Salta al contenuto principale



L’Europa può “unirsi attorno” al Rapporto Draghi, afferma von der Leyen

L'articolo proviene da #Euractiv Italia ed è stato ricondiviso sulla comunità Lemmy @Intelligenza Artificiale
L’Europa può unirsi “attorno” al Rapporto Draghi per dare una risposta ai cittadini europei. È questo il messaggio lanciato dalla presidente della Commissione europea, Ursula



Draghi invita l’UE ad agire come una “federazione” e rilancia sull’importanza del debito comune

L'articolo proviene da #Euractiv Italia ed è stato ricondiviso sulla comunità Lemmy @Intelligenza Artificiale
L’Europa deve iniziare ad agire meno come una confederazione e più come una federazione, secondo l’ex presidente della Banca

lgsp reshared this.



RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT



Background


RevengeHotels, also known as TA558, is a threat group that has been active since 2015, stealing credit card data from hotel guests and travelers. RevengeHotels’ modus operandi involves sending emails with phishing links which redirect victims to websites mimicking document storage. These sites, in turn, download script files to ultimately infect the targeted machines. The final payloads consist of various remote access Trojan (RAT) implants, which enable the threat actor to issue commands for controlling compromised systems, stealing sensitive data, and maintaining persistence, among other malicious activities.

In previous campaigns, the group was observed using malicious emails with Word, Excel, or PDF documents attached. Some of them exploited the CVE-2017-0199 vulnerability, loading Visual Basic Scripting (VBS), or PowerShell scripts to install customized versions of different RAT families, such as RevengeRAT, NanoCoreRAT, NjRAT, 888 RAT, and custom malware named ProCC. These campaigns affected hotels in multiple countries across Latin America, including Brazil, Argentina, Chile, and Mexico, but also hotel front-desks globally, particularly in Russia, Belarus, Turkey, and so on.

Later, this threat group expanded its arsenal by adding XWorm, a RAT with commands for control, data theft, and persistence, amongst other things. While investigating the campaign that distributed XWorm, we identified high-confidence indicators that RevengeHotels also used the RAT tool named DesckVBRAT in their operations.

In the summer of 2025, we observed new campaigns targeting the same sector and featuring increasingly sophisticated implants and tools. The threat actors continue to employ phishing emails with invoice themes to deliver VenomRAT implants via JavaScript loaders and PowerShell downloaders. A significant portion of the initial infector and downloader code in this campaign appears to be generated by large language model (LLM) agents. This suggests that the threat actor is now leveraging AI to evolve its capabilities, a trend also reported among other cybercriminal groups.

The primary targets of these campaigns are Brazilian hotels, although we have also observed attacks directed at Spanish-speaking markets. Through a comprehensive analysis of the attack patterns and the threat actor’s modus operandi, we have established with high confidence that the responsible actor is indeed RevengeHotels. The consistency of the tactics, techniques, and procedures (TTPs) employed in these attacks aligns with the known behavior of RevengeHotels. The infrastructure used for payload delivery relies on legitimate hosting services, often utilizing Portuguese-themed domain names.

Initial infection


The primary attack vector employed by RevengeHotels is phishing emails with invoicing themes, which urge the recipient to settle overdue payments. These emails are specifically targeted at email addresses associated with hotel reservations. While Portuguese is a common language used in these phishing emails, we have also discovered instances of Spanish-language phishing emails, indicating that the threat actor’s scope extends beyond Brazilian hospitality establishments and may include targets in Spanish-speaking countries or regions.

Example of a phishing email about a booking confirmation
Example of a phishing email about a booking confirmation

In recent instances of these attacks, the themes have shifted from hotel reservations to fake job applications, where attackers sent résumés in an attempt to exploit potential job opportunities at the targeted hotels.

Malicious implant


The malicious websites, which change with each email, download a WScript JS file upon being visited, triggering the infection process. The filename of the JS file changes with every request. In the case at hand, we analyzed Fat146571.js (fbadfff7b61d820e3632a2f464079e8c), which follows the format Fat\{NUMBER\}.js, where “Fat” is the beginning of the Portuguese word “fatura”, meaning “invoice”.

The script appears to be generated by a large language model (LLM), as evidenced by its heavily commented code and a format similar to those produced by this type of technology. The primary function of the script is to load subsequent scripts that facilitate the infection.

A significant portion of the new generation of initial infectors created by RevengeHotels contains code that seems to have been generated by AI. These LLM-generated code segments can be distinguished from the original malicious code by several characteristics, including:

  • The cleanliness and organization of the code
  • Placeholders, which allow the threat actor to insert their own variables or content
  • Detailed comments that accompany almost every action within the code
  • A notable lack of obfuscation, which sets these LLM-generated sections apart from the rest of the code

AI generated code in a malicious implant as compared to custom code
AI generated code in a malicious implant as compared to custom code

Second loading step


Upon execution, the loader script, Fat\{NUMBER\}.js, decodes an obfuscated and encoded buffer, which serves as the next step in loading the remaining malicious implants. This buffer is then saved to a PowerShell (PS1) file named SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1 (d5f241dee73cffe51897c15f36b713cc), where “\{TIMESTAMP\}” is a generated number based on the current execution date and time. This ensures that the filename changes with each infection and is not persistent. Once the script is saved, it is executed three times, after which the loader script exits.

The script SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1 runs a PowerShell command with Base64-encoded code. This code retrieves the cargajecerrr.txt (b1a5dc66f40a38d807ec8350ae89d1e4) file from a remote malicious server and invokes it as PowerShell.

This downloader, which is lightly obfuscated, is responsible for fetching the remaining files from the malicious server and loading them. Both downloaded files are Base64-encoded and have descriptive names: venumentrada.txt (607f64b56bb3b94ee0009471f1fe9a3c), which can be interpreted as “VenomRAT entry point”, and runpe.txt (dbf5afa377e3e761622e5f21af1f09e6), which is named after a malicious tool for in-memory execution. The first file, venumentrada.txt, is a heavily obfuscated loader (MD5 of the decoded file: 91454a68ca3a6ce7cb30c9264a88c0dc) that ensures the second file, a VenomRAT implant (3ac65326f598ee9930031c17ce158d3d), is correctly executed in memory.

The malicious code also exhibits characteristics consistent with generation by an AI interface, including a coherent code structure, detailed commenting, and explicit variable naming. Moreover, it differs significantly from previous samples, which had a structurally different, more obfuscated nature and lacked comments.

Exploring VenomRAT


VenomRAT, an evolution of the open-source QuasarRAT, was first discovered in mid-2020 and is offered on the dark web, with a lifetime license costing up to $650. Although the source code of VenomRAT was leaked, it is still being sold and used by threat actors.

