GuidePoint Security has announced the availability of its Breach & Attack Simulation as a Service (BASaaS) offering. The new service is designed to help organizations maximize the value from their BAS tools and improve their security posture and the ROI from their existing non-BAS security stack. Now GuidePoint Security can assist with ensuring BAS tools are configured properly, deploying sensors according to best practices and ensuring that an organizations security tools are properly integrated. Additionally, More

The post GuidePoint Security improves organizations security posture and ROI with its BASaaS appeared first on Help Net Security.

Seceon announced two new products designed to quantify and report on the value of the platform for its partners and their clients. Seceon aiSecurity Score360 service provides comprehensive scanning and risk assessments of attack surfaces. It quantifies, prioritizes and benchmarks environments. The platforms external scans include intelligence from the CVE, NVT, OVAL, and CPE databases. The modular dashboard includes charts and tables and drill down capabilities, making values in the dashboard meaningful and actionable. Seceon More

The post Seceon unveils two products for MSPs and MSSPs to quantify risk appeared first on Help Net Security.

There has long been a desire to enable users to mount filesystem images without requiring privileges, but the security implications of allowing it are seriously concerning. Few, if any, kernel filesystems are hardened against maliciously crafted images, after all. Lennart Poettering led a filesystem session at the 2023 Linux Storage, Filesystem, Memory-Management and BPF Summit where he presented a possible path forward.

Are you, by any chance, wondering about giving yourself wings? You should listen to [Liz McFarland] sharing her experience building a Wonder Woman suit, and not just any the Golden Eagle suit from Wonder Woman 1984, adorned with a giant pair of wings. If a suit like that is in your plans, youll be warmly welcomed at a cosplay convention and [Liz] had her sights on the San Diego Comic Con. With an ambitious goal of participating in the Comic Cons cosplay contest, the suit had to be impressive and impressive, it indeed was, not just for its looks, but for its mechanics too.

[Liz] tells us everything from producing the wings and painting them, to keeping them attached to the body while distributing the weight, and of course, things like on-venue nuances and safety with regards to other participants. The dark side of cosplay building reality isnt hidden either talking, of course, about the art of staying within a reasonably tight budget. This build takes advantage of a hackerspace that [Liz] is an active member in the [Crash Space] in LA. Everything is in lasercutting, 3D printing, and even custom jigs for bending wing-structual PVC pipes play a role.

It would have been a travesty to not have the wings move at will, of course, and [Liz] had all the skills you could want for making the wings compl...

NETSCOUT has introduced its Visibility Without Borders (VWB) platform to help organizations keep goods and services flowing by uniting performance, security, and availability under one common data framework. By proactively identifying areas of complexity, fragility, and risk, the platform unlocks insights at unparalleled scale to deliver the intelligence needed to increase visibility, improve agility, and keep data and applications secure. Nearly all enterprises are on a digital transformation journey to drive greater optional efficiency, leverage More

The post NETSCOUT introduces Visibility Without Borders platform appeared first on Help Net Security.

Series parts:

1. New Series: Inside the Real Linux Foundation
2. What the 2022 Tax Filing (From 7 Months Ago, for Tax Year 2021) Teaches Us About the Linux Foundation
3. The Real Linux Foundation Part 3: How It Splits Into Subgroups, Including New Ones
4. YOU ARE HERE How the Foundation Makes Its Money

Video download link | md5sum 01beded0d72272a6c7f3da823a617340
Kernel and Linux or LF
Creative Commons Attribution-No Derivative Works 4.0

Summary: The tax-exempt foundation called after Linux barely cares about Linux, nor does it invest much in Linux; its just a money-grabbing outfit run by people who never used GNU/Linux, led by a charlatan married to a fraud [1, 2, 3]

THE Linux Foundation...

