IT threat evolution Q2 2024
Targeted attacks
XZ backdoor: a supply chain attack in the making
On March 29, a message on the Openwall oss-security mailing list announced the discovery of a backdoor in XZ, a compression utility included in many popular Linux distributions. The backdoored library is used by the OpenSSH server process sshd. On a number of systemd-based distributions, including Ubuntu, Debian and RedHat/Fedora Linux, OpenSSH is patched to use systemd features and is therefore dependent on the library (Arch Linux and Gentoo are not affected). The code was inserted in February and March 2024, mostly by Jia Cheong Tan – probably a fictitious identity. We suspect that the goal of the attack was to introduce exclusive remote code execution capabilities into the sshd process by targeting the XZ build process; and then to push the backdoored code out to major Linux distributions as a part of a large-scale supply chain attack.
Timeline of events
2024.01.19 XZ website moved to GitHub pages by new maintainer (jiaT75)
2024.02.15 “build-to-host.m4” is added to .gitignore
2024.02.23 two “test files” containing the stages of the malicious script are introduced
2024.02.24 XZ 5.6.0 is released
2024.02.26 commit in CMakeLists.txt that sabotages the Landlock security feature
2024.03.04 the backdoor leads to issues with Valgrind
2024.03.09 two “test files” are updated, CRC functions are modified, Valgrind issue is “fixed”
2024.03.09 XZ 5.6.1 is released
2024.03.28 bug is discovered, Debian and RedHat notified
2024.03.28 Debian rolls back XZ 5.6.1 to version 5.4.5-0.2
2024.03.29 an email is published on the oss-security mailing list
2024.03.29 RedHat confirms backdoored XZ was shipped in Fedora Rawhide and Fedora Linux 40 beta
2024.03.30 Debian shuts down builds and starts process to rebuild them
2024.04.02 XZ main developer acknowledges backdoor incident
While earlier supply chain attacks we have seen in Node.js, PyPI, FDroid, and the Linux kernel consisted mostly of atomic malicious patches, fake packages and typo-squatted package names, this incident was a multi-stage operation that came close to compromising SSH servers on a global scale.
The backdoor in the liblzma library was introduced at two levels. The source code of the build infrastructure that generated the final packages was modified slightly (by introducing an additional file build-to-host.m4) to extract the next stage script hidden in a test-case file (bad-3-corrupt_lzma2.xz). This script, in turn, extracted a malicious binary component from another test-case file (good-large_compressed.lzma) that was linked to the legitimate library during the compilation process to be shipped to Linux repositories. Major vendors in turn shipped the malicious component in beta and experimental builds. The XZ compromise was assigned the identifier CVE-2024-3094 and the maximum severity level of 10.
The attackers’ initial goal was to hook one of the functions related to RSA key manipulation. In our analysis of the hook process, we focused on the behavior of the backdoor inside OpenSSH, specifically OpenSSH portable version 9.7p1 (the latest version). Our analysis revealed a number of interesting details about the backdoor’s functionality.
- The attacker set an anti-replay feature to prevent possible capture or hijacking of the backdoor communications.
- The author used a custom steganography technique in the x86 code to hide the public key.
- The backdoor hooks the logging function to hide its logs of unauthorized connections to the SSH server.
- The backdoor hooks the password authentication function to allow the attacker to use any username/password to log in to the infected server without any further verification. It does the same with public key authentication.
- The backdoor has remote code execution capabilities that allow the attacker to execute any system command on the infected server.
It’s clear that this is a highly sophisticated threat. The attackers used social engineering to gain long-term access to the development environment and extended it with fake human interactions in plain sight. They have extensive knowledge of the internals of open-source projects such as SSH and libc, as well as expertise in code/script obfuscation used to initiate the infection process. A number of things make this threat unique, including the way the public key information is embedded in the binary code itself, complicating the recovery process, and the meticulous preparation of the operation.
Kaspersky products detect malicious objects associated with the attack as HEUR:Trojan.Script.XZ and Trojan.Shell.XZ. In addition, Kaspersky Endpoint Security for Linux detects malicious code in sshd process memory as MEM:Trojan.Linux.XZ (as part of the Critical Areas Scan task).
For more information, read our initial analysis, incident assessment and in-depth hook analysis.
DuneQuixote campaign targeting the Middle East
In February, we discovered a new malware campaign targeting government entities in the Middle East that we dubbed DuneQuixote. Our investigation uncovered more than 30 DuneQuixote dropper samples being actively used in this campaign. Some were regular droppers, while others were manipulated installer files for a legitimate tool called Total Commander. The droppers carried malicious code to download a backdoor that we dubbed CR4T. While we have only identified two of these implants, we strongly believe that there may be more in the form of completely different malware. The group behind the campaign took steps to prevent collection and analysis of its implants and implemented practical and well-designed evasion techniques in both network communications and the malware code.
The initial dropper is a Windows x64 executable file, written in C/C++, although there are DLL versions of the malware that provide the same functionality. Upon execution, the malware initiates a series of decoy API calls that serve no practical purpose. These calls are primarily string comparison functions that are executed without any conditional jumps based on the comparison results. The strings specified in these functions are snippets of Spanish poetry. These vary from one sample to the next, changing the signature of each sample to evade traditional detection methods.
The primary goal of the CR4T implant is to give attackers access to a console for command line execution on the infected computer. It also facilitates the download, upload and modification of files.
We also discovered a Golang version of the CR4T implant that has similar capabilities to the C version. A notable difference of this version is the ability to create scheduled tasks using the Golang Go-ole library, which uses Windows Component Object Model (COM) object interfaces to interact with the Task Scheduler service.
Through the use of memory-only implants and droppers masquerading as legitimate software that mimics the Total Commander installer, the attackers demonstrate above-average evasion capabilities and techniques. The discovery of both C/C++ and Golang versions of the CR4T implant highlights the adaptability and ingenuity of the threat actor behind this campaign.
