Gli hacker cinesi hanno avuto accesso al sistema di posta elettronica del Comitato nazionale repubblicano per mesi prima che l’intrusione venisse scoperta. Il Wall Street Journal ha riferito che all’inizio di luglio 2024 Microsoft aveva avvisato i repubblicani di un attacco informatico avvenuto poco prima della convention nazionale del partito.

Gli esperti ipotizzano che le spie cercassero informazioni su come i repubblicani, una volta tornati al potere, avrebbero gestito la questione di Taiwan. A quanto pare, nei documenti del partito non c’è alcun accenno all’isola, cosa che avrebbe potuto interessare l’intelligence cinese. Nella precedente piattaforma del 2016, il Partito Repubblicano sosteneva un accordo di libero scambio con Taiwan, ma nella nuova versione questo punto mancava.

Secondo il WSJ, i politici hanno saputo dell’attacco solo pochi giorni prima dei tentativi di assassinio di Donald Trump , ma non venne contattata l’FBI a causa delle preoccupazioni circa la fuga di informazioni alla stampa. Nello stesso periodo, il governo degli Stati Uniti ha lanciato l’allarme sui possibili attacchi informatici cinesi alle infrastrutture critiche del Paese. La discussione verteva sull’introduzione di malware nei sistemi di approvvigionamento idrico, energetico e di comunicazione. Gli esperti ritengono che, in caso di conflitto su Taiwan, Pechino potrebbe attivare programmi dannosi, provocando il caos negli Stati Uniti.

Un mese prima, uno simile incidente è accaduto con le e-mail della campagna di Trump: gli hacker iraniani hanno rubato la corrispondenza e l’hanno fatta trapelare ai media.

L’FBI ha rifiutato di commentare la questione e i rappresentanti di Microsoft e del Partito Repubblicano non hanno ancora risposto alle richieste di commento. Non è ancora chiaro se questi attacchi siano collegati al gruppo Salt Typhoon, che precedentemente hackerato Le reti di telecomunicazioni americane avendo accesso a telefonate intercettate, messaggi di testo e altri dati sensibili.

Secondo le informazioni disponibili, tra le vittime dell’attacco potrebbero esserci Donald Trump e il suo vicepresidente J.D. Vance.

L'articolo Gli Hacker Cinesi erano nei Server dei Repubblicani Statunitensi per mesi proviene da il blog della sicurezza informatica.

L’aggregatore di fughe di dati Have I Been Pwned (HIBP) ha aggiunto al suo database più di 284 milioni di account rubati da infostealer e diffusi tramite Telegram. Il fondatore di HIBP, Troy Hunt, ha riferito di aver trovato 284.132.969 account compromessi analizzando 1,5 TB di registri di stealer, apparentemente raccolti da più fonti e pubblicati sul canale Telegram ALIEN TXTBASE.

“Questi registri contengono 23 miliardi di righe e 493 milioni di coppie sito web/email univoche, che interessano 284 milioni di indirizzi email univoci”, ha scritto Hunt in un post sul blog. “Abbiamo anche aggiunto 244 milioni di password mai viste prima al database Pwned Passwords e aggiornato i dati di altre 199 milioni di password che erano già presenti nel nostro database.”

Dato l’elevato numero di account in questo dump, si ritiene che la raccolta possa contenere credenziali vecchie e nuove rubate tramite attacchi di credential stuffing e varie fughe di dati. Prima di aggiungere le informazioni al database HIBP, Hunt ne ha verificato l’autenticità tentando di reimpostare le password di vari servizi utilizzando gli indirizzi e-mail presenti nel dump.

Ora, utilizzando le API appena aggiunte (che consentono di cercare 1.000 indirizzi e-mail al minuto e di cercare nei registri degli stealer), i proprietari di domini e gli operatori di siti che si abbonano a HIBP possono identificare i propri clienti le cui credenziali sono state rubate controllando i registri degli stealer più recenti per dominio e-mail o dominio del sito.

Anche gli utenti stessi potranno scoprire se i loro account sono stati trovati nei registri degli stealer di ALIEN TXTBASE, ma per questo dovranno abbonarsi alle notifiche di HIBP. “Questo mostrerà in quali siti sono state trovate le credenziali, ma solo se l’utente utilizza il servizio di notifica per verificare il proprio indirizzo email. “Non volevo rendere pubblica questa informazione perché avrebbe potuto rendere pubbliche informazioni sull’uso di servizi riservati”, spiega Hunt.

Ricordiamo che non è la prima volta che il database HIBP viene integrato con dati raccolti dai canali Telegram. Ad esempio, l’anno scorso, l’aggregatore di informazioni ha aggiunto un grosso dump al suo database contenente 361 milioni di indirizzi e-mail, nonché credenziali raccolte da numerosi canali Telegram di hacker, dove le informazioni rubate vengono spesso fornite gratuitamente agli abbonati come combo per aumentare la loro reputazione.

L'articolo Hai un account compromesso? 284 milioni di credenziali rubate aggiunte su HIBP! proviene da il blog della sicurezza informatica.

Google ha annunciato che intende eliminare gradualmente l’uso dei messaggi di testo SMS per l’autenticazione a più fattori in favore di metodi più sicuri. L’autenticazione a più fattori (MFA) tramite codici monouso e SMS è stata introdotta in Gmail nel febbraio 2011 e nel 2021 Google ha reso obbligatoria l’autenticazione a più fattori per la maggior parte dei suoi servizi.

Gli SMS nel contesto dell’MFA hanno perso da tempo la loro rilevanza a causa della loro intrinseca insicurezza. Va notato che il National Institute of Standards and Technology (NIST) aveva già lanciato l’allarme sui possibili rischi già dal 2016.

Negli ultimi nove anni la situazione non ha fatto che peggiorare, con un aumento dei casi di frode, scambio di SIM e persino vulnerabilità in SS7. Di conseguenza, lo scorso anno la CISA ha raccomandato ufficialmente di abbandonare l’autenticazione tramite SMS in favore di metodi più sicuri.

Come annunciato ora da Google, l’azienda ha deciso di eliminare gradualmente l’invio di password monouso tramite SMS. “Nei prossimi mesi riconsidereremo il modo in cui verifichiamo i numeri di telefono”, ha dichiarato ai media il portavoce per la privacy di Google, Ross Richendrfer. “In particolare, invece di inserire un numero e ricevere un codice di 6 cifre, sullo schermo verrà visualizzato un codice QR, che dovrà essere scansionato utilizzando l’app della fotocamera del telefono.”

Tuttavia, l’azienda non ha ancora eliminato completamente i messaggi SMS e a volte li utilizza per confermare l’identità. Tuttavia, per effettuare l’accesso, gli utenti dovranno scansionare i codici QR (a meno che non utilizzino chiavi di sicurezza, token e altre soluzioni).

“I codici SMS rappresentano un’area ad alto rischio per gli utenti e siamo entusiasti di presentare un nuovo approccio innovativo per ridurre la superficie di attacco per gli aggressori e proteggere gli utenti da attività dannose”, ha affermato Richendrafer.

L’azienda promette di fornire presto maggiori dettagli sulle modifiche. L’azienda non ha ancora annunciato date specifiche per l’implementazione delle modifiche per i titolari di account Google e gli utenti Gmail.

