By Cyberpress

Dubai / May 1st 2023 / Cyberpress Cybersecurity gets a new dedicated newswire. Cyberpress, a press release

This is a post from HackRead.com Read the original post: Cyberpress Launches Cybersecurity Press Release Distribution Platform

Via: AFP: Shares of PacWest Bancorp were in free fall Thursday after the banks attempt to reassure investors fell flat amid another pummeling of US regional bank stocks. Near 1600 GMT, shares of PacWest were down more than 50 percent. Other leading banks were also on the back foot, including Western Alliance (-43 percent), Zions []

Although generally hydrogen is only mentioned within the context of transportation and energy storage, by far the most useful applications are found in industrial applications, including for the chemical industry, the manufacturing of steel, as well as that of methanol and fertilizer. This is illustrated by how today most of all hydrogen produced today is used for these industrial applications, as well as for applications such as cooling turbo generators, with demand for hydrogen in these applications rapidly increasing.

Currently virtually all hydrogen produced today comes from natural gas, via steam methane reformation (SMR), with potentially methane pyrolysis making natural gas-derived hydrogen a low-carbon source. The remainder of hydrogen comes from coal gasification and a small fraction from electrolysis of water. The hydrogen is often produced on-site, especially at industrial plants and thermal power plants. So aside from any decarbonization efforts, ther...

After protest, disappointment, hand-wringing, and at times, sheer frustration, the European Commission has officially unveiled its full recommendation for combating piracy of live sports and musical events.

The Recommendation

The European Commission begins with a broad overview of the value of live events and the problems faced by rightsholders when tackling pirate IPTV and similar unlicensed streaming services.

From a reference perspective, particularly related to specific challenges and various aspects of relevant law, the ECs recommendation provides a great overview that makes for interesting reading. If explaining the illegal streaming problem had been the main aim, the document would receive solid marks. As a road map for solving tough issues in a short time frame, not so much.

Right from the very beginning its extremely clear that the EC understands almost every aspect of the challenges faced by rightsholders. Unfortunately, the vast majority of the report is dedicated to coverage of those challenges, for consumption by the very entities that supplied the information to the EC in the first place. Some of the key points in the initial overview can be summarized as follows:

Unauthorized supply, technical challenges

Main value in live sports broadcasts lies in the exploitation of live transmission
Illegal retransmissions can cause significant losses to rightsholders/broadcasters
Increasingly sophisticated means make content available via IPTV/apps/websites
Streaming piracy is a global phenomenon, increasingly reliant on offshore hosting
Offshore hosting minimizes pirates exposure to copyright or criminal law in the EU
Piracy-as-a-Service makes it easy to create pirate sites and start generate revenue
Some infringing services mirror legitimate streaming services
CDNs/reverse proxies often misused to obfuscate sources of pirate streams

These issues are common knowledge and the subject of countless reports, mostly published by rightsholders; the presence of the terms offshore hosting and Piracy-as-a-Service are evidence of that...

By Dominik Butzmann / re:publica re:publica faces 2019, CC BY-SA 2.0.

Summary: Cory Doctorow and Joe Mullin (EFF) wrote about software patents this week; this shows that the EFF can still pivot in the right direction if it really wants to

As it turns out, Joe Mullin is fortunately still around (at the EFF, he used to be in the media) and the other day he cautioned the U.S. Solicitor General Trying To Change The Law To Benefit Patent Trolls. His EFF colleague, Mr. Doctorow, said at almost the same time: In theory, patents are for novel, useful inventions that arent obvious to a skilled practitioner of the art. But as computers ate our society, grifters began to receive patents for doing something weve done for centurieswith a computer. With a computer: those three words had the power to cloud patent examiners minds.

He then changed the subject from software patents to patent trolls (the EFF habitually changes the subject to bad patents or trolls). To quote: Patent trolls who secure with a computer patents and then extract ransoms from people doing normal things on threat of a lawsuit are an underappreciated form of tech exceptionalism. Normally, tech exceptionalism refers to bros who wave away things like privacy invasions by arguing that with a computer makes it all different.