It might come as a surprise, but secrets management has become the elephant in the AppSec room. While security vulnerabilities like Common Vulnerabilities and Exposures (CVEs) often make headlines in the cybersecurity world, secrets management remains an overlooked issue that can have immediate and impactful consequences for corporate safety.  A recent study by GitGuardian found that 75% of IT

"Dozens" of organizations across the world have been targeted as part of a broad business email compromise (BEC) campaign that involved the use of adversary-in-the-middle (AitM) techniques to carry out the attacks. "Following a successful phishing attempt, the threat actor gained initial access to one of the victim employee's account and executed an 'adversary-in-the-middle' attack to bypass

Series parts:

1. New Series: Why People Everywhere Should Quit YouTube
2. YouTubes New Management: Times Up, Start Paying and Watch Ads, Dont Use Free Software
3. Why You Should Quit YouTube Part 3: Google Exploits Creators, Itll Get Even Worse
4. YOU ARE HERE Financial Crunch Time

Video download link | md5sum ec8f604ca4242f2ee20fd17b29192f49
YouTube Wants Nothing But Money
Creative Commons Attribution-No Derivative Works 4.0

Summary: Googles greed is destroying YouTube and theres no more free hosting; now they strive to bombard people with many long ads and the ad revenue is for Google to collect, not the people who do all the actual creative work and invest in equipment like expensive cameras, microphones, video editors etc.

THE previous part discussed the likely dire state of YouTubes accounting (under Google or Alphabet; it has become fashionable to make umbrella shells such as Meta). If YouTube was still an independent company, it would be deep in debt, just like Twitter and other fake successful companies (Spotify, from Sweden, is losing a billion dollars a year). A lot of video or multimedia (including music) hosting platforms are financially untenable. The video explains the example of Vimeo and others. Remember Microsofts Soapbox? It didnt last long, did it?

So Googles lawyers have now decided to nakedly take aim at Invidious. Is that a smart move? What percent of all Yo...

Dragos launched the Dragos Global Partner Program to comprise OT cybersecurity technology, services, and threat intelligence. The Dragos Partner Program extends even further by offering training that prepares partners as experts who can offer their customers assessment services based on Dragoss proven assessment methodology; resell the Dragos Platform including asset discovery, threat detection, and vulnerability management; and manage deployment for customers. The Dragos Partner Program enables channel partners to offer their customers the full range More

The post Dragos Partner Program helps users strengthen OT cybersecurity appeared first on Help Net Security.

By Waqas

BreachForums is already online with a new domain, gaining attraction from members, authorities, and the cybersecurity community.

This is a post from HackRead.com Read the original post: BreachForums Returns Under the Control of ShinyHunters Hackers

In the digital age, SaaS businesses have started embracing transformative technologies, such as Artificial intelligence (AI) and cloud computing. According to a research firm, the market for artificial intelligence (AI) is nearly 100 billion USD, which is expected to grow twentyfold by 2030, up to almost 2 trillion USD.

Although AI promises revolutionary advancements and cloud computing enables efficient storage and processing of massive amounts of data, their rapid adoption also raises concerns about cybersecurity. In 2021, the global cost of cybercrime was estimated to be $6 trillion.

<p><a class="aligncenter blog-photo" href= "https://lifeboat.com/blog.images/local-language-data-is-essential-for-building-effective-ai-tools.jpg"> <img class="aligncenter" src= "https://lifeboat.com/blog.images/local-language-data-is-essential-for-building-effective-ai-tools.jpg"></a></p> <p>Local language data helps automated systems understand and respond to users in their own language and can help businesses reach their target audiences more effectively, said Ganesh Gopalan, founder and CEO of AI startup <a href= "http://Gnani.ai">Gnani.ai</a>, during a panel discussion at the Mint Digital Innovation Summit & Awards on Friday.

If we dont have, firstly, content in the local language, if we cant talk to machines in the local language, then it is not possible for no system to work and, you know, reach the right audience, said Gopalan.</p> <p>The panel discussion also included Vivekanand Pani, Co-founder, Reverie Language Technologies, who agrees that to develop an AI tool for any language, the availability of data is crucial.</p> <div style="clear: both;"><a href= "https://www.techcircle.in/2023/06/12/local-language-data-is-essential-for-building-effective-ai-tools"> Read more</a></div>

Based upon a review by the SUN DAY Campaign of data recently released by the Federal Energy Regulatory Commission (FERC), utility-scale solar and wind have apparently each added more new electrical generating capacity during the first four months of 2023 than the new Vogtle-3 nuclear reactor that just came on-line after nearly 14 years of construction and major cost overruns.

FERC had earlier reported in its monthly Energy Infrastructure Update report for December 2022 that installed U.S. utility-scale solar generating capacity had reached 80,400 megawatts (MW) by the end of last year.

