates.

The ballot includes nominees for delegate-elect/director-elect openings submitted by division and region nominating committees, IEEE Technical Activities vice president-elect, IEEE-USA president-elect, IEEE Standards Association president-elect, IEEE Women in Engineering Committee chair-elect, and board of governors members-at-large.

IEEE members who want to run for an office but who have not been nominated need to submit their petition intention to the IEEE Board of Directors by 15 April. Petitions should be sent to the IEEE Corporate Governance staff: elections@ieee.org.

Those elected take office on 1 January 2024.

To ensure voting eligibility, members are encouraged to review and update their contact information and communication preferences by 30 June.

Given ever-changing global conditions, members might wish to vote electronically instead of by mail.

For more information about the offices up for election, the process of getting on the ballot, and deadlines, visit the IEEE elections page or write to elections@ieee.org.

05:01

How to encrypt Bash shell variables with Ansible Vault Linux.com

Use Ansible Vault to share encrypted Bash environment variables across projects.

Read More at Enable Sysadmin

The post How to encrypt Bash shell variables with Ansible Vault appeared first on Linux.com.

04:13

Chinese Sharp Panda Group Unleashes SoulSearcher Malware HackRead | Latest Cybersecurity and Hacking News Site

By Waqas

Currently, in its cyber espionage campaign, Sharp Panda hackers are targeting government entities in Asia.

This is a post from HackRead.com Read the original post: Chinese Sharp Panda Group Unleashes SoulSearcher Malware

04:13

Huge Lithium Find in Iran May End World Shortage SoylentNews

Huge lithium find may end world shortage there's a catch:

Lithium, sometimes hyped as white gold, has been highly sought after for its role in battery production, and other things.

Global demand is expected to continue to outstrip supply in the years to come. Albemarle Corporation projects [PDF] lithium demand will rise from 1.8 million metric tons in 2025 to 3.7 million metric tons in 2030 largely due to its role in electric vehicles and other battery dependent devices.

The White House last year said critical minerals rare earth metals, lithium, and cobalt "are essential to our national security and economic prosperity."

Alas for the US, the latest cache of this malleable metal has turned up in Iran one of just four countries America has designated a state sponsor of terrorism.

According to The Financial Tribune, an English language news publication focused on Iran that's operated by Tehran-based Donya-e-Eqtesad, Ebrahim Ali Molla-Beigi, director general of the Exploration Affairs Office of the Ministry of Industries, Mining and Trade, said that Iran has discovered its first lithium reserve in Hamedan Province, in the western part of the country.

The reserve is said to be 8.5 million metric tons, which if accurate would be among the largest known deposits yet discovered.

According to the US Geological Survey [PDF], the top five identified lithium reserves are: Bolivia, 21 million tons; Argentina, 20 million tons; Chile, 11 million tons; Australia, 7.9 million tons, and China, 6.8 million tons.

Read more of this story at SoylentNews.

03:27

03:16

Perth Mint Sold Diluted Gold To China, Got Caught, And Tried To Cover It Up cryptogon.com

Via: ABC: The historic Perth Mint is facing a potential $9 billion recall of gold bars after selling diluted or doped bullion to China and then covering it up, according to a leaked internal report. Four Corners has uncovered documents charting the WA government-owned mints decision to begin doping its gold in 2018, and then []

03:15

[$] BTHome: An open standard for broadcasting sensor data LWN.net

Many wireless sensors broadcast their data using Bluetooth Low Energy (BLE). Their data is easy to receive, but decoding it can be a challenge. Each manufacturer uses its own format, often tied to its own mobile apps. Integrating all of these sensors into a home-automation system requires a lot of custom decoders, which are generally developed by reverse-engineering the protocols. The goal of the BTHome project is to change this: it offers a standardized format for sensors to broadcast their measurements using BLE. BTHome is supported by the Home Assistant home-automation software and by a few open-firmware and open-hardware projects.

03:00

I Fly Openers BlackFly eVTOL IEEE Spectrum



On a gin-clear December day, Im sitting under the plexiglass bubble of a radically new kind of aircraft. Its a little past noon at the Byron Airport in northern California; in the distance, a jagged line of wind turbines atop rolling hills marks the Altamont Pass, blades spinning lazily. Above me, a cloudless blue sky beckons.