L'articolo Google dice addio agli SMS per l’MFA! Ecco cosa cambia per la tua sicurezza proviene da il blog della sicurezza informatica.

Un presunto exploit zero-day per VMware ESXi è apparso nei forum underground, offerto da un criminale informatico noto come “Vanger“.

Secondo le informazioni trapelate, l’exploit consentirebbe l’evasione dalla macchina virtuale (VM Escape), una delle minacce più critiche per gli ambienti virtualizzati. Il prezzo? 150.000 dollari. Ma è reale o un ennesimo tentativo di frode?

Il pericolo del VM Escape

Se autentico, questo exploit potrebbe consentire agli attaccanti di bypassare il livello di isolamento garantito dall’hypervisor ESXi, compromettendo il sistema host e le altre VM in esecuzione sullo stesso server. Ciò significa accesso non autorizzato ai dati sensibili, diffusione di malware e possibilità di movimento laterale all’interno della rete aziendale.

Le versioni affette sarebbero comprese tra la 5.5 e la 8.0, inclusi aggiornamenti specifici come ESXi 8.0 Update 3c e versioni precedenti. L’inserzione di Vanger elenca dettagliati numeri di build, suggerendo una conoscenza approfondita dell’ecosistema VMware.

Affare reale o ennesima truffa nei forum underground?

Non è la prima volta che sui marketplace del dark web vengono messi in vendita exploit con promesse da capogiro. Tuttavia, il venditore non vanta una reputazione solida nel settore degli exploit: le sue precedenti attività si limitavano alla vendita di credenziali di accesso aziendali compromesse.

Questo solleva forti dubbi sull’autenticità dell’exploit e sull’affidabilità della fonte. Potrebbe trattarsi di una frode? Assolutamente sì, ma il rischio che sia reale non può essere sottovalutato.

Le contromisure: come proteggersi da un possibile attacco

Indipendentemente dalla veridicità di questa minaccia, il solo fatto che venga pubblicizzata dimostra come le infrastrutture virtualizzate siano nel mirino del cybercrime. Le aziende devono adottare un approccio di sicurezza a più livelli per proteggere i propri ambienti:

• Patch Management: aggiornare regolarmente VMware ESXi e gli strumenti associati per chiudere le vulnerabilità note.
• Isolamento: limitare le funzionalità di condivisione tra VM e host, come clipboard e cartelle condivise.
• Monitoraggio: implementare soluzioni di sicurezza avanzate per rilevare attività sospette sia sulle VM che sull’host.
• Access Control: restringere i privilegi amministrativi e applicare l’autenticazione a più fattori per l’accesso agli hypervisor.

Conclusione

Che sia un inganno o meno, questo presunto exploit zero-day mette in luce una realtà inconfutabile: gli attori delle minacce stanno puntando sempre più aggressivamente alle infrastrutture virtualizzate.

La sicurezza non è un’opzione, ma una necessità. Mantenere i sistemi aggiornati e implementare misure di protezione robuste è l’unica difesa contro un panorama di minacce in continua evoluzione.

L'articolo Exploit Zeroday per VMware ESXi in vendita sul Dark Web per 150.000 dollari proviene da il blog della sicurezza informatica.

#History #China #PersianEmpire #TurkicEmpire #MongolEmpire #RussianEmpire #SilkRoute #Eurasia #Transoxiana #FerganaValley #Uzbekistan #Tajikistan #Turkmenistan #Kazakhstan #Kyrgyzstan #Islam #MilitantIslamism #Jihad #CentralAsia #URSS #SovietUnion

from: Jihad : the rise of militant Islam in Central Asia
by: Ahmed Rashid

2 Conquerors and Saints: The Past as Present

The ethnic, political, and religious factions now vying for control in Central Asia have a history almost as old as the Central Asian civilizations themselves. Since around 500 B.C., when Darius I added the region known as Transoxiana (present-day Uzbekistan and Tajikistan) to the Persian Empire, to the 1920s, when Stalin forcefully divided the region into the five socialist republics that correspond to the current independent republics, Central Asia has been a center for war and empire, art and culture, religion and commerce.
Much of the reason for Central Asia's rich history is geographical: its huge landmass lies at the heart of the Eurasian continent. In ancient times it was considered the center of the world, linking China with Europe by means of the famous Silk Route. In reality this consisted of several routes, forged to allow merchants to carry goods by camel caravan across the two continents. But the travelers transported more than silk or spices; they also spread new technologies—such as papermaking, gunpowder, and silk weaving— new ideas, and new religions. The religion of the ancient Greeks, Buddhism, Judaism, Zoroastrianism, Nestorian Christianity, Hinduism, Manichaeanism, and most of the major ideas of Islam have at one time or another found a home in Central Asia. It is the prevalence of the various ideas on Islam, in particular, and how they have been received by the various rulers of the Central Asian landmass, that are essential to an understanding of the conflicts that threaten the region today.