Quoting Mr. Mullin, regarding the U.S. Patent and Trademark Office (USPTO) and 35 U.S.C. 101: Government officials should be working to reduce, not increase, the burden that low-quality patent lawsuits impose on innovators. So were concerned and dismayed by recent briefs filed by the U.S. Solicitor General, asking the Supreme Court to reexamine and throw out the best legal defenses regular people have against patent trollscompanies that dont make products or provide services, but simply use patents to sue and th...

Summary: Techrights recommends caution against tech maximalism; not everything that can be done with/on a computer should, in practice, be done that way; a careful balance is needed, taking stock of pros and cons

TODAY in IRC we had a lengthy discussion about the downside of supposedly modern or smart cars^*. Itll be in the IRC logs tomorrow. Its very informal. Its going way beyond aspects like cost and privacy those two are commonly discussed these days. We did a series about it over a year ago.

People are simply asked to buy the latest no matter what Trojan horses are included (mandated) in these.What compels people to blindly assume that newer is always better when its perfectly clear that users arent in control and products are tailored (over time) to better suit the manufacturers, the stores etc.? People are simply asked to buy the latest no matter what Trojan horses are included (mandated) in these.

This subject keeps coming back. People who drive need to buy cars (occasionally) and there are many things they see which they strongly dislike.

The one [new article] about cars can be motivation for revisiting cars/embedded systems and software freedom, one person told us this week, suggesting it as a topic and stating that the focus was in-house expertise vs outsourcing, in cars.

To quote the portion weve already included in Daily Links:

I would argue relying too much on external software vendors and not seeing software as a first-class citizen is the root cause. But Volvo Cars is wisely moving away from that model by bringing software developers in-house. Google and Apple partner with vendors for commodities. Software and data just happen to be too key to treat it that way. As I argued in a previous post, the automotive industry needs to own their data and set up to make it to the mobility-driven phase.

Having someone from software-...

Fedora is looking for a few good testers.

The post A Fedora Test Week Starts Sunday. Want to Help? Heres How appeared first on FOSS Force.

There are a lot of things you can do with todays powerful microcontrollers, but sometimes you really need a full embedded Linux setup. [Dylan Brophy] wanted to make it easier to add Linux to his own projects and designed the BeagleStamp.

...

upstart writes:

Netflix Loses A Million Subscribers In Spain After Greedy Password Sharing Crackdown:

We've noted repeatedly how Netflix's password sharing crackdown is a stupid cash grab that alienates and annoys loyal customers, duplicates existing efforts to restrict "freeloaders," won't give the company the financial windfall it thinks, and just generally represents how the company has inevitably shifted from innovative disruptor to the kind of tone deaf cable giants it used to criticize.

The plan basically involves charging users an extra $2-$3 a month if it's found that someone is using your account outside of your home. The problem: Netflix has already been imposing blanket price hikes, and it already limits the number of simultaneously streams per account, forcing users to subscribe to more expensive tiers if they want to expand the limit.

While the crackdown isn't expected to hit U.S. subscribers until the end of the second quarter (aka soon), the effort has generally been a hot mess in the smaller countries Netflix first used as guinea pigs to test both the underlying tech and company messaging.

The company had to suspend the efforts in countries like Argentina, El Salvador, Guatemala, Honduras, and the Dominican Republic, after users were equal parts befuddled and annoyed. And in Spain, estimates are that the company saw a defection of more than one million subscribers largely due to the higher, unnecessary fees:

"There are of course inherent risks with clamping down on password sharing, particularly when back in 2017 Netflix was seen to be actively encouraging it. Some users were expected to be lost in the process but losing over 1 million users in a little over a month has major implications for Netflix and whether it decides to continue with its crackdown globally.

Interestingly, there is no strong demographic skew to those who cancelled, signaling a more outright rejection of the password sharing clampdo...

VulnCheck researchers devised a new exploit for a recently disclosed critical flaw in PaperCut servers that bypasses all current detections.