ToddyCat: punching holes in your infrastructure
The threat actor ToddyCat predominantly targets government organizations in the Asia-Pacific region, primarily to steal sensitive data. In our previous article, we described the tools the attackers use to collect and exfiltrate files (LoFiSe and PcExter). More recently, we examined how this threat actor maintains constant access to compromised infrastructure, the information they are interested in and the tools they use to extract it.
Our investigation revealed that ToddyCat was stealing data on an industrial scale. To steal large volumes of data, attackers need to automate the data harvesting process as much as possible, and provide several alternative means to continuously access and monitor the systems they attack.
ToddyCat used several methods to accomplish this. One was to create a reverse SSH tunnel. They launched this using the SSH client from the OpenSSH for Windows toolkit, along with the library required to run it, an OPENSSH private key file, and a script, a.bat, to hide the private key file. The attackers transferred files to the target host via SMB using shared folders.
The threat actor also made use of the server utility (VPN Server) from the SoftEther VPN package for tunneling. This package is an open-source solution developed as part of academic research at the University of Tsukuba, which allows the creation of VPN connections using a variety of popular protocols, such as L2TP/IPsec, OpenVPN, MS-SSTP, L2TPv3, EtherIP and others.
Another way ToddyCat accessed remote infrastructure was by tunneling to a legitimate cloud provider: an application running on the user’s host with access to the local infrastructure can connect to the cloud through a legitimate agent and redirect traffic or execute specific commands.
Ngrok is a lightweight agent that can redirect traffic from endpoints to cloud infrastructure and vice versa. The attackers installed Ngrok on target hosts and used it to redirect command and control (C2) traffic from the cloud infrastructure to a specific port on those hosts.
They also used Krong, a proxy that uses XOR to encrypt the data passing through it, thereby concealing the content of the traffic to avoid detection.
After creating tunnels on the target hosts using OpenSSH or SoftEther VPN, the threat actor also installed the FRP client, a fast reverse proxy written in Go that allows access from the internet to a local server behind a NAT or firewall.
ToddyCat used various tools to collect data. They used one of the tools, which we named “cuthead” (the name came from the file description field of the sample we found), to search for documents. They used “WAExp”, a WhatsApp data stealer, to search for and collect browser local storage files containing data from the web version of WhatsApp. The attackers also used a tool called “TomBerBil” to steal passwords from browsers.
To protect against such attacks, we recommend that organizations add the resources and IP addresses of cloud services that provide traffic tunneling to the corporate firewall denylist. We also recommend limiting the range of tools administrators can use to remotely access hosts: other tools should either be prohibited or closely monitored as possible indicators of suspicious activity. In addition, employees should avoid storing passwords in browsers, as this helps attackers gain access to sensitive information. Moreover, reusing passwords across services increases the amount of data available to attackers.
Other malware
QakBot attacks with Windows zero-day
In early April we investigated the Windows DWM (Desktop Window Manager) Core Library Elevation of Privilege Vulnerability (CVE-2023-36033), which was previously discovered as a zero-day being exploited in the wild. While searching for samples related to this exploit and attacks using it, we found a curious document uploaded to VirusTotal on April 1. This document caught our attention because it had a descriptive file name indicating that it contained information about a Windows vulnerability.
Inside we found a brief description of a Windows DWM vulnerability and how it could be exploited to gain system privileges – all written in very poor English. The exploitation process described in this document was identical to that used in the previously mentioned zero-day exploit for CVE-2023-36033 – but the vulnerability was different.
The poor quality of the writing, and the fact the document was missing some important details about how to actually trigger the vulnerability, suggested that the vulnerability described was completely made up or was present in code that could not be accessed or controlled by attackers.
However, a quick check revealed that this was a real zero-day vulnerability that could be used to escalate privileges, so we immediately reported our findings to Microsoft. The vulnerability was assigned CVE-2024-30051 and a patch was released as part of Patch Tuesday on May 14.
We also began closely monitoring our statistics for exploits and attacks using this zero-day, and in mid-April we discovered an exploit. We have seen this zero-day used in conjunction with QakBot and other malware, and believe that multiple threat actors have access to it.
Kaspersky products detect the exploitation of CVE-2024-30051 and related malware with the following verdicts:
- PDM:Exploit.Win32.Generic;
- PDM:Trojan.Win32.Generic;
- UDS:DangerousObject.Multi.Generic;
- Win32.Agent.gen;
- Win32.CobaltStrike.gen.
Using the LockBit builder to generate targeted ransomware
Last year, we published our research on the LockBit 3.0 builder. Leaked in 2022, this builder greatly simplified the creation of custom ransomware.
The keygen.exe file generates public and private keys used for encryption and decryption. The builder.exe file generates the variant according to the options set in the config.json file. The whole process is automated by the build.bat script.
The builder also allows attackers to choose exactly what they want to encrypt. If they know enough about the target’s infrastructure, they can create malware tailored to the specific configuration of the target’s network architecture, such as important files, administrative accounts and critical systems.
This has allowed attackers to generate customized versions of this threat to suit their needs, making their attacks more effective.
In February, the international law enforcement task force Operation Cronos gained insight into LockBit’s operations after taking down the group. The operation involved law enforcement agencies from 10 countries. They were able to seize the group’s infrastructure, obtain private decryption keys and create a decryption toolset based on a list of known victim IDs obtained by the authorities. However, just a few days later, the ransomware group announced that it was back in action.
In a recent incident response engagement, we were faced with a ransomware attack that involved a ransomware sample created with the same leaked builder. The attackers were able to find the admin credentials in plain text. They created a custom version of the ransomware that used the account credentials to spread across the network and perform malicious activities, such as killing Windows Defender and deleting Windows Event Logs to encrypt data and cover its tracks. In one of our latest articles, we revisited the LockBit 3.0 builder files and analyzed the steps the attackers took to compromise the network.