The Importance of Geography

Central Asia's greatest strength in the past— and its greatest problem today— is that it is landlocked, bordering Iran and Afghanistan to the south, China to the east, and Russia to the north and west. The vast Central Asian steppe is bounded by the Caspian Sea in the west, the Hindu Kush and the Pamir Mountain ranges in the south, and the Tian Shan Mountains in the -est along the border with China. There are no clear geographical boundaries in the. north, where the Kazakh steppe merges into Siberia.
Central Asia was once known as "the land between the two rivers'' for the two major rivers, the Amu Darya (Oxus) and the Syr Darya (Jaxartes), that bounded much of its territory before emptying into the Aral Sea. These two rivers have created formidable geographical, cultural, and political boundaries that separated Central Asia from the rest of the world even as the Silk Route connected it.
The Amu Darya, for example, divided the nomadic Turkic and Mongol empires in Central Asia from the Persian Empire to the south, and helped act as a buffer— along with an independent Afghanistan— between the British Empire in India and tsarist Russia. Recently it has marked the border between Taliban-ruled Afghanistan and Central Asia.
The Syr Darya has protected Central Asian kingdoms from periodic invasions from Mongolia, Siberia, and the Gobi Desert. Rivers are not the only natural boundaries.
Central Asia lies at the crossroads of the world's highest mountain ranges: the Pamir Mountains, which cover 93 percent of today's Tajikistan; the Tian Shan Mountains, stretching to the east and north of the Pamirs; the Himalayas to the southeast; and the Hindu Kush to the south.
The legendary traveler Marco Polo crossed the Pamirs in 1273 on his way to China, dubbing the range the Roof of the World. "Ascending mountain after mountain, you at length arrive at a point, where you might suppose the surrounding summits to be the highest lands in the world. ... So great is the height of the mountains, that no birds are to be seen near their summits. Here there live a tribe of savage, ill disposed and idolatrous people, who subsist upon the animals they can destroy and clothe themselves with the skins," wrote Polo in his memoirs.
In the center of this vast, magnificent landscape of mountains and steppe are two of the largest deserts in the world.
In the south, covering much of Turkmenistan, is the Kara-Kum (black sands) Desert: more than 135,000 square miles where rain falls approximately once a decade.
To the north, in Uzbekistan, lies the Kyzyl Kum (red sands) Desert.
But between these bleak wastes lush, well-irrigated valleys provide oases around which settlements and cities have grown, each oasis a self-contained economic community whose citizens traded with the local nomads and caravans that passed through. The harsh, sparsely populated landscape made Central Asia ripe for conquest but difficult to rule: empires rose and fell periodically throughout its history.
The geographical face of Central Asia remained largely untouched until the late nineteenth and twentieth centuries, when the region became part of the Russian Empire and then the Soviet Union. The Russians and later the Soviets changed the landscape, building massive irrigation networks flowing from huge reservoirs to support cotton agriculture between the Amu and Syr Darya rivers. Although in the process they created irretrievable environmental damage and pollution that have eventually resulted in acute water shortages, the drying up of lakes and rivers, and further desertification, the water routes were for many years essential sources of agriculture and food. Today those irrigation networks lie broken, hostage to the political battles that divide the region.
Central Asia currently comprises five independent republics: Kazakhstan, Uzbekistan, Turkmenistan, Kyrgyzstan, and Tajikistan, whose fiercely disputed boundaries were drawn by Stalin as part of his divide-and-rule campaign. Its landmass of 1,542,200 square miles hosts a population of just 52 million people, representing more than one hundred ethnic groups, from the predominant Uzbeks, Kazakhs, and Tajiks to Germans, Koreans, and Tibetans. The largest ethnic group is the Uzbeks, who make up 72 percent of Uzbekistan's 22 million people as well as substantial minorities in all the other Central Asian republics. Before the breakup of the Soyiet Union, there were also some 10 million Russians, comprising one-fifth of the population, many the result of forced relocation by Stalin, as another means of weakening the power of the region's ethnic groups. A large number of these Russians have migrated to Russia since 1991.
But the heart of Central Asia has always been the Fergana Valley. Just two hundred miles long and seventy miles across at its widest point, the fertile valley has for centuries been the home for the largest concentration of people. Today it has 10 million inhabitants, 20 percent of the total population of Central Asia.
The emperor Babur, who conquered Afghanistan and founded the Mogul Empire in India in the fifteenth century, was born in the Fergana Valley, describing it in his memoirs as the closest place to Paradise on earth. From his splendid palaces in Delhi, Babur would recall the 140 varieties of grapes and watermelons produced in Fergana. Valley horses were prized as cavalry mounts by nomadic tribes and empire builders as far away as China.
More than crops and livestock flourished in the Fergana Valley. Fergana has also traditionally been the center of Central Asia's political and cultural Islam, producing saints, scholars, mystics, and warriors whose knowledge and learning spread across the Muslim world.
The bordering city of Osh, today the second-largest city in Kyrgyzstan, was a seat of Islamic learning in the tenth century. Legend has it that the large mountain in the center of the town was blessed by King Solomon; it still bears the name Takht-i-Sulaiman (Seat of Solomon) and was long a site of Muslim pilgrimage. To the west lie the ancient Muslim capitals of Bukhara and Samarkand. The 360 mosques and 113 madrassahs (Islamic religious schools) of medieval Bukhara produced scholars who spread their faith throughout Russia, China, South Asia, and the Middle East. In the words of a medieval proverb: "The sun does not shine on Bukhara, it is Bukhara that shines on the sun." Even after Bukhara became a Russian protectorate in 1868 there were still 100 madrassahs in Bukhara, with some 10,000 students.