Cybersecurity researchers from VulnCheck have developed a new exploit for the recently disclosed critical flaw in PaperCut servers, tracked as CVE-2023-27350 (CVSS score: 9.8), that bypasses all current detections.

The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.

On April 19th, Print management software provider PaperCut confirmed that it is aware of the active exploitation of the CVE-2023-27350 vulnerability.

The company received two vulnerability reports from the cybersecurity firm Trend Micro for high/critical severity security issues in PaperCut MF/NG. 

Trend Micro announced they will disclose further information (TBD) about the vulnerability on 10th May 2023.

The company addressed both vulnerabilities with the release of PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11 and 22.0.9 and later, it highly recommends upgrading to one of these versions containing the fix.

Huntress researchers have observed post-exploitation activities within its partner environments after attackers exploited the above PaperCut MF/NG vulnerabilities.

Huntress security researcher Caleb Stewart also devised a proof-of-concept exploit for these threats, below is the video PoC shared by the company:

From our recreated proof-of-concept, we observed child processes spawned underneath the pc-app.exe process. The screenshot below sho...

Businesses should patch their TP-Link routers as soon as possible, after the revelation that a legendary IoT botnet is targeting them for recruitment. Read more in my article on the Tripwire State of Security blog.

Dont believe the hype (a shameless lying blitz)

Summary: The father of Bing left Microsoft, many Bing employees were laid off earlier this year, and the remaining ones relocated out of their office in Bellevue; the media is meanwhile hyping up the Bing brand (we saw new examples this morning) and pretending that Google is doomed; the data does not support this phony narrative (its more or less the same in other regions around the world; overall, worldwide, Bing market share is measured at about 2.5%)

Facebook discovered a new information-stealing malware, dubbed NodeStealer, that is being distributed on Meta.

NodeStealer is a new information-stealing malware distributed on Meta that allows stealing browser cookies to hijack accounts on multiple platforms, including Facebook, Gmail, and Outlook.

The malware was first spotted in late January 2023 while targeting the browsers of Windows systems. It can target multiple web browsers, including Google Chrome, Microsoft Edge, Brave, and Opera.

The researchers explained that NodeStealer is a custom Javascript malware that bundles the Node.js environment. The author uses Node.js to allow malware execution on multiple OS, including Windows, Linux, and macOS.

The info stealer is believed to have a Vietnamese origin and was allegedly distributed by threat actors from Vietnam. 

The social network giant took action to disrupt the malware campaign and support victims in recovering their accounts.

The malware is disguised as PDF and XLSX files and their filename was chosen to trick victims into opening them starting the infection process.

As part of this effort, we submitted takedown requests to third-party registrars, hosting providers, and application services such as Namecheap, which were targeted by these threat actors to facilitate distribution and malicious operations. reads the post published by Facebook. These actions led to a successful disruption of the malware. We have not observed any new samples of malware in the NodeStealer family since February 27 of this year and continue monitoring for any potential future activity.

The good news is that Facebook discovered the threat within two weeks of it being distributed

At the time of its discovery, the malicious code had a single detection on the VirusTotal platform.

One of the samples analyzed by the company was a Windows executable file disguised as a PDF file with a PDF icon. The threat actors changed the metadata in an attempt to disguise the file as a MicrosoftOffice product.

This sample is written in Javascript, executed using Node.js, and compiled into a Windows executable using a tool from the Node Package Manager (NPM) called pkg. This sample is around 46 MB in size, but experts discovered files with a size between 46 and 51 MB.

NodeStealer maintains persistence using the auto-launch module on Node.js.

The Chrome browser encrypts the users information before storing it, the encrypted_key is stored in the Local State file and Base64 en...

The 2018 Linux Storage, Filesystem, and Memory-Management (LSFMM) conference included a session on get_user_pages(), an internal kernel interface that can, in some situations, be used in ways that will lead to data corruption or kernel crashes. As the 2023 LSFMM+BPF event approaches, this problem remains unsolved and is still the topic of ongoing discussion. This patch series from Lorenzo Stoakes, which is another attempt at a partial solution, is the latest focus point.