The aircraft, called BlackFly, is unlike anything else on the planet. Built by a Palo Alto, Calif., startup called Opener, its an electric vertical take-off and landing (eVTOL) aircraft with stubby wings fore and aft of the pilot, each with four motors and propellers. Visually, its as though an aerial speedster from a 1930s pulp sci-fi story has sprung from the page.


There are a couple of hundred startups designing or flying eVTOLs. But only a dozen or so are making tiny, technologically sophisticated machines whose primary purpose is to provide exhilarating but safe flying experiences to people after relatively minimal training. And in that group, Opener has jumped out to an early lead, having built dozens of aircraft at its facilities in Palo Alto and trained more than a score of people to fly them.

My own route to the cockpit of a BlackFly was relatively straightforward. I contacted the companys CEO, Ken Karklin, in September 2022, pitched him on the idea of a story and video, and three months later I was flying one of his aircraft.

Well, sort of flying it. My brief flight was so highly automated that I was more passenger than pilot. Nevertheless, I spent about a day and a half before the flight being trained to fly the machine manually, so that I could take control if anything went wrong. For this training, I wore a virtual-reality headset and sat in a chair that tilted and gyrated to simulate flying maneuvers. To fly this simulation I manipulated a joystick that was identical to the one in the cockpit of a BlackFly. Openers chief operating officer, Kristina L. Menton, and engineer Wyatt Warner took turns patiently explaining the operations of the vehicle and giving me challenging tasks to complete, such as hovering and performing virtual landings in a vicious crosswind.

The BlackFly is entirely controlled by that joystick, which is equipped with a trigger and also topped by a thumb switch. To take off, I squeeze th...

02:46

Acer discloses a new data breach, 160 GB of sensitive data available for sale Security Affairs

Taiwanese multinational hardware and electronics corporation Acer discloses a data breach after a threat actor claimed the hack of the company.

Recently a threat actor announced the availability for sale of 160 GB of data allegedly stolen from the Taiwanese multinational hardware and electronics corporation Acer.

Acer data breach

The threat actor announced the hack on a popular cybercrime forum, he claims to have stolen about 2869 files. The stolen files include confidential product model documentation, binaries, backend infrastructure, BIOS information, and other sensitive data.

Reads the post published by the seller on Breached Forums:

The leak contains a total 160GB of 655 directories, and 2869 files. It includes:

  • Confidential slides/presentations
  • Staff manuals to various technical problems
  • Windows Imaging Format files
  • Tons of binaries (.exe, .dll, .bin, etc)
  • Backend infrastructure
  • Confidential product model documentation and information of phones, tablets, laptops, etc
  • Replacement Digital Product Keys (RDPK)
  • ISO files
  • Windows System Deployment Image (SDI) files
  • Tons of BIOS stuff
  • ROM files

(honestly theres so much shit that itll take me days to go through the list of what was breached lol)

Acer confirmed the incident and discloses a data breach, the company said that attackers have compromised one of its servers.

We have recently detected an incident of unauthorized access to one of our document servers for repair technicians. While our investigation is ongoing, there is currently no indication that any consumer data was stored on that server, ...

02:45

Initial Rust DRM Abstractions, AGX Apple DRM Driver Posted For Review Phoronix

After being in development for several months, Asahi Lina with the Asahi Linux project has posted the initial Rust Direct Rendering Manager (DRM) subsystem abstractions for review as well as a preview of the experimental state of the AGX DRM driver providing the open-source kernel graphics driver support for Apple M1/M2 hardware...

02:42

The Government Is Trying To Kill Us Now: Low-Income Americans Fume In Mile-Long Food Lines After Pandemic Benefits End cryptogon.com

Via: ZeroHedge: Over the past year, 18 US states have officially ended pandemic-era states of emergency including the covid food benefit, while a December mandate from Congress will end aid in March for the other 32 states, along with the District of Columbia, the US Virgin Islands and Guam. The collective return to pre-pandemic []

02:28

The initial posting of the Apple AGX graphics driver LWN.net

Asahi Lina has posted an initial version of a Rust-based driver for Apple AGX graphics processors; the posting includes a fair amount of Rust infrastructure for graphics drivers in general.

While developing the driver, I tried to make use of Rust's safety and lifetime features to provide not just CPU-side safety, but also partial firmware-ABI safety. Thanks to this, it has turned out to be a very stable driver even though GPU firmware crashes are fatal (no restart capability, need to reboot!) and the FW/driver interface is a huge mess of unsafe shared memory structures with complex pointer chains.

02:04

Expert released PoC exploit code for critical Microsoft Word RCE flaw Security Affairs

Security researcher released a proof-of-concept exploit code for a critical flaw, tracked as CVE-2023-21716, in Microsoft Word.

Security researcher Joshua Drake released a proof-of-concept for a critical vulnerability, tracked as CVE-2023-21716 (CVSS score 9.8 out of 10), in Microsoft Word.

The vulnerability can be exploited by a remote attacker to execute arbitrary code on a system running the vulnerable software. The issue can be easily exploited, anyway, it can be exploited only with user interaction.

Microsoft addressed the vulnerability with the release of the February Patch Tuesday security updates.

The vulnerability was discovered by Drake in November, it resides in the in Microsoft Offices wwlib.dll library.

An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file. reads the advisory published by Microsoft.

The vulnerability can be also be exploited by simply loading a specially crafted RTF document in the Preview Pane.

Drake discovered a heap corruption vulnerability in the RTF parser in Microsoft Word that can be triggered dealing with a font table (*\fonttbl*) containing a large number of fonts (*\f###*).

Following this memory corruption, additional processing takes place. With a properly crafted heap layout, an attacker cause the heap corruption to yield arbitrary code execution. Using the proof-of-concept code supplied below, processing eventually reaches the post-processing clean up code. reads the technical post published by the researchers.

The researchers shared a proof-of-concept code that trigger the bug to launch the Calculator app in Windows.

The good news is that at this time Microsoft is not aware of attacks in the wild ex...

01:47

Twitter Suspends Copyright Holder as Musk Outlaws Weaponization of DMCA (Updated) TorrentFreak

pirate twitterIn May 2022, Elon Musk declared overzealous use of the DMCA a plague on humanity.

As CEO of Twitter, Musk understands that his platform has certain obligations if it wishes to maintain protection from liability under copyright law. On receipt of a properly formatted and submitted takedown notice, allegedly infringing content must be taken down.

A dispute that boiled over yesterday began with these two steps but ended up with the copyright holder having his account suspended, presumably by Musk himself or on his instructions.

The two people at the heart of the original dispute are both Twitter users. Since most tweets relating to the initial dispute have since been deleted or disabled, here we rely on archived and cached copies for evidence. Since one users account has been suspended, links to the account and its tweets are included but are likely to fail.

Adrien Mauduit (@NightLights_AM)

Adrien Mauduit (@NightLights_AM, Norway) operates the currently-suspended Night Lights account. He describes himself as a professional nature cinematographer, astrophotographer, and an Aurora chasing specialist.

A review of Mauduits recent posts suggests that his Twitter account is mainly used to post content he creates himself, usually videos or photographs.

Mauduits pinned tweet is/was a stunning short video dated March 4, 2023. Its described as a double solar storm punch that created a G3 (max) geomagnetic storm. This video sits at the heart of the dispute.

nightlights-am-original

Posted on March 3, the video was well received. Comments under the original tweet include: INCREDIBLE! Feast for the eyes and spirit, This one is off the charts! and Wow Adrien! Absolutely killing it! Thanks for sharing!

Massimo (@Rainmaker1973)

Massimo (Italy) operates the...

IndyWatch Science and Technology News Feed Archiver

Go Back:30 Days | 7 Days | 2 Days | 1 Day

IndyWatch Science and Technology News Feed Today.

Go Forward:1 Day | 2 Days | 7 Days | 30 Days

IndyWatch Science and Technology News Feed was generated at World News IndyWatch.

Resource generated at IndyWatch using aliasfeed and rawdog