History of Conquest

The history of Central Asia is a tale of conquest, of Mongol "hordes" and Arab holy warriors who swept across its steppes and crossed its mountains and, for a time, enfolded it within the largest empires in the world. Alexander, Tamerlane, Genghis Khan: at one time each of these conquerors added the territories of Central Asia to his vast empire, founding dynasties that survived for centuries— until the next invader arrived.
Early Central Asian history is dominated by the rivalry between the Persians to the south and the Turkic tribes to the north, who vied for control of the rich oasis cities. The Persian Empire under Darius I added Transoxiana to its territory around 500 B.C. but the Persians were ousted for a time by Turkic nomadic invasions from Siberia and Mongolia. These tribes had originally (beginning in about 1000 B.C.) inhabited the Alatau Mountains in eastern Central Asia. (The Chinese began using the word Tur or Turkic to identify all the nomadic tribes who posed a threat to their empire— the ancient origins of the word Turkistan [home of the Turks], used even today to identify Central Asia.) The resurgent Persians next fell victim to Alexander the Great, who conquered Bactria and Sogdiana (ancient Uzbekistan, Tajikistan, and Afghanistan) between 329 and 327 B.C., founding the modern-day city of Khujand. Alexander consolidated his control by urging his men to marry local women; he himself married a Sogdian princess, Roxana. Alexander's Greco-Sogdian heirs created the Bactrian Empire, which governed a large part of Central Asia and Afghanistan between 300 and 140 B.C. The western region of Central Asia (presentday Turkmenistan) was ruled by the Parthians, a tribal dynasty based on the Saka tribes, whose empire lasted until A.D. 226, when they were defeated by the Persian Sassanids. Meanwhile, the north of Central Asia was invaded in the last century B.C. by successive waves of Sakas, who in time were driven out by another tribal group of nomads from the Gobi Desert: the Hsiung-nu, the forefathers of the Mongols. The Hsiung-nu had spread west after defeating the Uighurs, another tribal confederation who at that time ruled present-day Xinjiang Province and western China. Continuing their westward march across Central Asia, the Huns, as they were now called, reached the Volga River by a.d. 400. Their empire— the first nomadic Mongol empire— now stretched from Korea to the Volga.
In the fifth century the Huns invaded Europe under their chief Attila and marched on Rome. As the Huns moved westwards the vacuum in eastern Central Asia was once again filled by invading Turkic tribes, who continued their incursions for several centuries. These nomadic invasions from Mongolia and western China have left behind few traces of their empires or culture, and little is known about the political system they erected to rule their vast landmass. Invariably, they would arrive to conquer and then move on eastwards whilst other tribes arrived to take their place.
One nomadic empire did leave some impressive traces: the Kushan Empire, which dates from the first and second centuries A.D. and also included northern India, Iran, and present-day Xinjiang Province in China. In the second century the great Kushan king Kanishka became a patron of the Mahayana school of Buddhism, which was the first to humanize the figure of Buddha. (Previously Buddha had been depicted only by symbols, such as the prayer wheel.) Massive and beautiful stylized Kushan Buddha statues have been unearthed in archaeological digs in the twentieth century in Afghanistan and Tajikistan. It is also noteworthy that in keeping with the religious tolerance that has always characterized Central Asia, the Kushans allowed Zoroastrianism and Hinduism to flourish alongside Buddhism.
For the first several centuries A.D., then, various groups contended over Central Asia: Huns, Sassanians, Turks, and Chinese, who invaded the Fergana Valley. But the next important series of incursions began around 650, when the Arabs came, bringing with them the new faith of Islam. During the next hundred years they sent invading forces into Transoxiana, capturing Bukhara and Samarkand. In 751 an Arab army defeated a Chinese army at Talas, in present-day Kyrgyzstan, decisively ending Chinese ambitions and establishing Islam in Central Asia, although the Arabs themselves did not remain to found substantial kingdoms in the region.
Independent Muslim kingdoms sprang up in the oasis cities. The most significant of these was the empire of the Persian Samanids (874-999), who made their capital at Bukhara. With a well-organized bureaucracy and army the Samanids regulated and expanded the Silk Route, spreading the Persian language and making Bukhara a trade, transport, and cultural center of the Islamic world. Physicians such as Ibn Sina, mathematicians like Al Biruni, and poets such as Firdausi ensured that the Samanid court would leave an indelible mark on the development of the Persian language and culture, an importance that would not be eroded in Central Asia for centuries.
The Samanid Empire came to an end with the arrival of a new wave of Turkic tribes. The Ghaznavids (based in Ghazni, Afghanistan) took over Khurasand, the Qarakhanids captured Bukhara, and later the Seljuks arrived to defeat them and conquer Central Asia and Turkey.
By 1055 the Seljuk chief Turhril was standing outside the gates of Baghdad. For the next two hundred years the Seljuks ruled the area from the Pamir Mountains and the borders of China to Iraq, uniting Central Asia with the Persian and Arab worlds for the first time under Turkic hegemony.
The Mongol hordes (ordas) were the next to sweep through the region. In 1218 the Seljuks had executed an envoy of the Mongol ruler Genghis Khan and murdered 450 merchants who had been trading with the Mongols. The infuriated Mongols set out to conquer the Seljuks, and historians have subsequently blamed Seljuk high-handedness for the Mongol onslaught that followed. Under Genghis Khan the Mongols captured Bukhara in 1220, killing thirty thousand people. Standing before a pile of heads in Bukhara, Genghis Khan declared, "You ask who I am, who speaks this to you. Know, then, that I am the scourge of God. If you had not sinned God would not have sent me hither to punish you." The Mongols continued eastwards, adding Russia and parts of Eastern Europe to their empire. Then, having conquered this vast area, they settled down to exploit it. They developed the Silk Route, which had broken down during the incessant invasions, building resthouses along the way and instituting a postal service. Under the Mongols it was possible for caravans to travel in safety from Istanbul to present-day Beijing. For the first time since the conquests of Alexander the Great, Europe was linked with Asia. After the death of Genghis Khan, Central Asia was ruled by his son Chagatai, whose descendants divided the region into two khanates: Transoxiana in the west and Turkistan in the east.
The last great explosion out of Central Asia was to leave the most significant cultural influence in the region. Timur (Tamerlane), who did not begin his conquests until he was forty years old, created the first indigenous empire in Central Asia. Timur was a Barlas Turk who had been born near Samarkand, and he made the city his capital in 1369. After he had conquered Central Asia, he added India, Persia, Arabia, and parts of Russia to his empire. Samarkand was already one of the largest cities in the world, with a population of 150,000, and under Timur it became one of the architectural marvels of the world as well, for Timur brought in artisans and architects from all the conquered regions. By now, after almost four hundred years of Turkic rule, the region had become established as the center for Turkic influence in Central Asia and of resistance to Persian cultural and political domination. Timur even replaced Persian with the Jagatai dialect of Turkish as the court language. The Shaybani Uzbeks, who traced their genealogy back to Uzbek Khan, a grandson of Genghis Khan, created the last of the great nomadic empires in Central Asia. In 1500 they defeated the Timurids (descendants of Timur) and set up their capital in Bukhara. Under Shaybani rule Turkic (Uzbek) language and literature flourished. The great Uzbek poet Mir Alisher Navai (1441-1501) created the first Turkic script, which replaced Persian.
After the sixteenth century, weakened by the decline of the Silk Route as sea routes opened linking Europe to Africa and India, the Shaybani Empire began to erode. Large empires and strong rulers were no longer needed to ensure the safety of the Silk Route, whilst the dramatic loss of income from the traffic in trade meant that rulers were no longer capable of keeping large standing armies and expanding their kingdoms. In addition, the conservative ulema (Islamic scholars, who had enormous influence over daily life) banned innovations in education and science, further marginalizing Central Asia. The Shaybani Empire gradually degenerated into a collection of small, squabbling, city-based fiefdoms. In the seventeenth and eighteenth centuries these emerged as three separate but weak khanates— Khiva, Kokand, and Bukhara — in which the khans (rulers) later established dynasties: the Kungrad in Khiva, the Mangyt in Bukhara, and the Ming in Kokand. The impoverished khans survived by the slave trade and the imposition of exorbitant taxes on the population.
It was inevitable that the tsars, seeking to expand their Russian empire, should eventually look to Central Asia. By 1650 the Russians had annexed Siberia and reached the Pacific Ocean. In the next two centuries Russia moved to conquer the Caucasus and Central Asia. Peter the Great invaded the Kazakh steppe in 1715 and began building Russian forts, the first at Omsk in 1716. By 1750 all the Kazakh khans, who saw the Russians as their best security against the marauding Uzbeks, had signed treaties with Moscow. The Russian expansion was fueled by the empire's vast military bureaucratic apparatus, which had subdued the Caucasus and was now without a role even as the tsars eyed the potential resources of Central Asia: minerals and cotton. When the American Civil War (1861-65) cut off vital cotton supplies to Russian factories, the urge to conquer Central Asia was irresistible. At the same time Russia was watching with apprehension the steady expansion of the British Empire in India from Bengal towards Afghanistan. This was the era of the Great Game —the vast power struggle between Russia and Great Britain for control of Asia that used Central Asia and Afghanistan as pawns in their efforts to outmaneuver each other, building influence. At the end of the nineteenth century, Afghanistan was established as buffer between the two empires of Russia and Britain.
In the brief period between and 1876, Russian armies captured Tashkent and much of modern-day Uzbekistan, Turkmenistan, and Tajikistan, although the border between Afghanistan and Tajikistan remained open, and tribal leaders and bandits frequently took refuge in one another's territories— a tradition that is being revived today amongst the Islamic extremists of Central Asia and the Taliban. The Russians established the province of Turkestan, whose capital was Tashkent and which was ruled by a governor general appointed by Moscow. They left the khanates of Bukhara and Khiva as autonomous political units, dependent on Russia. Whilst the settled regions were easily conquered, the nomadic tribes continued to resist for several decades, and periodic revolts broke out in the Fergana Valley. In 1885 Russian troops crushed a revolt in the valley towns of Osh, Margilan, and Andijan led by a Sun Dervish, Khan Tura. The most serious threat to Russian rule arose in May 1898, when twenty-two Russian soldiers were killed in Andijan by Islamic rebels. The revolt spread to other towns before Russian troops arrived and brutally quashed the rebellion.
As a way of controlling the region, the Russians began resettling Central Asia with ethnic Russians and Cossacks and turning the rest of the land over to cotton production; in 1891 alone more than a million Russian and Cossack farmers were settled on Kazakh lands adjoining Siberia. The Russians developed large cotton plantations by means of vast irrigation projects. New industries manned by Russian workers were also introduced, and Central Asia was linked with Russia through a railway network that for the first time brought the Russian Empire up to the borders of Afghanistan, Iran, China, and British India. Tsarist rule ended in a holocaust of suffering for the peoples of Central Asia. In 1916, with the region facing a massive famine, a revolt broke out after Moscow tried to draft Central Asians to fight for the tsarist army in World War I. The government also increased taxes and forcefully appropriated wheat from the region. The Kazakh and Kyrgyz nomads, who saw no reason why they should fight in Europe for the tsar, were the first to rebel, and the revolt soon spread across Central Asia. But as with previous rebellions, tsarist troops brutally suppressed it, killing tens of thousands of people in the process. In the Tian Shan Mountains a Cossack army carried out reprisals against the Kyrgyz, slaughtering flocks, burning down villages, and forcing huge numbers of Kyrgyz to flee across the border into Chinese Turkestan. Even today the Kyrgyz identify the 1916-17 repression as the worst period in their history, in which as much as a quarter of the Kyrgyz population was slaughtered or forced to flee.
But when the Russian Revolution broke out in 1917, Central Asia had no desire to become part of the new Soviet Union. Central Asians resisted Sovietization more fiercely than most other regions, with the Muslim Basmachis ("bandits"), as the Bolsheviks termed them, leading the struggle. By 1929, however, when the Basmachis were finally defeated, the map of Central Asia had been forcibly redrawn into five soviet republics, and the centuries of wars for control of the region seemed to have come to an end. That too was to change.