In terms of human features that robots are probably the most jealous of, fingers have to be right up there with eyeballs and brains. Our fleshy little digits have a crazy amount of dexterity relative to their size, and so many sensors packed into them that allow you to manipulate complex objects sight unseen. Obviously, these are capabilities that would be really nice to have in a robot , especially if we want them to be useful outside of factories and warehouses.

There are two parts to this problem: The first is having fingers that can perform like human fingers (or as close to human fingers as is reasonable to expect); the second is having the intelligence necessary to do something useful with those fingers.

Once we also add visual feedback into the mix along with touch, we hope to be able to achieve even more dexterity, and one day start approaching the replication of the human hand.
Matei Ciocarlie, Columbia:

In a paper just accepted to the Robotics: Science and Systems 2023 conference, researchers from Columbia University have shown how to train robotic fingers to perform dexterous in-hand manipulation of complex objects without dropping them. Whats more, the manipulation is done entirely by touchno vision required.

Robotic fingers manipulate random objectsa level of dexterity humans master by the time theyre toddlers.Columbia University

Those slightly chonky fingers have a lot going on inside of them to help make this kind of manipulation possible. Underneath the skin of each finger is a flexible reflective membrane, and under that membrane is an array of LEDs along with an array of photodiodes. Each LED is cycled on and off for a fraction of a millisecond, and the photodiodes record how the light from each LED reflects off of the inner membrane of the finger. The pattern of that reflection changes when the membrane flexes, which is what happens if the finger is contacting something. A trained model can correlate that light pattern with the location and ampl...

Summary: OpenSource.com and enterprisersproject.com scaled down their activity around the time Red Hats CEO announced that 700+ workers would be made redundant; are writers among the casualties of these cuts?

T HIS is a subject we deem especially and exceptionally sensitive because many good people lost their jobs at Red Hat. Some were technical, some were less technical. We know some names, but this post will name nobody.

My wife and I have been reading OpenSource.com every day for about a decade, so these trends are easy to spot or feel (even the mere absence of something gets noticed).Last year we took note of neglect in OpenSource.com (a Red Hat site for well over a decade already) and weeks later the site picked up pace again, publishing 2-3 new articles per day, except weekends (sometimes on weekends too they published new material). Unlike months prior, they didnt post obnoxious stuff; they had actually published some tasteless things last year.

My wife and I have been reading OpenSource.com every day for about a decade, so these trends are easy to spot or feel (even the mere absence of something gets noticed). The sites editors changed a few times over the years (we wont name them; we want to keep this impersonal).

The Linux Foundation has been very quiet this year and it is intentional; they try to keep a low profile for a reason.So what exactly is going on? Let us know. Were generally thankful for what the site offered since its birth and it would be a shame if it became something like Linux.com in affect killed by the Linux Foundation when it fired all the staff writers and all the editors without prior notice or an explanation. Revenue was growing fast back then, unlike...

Criminal IP, an OSINT-based search engine provided by AI Spera, launched a new WordPress plugin called Anti-Brute Force, Login Fraud Detector, also known as Criminal IP FDS (Fraud Detection System). This latest development promises to revolutionize the digital security landscape by providing a comprehensive solution to detect and prevent fraudulent login attempts on WordPress websites. Criminal IP, a Cyber Threat Intelligence (CTI) search engine, has recently launched a powerful WordPress security plugin called Anti-Brute Force, More

The post AI Spera launches Criminal IP FDS plugin to prevent fraudulent login attempts on WordPress appeared first on Help Net Security.

Recently I noticed out-of-the-box on Ubuntu Linux the performance of Intel Xeon Scalable "Sapphire Rapids" processors was much improved for some workloads compared to tests done just weeks ago on the same Sapphire Rapids server. It ended up being an issue coming full-circle and ultimately boils down to one line of code added within the Linux kernel.