Stealers, stealers and more stealers
Stealers are a prominent feature of the threat landscape. They are designed to harvest passwords and other sensitive data from infected computers that can then be used in other attacks, resulting in financial loss to the target. Over the past year we have published a number of public and private reports on newly discovered stealers. We recently wrote reports on Acrid, ScarletStealer and Sys01: the first two are new, the latter has been updated.
Acrid, a new stealer discovered in December 2023, is written in C++ for the 32-bit system, despite the fact that most systems are now 64-bit. Upon closer inspection, it became apparent that the authors had compiled it for a 32-bit environment in order to use the “Heaven’s Gate” technique, which allows 32-bit applications to access the 64-bit space to bypass certain security controls. This malware is designed to steal browser data, local cryptocurrency wallets, files with specific names (wallet.dat, password.docx, etc.) and credentials from installed applications (FTP managers, messengers, etc.). The collected data are zipped and sent to the C2.
Last January, we analyzed a downloader we dubbed “Penguish”. One of the payloads it downloaded was a previously unknown stealer called “ScarletStealer” – an odd stealer, since most of its functionality is contained in other binaries (applications and Chrome extensions) that it downloads. When ScarletStealer is executed, it checks for the presence of cryptocurrencies and crypto wallets by looking for certain folder paths (e.g., %APPDATA%\Roaming\Exodus). If anything is detected, it starts downloading the additional executables using PowerShell. Most ScarletStealer executables are digitally signed. This stealer is very underdeveloped in terms of functionality and contains many bugs, errors, and redundant code. Considering the effort it takes to install the malware through a long chain of downloaders, the last of which is Penguish, it’s strange that it’s not more advanced.
SYS01 (aka Album Stealer and S1deload Stealer), a relatively unknown malware that has been around since at least 2022, has evolved from a C# stealer to a PHP stealer. What hasn’t changed is the infection vector. Users are tricked into downloading a malicious ZIP archive disguised as an adult video via a Facebook page.
The archive contains a legitimate binary that sideloads a malicious DLL. This DLL opens an adult video and executes the next payload, which is a malicious PHP file encoded with ionCube. The executed PHP file calls a script, install.bat, which ultimately executes the next stage by running a PowerShell command. This layer is conveniently named “runalayer” and runs what appears to be the final payload called “Newb”. However, we found a difference between the latest version and the previous publicly disclosed versions of the stealer. The current stealer (Newb) includes functionality to steal Facebook-related data and send stolen browser data to the C2. It also contains backdoor functionality. However, we found that the code that actually collects the browser data sent by Newb is in a different sample named “imageclass”. It is not 100% clear how imageclass was pushed to the system; but looking at the backdoor code of Newb, we concluded with a high degree of certainty that imageclass was later pushed through Newb to the infected machine. The initial ZIP archive also contains another malicious PHP file, include.php: this has similar backdoor functionality to Newb and accepts many of the same commands in the same format.
ShrinkLocker: turning BitLocker into a ransomware utility
During a recent incident response engagement, we discovered ransomware called “ShrinkLocker” that uses BitLocker to encrypt compromised computers. BitLocker is the full-disk encryption utility built into Windows that is designed to prevent data exposure on lost or stolen computers.
ShrinkLocker is implemented as a sophisticated VBScript. If the script detects that it’s running on Windows 2000, XP, 2003 or Vista, it shuts down. However, for later versions of Windows, it runs the appropriate portion of its code for the specific operating system. ShrinkLocker shrinks the computer’s drive partitions by 100MB and uses this slack space to create a boot partition for itself. The malware modifies the registry to configure BitLocker to run with the attacker’s settings. It then disables and removes all default BitLocker protections to prevent key recovery and enables the numeric password protection option. The script then generates this password and initiates encryption of all local drives before sending the password and system information to the attacker’s C2 server. Finally, the malware deletes itself and reboots the system.
If the user tries to use the recovery option while the computer is booting, they will see a message stating that no BitLocker recovery options are available.
ShrinkLocker changes the labels of all system drives to the attacker’s email address instead of leaving a ransom note.
You can read our full analysis of ShrinkLocker here.
securelist.com/it-threat-evolu…
Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant nowgitlab.com/fdroid/fdroidclient…
Search improvements: Sort based on keyword matching and removed alphabetic sort (!889) · Merge requests · F-Droid / Client · GitLab
The search results are pretty unusable currently. So I've changed it to show apps in this order: App name matches keyword, summary matches keyword, description matches keyword. Also,...GitLab
3D Printed RC Crane Has Epic 3-Foot Reach
Have you ever looked out the window at traffic and seen a giant crane driving alone the road? Have you ever wanted a little 3D printed version you could drive for yourself without the risk of demolishing your neighbors house? Well, [ProfessorBoots] has just the build for you.
The build, inspired by the Liebherr LTM 1300, isn’t just a little RC car that looks like a crane. It’s a real working crane, too! So you can drive this thing around, and you can park it up. Then you can deploy the fully working stabilizer booms like you’re some big construction site hot shot. From there, you can relish in the subtle joy of extending the massive three-foot boom while the necessary counterweight automatically locks itself in place. You can then use the crane to lift and move small objects to your heart’s content.
The video describes how the build works in intimate detail, from the gears and linkages all the way up to the grander assembly. It’s no simple beast either, with ten gearmotors, four servos, and two ESP32s used for control. If you really need to build one for yourself, [ProfessorBoots] sells his plans on his website.