Islam in Central Asia

The people of Central Asia are predominantly Sunni Muslims of the Hannafi sect. Shia Muslims make up a small minority in some of the great trading cities, like Bukhara and Samarkand, as well as in Tajikistan, where the Ismaeli sect, whose spiritual leader is the Aga Khan, can be found in the Gorno-Badakhshan region of the Pamir Mountains. (The Ismaelis also occupy adjacent areas south of the Pamirs in modern-day Afghanistan and Pakistan.) Since 1991 Central Asia has also seen a meteoric rise of militant Islamic sects, each with its own brand of orthodoxy and sharia (Islamic law), and this phenomenon has obscured one of the most important aspects of traditional Central Asian Islam— its tolerance. Characterized by major advances in philosophy, ethics, legal codes, and scientific research under largely liberal political rulers, and spread through a vast region by Arabs, Mongols, and Turks, the Islam of Central Asia took many forms. Early Central Asian Muslims coexisted in relative peace not only with one another but also with the Jews, Buddhists, Hindus, Zoroastrians, and Nestorian Christians who had established pockets of civilization in the region.
Perhaps the most important Islamic movement to arise in Central Asia was Sufism: a form of Islamic mysticism that preached direct communion with God and tolerance towards all other forms of worship. Sufism originated in Central Asia and Persia soon after the Arab invasions. The name derives from the rough woolen cloaks worn by the early Sufi brothers (sufi means "wool" in Arabic), who inherited some of the symbols of pre-Islamic nomadic mystics. The Sufis encouraged popular participation in Islam through their opposition to authority, intellectualism, and the mullahs (clergy).
Sufis urged all Muslims to experience God directly, without the intervention of priests or scholars— an important factor in the spread of Islam amongst Central Asia's sparse, nomadic population. The Sufi orders, or tariqas ("the way"), are best defined as "brotherhood[s] of Sufis who have a common pedigree of spiritual masters, ... in which elders initiate disciples and grant them formal permission to continue a common school of thought and practice."
Sufis invoke God through the zikr, vocal (or sometimes silent) prayers, Dervishes—another Sufi sect— perfected into an art form. Many of the tariqas evolved into secret societies with their own codes of behavior and prayer. The tariqas played a major role in reviving Islam in the thirteenth century after the Mongol destruction, and they continued to sustain Islamic faith and practice centuries later in the Soviet era, when Islam was driven underground by the authorities.
The most important tariqas are Naqshbandiyya, Qadiriyya, Yasawiyya, and Kubrawiyya.
The Qadiriyya, probably the oldest extant order, was founded by Abd al-Qadir. A minor tariqa in Baghdad in the twelfth century, the Qadiriyya moved to Central Asia, becoming particularly strong during the thirteenth century, and then spread to Afghanistan and India. Central Asian Qadiris were centered mainly in the cities of Transoxiana.
Kubra, the founder of Kubrawiyya, was martyred in the Mongol massacres in Central Asia in 1221. The Kubrawiyya order took strong hold in Khorezm (present-day Uzbekistan).
The Yasawiyya order was founded by the poet and mystic Ahmed Yasawi, who died in 1166 and is buried in southern Kazakhstan. Their main influence was in the Fergana Valley and amongst the southern Turkic tribes.
Muhammad ibn Baha ad-Din Naqshband (1317-89), the founder of the Naqshbandiyya tariqa, is still the most revered mystic and saint in Central Asia and Afghanistan. Even today his tomb outside Bukhara is the most important place of pilgrimage in Central Asia.
Unlike other Sufi sects the Naqshbandis, though mystics, believe in active missionary work and political activism; many led revolts against the tsar and the Communists. The leader of the 1898 revolt in Andijan was a Naqshbandi.
The Sufi orders spread their message to China via the Fergana Valley and to India and the Arab world through Afghanistan. Sufi spiritual leaders, especially the Naqshbandis, vied with the traditional ulema, who tended to be fiercely opposed to them, for influence amongst local rulers. And influence they had: the rulers of the Turkic dynasties would seek validation for their rule from the leading Sufi saints. The relationship of ruler and mystic, in the words of Islamic scholar Bruce Lawrence, tended to be "fraught with tension," for Sufi mystics saw themselves as eternal rulers, more powerful than the most autocratic temporal ruler.
In the eighteenth and nineteenth centuries the leading Naqshbandi families (leadership in the sect was frequently passed down from father to son) served as political advisers and spiritual guides to many of the khans who governed the increasingly fragmented Central Asia. Some of these Sufi families became rulers themselves. Many became rich and corrupt in the process, one of the reasons for the Jadid reforms in the nineteenth century. In the twentieth century Naqshbandi political activism played a major role in influencing militant Islamic movements in Afghanistan, Chechnya, and most recently the Fergana Valley.
But beyond the oasis towns and valleys, the spread of Islam on the Central Asian steppe was slow and sporadic. Islam did not come to the Kazakh steppe until the seventeenth century, and even then the predominant Sufism incorporated ancient shamanistic traditions of the nomadic culture, such as the veneration of animals and nature. Although Zoroastrianism, the religion of the Persian kings, was discouraged by the Islamic invaders, elements continued to thrive on the steppe, taking on an Islamic coloring, as well as in Iran and India.
Thus, early on in the history of Islam two branches of the religion emerged in Central Asia: the traditional, conservative, scholarly Islam of the settled areas and the oasis cultures that was dominated by local rulers and the ulema, and the much looser, less restrictive Islam of the nomads that still favored Sufism and pre-Islamic traditions.
As historian Fernand Braudel noted, "Islam is essentially an urban religion. So Islam consists of a few densely populated regions, separated by vast stretches of empty space."
Even today the nomadic Kazakh, Kyrgyz, and Turkmen tribes are far less Islamicized— and much less susceptible to Islamic radicalism— than their ethnic counterparts in the settled oasis areas.
The Arabs who brought Islam Central were soon displaced by Persian and Turkic tribes, each of whom adopted Islam. Of the two, for many centuries Persian was the dominant influence, lasting until the Safavid dynasty came to power in Persia around 1500. The Safavids changed Persia's state religion from Sunni to Shia Islam— step that considerably reduced Persian influence in Central Asia. In addition, Persia became preoccupied with combating the challenge of the Ottoman power in Turkey on its western borders, and Persian leaders therefore paid less attention to Central Asia.
Nevertheless, the earlier Persian empires had left an enormous legacy in Central Asia in the arts, language, poetry, and sciences. Not until the Shaybani Uzbeks, who aggressively made their empire more Turkic, did Persian control and influence in Central Asia wane. The only vestiges of Persian ethnicity remaining in Central Asia today are the Tajiks, who speak Persian and are proud of their Persian culture and heritage. But the tension between Persian and Turkic culture continues, both in the competition for influence in Central Asia between Iran and Turkey and in the ongoing disputes between Tajikistan and Turkic Uzbekistan over Tajiks in Uzbekistan and Uzbeks in Tajikistan, and over borders. Many Tajiks assert that the cities of Bukhara and Samarkand, which Stalin handed over to Uzbekistan, should rightfully belong to Tajikistan. For they are Tajik cultural and historical centers.
Central Asian Islam became less dynamic under the tsars, not because Central Asia's new Russian masters tried to interfere with the Islamic clergy, law, or practices but because they wooed them with modern advances: industry, education, technology. The Russians also supported the ultra-conservative ulema, whilst at the same time settling millions of ethnic Russians in the region to try and make good Russians out of Central Asians.
But the new colonial masters were only partly successful. The introduction of Western ideas and sciences paved the way for a modernist reinterpretation of Islam by the Jadids, a reform sect of Tartars whose inspiration was Ismail Bay Gasprinski (1851-1914), founder of the influential Tartar-language newspaper Tercuman in 1883. Based on Usul-i-jadid (new educational principles), Jadidism was one of the many intellectual Islamic reform movements that swept the colonized Muslim world in the late nineteenth century. All sought in varying degrees to reconcile the problems associated with exposure to Western modernism with Muslim religion and culture, particularly for Muslims who lived in colonies ruled by non-Muslims. These movements, in India, Egypt, Turkey, and Afghanistan, were primarily anticolonial and pan-Islamic, but they also advocated religious reform, modern education, and an understanding of the sciences.
Jadid teachers and scholars in Tashkent and the Fergana Valley founded new schools with modern curricula: math, the sciences, theater, poetry, and Russian and Turkic literature, as well as traditional Islamic subjects. They staged plays and operas and published a number of newspapers that helped revive the Turkic languages and develop a modern Turkic culture. The literature they generated analyzed local history, culture, and politics in a modern way for the first time. This embrace of modernism brought the Jadids into conflict not just with the Russians but also with the ulema, whom they considered reactionary and obscurantist. For their part the Russians had encouraged the ulema to continue their practice of a conservative interpretation of the sharia as a way of countering anti-Russian Islamic and nationalist movements.
For all their success the Jadids remained an intellectual rather than a mass movement, divided over ideology and politics. When the 1917 revolution came, some Jadids backed the Bolsheviks because they sought to throw over the tsarist empire and saw in the Communist ideology a chance of greater freedom, the adoption of modern ideas, and education whilst others resisted them because of their lack of respect for Islam. The Jadids who joined the Communist Party after 1917 played a critical role in helping build indigenous Communist parties in Central Asia, but it did them little good. The Soviets termed the Jadids bourgeois reformers and banned their literature. When Stalin came to power he began a steady purge of Jadids; the last Jadids were eliminated in the massacres of 1937. During the brief cultural flowering after independence in 1991, Uzbek intellectuals attempted to republish and popularize Jadid writings, but they were quickly suppressed. Uzbek President Islam Karimov discourages all attempts to renew interest in Jadidism, although the movement has immense relevance in today's discussion of the way Islam, nationalism, and democracy can coexist in Central Asia.