However, in its most recent report, with data through April 30, 2023, FERC cites 85,790-MW of installed solar generating capacity and that does not include new small-scale distributed PV systems. Meanwhile, FERC listed 143,280-MW of installed wind generating capacity at the end of 2022 but, four months later, that figure had been increased to 146,900-MW.

New research shows surprising activity levels in dying brains and may help explain the sudden clarity many people with dementia experience near death.

There [are] two types of companies in the world: Those who are great at AI and everybody else, Mark Cuban said.

Researchers led by the University of California San Diego have developed a new model that trains four-legged robots to see more clearly in 3D. The advance enabled a robot to autonomously cross challenging terrain with easeincluding stairs, rocky ground and gap-filled pathswhile clearing obstacles in its way.

The researchers will present their work at the 2023 Conference on Computer Vision and Pattern Recognition (CVPR), which will take place from June 18 to 22 in Vancouver, Canada.

By providing the robot with a better understanding of its surroundings in 3D, it can be deployed in more complex environments in the real world, said study senior author Xiaolong Wang, a professor of electrical and computer engineering at the UC San Diego Jacobs School of Engineering.

By arming each drone with its own sensors, researchers have created the first swarm capable of navigating a wide environment.

A database containing the personal information of more than 8.9 million Zacks Investment Research users was leaked on a cybercrime forum.

A database containing personal information of 8,929,503 Zacks Investment Research users emerged on a popular hacking forum on June 10, 2023.

Zacks is the leading investment research firm focusing on stock research, analysis, and recommendations.

The availability of the archive was reported by the data breach notification service Have I Been Pwned, which notified Zecks. According to HIBP, the records in the database contain names, addresses, phone numbers, email addresses, usernames, and passwords stored as unsalted SHA-256 hashes.

The company attempted to downplay the security breach by telling Have I Been Pwned that threat actors only had access to encrypted passwords.

In January, Zacks Investment Research (Zacks) disclosed a data breach, the company reported that the security incident may have affected the personal information of its 820,000 customers.

The company discovered the intrusion at the end of 2022, it believes the unauthorized access took place sometime between November 2021 and August 2022.

According to the notice, threat actors had access to an older database of customers who had signed up for the Zacks Elite product between November 1999 through February 2005.

At the time, the company added that it had no evidence that financial data has been exposed due to the security incident.

In December 2022, the investment research company Zacks announced a data breach. The following month, reports emerged of the incident impacting 820k customers. However, in June 2023, a corpus of data with almost 9M Zacks customers appeared before being broadly circulated on a popular hacking forum. The most recent data was dated May 2020 and included names, usernames, email and physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes. reported HIBP. On disclosure of the larger breach, Zacks advised that in addition to their original report the unauthorised third parties also gained access to encrypted [sic] passwords of zacks.com customers, but only in the encrypted [sic] format.

OneTrust announces enhancements to OneTrusts data policy engine designed to identify data security, privacy, and governance violations and automatically set and enforce data policies across the entire data ecosystem. Coupled with powerful automation, OneTrusts data discovery, classification, and governance solutions provide companies with the tools to adopt an effective data governance program and drive responsible data use. Security and privacy teams need to be able to quickly identify violations and remediate them to prevent data More

The post OneTrust enhances data policy engine to identify data security and privacy risks appeared first on Help Net Security.

AMD is kicking off what is going to be an exciting day with announcing the Ryzen PRO 7000 series processors for upcoming laptops and desktops.

A friend and I were sitting in a diner some time back talking mostly about old movies (my passion is for black-and-white films from 1927 to the death of Bogart in 1957). Somehow the topic of gravity came up, I suspect because we had homed in on early 50s science fiction films. Anyway, I remember his eyebrows raising when I mentioned how puny a force gravity was. I can understand why. We think about massive objects when we think about gravity, but of course it takes a lot of mass to get a little gravity.

In fact, gravity is some 10³⁸ times weaker than the strong force that holds atomic nuclei together, easily illustrated by pointing out to my friend that I was overcoming an entire planets worth of gravity by lifting the salt shaker on the table. I learned from Greg Matloff and Eugene Malloves The Starflight Handbook that despite Freeman Dysons early interest in using the gravitational force to capture energy from astronomical objects, it was Stanislaw Ulam who first pondered the idea in print.

