Gli esperti di sicurezza informatica chiedono un aggiornamento immediato dei server di posta Zimbra, poiché una nuova vulnerabilità critica viene già sfruttata attivamente dagli hacker.

La vulnerabilità con l’identificatore CVE-2024-45519 è stata scoperta il 27 settembre. Proofpoint riferisce che gli attacchi ai server vulnerabili sono iniziati il ​​giorno dopo la sua pubblicazione.

Secondo l’analisi di Project Discovery, il problema risiede nella libreria postjournal di Zimbra ed è dovuto a una convalida insufficiente dell’input dell’utente. Gli hacker possono aggiungere indirizzi falsi al campo CC nelle e-mail mascherate da Gmail. Di conseguenza, al posto degli indirizzi reali, nel campo compaiono stringhe in formato base64, che vengono elaborate dai server di posta Zimbra.

Lo sfruttamento della vulnerabilità consente agli aggressori di ottenere accesso non autorizzato, aumentare i privilegi e compromettere la sicurezza del sistema. Project Discovery segnala che anche le versioni non aggiornate di Zimbra possono proteggere parzialmente dall’attacco, ma piccoli cambiamenti nella sintassi dei comandi possono aggirare questa protezione.

Secondo Proofpoint, gli stessi server utilizzati per inviare e-mail dannose vengono utilizzati anche per scaricare e installare malware sui sistemi compromessi. Gli hacker stanno tentando di creare web shell sui server Zimbra vulnerabili, consentendo loro di eseguire comandi e scaricare file da remoto.

Ivan Kvyatkovsky, ricercatore capo sulle minacce informatiche presso HarfangLab, ha avvertito che sono già iniziati attacchi massicci e consiglia vivamente agli utenti Zimbra di installare immediatamente gli aggiornamenti.

Secondo la pagina di consulenza sulla sicurezza di Zimbra, la vulnerabilità è stata scoperta dallo studente Alan Lee presso l’Università Nazionale Yang Ming Chao Tung di Taiwan. Sebbene non gli sia stato ancora assegnato un livello di minaccia ufficiale, i ricercatori di Project Discovery lo hanno classificato come “critico” a causa delle gravi minacce alla sicurezza.

Il National Vulnerability Database (NVD) ha assegnato alla vulnerabilità un identificatore CVE. Tuttavia, a causa dell’elevato carico di lavoro dell’organizzazione, il processo di analisi delle vulnerabilità subisce ritardi. Nel febbraio di quest’anno, NVD ha affermato che occorreva tempo per “affrontare i problemi del programma NVD e sviluppare strumenti e tecniche migliorati”. Secondo VulnCheck, a maggio il 93,4% di tutte le vulnerabilità non disponeva di informazioni sufficienti per fornire protezione.

Il National Institute of Standards and Technology (NIST), che gestisce NVD, ha firmato a maggio un contratto con Analygence per accelerare l’elaborazione delle vulnerabilità. Nonostante i progressi, il 14,1% delle nuove vulnerabilità rimane ancora senza classificazione, nonostante il NIST abbia promesso il completamento entro il 30 settembre.

L'articolo IL Bug CVE-2024-45519 su Zimbra è Sfruttata Attivamente: Aggiornamento Immediato dei Server proviene da il blog della sicurezza informatica.

For as long as AI Large Language Models have been around (well, for as long as modern ones have been accessible online, anyway) people have tried to coax the models into revealing their system prompts. The system prompt is essentially the model’s fundamental directives on what it should do and how it should act. Such healthy curiosity is rarely welcomed, however, and creative efforts at making a model cough up its instructions is frequently met with a figurative glare and stern tapping of the Terms & Conditions sign.

Anthropic have bucked this trend by making system prompts public for the web and mobile interfaces of all three incarnations of Claude. The prompt for Claude Opus (their flagship model) is well over 1500 words long, with different sections specifically for handling text and images. The prompt does things like help ensure Claude communicates in a useful way, taking into account the current date and an awareness of its knowledge cut-off, or the date after which Claude has no knowledge of events. There’s some stylistic stuff in there as well, such as Claude being specifically told to avoid obsequious-sounding filler affirmations, like starting a response with any form of the word “Certainly.”

While the source code (and more importantly, the training data and resulting model weights) for Claude remain under wraps, Anthropic have been rather more forthcoming than others when it comes to sharing other details about inner workings, showing how human-interpretable features and concepts can be extracted from LLMs (which uses Claude Sonnet as an example).

Naturally, safety is a concern with LLMs, which is as good an opportunity as any to remind everyone of Goody-2, undoubtedly the world’s safest AI.

hackaday.com/2024/10/12/all-sy…

A regular comment we see on electric aircraft is to “just add solar panels to the wings.” [James] from Project Air has been working on just such a solar plane, and as he shows in the video after the break, it is not a trivial challenge.

A solar RC plane has several difficult engineering challenges masquerading as one. First, you need a solid, efficient airframe with enough surface area for solar panels. Then, you need a reliable, lightweight, and efficient solar charging system and, finally, a well-tuned autopilot to compensate for a human pilot’s limited endurance and attention span.

In part one of this project, a fault in the electrical system caused a catastrophe so James started by benching all the electricals. He discovered the MPPT controller had a battery cutoff feature that he was unaware of, which likely caused the crash. His solution was to connect the solar panels to the input of a 16.7 V voltage regulator—just under the fully charged voltage of a 4S LiPo battery— and wire the ESC, control electronics, and battery in parallel to the output. This should keep the battery charged as long as the motor doesn’t consume too much power.

After rebuilding the airframe and flight testing without the solar system, [James] found the foam wing spars were not up to the task, so he added aluminum L-sections for stiffness. The solar panels and charging system were next, followed by more bench tests. On the test flight, it turned out the aircraft was now underpowered and struggled to gain altitude thanks to the added weight of the solar system. With sluggish control responses,[James] eventually lost sight of it behind some trees, which led to a flat spin and unplanned landing.

Fortunately, the aircraft didn’t sustain any damage, but [James] plans to redesign it anyway to reduce the weight and make it work with the existing power system.

We’ve seen several solar planes from [rctestflight] and meticulously engineered versions from [Bearospace Industrues]. If long flight times is primarily what you are after, you can always ditch the panels and use a big battery for 10+ hour flights.

youtube.com/embed/xp0TCoPgcdM?…

hackaday.com/2024/10/12/solar-…

Physicist John Archibald Wheeler made groundbreaking contributions to physics, and [Amanda Gefter] has a fantastic writeup about the man. He was undeniably brilliant, and if you haven’t heard of him, you have certainly heard of some of his students, not to mention his work.

Ever heard of wormholes? Black holes? How about the phrase “It from Bit”? Then you’ve heard of his work. All of those terms were coined by Wheeler; a knack for naming things being one of his talents. His students included Richard Feynman and Kip Thorne (if you enjoyed The Martian, you at least indirectly know of Kip Thorne) and more. He never won a Nobel prize, but his contributions were lifelong and varied.

One thing that set Wheeler apart was the highly ambitious nature of his research and inquiries. He was known for pushing theories to (and past) their absolute limits, always seeking deeper insights into the nature of reality. The progress of new discoveries in the fields of general relativity (for which his textbook, Gravitation, remains highly relevant), space-time, and quantum mechanics frequently left Wheeler feeling as though more questions were raised than answered. His thirst for a greater understanding of the nature of reality was one he pursued until his death in 2006. He pondered not just the ultimate nature of our universe but also why we seem to have the same basic experience of it. Wheeler saw these questions as having answers that were far from being self-evident.

Wheeler’s relentless curiosity pushed the boundaries, reminding us that the search for knowledge never truly ends. If that inspires you, then take the time to check out the full article and see whether his questions inspire and challenge your own perspective.

Scientists can now make black holes — sort of. You can even make your own wormhole. Sort of.

hackaday.com/2024/10/12/rememb…

"La Richard-Ginori, ufficialmente fallita nel gennaio 2013, è stata acquistata nel maggio 2013 dal gruppo Gucci[1], a sua volta controllato dalla società francese Kering."
(da Wikipedia)

E voi che pensavate alla RIchard Ginori come un'eccellenza tutta italiana, eh?

Francesi, i soldi e la proprietà sono dei francesi