Sembra che Paolo Zampolli abbia ricevuto la nomina direttamente da Trump, ma nessuna istituzione italiana ne sa niente, e non si sa neanche cosa viene a fare

Questo “inviato speciale” degli Stati Uniti in Italia è un caso strano: ilpost.it/2025/02/27/zampolli-…

Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept (PoC) instances decreased compared to 2023. Among notable techniques in Q4, attackers leveraged undocumented RPC interfaces and targeted the Windows authentication mechanism.

Statistics on registered vulnerabilities

This section contains statistics on registered vulnerabilities. Data is sourced from the CVE portal: cve.org.

Total number of registered vulnerabilities and number of critical ones, Q4 2023 vs. Q4 2024 (download)

In Q4 2024, the trend of documenting software flaws that create vulnerabilities continued to gain momentum. The share of vulnerabilities labeled as critical was slightly higher than in Q4 2023. In general, more and more vulnerabilities are being assigned CVE identifiers through Bug Bounty programs and general software security research. Let’s also examine the number of public exploits.

Number of vulnerabilities, the share of critical ones, and those for which exploits exist, 2019–2024 (download)

As shown in the graph, the number of published exploits for vulnerabilities ended up at around 6%, which is 4 p.p. lower than in 2023. This decline may be due to vendors’ requirements not to disclose information about exploitation methods for discovered vulnerabilities and corresponding exploits—we believe researchers are increasingly encountering such requests. Thus, the main trends of 2024 were the growth in the number of registered vulnerabilities, the decrease in the number of PoCs, and the share of critical vulnerabilities remaining at 2023 levels.

Let’s examine the most popular types of vulnerabilities exploited in real attacks in 2023 and 2024.

Number of vulnerabilities by the most prevalent CWEs used in attacks on users in 2023 (download)

Number of vulnerabilities by the most prevalent CWEs used in attacks on users in 2024 (download)

As in 2023, the top three in the list are the following software issues:

• CWE-78—Improper or insufficient neutralization of command-line inputs (OS Command Injection);
• CWE-20—Improper input filtering and validation. This includes most vulnerabilities that allow attackers to take control of applications;
• CWE-787—Memory corruption vulnerabilities (Out-of-bounds Write).

These types of flaws have been known for a long time and remain actively exploited by attackers. The number of associated vulnerabilities has remained at the same level over the past two years.

Next are software flaws that are less common but no less critical. In 2024, some of the most popular CWEs included the following:

• CWE-416—Improper use of dynamic memory resources (Use After Free);
• CWE-22—Improper handling of file system path formats (Path Traversal);
• CWE-94—Improper control of code generation (Code Injection);
• CWE-502—Deserialization of untrusted data;
• CWE-843—Improper handling of data types (Type Confusion);
• CWE-79—Improper neutralization of input during web page generation (Cross-site Scripting);
• CWE-122—Heap-based Buffer Overflow.

Compared to 2023, CWE-119—associated with performing operations outside buffer bounds—was the only one to drop out of the TOP 10. However, it was replaced by a similar type, CWE-122, associated with buffer overflow—so memory corruption vulnerabilities remained on the list. This confirms that the landscape of software flaws leading to exploitable vulnerabilities has remained unchanged over the past two years.

Exploitation statistics

This section contains statistics on the use of exploits in Q4 2024. The data is based on open sources and our telemetry.

Windows and Linux vulnerability exploitation

Among the exploits detected by Kaspersky solutions for Windows, the most popular throughout 2024, including Q4, were vulnerabilities in Microsoft Office applications:

• CVE-2018-0802—Remote code execution vulnerability in the Equation Editor component;
• CVE-2017-11882—Another remote code execution vulnerability also affecting the Equation Editor;
• CVE-2017-0199—A vulnerability in Microsoft Office and WordPad that allows an attacker to take control of the system.