We’ve seen great stuff from [ProfessorBoots] before—he’s come a long way from his skid steer design last year. Video after the break.
youtube.com/embed/faC3Yzz9IqI?…
Thanks to [Hudson Bazemore] for the tip!
reshared this
HackerHood di RHC scopre un nuovo 0day sui prodotti Zyxel
Il gruppo hacker di Red Hot Cyber, HackerHood ha scoperto un nuovo 0day sui dispositivi di sicurezza della Zyxel. Questa vulnerabilità di sicurezza è stata scoperta dai ricercatori di sicurezza Alessandro Sgreccia e Manuel Roccon, membri del team di HackerHood, durante le attività di ricerca che svolgono costantemente sugli apparati di Zyxel.
All’interno delle attività di ricerca svolte dal team sugli apparati di Zyxel, è stato individuato ub bug di sicurezza (alcuni sono ancora in gestione dal fornitore) che è stato immediatamente comunicato a Zyxel seguendo le best-practices internazionali della Coordinate Vulnerability Disclosure (CVD).
Le nuove vulnerabilità rilevate su Zyxel
CVE-2024-7203 è una vulnerabilità di iniezione di comandi che colpisce le versioni del firmware (V4.60 – V5.38) dei dispositivi delle serie Zyxel ATP e USG FLEX. Questa falla permette a un attaccante autenticato con privilegi amministrativi di eseguire comandi arbitrari del sistema operativo, sfruttando comandi CLI appositamente costruiti. La vulnerabilità è classificata come ad alta gravità, con un punteggio CVSS di 7.2, indicando un rischio significativo per l’integrità e la riservatezza del sistema.
Puoi trovare maggiori dettagli nell’avviso ufficiale di Zyxel.
Il gruppo hacker di HackerHood
Il gruppo HackerHood, è un gruppo della community di Red Hot Cyber che si è specializzato nelle attività tecnico specialistiche finalizzate all’incentivazione verso la collaborazione attraverso le attività di ethical hacking (penetration test e ricerca 0day), programmazione e malware Analysis.
Uno tra i programmi del gruppo di HackerHood è appunto l’identificazione di bug non documentati (c.d. 0day), dove i membri del team una volta rilevate le vulnerabilità 0day su prodotti di largo consumo, collaborano con i vendor di prodotto per migliorare la sicurezza informatica.
Le attività si svolgono attraverso il processo di Coordinate Vulnerability Disclosure e solo a valle della pubblicazione della fix da parte dei vendor si procede alla disclosure pubblica e alla diffusione di eventuali Proof of Concept (PoC).
Un altro programma di HackerHood è lo svolgimento di attività di penetration test su infrastrutture ICT di aziende italiane che abbracciano politiche di “Responsible disclosure”. Tutto questo consente di dare un contributo al comparto Italia e quindi aiutare le aziende a migliorare la propria sicurezza informatica oltre che incentivare altre persone a fare lo stesso.
Quindi, se sei un analista di sicurezza con skill di ethical hacking o un ricercatore di bug che sposi il Manifesto di HackerHood, potresti essere anche tu un membro di HackerHood. Scrivici quindi alla casella di posta del team: info@hackerhood.it
“Tieni Il Mento Alto. Un Giorno Ci Sarà Di Nuovo La Felicità A Nottingham, Vedrai.” (Robin Hood)
L'articolo HackerHood di RHC scopre un nuovo 0day sui prodotti Zyxel proviene da il blog della sicurezza informatica.
Civil society organisations call for EU spyware ban
Civil society organisations demand for comprehensive legislation banning spyware throughout the EU, citing widespread misuse and insufficient regulation, in a joint statement.
Lo 0-day di Google Chrome viene sfruttato dagli Hacker Nord-Coreani per Svuotare i Wallett di Criptovaluta
Gli hacker nordcoreani stanno sfruttando una vulnerabilità zero-day in Google Chrome per ottenere il controllo dei sistemi e prendere il controllo delle risorse crittografiche delle vittime.
Microsoft ha confermato che il gruppo Citrine Sleet (precedentemente DEV-0139) ha utilizzato il CVE-2024-7971 zero-day per iniettare il rootkit FudModule dopo aver ottenuto i privilegi di SYSTEM utilizzando un exploit nel kernel di Windows.
L’obiettivo principale degli attacchi è il settore delle criptovalute, dove gli hacker cercano guadagni finanziari. Il gruppo Citrine Sleet è noto da tempo per i suoi attacchi contro le istituzioni finanziarie, ma soprattutto contro le organizzazioni che operano nel settore delle criptovalute e i loro dipendenti. In precedenza, gli hacker erano associati all’intelligence nordcoreana.
Citrine Sleet (AppleJeus, Labyrinth Chollima, UNC4736) ha ripetutamente utilizzato siti Web falsi mascherati da piattaforme di scambio di criptovalute legittime. Gli hacker hanno infettato i sistemi delle vittime attraverso false domande di lavoro o tramite falsi portafogli e applicazioni commerciali. Ad esempio, nel marzo 2023, UNC4736 ha compromesso la catena di fornitura del software di videoconferenza 3CX, provocando l’hacking del software X_TRADER, progettato per automatizzare il commercio di azioni.
Anche il Google Threat Analysis Group (TAG) ha confermato il collegamento del gruppo AppleJeus con la compromissione del sito web di Trading Technologies. Il governo degli Stati Uniti mette in guardia da anni sui rischi posti dagli hacker nordcoreani che prendono di mira le società di criptovaluta e i loro dipendenti utilizzando il malware AppleJeus.
Una settimana fa, Google ha corretto la vulnerabilità zero-day CVE-2024-7971, nel motore JavaScript V8 utilizzato in Chrome. Il bug consentiva agli aggressori di eseguire codice remoto nella sandbox del browser Chromium, dopodiché gli aggressori potevano utilizzare il browser per scaricare l’exploit CVE-2024-38106 nel kernel di Windows. L’attacco consente agli hacker di ottenere i diritti di SYSTEM e di iniettare in memoria ilrootkit FudModule, che viene utilizzato per manipolare gli oggetti del kernel e aggirare i meccanismi di sicurezza.
