Get greater control over TCP port checking with a DIY, customizable approach using Python and Scapy.

Read More at Enable Sysadmin

The post Test TCP ports with Python and Scapy appeared first on Linux.com.

The Vintage Computer Festival East took place last weekend at the InfoAge Science and History Museum in New Jersey, and by any metric you care to use, it was a phenomenal success. Everyone you spoke with, from the the exhibitors and attendees, to the veteran volunteers who put this incredible show together, all said the same thing: theyd never seen a turnout like this before.

...

Like trusting Microsoft not to lock/shut GNU/Linux and BSD out (using, e.g., secure boot)

Summary: There was never a lack of gullible people saying terrible things, in spite of all evidence to the contrary

Past 6 months (2023 estimates say 230,842,743 people live in Nigeria, the sixth biggest population on this planet):

Summary: As per these figures from this month, Nigeria is adopting GNU/Linux faster than some countries; is 1 in 20 desktops/laptops running GNU/Linux? Microsoft bribed Nigerian officials 15 years ago to prevent this from happening.

Google on Tuesday rolled out emergency fixes to address another actively exploited high-severity zero-day flaw in its Chrome web browser. The flaw, tracked as CVE-2023-2136, is described as a case of integer overflow in Skia, an open source 2D graphics library. Clment Lecigne of Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on April 12, 2023. "

The desktop-oriented Solus distribution has been through a difficult period; this post describes the extensive changes that have been made in response.

Notably, innovation in the Linux ecosystem is presently centered around the use of application sandboxing, containers and the development of immutable operating systems with a well understood Software Bill of Materials. Each of these concepts allow for a degree of separation and stability when developing, testing and certifying software and products.

The current Solus tooling, as well as the resulting packaging and development experience, is somewhat ill-suited to this objective and would most likely need a wholesale re-engineering of the tools before this becomes feasible.

However, there is a more straightforward path for Solus: Rebasing onto Serpent OS.

Posted by Georgi Guninski on Apr 19

There is minor information disclosure vulnerability similar
to nmap in browser.

It is possible to check the existence of firewalled URL U via
the following javascript in a browser:

Security updates have been issued by Debian (asterisk), Fedora (lldpd and openssh), Red Hat (curl, kernel, and openvswitch2.13), SUSE (compat-openssl098, glib2, grafana, helm, libgit2, openssl, and openssl-1_1), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.19, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, and vim).

COLORADO SPRINGS Axiom Space has introduced a new program to allow countries to create human spaceflight programs without needing to develop their own infrastructure or other capabilities.

The Axiom Space Access Program, announced April 17, offers countries a tiered approach to conducting research on the International Space Station or Axioms future commercial space station, as well as flying their own astronauts.

The program is effectively a space program in a box, said Tejpaul Bhatia, chief revenue officer at Axiom, in an interview during the 38^th Space Symposium. The real key is that turnkey access at affordable, sustainable and predictable rates.

The first 100 people to use code UNIVERSE at the link below will get 60% off of Incogni: https://incogni.com/universe.

Researched and Written by Colin Stuart.
Check out his superb Astrophysics for Beginners course here: https://www.colinstuart.net/astrophysics-course-for-beginneron-online/

Edited by Manuel Rubio.
Narrated and Script Edited by David Kelly.
Thumbnail art by Ettore Mazza, the GOAT: https://www.instagram.com/ettore.mazza/?hl=en.
Animations by Jero Squartini https://fiverr.com/freelancers/jerosq.
Stock footage taken from Videoblocks and Artgrid, music from Epidemic Sound, Artlist, Silver Maple and Yehezkel Raz.
Space imagery also used from NASA and ESO.

Specific image credits:
AT Service via Wikimedia for images of Kip Thorne and Bryce DeWitt.
Massachusetts Institute of Technology, via Wikimedia Commons for the image of Bruno Rossi.

00:00 Introduction.
06:00 The Block Universe.
16:25 Visiting The Future.
27:00 Visiting The Past.
37:59 Time Streams.