After Richard Branson delivered some inspiring words from his seat aboard SpaceShipTwo Unity, he unbuckled himself and started to float around the vehicles cabin along with three other Virgin Galactic employees. Reaching an apogee of 86 kilometers (53 miles), the passengers enjoyed four minutes of weightlessness during the July 2021 flight that was live-streamed over the Internet to an audience of millions. After years of delays, SpaceShipTwo had finally demonstrated it was capable of taking paying customers to the edge of space. As far as victories go it was pretty impressive.

Yet despite the spectacle, weeks and months went by without an announcement about when commercial flights of the worlds first spaceline would finally begin. Now, nearly two years after Bransons flight, Unity has flown again. Except instead of carrying the first group of customers, it performed the sort of un-powered test flight that Virgin Galactic hasnt performed since 2017. Clearly, something didnt go to plan back then.

...

HUB Security entered into an agreement for up to $16 million in gross proceeds from Lind Global Asset Management VI LLC, an investment entity managed by The Lind Partners, a New York based institutional fund manager (together, Lind). This investment is expected to provide HUB Security with additional resources to fuel its rapid growth and development, enhance its financial stability, and enable the Company to pursue its future plans. The additional funding from The Lind More

The post HUB Security raises up to $16 million to fuel technology development appeared first on Help Net Security.

The Red Hat Developer site has an overview of some of the new C-language features supported by the GCC 13 release.

The nullptr constant first appeared in C++11, described in proposal N2431 from 2007. Its purpose was to alleviate the problems with the definition of NULL, which can be defined in a variety of ways: (void *)0 (a pointer constant), 0 (an integer), and so on. This posed problems for overload resolution, generic programming, etc. While C doesnt have function overloading, the protean definition of NULL still causes headaches.

Security updates have been issued by Fedora (python-sentry-sdk) and Ubuntu (python-django and ruby2.3, ruby2.5, ruby2.7).

Airgap Networks announced that it is bringing the power of AI to its Zero Trust Firewall with ThreatGPT. Built on an advanced AI/ML model designed to protect enterprises from evolving cyber threats, ThreatGPT delivers a new level of insight and productivity for network security teams. Perimeter firewalls struggle with todays combination of a complex, dynamic endpoint architecture and the real-world pervasiveness of legacy systems and headless devices. Airgap ZTFW complements existing perimeter firewall infrastructure by More

The post Airgap Networks enhances its Zero Trust Firewall with ThreatGPT appeared first on Help Net Security.

The City of Dallas, Texas, has suffered a ransomware attack that resulted in disruption of several of its services. What do we know so far? Wednesday morning, the Citys security monitoring tools notified our Security Operations Center (SOC) that a likely ransomware attack had been launched within our environment, the Citys public statement revealed. Subsequently, the City has confirmed that a number of servers have been compromised with ransomware, impacting several functional areas, including the More

The post City of Dallas hit by ransomware appeared first on Help Net Security.

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services. This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic. "

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections. Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. While the flaw was patched by the

AppOmni announced free Salesforce Community Cloud Scanner to help organizations secure their Salesforce Community websites from data exposure risks and misconfigurations. Salesforce data leaks recently identified by Krebs on Security have resulted in exposure of numerous Salesforce Community Cloud customers sensitive data. These data leaks occur when Salesforce customers access control permissions are misconfigured. The Salesforce misconfigurations, along with others previously discovered by AppOmnis Principal SaaS Security Engineer Aaron Costello, are frequent targets for threat More

The post AppOmni releases Salesforce Community Cloud Scanner appeared first on Help Net Security.

It's been just under two years since Amazon's Lumberyard game engine was spun into the Open 3D Engine and the Open 3D Foundation established under the Linux Foundation. Today the project is celebrating its newest open-source game engine update with Open 3D Engine 23.05...

SpaceX Completes First Fully Expendable Falcon Heavy Mission

SpaceX Completes First Fully Expendable Falcon Heavy Mission:

The triple-core rocket blasted off on Sunday evening to deliver three satellites to a high Earth orbit.

SpaceX's giant Falcon Heavy rocket successfully delivered three satellites to high Earth orbit on April 30. The launch marked the first time that none of the rocket's boosters were recovered.

