Salta al contenuto principale


DK 9x09 - Quo usque tandem


Due notiziole da picchi di cristomadonio, META e le pubblicità "meno personalizzate" e la chiesa con il Gesù digitale; e una terza da far saltare le valvole: Anthropic paga un tizio per occuparsi di "AI welfare".
È ancora possibile vivere in questi tempi e rimanere sani di mente? E a quale punto è lecito spaccare tutto e ritirarsi a preparare la parnigiana di melanzane?


spreaker.com/episode/dk-9x09-q…



This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we talk about traffic, a return to Azeroth, egg prices and bullying.#BehindTheBlog


Fully Submerge This Modernized pH Sensor


26494862

There’s a school of thought that says you shouldn’t mess around with a solution that’s already working, but that’s never seemed to stop anyone in this community. When [Skye] was looking at the current state of connected pH meters they realized there was incredible room for improvement.

Called the Nectar Monitor, this pH meter is a more modern take on what is currently offered in this space. Open source and based on the ESP32, it’s accessible to most people with a soldering iron, fits into a standard project box, and includes other modern features like USB and WiFi connectivity. It can even measure conductivity and temperature. But the main improvement here is that unlike other monitors that can only be submerged temporarily, this one is designed to be under water for long time periods thanks to a specially designed probe and electrical isolation.

This design makes it an appealing choice for people with aquariums, hydroponic farms, or any other situation where constant monitoring of pH is extremely important to maintaining a balanced system. We’ve seen some unique takes on hydroponics before especially, including this build that moves the plants instead of the nutrient solution and this fully automated indoor garden.


hackaday.com/2024/11/29/fully-…



Pagamenti con Pos e Bancomat, continuano i problemi: cosa è successo e quando saranno risolti

I problemi con i pagamenti elettronici proseguono ancora oggi, venerdì 29 novembre 2024. Il down di Bancomat, PagoBancomat e Nexi è iniziato alle 11:25 di giovedì 28 con picchi di segnalazioni attorno alle 14:00. Un nuovo picco è stato registrato questa mattina alle 08:00. I disservizi sono legati a problemi sulla rete della società francese Worldline.

fanpage.it/innovazione/tecnolo…

@Informatica (Italy e non Italy 😁)

reshared this




Black Friday in Tilt: Lavori Stradali Mandano KO i Pagamenti Digitali in Italia


Non è la prima volta che in Italia infrastrutture critiche vengono messe fuori uso da problemi legati a cavi danneggiati o rotture di fibre ottiche. Episodi simili dimostrano quanto sia urgente investire di più nella resilienza delle reti, garantendo piani di emergenza efficaci. Non si tratta solo di affrontare minacce legate alla sicurezza informatica, come attacchi cyber, ma anche di prevenire e gestire incidenti legati alla normale amministrazione, come lavori stradali o errori tecnici. In un’epoca in cui i servizi digitali sono il cuore pulsante dell’economia e della società, quello che si chiama “single point of failure” non può essere ammesso, soprattutto sotto la pressione delle speso folli del Black Friday.

La società francese di pagamenti digitali Worldline ha dichiarato venerdì che i lavori stradali del gas hanno danneggiato accidentalmente la connessione di rete ai suoi data center in Italia, interrompendo i servizi per i clienti e causando problemi che devono ancora essere risolti.

L’interruzione si è verificata nel pieno dell’intensa stagione degli acquisti del Black Friday.

Worldline ha dichiarato in una nota che i suoi servizi di pagamento sono stati interrotti da giovedì mattina, principalmente in Italia ma anche in altri mercati non specificati.

La causa dell’interruzione è stata identificata. L’installazione di tubi del gas da parte delle autorità locali ha danneggiato gravemente i cavi e la rete del nostro fornitore. I lavori di ripristino da parte del nostro fornitore dovrebbero iniziare più tardi oggi“, ha affermato la società.

Worldline ha aggiunto che sta lavorando “instancabilmente” per verificare se è possibile riattivare i servizi prima che la sua infrastruttura fisica venga riparata e si è scusata con i consumatori e i negozianti per l’inconveniente.

In una dichiarazione separata, il gruppo italiano di pagamenti Nexi ha confermato che Worldline non ha ancora risolto il problema e ha affermato di aver avviato un’indagine e di riservarsi il diritto di adottare misure per proteggere l’azienda e i suoi clienti.

Anche la Banca d’Italia è intervenuta, affermando che stava monitorando la situazione. “Alcuni dei servizi di pagamento interessati sono stati riattivati, mentre permangono malfunzionamenti per alcuni circuiti di carte di credito e di debito”, ha affermato la banca centrale.

L'articolo Black Friday in Tilt: Lavori Stradali Mandano KO i Pagamenti Digitali in Italia proviene da il blog della sicurezza informatica.



Sciopero generale, Landini: “Siamo in 500mila per rimettere al centro le persone, non il profitto” | VIDEO


@Politica interna, europea e internazionale
“Più di 500mila persone oggi in Italia hanno scelto di essere in piazza per difendere la libertà e i diritti di tutti. E il messaggio molto chiaro è che non solo la piazza non si precetta ma che non siamo qui tutti insieme per difendere l’integrità



Low-Profile Travel Keyboard Is Mostly 3D Printed


26480570

If you’ve got a nice mechanical keyboard, typing on anything else can often become an unpleasant experience. Unfortunately, full-sized versions are bulky and not ideal when you’re travelling or for certain portable applications. [Applepie1928] decided to create a small travel keyboard to solve these problems.

Meet the Micro Planck. It’s a simple ortholinear mechanical keyboard in a decidedly compact form factor—measuring just 23 cm wide, 9.5 cm tall, and 2 cm deep. You could probably stuff it in your pocket if you wear baggy jeans. Oh, and if you don’t know what ortholinear means, it just means that the keys are in a straight grid instead of staggered. Kind of like those “keyboards” at the bowling alley.

The build relies on Gateron KS-33 switches installed on a custom PCB, with a ATmega32U4 microcontroller running the popular open source QMK firmware. The keyboard has a USB-C port because it’s 2024, and all the components are wrapped up in a neat 3D printed shell.

Overall, it’s a tasteful design that packs in a lot of functionality. It’s also neat to see a mechanical design used which offers more tactile feedback than the rubber dome designs more typical at this scale. Meanwhile, if you’re cooking up your own nifty keyboard designs, don’t hesitate to let us know what you’re up to!


hackaday.com/2024/11/29/low-pr…




IT threat evolution in Q3 2024. Non-mobile statistics


26473866

IT threat evolution in Q3 2024
IT threat evolution in Q3 2024. Non-mobile statistics
IT threat evolution in Q3 2024. Mobile statistics

The statistics presented here are based on detection verdicts by Kaspersky products and services received from users who consented to providing statistical data.

Quarterly figures


In Q3 2024:

  • Kaspersky solutions successfully blocked more than 652 million cyberattacks originating from various online resources.
  • Web Anti-Virus detected 109 million unique links.
  • File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects.
  • More than 90,000 users experienced ransomware attacks.
  • Nearly 18% of all victims published on ransomware gangs’ data leak sites (DLSs) had been hit by RansomHub.
  • More than 297,000 users experienced miner attacks.


Ransomware

Quarterly trends and highlights
Progress in law enforcement


In August, Spain arrested a cybercriminal who founded Ransom Cartel in 2021 and set up a malvertizing campaign. According to the UK’s National Crime Agency (NCA), this individual also was behind the infamous Reveton ransomware Trojan spread in 2012 — 2014. Reveton was among the most notorious PC screen lockers. This type of cyberextortion predated Trojans, which encrypt the victim’s files.

Two other cybercriminals, arrested earlier and suspected of spreading LockBit, pleaded guilty. In 2020 — 2023, one of them was an active cyberextortionist who attacked organizations in several countries, causing a total of at least $1.9 million in damage. The other one, according to the source, had caused damage estimated at roughly $500,000.

Vulnerability exploitation attacks


Ransomware gangs continue to exploit software vulnerabilities, mostly to penetrate networks and escalate their privileges.

  • In September the Akira ransomware attacked SonicWall devices powered by SonicOS to exploit the CVE-2024-40766 vulnerability in the operating system, patched in August.
  • Akira and Black Basta launched ransomware attacks on VMware ESXi by exploiting the CVE-2024-37085 vulnerability in the hypervizor, which allowed escalating privileges.


High-profile incidents


Dark Angels, which operates a DLS known as “Dunghill Leak”, extracted what was probably the largest ransom payment ever: $75 million. Researchers who reported the incident did not mention the organization that paid up. Before that, the highest known ransom paid was $40 million, received by Phoenix ransomware operators from CNA Financial in 2021.

The most prolific groups


The statistics on the most prolific ransomware gangs draw on the number of victims added by attackers to their DLSs during the period under review. The third quarter’s most prolific ransomware gang was RansomHub, which accounted for 17.75% of all victims.

The group’s victims according to its DLS as a percentage of all groups’ published victims during the period under review (download)

Number of new modifications


In Q3 2024, we detected three new ransomware families and 2109 new variants, or half of what we discovered in the previous reporting period.

New ransomware modifications, Q3 2023 — Q3 2024 (download)

Number of users attacked by ransomware Trojans


Despite the decrease in new variants, the number of users encountering ransomware has increased compared to the second quarter. Kaspersky security solutions successfully defended 90,423 individual users from ransomware attacks from July through September 2024.

Unique users attacked by ransomware Trojans, Q3 2024 (download)

Geography of attacked users
TOP 10 countries attacked by ransomware Trojans
Country/territory*%**
1Israel1.08
2China0.95
3Libya0.68
4South Korea0.66
5Bangladesh0.50
6Pakistan0.48
7Angola0.46
8Tajikistan0.41
9Rwanda0.40
10Mozambique0.38

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.

TOP 10 most common families of ransomware Trojans
NameVerdictShare of attacked users*
1(generic verdict)Trojan-Ransom.Win32.Gen23.77%
2WannaCryTrojan-Ransom.Win32.Wanna8.58%
3(generic verdict)Trojan-Ransom.Win32.Encoder7.25%
4(generic verdict)Trojan-Ransom.Win32.Crypren5.70%
5(generic verdict)Trojan-Ransom.Win32.Agent4.25%
6(generic verdict)Trojan-Ransom.MSIL.Agent3.47%
7LockBitTrojan-Ransom.Win32.Lockbit3.21%
8(generic verdict)Trojan-Ransom.Win32.Phny3.18%
9PolyRansom/VirLockVirus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom2.97%
10(generic verdict)Trojan-Ransom.Win32.Crypmod2.50%

* Unique Kaspersky users attacked by the ransomware Trojan family as a percentage of all users attacked by ransomware Trojans.

Miners

Number of new modifications


In Q3 2024, Kaspersky solutions detected 15,472 new miner variants, or twice fewer than in Q2.

New miner modifications, Q3 2024 (download)

Users attacked by miners


We observed a 12% decline in miner-related attacks during the third quarter. Kaspersky solutions worldwide detected this type of malware on 297,485 unique user devices.

Unique users attacked by miners, Q3 2024 (download)

Geography of miner attacks
TOP 10 countries attacked by miners
Country/territory*%
1Venezuela1.73
2Tajikistan1.63
3Kazakhstan1.34
4Ethiopia1.30
5Uzbekistan1.20
6Belarus1.20
7Kyrgyzstan1.16
8Panama1.10
9Bolivia0.92
10Sri Lanka0.87

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.

Attacks on macOS


Password stealers were the third quarter’s most noteworthy findings associated with attacks on macOS users. Security researchers discovered two new subscription-based stealers, Banshee Stealer and Ctulhu Stealer, which were being distributed via Telegram channels and dark web forums. These bore a strong similarity to the previously known AMOS Trojan, but they were written in C++ and Go, respectively. Furthermore, an independent security researcher released an analysis of a new version of BeaverTail, another type of information stealer designed to exfiltrate data from web browsers and cryptocurrency wallets. This malware also possessed the capability to install a backdoor on compromised systems.

In addition to the new stealers, the third quarter saw the discovery of a new macOS backdoor. HZ Rat is the macOS-compatible version of a similarly named Windows backdoor. It targets the users of the Chinese messaging services WeChat and DingTalk.

TOP 20 threats to macOS

Unique users* who encountered the threat as a percentage of all users of Kaspersky security solutions for macOS who were attacked (download)

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

Adware and other potentially unwanted applications were as usual the most widespread threats for macOS. For example, AdWare.OSX.Angent.ap (9%) adds advertising links as browser bookmarks without the user’s knowledge.

Additionally, a variety of malicious applications were among the most active threats. These included MalChat (5.08%), a modified Telegram client that stole user data, and Amos, a stealer often bundled with cracked software.

Geography of threats to macOS
TOP 10 countries and territories by share of attacked users
Q2 2024*Q3 2024*
Mainland China0.47%1.47%
Hong Kong0.97%1.36%
Spain1.14%1.21%
France0.93%1.16%
Germany0.59%0.95%
Mexico1.09%0.75%
Brazil0.57%0.61%
India0.70%0.46%
Russian Federation0.33%0.37%
Japan0.22%0.36%

** Unique users who encountered threats targeting macOS as a percentage of all unique users of Kaspersky products in the country/territory.

There was a noticeable increase in the percentage of users who encountered macOS threats in mainland China (1.47%) and Hong Kong (1.36%). The metric also increased in Spain (1.21%), France (1.16%), Germany (0.95%), Brazil (0.61%), Russia (0.37%), and Japan (0.36%). Conversely, India (0.46%) and Mexico (0.75%) both experienced a slight decrease. Both the United Kingdom and Italy fell out of the TOP 10 most vulnerable countries.

IoT threat statistics


The distribution of devices that targeted Kaspersky honeypots across protocols went through only minor shifts in Q3 2024. Following a decline in the previous quarter, Telnet attacks witnessed a slight uptick, while SSH-based attacks decreased.

Attacked services by number of unique attacking device IP addresses, Q2 — Q3 2024 (download)

When analyzing the distribution of attacks across different protocols, we observed a slight increase in the share of Telnet, which accounted for 98.69% of all attacks.

Distribution of attackers’ sessions in Kaspersky honeypots, Q2 — Q3 2024 (download)

TOP 10 threats downloaded to IoT devices:

Share of each threat uploaded to an infected device as a result of a successful attack in the total number of uploaded threats (download)

Attacks on IoT honeypots


There was a slight decrease in the percentage of SSH attacks originating in mainland China (22.72%), the United States (11.31%), Singapore (5.97%) and South Korea (4.28%). The freed percentage was distributed across other countries and territories.

Country/territoryQ2 2024Q3 2024
Mainland China23.37%22.72%
United States12.26%11.31%
Singapore6.95%5.97%
India5.24%5.52%
Germany4.13%4.67%
South Korea6.84%4.28%
Australia2.71%3.53%
Hong Kong3.10%3.23%
Brazil2.73%3.17%
Indonesia1.91%2.77%

The percentage of Telnet attacks originating in India (32.17%) increased, surpassing other countries and territories.

Country/territoryQ2 2024Q3 2024
India22.68%32.17%
Mainland China30.24%28.34%
Tanzania0.01%5.01%
Brazil4.48%2.84%
Russian Federation3.85%2.83%
South Korea2.46%2.63%
Taiwan2.64%2.42%
United States2.66%2.34%
Japan3.64%2.21%
Thailand2.37%1.35%

Attacks via web resources


The statistics in this section are based on data provided by Web Anti-Virus, which protects users when malicious objects are downloaded from malicious or infected web pages. Cybercriminals set up malicious pages on purpose. User-generated content platforms, such as forums, and compromised legitimate websites are both susceptible to malware infection.

Countries that serve as sources of web-based attacks: the TOP 10


The following statistics show the geographic distribution of sources of online attacks on user computers that were blocked by Kaspersky products. These attacks included web pages redirecting to exploits, websites hosting exploits and other malware, botnet command and control centers, and so on. Any unique host could be the source of one or more web-based attacks.

To determine the geographical origin of web-based attacks, we mapped the domain names to the domain IP addresses and determined the geographical location of the IP address (GEOIP).

In Q3 2024, Kaspersky solutions blocked 652,004,741 attacks from online resources located around the world. A total of 109,240,722 unique URLs triggered a Web Anti-Virus detection.

Geographical distribution of web-based attack sources, Q3 2024 (download)

Countries and territories where users faced the greatest risk of online infection


To assess the risk of online malware infection faced by users in various countries and territories, for each country or territory, we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.

These rankings only include attacks by malicious objects that belong in the Malware category. Our calculations do not include Web Anti-Virus detections of potentially dangerous or unwanted applications, such as RiskTool or adware.

Country/territory*%**
1Qatar11.95
2Peru11.86
3Morocco11.56
4Algeria11.52
5Tunisia11.24
6Greece11.11
7Ecuador10.95
8Bolivia10.90
9Serbia10.82
10Bahrain10.75
11Sri Lanka10.62
12Slovakia10.58
13Bosnia and Herzegovina10.29
14Botswana10.01
15Egypt9.93
16North Macedonia9.91
17Libya9.87
18Jordan9.85
19Thailand9.67
20UAE9.62

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users targeted by Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.

On average during the quarter, 7.46% of internet users’ computers worldwide were subjected to at least one Malware-category web attack.

Local threats


Statistics on local infections of user computers are an important indicator. Objects detected as local are those that infiltrated a computer through file or removable media infection or were initially introduced to the computer in a non-obvious form, for example as programs included in complex installers, encrypted files, and so on.

Data in this section is based on analyzing statistics produced by Anti-Virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from OAS (on-access scan) and ODS (on-demand scan) modules, which were consensually provided by users of Kaspersky products. The data includes detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones or external hard drives.

In Q3 2024, Kaspersky File Anti-Virus detected 23,196,497 malicious and potentially unwanted objects.

Countries and territories where users faced the highest risk of local infection


For each country and territory, we calculated the percentage of Kaspersky users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries and territories worldwide.

These rankings only include attacks by malicious objects that belong in the Malware category. Our calculations exclude File Anti-Virus detections of potentially dangerous or unwanted applications, such as RiskTool or adware.

Country/territory*%**
1Turkmenia46.00
2Afghanistan38.98
3Yemen38.43
4Tajikistan34.56
5Cuba33.55
6Syria32.56
7Uzbekistan30.45
8Niger27.80
9Burkina Faso27.55
10Burundi27.27
11Bangladesh27.24
12South Sudan26.90
13Tanzania26.53
14Cameroon26.35
15Benin25.80
16Vietnam25.52
17Iraq25.15
18Mali24.82
19Belarus24.81
20Angola24.67

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.

Overall, 13.53% of user computers globally faced at least one Malware-type local threat during Q3.


securelist.com/malware-report-…



IT threat evolution in Q3 2024. Mobile statistics


26471354

IT threat evolution in Q3 2024
IT threat evolution in Q3 2024. Non-mobile statistics
IT threat evolution in Q3 2024. Mobile statistics

Quarterly figures


According to Kaspersky Security Network, in Q3 2024:

  • As many as 6.7 million attacks involving malware, adware or potentially unwanted mobile apps were prevented.
  • Adware was the most common mobile threat, accounting for 36% of all detected threats.
  • More than 222,000 malicious and potentially unwanted installation packages were detected, of which:
    • 17,822 were associated with mobile banking Trojans.
    • 1576 packages were mobile ransomware Trojans.



Quarterly highlights


Mobile attacks involving malware, adware or potentially unwanted apps dropped by 13% in Q3, to a total of 6,686,375. The figure is still above the early 2023 level.

Attacks on users of Kaspersky mobile solutions, Q1 2023 — Q3 2024 (download)

We attribute this drop to the ongoing decline in the activity of adware, primarily stealthware belonging to the AdWare.AndroidOS.HiddenAd family.

Meanwhile, threat actors had not abandoned their attempts to spread their creations through official app marketplaces. For instance, in the third quarter, we discovered the xHelper Trojan inside the Open Browser app on Google Play.

26471359

xHelper acts as a stealthy downloader, installing various apps on the device unbeknownst to the user. These downloaders can introduce both ads and malware onto your phone.

We also discovered many apps infected with the Necro Trojan, both in the Google Play store and outside of it. Necro is a multi-component Trojan with an extensive feature set. It can perform any action on a compromised device: from ad display and malware downloads to automatic subscriptions.

Mobile threat statistics


The number of detected Android malware and potentially unwanted app samples also decreased in the third quarter to 222,444.

Detected malicious and potentially unwanted installation packages, Q3 2023 — Q3 2024 (download)

Adware (36.28%) and riskware classified as RiskTool (23.90%) continued to dominate the landscape of installed software packages. The share of RiskTool decreased markedly from Q2. Conversely, there was a minor uptick in the proportion of detected adware.

Detected mobile apps by type, Q2* — Q3 2024 (download)

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

Compared to the previous quarter, there was a significant decrease in the number of installation packages for the BrowserAd and MobiDash adware. At the same time, there was an increase in the number of unique HiddenAd apps. The spike in new RiskTool.AndroidOS.Fakapp files, seen in the previous quarter, subsided, causing a decline in the overall RiskTool category.

Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2024 (download)

*The sum may exceed 100% if the same users encountered multiple attack types.

Although the number of installation packages for AdWare.AndroidOS.HiddenAd increased, still, as mentioned above, the overall number of attacks by this malware decreased, which was reflected in its incidence on actual devices. Put simply, while cybercriminals released a variety of unique malware types, they were unsuccessful in infecting a large number of users.

Top 20 mobile malware programs


Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.

Verdict%* in Q2 2024%* in Q3 2024Difference in p.p.Change in ranking
DangerousObject.Multi.Generic.11.449.79-1.650
Trojan.AndroidOS.Triada.ga6.669.18+2.52+1
Trojan.AndroidOS.Fakemoney.v6.609.12+2.52+1
Trojan.AndroidOS.Boogr.gsh6.015.22-0.79+1
Trojan.AndroidOS.Triada.gs0.005.05+5.05
Trojan-Banker.AndroidOS.Mamont.bc0.144.89+4.75+180
Trojan-Downloader.AndroidOS.Dwphon.a2.714.74+2.02+1
DangerousObject.AndroidOS.GenericML.7.564.45-3.11-6
Trojan.AndroidOS.Fakemoney.bw1.174.27+3.10+15
Trojan.AndroidOS.Triada.gm5.163.89-1.27-3
Trojan-Spy.AndroidOS.SpyNote.bv1.263.68+2.43+10
Trojan-Spy.AndroidOS.SpyNote.bz1.972.98+1.01-1
Trojan-Downloader.AndroidOS.Agent.mm1.292.67+1.38+7
Trojan-Spy.AndroidOS.SpyNote.cc1.182.45+1.27+9
Trojan.AndroidOS.Triada.gn2.232.44+0.20-5
Trojan.AndroidOS.Generic.2.592.31-0.27-7
Trojan-Dropper.Linux.Agent.gen0.901.54+0.64+13
Trojan-Downloader.AndroidOS.Necro.f0.001.33+1.33
Trojan.AndroidOS.Triada.fd5.891.30-4.60-13
Trojan-Spy.AndroidOS.SpyNote.ck0.001.25+1.25

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The list of the most prevalent malware did not see any significant changes compared to the previous quarter. The generalized cloud verdict of DangerousObject.Multi.Generic took its usual top spot, followed by WhatsApp mods with embedded Triada modules, the Fakemoney phishing app which tricked users into providing their personal data by promising easy earnings, the Mamont banking Trojan, and the Dwphon pre-installed malware.

Region-specific malware


This section describes malware types that mostly focused on specific countries.

VerdictCountry*%*
Trojan-Banker.AndroidOS.BrowBot.qTurkey98.80
Trojan-Banker.AndroidOS.Coper.cTurkey97.99
Trojan-Banker.AndroidOS.Coper.aTurkey97.70
HackTool.AndroidOS.FakePay.cBrazil97.36
Trojan-Spy.AndroidOS.SmsThief.yaIndia97.33
Trojan-Banker.AndroidOS.UdangaSteal.fIndonesia96.75
Trojan-Dropper.AndroidOS.Agent.smTurkey96.71
Trojan-Banker.AndroidOS.Agent.oxIndia95.85
Trojan-Banker.AndroidOS.Agent.ppIndia95.50
Trojan-Banker.AndroidOS.Rewardsteal.nIndia95.31
Trojan-Banker.AndroidOS.UdangaSteal.kIndia95.17
Backdoor.AndroidOS.Tambir.dTurkey95.14
Trojan-Spy.AndroidOS.SmsThief.fsTurkey95.10
Backdoor.AndroidOS.Tambir.aTurkey94.93
Trojan-Spy.AndroidOS.SmsThief.wkIndia94.87
Trojan-Spy.AndroidOS.SmsThief.xyIndia94.59
Trojan-Banker.AndroidOS.Rewardsteal.gmIndia94.55
Trojan-Banker.AndroidOS.UdangaSteal.bIndonesia94.32
Trojan-Dropper.AndroidOS.Hqwar.bfTurkey94.31
Trojan-Spy.AndroidOS.SmsThief.vbIndonesia94.28
Trojan-Banker.AndroidOS.Coper.dTurkey94.17

* The country where the malware was most active.
** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.

The list of malware types that targeted specific countries was updated with new samples: SmsThief.fs which attacked Turkish users, and SmsThief.ya and SmsThief.xy which both were being spread in India. The first one was associated with an ongoing Coper banker campaign in Turkey, while the other two were SMS spies masquerading as government or banking apps.

In addition, the list includes familiar malware that continued to operate in certain countries: the Tambir backdoor, and the BrowBot and Hqwar Trojans in Turkey, FakePay in Brazil, members of the UgandaSteal family in Indonesia and India, and others.

Mobile banking Trojans


The third quarter saw detected mobile banking Trojans installation packages reach a total of 17,822.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2023 — Q3 2024 (download)

The majority of the installation packages belonged to the Mamont family, which also dominated real-life cyberattacks.

Top 10 mobile bankers

Verdict%* in Q2 2024%* in Q3 2024Difference in p.p.Change in ranking
Trojan-Banker.AndroidOS.Mamont.bc1.4735.29+33.82+21
Trojan-Banker.AndroidOS.Coper.c0.006.61+6.61
Trojan-Banker.AndroidOS.Agent.rj0.005.53+5.53
Trojan-Banker.AndroidOS.GodFather.m6.415.40-1.010
Trojan-Banker.AndroidOS.Faketoken.z5.174.67-0.500
Trojan-Banker.AndroidOS.Mamont.aj0.394.44+4.06+33
Trojan-Banker.AndroidOS.Svpeng.aj3.743.84+0.10+3
Trojan-Banker.AndroidOS.Coper.a2.353.22+0.86+7
Trojan-Banker.AndroidOS.Mamont.aq14.132.93-11.20-8
Trojan-Banker.AndroidOS.UdangaSteal.b10.102.87-7.23-8

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.


securelist.com/malware-report-…



IT threat evolution Q3 2024


26469414

IT threat evolution in Q3 2024
IT threat evolution in Q3 2024. Non-mobile statistics
IT threat evolution in Q3 2024. Mobile statistics

Targeted attacks

New APT threat actor targets Russian government entities


In May 2024, we discovered a new APT targeting Russian government organizations. CloudSorcerer is a sophisticated cyber-espionage tool used for stealth monitoring, data collection and exfiltration via Microsoft, Yandex and Dropbox cloud infrastructures. The malware utilizes cloud resources for its C2 (command and control) servers, which it accesses via APIs using authentication tokens. CloudSorcerer also employs GitHub as its initial C2 server. CloudSorcerer functions as separate modules – for communication and data collection – depending on the process it’s running, but executes from a single executable. It leverages Microsoft COM object interfaces to perform its malicious operations.

While the modus operandi of the threat actor is reminiscent of the CloudWizard APT that we reported on in 2023, the malware code is completely different. Consequently, we believe CloudSorcerer is a new threat actor that has emulated a similar approach to interacting with public cloud services.

Two months later, in July 2024, CloudSorcerer launched further attacks against Russian government organizations and IT companies. The campaign, which we dubbed EastWind, used phishing emails with malicious shortcuts attached to deliver malware to target computers. The malware, which received commands via the Dropbox cloud service, was used to download additional payloads.

One of these was an implant called GrewApacha, used by APT31 since at least 2021. The other was an updated version of the backdoor used by CloudSorcerer in its earlier attacks. This one uses LiveJournal and Quora profiles as initial C2 servers.

The latest attacks also use a previously unknown implant with classic backdoor functionality called PlugY. This malware, which is loaded via the CloudSorcerer backdoor, has an extensive command set and is capable of supporting three different protocols for communicating with the C2. The code is similar to that of the DRBControl (aka Clambling) backdoor, which has been attributed to APT27 by several companies.

BlindEagle adds side-loading to its arsenal


In August, we reported a new campaign by Blind Eagle, a threat actor that has been targeting government, finance, energy, oil and gas and other sectors in Latin America since at least 2018. The campaign aligns with the TTPs (Tactics, Techniques and Procedures) and artifacts used by BlindEagle, although the attackers have introduced one new technique to their toolset – DLL side-loading.

The attack starts with phishing emails purporting to be a court order or summons from an institution in Colombia’s judicial system. The email contains a link in the body of the message that is also contained in the attached file, which appears to be a PDF or Word document. Victims are tricked into clicking the link to retrieve documents related to the lawsuit.

26469416

These documents are in fact password-protected ZIP or other archives. The archive files contain a clean executable file responsible for initiating the infection process through side-loading, alongside various malicious files used in the attack chain. One of these files carries an embedded loader named HijackLoader, which decrypts and loads the final payload. The final payload is a version of AsyncRAT, one of the Remote Access Trojans (RATs) used by BlindEagle in previous campaigns.

You can read more details about this campaign and the TTPs employed by this threat actor in general here.

Tropic Trooper spies on government entities in the Middle East


The threat actor Tropic Trooper, active since 2011, has historically targeted government, healthcare, transportation and high-tech sectors in Taiwan, the Philippines and Hong Kong. In June 2023, Tropic Trooper initiated a series of persistent campaigns targeting a government body in the Middle East.

We were alerted to the infection in June of this year when our telemetry indicated recurring alerts for a new China Chopper web shell variant discovered on a public web server. China Chopper is widely used by Chinese-speaking actors. The server was hosting a CMS (Content Management System) called Umbraco, an open source CMS platform for publishing content, written in C#. The observed web shell component was compiled as a .NET module of the Umbraco CMS.

Malicious module found inside Umbraco CMS on the compromised server
Malicious module found inside Umbraco CMS on the compromised server

In the course of our subsequent investigation, we looked for other suspicious detections on this public server and identified several malware sets. These include post-exploitation tools that we have assessed with medium confidence to be related to this intrusion. We also identified new DLL search-order hijacking implants that are loaded from a legitimate vulnerable executable as it lacks the full path specification to the DLL it needs. This attack chain attempted to load the Crowdoor loader, named partly after the SparrowDoor backdoor described by ESET. During the attack, the security agent blocked the first Crowdoor loader, prompting the attackers to switch to a new, previously unreported variant with almost the same impact.

We attribute this activity with high confidence to the Chinese-speaking threat actor known as Tropic Trooper. Our findings show an overlap in the techniques reported in recent Tropic Trooper campaigns. The samples we found also demonstrate a high degree of overlap with samples previously attributed to Tropic Trooper.

The significance of this intrusion is that it involved a Chinese-speaking actor targeting a CMS platform that published studies on human rights in the Middle East, with a particular focus on the situation surrounding the Israel-Hamas conflict. Our analysis revealed that the entire system was the sole target during the attack, suggesting a deliberate focus on this specific content.

From 12 to 21: connections between Twelve and BlackJack groups


In the spring of 2024, posts containing personal data of real individuals began appearing on the -=TWELVE=- Telegram channel. This was soon blocked for violating Telegram’s terms of service, and the group remained inactive for several months. However, during our investigation of an attack in late June, we discovered techniques identical to Twelve’s and the use of C2 servers associated with this threat actor.

The Twelve group was established in April 2023 in the context of the Russian-Ukrainian conflict and has been attacking Russian government organizations ever since. The threat actor specializes in encrypting and then deleting its targets’ data, which suggests that the group’s primary objective is to cause as much damage as possible. Twelve also exfiltrates sensitive information from targeted systems and posts it on the group’s Telegram channel.

Interestingly, Twelve shares infrastructure, utilities and TTPs (Tactics, Techniques and Procedures) with the DARKSTAR ransomware group (formerly known as Shadow or COMET). This indicates that the two may belong to the same syndicate or activity cluster. At the same time, while Twelve’s actions are clearly hacktivist in nature, DARKSTAR adheres to the classic double extortion pattern. This variation in objectives within the syndicate highlights the complexity and diversity of modern cyberthreats.

In our September report on Twelve, we used the Unified Kill Chain methodology to analyze the group’s activities.

We also discovered overlapping TTPs with BlackJack, another hacktivist group that emerged in late 2023. This group’s stated aims, from its Telegram channel, is to find vulnerabilities in the networks of Russian organizations and government institutions. The threat actor has claimed responsibility for more than a dozen attacks, and our telemetry also contains information about other undisclosed attacks where indicators point to BlackJack’s involvement.

The group uses only freely available and open source software. This includes the use of the ngrok utility for tunneling, Radmin, AnyDesk and PuTTY for remote access, the Shamoon wiper and a leaked version of the LockBit ransomware. This confirms that this is a hacktivist group that lacks the resources typical of large APT threat actors.

Other malware

How “professional” ransomware groups boost the business of cybercriminals


Cybercriminals who want to get into the ransomware business don’t necessarily need to develop the software themselves. They can find a leaked ransomware variant online, buy ransomware on the dark web, or become an affiliate. In recent months, we have published several private reports detailing exactly this.

In April, IxMetro was hit by an attack that used a still-new ransomware variant dubbed “SEXi”, a group that focuses primarily on ESXi applications. In each of the cases we investigated, the targeted organizations were running unsupported versions of ESXi. This group deploys either LockBit or Babuk ransomware, depending on the platform – Windows or Linux, respectively.

In the majority of cases, the attackers leave a note containing an email address or URL for a leak site. In the case we looked at, the note included a user ID associated with the Session messaging app. The ID belonged to the attackers and was used across a number of different ransomware attacks on a variety of victims. This indicates a lack of professionalism and suggests that the attackers did not have a TOR leak site.

Key Group (aka keygroup777) has utilized no fewer than eight different ransomware families in its relatively short history (since April 2022):

Use of leaked ransomware builders by Key Group
Use of leaked ransomware builders by Key Group

Over the approximately two-year period that the group has been active, it has made minor adjustments to its TTPs with each new ransomware variant. For example, the persistence mechanism was consistently implemented via the registry, though the specific technique differed by family. In most cases, autorun was used, but we’ve also seen them using the startup folder. While Russian-speaking groups typically operate outside Russia, this is not the case with Key Group. Like SEXi’s, Key Group’s operations are not particularly professional. For example, the primary C2 channel is a GitHub repository, which makes the group easier to track, and communication is conducted over Telegram, as opposed to a dedicated server on the TOR network.

Mallox is a relatively new ransomware variant that first came to light in 2021 and kicked off an affiliate program in 2022. It’s unclear how the authors obtained the source code: perhaps they wrote it from scratch, used a published or leaked version, or – as they claim – purchased it. Although it started as a private group running its own campaigns, it launched an affiliate program shortly after its inception. It is noteworthy that the group only engages with Russian-speaking affiliates and does not do business with novices. Affiliates are explicitly instructed to target organizations with a minimum revenue of $10 million and to avoid hospitals and educational institutions. Mallox uses affiliate IDs, making it possible to track affiliate activity over time. In 2023, there were 16 active partners. In 2024, only eight of the original affiliates were still active, with no newcomers. Other than that, Mallox has all the typical Big Game Hunting attributes that other groups have, such as a leak site and a server hosted on TOR.

You can read more about the above threats here. You can also read our full report on Mallox ransomware here. To learn more about our crimeware reporting service, contact us at crimewareintel@kaspersky.com.

HZ Rat backdoor for macOS


In June, we discovered a macOS version of the HZ Rat backdoor. The backdoor was being used to target users of the enterprise messenger DingTalk and the social networking and messaging platform WeChat. Although we do not know the original distribution point for the malware, we were able to locate an installation package for one of the backdoor samples – a file named OpenVPNConnect.pkg.

OpenVPNConnect.pkg on VirusTotal
OpenVPNConnect.pkg on VirusTotal

The samples we discovered almost exactly replicate the functionality of the Windows version of the backdoor with the exception of the payload, which is received in the form of shell scripts from the attackers’ server. We noticed that some versions of the backdoor utilize local IP addresses to connect to the C2, leading us to believe the threat might be targeted. This also suggests that the attackers intend to use the backdoor for lateral movement through the target network.

The data collected about the targets’ companies and contact information could be used to spy on people of interest and lay the groundwork for future attacks. During the course of our investigation, we did not encounter the use of two of the backdoor’s commands (write file to disk and send file to server), so the full scope of the attacker’s intentions remains unclear.

Hacktivist group Head Mare targets Russia and Belarus


Since the start of the Russo-Ukrainian conflict, numerous hacktivist groups have emerged whose main goal is to cause damage to organizations on the opposing side of the conflict. One such group is Head Mare, which targets organizations in Russia and Belarus.

While such hacktivist groups tend to use similar TTPs, Head Mare uses more up-to-date methods to gain initial access. For example, the attackers leveraged a recently discovered vulnerability in WinRAR (CVE-2023-38831) that allowed them to execute arbitrary code on a compromised system via a specially crafted archive. This approach allows the group to more effectively deliver and disguise the malicious payload.

As is the case with most hacktivist groups, Head Mare maintains a public account on the X social network, which it uses to post information about some of its victims.

Head Mare post on X
Head Mare post on X

Head Mare has targeted a variety of industries, including government, energy, transportation, manufacturing and entertainment. The group mainly uses publicly available software, which is typical of hacktivist groups. However, Head Mare’s toolkit also includes custom malware, PhantomDL and PhantomCore, delivered via phishing emails. In addition to its primary goal of causing damage to targeted organizations, Head Mare also deploys LockBit and Babuk ransomware, which demand a ransom for restoring encrypted data.

Loki: a new private agent for the popular Mythic framework


In July, we discovered a previously unknown backdoor called Loki, which was used in a series of targeted attacks against Russian companies in various industries, including engineering and healthcare. From our analysis and information gleaned from open sources, we determined that Loki is a private version of an agent for the open source Mythic framework. This has its origins in an open source framework for post-exploitation of compromised macOS systems, called Apfell. Two years later, several developers joined the project, the framework became cross-platform and was renamed Mythic. Mythic allows the use of agents in any language, for any platform, with the required functionality. Around two dozen agents have been published in the official Mythic repository, including Loki.

The Loki agent we discovered is a Mythic-compatible version of the agent for another framework, Havoc. The Loki modification inherited several techniques from Havoc to make it more difficult to analyze the agent, such as encrypting its memory image, indirectly calling system API functions, searching for API functions by hash and more. However, unlike the agent for Havoc, Loki was split into a loader and a DLL, where the main functionality of the malware is implemented.

Based on our telemetry, and the filenames of infected files, we believe that in several cases Loki was distributed via email, with unsuspecting victims launching the file themselves. More than a dozen companies have encountered this threat, although we believe the number of potential victims may be higher.

There is currently not enough data to attribute Loki to any known group. Rather than using standard email templates to distribute the agent, we think it’s likely that the attackers are approaching each target individually. We have also not found any unique tools on the infected machines that could help with attribution. The attackers seem to prefer using only publicly available traffic tunneling utilities such as gTunnel and ngrok, and the goReflect tool to modify them.

Tusk: unravelling a complex infostealer campaign


The Kaspersky Global Emergency Response Team (GERT) recently identified a complex campaign consisting of several sub-campaigns orchestrated by Russian-speaking cybercriminals. The sub-campaigns imitate legitimate projects, with slight modifications to names and branding, and using multiple social media accounts to enhance their credibility.

All the active sub-campaigns host the initial downloader on Dropbox. This downloader is responsible for delivering additional malware samples to the target’s machine, mostly infostealers (Danabot and StealC) and clippers (which monitor clipboard data). Additionally, the threat actors employ phishing tactics to entice individuals into revealing further sensitive information, such as credentials, which can then be sold on the dark web or used to gain unauthorized access to gaming accounts and cryptocurrency wallets, resulting in direct financial loss.

We identified three active sub-campaigns and 16 inactive sub-campaigns related to this activity, which we dubbed “Tusk”. In the three active sub-campaigns we analyzed, the threat actor uses the word “Mammoth” (a slang word used by Russian-speaking threat actors to refer to victims) in log messages of initial downloaders. Analysis of the inactive sub-campaigns suggests that they are either old campaigns or campaigns that haven’t started yet.

Our report includes our analysis of the three most recently active sub-campaigns – TidyMe, RuneOnlineWorld and Voico.

26469418

These campaigns underscore the persistent and evolving threat posed by cybercriminals who are adept at mimicking legitimate projects to deceive victims. By capitalizing on user trust in well-known platforms, these attackers effectively deploy a range of malware designed to steal sensitive information, compromise systems, and ultimately reap financial gain.

The use of social engineering techniques such as phishing, coupled with multi-stage malware delivery mechanisms, demonstrates the advanced capabilities of the threat actors involved. Their use of platforms like Dropbox to host initial downloaders, along with the deployment of infostealer and clipper malware, suggests a coordinated effort to evade detection and maximize the impact of their operations.

The similarities between different sub-campaigns and the shared infrastructure across them indicates a well-organized operation, potentially linked to a single actor or group with specific financial motives.

The discovery of 16 inactive sub-campaigns further illustrates the dynamic and adaptable nature of the threat actor’s operations.

You can read our report here.

SambaSpy


In May, we discovered a campaign exclusively targeting victims in Italy, which is quite unusual, as cybercriminals typically broaden their range of targets to maximize their profits. However, in this campaign, the attackers check at various stages of the infection chain to ensure that only people in Italy are infected.

The final payload of the infection is a new RAT (Remote Access Trojan) called SambaSpy, a full-featured RAT developed in Java and obfuscated using the Zelix KlassMaster protector. The malware includes an extensive list of functions, including file system management, process management, keylogging, screen grabbing and webcam control.

The attackers lure their targets with phishing emails disguised as messages from a real estate agency. If the target clicks the link in the message, they are redirected to a malicious website that checks the system language and browser. If the potential victim’s system is set to Italian and they open the link in Edge, Firefox or Chrome, they receive a malicious PDF file that infects their device with either a dropper or a downloader. The difference between the two is minimal: the dropper installs the Trojan immediately, while the downloader first downloads the necessary components from the attackers’ servers. Those who don’t meet these criteria are redirected to the website of an Italian cloud-based solution for storing and managing digital invoices.

SambaSpy infection chain 1
SambaSpy infection chain 1

SambaSpy infection chain 2
SambaSpy infection chain 2

While we don’t yet know which cybercriminal group is behind this sophisticated attack, circumstantial evidence indicates that the attackers speak Brazilian Portuguese. We also know that they’re already expanding their operations to Spain and Brazil, as evidenced by malicious domains used by the same group in other detected campaigns.


securelist.com/malware-report-…



GPS Enabled Pumpkin Spice Sprayer Knows When It’s PSL Season


An homemade automated air freshener dispenser

Pumpkin spice, also known as allspice with better marketing, has found its way into a seemingly endless amount of products over the years. It goes beyond the obvious foodstuffs of pies and cakes; because there are plenty of candles, deodorants, and air fresheners ready to add a little more spice to your world. One such autumnal smell enthusiast, YouTube user [J-Knows], sought to automate the delivery mechanism with his 3D printed pumpkin spice aerosol sprayer.

The sprayer device uses an Arduino to rotate a small 3D printed arm that depresses the button on an air freshener cap. This design came as a result of multiple attempts to create a clip that would securely attach to a standard canister. When problems arose with the clip slipping out of place after the motor rotated, a pinch of sticky tack ended up being just the solution. With the proper amount of adhesion, the automated sprayer could now “pollute” any space it is in, as [J-Knows] described.

What took this project to another level is the addition of an Adafruit GPS module. It was coded to respond when it was within one mile of a Starbucks — arguably the organization responsible for the pumpkin spice craze. For some the company’s pumpkin spice latte (PSL) is synonymous with all things fall, and marks the beginning of the season when it is brought back to the coffee menu. Though not being a regular coffee drinker himself, [J-Knows] fully committed to the bit by taking his creation on a test trip to his local Starbucks for a PSL. Judging by the amount of pumpkin spice aerosol solution that ended up on his car dash, he is going to be smelling it into the next year.

youtube.com/embed/Rnx5D53qFy4?…


hackaday.com/2024/11/29/gps-en…



Windows 11 Nel Mirino: L’Exploit per il bug del Driver ksthunk.sys Minaccia le reti


Recentemente è stata identificata una vulnerabilità in Windows 11 versione 23H2 che consente agli aggressori locali di ottenere privilegi elevati a causa di un overflow di numeri interi nel driver “ksthunk.sys”. Il problema è stato scoperto nella funzione “CKSAutomationThunk::ThunkEnableEventIrp“, che è responsabile dell’elaborazione dei processi a 32 bit in un ambiente a 64 bit.ssd-disclosure.com/ssd-advisor…

La ricerca è stata presentata all’evento TyphoonPWN 2024, dove è stato dimostrato il successo dell’utilizzo dell’exploit. Lo sviluppatore che ha partecipato al concorso si è classificato secondo.

Microsoft ha affermato che la vulnerabilità è già stata risolta, ma non ha fornito una data esatta per la correzione. Dal controllo è emerso che il problema persiste nell’ultima versione di Windows 11 e che non esiste un numero CVE e una documentazione ufficiali per la correzione.

L’errore è legato ad un’elaborazione errata della dimensione del buffer, che porta ad un overflow. Un utente malintenzionato può ottenere il controllo della memoria ed eseguire scritture arbitrarie, consentendo l’inserimento del token di sistema nel processo corrente e ottenendo privilegi di amministratore.

Per il funzionamento viene utilizzata la seguente sequenza:

  1. Bypassare il controllo “ProbeForRead” attraverso la manipolazione dell’indirizzo di memoria.
  2. Un overflow del buffer provoca il danneggiamento di un oggetto di memoria vicino.
  3. Le primitive vengono create per leggere e scrivere in aree di memoria arbitrarie.
  4. Modificando il token del processo, l’aggressore ottiene l’accesso ai privilegi SYSTEM.

Lo sfruttamento di questa vulnerabilità minaccia la sicurezza sia dei dispositivi personali che delle reti aziendali. Poiché la vulnerabilità è legata all’elaborazione della memoria, lo sfruttamento richiede notevoli competenze tecniche, ma se attaccato con successo, le conseguenze potrebbero essere catastrofiche.

Gli esperti raccomandano:

  • Installare tutti gli aggiornamenti disponibili per Windows 11.
  • Utilizzare soluzioni antivirus in grado di rilevare comportamenti anomali dei processi.
  • Impostare restrizioni sull’esecuzione di applicazioni sospette sulla rete locale.

Nell’era digitale, la sicurezza del sistema dipende non solo dalle barriere tecniche, ma anche dalla vigilanza degli utenti e degli specialisti pronti a riconoscere e neutralizzare rapidamente le potenziali minacce, trasformando le vulnerabilità tecniche in opportunità per migliorare i meccanismi di protezione.

L'articolo Windows 11 Nel Mirino: L’Exploit per il bug del Driver ksthunk.sys Minaccia le reti proviene da il blog della sicurezza informatica.



Italia-Marocco. Partnership militare sempre più stretta


@Notizie dall'Italia e dal mondo
Dal 13 al 21 novembre scorso si è svolta nelle acque del Golfo di Taranto, l’esercitazione bilaterale italo-marocchina denominata ITA-MOR 24
L'articolo Italia-Marocco. Partnership militare pagineesteri.it/2024/11/29/med…



L'ennesima bugia della scimmia urlatrice della Garbatella


Vuoi Combattere la Censura? Tor Ha Bisogno di Te!


Il Tor Project ha annunciato il lancio di una campagna per reclutare volontari per installare 200 nuovi bridge WebTunnel entro la fine dell’anno. Questi bridge sono essenziali per combattere la crescente censura di Internet, soprattutto nei paesi con accesso limitato a Internet.

Tor attualmente utilizza 143 bridge WebTunnel che aiutano gli utenti a aggirare il blocco dei siti Web e le restrizioni di accesso a Internet. Tuttavia, la maggiore censura di Internet in alcune regioni crea ulteriori ostacoli influenzando i meccanismi di elusione integrati come obfs4 e Snowflake.

I bridge WebTunnel sono un nuovo tipo di tecnologia introdotta da Tor nel marzo 2024. Consentono al traffico Tor di essere mascherato da HTTPS, rendendolo difficile da rilevare. A differenza dei bridge standard che utilizzano protocolli come obfs4, WebTunnel funziona attraverso un server web con un certificato SSL/TLS valido, rimanendo non rilevabile dai sistemi di blocco.

I problemi affrontati dagli utenti Tor includono tentativi di bloccare bridge e strumenti di bypass, rimozione di applicazioni rilevanti dagli store e restrizioni a livello di provider di hosting. Ciò rende difficile per gli utenti russi l’accesso gratuito a Internet e sottolinea la necessità di aumentare il numero di bridge WebTunnel.

La campagna durerà fino al 10 marzo 2025 e i partecipanti che installeranno cinque o più ponti riceveranno un regalo commemorativo dal Progetto Tor. Per partecipare è necessario:

  • un bridge per indirizzo IPv4;
  • disponibilità di un certificato SSL/TLS valido;
  • sito web che supporta il bridge;
  • larghezza di banda minima 1 TB/mese;
  • Disponibilità dei bridge 24 ore su 24 (sono accettabili i riavvii per gli aggiornamenti);
  • funzionamento obbligatorio dei ponti durante tutto l’anno.

L’organizzazione consiglia di evitare l’utilizzo dell’hosting Hetzner ed è pronta a fornire istruzioni per la creazione di bridge sul proprio sito ufficiale.

Il progetto Tor spera che i nuovi bridge WebTunnel contribuiscano a mantenere l’accesso a Internet libero a fronte di un maggiore controllo sulla rete.

L'articolo Vuoi Combattere la Censura? Tor Ha Bisogno di Te! proviene da il blog della sicurezza informatica.



Cybersecurity in Africa: Dalla Dipendenza Estera all’Indipendenza Tecnologica


I problemi legati allo spionaggio informatico e alle vulnerabilità della catena di approvvigionamento stanno costringendo i paesi africani a cercare modi per diversificare i propri partner tecnologici. I recenti incidenti che coinvolgono backdoor e violazioni dei dati hanno evidenziato i rischi derivanti dal fare affidamento su fornitori stranieri, in particolare dalla Cina e dagli Stati Uniti.

Si scopre che per cinque anni i computer della sede dell’Unione Africana in Etiopia, una struttura costruita da aziende cinesi, hanno trasmesso dati sensibili ai server in Cina. La Cina nega le accuse, ma il caso è diventato un simbolo della vulnerabilità delle forniture tecnologiche.

Secondo un rapporto dell’Africa Center for Strategic Studies (ACSS), i paesi africani stanno iniziando a riconsiderare il proprio approccio all’approvvigionamento. Particolare attenzione è rivolta alla sicurezza delle catene di fornitura che abbracciano applicazioni, dispositivi, infrastrutture e servizi.

Nate Allen, l’autore del rapporto, osserva che l’interesse dei paesi africani per una maggiore indipendenza tecnologica è in crescita. Gli Stati africani sono consapevoli della necessità di controllare e influenzare le proprie catene di approvvigionamento, ha affermato.

Tra le minacce globali come gli attacchi WannaCry e NotPetya, i paesi africani sono anche preoccupati per le interferenze straniere, non solo provenienti dalla Cina ma anche da altri attori, compresi gli Stati Uniti.

Mark Walker, vicepresidente di IDC Sud Africa, sottolinea che lo sviluppo della tecnologia locale e il miglioramento delle competenze delle comunità sono fondamentali per ridurre la dipendenza. Tuttavia, le risorse limitate rallentano questo processo.

Nonostante gli sforzi, 36 delle 100 app più popolari in Africa sono create da aziende cinesi e 23 da aziende americane, mentre la quota di sviluppatori africani è estremamente ridotta. Il dominio statunitense è evidente anche nei sistemi operativi, con Windows, Android e iOS in testa.

Tuttavia, il mercato tecnologico africano è in crescita e le aziende locali comprendono meglio le esigenze nazionali. La diversità e la concorrenza possono aiutare a ridurre l’influenza degli attori esterni, osserva il rapporto dell’ACSS.

Incidenti come l’attacco ai funzionari keniani per il debito verso la Cina, così come le operazioni contro le missioni diplomatiche e le forze militari, sottolineano l’importanza di migliorare la sicurezza informatica. Gli esperti africani mettono in guardia anche sulle vulnerabilità dei software open source ampiamente utilizzati nel continente.

Le aziende che desiderano operare nel mercato africano devono tenere conto delle caratteristiche locali e offrire soluzioni affidabili. Senza ciò rischiano di perdere terreno rispetto alla concorrenza, sottolinea Walker.

L'articolo Cybersecurity in Africa: Dalla Dipendenza Estera all’Indipendenza Tecnologica proviene da il blog della sicurezza informatica.



ICS a Rischio: Il Nuovo Malware FrostyGoop Colpisce Ucraina e Romania


I ricercatori del team Unit42 hanno scoperto il nuovo malware FrostyGoop che prende di mira i dispositivi Industrial Control System (ICS). Il malware utilizza il protocollo Modbus TCP per sferrare attacchi alle infrastrutture critiche, comprese strutture in Ucraina e Romania. Inoltre il malware è in grado di provocare anche danni fisici.

FrostyGoop è stato avvistato per la prima volta nell’ottobre 2023. Il malware sfrutta le porte Telnet vulnerabili sui dispositivi ENCO e sui router TP-Link WR740N obsoleti, rendendo i sistemi particolarmente vulnerabili agli attacchi. Lo scopo principale è accedere ai dispositivi ed eseguire comandi Modbus.

Una caratteristica speciale di FrostyGoop è l’uso di una configurazione JSON unica e della libreria go-json di Goccy, che semplifica l’analisi del suo funzionamento. I ricercatori hanno anche trovato un eseguibile chiamato “go-encrypt.exe” che crittografa i file JSON utilizzando AES-CFB. Ciò potrebbe indicare un tentativo da parte degli aggressori di nascondere dati sensibili.

Il malware utilizza attivamente Modbus TCP per comunicare con i dispositivi tramite la porta 502. I comandi dannosi includono la lettura e la scrittura di registri utilizzando i codici funzione 3, 6 e 16, che consentono agli aggressori di controllare i dispositivi compromessi.

Gli esperti sottolineano che tali attacchi espongono vulnerabilità critiche nelle infrastrutture legacy ed evidenziano la necessità di rafforzare la protezione dei sistemi industriali. Con la crescente integrazione delle reti IT e OT, stanno emergendo nuovi vettori di attacco, rendendo le minacce provenienti da malware come FrostyGoop ancora più significative.

Gli attacchi alle infrastrutture critiche in paesi come Ucraina, Romania e Stati Uniti confermano l’urgenza del problema. Gli esperti di Palo Alto Networks sottolineano che la protezione dei sistemi legacy è un elemento chiave della sicurezza.

L'articolo ICS a Rischio: Il Nuovo Malware FrostyGoop Colpisce Ucraina e Romania proviene da il blog della sicurezza informatica.



Ultra-Wide Gaming Handheld Channels The Nintendo DS


26448976

“The Nintendo DS isn’t wide enough!” said nobody, ever. Most players found Nintendo’s form factor to be perfectly acceptable for gaming on the go, after all. Still, that doesn’t mean a handheld gaming rig with a more… cinematic aspect ratio couldn’t be fun! [Marcin Plaza] built just that, with great results.

The initial plan was to build a Steam Deck-like device, but using laptop trackpads instead of joysticks. [Marcin] had a broken Lenovo Yoga 730-13 to use as the basis for the build. That caused the plan to diverge, as the only screen [Marcin] could find that was easily compatible with the laptop’s eDP interface was an ultrawide unit. From there, a clamshell enclosure was designed specifically to rehouse all the key components from the Lenovo laptop. The top half of the clamshell would hold the screen, while the base would feature a small custom keyboard, some buttons, and the aforementioned trackpad. This thing reminds us of the Nintendo DS for multiple reasons. It’s not just the clamshell design—it’s the fact it has a touch control on the lower deck, albeit without a screen.

It’s an original concept for a handheld gaming device, and it makes us wish there were more games built for the ultrawide aspect ratio. This is one project that has us browsing the usual websites to see just what other oddball screens are out there… round screens in a makeup compact clamshell, anyone? Video after the break.

youtube.com/embed/PJccc3qpPh0?…


hackaday.com/2024/11/28/ultra-…



Ancora Ospedali Sotto Attacco! Pazienti a Rischio e Procedure Rinviate


28 novembre 2024

Il Wirral University Teaching Hospital (WUTH), una delle principali strutture sanitarie nel Regno Unito, è stato vittima di un grave attacco informatico che ha paralizzato i suoi sistemi IT, costringendo l’ospedale a rimandare molte procedure non urgenti. In un comunicato ufficiale, l’ente sanitario ha confermato che l’incidente ha avuto un impatto significativo sulla capacità operativa e che si stanno adottando misure per proteggere i dati dei pazienti e ristabilire i servizi essenziali.

L’attacco ha colpito non solo i sistemi clinici, ma anche le infrastrutture amministrative, ostacolando il lavoro del personale e complicando la comunicazione con i pazienti. Al momento, non è stato reso noto se i dati sensibili siano stati esfiltrati o compromessi, ma l’entità del danno sottolinea la vulnerabilità delle infrastrutture sanitarie nel contesto delle moderne minacce cibernetiche.

Analisi dell’evento


Gli attacchi informatici nel settore sanitario non sono un fenomeno nuovo, ma la loro frequenza e gravità stanno crescendo esponenzialmente. Secondo dati recenti, il 34% degli attacchi ransomware a livello globale prende di mira strutture sanitarie, con conseguenze devastanti in termini di costi, interruzioni del servizio e rischi per i pazienti. Il caso del WUTH evidenzia due problematiche principali:

  1. La fragilità dei sistemi sanitari digitali: La transizione verso la digitalizzazione, pur offrendo enormi benefici, ha esposto molte istituzioni a rischi elevati. Sistemi obsoleti, mancanza di investimenti adeguati nella cybersecurity e scarsa consapevolezza del personale rendono ospedali e cliniche facili bersagli.
  2. L’impatto umano degli attacchi: Quando un ospedale viene colpito, non si tratta solo di dati rubati o denaro richiesto: la vita dei pazienti è direttamente a rischio. Ritardi nelle procedure, impossibilità di accedere a informazioni mediche cruciali e perdita di fiducia nel sistema sanitario sono solo alcune delle conseguenze tangibili.


Commento e considerazioni


Questo attacco arriva in un momento critico in cui molte nazioni stanno recependo normative europee come la Direttiva NIS2 (Norme sulla Sicurezza delle Reti e dei Sistemi Informativi), che impone misure più rigorose per proteggere le infrastrutture critiche. Tuttavia, come dimostra il caso del WUTH, il semplice rispetto di queste normative potrebbe non essere sufficiente se non accompagnato da un cambiamento culturale e operativo.

Inoltre, gli hacker sembrano preferire il settore sanitario proprio per la sua natura critica: gli ospedali, sotto pressione, spesso cedono al ricatto per ripristinare i sistemi il più rapidamente possibile. Ciò alimenta un circolo vizioso che incoraggia ulteriori attacchi.

Conclusioni


Questo evento deve fungere da campanello d’allarme per tutte le organizzazioni sanitarie a livello globale. È necessario:

  • Aumentare gli investimenti nella sicurezza informatica: Questo include non solo l’adozione di tecnologie avanzate, ma anche la formazione del personale per riconoscere e rispondere a minacce.
  • Migliorare la resilienza operativa: Oltre a prevenire gli attacchi, gli ospedali devono sviluppare piani di continuità che permettano di operare anche in caso di incidenti gravi.
  • Rafforzare la collaborazione internazionale: Gli attacchi informatici non conoscono confini, e solo una risposta coordinata e condivisa può arginarne la diffusione.

Infine, la lezione più importante è che la sicurezza informatica non è un costo, ma un investimento essenziale per proteggere non solo dati e infrastrutture, ma anche vite umane. L’attacco al WUTH dimostra quanto possa essere fragile un sistema sanitario, e quanto sia urgente proteggerlo.

L'articolo Ancora Ospedali Sotto Attacco! Pazienti a Rischio e Procedure Rinviate proviene da il blog della sicurezza informatica.



US Is Getting Its First Onshore Wave Power Plant


Waves crash near a rocky shore. Large, SUV-sized blue "floaters" sit in the water perpendicular to a concrete pier. The floaters look somewhat like a bass boat shrink wrapped in dark blue plastic and attached to a large piston and hinge. A grey SUV sits on the pier, almost as if for scale.

Renewables let you have a more diverse set of energy inputs so you aren’t putting all your generation eggs in one basket. One type of renewable that doesn’t see a lot of love, despite 80% of the world’s population living within 100 km (~60 mi) of a coastline, is harnessing the energy of the tides. [via Electrek]

“The U.S. Department of Energy’s National Renewable Energy Laboratory estimates that wave energy has the potential to generate over 1,400 terawatt-hours per year,” so while this initial project won’t be huge, the overall possible power generation from tidal power is nothing to sneeze at. Known more for its role in shipping fossil fuels, the Port of Los Angeles will host the new wave power pilot being built by Eco Wave Power and Shell. Eco Wave’s system uses floaters to drive pistons that compress hydraulic fluid and turn a generator before the decompressed fluid is returned to the pistons in a nice, tidy loop.

Eco Wave plans to finish construction by early 2025 and already has the power conversion unit onsite at the Port of Los Angeles. While the press release is mum on the planned install capacity, Eco Wave claims they will soon have 404.7 MW of installed capacity through several different pilot projects around the world.

We covered another Swiss company trying to harness tidal power with underwater kites, and if wave power isn’t your thing but you still like mixing water and electricity, why not try offshore wind or a floating solar farm? Just make sure to keep the noise down!


hackaday.com/2024/11/28/us-is-…



UFO 50 Inspired LX System Looks Straight Out of a Video Game


A replica LX System game console inspired by the UFO 50 video game sitting on a wooden desk next to a can of diet Coke.

They simply don’t make them like they used to, and in the case of this retro LX system build, they only make what never existed in the first place. Earlier this year the long awaited video game UFO 50 released to widespread critical acclaim. The conceit of the game is an interactive anthology of a faux 1980’s game console constructed by a large group of actual indie game developers. Leave it to [Luke], who admitted to UFO 50 to taking over his life, to bring the LX system from the digital screen to the real world.

Each piece of the LX System case was printed on a multi-color filament capable Bambu Labs P1S. Dual XLR jacks wired up as USB serve as controller ports, and the controller itself is a repurposed NES style USB controller fitted with a new housing printed with the same filament as the case. Both the prominent front mounted power and “sys” buttons are functional; the latter actually switches to a new game within UFO 50. The brains of this project is a mini Windows PC hooked up to a 9 inch 720p LCD screen which is plenty enough resolution for pixelated look of the games. As impressive as replicating the whole case look is, it’s really brought together by the addition of a 3.5 inch floppy drive. It could be an interesting way to backup save files, provided they fit within 1.44 MB.

In addition to sharing the completed LX System, [Luke] has also made the print files available online along with a list of project materials used. It would be neat to see an alternate color scheme or remix for this working prototype of a console that never actually existed. In the meantime, there are plenty more games to play and discover in UFO 50…there’s 50 of them after all.

via Time Extension


hackaday.com/2024/11/28/ufo-50…



Buonasera, @Signor Amministratore ⁂

TL;DR
come si usa la funzione Channels di #Friendica?


Ho provato a usare la funzione Impostazioni > Channels in Friendica per personalizzare alcune #timeline.

A parte quelle predefinite (Ultimi messaggi, latest creation ecc.) non sono mai riuscito a crearne una nuova che effetivamente mostrasse una timeline con una selezione di post.

Ho provato a farne una senza alcun tipo di filtro, che accettasse tutte le lingue e che semplicemente "pescasse" i post da una cerchia.

In teoria mi aspettavo di vedere gli stessi post che vedo cliccando sulla cerchia. In pratica, invece, ottengo comunque una timeline vuota.

Qualsiasi suggerimento è benvenuto. Grazie!

in reply to J. Alfred Prufrock

Hai ragione. La visibilità delle timeline è gestira malissimo 🤣

Diciamo che dopo averle impostate, Per poterle vedere, devi consentirme La visualizzazione nella sezione visualizzazione o display al link seguente:
poliverso.org/settings/display

in reply to Signor Amministratore ⁂

In realtà avevo fatto quanto indicato per la visualizzazione, ma non sembra andare comunque. Che peccato, se andasse sarebbe una marcia in più.

Le cerchie sono un modo pratico per personalizzarsi le timeline, e @RaccoonForFriendica le rende anche pratiche da usare.

Però non si riesce, ad esempio, a fare una visualizzazione "solo post, no boost"

Questa voce è stata modificata (7 mesi fa)



Dissi che la Russia avrebbe distrutto l'Ucraina e così è stato. Adesso devo dare un'altra pessima notizia: la Russia ha appena iniziato.
Le politiche della Nato non hanno fatto bene all'Ucraina.

Alessandro Orsini



Minichord Wants To Help You Find Rad Chord Progressions


26419281

If you’re good at music theory, you can probably find all the chords and progressions you need just by using your fingers and a suitable instrument. For a lot of musicians, though, remembering huge banks of chords can be difficult, and experimenting with combinations can quickly become tedious and tiring. Enter the minichord, a tiny version of the Omnichord synth designed by [Benjamin] that offers to help out by putting all the chords you need a mere button press away.

The minichord is based around the Teensy 4.0, a capable microcontroller platform if ever there was one. It’s paired with a bunch of tactile buttons which are used to tell the Teensy which chord you desire to play. Various combinations of buttons can be used to play more advanced chords, too. There are potentiometers on board as well for volume control, as well as a touch pad for “strumming” arpeggios and other fine control tasks. An online interface allows modifying the presets onboard, too.

[Benjamin] hopes to get the minichord into production; it’s currently in a Seeedstudio competition that could see that happen, based on likes on the project video. The minichord isn’t the only player in this space, of course. The Orchard synth has been making similar waves this week. We’ve seen [Benjamin’s] work before, too. Video after the break.

youtube.com/embed/66Gu4NNnHgA?…


hackaday.com/2024/11/28/minich…

djpanini reshared this.



Sto provando #raccon per #friendica e devo dire che come al solito su smartphone un app fatta bene fa la differenza... Quest'app potrebbe spingermi ad usare friendica finalemte. Anche perché onestamente lo trovo molto più potente e completo di #mastodon che già uso

reshared this

in reply to Manuel

passerei volentieri da mastodon a friendica, più che altro perché il limite di 500 caratteri mi sta strettino. Ma in caso secondo te potrei migrare da una piattaforma all'altra senza perdere lo storico di post, contatti etc.?! Ho sentito che potrebbe essere possibile ma non sono sicuro...
in reply to Adriano Bono

@Adriano Bono non saprei non ho mai provato anche se pure io avevo letto della possibilità, chiediamo a qualcuno più esperto @Ska
in reply to Adriano Bono

@adrianobono da una piattaforma a un'altra non saprei sinceramente, chiedo l'aiuto del pubblico! @macfranc
in reply to Adriano Bono

@adrianobono ho una notizia bella è una brutta:

  • quella brutta è che lo storico Dei tuoi messaggi non lo potresti portare dal vecchio account al nuovo account neanche se passassi da Mastodon a Mastodon. L'unica cosa che potresti fare è una sorta di redirect che fa in modo che i tuoi follower vengano trasferiti sul nuovo account. NB: non si tratta di crudeltà da parte degli sviluppatori, ma di un limite intrinseco del Fediverso, 😅. Tuttavia puoi importare tutti i tuoi contatti, sia esportando da Mastodon quelli che segui e (in maniera più complicata) quelli che ti seguono, e importare tutto su Friendica alla voce"Import Contacts" delle impostazioni!
  • la notizia bella è che nessuno ti obbliga a buttare via il tuo vecchio account Mastodon! Al di là del fatto che sia #RaccoonForFriendica, sia le altre app attualmente usate come Fedilab o Tusky, possono gestire più account, non è mai necessario eliminare il vecchio account. Anzi, come spiego in questo post, un account Friendica può essere utilizzato benissimo anche insieme a un account Mastodon. E d'altra parte, sebbene Friendica sia infinitamente più potente e completo rispetto a Mastodon, l'immediatezza di scrivere un messaggio con mastodon è proprio l'aspetto che caratterizza quella piattaforma.

Naturalmente, se hai bisogno di supporto ulteriore, sono a disposizione 😅

@manuel


HO GIÀ UN ACCOUNT MASTODON: PERCHÉ POTREI USARE ANCHE FRIENDICA? LE POSSIBILI RISPOSTE PER CHIUNQUE ABBIA GIÀ UNO O PIÙ ACCOUNT SU MASTODON.

@Che succede nel Fediverso?

Anche grazie alle limitazioni volutamente imposte dal suo staff di sviluppo, Mastodon è un software relativamente semplice da usare e questa semplicità è diventata uno dei punti di forza di Mastodon ripetto ai tanti social del Fediverso.

Friendica invece non è semplice (qui abbiamo scritto una guida per renderlo forse più comprensibile) e presenta una quantità tale di funzionalità impensabili per qualsiasi altro software del Fediverso; così tante che è facile perdersi e... stufarsi!

Questo è uno dei motivi per cui il numero di utenti che usa Friendica è infinitamente più ridotto di quelli che utilizzano Mastodon, eppure è chiaro che chi non ha usato Friendica ha perso l'opportunità di conoscere bene le reali potenzialità offerte dai social del Fediverso.

Vediamo allora perché un utente Mastodon che vuole mantenere il proprio account Mastodon potrebbe decidere di aprire un nuovo account Friendica.

1) Scrivere post più lunghi, formattati e con immagini in linea e poi ricordarsi di ricondividerli con il proprio account Mastodon, in modo che tutti i follower Mastodon ne abbiano visibilità
2) Rispondere ad alcune discussioni con un messaggio più lungo che consenta di esprimere opinioni più argomentate
3) Impostare il proprio account Friendica per fare in modo che ricondivida automaticamente i post pubblicati dal proprio account Mastodon (sì, da Friendica possiamo farlo allo stesso modo rispetto a quando condividiamo i feed RSS che il nostro account può seguire)
4) Creare un gruppo Friendica (una cosa a metà tra una lista di distribuzione e un gruppo Facebook) da usare per invitare i propri contatti a delle discussioni di gruppo
5) creare un account collettivo che possa essere gestito, attraverso la funzione "delega", da altri utenti della stessa istanza Friendica
6) utilizzare alcune funzionalità di ricerca avanzata (i canali) e di ricondivisione dei contenuti ricercati per rimanere aggiornati su alcuni temi
7) mantenere un account di riserva in caso di problemi (indisponibilità o chiusura del server, sospensione, etc)
8) imparare che al mondo non esiste solo il microblogging e che vi sono sistemi più versatili e ricchi di funzionalità rispetto a Mastodon

Tutto chiaro? Per qualsiasi dubbio, siamo a disposizione!


Luigi Recupero reshared this.



di Paolo Ferrero - Voglio esprimere il mio pieno appoggio allo sciopero generale e un grazie ai lavoratori e alle lavoratrici che vi parteciperanno ed alle organizzazioni sindacali che l’hanno indetto: Cgil, Uil, Adl, Cobas, Cub, Sgb. Mai come questa volta lo sciopero generale è opportuno e giusto! – La situazione in cui versa il [...]


Addio Virus! Gli Scienziati Creano NanoGripper, il NanoRobot DNA che li “Cattura”


Gli scienziati dell’Università dell’Illinois hanno sviluppato un nanorobot, NanoGripper, creato da una singola molecola di DNA. Questa struttura in miniatura ricorda una mano con quattro dita flessibili in grado di catturare i virus, incluso il Covid-19, e impedire loro di entrare nelle cellule. Il dispositivo può essere utilizzato per la diagnosi, il blocco delle infezioni e la somministrazione di farmaci alle cellule bersaglio.

Il DNA è diventato la base del design grazie alla sua forza, flessibilità e capacità di essere programmato. Il nanorobot utilizza speciali aptameri del DNA che riconoscono bersagli molecolari, come la proteina spike del coronavirus.

Una volta rilevato il bersaglio, le dita si piegano per bloccare il virus . Il dispositivo può essere fissato a superfici o sistemi complessi per applicazioni biomediche, comprese la diagnostica e la terapia.
26412097
Per rilevare il COVID-19, NanoGripper è stato integrato con un cristallo fotonico, che ha permesso di sviluppare un test rapido paragonabile in termini di accuratezza ai metodi PCR. Il test dura circa 30 minuti ed è altamente sensibile grazie alla capacità del nanorobot di catturare singole particelle virali. Quando viene rilevato un virus nel sistema, viene attivato un segnale fluorescente che consente il conteggio delle particelle.

Inoltre, NanoGripper è in grado di bloccare i virus nella fase della loro interazione con le cellule. Negli esperimenti di laboratorio, i nanorobot hanno avvolto le braccia attorno ai virus, impedendo loro di legarsi ai recettori cellulari. Ciò apre la prospettiva di sviluppare agenti antivirali, come uno spray nasale, che potrebbero prevenire l’infezione da virus respiratori.

Il dispositivo viene preso in considerazione anche per altre applicazioni mediche, come la lotta al cancro. Il nanorobot può essere programmato per riconoscere marcatori tumorali specifici e somministrare farmaci direttamente alle cellule colpite. In futuro è prevista un’ulteriore ottimizzazione della progettazione e del test della tecnologia per un’ampia gamma di applicazioni biomediche.

L'articolo Addio Virus! Gli Scienziati Creano NanoGripper, il NanoRobot DNA che li “Cattura” proviene da il blog della sicurezza informatica.




Ripristina Credenziali: la nuova funzione di Android per cambiare Telefono senza Stress!


Google ha introdotto una nuova funzionalità chiamata Ripristina credenziali. Tale funzionalità dovrebbe aiutare gli utenti a ripristinare in modo sicuro e rapido l’accesso alle applicazioni di terze parti. Questo ovviamente dopo il passaggio a un nuovo dispositivo Android.

Come funziona Ripristina Credenziali


La funzionalità fa parte dell’API Credential Manager ed è progettata per eliminare la necessità per gli utenti di reinserire più credenziali per ciascuna applicazione. “Con Ripristina credenziali, le app possono connettere facilmente gli utenti agli account su un nuovo dispositivo dopo aver ripristinato app e dati da un dispositivo precedente”, afferma Google.

Secondo l’azienda, questo processo avverrà automaticamente in background mentre l’utente ripristina applicazioni e dati dal vecchio dispositivo. Ciò utilizzerà una cosiddetta chiave di ripristino, che in realtà è una chiave pubblica conforme a FIDO2. Il ripristino della chiave verrà eseguito utilizzando il processo di backup e ripristino integrato di Android.
26410225
Pertanto, quando un utente accede a un’app che supporta questa funzionalità, la chiave di ripristino viene archiviata in Credential Manager (localmente sul dispositivo e crittografata).

L’Utilizzo della chiave di ripristino


Se lo si desidera, la chiave di ripristino crittografata può essere archiviata nel cloud se è configurato il backup nel cloud. Naturalmente è anche possibile trasferire manualmente le chiavi di ripristino direttamente da un dispositivo all’altro.

Di conseguenza, quando si passa a un nuovo dispositivo e si ripristinano le applicazioni, durante il processo verranno richieste le chiavi di ripristino. Queste ti consentiranno di accedere automaticamente agli account senza dover reinserire le credenziali.

“Se l’utente attualmente registrato è attendibile, puoi generare una chiave di ripristino in qualsiasi momento dopo che si è autenticato sulla tua app“, istruisce Google agli sviluppatori di app. “Ad esempio, immediatamente dopo l’accesso o durante un controllo di routine per una chiave di ripristino esistente.”

Si consiglia inoltre di eliminare la chiave di ripristino immediatamente dopo la disconnessione dell’utente per evitare un ciclo in cui l’utente si disconnette intenzionalmente e accede nuovamente automaticamente.
26410228Metodi per trasferire la chiave di ripristino tra il vecchio e il nuovo dispositivo: backup su cloud o connessione diretta al dispositivo
Va notato che Apple ha implementato da tempo funzionalità simili in iOS, che utilizza l’attributo kSecAttrAccessible per controllare l’accesso delle app a determinate credenziali archiviate nel portachiavi iCloud.

L'articolo Ripristina Credenziali: la nuova funzione di Android per cambiare Telefono senza Stress! proviene da il blog della sicurezza informatica.



Keeping up with links shared on your feeds with Sill, a new open protocol with Leaf, and PeerTube is starting to test their mobile app.


Last Week in Fediverse – ep 94

Keeping up with links shared on your feeds with Sill, a new open protocol with Leaf, and PeerTube is starting to test their mobile app.

The News


Sill is a new app that aggregates the most popular links that are posted in your network. Sill connects to both your Mastodon and Bluesky accounts, and gives a combined overview of all the networks, as well as the option to filter the links. It not only shows you the links, but also shows you what people you follow have posted about these links, and sends you a daily email update. Creator Tyler Fisher describes Sill as an open-source passion project, and says he wants to make it sustainable, and is thus thinking about potential ways to make revenue. Fisher also says that he is ‘committed to always keeping the basic Sill web client free’.

The Leaf Protocol is a newcomer in the space of decentralised protocols, a peer-to-peer federation protocol. The Leaf protocol is working towards what they call an ‘agentic fediverse’. The Leaf Protocol is developed in tandem with the product named Weird, which provides people with a simple homepage on the internet. Underneath this website is Leaf, which provides the possibility of federation with other versions of Weird, as well as other potential products. The team has written here on how Leaf compares to ActivityPub and ATProto, as well as about capabilities and identity to see how it holds up to Christine Lemmer-Webber’s ‘recipe for making the “Correct Fediverse IMO (TM)”‘.

One of PeerTubes main goals for 2024 is to release a mobile app. PeerTube has now started testing the first versions of the app, available for both Android and iOS. They note that the app is still under active development, with some features missing.

Ghost’s latest update on their work on implementing ActivityPub shows that they are working on two different types of readers: an inbox for long-form content, and a feed for short-form.

The Links


That’s all for this week, thanks for reading!

fediversereport.com/last-week-…




Digital Security Festival 2024: l’esperienza del presente al servizio del futuro


L’edizione 2024 del Digital Security Festival ha portato i racconti di più esperienze con il comune denominatore della sicurezza cyber in tutto il Nordest, parlando a cittadini, imprenditori e professionisti di come la tecnologia sia – o meglio: debba essere – comunque al servizio dell’uomo. Da qui il tema di “Umanocentrico per natura” che ha saputo caratterizzare 10 incontri in presenza e 4 online.

Marco Cozzi, Presidente del Digital Security Festival 2024, si è reso disponibile per un’intervista dopo la conclusione del Festival offrendoci un feedback ma soprattutto un’anteprima del prossimo futuro.

Com’è andata la sesta edizione del Digital Security Festival?

È stata un’edizione straordinaria, che ha superato ogni aspettativa. Dal 18 ottobre all’8 novembre, il Festival ha coinvolto un pubblico incredibilmente vasto, con oltre 1.000 partecipanti agli eventi fisici e online. Abbiamo avuto 10 tappe in presenza, toccando le Province di Udine, Trieste, Treviso, Padova e Vicenza, oltre a quattro eventi online, con la partecipazione di più di 50 relatori, tra esperti nazionali e internazionali. È stato emozionante vedere studenti, imprenditori e cittadini unirsi a noi per discutere temi cruciali come la sicurezza digitale e l’intelligenza artificiale.
26408836

Quali sono stati i momenti più significativi di questa edizione?

Uno dei momenti più emozionanti è stato sicuramente l’annuncio dell’onorevole Walter Rizzetto sull’approvazione della legge che introdurrà la sicurezza sul lavoro nelle scuole, fatto davanti a centinaia di studenti a Udine. È stato anche entusiasmante l’annuncio della collaborazione del Festival con le Olimpiadi Italiane di Informatica. Ogni incontro è stato unico: a Trieste abbiamo affrontato l’importanza delle normative europee come la NIS2, mentre a Padova abbiamo discusso degli impatti futuri dell’intelligenza artificiale e del computer quantistico. La chiusura a Vicenza, in una location storica, ha offerto un’esperienza speciale, con interventi di relatori di altissimo livello.
26408838Marco Cozzi e l’on. Walter Rizzetto

Qual è stato il tema principale di questa edizione?

Il tema “Umanocentrico per natura” è stato il filo conduttore. Abbiamo voluto mettere al centro il ruolo dell’essere umano nell’evoluzione tecnologica, ispirandoci alla prima legge della robotica di Isaac Asimov. La tecnologia deve essere un mezzo per migliorare la vita delle persone, non un fine in sé. Questo approccio ha stimolato riflessioni profonde, puntando sull’importanza dell’etica e dell’equilibrio tra progresso tecnologico e necessità umane.

Quanto è stato importante il contributo del direttivo e dei partner del Festival?

Fondamentale. Voglio ringraziare il nostro direttivo, composto da Gabriele Gobbo, Sonia Gastaldi, Luigi Gregori e Davide Bazzan, per il loro impegno e la loro passione. Ogni membro ha dato un contributo essenziale per rendere il Festival quello che è oggi: un punto di riferimento per la cultura della sicurezza digitale. Inoltre, il supporto dei nostri partner e sponsor è stato determinante per il successo e il sostentamento dell’evento
26408840Marco Cozzi, Presidente del Digital Security Festival

Quali sono i prossimi obiettivi per il Digital Security Festival?

Il futuro è entusiasmante. Con la trasformazione in Associazione di Promozione Sociale (APS), possiamo espandere le nostre attività e raggiungere tutta l’Italia e pensare anche all’estero. Inoltre abbiamo gettato le basi per studiare un protocollo con il Consiglio per la Parità di Genere, volto al contrasto al divario di genere nelle aree Stem. Il nostro obiettivo è continuare a diffondere la cultura digitale e rafforzare il legame tra tecnologia, etica e umanità, creando un ecosistema digitale più sicuro e inclusivo per tutti.
Siamo solo all’inizio di un percorso che mira a unire tecnologia e umanità in modo responsabile e sostenibile.
26408842
L'articolo Digital Security Festival 2024: l’esperienza del presente al servizio del futuro proviene da il blog della sicurezza informatica.



Chocolate-Coating Machine Mk. 2: the Merry-Go-Round


A chocolate coating machine works in the round to enrobe mint Oreos.

This holiday season, [Chaz] wanted to continue his family’s tradition of enrobing a little bit of everything in dark chocolate, and built an improved, rotating chocolate-coating machine.

You may remember last year’s offering, aka the conveyor belt version. Although that one worked, too much chocolate was ultimately lost to the surface of the kitchen table. [Chaz] once again started with a standard chocolate fountain and bought a round wire rack that fits the circumference of the bowl at the bottom. He snipped a hole in the center large enough to accommodate the business part of the fountain and printed a collar with holes that he cleverly zip-tied to the rack.

[Chaz] also printed a large gear to go around the bowl, a small gear to attach to a six RPM motor, a motor mount for the bowl, and an air blade attachment for a portable Ryobi fan. The air blade worked quite well, doing the double duty of distributing the chocolate and thinning out the coating. Plus, it gives things a neat rumpled look on the top.

Want to make some special chocolates this year, but don’t want to build an enrober? Get yourself a diffraction grating and make some rainbow goodies with melted chocolate.

youtube.com/embed/vCmFPCjinH8?…


hackaday.com/2024/11/28/chocol…



Vannacci stupito dalle parole di Fedez: “Sono lusingato. Avevo ragione, il mondo è proprio al contrario”


@Politica interna, europea e internazionale
Vannacci stupito dalle parole di Fedez: “Sono lusingato” Vannacci si è mostrato sorpreso dalle parole che Fedez ha speso nei suoi confronti dichiarandolo superiore, quantomeno a livello comunicativo, alla segretaria del Pd Elly Schlein. Ospite del programma radiofonico



#NoiSiamoLeScuole questa settimana è dedicato a due Nuove Scuole, la “P. Zuffardi” di Fornovo di Taro (PR) e la Scuola dell’infanzia di Lugagnano Val D'Arda (PC), che saranno costruite ex novo, e al Liceo “Cassinari” di Piacenza che, con i fondi #PNR…


Sciopero generale 29 novembre, si fermano scuola, trasporti e sanità: orari e servizi garantiti


@Politica interna, europea e internazionale
Sciopero generale 29 novembre, orari e servizi garantiti: le informazioni Dalla scuola ai trasporti fino alla sanità: domani, venerdì 29 novembre 2024, Cgil e Uil hanno proclamato uno sciopero generale per protestare contro la manovra finanziaria del




Redbox left 24,000 abandoned DVD rental kiosks. These are some of the people recovering them.#Redbox