Following these, the most common vulnerabilities in Q4 included those in WinRAR and various Windows subsystems:

• CVE-2023-38831—A vulnerability in WinRAR related to improper handling of objects contained in an archive;
• CVE-2024-38100—A vulnerability known as Leaked Wallpaper, which allows an attacker to obtain a NetNTLM hash used in user authentication protocols;
• CVE-2024-21447—A vulnerability in improper link handling within the file system. It resides in the UserManager service and, if exploited, allows privilege escalation;
• CVE-2024-28916—A vulnerability similar to CVE-2024-21447 in the Xbox Gaming Service.

Each of the above vulnerabilities can be used to compromise the system and gain the highest possible privileges, so we recommend regularly updating the corresponding software.

Dynamics of the number of Windows users encountering exploits, Q1 2023—Q4 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)

Kaspersky products for the Linux operating system triggered on exploits for the following vulnerabilities:

• CVE-2024-1086—Improper resource handling vulnerability in the nf_tables component of the kernel. Exploiting it allows privilege escalation in the system;
• CVE-2024-0582—A memory leak vulnerability in the io_uring component, which can be used to escalate privileges on the vulnerable system;
• CVE-2022-0847—A widespread vulnerability known as Dirty Pipe, allowing privilege escalation and control over running applications;
• CVE-2022-34918—Improper handling of kernel objects related to the netfilter component. Exploiting the vulnerability allows privilege escalation in the system.

Dynamics of the number of Linux users encountering exploits, Q1 2023—Q4 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)

For the Linux operating system, it is critically important to keep kernel components up to date, as well as any software used.

Most common published exploits

The distribution of published exploits for vulnerabilities by platform, Q3 2024 (download)

The distribution of published exploits for vulnerabilities by platform, Q4 2024 (download)

In Q4 2024, operating systems remained the most popular category of software in terms of the number of publicly available working exploits. At the same time, the share of exploits targeting Microsoft Office tools decreased, and no exploits for SharePoint vulnerabilities were published.

The distribution of published exploits for vulnerabilities by platform, 2024 (download)

Data for 2024 shows that the overall trend of attacks on operating systems continues to grow, increasingly displacing other categories of software. Researchers and attackers are finding new operating system components that still contain potentially exploitable vulnerabilities.

Vulnerability exploitation in APT attacks

We analyzed which vulnerabilities were most commonly used in APT attacks in Q4 2024. The ranking below is based on our telemetry, research, and open sources.

TOP 10 vulnerabilities exploited in APT attacks, Q4 2024 (download)

The list of vulnerabilities commonly used in APT attacks shows changes in the software exploited by attackers. Microsoft Office applications, whose vulnerabilities were not used as much in 2023, have returned to the top ten most frequently exploited types of software. In addition, vulnerabilities for PAN-OS appeared on the list for the first time. Moreover, remote access systems and corporate data processing solutions once again appeared among the vulnerable applications. These statistics highlight the issue of delayed patch installation, which attackers quickly exploit. We strongly recommend promptly updating the software listed.

Interesting vulnerabilities

This section contains the most interesting vulnerabilities published in Q4 2024.

CVE-2024-43572—Remote code execution vulnerability in Microsoft Management Console

The Windows operating system has many useful features and mechanisms that allow users to customize it for their convenience. One such feature is the Microsoft Management Console (MMC)—an interface for running applications that contain strictly structured information. These applications are called “snap-ins.” The operating system provides a number of built-in tools for working with MMC, such as
services.msc—an interface for managing services. This is an XML file that interacts with individual COM objects and allows you to set parameters for them in the management console.
According to Microsoft documentation, .msc files can be used for system administration. Attackers exploited this functionality to run commands on user systems: inside the .msc file, they specified the URI
urn:schemas-microsoft-com:xslt and commands in JavaScript and VBScript. These files were distributed as email attachments.

Header of the main .msc file

CVE-2024-43451—NetNTLM hash disclosure vulnerability

This vulnerability is also related to the functionality of the Windows operating system, specifically to the NTLM authentication mechanism with the SSPI interface, which is automatically launched in all versions of the OS up to and including Windows 10. During the transmission of the NetNTLM hash, an attacker can intercept it or redirect it to another service, resulting in the compromise of the victim’s credentials. In common legitimate Windows scenarios, users frequently need to authenticate using the NTLM protocol, which may attract attackers. In 2024, we observed the active use of files of various formats with the .url extension in attacks: these files contained links to resources that triggered authentication using NTLM mechanisms.

CVE-2024-49039—Elevation of privilege vulnerability in Windows Task Scheduler

Our 2024 reports mainly included vulnerabilities that were used either solely for privilege escalation or for initial system access. However, CVE-2024-49039 stands out because it allows stealthy persistence within the system, privilege escalation, and command execution.

This vulnerability exploits an undocumented RPC endpoint on the server side, which contains interfaces with a misconfigured security descriptor, enabling privilege escalation.

In recent versions of Windows, when a scheduled task is registered, applications can run in AppContainer, which generally limits their privileges. To exploit the vulnerability, an attacker needs to create a scheduled task that, upon execution, calls the undocumented RPC endpoint. The Task Scheduler contains a vulnerable application launch algorithm, and as a result of the RPC call, the application will be relaunched without AppContainer with the privileges of a regular or system user.

Conclusion and advice

The total number of vulnerabilities registered in the Q4 2024 continues to grow compared to 2023, but the number of published exploits decreased. This may be due to the fact that software vendors have not yet released patches because of the traditional lull during the holiday period. Notably, attackers continue to invent new methods of privilege escalation, as seen in the Task Scheduler vulnerability.

To stay safe, it is essential to respond promptly to the evolving threat landscape. Also, make sure that you:

• Ensure round-the-clock monitoring of your infrastructure, paying special attention to the perimeter;
• Maintain a patch management process: promptly apply security fixes. To configure and automate vulnerability and patch management, you can use solutions like Vulnerability Assessment and Patch Management and Kaspersky Vulnerability Data Feed;
• Use reliable solutions that can detect and block malware on corporate devices, and comprehensive tools that include incident response scenarios and up-to-date cyberthreat databases.

securelist.com/vulnerabilities…

Camper shells are a time-honored piece of truck gear, but with modern trucks having increasingly vestigial beds, the length of your overnight abode has increasingly shrunk as well. To combat this problem, [Ed’s Garage] built a camper shell that extends once you’ve arrived at your campsite.

[Ed] wanted to keep things relatively low profile while still tall enough to sit up in for convenience, leading to a small bit of the shell peeking over the truck’s roof. To keep the cold Canadian winter out, attention was paid to proper weather sealing around the sliding portion of the shell so that it stays warm and dry inside.

While this would work on any truck, the mains power plugs in the bed of some modern trucks mean that certain glamping conveniences like a heater and projector can be easily powered while you’re in camp. We get to see the camper shell in action at the end of the video where the pros and cons of having your sleeping space also being your storage while en route become apparent.

If you’re looking for something a little less conventional for your camping experience, how about this solar camper or this retro bike camper?

youtube.com/embed/MfxifnxYbPI?…

hackaday.com/2025/02/26/want-a…

Muon tomography (muography) is the practice of using muons generated by cosmic rays interacting with Earth’s atmosphere (or equivalent) to image structures on Earth’s surface, akin to producing an X-ray. In lieu of spending a lot of spending a fair bit of money on dedicated muon detectors, you can also hack such a device together with two Geiger-Müller tubes and related circuitry for about $100 or whatever you can source the components for.