VenomRAT packages on the dark web
VenomRAT packages on the dark web

According to the vendor’s website, VenomRAT offers a range of capabilities that build upon and expand those of QuasarRAT, including HVNC hidden desktop, file grabber and stealer, reverse proxy, and UAC exploit, amongst others.

As with other RATs, VenomRAT clients are generated with custom configurations. The configuration data within the implant (similar to QuasarRAT) is encrypted using AES and PKCS #5 v2.0, with two keys employed: one for decrypting the data and another for verifying its authenticity using HMAC-SHA256. Throughout the malware code, different sets of keys and initialization vectors are used sporadically, but they consistently implement the same AES algorithm.

Anti-kill


It is notable that VenomRAT features an anti-kill protection mechanism, which can be enabled by the threat actor upon execution. Initially, the RAT calls a function named EnableProtection, which retrieves the security descriptor of the malicious process and modifies the Discretionary Access Control List (DACL) to remove any permissions that could hinder the RAT’s proper functioning or shorten its lifespan on the system.

The second component of this anti-kill measure involves a thread that runs a continuous loop, checking the list of running processes every 50 milliseconds. The loop specifically targets those processes commonly used by security analysts and system administrators to monitor host activity or analyze .NET binaries, among other tasks. If the RAT detects any of these processes, it will terminate them without prompting the user.

List of processes that the malware looks for to terminate
List of processes that the malware looks for to terminate

The anti-kill measure also involves persistence, which is achieved through two mechanisms written into a VBS file generated and executed by VenomRAT. These mechanisms ensure the malware’s continued presence on the system:

  1. Windows Registry: The script creates a new key under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, pointing to the executable path. This allows the malware to persist across user sessions.
  2. Process: The script runs a loop that checks for the presence of the malware process in the process list. If it is not found, the script executes the malware again.

If the user who executed the malware has administrator privileges, the malware takes additional steps to ensure its persistence. It sets the SeDebugPrivilege token, enabling it to use the RtlSetProcessIsCritical function to mark itself as a critical system process. This makes the process “essential” to the system, allowing it to persist even when termination is attempted. However, when the administrator logs off or the computer is about to shut down, VenomRAT removes its critical mark to permit the system to proceed with these actions.

As a final measure to maintain persistence, the RAT calls the SetThreadExecutionState function with a set of flags that forces the display to remain on and the system to stay in a working state. This prevents the system from entering sleep mode.

Separately from the anti-kill methods, the malware also includes a protection mechanism against Windows Defender. In this case, the RAT actively searches for MSASCui.exe in the process list and terminates it. The malware then modifies the task scheduler and registry to disable Windows Defender globally, along with its various features.

Networking


VenomRAT employs a custom packet building and serialization mechanism for its networking connection to the C2 server. Each packet is tailored to a specific action taken by the RAT, with a dedicated packet handler for each action. The packets transmitted to the C2 server undergo a multi-step process:

  1. The packet is first serialized to prepare it for transmission.
  2. The serialized packet is then compressed using LZMA compression to reduce its size.
  3. The compressed packet is encrypted using AES-128 encryption, utilizing the same key and authentication key mentioned earlier.

Upon receiving packets from the C2 server, VenomRAT reverses this process to decrypt and extract the contents.

Additionally, VenomRAT implements tunneling by installing ngrok on the infected computer. The C2 server specifies the token, protocol, and port for the tunnel, which are sent in the serialized packet. This allows remote control services like RDP and VNC to operate through the tunnel and to be exposed to the internet.

USB spreading


VenomRAT also possesses the capability to spread via USB drives. To achieve this, it scans drive letters from C to M and checks if each drive is removable. If a removable drive is detected, the RAT copies itself to all available drives under the name My Pictures.exe.

Extra stealth steps


In addition to copying itself to another directory and changing its executable name, VenomRAT employs several stealth techniques that distinguish it from QuasarRAT. Two notable examples include:

  • Deletion of Zone.Identifier streams: VenomRAT deletes the Mark of the Web streams, which contain metadata about the URL from which the executable was downloaded. By removing this information, the RAT can evade detection by security tools like Windows Defender and avoid being quarantined, while also eliminating its digital footprint.
  • Clearing Windows event logs: The malware clears all Windows event logs on the compromised system, effectively creating a “clean slate” for its operations. This action ensures that any events generated during the RAT’s execution are erased, making it more challenging for security analysts to detect and track its activities.


Victimology


The primary targets of RevengeHotels attacks continue to be hotels and front desks, with a focus on establishments located in Brazil. However, the threat actors have been adapting their tactics, and phishing emails are now being sent in languages other than Portuguese. Specifically, we’ve observed that emails in Spanish are being used to target hotels and tourism companies in Spanish-speaking countries, indicating a potential expansion of the threat actor’s scope. Note that among earlier victims of this threat are such Spanish-speaking countries as Argentina, Bolivia, Chile, Costa Rica, Mexico, and Spain.

It is important to point out that previously reported campaigns have mentioned the threat actor targeting hotel front desks globally, particularly in Russia, Belarus, and Turkey, although no such activity has yet been detected during the latest RevengeHotels campaign.

Conclusions


RevengeHotels has significantly enhanced its capabilities, developing new tactics to target the hospitality and tourism sectors. With the assistance of LLM agents, the group has been able to generate and modify their phishing lures, expanding their attacks to new regions. The websites used for these attacks are constantly rotating, and the initial payloads are continually changing, but the ultimate objective remains the same: to deploy a remote access Trojan (RAT). In this case, the RAT in question is VenomRAT, a privately developed variant of the open-source QuasarRAT.

Kaspersky products detect these threats as HEUR:Trojan-Downloader.Script.Agent.gen, HEUR:Trojan.Win32.Generic, HEUR:Trojan.MSIL.Agent.gen, Trojan-Downloader.PowerShell.Agent.ady, Trojan.PowerShell.Agent.aqx.

Indicators of compromise


fbadfff7b61d820e3632a2f464079e8c Fat146571.js
d5f241dee73cffe51897c15f36b713cc SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1
1077ea936033ee9e9bf444dafb55867c cargajecerrr.txt
b1a5dc66f40a38d807ec8350ae89d1e4 cargajecerrr.txt
dbf5afa377e3e761622e5f21af1f09e6 runpe.txt
607f64b56bb3b94ee0009471f1fe9a3c venumentrada.txt
3ac65326f598ee9930031c17ce158d3d deobfuscated runpe.txt
91454a68ca3a6ce7cb30c9264a88c0dc deobfuscated venumentrada.txt


securelist.com/revengehotels-a…

#5



Eric Ambler – Viaggio nella paura
freezonemagazine.com/rubriche/…
È il gennaio 1940, il mondo attende una «una primavera sanguinosa», e Mr. Graham, ingegnere inglese specializzato in artiglieria navale, si appresta a lasciare Istanbul dopo aver assicurato alla propria azienda l’appalto per il riequipaggiamento della flotta militare turca. Graham è un tipo tranquillo, simpatico, con una mente matematica e la cordialità senza smancerie di […]
L'articolo


Vulnerabilità critica in Linux: exploit 0-click N-Days permette l’esecuzione di codice remoto


Un ricercatore di sicurezza ha recentemente sviluppato unexploit 0-click per il demone kernel SMB3 di Linux (ksmbd), sfruttando due vulnerabilità specifiche. Questo exploit consente l’esecuzione di codice remoto (RCE) in modalità kernel senza alcuna interazione da parte dell’utente, rappresentando una minaccia significativa per i sistemi vulnerabili.