Now Ulam is an interesting figure, a name that resonates on Centauri Dreams in the context of nuclear pulse propulsion, which he first analyzed as far back as 1947 in a report for Los Alamos Scientific Laboratory. This grew into the Project Orion concept, with nuclear bombs exploded behind a flat steel plate, the crew protected by the mother of all shock absorbers. Ulams work on gravitational machines, however, analyzed how much energy could be extracted in a three-body system, one of which was a rocket, and what kind of velocities such a rocket could attain.

Image: Stanislaw Ulam (1909-1984), well known for his work on Orion, but also an early analyst of the extraction of gravitational energy.

Freeman Dysons notion, explained in the paper Gravitational Machines that we looked at last week, was to extract energy from a binary star system, as shown in the figure from the paper below. The ever imaginative Dyson, remember, was...

Thanks to the driver being open-source, the ATI (AMD) R300 Gallium3D driver within Mesa is still seeing new (occasional) optimizations for Radeon graphics cards launched nearly two decades ago...

Meta engineers have proposed a shared workqueue "swqueue" feature for the Linux kernel's CFS scheduler that can help with a small throughput performance improvement and slightly better latency, particularly for AMD systems with multiple CCXs...

The convenient Mesa Matrix tracker that has long shown Vulkan and OpenGL versions and extensions supported by the different open-source drivers has also now begun reporting OpenCL support...

Accenture announced a $3 billion investment over three years in its Data & AI practice to help clients across all industries rapidly and responsibly advance and use AI to achieve greater growth, efficiency and resilience. There is unprecedented interest in all areas of AI, and the substantial investment we are making in our Data & AI practice will help our clients move from interest to action to value, and in a responsible way with clear More

The post Accenture announced a $3 billion investment in AI appeared first on Help Net Security.

Video download link | md5sum 0cf753fb90aab5992efe0bfd625e24fb
Political Escalation
Creative Commons Attribution-No Derivative Works 4.0

Summary: Todays video mostly covers part 3 of the series while stressing the relevance to Free software and the British government; Sirius Open Source did play a big role in adoption of Free software in the UK, so its crimes against staff (that worked on government computer systems) matter a lot, except the British police prefers to overlook this matter

THE pension fraud at Sirius was a serious crimes and the perpetrators of the crime have not been punished yet. For context, this is a company that once upon a time sponsored the Free Software Foundation (FSF) for several consecutive years and wasnt reluctant to put GNU logos in its Web site.

Things soured over the years. A decade ago I went to a meeting which helped secure a very important deal for the company. Id rather not name the client, but lets just say it supervises (or is in charge of) the people who run Action Fraud basically the very same folks who turned down my report of a crime, a crime committed not only against myself. This is confirmed, its not merely a suspicion.

Action Fraud, what about action? Wheres Action Fraud?

Are they trying to hide something?

It has been three weeks already and theyre not even responding to my elected representative, who (to her credit!) seems eager to get to the bottom of it.

The video above is a verbal update on the issue. We still have a lot of material left to publish and many steps remaining to explore, bodies to escalate to, issues to scrutinise etc. This cannot possibly end well unless the perpetrators are held accountable. All of them. Facilitators are another matter as theyre only indirectly culpable. ?

Series parts:

1. New Series: The End of Sirius Open Source
2. Sirius Open Source Cannot Retain Staff and Clients (Many of the Remaining Ones Leave the Company)
3. Police Out of Control (or Oversight) Part 3: Action Fraud and Reports of Sirius Fraud
4. YOU ARE HERE The Pokmon Village of Sirius Open Source and British Government

Video download link | md5sum 0cf753fb90aab5992efe0bfd625e24fb
Political Escalation
Creative Commons Attribution-No Derivative Works 4.0

Summary: Todays video mostly covers part 3 of the series while stressing the relevance to Free software and the British government; Sirius Open Source did play a big role in adoption of Free software in the UK, so its crimes against staff (that worked on government computer systems) matter a lot, except the British police prefers to overlook this matter

THE pension fraud at Sirius was a serious crimes and the perpetrators of the crime have not been punished yet. For context, this is a company that once upon a time sponsored the Free Software Foundation (FSF) for several consecutive years and wasnt reluctant to put GNU logos in its Web site.

This cannot possibly end well unless the perpetrators are held accountable. All of them.Things soured over the years. A decade ago I went to a meeting which helped secure a very important deal for the company. Id rather not name the client, but lets just say it supervises (or is in cha...