Wild SpaceX Video Shows Hottest Reentry Yet of Reusable Rocket Fairing

upstart writes:

Wild SpaceX Video Shows Hottest Reentry Yet of Reusable Rocket Fairing:

The dramatic footage shows a Falcon Heavy fairing blazing through the atmosphere at speeds reaching Mach 15.

The most recent flight of SpaceX's Falcon Heavy was historic in that it was the rocket's first fully expendable mission, and it was also the first Falcon Heavy mission to include previously flown fairings. As new footage attests, the fiery return of these fairings was a sight to behold.

After several delays, the Falcon Heavy blasted off from Launch Complex 39A at NASA's Kennedy Space Center in Florida on Sunday, April 30 at 8:26 p.m. ET. The triple-core rocket successfully deployed its primary payload, the broadband ViaSat-3 Americas satellite, and two smaller satellites to geosynchronous Earth orbit (GEO).

Key to SpaceX's ongoing success is its devotion to reusabilityit's a lot cheaper to recover your engines and reuse them than to produce new ones for every launch. For this mission, however, none of the rocket's three booster stages could be recovered, as they expelled all their fuel in the effort to get the payloads to GEO. That said, SpaceX did make the attempt to recover the rocket's fairings, so in that sense it wasn't a fully expendable mission.

Read more of this story at SoylentNews.

X.Org members have approved of the X.Org Foundation letting the Software Freedom Conservancy (SFC) become its fiscal sponsor...

Arthur introduced a powerful addition to its suite of AI monitoring tools: Arthur Shield, a firewall for large language models (LLMs). This patented new technology enables companies to deploy LLM applications like ChatGPT more safely within an organization, helping to identify and resolve issues before they become costly business problems or worse, result in harm to their customers. Recent advancements in large language models from OpenAI, Google, Meta, and others have spurred a rush More

The post Arthur Shield tackles safety and performance issues in large language models appeared first on Help Net Security.

IT and cybersecurity teams are so inundated with security notifications and alerts within their own systems, its difficult to monitor external malicious environments which only makes them that much more threatening.  In March, a high-profile data breach hit national headlines when personally identifiable information connected to hundreds of lawmakers and staff was leaked on the dark web. The

Music fans love to share mixtapes and have done so for decades but sharing these tapes over the Internet is not without risk.

Popular hip-hop mixtape site and app Spinrilla has millions of users and is well aware of the pitfalls. In 2017, the company was sued by several RIAA-backed labels, including Sony, Warner, and UMG, which accused the company of massive copyright infringement.

Spinrilla specializes in ripping off music creators by offering thousands of unlicensed sound recordings for free, the RIAA commented at the time.

Spinrilla Fought Piracy Accusations

The hip-hop site countered the allegations by pointing out its RIAA-approved anti-piracy filter and highlighting how it actively worked with major record labels to promote their tracks. In addition, Spinrilla stressed that the DMCAs safe harbor protects the company from liability.

As the case progressed both parties filed motions for summary judgment. The music companies requested rulings to establish that Spinrilla is liable for direct copyright infringement and that the DMCA safe harbor doesnt apply. Spinrilla countered with cross-motions, filed under seal, in which they argued the opposite.

Court: Spinrilla is Liable

In December 2020, US District Court Judge Amy Totenberg ruled that Spinrilla is indeed liable for direct copyright infringement. In her ruling, Judge Totenberg concluded that 4,082 copyrighted sound recordings were streamed at least once through Sprinrillas website or app.

Without the DMCAs safe harbor protection, Spinrilla faced a severe disadvantage in the event the case went to trial. With 4,082 copyrights at stake, potential damages would exceed $600 million if the jury found that the infringements were willful.

In recent weeks it looked like both parties were gearing up for a trial but, at the last minute, Spinrilla accepted a settlement and voluntarily submitted an offer of judgment to the court.

$50 Million + Shutdown

Spinrilla doesnt go li...