Dalla sua scoperta nell’ottobre 2022, il rootkit FudModule è stato utilizzato anche da un altro gruppo di hacker nordcoreano, Diamond Sleet, che utilizza strumenti di attacco e infrastrutture simili. Nell’agosto 2024, Microsoft ha rilasciato un aggiornamento di sicurezza che risolve la vulnerabilità CVE-2024-38193 nel driver AFD.sys, utilizzato anche negli attacchi Diamond Sleet .
L'articolo Lo 0-day di Google Chrome viene sfruttato dagli Hacker Nord-Coreani per Svuotare i Wallett di Criptovaluta proviene da il blog della sicurezza informatica.
Litigation funds: i pericolosi rapporti tra finanza e giustizia
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
Negli ultimi anni si sono affermati i litigation funds: anticipano i costi delle class action e, in caso di successo, trattengono parte dei rimborsi
L'articolo Litigation funds: i pericolosi rapporti tra finanza e giustizia proviene da Valori.
imolaoggi.it/2024/08/27/partit…
Elly, per favore, lascia perdere Renzi in Liguria e dai la linea al centrosinistra per la Regione
@Politica interna, europea e internazionale
Questo è un appello, anzi una richiesta pressante, una supplica angosciata rivolta ai dirigenti, nazionali e locali, dei partiti della cosiddetta opposizione, e in particolare al Partito democratico. In particolare mi rivolgo alla segretaria Elly Schlein
Palestinesi denunciano: gravi le condizioni della deputata Khalida Jarrar in carcere in Israele
@Notizie dall'Italia e dal mondo
La parlamentare del Fronte popolare, detenuta senza processo da otto mesi, verrebbe tenuta in uno stretto isolamento e sottoposta a gravi restrizioni nonostante le sue precarie condizioni di salute
L'articolo
Sull’arresto del fondatore di Telegram e le accuse di illiberalismo
[quote]Ma davvero cercare di regolamentare il Web e di responsabilizzarne gli attori sarebbero propositi illiberali? L’arresto, in Francia, del fondatore di Telegram Pavel Durov, l’avvio di un’indagine a suo carico da parte della Commissione europea e la sospensione di X decretata dalla Corte
Deca – Strategia esoterica
“Ogni mio nuovo lavoro rappresenta la summa e la sintesi di tutti quelli realizzati prima, evolvendone nuovamente il significato e la portata artistica. Credo che “Strategia Esoterica” abbia comunque una forza molto superiore perché frutto di una trasmutazione molto potente”- Deca @Musica Agorà
iyezine.com/deca-strategia-eso…
Deca - Strategia esoterica
Deca - Strategia esoterica - “Ogni mio nuovo lavoro rappresenta la summa e la sintesi di tutti quelli realizzati prima, evolvendone nuovamente il significato e la portata artistica.Massimo Argo (In Your Eyes ezine)
LIBRI. Laboratorio Palestina: l’esperienza sul campo si vende in armi
@Notizie dall'Italia e dal mondo
Antony Loeweisten, giornalista investigativo australiano, traccia la linea delle relazioni tra l’industria bellica israeliana e molti paesi del mondo. La vendita di armi emerge come priorità impellente per Tel Aviv a dispetto della natura politica dell’acquirente
L'articolo
Perù: FSC sospende la certificazione alla società di disboscamento, una vittoria per le organizzazioni indigene
@Notizie dall'Italia e dal mondo
La revoca completa della certificazione è stata richiesta dalle organizzazioni indigene peruviane in seguito alla pubblicazione delle immagini che mostrano che l'area è abitata da un
GAZA. Israele costruisce un nuovo corridoio per il controllo permanente
@Notizie dall'Italia e dal mondo
Cominciata a inizio novembre, secondo il Forensic Architecture, la costruzione della strada è costata la distruzione di fattorie, terreni agricoli, abitazioni, frutteti e garantirà alle truppe un accesso sicuro fin dentro Gaza City
L'articolo GAZA. Israele
È disponibile il nuovo numero della newsletter del Ministero dell’Istruzione e del Merito.
Ministero dell'Istruzione
#NotiziePerLaScuola È disponibile il nuovo numero della newsletter del Ministero dell’Istruzione e del Merito.Telegram
Pibiesse, la tipografia che guarda al futuro
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
La Pibiesse è una tipografia, ma anche un progetto di innovazione sociale che vuole diventare modello per la riqualificazione del territorio
L'articolo Pibiesse, la tipografia che guarda al futuro proviene da Valori.
Aerei e navi nella tassonomia europea: Bruxelles dovrà risponderne in tribunale
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
Bruxelles etichetta come “investimenti verdi” aerei e navi inquinanti: una coalizione di ong la trascina in tribunale
L'articolo Aerei e navi nella tassonomia europea: Bruxelles dovrà risponderne in tribunale proviene da Valori.
controinformazione.info/lucrai…
Bluesky experiences a massive new wave of signups from Brazil, Premium feeds with sub.club, and much more.
[share author='Laurens Hof' profile='https://fediversereport.com/author/laurenshof/' avatar='https://poliverso.org/photo/206608119366e42c304ffac007248590-5.jpeg?ts=1734620326' link='https://fediversereport.com/last-week-in-fediverse-ep-82/' posted='2024-09-01 18:04:28' guid='08552256-1db60dc7714646e3-cb23b587' message_id='https://fediversereport.com/last-week-in-fediverse-ep-82/']Last Week in Fediverse – ep 82
1 million new accounts on Bluesky as Brazil bans X, and premium feeds with Sub.club, and much much more.