Automation Anywhere and Google Cloud announced an expanded partnership that combines the power of generative AI and intelligent automation to accelerate the adoption of AI and make it accessible to every enterprise. Automation Anywhere is utilizing Google Clouds large language models (LLMs) via Vertex AI to build and launch new generative AI features on the Automation Success Platform. Businesses today utilize the Automation Success Platform to automate common front- and back-office processes in areas like More

The post Automation Anywhere and Google Cloud join forces to accelerate the adoption of AI appeared first on Help Net Security.

The NOMAD Laboratory researchers have recently shed light on fundamental microscopic mechanisms that can help with tailoring materials for heat insulation. This development advances the ongoing efforts to enhance energy efficiency and sustainability.

The role of heat transport is crucial in various scientific and industrial applications, such as catalysis, turbine technologies, and thermoelectric heat converters that convert waste heat into electricity.

Particularly in the context of energy conservation and the development of sustainable technologies, materials with high thermal insulation capabilities are of utmost importance. These materials make it possible to retain and utilize heat that would otherwise go to waste. Therefore, improving the design of highly insulating materials is a key research objective in enabling more energy-efficient applications.

So I commented on an IKEA story about them using employees to assist in interior design. I commented, Can they use AI, of course knowing people can. AI can augment a regular homeowner into an interior designer.

Here is a list of some helpful AI interior design tools for homeowners who would like to avoid interior designers and decorate their homes on their own.

Home owners, nowadays, spend a sizeable amount of their savings on decorating their homes. Nevertheless, many of them remain averse to hiring interior decorators, as they believe it to be a costly affair. Hence, they take things into their own hands, when it comes to deciding the design of their dream abodes. Today, there are many Artificial Intelligence (AI)-powered interior design apps and software that can help the home owners with the interior designing job. Moreover, home owners do not need to be tech-savvy to use these tools.

A nice Tesla Video. Hope its not censored.

#TeslaFans #teslanews #teslamotorfans #gigaberlin.
Please Subcribe my channel: http://bit.ly/3clkTm6
=====
Tesla Giga Shanghai Production Speed 38 Seconds, Changes Everything!
Huge thank to:
CCTV https://www.youtube.com/c/cctv.
wu wa https://www.youtube.com/c/%E7%83%8F%E7%93%A6
Jason Yang https://www.youtube.com/c/JasonYang.
====
Teslas Giga Shanghai is a trump card for the EV revolution of Tesla.
Recently, Elon Musk revealed how fast Giga Shanghai could produce a car in just 38 seconds.
So how did that change everything?
The first video includes a ten-minute and five-minute segment of the Model Y leaving the workshop.
And during the 10-minute segment, 16 new cars were completed, which would be 38 seconds per car on average.
7 cars were completed in the following 5-minute segment, translating to an average of 44 seconds per car.

We will not count it to double-check, but the peak rate may be amazingly high. Of course, not necessarily constant and simultaneous for both models.
Based on production and statistics, we can completely believe in the super-fast production speed of Giga Shanghai.

This is the carmakers first Gigafactory outside the United States, with an industrial chain localization rate of more than 95 percent and 99.99 percent of the employees being Chinese.
Especially, Giga Shanghais production and sales volume reached a new record.
This $2 billion US factory produced nearly 300,000 cars in the first half of this year.
Tesla delivered a record high of 77,938 vehicles in China in June, up 177 percent yearly.
Its a big step for Tesla though it has faced unprecedented delays in vehicle production due to pandemic-related supply chain disruptions. Giga Shanghai was shut down for over three weeks in April, and no vehicles were exported to other territories.

Tesla says its Giga Shanghai is now the most productive EV factory in the world. It saw a projected annual capacity increase from just 450,000 vehicles to a whopping 750,000 from Q1 to Q2 2022.
Tesla shared: While the Shanghai factory was shut down fully and partially for the majority of Q2, we ended th...