The reason for having two Geiger-Müller tubes is to filter out the countless other (much more prevalent) sources of ionizing radiation that we’re practically bathed in every second. Helped by a sheet of lead between both tubes, only a signal occurring at the same time from both tubes should be a muon. Specially cosmic ray muons, as these have significantly more kinetic energy that allows them to pass through both tubes. As a simple check it’s helpful to know that most of these muons will come from the direction of the sky.

The author of the article tested this cobbled-together detector in an old gold mine. Once there the presence of more rock (and fewer muons) was easily detected, as well as a surge in muons indicating a nearby void (a mine shaft). While not a fast or super-easy way to image structures, it’s hard to beat for the price and the hours of fun you can have while spelunking.

hackaday.com/2025/02/26/buildi…

This week, Jonathan Bennett and Rob Campbell talk with Shimon Schocken about Nand2Tetris, the free course about building a computer from first principles. What was the inspiration for the course? Is there a sequel or prequel in the works? Watch to find out!

• Nand2Tetris

youtube.com/embed/X-CavXZjfGU?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or contact the guest and have them contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2025/02/26/floss-…

Picture a football (soccer ball) in your head and you probably see the cartoon ideal—a roughly spherical shape made with polygonal patches that are sewn together, usually in a familiar pattern of black and white. A great many balls were made along these lines for a great many decades.

Eventually, though, technology moved on. Footballs got rounder, smoother, and more colorful. This was seen as a good thing, with each new international competition bringing shiny new designs with ever-greater performance. That was, until things went too far, and the new balls changed the game. Thus was borne the “knuckleball” phenomenon.

Smoother Is Better, Right?

An Adidas Telstar from the 1974 World Cup. The original Telstar design actually predates 1974, and the combination of 12 pentagonal and 20 hexagonal panels and black and white patterns had been used before, too. Regardless, the Adidas design was soon globally known, and eventually became the “default” design for a football in media. Credit: shine2010, CC BY 2.0
From the late industrial era onwards, footballs were traditionally made with leather panels wrapped around some form of rubber bladder. As it’s not easy to produce a seamless leather sphere, balls were instead sewn together from individual leather panels in order to create a vaguely spherical whole. Early designs had few panels, and weren’t particularly good at approximating the shape of a sphere. They often had large, wide seams that stretched far across the surface of the ball. Larger seams were by and large undesirable, as they made the ball harder to control. Ridges where the panels met could catch on the foot and lead to unpredictable behavior.
The 32-panel design persisted at the World Cup level until 2002, with the Fevernova ball. Credit: Nicola, CC BY-SA 4.0
Over time, there was a desire to create smoother, rounder balls for professional play. By the 1970s, football designs began to coalesce around a common format. The standard became 12 pentagonal and 20 hexagonal panels, which could be sewn together into a relatively good approximation of a sphere. This also allowed the construction of a ball with very fine seams, creating a more predictable ball which enabled far finer control. The format was perhaps best popularized by the Adidas Telstar as used in the 1970 and 1974 World Cups. Even though it wasn’t the first to use the 12-and-20 design, the layout and the black-and-white pattern has been firmly etched in footballing consciousness ever since. Indeed, starting at the 1970 World Cup, Adidas has made every following World Cup ball since.

For a time, it seemed as if the design of the football was settled science. Adidas stuck with the 32-panel design up until the 2006 World Cup, when it revealed the +Teamgeist design. It used 14 curved panels that were bonded instead of stitched, creating a smoother ball for yet more predictable handling. It was also intended that the design would be more waterproof, to avoid gaining weight in wet matches. The ball was criticised by some for its erratic flight patterns, but by and large was seen as fit for purpose.
The Jabulani proved controversial, with its ultra-smooth design criticised for creating its unpredictability in flight. Credit: Adidas, editorial use
With another successful World Cup under its belt, Adidas innovated further for the 2010 World Cup. It created the Jabulani, which consisted of just eight spherically-moulded panels bonded together into an ultra-smooth and cohesive sphere. If the 2006 World Cup ball was slightly controversial, the Jabulani was outrageous. The ball was referred to as “supernatural” for its tendency to suddenly change direction in flight, which pleased strikers to a degree, but frustrated goalkeepers to no end. Ultimately, though, this tendency wasn’t good for getting balls on target. Just 147 goals were scored in the 2010 World Cup, the fewest since the competition changed its tournament format in 1998.

The problem came down to a phenomenon known as “knuckling.” This happens when the ball is travelling through the air with little to no spin. At a certain speed, the seams on the ball tend to interact with the airflow, channeling it such that it creates sudden and unpredictable movements. The term first developed in baseball, but became relevant to football with the development of the 2006 and 2010 World Cup balls, which suffered this phenomenon more often in play.

The phenomenon became so well known that NASA scientists took the opportunity to throw World Cup balls in a test chamber to demonstrate the effects at play. Knuckling behavior tends to peak at a certain critical speed, with the effect lessened either side of the peak. The problem was that the smoother designs were “knuckling” at higher speeds than balls from previous generations. NASA researchers found that the Jabulani would undergo unpredictable flight due to knuckling at speeds of 50 to 55 mph—right around the speed at which professional strikers can deliver a ball to the net. Meanwhile, more traditional 32-panel balls tend to see a peak in knuckling around 30 mph. Since strikers were typically kicking beyond this speed, knuckling—and thus unpredictable flight—wasn’t such a problem with the older designs.
The Brazuca demonstrated a critical knuckling speed closer to a traditional 32-panel ball in NASA’s tests. “What we are looking for in the smoke patterns is at what speed the smoke patterns suddenly change,” notes Rabi Mehta, NASA’s chief of the Experimental Aero-Physics Branch. “This is when the knuckling effect is greatest.” Credit: NASA
Being well aware of the problem after the 2010 World Cup, Adidas went back to the drawing board and developed the Brazuca for the 2014 competition. The number of panels was reduced yet further to just six. However, Adidas wasn’t intending to just go smoother yet again. Instead, the Brazuca had longer, deeper seams than the Jabulani, and panels covered in textured bumps. Through the company’s careful design efforts, this brought the critical knuckling speed back down to around 30 mph, much more akin to a traditional 32-panel ball.

By and large, the Brazuca proved far less controversial than its two predecessors. Search for articles on the 2014 ball, and you’ll find a little speculation from before the World Cup, before the story died completely once competition began. No more were unpredictable balls confounding the world’s finest footballers. Meanwhile, democratically speaking, where the +Teamgeist and Jabulani each have hundreds of words spilled on Wikipedia over controversy and criticism, the Brazuca has none.
Adidas gave the Brazuca deeper seams and a bumpy finish to improve its stability in flight. Credit: Nicola, CC BY-SA 4.0
The story of the Jabulani is one of unintended consequences. Adidas had intended to improve its product in a predictable and routine manner, only to find an unexpected effect at play which threw a spanner in the works. Once the effect was understood, it could be controlled and refined out with careful design. Football hasn’t suffered a “supernatural” ball since, even as the technology marches ever further into the Smart Ball era. Still, who knows what comes next at the 2026 World Cup?

hackaday.com/2025/02/26/too-sm…