Brazil bans X, and a signup wave to Bluesky
The Brazilian supreme court has banned the use of X in an ongoing legal fight with Elon Musk. The ban follows after a long trajectory of legal issues between the Brazilian government and Musk’s X. In April 2024, the Brazilian court ordered X to block certain X accounts that were allegedly related to the 2023 coup attempt, which Musk refused to do. In that same time period, President Luiz Inácio Lula da Silva opened an account on Bluesky, and there was already an inflow of a Brazilian community into Bluesky. Now, the legal fight has further escalated over X’s refusal to appoint a legal representative in the country, and Musk’s continuing refusal to comply with Brazil’s laws and regulation has resulted in the supreme court banning the use of X in the country altogether.
The ban on X has caused a massive signup wave to Bluesky, with over 1 million new accounts created in just three days, of which the large majority are from Brazil. The user statistics shot up even more than that, suggesting that there are a lot of people with an existing account logging back in as well.
The new inflow of people to Bluesky is having some significant effects on the network, as well as on the state of decentralised social networks more broadly:
- President Lula is putting actual focus on Bluesky. In one of his final posts on X, Luala listed in non-alphabetical order all other platforms that he is active on, and placed Bluesky at the top of the list. Posts by Lula that are placed on Bluesky (134k followers) as well as on Threads (2.4m followers) get more than 5 times as much likes on Bluesky. Today, Lula explicitly asked people on Bluesky what they thought about the platform, in a post that got over 30k likes and counting. It is hard to imagine that the Brazilian government is not paying attention to this all, and is looking which platform(s) the Brazilian community is moving towards in the wake of the ban on X.
- Brazilians are a very active community on the internet (see Orkut), and bring with them their own unique culture to Bluesky. The current decentralised social networks are heavily focused on US politics, judged by top posts on both Mastodon and Bluesky, and beyond shitposts and memes there is surprisingly little space for mainstream pop culture and sports. The Brazilian community does seem to bring a large number of pop culture and sports to Bluesky, significantly diversifying the topics of discussion, and in turn, creating more space for other people who are interested in that in the future. The activity of Brazilians on microblogging can also be seen in the like counts on popular posts of Bluesky: before this week, the most popular posts of any given day usually got around 3k likes, this has sprung up to 30k to 50k likes. Brazilians are so chatty in fact, that currently 81% of the posts on the network are in Portugese, and the amount of accounts of people who post on a given day has gone up from a third to over 50%.
- The Bluesky engineers have build a very robust infrastructure system, and the platform has largely cruised along fine without issues, even when faced with a 15x increase in traffic. This all without having to add any new servers. For third party developers, such as the Skyfeed developer, this increase in traffic did came with downtime and more hardware requirements however. It shows the complications of engineering an open system, while the Bluesky team itself was prepared with their core infrastructure, third party infrastructure, on which a large number of custom feeds rely, was significantly less prepared for the massive increase in traffic.
In contrast, the ban on X in Brazil has made little impact on Mastodon, with 3.5k new signups from Brazil on Mastodon.social. I’d estimate that this week has seen 10k new accounts above average, with 15k new accounts the previous week and 25k in this week. That places Mastodon two orders of magnitude behind Bluesky in signups from Brazil. There are a variety of reasons for this, which deserve their own analysis, this newsletter is long enough as it is. One thing I do want to point out is within fediverse community there are two sub communities that each have their own goals and ideas about the fediverse and growth. Some people responded with the news that most Brazilians went to Bluesky with type of response that indicated that they appreciate the small, quiet and cozy community that the fediverse currently provides, and a distrust of the growth-at-all-costs model for social networks. For other people however, their goal of the fediverse is to build a global network that everyone is a part of and everyone uses (‘Big Fedi’), a view of the fediverse that is also represented in the latest episode of the Waveform podcast (see news below). And if the goal is to build ActivityPub into the default protocol for the social web, it is worth paying attention to what is happening right now in the Brazilian ATmosphere.
The News
Sub.club is a new way to monetise feeds on the fediverse, with the goal of bringing the creator economy to the fediverse. It gives people the ability to create premium feeds that people can only access via a subscription. People can follow this feed from any Mastodon account (work on other fediverse platforms is ongoing). Sub.club handles the payment processes and infrastructure, for which they charge 6% of the subscription fee (compared to 8-12% Patreon charges). Sub.club also makes it possible for other apps to integrate, both IceCubes and Mammoth have this option. Bart Decrem, who is one of the people behind Sub.club, is also the co-founder of the Mastodon app Mammoth. Sub.club also explicitly positions itself as a way for server admins to fund their server. Most server admins rely on donations by their users, often via services like Patreon, Ko-fi, Open Collective or other third party options. By integration payments directly into the fediverse, Sub.club hopes that the barrier for donations will be lower, and more server admins can be financially sustainable.
Newsmast has build a new version of groups software for the fediverse, and the first group is dedicated to the Harris campaign. There are few types of groups available that integrate with Mastodon, such as with Friendica or a.gup.pe. These groups function virtually identical to hashtags, by boosting out posts where the group account is tagged in to everyone who follows the group account. As there is no moderation in these types of group accounts, it allows anyone to hijack the group account. A group account dedicated to a political campaign is especially vulnerable to this. On Mastodon a volunteer Harris Campaign group used a Friendica group for campaign organising, but the limited moderation tools (blocking a user from following the group) that are available are not working, which allowed blocked users to still get their posts boosted by the group account. Newsmast’s version of Groups gives (working) moderation tools, and only boosts top level comments and not replies, to cut down on the noise. For now, the new Group is only available to the Harris Campaign group for testing, but it will come later to Mastodon servers that run the upcoming Patchwork plugin.
Bluesky added quite a number of new anti-toxicity features in their most recent app update. Bluesky has added quote posting controls, allowing people to set on a per-post basis if people can quote the post or not. There is also the option to remove quotes after the fact as well: if you’ve allowed quote posts on a post you’ve made, but someone made a quote post that you do not feel comfortable with, you have the possibility to detach your post. Another update is the possibility to hide replies on your posts. Bluesky already hides comments under a ‘show more’ button if the comment is labeled by a labeler you subscribe to. You now have the option to do so on all comments that are made on your posts, and the hidden comment will be hidden for everyone. Finally, Bluesky has changed how replies are shown in the Following feed, which is an active subject of discussion. I appreciate the comments made by Bluesky engineer Dan Abramov here, who notes there are two different ways of using Bluesky, who each prioritise comments in conflicting ways. As new communities grow on Bluesky, prioritising their (conflicting) needs becomes more difficult, and I’m curious to see how this further plays out.
The WVFRM (Waveform) podcast of popular tech YouTuber MKBHD has a special show about the fediverse, ‘Protocol Wars – The Fediverse Explained!’. It is partially a discussion podcast, partial explainer, and partial interview with many people within the community. They talk with Mastodon’s Eugen Rochko, Bluesky’s Jay Graber, Threads’s Adam Mosseri, and quite some more people. It is worth noting for a variety of reason. The show is quite a good introduction, that talks to many of the most relevant names within the community. MKBHD is one of the biggest names in the tech creator scene, and many people are paying attention to what he and his team is talking about. Furthermore, I found the framing as ‘protocol wars’ interesting, as the popularity of Bluesky in Brazil as an X replacement indicates that there is indeed a race between platforms to be build on top of the new dominant protocol.
Darnell Clayton has a very interesting blog post, in which he discovers that there is a discrepancy in follower count for Threads accounts that have turned on fediverse sharing. Clayton notes that the follower count shown in the Threads app is lower than the one shown in a fediverse client, for both Mastodon and Flipboard. He speculates that this difference is the number of fediverse accounts that follow a Threads account. It should be noted that this is speculation and has not been confirmed, but if this is true, it would give us a helpful indication of how many fediverse accounts are using the connection with Threads. While we’re talking about Threads accounts, Mastodon CEO Eugen Rochko confirmed that the mastodon.social server has made a connection with 15.269 Threads accounts who have turned on fediverse sharing.
The Links
- Threads has figured out how maximise publicity by making minimal incremental updates to their ActivityPub implementation, edition 500.
- A Developer’s Guide to ActivityPub and the Fediverse – The New Stack interviews Evan Prodromou about his new book about ActivityPub.
- FedIAM is a research project where people can use fediverse and Indieweb protocols for logging in.
- You can now test Forgejo’s federation implementation.
- This week’s fediverse software updates.
- Ghost’s latest update on their work on implementing ActivityPub: “With this milestone, Ghost is for the first time exceeding the functionality of a basic RSS reader. This is 2-way interaction. You publish, and your readers can respond.”
- Dhaaga is a multiplatform fediverse client that adds unique client-side functionalities.
- Lotide, a experimental link-aggregator fediverse platform, ceases development.
- A custom QR code generator, which some pretty examples of custom QR codes for your fediverse profile.
- Custom decentralised badges on atproto with badges.blue, a new work in process by the create of atproto event planner Smoke Signal.
- Smoke Signal will be presenting at the next version of the (third party organised) ATproto Tech Talk.
That’s all for this week, thanks for reading.
Ieri avevo in programma un giro per negozi di biciclette per vedere e provare un po' di bici elettriche. Uno di questi si trova a Spandau, che rispetto a casa mia è inculatissima (un'ora di viaggio minimo) per cui ho unito l'utile al dilettevole e con l'occasione sono stata anche a visitare la Cittadella.
Vista dalla Juiliusturm (1230), dicono il più antico edificio preservato di Berlino.
Questa scelta mi ha innanzitutto regalato la conoscenza degli Heilung, band che pesta tantissimo e che suonava la sera stessa proprio nella Cittadella. I tecnici che ne facevano il soundcheck mentre io gironzolavo me li hanno fatti apprezzare. Se amate la musica che pesta tantissimo date loro un orecchio, secondo me possono messere d'accordo gente dai gusti diversi (purché pestino! L'ho detto che pestanopestanopestano?).
Poi va detto che il biglietto di ingresso a 4,50 € stracciati dà accesso a tutti e sei i musei presenti nel complesso, piccoli, diversi, ma tutti meritevoli. Ho saltato solo il Centro d'Arte Contemporanea perché chiuso per allestimento di una mostra.
Prima fermata: la "finestra archeologica"
Qui sono conservati gli scavi archeologici che hanno portato alla luce le tre fasi costruttive della fortificazione. Dal XIII al XVI secolo si vede l'evoluzione dalla prima palizzata in legno, alle mura in pietra medievali, al castello in stile rinascimentale e mattoni rossi oggi visibile. Vengono spiegati anche dettagli ingegneristici, tipo che per costruire i bastionazzi così come sono oggi hanno "sbrodolato" fuori dai confini dell'isoletta su cui era sorto il nucleo originario. Per costruire in acqua hanno praticamente fatto una fitta base di "denti" di legno su cui poi è stata costruita la struttura attuale. Che non sia sprofondato tutto per me ha del miracoloso.
Seconda fermata: il museo civico di Spandau
Qui sono esposti reperti della storia di Spandau: dalle repliche dei documenti ufficiali, agli oggetti di uso comune, al prodotto dell'industria qui storicamente stanziata, al (ovviamente) nazionalsocialismo, alla divisione.
Questi sono giocattoli, che già di per sé mi fa rabbrividire. Alle stuatuine di Hitler e Göring si può alzare il braccino per fargli fare il saluto nazista. Ha un sapore distopico, invece è successo davvero: dei bambini hanno giocato con 'sta roba.
Gironzolando qui ho scoperto che parte di Metropolis è stata girata a Spandau (pensavo solo ai Babelstudios, e invece) e c'è un memoriale di una persona che ha partecipato alla produzione che vorrò leggere per intero. Amo Metropolis!
Terza fermata: la sala d'armi (o come diavolo vogliamo tradurre Exerzierhalle)
Qui sono conservati cannoni. Decine e decine di cannoni. Il più vecchio è del primo '400, il più giovane risale alla Prima Guerra Mondiale.
Immaginate di stare accovacciati qui dietro a sparare al "nemico".
La sala è chiusa e, con il caldo, dentro ristagna un odore che ricorda un'officina meccanica, ma con un "twist" tutto suo. Il mio cervello lo ha etichettato come "odore di guerra", ma non penso che sul campo la puzza fosse quella (o almeno non soltanto quella).
Toccacciando in giro (perché qui è concesso mettere le mani sugli artefatti) ho poi constato come ci sia stata un'epoca, tra '600 e '700, in cui usava mettere motti vari sui cannoni. Questo qua mi ha colpita di più:
Dice:"Saturnus frist (!) die Kind allein ich fress sie aller gros (!) und klein" (grossomodo: "Saturno mangia solo i bambini, io mangio tutti, grandi e piccini". Che detto da un cannone ci sta).
Quarta tappa: il deposito provvigioni
Questo è un edificio del periodo rinascimentale, in parte ricostruito, oggi adibito a galleria che preserva una serie di monumenti scultorei precedentemente sparsi per Berlino dal XVIII al XX secolo. Praticamente un consesso di figure rilevanti per la storia della città (e non solo). Alla fine c'è anche lui: il capoccione di Lenin!
Avete presente il megaprogetto di Hitler per la trasformazione di Berlino nella "Welthauptstadt Germania"? Come doveva diventare una città monumentale, con al centro un ipermega edificio celebrativo? Ecco. Questo plastico rende l'idea di quanto megalomane fosse il progetto di quell'edificio: quella cosina a destra è la porta di Brandeburgo, in scala.
Quinta tappa: la casa del comandante
L'ho vista per ultima, ma, essendo sopra la biglietteria, in realtà si potrebbe vedere anche come prima cosa. Qui sono conservati reperti e documenti della storia della Cittadella, altri dettagli sulle fasi costruttive, ma anche flora e fauna del luogo.
Che dire alla fine di tutto questo? Ma niente, solo che ogni volta che sfioro la storia di questa città il brivido lungo la schiena è assicurato. Qua sono successe cose folli.
(Oh, le bici in tutto questo le ho provate eh. Ho due candidate tra cui decidere).
GAZA. Israele costruisce un nuovo corridoio per il controllo permanente
@Notizie dall'Italia e dal mondo
Cominciata a inizio novembre, secondo il Forensic Architecture, la costruzione della strada è costata la distruzione di fattorie, terreni agricoli, abitazioni, frutteti e garantirà alle truppe un accesso sicuro fin dentro Gaza City
L'articolo GAZA. Israele
Recensione : MELT-BANANA – 3 + 5
MELT-BANANA - 3 + 5
MELT-BANANA - 3 + 5 - "Che cazzo è 'sta roba?!?!?!?" si chiese meravigliato chi vi scrive, quando ha scoperto dell'esistenza, anni fa, dei giapponesi Melt-Banana, dal 1992 tra i principali agitatori della scena/movimento concettuale "Japanoise", vale…Reverend Shit-Man (In Your Eyes ezine)
Il Burkina Faso ha deciso di nazionalizzare le miniere d’oro l L'Indipendente
"L’azione del governo di Ouagadougou rientra in un contesto più ampio, che vede sempre più nazioni africane riappropriarsi delle proprie risorse per orientarne i profitti a beneficio dello sviluppo nazionale e non di società straniere. Una tendenza ancora più marcata in quegli Stati africani desiderosi di riacquisire la propria indipendenza politica e strategica dalle direttive neocoloniali occidentali."
lindipendente.online/2024/08/3…
La morte e la legge
L'articolo La morte e la legge proviene da Fondazione Luigi Einaudi.
reshared this
Ordine marittimo globale. Ecco cosa porta il Cavour (e la Nato) nell’Indo Pacifico
[quote]Cosa è andato a fare il carrier strike group guidato dalla portaerei Cavour fino a Tokyo? La diplomazia navale – certo. Le esercitazioni – senz’altro. Il partenariato col Giappone, trainato dal Gcap – ovviamente. Ma perché? Se lo è chiesto Alessio Patalano – Professore
ivdp.it/articoli/caccia-f16-il…
ivdp.it/articoli/l-globalismo-…
like this
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 reshared this.
Dottor S. likes this.
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 likes this.
Come difendersi dagli attacchi cyber? Parla Galtieri
[quote]In un’era dominata dalla digitalizzazione e dalle crescenti minacce informatiche, diventa essenziale potenziare le capacità nazionali a livello di cybersecurity. E il consolidamento di tali capacità non può non passare per il rafforzamento cibernetico delle piccole e medie imprese, vera struttura portante del tessuto economico
Destra e sinistra? Time out. Un terzo polo avrebbe il 10%, lo spazio c’è
L'articolo Destra e sinistra? Time out. Un terzo polo avrebbe il 10%, lo spazio c’è proviene da Fondazione Luigi Einaudi.
Apple’s Huge “Dual Use” Face Swap App Problem Is Not Going Away
Maybe Apple should ban face swapping apps entirely.Emanuel Maiberg (404 Media)
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕
in reply to 𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 • •RaccoonForFriendica reshared this.
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕
in reply to 𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 • •RaccoonForFriendica reshared this.