As more victim organizations of Cl0p gangs MOVEit rampage continue popping up, security researchers have released a PoC exploit for CVE-2023-34362, the RCE vulnerability exploited by the Cl0p cyber extortion group to plunder confidential data. CVE-2023-34362 PoC exploit released Horizon3 security researchers have released proof-of-concept (PoC) exploit code for CVE-2023-34362, as well as technical root cause analysis of the flaw. Rapid7 has released an analysis of the vulnerability and a full exploit chain for CVE-2023-34362. More

The post PoC exploit for exploited MOVEit vulnerability released (CVE-2023-34362) appeared first on Help Net Security.

upstart writes:

Man's WW2 codebook unearths St Erth's 'best-kept secret':

Mike Griffiths unearthed the secret existence of the MI6 outstation in St Erth when his late father, Harry Griffiths, left him his code book. He has revealed the role his father and others played in providing intelligence for code-breakers at Bletchley Park. Mr Griffiths said he "couldn't be prouder" of what his father achieved.

The St Erth Radio Security Service Station - which Mr Griffiths said had about 100 employees - was a secret to anyone outside the village, but to those who lived there, it was common knowledge.

"It was quite remarkable," Mr Griffiths said. He added: "I think almost if you like, the boundary of the village, the secret didn't go beyond the boundary of the village."

[...] Mr Griffiths, who lives in Plymouth, said one of the main roles of the station was to listen to the German Secret Service discussing major military campaigns and building a "complete picture of the German war machine".

He said: "At the end of the war, when the German officers were being interrogated, they were staggered by how much the British actually knew. "They knew more about the German war machine than the Germans did themselves - quite staggering."

Harry Griffiths worked at the listening station from 1939 to 1946, when he was in his late twenties. He was recruited because of his aptitude with Morse code.

[...] He described the listening station as "the ears" of Bletchley Park in Milton Keynes, known as the home of the codebreakers.

His son said: "They were being told, home in on this particular agent, wherever they are in Europe, home in on these and find out who they're talking to."

[...] He said his advice to others was to ask their loved ones about their memories while they still could. "I would urge you, if you know somebody who went through the war, sit down with them, make a cup of tea, buy a bun - a saffron bun preferably, talk to them and say 'right actually, what did you do?', because I so wish I'd talked to him about it," Mr Griffiths said, about his late father.

Original Submission

Read more of this story at SoylentNews.

Weve heard a ton of stories over the years about abandoned technology useful widgets, often cloud-based, that attracted an early and enthusiastic following, only to have the company behind the tech go bankrupt or decide to end operations for business reasons, which effectively bricks hundreds or perhaps millions of otherwise still-usable devices. Now imagine that happening to your brain.

[Markus Mllmann-Bohle] doesnt have to imagine it, because hes living it. [Markus] suffers from chronic cluster headaches, an often debilitating condition that leaves a person with intractable pain. Having lived with these headaches since 1987, and treating them with medications with varying degrees of success, [Markus] was finally delivered from his personal hell by a sphenopalatine ganglion (SPG) neuromodulator. The device consists of an unpowered stimulator implanted under the cheekbone thats wired into the SPG, a bundle of nerves that supply the sinuses, nasal mucosa, tear glands, and many other structures in the face.

To reverse a cluster headache, [Markus] applies an external transmitter to the side of his face, which powers the implant and directs it to stimulate the SPG with low-fr...

Believe it or not, your attack surface is expanding faster than you realize. How? APIs, of course! More formally known as application programming interfaces, API calls are growing twice as fast as HTML traffic, making APIs an ideal candidate for new security solutions aimed at protecting customer data, according to Cloudflare. According to the "Quantifying the Cost of API Insecurity" report, US

Fortinet addressed a new critical flaw, tracked as CVE-2023-27997, in FortiOS and FortiProxy that is likely exploited in a limited number of attacks.

Fortinet has finally published an official advisory about the critical vulnerability, tracked as CVE-2023-27997 (CVSS score: 9.2), impacting FortiOS and FortiProxy.

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. reads the advisory.

The vulnerability is a heap-based buffer overflow issue and according to the vendor it may have been exploited in a limited number of attacks aimed at government, manufacturing, and critical infrastructure sectors.

Our investigation found that one issue (FG-IR-23-097) may have been exploited in a limited number of cases and we are working closely with customers to monitor the situation. states the report published by Fortinet. For this reason, if the customer has SSL-VPN enabled, Fortinet is advising customers to take immediate action to upgrade to the most recent firmware release. If the customer is not operating SSL-VPN the risk of this issue is mitigated however, Fortinet still recommends upgrading.

A remote attacker can trigger the vulnerability to execute arbitrary code or commands by sending specifically crafted requests to vulnerable devices.