Il primo bug, identificato come CVE-2023-52440, riguarda un overflow SLUB nel metodo ksmbd_decode_ntlmssp_auth_blob(). Questo errore si verifica durante l’autenticazione NTLM, quando la lunghezza della chiave di sessione (sess_key_len) è controllata dall’utente.

Impostando un valore eccessivo per questa lunghezza, è possibile sovrascrivere porzioni di memoria adiacenti, consentendo l’esecuzione di codice arbitrario. L’exploit è stato testato su una versione 6.1.45 di Linux, con tutte le mitigazioni standard attive, come SMAP, SMEP, KPTI, KASLR e altre.

Il secondo bug, CVE-2023-4130, è una vulnerabilità di lettura fuori dai limiti (OOB read) nel metodo smb2_set_ea(). Questa falla consente a un utente autenticato di leggere dati sensibili dalla memoria kernel, sfruttando la gestione errata degli attributi estesi (xattr) nei file condivisi tramite SMB3. La combinazione di queste due vulnerabilità permette di ottenere un controllo completo sul sistema bersaglio.

L’exploit sviluppato utilizza una tecnica di “heap spraying” per manipolare la memoria heap, creando condizioni favorevoli per l’esecuzione del codice maligno. Una volta ottenuto l’accesso alla memoria kernel, viene eseguita una catena di ritorno (ROP) per eseguire un reverse shell, ottenendo così il controllo remoto del sistema. Questo processo avviene senza alcuna interazione da parte dell’utente, rendendo l’attacco particolarmente insidioso.

Il ricercatore ha testato l’exploit su un sistema con un singolo core x86_64, ma ha osservato che su sistemi multi-core l’affidabilità dell’exploit diminuisce a causa della gestione per CPU delle allocazioni di memoria. Inoltre, l’exploit può causare instabilità nel sistema bersaglio, richiedendo interventi per ripristinare la stabilità dopo l’esecuzione dell’attacco.

Per mitigare questa vulnerabilità, è consigliabile aggiornare il sistema alla versione più recente del kernel Linux, in quanto le versioni successive alla 6.1.45 hanno corretto entrambe le vulnerabilità. Inoltre, è importante configurare correttamente i permessi di accesso alle condivisioni SMB, limitando l’accesso in scrittura solo agli utenti autorizzati. Disabilitare l’esposizione di ksmbd su Internet e monitorare attivamente le attività sospette possono contribuire a ridurre il rischio di sfruttamento di questa vulnerabilità.

Questo caso evidenzia l’importanza di mantenere aggiornati i sistemi e di applicare le best practice di sicurezza per prevenire attacchi sofisticati come questo. La comunità di ricerca sulla sicurezza continua a monitorare e analizzare tali vulnerabilità per migliorare la protezione dei sistemi informatici.

L'articolo Vulnerabilità critica in Linux: exploit 0-click N-Days permette l’esecuzione di codice remoto proviene da il blog della sicurezza informatica.



Allarme sicurezza per i server di intelligenza artificiale: migliaia sono a rischio


I sistemi di intelligenza artificiale sono sempre più sotto attacco. Il dato emerge da “Trend Micro State of AI Security Report, 1H 2025. L’azienda esorta gli addetti ai lavori e i leader della comunità IT a seguire le migliori pratiche per l’implementazione di stack applicativi IA sicuri, al fine di evitare furti di dati, avvelenamento dei modelli, richieste di estorsioni e altri attacchi.

“L’intelligenza artificiale potrebbe essere l’opportunità del secolo per le aziende di tutto il mondo, ma le organizzazioni che non prevedono adeguate precauzioni potrebbero finire per sperimentare più danni che benefici. Come rivela la nostra ultima ricerca, sono troppe le infrastrutture di intelligenza artificiale che vengono costruite con componenti non protetti o privi di patch, dando il via libera ad attività cybercriminali”. Afferma Salvatore Marcis, Country Manager di Trend Micro Italia.

Di seguito, le principali sfide alla sicurezza dell’IA identificate dalla ricerca Trend Micro:

  1. Vulnerabilità/exploit in componenti critici: Le organizzazioni che sviluppano, distribuiscono e utilizzano applicazioni IA sfruttano diversi componenti e framework software specializzati, che potrebbero contenere vulnerabilità riscontrabili nei normali software. Lo studio rivela vulnerabilità ed exploit zero-day nei componenti principali, tra cui ChromaDB, Redis, NVIDIA Triton e NVIDIA Container Toolkit
  2. Esposizione accidentale a internet: Le vulnerabilità sono spesso il risultato di tempistiche di sviluppo e implementazione affrettate. Questo vale anche per i sistemi di intelligenza artificiale, che possono essere accidentalmente esposti a Internet, dove vengono analizzati dai cybercriminali. Trend ha rilevato oltre 200 server ChromaDB, 2.000 server Redis e oltre 10.000 server Ollama esposti a Internet senza autenticazione
  3. Vulnerabilità in componenti open-source: Molti framework e piattaforme di intelligenza artificiale utilizzano librerie software open source per fornire funzionalità comuni. Tuttavia, i componenti open source contengono spesso vulnerabilità che finiscono per insinuarsi nei sistemi di produzione, dove sono difficili da rilevare. Nel recente Pwn2Own di Berlino, che includeva la nuova categoria AI, i ricercatori hanno scoperto un exploit per il database vettoriale Redis, che derivava da un componente Lua obsoleto
  4. Debolezza a livello container: Gran parte dell’infrastruttura IA viene eseguita su container, questo significa che è esposta alle stesse vulnerabilità e minacce di sicurezza che influiscono sugli ambienti cloud e container. Come sottolineato nello studio, i ricercatori di Pwn2Own sono stati in grado di scoprire un exploit di NVIDIA Container Toolkit. Le organizzazioni, per mitigare i rischi, dovrebbero “sanificare” i dati in input e monitorare il comportamento in fase di esecuzione

La comunità degli sviluppatori e le aziende devono bilanciare al meglio la sicurezza con il time-to-market. Misure concrete potrebbero includere:

  • Una migliore gestione delle patch e scansione delle vulnerabilità
  • Il mantenimento di un inventario di tutti i componenti software, comprese librerie e sottosistemi di terze parti
  • L’adozione di best practice per la sicurezza della gestione dei container, incluso l’utilizzo di immagini di base minime e strumenti di sicurezza a runtime
  • Controlli di configurazione per garantire che i componenti dell’infrastruttura IA, come i server, non siano esposti a Internet


L'articolo Allarme sicurezza per i server di intelligenza artificiale: migliaia sono a rischio proviene da il blog della sicurezza informatica.