When youve got a piece of interesting old aviation hardware on your desk, what do you do with it? If youre not willing to relegate it to paperweight status, your only real choice is to tear it down to see what makes it tick. And if youre lucky, youll be able to put it to work based on what you learned.

Thats what happened when [Glen Akins] came across a tachometer for a jet airplane, which he promptly turned into a unique CPU utilization gauge for his computer. Much of the write-up is concerned with probing the instruments innards to learn its secrets, although it was clear from the outset that his tachometer, from Kollsman Instruments, was electrically driven. [Glen]s investigation revealed a 3-phase synchronous motor inside the tach. The motor drives a permanent magnet, which spins inside a copper cup attached to the needle on the tachs face. Eddy currents induced in the cup by the spinning magnet create a torque that turns the needle against the force of a hairspring. Pretty simple but how to put the instrument to work?

[Glen]s solution was to build what amounts to a variable frequency drive (VFD). His power supply is based on techniques he used to explore aircraft synchros, which...

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks. "Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet," Guy Rosen, chief information

CERT-UA is warning of destructive cyberattacks conducted by the Russia-linked Sandworm APT group against the Ukraine public sector.

Russia-linked APT group Sandworm is behind destructive cyberattacks against Ukrainian state networks, the Ukrainian Government Computer Emergency Response Team (CERT-UA) warns.

The Sandworm group (aka BlackEnergy, UAC-0082, Iron Viking, Voodoo Bear, and TeleBots) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRUs Main Center for Special Technologies (GTsST).

The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017. In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe. 

The threat actors allegedly obtained access to Ukraines public networks by using compromised VPN credentials.

CERT-UA started investigating the attack after it received information about an attack against an ICS system of one of the state organizations of Ukraine.

The attackers used a BAT script dubbed RoarBat that recursively searches for files with specific...

Posted by Reid Sutherland on May 04

Moritz Bechler wrote:

Performing outside queries is not a reasonable default in terms of
security. It's up to the developer if they wish to open up the user to
that risk. Libraries cannot shift defaults on a whim, this is why they
have documentation.

Posted by Johannes Segitz on May 04

Hi,

first of all let me take the opportunity to thank you for your work in this
area. I'm not a member of the distros list anymore (have been for years),
but I appreciate very much what you do for the community.

I agree. And I'm happy to see that this is being discussed, as I've seen
Daniel talking on Mastodon about this and it would be a shame if they
wouldn't provide their high quality reports to distributions up front...

Going back to 2016 Intel began working on MIPI SoundWire support for Linux and now in 2023, AMD has joined the party with their initial AMD SoundWire support driver landing in the mainline kernel...

Since the beginning of 2023 until the end of April, out of 13,296 new domains created related to ChatGPT or OpenAI, 1 out of every 25 new domains were either malicious or potentially malicious, Check Point researchers have shared on Tuesday. On Wednesday, Meta said that, since March 2023, theyve blocked 1,000+ malicious links leveraging ChatGPT as a lure from being shared across their technologies (Facebook, WhatsApp, etc.). Impersonating ChatGPT Threat actors generally disguise malware More

The post ChatGPT and other AI-themed lures used to deliver malicious software appeared first on Help Net Security.

Employing proprietary architecture, the Aegis NVX is the first Apricorn encrypted device to feature an NVME SSD inside, to address the immediate protection of raw data delivered directly from its source at high speeds. Initial capacity offerings will be 500GB, 1TB, and 2TB, with a price range of 280.00 600.00 MSRP. The NVX was conceived to meet demands and product requirements such as for use with high-definition video cameras with the capability to write More

The post Apricorn introduces Aegis NVX hardware-encrypted USB storage device appeared first on Help Net Security.

The printk code changes were merged last week for the ongoing Linux 6.4 merge window and it's notable not for what is in the pull request but rather what is still outstanding...

At the end of last year AMD's GPUOpen group released the Render Pipeline Shaders "RPS" SDK for graphics applications and engines leveraging Direct3D 12 or Vulkasn as an open-source render graph framework. On Wednesday the Render Pipeline Shaders SDK 1.1 was released and is complemented by Linux support...