The vulnerability was reported to Fortinet by the researcher Charles Fol and Dany Bach (DDXhunter) from Lexfo Security. The researcher describes the issue as a reachable pre-authentication that impacts every SSL VPN appliance.

The issue impacts at least:

TLDR: Success!

It's another small step for a ling but one giant leap for ling kind. See you next time!

The U.S. Department of Justice (DoJ) has charged two Russian nationals in connection with masterminding the 2014 digital heist of the now-defunct cryptocurrency exchange Mt. Gox. According to unsealed indictments released last week, Alexey Bilyuchenko, 43, and Aleksandr Verner, 29, have been accused of conspiring to launder approximately 647,000 bitcoins stolen from September 2011 through at

One of the interesting Intel i915 DRM kernel driver patch series being worked on recently is fdinfo memory statistics with the ability to report per-process/client memory statistics around vRAM use...

The UK's broadcasting regulator, Ofcom, has confirmed that it is amongst the organisations whose data has been stolen as a result of the massive MOVEit supply-chain cyber attack. Read more in my article on the Hot for Security blog.

Last month I wrote about the virtual ALSA driver being developed for the Linux kernel. That driver has now morphed into the Virtual PCM Test driver and is on its way with the upcoming Linux 6.5 cycle...

The European Union Intellectual Property Office (EUIPO) has published the findings of its 2023 study on European Citizens and Intellectual Property: Perception, Awareness and Behavior.

The study aims to gain a better understanding of European consumers attitudes toward intellectual property and covers physical counterfeit goods and online digital content; our focus here will be on the latter.

Most Europeans Oppose Use of Illegal Content Sources

Given the entertainment industries regular and urgent calls to tackle online piracy, the EUIPO study paints a more positive picture in respect of attitudes towards illegal content.

In general, most Europeans do not support obtaining digital content from illegal sources. The majority disagree with a variety of reasons that are sometimes used to justify this behavior, such as that it is OK if only for personal use (65 % disagree or tend to disagree with this), if the price of the content is too high (72 %), or if the content is not available via a legal source (74 %), the report notes.

In line with most, if not all, studies in recent years, acceptance of piracy decreases with age. While 19% of citizens aged 55-64, and 18% of those aged 65 and over, believe that its acceptable to access content via illegal sources if the price is too high, acceptance rates jump to 41% and 46% in the 25-34 and 15-24 groups, respectively.

Piracy acceptance rates are also higher in the younger age groups when content isnt available from legal sources, reaching 44% among 15 to 24-year-olds. However, the majority of Europeans (80%) say that they prefer to obtain content from legal sources, if an affordable legal option is available.

In that respect, a surprising 69% of respondents consider the quality and range of content to be better than that currently available from illegal platforms.

14% of EU Citizens Pirate, But Not Exclusively

The study found that 43% of Europeans paid to access online content from a legal service in the past 12 months. Just 14% admitted to having used illegal sources during the same period but these arent all hardcore pirates. Of this group, six in every 10 citizens (60%) also purchased content...

Following my recent RADV+Zink vs. RadeonSI OpenGL benchmarking for various games and workloads, Valve's Zink lead developer Mike Blumenkrantz was hopping on some of the benchmarks where this generic OpenGL-on-Vulkan implementation lagged behind the RadeonSI Gallium3D driver...

The fifth conference on Power Management and Scheduling in the Linux Kernel (abbreviated "OSPM") was held on April 17 to 19 in Ancona, Italy. LWN was not there, unfortunately, but the attendees of the event have gotten together to write up summaries of the discussions that took place and LWN has the privilege of being able to publish them. Reports from the first day of the event appear below.

Paul McKenney has announced a new "https://mirrors.edge.kernel.org/pub/linux/kernel/people/paulmck/perfbook/perfbook.html"> Is Parallel Programming Hard, And, If So, What Can You Do About It?.

This release contains a new section on thermal throttling (along with a new cartoon), improvements to the memory-ordering chapter (including intuitive subsets of the Linux-kernel memory model), fixes to the deferred-processing chapter, additional clocksource-deviation material to the "What Time Is It?" section, and numerous fixes inspired by questions and comments from readers.

Videos from the 2022 Tracing Summit are now available on YouTube. They include talks about Visual eBPF, Perfetto, the state of Linux tracers, libpatch, hardware trace, and more.