La Costituzione Apostolica Veritatis Gaudium affida alle facoltà ecclesiastiche il compito di coltivare e promuovere le discipline che servono alla missione della Chiesa, per considerare alla luce della Rivelazione i nuovi problemi che sorgono nel mo…



ma veramente... armi si, libertà di espressione no? ma cosa sono gli stati uniti? per partorire questa "cosa" chiamata trump. poi pure brutto.


Il Papa ha ricevuto oggi a Castel Gandolfo Sua Santità Karekin II, Patriarca Supremo e Catholicos di Tutti gli Armeni, con il suo seguito, tra cui il card. Kurt Koch, Prefetto del Dicastero per la Promozione dell'Unità dei Cristiani.


Celam: presidenza in udienza da Papa Leone XIV,  “incontro fraterno, il Santo Padre ha anima latinoamericana. Vescovi incoraggiati a lavorare insieme”

L’udienza privata con Papa Leone XIV è stata un incontro fraterno che ha segnato la conclusione della visita apostolica della Presidenza del Consiglio Episcopale Latinoamericano e Caraibico (Celam) ai diversi dicasteri e dipendenze della Santa Sede.



Jointly is a Typeface Designed for CNC Joinery


If you have a CNC router, you know you can engrave just about any text with the right tool, but Jointly is a typeface that isn’t meant to be engraved. That would be too easy for [CobyUnger]. His typeface “Jointly” is the first we’ve seen that’s meant to be used as joinery.

The idea is simple: carve mortises that take the shape of letters in one piece, and carve matching letter-tenons into the end of another. Push them together, and voila: a joint! To get this concept to work reliably, the font did have to be specially designed — both the inner and outer contours need to be accessible to a rotary cutting tool. Cutting tools get harder to use the smaller they go (or more fragile, at any rate) so with Jointly, the design spec was that any letters over 3/4″ (19.05 mm) tall needed to be handled with a 1/8″ (3.175 mm) rotary cutter.

This gives the font a friendly curved appearance we find quite fetching. Of course if you’re going to be cutting tenons into the end of a board, you’re going to need either some serious z-depth or an interesting jig to get the end of the board under the cutting head. It looks like [CobyUnger] has both, but he mentions the possibility of using a handheld CNC router as the cheaper option.

Speaking of routing out type, do you know the story of Gorton? You can’t make joinery with that typeface, but you’ve almost certainly seen it.


hackaday.com/2025/09/16/jointl…



Allarme Trojan DeliveryRAT: gli hacker rubano dati e soldi con app fasulle


Gli esperti di F6 e RuStore riferiscono di aver scoperto e bloccato 604 domini che facevano parte dell’infrastruttura degli hacker che hanno infettato i dispositivi mobili con il trojan DeliveryRAT. Il malware si mascherava da app di consegna di cibo a domicilio, marketplace, servizi bancari e servizi di tracciamento pacchi.

Nell’estate del 2024, gli analisti di F6 hanno scoperto un nuovo trojan Android, chiamato DeliveryRAT. Il suo compito principale era raccogliere dati riservati per l’elaborazione dei prestiti nelle organizzazioni di microfinanza, nonché rubare denaro tramite l’online banking.

Successivamente, è stato scoperto il bot Telegram del team Bonvi, in cui DeliveryRAT veniva distribuito utilizzando lo schema MaaS (Malware-as-a-Service). Si è scoperto che, tramite il bot, gli aggressori ricevevano un campione gratuito del Trojan, dopodiché dovevano consegnarlo loro stessi al dispositivo della vittima.

I proprietari del bot offrono due opzioni tra cui scegliere: scaricare l’APK compilato o ottenere un collegamento a un sito falso, presumibilmente generato separatamente per ogni worker.

I dispositivi delle vittime sono stati infettati utilizzando diversi scenari comuni. “Per attaccare la vittima, gli aggressori hanno utilizzato vari scenari ingegnosi: hanno creato falsi annunci di acquisto e vendita o falsi annunci di assunzione per lavoro da remoto con uno stipendio elevato”, afferma Evgeny Egorov, analista capo del Dipartimento di Protezione dai Rischi Digitali di F6. “Quindi il dialogo con la vittima viene trasferito ai servizi di messaggistica e la vittima viene convinta a installare un’applicazione mobile, che si rivela dannosa”.

Gli aggressori creano annunci con prodotti a prezzo scontato su marketplace o in negozi fittizi. Sotto le spoglie di un venditore o di un gestore, i criminali contattano la vittima tramite Telegram o WhatsApp e, durante la conversazione, la vittima fornisce loro i propri dati personali (nome completo del destinatario, indirizzo di consegna dell’ordine e numero di telefono). Per tracciare il falso ordine, il gestore chiede di scaricare un’applicazione dannosa.

Gli hacker creano anche falsi annunci di lavoro da remoto con buone condizioni e un buon stipendio. Le comunicazioni con la vittima vengono trasferite anche su servizi di messaggistica, dove prima raccolgono i suoi dati: SNILS, numero di carta, numero di telefono e data di nascita. Quindi, i truffatori chiedono di installare un’applicazione dannosa, presumibilmente necessaria per il lavoro.

Inoltre, gli esperti hanno individuato la distribuzione di post pubblicitari su Telegram che invitavano a scaricare un’applicazione infetta da DeliveryRAT. In questo caso, il malware era solitamente mascherato da applicazioni con sconti e codici promozionali.

Il rapporto sottolinea che questo schema fraudolento si è diffuso perché la creazione di link generati nei bot di Telegram non richiede particolari conoscenze tecniche. I ricercatori affermano inoltre che la caratteristica principale dello schema è l’elevato grado di automazione dei processi.

L'articolo Allarme Trojan DeliveryRAT: gli hacker rubano dati e soldi con app fasulle proviene da il blog della sicurezza informatica.



Papa Leone XIV è a Castel Gandolfo e rientrerà oggi in serata. A confermarlo ai giornalisti è la Sala Stampa vaticana. Papa Leone si è recato a Villa Barberini ieri sera.



Idf, 'abbiamo iniziato a distruggere siti di Hamas a Gaza City'

tradotto:

siccome fino ad adesso non siamo riusciti a uccidere tutti i palestinesi, ci stiamo ancora provando e questa volta speriamo di riuscire. e cercheremo anche di sterminare tutti i bambini in modo che i palestinesi non abbiano una ricrescita. quel che rimane di gaza city sarà distrutto. una fine e mirata operazione di polizia e di intelligence insomma. incapaci.




Possibile che in italia un farmacista su un farmaco antidolorifico non capisca neppure che il piano terapeutico contenga il dosaggio massimo, ma poi a seconda dei dolori del momento, una persona possa trovare utile anche di un dosaggio più basso? E che si cerchi di usare sempre il dosaggio più basso possibile? Siamo in una civiltà di cretini. Sembra che questo di medicina non capiscano alcunché e che si limitino a fare dei magazzinieri. Forse dovrebbe toccare a tutto una persona malata da accudire e magari dopo capiscono come funziona il dolore.
in reply to simona

le malattie esistono, i dolori esistono e non è che guardano solo le persone anziane. i farmaci sono pesanti e rincoglioniscono, ed è il paziente stesso che cerca di prendere il dosaggio più basso utile. a seconda della giornata, del mese, del caldo o di infiniti parametri. anche perché vorrebbe anche poi riuscire a fare qualcosa durante il giorno. parlo di una persona di 30 anni. ignorare tutto questo significa essere fuori dal mondo di chi neppure conosce cosa comporta prendersi cura di una persona malata. anche giovane. il farmacista non consiglia niente ma rifiuta di fornire lo stesso farmaco ma con un dosaggio più ridotto. non è che si possa modificare un piano terapeutico 2 volte al giorno a seconda della necessità. quanto detto è esattamente quello che sta avvenendo e non c'è da fare stime su cosa il farmacista suggerisca o pensi. quindi non è che il farmacista mi stia consigliando qualcosa. rebecca prende palgos 20, o depalgos 10, o depalgos 10-20 a seconda della necessità del momento. fra le altre infinite cose. chiaramente sul piano terapeutico c'è scritto depalgos 20. nessun medico fa i piani con tutti i dosaggi possibili. starebbe all'intelligenza del farmacista capire che quello è il dosaggio massimo. hai mai visto un piano terapeutico con indicato depalgos 5, depalgos 10, depalgos 20? no eh? infatti non si fa. si indica il dosaggio massimo. oltretutto il suo piano terapeutico già prevede 3 pagine di farmaci... cosa è? non è abbastanza lungo? a ogni livello siamo in mano a cretini assoluti. oltretutto ho pure il medico gentile che già sta a modificare mediamente il piano terapeutico 2 volte al mese per via dei farmaci che spariscono e vanno rimpiazzati pur mantenendo lo stesso principio attivo. c'è da uscirne di testa. se una virgola non torna devi cambiare il piano terapeutico. normalmente significa farsi fare l'impegnativa dal medico di base e prendere appuntamento dal medico tramite cup d aspettare la visita mesi.



Lug Bolzano - Migration Completed: Cloud to Nuvola


lugbz.org/migration-completed-…
Segnalato da Linux Italia e pubblicato sulla comunità Lemmy @GNU/Linux Italia
Migration von Cloud auf Nuvola abgeschlossen Unsere bisherige Nextcloud-Instanz cloud.lugbz.org wurde erfolgreich abgeschaltet. Alle Daten konnten in den vergangenen Wochen





Parole e atti violenti nel silenzio istituzionale


@Giornalismo e disordine informativo
articolo21.org/2025/09/parole-…
Più che rassegnazione è assuefazione. Improvvisamente, negli ultimi tre anni, dall’aggressione russa all’Ucraina in poi, nel nostro quotidiano sono entrate parole di una violenza estrema: aggressione, guerra, bombe, massacri,



An LLM breathed new life into 'Animal Crossing' and made the villagers rise up against their landlord.

An LLM breathed new life into x27;Animal Crossingx27; and made the villagers rise up against their landlord.#News #VideoGames


AI-Powered Animal Crossing Villagers Begin Organizing Against Tom Nook


A software engineer in Austin has hooked up Animal Crossing to an AI and breathed new and disturbing life into its villagers. Using a Large Language Model (LLM) trained on Animal Crossing scripts and an RSS reader, the anthropomorphic folk of the Nintendo classic spouted new dialogue, talked about current events, and actively plotted against Tom Nook’s predatory bell prices.

The Animal Crossing LLM is the work of Josh Fonseca, a software engineer in Austin, Texas who works at a small startup. Ars Technica first reported on the mod. His personal blog is full of small software projects like a task manager for the text editor VIM, a mobile app that helps rock climbers find partners, and the Animal Crossing AI. He also documented the project in a YouTube video.
playlist.megaphone.fm?p=TBIEA2…
Fonseca started playing around with AI in college and told 404 Media that he’d always wanted to work in the video game industry. “Turns out it’s a pretty hard industry to break into,” he said. He also graduated in 2020. “I’m sure you’ve heard, something big happened that year.” He took the first job he could find, but kept playing around with video games and AI and had previously injected an LLM into Stardew Valley.

Fonseca used a Dolphin emulatorrunning the original Gamecube Animal Crossing on a MacBook to get the project working. According to his blog, an early challenge was just getting the AI and the game to communicate. “The solution came from a classic technique in game modding: Inter-Process Communication (IPC) via shared memory. The idea is to allocate a specific chunk of the GameCube's RAM to act as a ‘mailbox.’ My external Python script can write data directly into that memory address, and the game can read from it,” he said in the blog.

He told 404 Media that this was the most tedious part of the whole project. “The process of finding the memory address the dialogue actually lives at and getting it to scan to my MacBook, which has all these security features that really don’t want me to do that, and ending up writing to the memory took me forever,” he said. “The communication between the game and an external source was the biggest challenge for me.”

Once he got his code and the game talking, he ran into another problem. “Animal Crossing doesn't speak plain text. It speaks its own encoded language filled with control codes,” he said in his blog. “Think of it like HTML. Your browser doesn't just display words; it interprets tags like <b> to make text bold. Animal Crossing does the same. A special prefix byte, CHAR_CONTROL_CODE, tells the game engine, ‘The next byte isn't a character, it's a command!’”

But this was a solved problem. The Animal Crossing modding community long ago learned the secrets of the villager’s language, and Fonseca was able to build on their work. Once he understood the game’s dialogue systems, he built the AI brain. It took two LLM models, one to write the dialogue and another he called “The Director” that would add in pauses, emphasize words with color, and choose the facial animations for the characters. He used a fine-tuned version of Google’s Gemini for this and said it was the most consistent model he’d used.

To make it work, he fine-tuned the model, meaning he reduced its input training data to make it better at specific outputs. “You probably need a minimum of 50 to 100 really good examples in order to make it better,” he said.

Results for the experiment were mixed. Cookie, Scoot, and Cheri did indeed utter new phrases in keeping with their personality. Things got weird when Fonseca hooked up the game to an RSS reader so the villagers could talk about real world news. “If you watch the video, all the sources are heavily, politically, leaning in one direction,” he said. “I did use a Fox news feed, not for any other reason than I looked up ‘news RSS feeds’ and they were the first link and I didn’t really think it through. And then I started getting those results…I thought they would just present the news, not have leanings or opinions.”

“Trump’s gonna fight like heck to get rid of mail-in voting and machines!” Fitness obsessed duck Scoot said in the video. “I bet he’s got some serious stamina, like, all the way in to the finish line—zip, zoom!”

The pink dog Cookie was up on her Middle East news. “Oh my gosh, Josh 😀! Did you see the news?! Gal Gadot is in Israel supporting the families! Arfer,” she said, uttering her trademark catchphrase after sharing the latest about Israel.

In the final part of the experiment, Fonseca enabled the villagers to gossip. “I gave them a tiny shared memory for gossip, who said what, to whom, and how they felt,” he said in the blog.The villagers almost instantly turned on Tom Nook, the Tanuki who runs the local stores and holds most of Animal Crossing's inhabitants in debt. “Everything’s going great in town, but sometimes I feel like Tom Nook is, like, taking all the bells!” Cookie said.

“Those of us with big dreams are being squashed by Tom Nook! We gotta take our town back!” Cheri the bear cub said.

“This place is starting to feel more like Nook’s prison, y’know?” Said Scoot.
youtube.com/embed/7AyEzA5ziE0?…
Why do this to Animal Crossing? Why make Scoot and Cheri learn about Gal Gadot, Israel, and Trump?

“I’ve always liked nostalgic content,” Fonscesca said. His TikTok and YouTube algorithm is filled with liminal spaces and music from his childhood that’s detuned. He’s gotten into Hauntology, a philosophical idea that studies—among other things—promised futures that did not come to pass.

He sees projects like this as a way of linking the past and the future. “When I was a child I was like, ‘Games are gonna get better and better every year,’’ he said. “But after 20 years of playing games I’ve become a little jaded and I’m like, ‘oh there hasn’t really been that much innovation.’ So I really like the idea of mixing those old games with all the future technologies that I’m interested in. And I feel like I’m fulfilling those promised futures in a way.”

He knows that not everyone is a fan of AI. “A lot of people say that dialogue with AI just cannot be because of how much it sounds like AI,” he said. “And to some extent I think people are right. Most people can detect ChatGPT or Gemini language from a mile away. But I really think, if you fine tune it, I was surprised at just how good the results were.”

Animal Crossing’s dialogue is simple and that simplicity makes it a decent test case for AI video game marks, but Fonseca thinks he can do similar things with more complicated games. “There’s been a lot of discussion around how what I’m doing isn’t possible when there’s like, tasks or quests, because LLMs can’t properly guide you to that task without hallucinating. I think it might be more possible than people think,” he said. “So I would like to either try out my own very small game or take a game that has these kinds of quests and put together a demo of how that might be possible.”

He knows people balk at using AI to make video games, and art in general, but believes it’ll be a net benefit. “There will always be human writers and I absolutely want there to be human writers handling the core,” he said. “I would hope that AI is going to be a tool that doesn’t take away any of the best writers, but maybe helps them add more to their game that maybe wouldn’t have existed otherwise. I would hope that this just helps create more art in the world. I think I see the total art in the world increasing as a good thing…now I know some people would say that using AI ceases to make it art, but I’m also very deep in the programming aspect of it. What it takes to make these things is so incredible that it still feels like magic to me. Maybe on some level I’m still hypnotized by that.”




New documents obtained by 404 Media show how a data broker owned by American Airlines, United, Delta, and many other airlines is selling masses of passenger data to the U.S. government.#FOIA


Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching


📄
This article was primarily reported using public records requests. We are making it available to all readers as a public service. FOIA reporting can be expensive, please consider subscribing to 404 Media to support this work. Or send us a one time donation via our tip jar here.

A data broker owned by the country’s major airlines, including American Airlines, United, and Delta, is selling access to five billion plane ticketing records to the government for warrantless searching and monitoring of peoples’ movements, including by the FBI, Secret Service, ICE, and many other agencies, according to a new contract and other records reviewed by 404 Media.

The contract provides new insight into the scale of the sale of passengers’ data by the Airlines Reporting Corporation (ARC), the airlines-owned data broker. The contract shows ARC’s data includes information related to more than 270 carriers and is sourced through more than 12,800 travel agencies. ARC has previously told the government to not reveal to the public where this passenger data came from, which includes peoples’ names, full flight itineraries, and financial details.

“Americans' privacy rights shouldn't depend on whether they bought their tickets directly from the airline or via a travel agency. ARC's sale of data to U.S. government agencies is yet another example of why Congress needs to close the data broker loophole by passing my bipartisan bill, the Fourth Amendment Is Not For Sale Act,” Senator Ron Wyden told 404 Media in a statement.

💡
Do you know anything else about ARC or the sale of this data? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.

ARC is owned and operated by at least eight major U.S. airlines, publicly released documents show. Its board of directors includes representatives from American Airlines, Delta, United, Southwest, Alaska Airlines, JetBlue, and European airlines Air France and Lufthansa, and Canada’s Air Canada. ARC acts as a bridge between airlines and travel agencies, in which it helps with fraud prevention and finds trends in travel data. ARC also sells passenger data to the government as part of what it calls the Travel Intelligence Program (TIP).

TIP is updated every day with the previous day’s ticket sales and can show a person’s paid intent to travel. Government agencies can then search this data by name, credit card, airline, and more.

The new contract shows that ARC has access to much more data than previously reported. Earlier coverage found TIP contained more than one billion records spanning more than 3 years of past and future travel. The new contract says ARC provides the government with “5 billion ticketing records for searching capabilities.”


Screenshots of the documents obtained by 404 Media.

404 Media obtained the contract through a Freedom of Information Act (FOIA) with the Secret Service. The contract indicates the Secret Service plans to pay ARC $885,000 for access to the data stretching into 2028. A spokesperson for the agency told 404 Media “The U.S. Secret Service is committed to protecting our nation’s leaders and financial infrastructure in close coordination with our federal, state, and local law enforcement partners. To safeguard the integrity of our work, we do not discuss the tools used to conduct our operations.” The Secret Service did not answer a question on whether it seeks a warrant, subpoena, or court order to search ARC data.

404 Media has filed FOIA requests with a wide range of agencies that public procurement records show have purchased ARC data. That includes ICE, CBP, ATF, the SEC, TSA, the State Department, U.S. Marshals, and the IRS. A court record reviewed by 404 Media shows the FBI has asked ARC to search its databases for a specific person as part of a drug investigation.
playlist.megaphone.fm?p=TBIEA2…
The ATF told 404 Media in a statement “ATF uses ARC data for criminal and investigative purposes related to firearms trafficking and other investigations within ATF’s purview. ATF follows DOJ policy and appropriate legal processes to obtain and search the data. Access to the system is limited to a very small group within ATF, and all subjects searched within ARC must be part of an active, official ATF case/investigation.”

An ARC spokesperson told 404 Media in an email that TIP “was established by ARC after the September 11, 2001, terrorist attacks and has since been used by the U.S. intelligence and law enforcement community to support national security and prevent criminal activity with bipartisan support. Over the years, TIP has likely contributed to the prevention and apprehension of criminals involved in human trafficking, drug trafficking, money laundering, sex trafficking, national security threats, terrorism and other imminent threats of harm to the United States.”

The spokesperson added “Pursuant to ARC’s privacy policy, consumers may ask ARC to refrain from selling their personal data.”

After media coverage and scrutiny from Senator Wyden’s office of the little-known data selling, ARC finally registered as a data broker in the state of California in June. Senator Wyden previously said it appeared ARC had been in violation of Californian law for not registering while selling airline customers’ data for years.


#FOIA



#NotiziePerLaScuola
È disponibile il nuovo numero della newsletter del Ministero dell’Istruzione e del Merito.




Thursday: Oppose Cambridge Police Surveillance!


This Thursday, the Cambridge Pole & Conduit Commission will consider Flock’s requests to put up 15 to 20 surveillance cameras with Automatic License Plate Recognition (ALPR) technologies around Cambridge. The Cambridge City Council, in a 6-3 vote on Feb. 3rd, approved Cambridge PD’s request to install these cameras. It was supposed to roll out to Central Square only, but it looks like Cambridge PD and Flock have asked to put up a camera at the corner of Rindge and Alewife Brook Parkway facing eastward. That is pretty far from Central Square.

Anyone living within 150 feet of the camera location should have been mailed letters from Flock telling them that the can attend the Pole & Conduit Commission meeting this Thursday at 9am and comment on Flock’s request. The Pole & Conduit Commission hasn’t posted its agenda or the requests it will consider on Thursday. If you got a letter or found out that you are near where Flock wants to install one of these cameras, please attend the meeting to speak against it and notify your neighbors.

The Cambridge Day, who recently published a story on us, reports that City Councilors Patty Nolan, Sumbul Siddiqui and Jivan Sobrinho-Wheeler have called for reconsidering introducing more cameras to Cambridge. These cameras are paid for by the federal Urban Area Security Initiative grant program and the data they collect will be shared with the Boston Regional Information Center (BRIC) and from there to ICE, CBP and other agencies that are part of Trump’s new secret police already active in the Boston area.

We urge you to attend this meeting at 9am on Thursday and speak against the camera nearest you, if you received a letter or know that the camera will be within 150 feet of your residence. You can register in advance and the earlier you register, the earlier you will be able to speak. Issues you can bring up:

We urge affected Cambridge residents to speak at Thursday’s hearing at 9am. If you plan to attend or can put up flyers in your area about the cameras, please email us at info@masspirates.org.


masspirates.org/blog/2025/09/1…


CBP Had Access to More than 80,000 Flock AI Cameras Nationwide


Customs and Border Protection (CBP) regularly searched more than 80,000 Flock automated license plate reader (ALPR) cameras, according to data released by three police departments. The data shows that CBP’s access to Flock’s network is far more robust and widespread than has been previously reported. One of the police departments 404 Media spoke to said it did not know or understand that it was sharing data with CBP, and Flock told 404 Media Monday that it has “paused all federal pilots.”

In May, 404 Media reported that local police were performing lookups across Flock on behalf of ICE, because that part of the Department of Homeland Security did not have its own direct access. Now, the newly obtained data and local media reporting reveals that CBP had the ability to perform Flock lookups by itself.

Last week, 9 News in Colorado reported that CBP has direct access to Flock’s ALPR backend “through a pilot program.” In that article, 9 News revealed that the Loveland, Colorado police department was sharing access to its Flock cameras directly with CBP. At the time, Flock said that this was through what 9 News described as a “one-to-one” data sharing agreement through that pilot program, making it sound like these agreements were rare and limited:

“The company now acknowledges the connection exists through a previously publicly undisclosed program that allows Border Patrol access to a Flock account to send invitations to police departments nationwide for one-to-one data sharing, and that Loveland accepted the invitation,” 9 News wrote. “A spokesperson for Flock said agencies across the country have been approached and have agreed to the invitation. The spokesperson added that U.S. Border Patrol is not on the nationwide Flock sharing network, comprised of local law enforcement agencies across the country. Loveland Police says it is on the national network.”

New data obtained using three separate public records requests from three different police departments gives some insight into how widespread these “one-to-one” data sharing agreements actually are. The data shows that in most cases, CBP had access to more Flock cameras than the average police department, that it is regularly using that access, and that, functionally, there is no difference between Flock’s “nationwide network” and the network of cameras that CBP has access to.

According to data obtained from the Boulder, Colorado Police Department by William Freeman, the creator of a crowdsourced map of Flock devices called DeFlock, CBP ran at least 118 Flock network searches between May 13 and June 13 of this year. Each of these searches encompassed at least 6,315 individual Flock networks (a “network” is a specific police department or city’s cameras) and at least 82,000 individual Flock devices. Data obtained in separate requests from the Prosser Police Department and Chehalis Police Department, both in Washington state, also show CBP searching a huge number of networks and devices.

A spokesperson for the Boulder Police Department told 404 Media that “Boulder Police Department does not have any agreement with U.S. Border Patrol for Flock searches. We were not aware of these specific searches at the time they occurred. Prior to June 2025, the Boulder Police Department had Flock's national look-up feature enabled, which allowed other agencies from across the U.S. who also had contracts with Flock to search our data if they could articulate a legitimate law enforcement purpose. We do not currently share data with U.S. Border Patrol. In June 2025, we deactivated the national look-up feature specifically to maintain tighter control over Boulder Police Department data access. You can learn more about how we share Flock information on our FAQ page.”

A Flock spokesperson told 404 Media Monday that it sent an email to all of its customers clarifying how information is shared from agencies to other agencies. It said this is an excerpt from that email about its sharing options:

“The Flock platform provides flexible options for sharing:

National sharing

  1. Opt into Flock’s national sharing network. Access via the national lookup tool is limited—users can only see results if they perform a full plate search and a positive match exists within the network of participating, opt-in agencies. This ensures data privacy while enabling broader collaboration when needed.
  2. Share with agencies in specific states only
    1. Share with agencies with similar laws (for example, regarding immigration enforcement and data)


  3. Share within your state only or within a certain distance
    1. You can share information with communities within a specified mile radius, with the entire state, or a combination of both—for example, sharing with cities within 150 miles of Kansas City (which would include cities in Missouri and neighboring states) and / or all communities statewide simultaneously.


  4. Share 1:1
    1. Share only with specific agencies you have selected


  5. Don’t share at all”

In a blog post Monday, Flock CEO Garrett Langley said Flock has paused all federal pilots.

“While it is true that Flock does not presently have a contractual relationship with any U.S. Department of Homeland Security agencies, we have engaged in limited pilots with the U.S. Customs and Border Protection (CBP) and Homeland Security Investigations (HSI), to assist those agencies in combatting human trafficking and fentanyl distribution,” Langley wrote. “We clearly communicated poorly. We also didn’t create distinct permissions and protocols in the Flock system to ensure local compliance for federal agency users […] All federal customers will be designated within Flock as a distinct ‘Federal’ user category in the system. This distinction will give local agencies better information to determine their sharing settings.”

A Flock employee who does not agree with the way Flock allows for widespread data sharing told 404 Media that Flock has defended itself internally by saying it tries to follow the law. 404 Media granted the source anonymity because they are not authorized to speak to the press.

“They will defend it as they have been by saying Flock follows the law and if these officials are doing law abiding official work then Flock will allow it,” they said. “However Flock will also say that they advise customers to ensure they have their sharing settings set appropriately to prevent them from sharing data they didn’t intend to. The question more in my mind is the fact that law in America is arguably changing, so will Flock just go along with whatever the customers want?”

The data shows that CBP has tapped directly into Flock’s huge network of license plate reading cameras, which passively scan the license plate, color, and model of vehicles that drive by them, then make a timestamped record of where that car was spotted. These cameras were marketed to cities and towns as a way of finding stolen cars or solving property crime locally, but over time, individual cities’ cameras have been connected to Flock’s national network to create a huge surveillance apparatus spanning the entire country that is being used to investigate all sorts of crimes and is now being used for immigration enforcement. As we reported in May, Immigrations and Customs Enforcement (ICE) has been gaining access to this network through a side door, by asking local police who have access to the cameras to run searches for them.

9 News’s reporting and the newly released audit reports shared with 404 Media show that CBP now has direct access to much of Flock’s system and does not have to ask local police to run searches. It also shows that CBP had access to at least one other police department system in Colorado, in this case Boulder, which is a state whose laws forbid sharing license plate reader data with the federal government for immigration enforcement. Boulder’s Flock settings also state that it is not supposed to be used for immigration enforcement.

This story and our earlier stories, including another about a Texas official who searched nationwide for a woman who self-administered an abortion, were reported using Flock “Network Audits” released by police departments who have bought Flock cameras and have access to Flock’s network. They are essentially a huge spreadsheet of every time that the department’s camera data was searched; it shows which officer searched the data, what law enforcement department ran the search, the number of networks and cameras included in the search, the time and date of the search, the license plate, and a “reason” for the search. These audit logs allow us to see who has access to Flock’s systems, how wide their access is, how often they are searching the system, and what they are searching for.

The audit logs show that whatever system Flock is using to enroll local police departments’ cameras into the network that CBP is searching does not have any meaningful pushback, because the data shows that CBP has access to as many or more cameras as any other police department. Freeman analyzed the searches done by CBP on June 13 compared to searches done by other police departments on that same day, and found that CBP had a higher number of average cameras searched than local police departments.

“The average number of organizations searched by any agency per query is 6,049, with a max of 7,090,” Freeman told 404 Media. “That average includes small numbers like statewide searches. When I filter by searches by Border Patrol for the same date, their average number of networks searched is 6,429, with a max of 6,438. The reason for the maximum being larger than the national network is likely because some agencies have access to more cameras than just the national network (in-state cameras). Despite this, we still see that the count of networks searched by Border Patrol outnumbers that of all agencies, so if it’s not the national network, then this ‘pilot program’ must have opted everyone in the nation in by default.”

CBP did not immediately respond to a request for comment.




Drive-By Truckers ecco la ristampa espansa di Decoration Day
freezonemagazine.com/news/driv…
Decoration Day, pubblicato nel 2003 remixato e rimasterizzato dal celebre ingegnere Greg Calbi. Contiene alcuni dei brani più famosi dei Drive-By Truckers come Sink Hole, Marry Me, My Sweet Annette e le prime canzoni di Jason Isbell entrato da poco nella band, come Outfit o la title track. Al disco originale viene aggiunto Heathens Live


Drive-By Truckers ecco la ristampa espansa di Decoration Day
freezonemagazine.com/news/driv…
Decoration Day, pubblicato nel 2003 remixato e rimasterizzato dal celebre ingegnere Greg Calbi. Contiene alcuni dei brani più famosi dei Drive-By Truckers come Sink Hole, Marry Me, My Sweet Annette e le prime canzoni di Jason Isbell entrato da poco nella band, come Outfit o la title track. Al disco originale viene aggiunto Heathens Live


#CharlieKirk: dall'omicidio alla repressione


altrenotizie.org/primo-piano/1…


L’antitrust cinese pizzica Nvidia per l’affare Mellanox

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Per la Cina, Nvidia ha violato le leggi antitrust con l'acquisizione dell'israeliana Mellanox nel 2020. Nuovi problemi per il colosso dei microchip di Jensen Huang, già al centro della sfida tecnologica tra Washington e Pechino (che



A che punto è l’alleanza Leonardo-Airbus-Thales sui satelliti? I dettagli

@Notizie dall'Italia e dal mondo

La possibile alleanza spaziale tra Airbus, Thales e Leonardo potrebbe essere vicina a diventare realtà. A confermarlo è Michael Schoellhorn, ceo di Airbus Defence and Space, in un’intervista al Corriere della Sera: “Queste operazioni richiedono sempre due momenti. Il primo è la firma (di



Ecco l’intelligenza artificiale trumpizzata di Apple. Report Reuters

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Apple ha aggiornato le linee guida per la sua intelligenza artificiale, cambiando approccio sui termini dannosi e controversi per startmag.it/innovazione/apple-…



Vi spiego come Gaia-X potrà favorire la sovranità digitale europea

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
A che punto è Gaia-X, iniziativa che riunisce oltre 350 enti pubblici, privati e centri di ricerca per creare un mercato unico dei dati, considerata un'infrastruttura critica per la sicurezza e