#wormhole #quantum

Contents

• GNU/Linux
  • Server
  • Kernel Space
  • Applications
  • Instructionals/Technical
  • Games
• Distributions and Operating Systems
  • Reviews
  • Fedora Family / IBM
  • Canonical/Ubuntu Family
  • Devices/Embedded
  • Open Hardware/Modding
  • Mobile Systems/Mobile Applications
• Free, Libre, and Open Source Software
  • Productivity Software/LibreOffice/Calligra
  • Programming/Development
    • Python
    • Shell/Bash/Zsh/Ksh
• Leftovers
  • Education
  • Hardware
  • Health/Nutrition/Agriculture
  • Proprietary
  • Security
    • Integrity/Availability/Authenticity
    • Privacy/Surveillance
  • Defence/Aggression
  • Transparency/Investigative Reporting
  • Environment
  • Wildlife/Nature
• Finance
• AstroTurf/Lobbying/Politics...

upstart writes:

New CFO sees interesting in-tray at 20 percent year-on-year growth database company:

Database vendor MariaDB has cut a number of jobs and reiterated a "going concern" warning over its medium-term financial viability.

In a statement to the stock market [PDF] late last month, the company, which floated on the New York Stock Exchange at the end of 2022, said it was reducing its headcount by 26 "to achieve cost reduction goals and to focus the Company on key initiatives and priorities."

In December, CEO Michael Howard told The Register the company was looking to hire more people following $104 million in funding and $18 million through private investment in public equity through the special purpose acquisition company that enabled the flotation.

Although the job losses may be a fraction of the reported 340 people the company employs, other details in the filing may highlight further cause for concern over its financial viability.

It includes a mention of MariaDB's February 10Q warning that the company's current cash and cash equivalents "would not be sufficient to fund our operations, including capital expenditure requirements for at least 12 months from... February 13, 2023, raising substantial doubt about our ability to continue as a going concern."

The March 24 statement said it anticipated that the money raised by database subscriptions and services would not be enough to meet its projected working capital and operating needs. "We are currently seeking additional capital to meet our projected working capital, operating, and debt repayment needs for periods after September 30, 2023 ... Going forward, we cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business," it says.

Read more of this story at SoylentNews.

Linux kernel developers are preparing for the first upgrade to its Rust toolchain since the Rust code initially merged in Linux 6.1...

How is this man even remotely compatible with the EFFs original mission? Sciencewash as a revenue model?

Fixing the net for prostitution:

Thanking Alfred Pritchard Sloan, Jr.:

Thanking Alfred Pritchard Sloan, Jr. yet again:

Summary: The EFF is becoming more about sex than about digital rights, based on yesterdays podcast (two blog posts about it, with the episodes distributed through centralised, proprietary platforms with DRM). Does the EFF really want to frame privacy activism as fighting for prostitutes (Safer Sex Work Makes a Safer Internet)? The people who took control of the EFF canceled a co-founder because of an alleged sex scandal (he wasnt the first) and the EFF now produces shows with prostitutes as experts in them. This helps stigmatise privacy advocates. The EFF has been in the red (losses), probably for the first time in its history, for several years now. When the original founder ran it they fought against power and raised money from members. Now its run by billionaires, gives awards to Microsofters, and gives a voice to people who promote prostitution. The above shows the EFF repeatedly thanking Alfred P. Sloan Foundation (Lets take a quick moment to say thank you to our sponsor. How to Fix the Internet is supported by The Alfred P. Sloan Foundation and then again towards the end; screenshots above). Does the EFF know or care that General Motors under Alfred P. Sloan helped the Nazis? This isnt the first example of EFF acting as a front for billionaires, or the powerful ins...

The upstream, open-source Nouveau DRM kernel driver working to make use of the NVIDIA GPU System Processor "GSP" will ideally lead to more punctual new hardware support, hopefully overcome the power management / re-clocking challenges that have plagued the driver for years with very low performance, and other current limitations. But it will also lead to more NVIDIA GPU firmware files in the linux-firmware tree and increased bloat...

The Pakistan-based advanced persistent threat (APT) actor known as Transparent Tribe used a two-factor authentication (2FA) tool used by Indian government agencies as a ruse to deliver a new Linux backdoor called Poseidon. "Poseidon is a second-stage payload malware associated with Transparent Tribe," Uptycs security researcher Tejaswini Sandapolla said in a technical report published this week.

Either the great copyright battle pitting the record industry against generative artificial intelligence has begun or someones clout-chasing AI headlines.

The generative AI music hype train only needed about 48 hours to go from oh, thats interesting to full Balenciaga pope territory, and while its clear someone is using the technology to run a scheme, were still not sure who it is.

Heres the short version:

---

Something doesnt make sense.

After four long decades of persistence, scientists have improved the resolution of the humble magnetic resonance imaging (MRI) scan.

Using the advanced MRI version, they created the most detailed image of a mouse brain, revealing microscopic details of the biological structure.

The new chip can wire together supercomputers for artificial intelligence networks.

American semiconductor manufacturing company Broadcom Inc. has released a new chip Jericho3-AI, which is being touted by the company as the highest-performance fabric for artificial intelligence (AI) networks. The new chip will wire together supercomputers.

---

G0d4ather/iStock.

Jericho3-AI is packed with features like improved load balancing which ensures maximum network utilization under the highest network loads, congestion-free operation which implies no flow collisions and no jitter, high radix which allows Jericho3-AI to connect to 32,000 GPUs collectively, and Zero-Impact Failover ensuring sub-10ns automatic path convergence. All of this would lead to cutting down on the job completion times for AI workload.

A fresh round of patches has been made available for the vm2 JavaScript library to address two critical flaws that could be exploited to break out of the sandbox protections.

Both the flaws CVE-202329199 and CVE-202330547 are rated 9.8 out of 10 on the CVSS scoring system and have been addressed in versions 3.9.16 and 3.9.17, respectively.

Successful exploitation of the bugs, which allow an attacker to raise an unsanitized host exception, could be weaponized to escape the sandbox and run arbitrary code in the host context.

Sam Altman says the research strategy that birthed ChatGPT is played out and future strides in artificial intelligence will require new ideas.

Google CEO Sundar Pichai said the companys experts call this aspect of AI a black box.

Despite the impressive recent progress in AI capabilities, there are reasons why AI may be incapable of possessing a full general intelligence. And although AI will continue to transform the workplace, some important jobs will remain outside the reach of AI. In other words, the Economic Singularity may not happen, and AGI may be impossible.

These are views defended by our guest in this episode, Kenneth Cukier, the Deputy Executive Editor of The Economist newspaper.

For the past decade, Kenn was the host of its weekly tech podcast Babbage. He is co-author of the 2013 book Big Data, a New York Times best-seller that has been translated into over 20 languages. He is a regular commentator in the media, and a popular keynote speaker, from TED to the World Economic Forum.

In a lot of ways, it seems like were in the plateau of productivity part of the hype cycle when it comes to drones. UAVs have pretty much been reduced to practice and have become mostly an off-the-shelf purchase these days, with a dwindling number of experimenters pushing the envelope with custom builds, like building drones out of dead birds.

These ornithopomorphic UAVs come to us from the New Mexico Insitute of Mining and Technology, where [Mostafa Hassanalian] runs the Autonomous Flight and Aquatic Systems lab. While looking into biomimetics, [Dr. Hassanalian] hit upon the idea of using taxidermy birds as an airframe for drones. He and his team essentially reverse-engineered the birds to figure out how much payload theyd be able to handle, and added back the necessary components to make them fly again.

From the brief video in the tweet embedded below, its clear that theyve come up with a huge variety of feathered drones. Some are clearly intended for testing the aerodynamics of taxidermy wings in makeshift wind tunnels, while others are designed to actually fly. Propulsion seems to run the gamut from bird-shaped RC airplanes with a propeller m...

Read the original post at: Read More 

The post DENT Network Operating System Collaborates with OCP to Integrate Switch Abstraction Interface (SAI) appeared first on Linux.com.

AMD has published AMDVLK 2023.Q2.1 as their first official open-source Vulkan driver update for the quarter that for Linux users serves as an alternative to the Mesa RADV driver or the code bundled up into their Radeon Software packaged driver...

Recent data breaches across CircleCI, LastPass, and Okta underscore a common theme: The enterprise SaaS stacks connected to these industry-leading apps can be at serious risk for compromise. CircleCI, for example, plays an integral, SaaS-to-SaaS role for SaaS app development. Similarly, tens of thousands of organizations rely on Okta and LastPass security roles for SaaS identity and access

While the Godot 4.0 open-source game engine only shipped at the start of March, there are already plans underway for some renderer upgrades that will be part of the upcoming Godot 4.1 engine upgrade...

As expected following the GCC 13 release branching this week, the first release candidate of what will be the premiere GCC 13.1 stable release is now available...

upstart writes:

SpaceX Starship launch countdown: all of the news on its first test flight:

Elon Musk's stated goal of putting humans on Mars relies heavily on the development of a next-generation reusable spacecraft, and Starship (formerly known as Big Falcon Rocket or BFR) is ready for its first orbital test flight. It's not the "six months" goal Musk projected in 2019, but after a number of suborbital tests that included some terrific successes and fantastic, fiery failures, the big day is finally almost here.

With just over five minutes to go before its first scheduled launch attempt Monday morning, SpaceX announced that due to a pressurization issue with the first stage, the attempt became a "wet dress rehearsal," and the countdown ended with 10 seconds to go. SpaceX now says it's targeting April 20th for another attempt, with a launch window between  8:28AM CT (9:28AM ET) and 9:30 AM CT (10:30AM ET).

If all goes according to plan, the Starship will fly to orbital velocity after separating from its Super Heavy booster rocket about three minutes into the trip, then splashdown in the Pacific Ocean near Hawaii.

The entire trip should take about 90 minutes to complete, and SpaceX is livestreaming the events on its YouTube channel.

Previously: SpaceX's First Orbital Test Flight of Starship Imminent [Scrubbed]

---

Original Submission

Read more of this story at SoylentNews.

The Hero C Compiler "HCC" wants to make it easy to compile C code to run on GPUs by compiling common C11 code and turning it into SPIR-V modules that can then be consumed by GPUs with Vulkan support...

There has been an exponential increase in the demand for electric vehicles, with hybrid and electric cars expected to account for a considerable portion of car sales in the near future. Designing efficient motors is critical for increasing range, reducing battery capacity requirements, and improving power density and costs.

Register now to attend this free webinar.

---

To accomplish such design, using multiphysics modeling and simulation is essential. COMSOL Multiphysics and the add-on AC/DC Module and Battery Design Module provide various features for modeling different types of electric motors and drivetrain components. The software has the capability to capture the multiple interacting physics involved in motors, such as electromagnetics, thermal effects, fluid mechanics, and structural mechanics. COMSOL Multiphysics also offers powerful optimization techniques that help to accelerate product development time.

We invite you to attend this webinar. You will learn more about these topics and see how COMSOL Multiphysics can be used in electric motor and drivetrain R&D.

An Iran-linked APT group tracked as Mint Sandstorm is behind a string of attacks aimed at US critical infrastructure between late 2021 to mid-2022.

Microsoft has linked the Iranian Mint Sandstorm APT (previously tracked by Microsoft as PHOSPHORUS) to a series of attacks aimed at US critical infrastructure between late 2021 to mid-2022.

The IT giant reported Mint Sandstorm is refining its tactics, techniques, and procedures (TTPs). The group rapidly weaponized N-day vulnerabilities in popular enterprise applications by using publicly disclosed POCs. Mint Sandstorm also used custom tools in selected targets, notably organizations in the energy and transportation sectors.

Mint Sandstorm targets both private and public organizations, including political dissidents, journalists, activists, the Defense Industrial Base (DIB), and employees from multiple government agencies, including individuals protesting oppressive regimes in the Middle East.  The activity associated with the Mint Sandstorm group overlaps with public reporting on groups known as APT35, APT42, Charming Kitten, and TA453.

Microsoft assesses that Mint Sandstorm is associated with an intelligence arm of Irans military, the Islamic Revolutionary Guard Corps (IRGC), an assessment that has been corroborated by multiple credible sources including Mandiant, Proofpoint, and SecureWorks. reads the report published by Microsoft. In 2022, the US Department of Treasury sanctioned elements of Mint Sandstorm for past cyberattacks citing sponsorship from the IRGC.

Microsoft states that from late 2021 to mid-2022, the Mint Sandstorm subgroup launched a series of attacks against US critical infrastructure, including seaports, energy companies, transit systems, and a major US utility and gas entity. The attacks were conducted as a retal...

Posted by Jacques Le Roux on Apr 19

Hi Seth,

As I guess you know, the ASF has many (350+) projects: https://projects.apache.org/
OFBiz is only one of these projects. An "old" one, IIRW it was the 26th to get in.

I say that because we have our own security team.
Yet, all projects are overseen and especially helped by the ASF security team for security matter.
In other words we (projects) all share the experience and expertise of the ASF security team.

So I must add that...

Posted by nightmare . yeah27 on Apr 19

Another (simpler?) way is to fork before giving up privilege.

Posted by Vellore Rajakumar, Sri Saran Balaji on Apr 19

Hello Kubernetes Community,

We have released minikube v1.30.0<https://github.com/kubernetes/minikube/releases/tag/v1.30.0> to address two security
issues in minikube. We recommend all to upgrade minikube to the created with an affected version. Minikube is a utility tool that sets up a Kubernetes environment on a local machine
for developing and testing Kubernetes applications. Minikube...

Posted by peacewong on Apr 19

Hi Seth Arnold,
Thank you for your reply, I will modify the content according to the
process

Best Regards,
Peace Wong

Seth Arnold 2023418 09:27

Also available via the Gemini protocol at:

• gemini://gemini.techrights.org/irc-gmi/irc-log-techrights-180423.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-180423.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-social-180423.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-techbytes-180423.gmi

Over HTTP:

#techrights log as HTML5	#boycottnovell log as HTML5
#boycottnovell-social log as HTML5	#techbytes log as HTML5
#techrights log as text	...

U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against targets. The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims. The

Looking at configuration data, 56% of decommissioned routers disposed of and sold on the secondary market contained sensitive corporate data, according to ESET. Of the networks that had complete configuration data available: 22% contained customer data 33% exposed data allowing third-party connections to the network 44% had credentials for connecting to other networks as a trusted party 89% itemized connection details for specific applications 89% contained router-to-router authentication keys 100% contained one or more of More

The post Researchers discover sensitive corporate data on decommissioned routers appeared first on Help Net Security.

Twitter, like many social networks, used to feature a useful API. This let people do fun things like create toasters that could automatically post breaderly updates, or even load Twitter posts on machines that couldnt handle full-fat websites. That API is now history, but [NEKOPLA] used it for a cute Game Boy-like Twitter device in its dying days earlier this year.

...

upstart writes:

mjg59 | PSA: upgrade your LUKS key derivation function:

Many Linux users rely on LUKS for their disk encryption but perhaps they need to pay a bit more attention to it. If the disk was encrypted more than a few years ago (LUKS Version 1) it appears that it might not be secure enough to withstand a concerted attack. It is time to check whether you are using Version 2, and if not the fix takes a few minutes. [JR]

Here's an article from a French anarchist describing how his (encrypted) laptop was seized after he was arrested, and material from the encrypted partition has since been entered as evidence against him. His encryption password was supposedly greater than 20 characters and included a mixture of cases, numbers, and punctuation, so in the absence of any sort of opsec failures this implies that even relatively complex passwords can now be brute forced, and we should be transitioning to even more secure passphrases.

Or does it? Let's go into what LUKS is doing in the first place. The actual data is typically encrypted with AES, an extremely popular and well-tested encryption algorithm. AES has no known major weaknesses and is not considered to be practically brute-forceable - at least, assuming you have a random key. Unfortunately it's not really practical to ask a user to type in 128 bits of binary every time they want to unlock their drive, so another approach has to be taken.

This is handled using something called a "key derivation function", or KDF. A KDF is a function that takes some input (in this case the user's password) and generates a key. As an extremely simple example, think of MD5 - it takes an input and generates a 128-bit output, so we could simply MD5 the user's password and use the output as an AES key. While this could technically be considered a KDF, it would be an extremely bad one! MD5s can be calculated extremely quickly, so someone attempting to brute-force a disk encryption key could simply generate the MD5 of every plausible password (probably on a lot of machines in parallel, likely using GPUs) and test each of them to see whether it decrypts the drive.

Read more of this story at SoylentNews.

While some anti-piracy groups focus on taking content down, others prefer to take entire sites down.

The benefits of the latter approach are obvious; when a site no longer exists, the need to send future takedown notices is eliminated. Its also much more easily said than done but certainly not impossible.

The Alliance for Creativity and Entertainment has taken down hundreds of sites, and its often possible to predict which sites are about to feel the heat. DMCA subpoenas obtained at courts in the United States compel intermediaries to hand over details of pirate site operators, and since the applications are public, the names of sites are public too.

A series of recent applications revealed ACE attempting to gain information on The Pirate Bays operators but other sites were mentioned too. Despite having millions of monthly visitors, two of them have just disappeared into thin air.

Bulgarian Exodus

Over the past several days, at least four pirate sites with a focus on Bulgaria disappeared without warning. According to SimilarWeb data, Filmisub.com was the largest with around 7.8 million visits per month.

Filmisub specialized in streaming movies and TV shows. From its apparently large selection, ACE/MPA complained about just one (Shaft) but that was enough to get Cloudflare to hand over the operators details. Of the four sites confirmed to have gone offline, Filmisub is the only one to have left any kind of message.

The site is permanently closed. It will never work again in any form whatsoever, it announced before disappearing offline.

...

This is a snapshot of the antique world that we all came from in which Big Man rules made things up as they went along.  This is deeply supressed in the developed world, but is still out there wherever muscle can be used to force folks to cooperate.

...

...

Posted by Kyle Zeng on Apr 18

Hi there,

We recently found a slab OOB access bug in the Linux kernel's XFS
subsystem. It can cause denial-of-service and potentially privilege
escalation.

The root cause of the bug is a missing metadata validation when
mounting a user-supplied XFS disk image. More specifically, in a
corner case where there is a dirty log with a buffer log item for an
AGF and the on-disk buffer appears to be newer, XFS will discard the
old dirty log and...

An Iranian government-backed actor known as Mint Sandstorm has been linked to attacks aimed at critical infrastructure in the U.S. between late 2021 to mid-2022. "This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align

Video download link

Summary: The above LibrePlanet talk was uploaded by the FSF 12 hours ago (slides here)

Licence: GFDL 1.3

Straw man arguments can undermine democracy, too

Murdoch (right) with President John F. Kennedy and Zell Rabin in the Oval Office in 1961

Summary: Straw man arguments for voting machines or against critics of these will become ubiquitous in days to come; its important to distinguish between the disinformation from Rupert Murdochs media apparatus and the actual science (many distinguished scientists have long warned against voting machines, more so proprietary ones)

So, as noted in Daily Links (much more on this later), Dominion won a case against a very soft target (Rupert Murdoch, serial fabricator), but voting machines must still be avoided, criticised, and generally protested against. Pseudo-liberal media will be missing the point, as usual, instead stigmatising critics and sceptics of voting machines as "Nazis".

We are seeing many cautionary tales right now in Russia and in China.We kindly ask people not to fall for it. There are many perfectly legitimise reasons to avoid voting machines. When I vote here a few days from now itll involve only paper, a pencil, and a physical box with a hole in it. That works. No reason/s to give a large contract to some tech company. Many other things in modern society are being turned into a computer for no good, pragmatic/practical reasons. They use buzzwords like digitalisation, but the agenda is multi-faceted and potentially very dangerous. It gives very few people far too much control (top-down control by centralisation and consolidation of authority). Thats potentially devastating to democracy. We are seeing many cautionary tales right now in Russia and in China.

Citizen Lab reported that Israeli surveillance firm NSO Group used at least three iOS zero-click exploits in 2022.

A new report from Citizen Lab states that the Israeli surveillance firm NSO Group used at least three zero-click zero-day exploits to deliver its Pegasus spyware.

In 2022, the Citizen Lab analyzed the NSO Group activity after finding evidence of attacks on members of Mexicos civil society, including two human rights defenders from Centro PRODH, which represents victims of military abuses in Mexico.

The researchers discovered that in 2022, NSO Group customers used at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets worldwide.

One of the iOS zero-click used in 2022, called by Citizen Lab PWNYOURHOME, was used against iPhones running iOS 15 and iOS 16 starting in October 2022. The researchers believe PWNYOURHOME is a novel two-step zero-click exploit. The first step targets the HomeKit process, while the second step targets iMessage.

Another zero-click exploit dubbed FINDMYPWN was used by the surveillance firm against iOS 15 since June 2022. FINDMYPWN is a two-step exploit that targets the iPhones Find My feature and the step targets iMessage.

Another two-step exploit, which targets the Find My feature and iMessage, has been dubbed FindMyPwn. This zero-click exploit has been used against iPhones running iOS 15 since at least June 2022. 

The third zero-click exploit discovered by Citizen Lab is LATENTIMAGE, it was found on a single targets phone and experts believe it was the first new exploit used by NSO Group in 2022.

Further analysis yielded additional indicators, which were then applied to analyze additional devices in the global pool of 2022 Pegasus victims to uncover more details about NSO Groups 2022 exploits. reads the report. These indicator overlaps allow us to attribute the 2022 zero-click chains to NSO Groups Pegasus spyware with high confidence. Overall, we believe NSO Group deployed at least three zero-click chains in 2022 (Figure 2), exploiting a variety of apps and features on the iPhone. We have observed cases of some of the chains deployed as zero-days against iOS versions 15.5 and 15.6 (FINDMYPWN), and 16.0.3 (PWNYOURHOME).

The 20th century saw everything from telephones to computers become mainstream. Many of these devices were beautifully designed in the mid-century period, something thats hard to say about a lot of todays cheaper technology. [John Graham-Cumming] has shown us one exquisite example, with his teardown of a simple Czech telephone.

...

Video download link

Summary: The above LibrePlanet talk is a physical presence/panel talk^* about [f]inding a job while caring about free software; it was uploaded by the FSF^** 8 hours ago; From the official page: A panel of people who care about software freedom, and have have somewhat recently gone through a job search. They will discuss and share their experience, offer some advice, and involve the audience. There is a vast array of ways to advance free software while looking after your finances, but in this talk, our focus will be on finding employment doing technical work and issues encountered there. For example: How much conflict with free software values do you accept in a company and for what price? What about ethical differences between your individual work vs the employers overall business model?

Licence: CC BY SA 4.0
________
^* framatube.org (PeerTube platform for FSF) has this channel too, in case MediaGoblin is down. The FSF seriously under-provisioned MediaGoblin for these new videos. Now the site goes up and down (mostly down) and it makes MediaGoblin look bad.

^** Talk by Ian Kelling, Rubn Rodrguez Prez, and Amin Bandali.

As cyberattacks increase in frequency and sophistication, small and medium-sized businesses (SMBs) become more vulnerable to cyber threats. Unlike larger enterprises, SMBs often lack the financial and technical resources to secure their networks and data against malicious actors effectively. With limited budgets and IT staff, many small companies are forced to make difficult decisions about where to allocate their resources. Fortunately, several free online cybersecurity resources can help small businesses protect themselves from cyber attacks. More

The post 5 free online cybersecurity resources for small businesses appeared first on Help Net Security.