Security updates have been issued by Debian (vim), Fedora (kernel), Oracle (emacs, firefox, python3, and qemu), SUSE (firefox, java-1_8_0-ibm, and libwebp), and Ubuntu (firefox, glusterfs, and sniproxy).

ve just gotten the latest numbers from ONS. About 10 minutes ago ONS released Week 22 numbers for 2023 (15 minutes ago an updated file wasnt there yet).

Notice how this year compares to last year or prior years. 29.5% higher.

Back to work, folks Pandemic is over, according to WHO.

Today in Gemini:

So, some quick advice: Dont get COVID.

I went back to Seattle in the beginning of March, wore a mask the whole time (my partner did not. I think this is important). We got to drop in on Emerald City Comic Con, which was well missed, and I was so happy to be there, and also just walk around the city again. I miss walking around cities.

My partner was sick by the time we were done at ECCC (they did wear a mask there, as we do for conventions). By the time we got home, I had cold-like symptoms. That Tuesday I was fully sick with it.

[...]

Anyway, three months out, I still have a little bit of a cough, and my brain fog has mostly cleared up. I truly believe it could have been so much worse, if I had not gotten vaccines.

The Fedora project has posted the results of its elections for members of the Fedora Engineering Steering Committee (Stephen Gallagher, Neal Gompa, Major Hayden, and Tom Stellard), Fedora Council (Sumantro Mukherjee), and Mindshare Committee (David Duncan).

Do high voltages affect the resonant frequency of a crystal? Honestly, we never thought about it, but [Joe] did and decided to risk his analyzer to find out. He started with some decidedly old-school crystals like you might have found in a 1960-era Novice rig. Since the crystal is piezoelectric, he wondered if using a high DC voltage to bend the crystal to move the frequency to create a variable crystal oscillator (sometimes called a VXO).

He created a rig to block DC away from the network analyzer and then feed voltage directly across the crystal. The voltage was from an ESD tester that provides over 1000 volts.

Getting a crystal to change much in frequency is difficult, which is why they are useful. So we werent surprised that even at very high voltages, the effect wasnt very large. It did change the frequency, but it just wasnt very much.

At one point, it looked like he might have killed the test equipment. There was a time when letting the smoke out of a network analyzer would have been a costly mistake, but these days the cost isnt that prohibitive. In the end, this experiment probably doesnt produce any practical results. Still, it is interesting, and we always enjoy watching anything that gives us more intuition about the behavior of circuits or, in this case, circuit elements.

If you need a refresher on crystal oscillators, we can help. There are other ways to modif...

UK communications regulator Ofcom suffered a data breach after a Clop ransomware attack exploiting the MOVEit file transfer zero-day.

UKs communications regulator Ofcom disclosed a data breach after a Clop ransomware attack. The threat actors exploited the zero-day flaw (CVE-2023-34362,) in MOVEit file transfer and access the infrastructure of the regulator.

A spokesperson for Ofcom told The Record that the ransomware group had access confidential information which the regulator held on companies it regulates.

A limited amount of information about certain companies we regulate some of it confidential along with personal data of 412 Ofcom employees, was downloaded during the attack, the spokesperson told The Record. We took immediate action to prevent further use of the MOVEit service and to implement the recommended security measures. We also swiftly alerted all affected Ofcom-regulated companies, and we continue to offer support and assistance to our colleagues.

MOVEit Transfer is a managed file transfer that is used by enterprises to securely transfer files using SFTP, SCP, and HTTP-based uploads

The vulnerability is a SQL injection vulnerability, it can be exploited by an unauthenticated attacker to gain unauthorized access to MOVEit Transfers database. The vulnerability affects all MOVEit Transfer versions, it doesnt

The Clop ransomware gang (aka Lace Tempest) was credited by Microsoft for the recent campaign that exploits the zero-day vulnerability CVE-2023-34362.

On Wednesday, the Clop ransomware gang published an extortion note on its dark web leak site claiming to have information on hundreds of businesses.

Also available via the Gemini protocol at:

• gemini://gemini.techrights.org/irc-gmi/irc-log-techrights-120623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-120623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-social-120623.gmi
• gemini://gemini.techrights.org/irc-gmi/irc-log-techbytes-120623.gmi

Over HTTP: