Kaspersky’s Global Research and Analysis Team (GReAT) has been releasing quarterly summaries of advanced persistent threat (APT) activity for over seven years now. Based on our threat intelligence research, these summaries offer a representative overview of what we’ve published and discussed in more detail in our private APT reports. They are intended to highlight the significant events and findings that we think are important for people to know about. This is our latest roundup, covering activity we observed during Q3 2024.

If you’d like to learn more about our intelligence reports or request more information about a specific report, please contact intelreports@kaspersky.com.

The most remarkable findings

In the second half of 2022, a wave of attacks from an unknown threat actor targeted victims with a new type of attack framework that we dubbed P8. The campaign targeted Vietnamese victims, mostly from the financial sector, with some from the real estate sector. Later, in 2023, Elastic Lab published a report about an OceanLotus APT (aka APT32) attack that leveraged a new set of malicious tools called Spectral Viper. Although the campaigns are the same, we cannot conclusively attribute P8 to OceanLotus.

The P8 framework includes a loader and multiple plugins. Except for the first-stage loader and the PipeShell plugin, all plugins are downloaded from the C2 and then loaded into memory, leaving no trace on disk. After a thorough analysis of the framework and its modules, we believe P8 was developed based on the open source project C2Implant, which is a red teaming C2 framework. However, P8 contains many built-in functions and redesigns of the communication protocol and encryption algorithm, making it a well-designed and powerful espionage platform. Based on the implemented supported commands, we suspect the goal is to implement another Cobalt Strike-like post-exploitation platform. Methods to gain persistence on affected systems are not built in and depend on commands received from the C2.

Unfortunately, we were unable to obtain any bait files or initial infection vectors. Based on limited telemetry, we believe with medium to low confidence that some of the initial infections were spear-phishing emails. Notably, these attacks use an obsolete version of the Kaspersky Removal Tool to side-load the P8 beacon. We also observed SMB and printer driver vulnerabilities being used to move laterally through the network.

We published a follow-up report on P8 that describes the plugins used in the attacks. Each time the system restarts, or as required by the operation, P8 downloads additional plugins from the C2 or loads them from disk into memory. So far, we have collected 12 plugins or modules that are used to support the operation by adding functionality for lateral movement, exfiltration, file management, credential stealing, taking screenshots or custom loading capabilities. In particular, two plugins are used to upload files of interest; one plugin is used for small files, while a second is used to upload large files to another server, presumably to reduce the network load on the C2.

We subsequently detected new attacks from this threat actor. While carrying out these attacks, the actor changed its TTPs from those outlined in our previous reports. For example, new persistence mechanisms were detected and we found that the loading mechanism of the final payload, the P8 beacon, also changed. In terms of victimology, there was little change. Most of the infections were still at financial institutions in Vietnam, with one victim active in the manufacturing industry. The infection vector has still not been found, nor have we been able to link these attacks to OceanLotus (APT32).

Earlier in 2024, a secure USB drive was found to be compromised and malicious code was injected into the access management software installed on the USB drive. The secure USB drive was developed by a government entity in Southeast Asia to securely store and transfer files between machines in sensitive environments. The access management software facilitates access to the encrypted partition of the drive. A Trojanized version of the software module was found to be used in these attacks. The malicious code injected into it is designed to steal sensitive files saved on the secure partition of the drive, while also acting as a USB worm and spreading the infection to USB drives of the same type.

Last year we investigated attacks against another different type of secure USB drive. Similarly, the attacks were delivered via a Trojanized USB management software called UTetris. We are tracking the threat actor behind the UTetris software attack as TetrisPhantom. In addition to the Trojanized UTetris software, TetrisPhantom uses a number of other malicious tools that have been in use for a few years. TetrisPhantom is still active and new samples of its tools have recently been detected.

While both the tactic of targeting a secure USB drive by compromising the software module installed on the drive and the victim profile in the recent attacks are similar to TetrisPhantom attacks, the malicious code implanted in the drive bears little similarity to the code injected into the utetris.exe program.

Our report provided an initial analysis of the Trojanized USB management program.

Chinese-speaking activity

In July 2021, we detected a campaign called ExCone targeting government entities in Russia. The attackers leveraged the VLC media player to deploy the FourteenHi backdoor after exploiting MS Exchange vulnerabilities. We also found Cobalt Strike beacons and several traces tying this actor to the ShadowPad malware and UNC2643 activity, which is in turn associated with the HAFNIUM threat actor.

Later that year, we discovered a new set of activities. This time the victimology changed: victims were also found in Europe, Central Asia and Southeast Asia. We also found new samples that we linked to Microcin, a Trojan used exclusively by SixLittleMonkeys. Shortly after, another campaign called DexCone was discovered, with similar TTPs to the ExCone campaign. Several new backdoors such as Pangolin and Iguania were discovered, both of which have similarities to FourteenHi.

Then, in 2022, we discovered another campaign by the same threat actor targeting Russia, with a special interest in government institutions, using spear-phishing emails as an infection vector and deploying an updated version of the Pangolin Trojan.

After that, we did not observe any new activity related to this actor until mid-July 2024. In this most recent campaign, the actor uses spear-phishing emails, embedding a JavaScript loader as the initial infection vector. The JavaScript loader loads yet another loader from a ZIP file, which in turn downloads a BMP image containing shellcode and an embedded PE file, which is the final payload. This is a new backdoor with limited functionality, reading and writing to files and injecting code into the msiexec.exe process. In this campaign, the actor decided to attack Russian educational institutions instead of government entities as it had previously.

The Scieron backdoor, a tool commonly used in cyber-espionage campaigns by the Scarab group, was detected in a new campaign. This campaign introduces novel decoders and loaders that use machine-specific information to decode and decrypt the Scieron backdoor and run it in memory. The campaign has specifically targeted a government entity in an African country and a telecoms provider in Central Asia. Notably, the infections within the telecoms provider have been traced back to 2022.

More recently, in June 2024, an updated infection chain was identified, with an updated set of decoders and loaders designed to run the Scieron backdoor and make it persistent. Our private report also provides a detailed description of the attackers’ post-compromise activities.

Europe

Awaken Likho is an APT campaign, active since at least July 2021, primarily targeting government organizations and contractors. To date, we have detected more than 120 targets in Russia, but there are also targets in other countries and territories such as India, China, Vietnam, Taiwan, Turkey, Slovakia, the Philippines, Australia, Switzerland and the Czech Republic, among others. Based on our findings, we would like to highlight two specific features of this campaign: all attacks are well prepared, and the hackers rely on the use of the legitimate remote administration tool UltraVNC. While this approach is rather simplistic, the attackers have been using this technique successfully for years.

We discovered a new Awaken Likho campaign that emerged in May 2024, in which the threat actor adjusted its TTPs slightly. The threat actor cleaned up its Golang SFX-based archives by removing unused files and also switched to executing AutoIT scripts after file extraction. UltraVNC remained the final payload, but in this campaign it was made to look like a OneDrive update utility. The targeting remained the same as in the earlier campaign – mainly government organizations and their contractors located in Russia.

Awaken Likho then adjusted its TTPs again, in a campaign uncovered in June 2024 that is still ongoing. The threat actor continued to favor the use of AutoIT scripts and also began using protectors such as Themida to protect its samples. While most of the samples we found still deployed the UltraVNC module, the attackers changed the final payload from UltraVNC to MeshAgent in several samples. Unlike previous campaigns, we did not observe the Golang SFX droppers this time. The nature of the threat actor, leveraging open source and free tools, allows it to quickly change its arsenal during active campaigns.

Epeius is a commercial spyware tool developed by an Italian company that claims to provide intelligence solutions to law enforcement agencies and governments. In recent years, the malware attracted the attention of the community due to the publication of two articles. The first, published in 2021 by Motherboard and Citizen Lab, shared the first evidence and indicators related to the software. The second, an article published in 2024 by the Google Threat Analysis Group, described the business model of various companies that provide commercial surveillance solutions. Knowledge of this threat is sparse and the Epeius malware has never been publicly described in detail. Our own threat hunting efforts to obtain related samples started in 2021, and last year we discovered a DEX file that we attribute with medium to high confidence to Epeius. Our private report describes what we know about Epeius and provides a technical description of its main Android component.

Middle East

In September 2023, our colleagues at ESET published a report on a newly discovered and sophisticated backdoor used by the FruityArmor threat actor, which they named DeadGlyph. The same month, we released an APT report detailing the ShadowWhisperer and NightmareLoader tools used in conjunction with the DeadGlyph malware. More recently, we identified what appears to be the latest version of the native DeadGlyph Executor backdoor module, with changes to both its architecture and workflow components.

MuddyWater is an APT actor that surfaced in 2017 and has traditionally targeted countries in the Middle East, Europe and the USA. The actor typically uses multi-stage PowerShell execution in its attacks, probably to obfuscate the attacks, evade defenses and hinder analysis.

Recently we uncovered VBS/DLL-based implants used in intrusions by the MuddyWater APT group that are still active today. The implants were found at multiple government and telecoms entities in Egypt, Kazakhstan, Kuwait, Morocco, Oman, Syria and the UAE. The threat actor achieves persistence through scheduled tasks that execute a malicious VBS file with the wscript.exe utility.

The TTPs and infrastructure we analyzed for the current intrusions are similar to previously reported intrusions by the MuddyWater APT group.

Southeast Asia and Korean Peninsula

Gh0st RAT, an open source RAT created about 15 years ago, is used by various groups, including state-sponsored actors. One of them is Dragon Breath (aka APT-Q-27 and Golden Eye Dog), first discussed in 2020 in connection with a watering hole campaign aimed at tricking users into installing a Trojanized version of Telegram. By 2022, the group was still using Trojanized Telegram applications as an infection vector, but had changed the final payload to Gh0st RAT.

A year later, Sophos published a blog post describing the latest change in the group’s TTPs, which included double side-loading DLLs. Since then, the Gh0st RAT payload has remained the same, but the attackers have again slightly adjusted their TTPs. DLL side-loading was abandoned and replaced by leveraging a logical flaw in a version of the TrueUpdate application, while more recently the group began to run the malware via a Python-based infection chain executed by the installer package.

Historically, Dragon Breath has targeted the online gaming and gambling industry. Given the nature of the infection vector, we’re not yet able to determine the target audience for this campaign. The attack begins by tricking users into downloading a malicious MSI installer. Once the installer is started, the malware is installed alongside the legitimate application. We believe the victim is prompted to download and launch it from a fake site while searching for a Chinese version of the legitimate TrueUpdate MSI installer.

Bitter APT has been active for over a decade. Since late 2023, this threat actor has used and continues to use CHM (compiled HTML) files, LNK shortcuts and DOC files as the first stage of infection. These files carry malicious scripts to connect to a remote server and download the next stage of the attacks, and appear to be used as attachments to spear-phishing emails. The payloads delivered via these malicious scripts represent new samples of backdoor modules described in previous private reports. However, in several cases, the final payloads can only be downloaded by pre-selected system configurations authorized by the threat actor after the initial reconnaissance phase. In a recent report, we discussed the workflow of the initial LNK, DOC and CHM files, their progress through the next stages of the attack, as well as the updates to the final backdoor modules and corresponding infrastructure.

Tropic Trooper (aka KeyBoy and Pirate Panda) is an APT group operating since 2011. The group’s targets have traditionally been in government, as well as the healthcare, transportation and high-tech industries located in Taiwan, the Philippines, and Hong Kong. Our most recent investigation revealed that in 2024, the group conducted persistent campaigns against a government entity in Egypt, which began in June 2023.

We noticed the infection in June 2024, when our telemetry showed recurring alerts for a new China Chopper web shell variant (China Chopper is used by many Chinese-speaking actors) found on a public web server. The server hosted a Content Management System (CMS) called Umbraco, an open source CMS platform for publishing content written in C#. The observed web shell component was compiled as a .NET module of Umbraco CMS.

During our subsequent investigation, we looked for other suspicious detections on this public server and identified several related malware sets. These include post-exploitation tools that we believe with medium confidence are related and being used as part of this intrusion.

We also identified new DLL search-order hijacking implants that are loaded from a legitimate vulnerable executable because it lacks the full path to the required DLL. This attack chain attempted to load the Crowdoor loader, named after SparrowDoor described by ESET. During the attack, the security agent blocked the first Crowdoor loader, which prompted the attackers to switch to a new, as yet unreported variant, with almost the same effect.

We investigated the attribution of this activity to the Chinese-language threat actor known as Tropic Trooper. Our findings show an overlap in capabilities reported in recent Tropic Trooper campaigns. The samples we found also show a high degree of overlap with samples previously attributed to Tropic Trooper.

PhantomNet is a RAT first described by ESET in late 2020. In 2021, we released our analysis of the PhantomNet malware, which at the time was being used in attacks against the Vietnamese government sector. Our report discussed in detail the plugins we found and the commands it supported.

We rediscovered PhantomNet during a recent investigation into a cyberattack on the Brazilian education and government sectors that occurred in April. This time we were able to recover several scripts, commands executed by the attackers, and the PhantomNet builder tool. The threat actor has changed the persistence mechanism so that the payload is now stored in an encrypted manner in the Windows registry and with an associated loader to retrieve the payload from the registry. There are also some changes to the victimology. Previously, PhantomNet infections were found in Asia, but now the infections have been found in many regions around the world and affect a wide variety of industries.

We discussed these findings in our private report, filling in the gaps from our previous report.

We have observed that the Kimsuky group uses a strategy of registering malware as a service for reliable persistence. The so-called ServiceChanger malware drops a malicious DLL file and registers a service disguised as a legitimate service. In the case we analyzed, ServiceChanger installed the TOGREASE malware, which is an evolved version of GREASE that adds the ability to toggle RDP activation when necessary by the operator; and in another instance, it was observed installing the XMRig miner.

In addition, this year’s updated version of the GREASE malware creates backdoor accounts to use RDP connections under the names “Guest” and “IIS_USER”, respectively. They borrow code from the publicly available UACME, allowing them to bypass UAC and execute commands with escalated privileges. Uniquely, the resources section within the GREASE malware includes a Zoom Opener installer vulnerable to DLL hijacking, which has not been observed in use by Kimsuky. However, it is possible that they may create malware that exploits this vulnerability in the future.

The updated GREASE malware is thought to be connected to the RandomQuery malware also used by Kimsuky, as it communicates with the C2 in a similar manner. The similarity and the overlap between the TOGREASE and GREASE malware used by the Kimsuky group suggests that this group is behind the malware.

Hacktivism

In the course of our research on hacktivist groups targeting organizations based in Russia, we have identified similarities among several of these groups. This suggests either that these clusters of activity share at least a subset of the same individuals, or that the groups are working closely together in their attacks. Our report details the tools, malware, and procedures of the BlackJack group and links it to the previously known group Twelve. In addition, further examination of its preferred wiper and ransomware tools uncovered samples that cannot be definitively attributed to either group.

Other interesting discoveries

In June, we identified an active campaign called “PassiveNeuron”, targeting government entities in Latin America and East Asia using previously unknown malware. The servers were compromised before security products were installed, and the method of infection is still unknown. The implants used in this operation were dubbed “Neursite” and “NeuralExecutor”. They do not share any code similarities with known malware, so attribution to a known threat actor is not possible at this time. The campaign shows a high level of sophistication, with the threat actor using compromised internal servers as an intermediate C2 infrastructure. The threat actor is able to move laterally through the infrastructure and exfiltrate data, optionally creating virtual networks that allow attackers to steal files of interest even from machines isolated from the internet. A plugin-based approach provides dynamic adaptation to the attacker’s needs.

In mid-April, we discovered a suspicious domain which, upon further investigation, revealed two backdoors written in Golang. During analysis, another backdoor was discovered that was used earlier in the attack timeline and protected using VMProtect. As well as the backdoors, an unknown keylogger and the use of the SOCAT tool were observed in this attack. The campaign exhibits a few peculiarities. First, the Golang backdoor uses Google Translate services as a proxy to communicate with the C2. Second, the threat actor tries to imitate Kaspersky software in terms of file names and names of scheduled tasks. Thirdly, we found only one infection, targeting a telecoms research center in India. We were unable to attribute this campaign to any known threat actor based on code similarity or TTPs.

In early April, we decided to take a closer look at the Windows Desktop Window Manager (DWM) Core Library Elevation of Privilege vulnerability (CVE-2023-36033), which was previously discovered as a zero-day and exploited in the wild. While searching for samples related to this exploit and attacks using it, we found a document of note that was uploaded to a multi-scanner service on April 1, 2024. This document had a rather descriptive file name, indicating that it contained information about a vulnerability in the Windows operating system. Inside the document we found a brief description of a Windows Desktop Window Manager vulnerability and how it could be exploited to gain system privileges.

The exploitation process described in the document was identical to that used in the previously mentioned zero-day exploit for CVE-2023-36033. However, the vulnerability was different. Judging by the quality of the writing and the fact that the document was missing critical details about how to actually trigger the vulnerability, there was a high probability that the vulnerability described was made up or was present in code that could not be accessed or controlled by the attackers. The subsequent investigation revealed a zero-day vulnerability that can be used to escalate privileges. After reporting the findings to Microsoft, the vulnerability was designated CVE-2024-30051 and a patch was released as part of Patch Tuesday on May 14, 2024.

After closely monitoring our statistics for related exploits and attacks, it became clear that there were several exploits for this zero-day vulnerability. Our discoveries showed that it was being used in conjunction with QakBot and other malware such as NewBot, leading us to believe that multiple threat actors have access to it. While previous findings of in-the-wild exploitation of CVE-2024-30051 showed financial motivation, it is possible that it could be leveraged in future APT activity.

An updated set of intrusions, possibly related to the Deathstalker cyber-mercenary group, employs an updated DarkMe VB6 OCX/DLL implant and stealthier TTPs, such as a more sophisticated infection chain.

In the intrusions we reported previously, the threat actor typically delivered the initial dropper through instant messaging (IM) apps such as Skype. In more recent intrusions, the actor typically delivered the initial dropper through Telegram. We assess with medium confidence that the threat actor delivered the initial droppers via Telegram channels related to e-trading and fintech news.

Apart from the delivery method, the attackers also increased their level of OPSEC and post-compromise cleanup by deleting post-exploitation files, tools, and registry keys after the operators achieve their objectives. Such actions, in turn, make the infection harder to detect and complicate post-compromise investigation.

Final thoughts

While some threat actors’ TTPs remain consistent over time, such as a heavy reliance on social engineering as a means of gaining entry into a target organization or compromising an individual’s device, others have updated their toolsets and expanded the scope of their activities. Our regular quarterly reviews are designed to highlight the most significant developments related to APT groups.

Here are the key trends we observed in Q3 2024:

• This quarter, we saw threat actors broaden their targeting, both in terms of verticals and geography.
• The purpose of most APT activity is cyber-espionage, although hacktivist attacks remain a feature of the threat landscape this quarter, mirroring areas of real-world conflict.
• Even more open source tools have been employed by APT threat actors, mostly to manage network connectivity with C2s.
• We continue to see threat actors using LOTL (Living off the Land) techniques in their campaigns.

As always, we would like to point out that our reports are the product of our visibility into the threat landscape. However, it is important to remember that while we strive for continuous improvement, there is always the possibility that other sophisticated attacks may fly under our radar.

Disclaimer: When we refer to APT groups as Russian-speaking, Chinese-speaking, etc., we are referring to various artifacts used by the groups (such as malware debugging strings, comments found in scripts, etc.) that contain words in those languages, based on information we have obtained directly or that is otherwise publicly known and widely reported. The use of certain languages does not necessarily indicate a specific geographic relationship, but rather indicates the languages used by the developers behind these APT artifacts.

securelist.com/apt-report-q3-2…

Gli sviluppatori del malware Banshee Stealer hanno cessato le attività dopo che il codice sorgente del programma è trapelato online. Banshee Stealer, apparso nell’agosto del 2024, è diventato uno dei pochi infostealer progettati per attaccare macOS.

Tuttavia, il programma è diventato famoso soprattutto per il suo prezzo di affitto elevato: oltre 3.000 dollari al mese, ovvero circa 10 volte superiore al costo standard di programmi simili.

Secondo un rapporto di Elastic Security Labs, il malware aveva tutte le funzioni tipiche degli infostealer: rubare password dai browser, rubare chiavi di portafogli di criptovalute, raccogliere dati sul sistema operativo e lanciare pagine di phishing.

La fuga del codice sorgente, secondo gli esperti, potrebbe essere collegata ad un cliente insoddisfatto. Simili situazioni non sono rare nei forum underground: gli acquirenti, sentendosi ingannati o volendo danneggiare i concorrenti, spesso pubblicano i codici sorgente dei malware rendendoli di pubblico dominio.

Recentemente, il team Elastic Security Labs ha anche identificato un nuovo metodo per diffondere il malware GHOSTPULSE: caricare i dati attraverso i pixel di un file PNG. Questo approccio è stato definito uno dei cambiamenti più significativi nel funzionamento del malware dalla sua introduzione nel 2023.

In precedenza, GHOSTPULSE (HIJACKLOADER, IDATLOADER) nascondeva dati dannosi nei blocchi IDAT dei file PNG. Inoltre, il nuovo algoritmo consente di incorporare dati dannosi direttamente nella struttura dei pixel dell’immagine, complicandone il rilevamento.

L'articolo Banshee Stealer ha Chiuso! Tutto per colpa del codice trapelato online proviene da il blog della sicurezza informatica.

Spoiler alert: almond butter isn’t phosphorescent. But powdered milk is, at least to the limit of detection of this homebrew phosphorescence detector.

Why spend a bunch of time and money on such a thing? The obvious answer is “Why not?”, but more specifically, when [lcamtuf]’s son took a shine (lol) to making phosphorescent compounds, it just seemed natural for dad to tag along in his own way. The basic concept of the detector is to build a light-tight test chamber that can be periodically and briefly flooded with UV light, charging up the putatively phosphorescent compounds within. A high-speed photodiode is then used to detect the afterglow, which can be quantified and displayed.

The analog end of the circuit was the far fussier end of the design, with a high-speed transimpedance amplifier to provide the needed current gain. Another scaling amp and a low-pass filter boosts and cleans up the signal for a 14-bit ADC. [lcamtuf] went to great lengths to make the front end as low-noise as possible, including ferrite beads and short leads to prevent picking up RF interference. The digital side has an AVR microcontroller that talks to the ADC and runs an LCD panel, plus switches the 340 nm LEDs on and off rapidly via a low gate capacitance MOSFET.

Unfortunately, not many things found randomly around the average home are all that phosphorescent. We’re not sure what [lcamtuf] tried other than the aforementioned foodstuffs, but we’d have thought something like table salt would do the trick, at least the iodized stuff. But no matter, the lessons learned along the way were worth the trip.

hackaday.com/2024/11/28/homebr…

I ricercatori di sicurezza informatica hanno segnalato la creazione di un bootkit UEFI unico nel suo genere per i sistemi Linux. Lo strumento, chiamato Bootkitty, è considerato un proof-of-concept (PoC) e, secondo gli esperti, non è stato ancora utilizzato in attacchi reali. Il bootkit è noto anche come IranuKit ed è stato caricato per la prima volta sulla piattaforma VirusTotal il 5 novembre 2024.

Il compito principale di Bootkitty è disabilitare la funzione di verifica della firma del kernel Linuxe precaricare due file ELF tramite il processo init, che viene avviato per primo all’avvio del sistema. Secondo gli esperti di ESET, la funzionalità del bootkit rappresenta una seria sfida per la sicurezza informatica.

Questo bootkit utilizza un certificato autofirmato, che ne impedisce l’esecuzione su sistemi con Secure Boot abilitato, a meno che gli aggressori non abbiano precedentemente installato un certificato controllato. Tuttavia, anche se Secure Boot è abilitato, Bootkitty è in grado di modificare le funzioni di controllo dell’integrità del kernel in memoria prima di avviare il boot loader GRUB.

Pertanto, se Secure Boot è abilitato, Bootkitty si connette a due funzioni dei protocolli di autenticazione UEFI, ignorando i controlli di integrità. Quindi modifica tre funzioni nel bootloader GRUB per consentirgli di aggirare ulteriori controlli di sicurezza. Ciò dimostra la grave vulnerabilità dei sistemi moderni.

L’indagine di ESET ha scoperto un modulo kernel non firmato in bundle che distribuisce un binario ELF BCDropper. Questo file carica un altro modulo del kernel sconosciuto dopo l’avvio del sistema. Le funzioni del modulo includono nascondere file e processi e aprire porte di rete, tipico dei rootkit.

Gli esperti sottolineano che Bootkitty distrugge lo stereotipo secondo cui i bootkit UEFI minacciano solo i sistemi Windows e indica la necessità di prepararsi a nuove minacce. Questa scoperta potrebbe diventare un punto di partenza per ulteriori sviluppi nel campo della protezione delle piattaforme Linux.

L'articolo I Bootkit UEFI Sbarcano su Linux! Come il PoC di IranuKit Svela Vulnerabilità Nascoste proviene da il blog della sicurezza informatica.

Prima del 1994, la maggior parte delle tecnologie di scansione utilizzavano codici a barre unidimensionali in grado di memorizzare solo fino a 80 caratteri alfanumerici. Denso Wave ha creato i primi codici QR, aumentando la capacità a 7.000 caratteri digitali o 4.300 alfanumerici.

Uno studio di Cisco Talos ha dimostrato che i filtri antispam sono praticamente impotenti contro i codici QR dannosi perché non sono in grado di riconoscerne la presenza nelle immagini. Le statistiche mostrano che, sebbene i codici QR appaiano solo in una e-mail su 500, uno scioccante 60% di essi contiene spam o malware.

Questa nuova tipologia di frode è ancora molto giovane. Si chiama “quishing“. Gli aggressori creano siti Web falsi che imitano risorse legittime e inseriscono codici QR in luoghi pubblici. Ad esempio, ci sono stati casi in cui qualcuno ha posizionato adesivi QR sui parchimetri che reindirizzano le vittime a sistemi di pagamento falsi.

Le e-mail con codici QR mascherati da richieste di autenticazione a due fattori sono lo stratagemma più comune. I truffatori li usano per rubare credenziali. Quando un codice QR viene scansionato da un dispositivo mobile, tutto il traffico successivo tra la vittima e l’aggressore passa attraverso la rete cellulare, aggirando i sistemi di sicurezza aziendali.

Nonostante la quota relativamente piccola di tali email (0,1-0,2% del volume totale), finiscono molto più spesso nella casella di posta, aggirando i filtri antispam. Inoltre, i truffatori ingegnosi hanno imparato a creare codici QR utilizzando i caratteri Unicode, rendendoli ancora più difficili da rilevare. I metodi tradizionali per neutralizzare i collegamenti dannosi, come la sostituzione del protocollo “http” con “hxxp” o l’aggiunta di parentesi all’URL, funzionano molto peggio in questo caso.

Esistono modi per rendere i codici QR sicuri da visualizzare, ad esempio mascherando i moduli dati o rimuovendo uno o più modelli di posizione (grandi quadrati agli angoli del codice). Questi trucchi però non sono chiari a tutti e non si sono ancora diffusi.

Una minaccia separata è rappresentata dalla cosiddetta “QR art”, immagini in cui il codice è mascherato da una normale immagine. Un utente potrebbe accidentalmente scansionarlo con una fotocamera e fare clic su un collegamento dannoso senza nemmeno rendersene conto.

Gli analisti di Cisco Talos consigliano di usare la stessa cautela durante la scansione dei codici utilizzata quando si fa clic su collegamenti sospetti. Per chi li utilizza regolarmente, esistono appositi decoder online che consentono di pre-controllare il contenuto.

Ricorda: la semplicità e la comodità delle tecnologie QR non dovrebbero mettere in secondo piano la necessità di rispettare le regole basilari di sicurezza digitale.

L'articolo Codici QR e Sicurezza: Nuove Frodi Tecnologiche all’Orizzonte proviene da il blog della sicurezza informatica.

Nelle ultime settimane, il panorama delle minacce è stato scosso dall’emergere di attacchi che sfruttano la combinazione letale di due vulnerabilità zero-day, CVE-2024-9680 e CVE-2024-49039, collegate rispettivamente a Firefox e a Windows. L’obiettivo è stato identificato in una campagna mirata guidata dal gruppo di cybercriminali dietro la backdoor RomCom. Questa operazione dimostra una sofisticazione crescente nei metodi di attacco e una pericolosa rapidità nello sfruttamento di vulnerabilità.

Le vulnerabilità e il meccanismo di attacco

CVE-2024-9680, una vulnerabilità use-after-free nelle timeline di animazione di Firefox, permette l’esecuzione di codice malevolo senza necessità di interazione da parte della vittima. Gli attacchi che sfruttano questa vulnerabilità sono stati confermati in-the-wild, con un punteggio di gravità pari a 9.8 su 10, evidenziando la sua pericolosità e criticità.

La seconda vulnerabilità, CVE-2024-49039, una falla di elevazione dei privilegi in Windows, consente agli attaccanti di compromettere il sistema sfruttando la combinazione con lo zero-day di Firefox, guadagnando accesso completo al dispositivo della vittima.

La catena di compromissione, scoperta da Damien Schaeffer di ESET, ha avuto inizio con un sito web malevolo progettato per reindirizzare gli utenti a un server che ospitava un exploit zero-click. Non è stata necessaria alcuna interazione da parte dell’utente: una volta attivato, l’exploit scaricava e installava RomCom Backdoor, un malware avanzato che consente agli attaccanti di eseguire comandi remoti, raccogliere informazioni sensibili e scaricare moduli aggiuntivi per ampliare le capacità del malware.

La campagna, attiva tra ottobre e novembre 2024, ha colpito principalmente utenti in Europa e Nord America, mirandoli in particolare nei settori governativo, energetico e sanitario. La scelta di questi settori strategici sottolinea l’interesse di RomCom per dati sensibili e operazioni di sabotaggio.

Mappa delle potenziali vittime che riporta ESET

RomCom: Il gruppo dietro gli attacchi

RomCom (noto anche come Tropical Scorpius o UNC2596) è un gruppo di cybercriminali allineato con la Russia, coinvolto in numerose campagne di cybercrimine e spionaggio. Già nel 2023, aveva sfruttato un attacco zero-day tramite Microsoft Word, dimostrando la sua capacità di adattarsi alle nuove vulnerabilità. Nel 2024, RomCom ha espanso la sua attività colpendo settori critici in Ucraina, Europa e Stati Uniti, confermando l’intensificazione della sua operatività nel rubare dati strategici e danneggiare infrastrutture critiche.

Tempestività nelle Patch

La tempestività nella risposta alle vulnerabilità è stata cruciale per mitigare l’impatto di questa campagna. Mozilla, ad esempio, ha dimostrato una reattività eccezionale: entro 48 ore dalla segnalazione da parte di ESET, sono stati distribuiti aggiornamenti per Firefox e Thunderbird, garantendo protezione agli utenti contro CVE-2024-9680. Anche Microsoft ha seguito rapidamente con il rilascio della patch per CVE-2024-49039 il 12 novembre, chiudendo un’importante porta di accesso sfruttata dagli attaccanti. Questi interventi rapidi hanno dimostrato l’importanza di una collaborazione efficace tra ricercatori di sicurezza e aziende tecnologiche per contenere le minacce prima che possano espandersi su scala più ampia.

Raccomandazioni

1. Aggiornamenti immediati: Applicare prontamente le patch per i browser e i sistemi operativi è fondamentale per proteggere i propri dispositivi da vulnerabilità simili a quelle sfruttate in questa campagna.
2. Monitoraggio continuo: Implementare strumenti avanzati di rilevamento per identificare movimenti laterali e comandi malevoli è cruciale per evitare che gli attaccanti possano passare inosservati.
3. Consapevolezza del personale: Formare i dipendenti sui rischi legati a siti web fasulli e vulnerabilità zero-click può fare la differenza nella prevenzione degli attacchi.

Conclusione

La campagna RomCom evidenzia una crescente sofisticazione nelle operazioni dei gruppi di cybercriminali allineati a stati nazionali, con un utilizzo sempre più frequente di vulnerabilità zero-day per eseguire attacchi mirati e devastanti. La combinazione di falle in Firefox e Windows ha dimostrato come gli exploit possano aggirare le protezioni tradizionali, colpendo senza alcuna interazione da parte delle vittime. Tuttavia, la tempestività nella distribuzione delle patch da parte di Mozilla e Microsoft sottolinea l’importanza di una risposta rapida e coordinata per limitare i danni. Questa vicenda ci ricorda l’urgenza di mantenere sistemi aggiornati, monitorare attivamente le minacce e investire nella sicurezza informatica, poiché i rischi non solo evolvono, ma colpiscono con una velocità senza precedenti.

L'articolo Scoperto l’attacco zero-day più sofisticato del 2024 e RomCom e la Backdoor invisibile proviene da il blog della sicurezza informatica.

There can be few among those of us who produce printed circuit boards, who have not at some point placed a component the wrong way round, or with the wrong footprint. Usually this can be rectified with a bit of rework and a fresh board spin, but just occasionally these mishaps make it into the wild undetected. It seems nobody is immune, as [Doug Brown] is here to tell us with a tale of an Apple product with a misplaced capacitor.

The LC series of Macs came out through the early 1990s, and their pizza-box style cases could be found slowly turning yellow in universities and schools throughout that decade. Of them there was a persistent rumor of the LCIII had a misplaced capacitor, so when he received an unmodified original machine he took a look. The investigation is quite simple, but revealing — there are three power supply rails and one of the capacitors does have a significant leak.

The explanation is simple enough, the designer had placed a capacitor on each rail, with its negative side to the ground plane, but one of the rails delivers -5 volts. Thus the capacitor is the wrong way round, and must have failed pretty early in the lifetime of each LCIII. We’re curious then since so many of them went through their lives without the component being replaced, how the circuit remained functional. We’re guessing that there were enough other capacitors in the -5 volt line to provide enough smoothing.

hackaday.com/2024/11/27/even-a…

If you think your job sucks, be grateful you’re not this homebrew sewer inspection robot.

Before anyone gets upset, yes we know what [Stargate System] built here isn’t a robot at all; it’s more of a remotely operated vehicle. That doesn’t take away from the fact that this is a very cool build, especially since it has to work in one of the least hospitable and most unpleasant environments possible. The backstory of this project is that the sewer on a 50-year-old house kept backing up, and efforts to clear it only temporarily solved the problem. The cast iron lateral line was reconfigured at some point in its history to include a 120-degree bend, which left a blind spot for the camera used by a sewer inspection service. What’s worse, the bend was close to a joint where a line that once allowed gutters and foundation drains access to the sewer.

To better visualize the problem, [Stargate] turned to his experience building bots to whip up something for the job. The bot had to be able to fit into the pipe and short enough to make the turn, plus it needed to be — erm, waterproof. It also needed to carry a camera and a light, and to be powered and controlled from the other end of the line. Most of the body of the bot, including the hull and the driving gear, was 3D printed from ABS, which allowed the seams to be sealed with acetone later. The drive tracks were only added after the original wheels didn’t perform well in testing. Controlling the gear motors and camera was up to a Raspberry Pi Zero, chosen mostly due to space constraints. An Ethernet shield provided connectivity to the surface over a Cat5 cable, and a homebrew PoE system provided power.

As interesting as the construction details were, the real treat is the down-hole footage. It’s not too graphic, but the blockage is pretty gnarly. We also greatly appreciated the field-expedient chain flail [Stargate] whipped up to bust up the big chunks of yuck and get the pipe back in shape. He did a little bit of robo-spelunking, too, as you do.

And no, this isn’t the only sewer bot we’ve ever featured.

youtube.com/embed/adGp3PADKsk?…

hackaday.com/2024/11/27/diy-pi…

[Angus] of Maker’s Muse has a video with a roundup of different 3D-printable hinge designs, and he points out that a great thing about 3D printing objects is that adding printable features to them is essentially free.
These hinges have an indexing feature that allows them to lock into place, no additional parts needed.
A great example of this is his experimental print-in-place butt hinge with indexing feature, which is a hinge that can lock without adding any additional parts. The whole video is worth a watch, but he shows off the experimental design at the 7:47 mark. The hinge can swing normally but when positioned just right, the squared-off pin within slots into a tapered track, locking the part in place.

Inspired by a handheld shopping basket with a lockable handle, [Angus] worked out a design of his own and demonstrates it with a small GoPro tripod whose legs can fold and lock in place. He admits it’s a demonstration of the concept more than a genuinely useful tripod, but it does show what’s possible with some careful design. Being entirely 3D printed in a single piece and requiring no additional hardware is awfully nice.

3D printing is very well-suited to this sort of thing, and it’s worth playing to a printer’s strengths to do for pennies what one would otherwise need dollars to accomplish.

Want some tips on designing things in a way that take full advantage of what a 3D printer can achieve? Check out printing enclosures at an angle with minimal supports, leveraging the living hinge to print complex shapes flat (and fold them up for assembly), or even print a one-piece hinge that can actually withstand a serious load. All of those are full of tips, so keep them in mind the next time you design a part.

hackaday.com/2024/11/27/would-…

Le Ransomware Gang colpiscono anche le squadre del cuore. Il Bologna FC, uno dei club storici della Serie A, è stata rivendicata come vittima di un attacco ransomware presumibilmente condotto dal gruppo RansomHub.

Questo attacco evidenzia come i cybercriminali non risparmino neanche il mondo dello sport, utilizzando l’esfiltrazione di dati sensibili come leva per estorcere denaro. Secondo quanto riportato, sarebbero stati sottratti 200 GB di dati riservati, inclusi documenti aziendali, strategie di mercato e informazioni personali di tifosi, calciatori e staff.

Al momento, non possiamo confermare la veridicità della notizia, poiché l’organizzazione non ha ancora rilasciato alcun comunicato stampa ufficiale sul proprio sito web riguardo l’incidente. Pertanto, questo articolo deve essere considerato come ‘fonte di intelligence’.

RansomHub e il modello RaaS

RansomHub opera con il modello di Ransomware-as-a-Service (RaaS), una struttura che consente agli affiliati di lanciare attacchi utilizzando strumenti forniti dal gruppo centrale. Questo sistema non si limita al blocco dei dati tramite crittografia, ma punta sull’esfiltrazione delle informazioni e sulla successiva minaccia di pubblicarle per aumentare la pressione sulle vittime.

Nel caso del Bologna FC, il gruppo avrebbe dichiarato che il club non dispone di misure di sicurezza adeguate, utilizzando il GDPR come ulteriore strumento di coercizione. Le sanzioni previste dal regolamento europeo per la mancata protezione dei dati possono raggiungere i 10 milioni di euro o il 2% del fatturato, un fattore che potrebbe spingere le vittime a considerare il pagamento del riscatto.

Dati sottratti

RansomHub afferma di aver trafugato una vasta quantità di informazioni, inclusi:

• Contratti di sponsorizzazione con dettagli economici.
• Strategie aziendali e commerciali del club.
• Dati personali di giocatori, tifosi e dipendenti.
• Documenti medici completi dei calciatori.
• Informazioni su trasferimenti e giovani talenti.
• Scansioni di passaporti e dettagli bancari, tra cui quello dell’allenatore Vincenzo Italiano.

Alcuni screenshot di questi documenti sarebbero stati già pubblicati nel dark web, dimostrando l’autenticità del furto e intensificando la pressione sul Bologna FC.

Conclusione

Se confermato, l’attacco al Bologna FC rappresenta un segnale d’allarme per tutte le organizzazioni, sportive e non. La combinazione ditecnologie avanzate e tattiche di pressionesta trasformando i ransomware in una delle minacce più insidiose del nostro tempo. Con un attacco simile, il mondo dello sport non può più ignorare la crescente minaccia cyber. È cruciale adottare strategie di sicurezza che comprendano monitoraggi costanti, l’implementazione di tecnologie avanzate e una cultura della cybersecurity condivisa tra tutte le figure aziendali. Solo così sarà possibile evitare che il prossimo club a essere colpito possa vedere i propri dati, e la propria reputazione, messi in pericolo.

Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione da parte dell’azienda qualora voglia darci degli aggiornamenti sulla vicenda. Saremo lieti di pubblicare tali informazioni con uno specifico articolo dando risalto alla questione.

RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono utilizzare la mail crittografata del whistleblower.

L'articolo Il Bologna FC nel mirino di RansomHub che rivendica 200 GB di dati! proviene da il blog della sicurezza informatica.

This week, Jonathan Bennett and Lars Wikman chat about Elixir and Nerves — a modern language that’s a take on Erlang, and an embedded Linux approach for running Elixir code on devices.

• underjord.io/feed/
• elixir-lang.org/
• nerves-project.org/
• Introducing Elixir and the ecosystem from Oredev 2023
• Introducing Nerves from Oredev 2024 (just released)
• The Soul of Erlang & Elixir, by Sasa Juric

Subscribe to catch the show live, and come to Hackaday for the rest of the story!

youtube.com/embed/ZGKxutJVw_g?…

Did you know you can watch the live recording of the show Right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or contact the guest and have them contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2024/11/27/floss-…

Un attore malevolo ha pubblicato su un forum nel dark web due annunci in cui afferma di aver ottenuto accesso non autorizzato alla piattaforma cloud di Oracle e ai server di un’importante azienda globale nel settore sanitario.

Le dichiarazioni del cybercriminale sollevano preoccupazioni significative riguardo alla sicurezza delle infrastrutture critiche e alla protezione dei dati personali a livello globale.

Attualmente, non possiamo confermare l’autenticità della notizia, poiché l’organizzazione non ha ancora pubblicato un comunicato ufficiale sul proprio sito web in merito all’incidente. Le informazioni riportate provengono da fonti pubbliche accessibili su siti underground, pertanto vanno interpretate come una fonte di intelligence e non come una conferma definitiva.

Primo Post: Vendita di Accesso API di Oracle Cloud

Nel primo post, il cybercriminale ha dichiarato di aver compromesso l’accesso alla piattaforma cloud di Oracle, offrendolo in vendita al miglior offerente per la cifra di 100.000 dollari in cripto.

Oracle, è un colosso globale nel campo del software aziendale e delle soluzioni cloud, rappresenta una colonna portante della tecnologia mondiale. La compromissione di un accesso API esclusivo alla sua piattaforma potrebbe avere ripercussioni devastanti, potenzialmente aprendo la porta a exploit su larga scala contro aziende clienti e interi ecosistemi digitali.

Secondo Post: Dati Sanitari Globali Esposti

Nel secondo annuncio, l’attore malevolo ha alzato ulteriormente la posta, dichiarando di aver violato i server di un’importante azienda sanitaria globale sfruttando le infrastrutture Oracle. Secondo quanto riportato, l’attacco avrebbe portato all’accesso e alla vendita di dati sensibili relativi a milioni di cittadini in tutto il mondo. Tra le informazioni compromesse si troverebbero:

• Dati identificativi personali
• Numeri di telefono
• Nomi completi
• Indirizzi email
• Dettagli sensibili aggiuntivi

L’attore sostiene inoltre di avere pieno controllo sui server cloud e sulle applicazioni utilizzate dall’azienda sanitaria, mettendo i dati rubati in vendita per una cifra di 15.000 dollari, accettando criptovalute come Bitcoin, Ethereum o Litecoin.

Per contattare direttamente il criminale, è stato persino fornito un indirizzo Tox, segnalando l’intento di negoziare o vendere informazioni senza lasciare tracce attraverso canali anonimi e criptati.

Le conseguenze potenziali di queste violazioni, se confermate, sono estremamente gravi. I dati personali di milioni di persone potrebbero finire nelle mani sbagliate, alimentando frodi finanziarie, furti d’identità e altre attività criminali. Inoltre, la vendita di accesso API alla piattaforma cloud di Oracle potrebbe dare a ulteriori attori malevoli la possibilità di perpetrare attacchi su scala ancora maggiore, danneggiando clienti aziendali e infrastrutture critiche.

Di fronte a queste minacce, è imperativo agire rapidamente e con decisione. Alcune misure chiave includono:

1. Monitorare i forum del dark web: Tracciare l’attività legata a queste dichiarazioni per rilevare sviluppi e rischi imminenti.
2. Verificare l’autenticità delle affermazioni: Collaborare con esperti di sicurezza per identificare le vulnerabilità e limitarne immediatamente l’impatto.
3. Proteggere clienti e utenti finali: Comunicare con trasparenza e offrire supporto a coloro che potrebbero essere stati colpiti.
4. Implementare audit approfonditi: Rafforzare la sicurezza dei sistemi Oracle e dei partner aziendali attraverso controlli e aggiornamenti rigorosi.

Le dichiarazioni di questo attore malevolo non sono solo un segnale d’allarme, ma un vero e proprio invito all’azione. Oracle e le aziende coinvolte devono reagire con urgenza, adottando misure preventive e correttive per proteggere i propri sistemi e la privacy degli utenti.

Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione da parte dell’azienda qualora voglia darci degli aggiornamenti sulla vicenda. Saremo lieti di pubblicare tali informazioni con uno specifico articolo dando risalto alla questione.

RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono utilizzare la mail crittografata del whistleblower.

L'articolo Attacco Hacker su Scala Globale: Oracle e Salute Pubblica nel Mirino proviene da il blog della sicurezza informatica.

Fossil fuels can be a bit fussy to access, and geopolitics tends to make prices volatile. Burning them also takes carbon out of the ground and puts it into the atmosphere, with undesirable climate implications. The hunt for a solution has been on for quite some time.

Various synthetic fuels have been proposed as a solution, wherein carbon dioxide is captured from the air and chemically processed into useful fuel. Done properly, this could solve the climate issue where any fuel burned has its carbon later captured to make more fuel. The problem, though, is that this process is very energy intensive. Given the demands, it’s no surprise that some are looking towards nuclear reactors for the answer.

Hot To Go

Synthetic fuels are typically designed to replace conventional gasoline, diesel, or jet fuel. Credit: DOE, public domain
Burning fossil fuels is bad for the environment, but the problem is that they’re so very useful. Take transport, for example. Fossil fuels are perfect for this application because they pack a huge amount of energy into very little space while weighing relatively little to boot. At the same time, more than a third of global carbon emissions in 2021 came from transportation, according to the International Energy Agency. While electric vehicles are rapidly gaining market share in some areas, the complete phase out of internal combustion engines is by no means a sure thing. Meanwhile, sectors like aviation are proving especially difficult to fully electrify. We want to get off fossil fuels, but circumstances demand we continue to use them.

Enter synthetic fuels. They’re essentially drop-in replacements for gasoline, diesel and jet fuel that are produced from CO2, water and clean energy rather than being refined from petroleum. When made using captured CO2 and cleanly-produced hydrogen, they have the potential to significantly reduce transport emissions when taking the whole system into account. All this, without requiring an entirely new fueling infrastructure or any changes for the end user.

By capturing carbon and then chemically processing it into a useful combustible fuel, we could keep using existing technologies that we already find practical, like combustion-engined vehicles. Their emissions would still be undesirable, but they’d be offset by the capture process used to make new fuel. The idea is to create a closed loop for carbon emissions. The problem is finding a synfuel production process that’s efficient—both in terms of carbon capture and chemical processing—and to find the energy to run it.

Indeed, synthesizing hydrocarbons is an energy-intensive process. The process is well-understood at this point. Capturing CO2 from the air, generating hydrogen via electrolysis, and catalytically combining them into fuels at high temperatures and pressures all require a lot of energy input. For synfuels to deliver real climate benefits, this energy must come from clean, non-fossil sources.
The Department of Energy has a strong interest in nuclear synfuel production. Credit: Argonne National Laboratory
What do we do when we need a lot of power with minimum emissions? We look at nuclear! Several U.S. Department of Energy labs are actively researching nuclear-powered synfuel production, and the DOE is funding a $20 million demonstration project in Utah. Meanwhile, in the United Kingdom, the Nuclear Industry Association has been urging the country to seize a leadership position in this emerging field as well.

On a very basic level, a conventional nuclear power plant could provide electricity for various processes involved in synthetic fuel production. However, that’s not the only way to go. For some processes, the heat from a nuclear reactor could be directly used to power the synfuel production process. That is, rather than using heat from a nuclear reaction to create steam to turn a turbine, a purpose-built synfuel reactor could just deliver heat directly to a chemical process that needs it. Nuclear heat could be useful for desalinating seawater for hydrogen electrolysis, or for carbon capture, too.
The chemistry involved in synfuel production is well understood. The problem is figuring out how to do it cheaply enough to be competitive with fossil fuels, while using clean sources of CO2 and hydrogen. Credit: Argonne National Laboratory
The question is whether all the effort will be worthwhile. Competing with regular old fossil fuels on price will be a must, even if some degree of subsidy is used to lean the scales in the favor of synfuels. There are hopes that nuclear-produced synfuels could reach prices of $3 a gallon with the right feedstocks and input costs, but that’s words on a page at this stage. There is plenty of engineering to be done before you’ll be filling your car with 20 gallons of nuke gas at your local station.

Efficiency also comes into it, and this could play a big role in how synfuels pan out. Take cars, for example. Automakers have figured out how to make supremely efficient electric vehicles in the past decade. Electrical engineers have become experts at squirting power efficiently all over the country, and there are more EV charging stations than ever. Does it make sense to spin up bespoke nuclear synfuel plants to keep internal combustion alive, when the technology to replace it already exists? Arguments could be made for more demanding applications like trucking or aviation, but then the market for synfuels grows smaller.
Synthetic fuels are particularly attractive for the aviation industry, which has found electrification hard to achieve due to the limits of battery technology. Credit: US Air Force, public domain
In any case, nuclear synfuel holds great promise. Whether it can overcome the general resistance towards all nuclear technologies remains to be seen. Still, the tides may be changing on that front, and the future is anyone’s guess. If you’re a fan of fossil fuels and the like, be happy—there is hope yet that the flammable fluid market will roll on.

hackaday.com/2024/11/27/could-…

During World War II, shipboard life in the United States Navy was a gamble. No matter which theater of operations you found yourself in, the enemy was all around on land, sea, and air, ready to deliver a fatal blow and send your ship to the bottom. Fast forward a couple of decades and Navy life was just as hazardous but in a different way, as this Navy training film on the shipboard hazards of low-voltage electricity makes amply clear.

With the suitably scary title “115 Volts: A Deadly Shipmate,” the 1960 film details the many and various ways sailors could meet an untimely end, most of which seemed to circle back to attempts to make shipboard life a little more tolerable. The film centers not on the risks of a ship’s high-voltage installations, but rather the more familiar AC sockets used for appliances and lighting around most ships. The “familiarity breeds contempt” argument rings a touch hollow; given that most of these sailors appear to be in their 20s and 30s and rural electrification in the US was still only partially complete through the 1970s, chances are good that at least some of these sailors came from farms that still used kerosene lamps. But the point stands that plugging an unauthorized appliance into an outlet on a metal ship in a saltwater environment is a recipe for being the subject of a telegram back home.

The film shows just how dangerous mains voltage can be through a series of vignettes, many of which seem contrived but which were probably all too real to sailors in 1960. Many of the scenarios are service-specific, but a few bear keeping in mind around the house. Of particular note is drilling through a bulkhead and into a conduit; we’ve come perilously close to meeting the same end as the hapless Electrician’s Mate in the film doing much the same thing at home. As for up-cycling a discarded electric fan, all we can say is even brand new, that thing looks remarkably deadly.

The fact that they kept killing the same fellow over and over for each of these demonstrations doesn’t detract much from the central message: follow orders and you’ll probably stay alive. In an environment like that, it’s probably not bad advice.

youtube.com/embed/ylhf1dLD6QA?…

hackaday.com/2024/11/27/retrot…

Ciao a tuttə del Poliverso! 😺

Io sono Synth, è un anno ormai che sono nel #Fediverse e ho deciso di espandermi su Friendica per esplorarne le possibilità dato che è un po' di tempo che nutro curiosità per questo software.

Questo account non è il mio main, quello lo potete trovare su Misskey.social sul mio profilo @synthBirba , quello rimarrà il mio profilo "generico" ITA/ENG, qui vorrei concentrarmi nel comunicare esclusivamente in italiano e con persone che parlano la stessa lingua.

Ho scelto questa istanza perchè mi è capitato diverse volte di interagire con utenti che vengono da qui ^^

Presto farò l'annuncio anche sul mio main su Misskey per confermare il "collegamento" degli account (e sempre presto spero di approdare su PixelFed per caricare foto di gatti e quel che capita!)

Spero di trovarmi bene, di conoscere sempre più gente e di interagire in maniera interessante anche per voi c:

La squadra del presidente eletto Donald Trump sta discutendo la possibilità di creare una nuova posizione: quella di curatore dell’intelligenza artificiale. Questo specialista coordinerà la politica federale e l’uso delle tecnologie di intelligenza artificiale nelle agenzie governative

La scelta del candidato sarà influenzata in modo significativo da Elon Musk e Vivek Ramaswamy, che guidano l’organizzazione non governativa Department of Governance Effectiveness (DOGE). Tuttavia, lo stesso Musk, proprietario della società xAI, non si candida per questa posizione, ma è attivamente coinvolto nella definizione della politica nel campo dell’intelligenza artificiale. Alcuni rivali sostengono che i suoi legami con l’amministrazione Trump potrebbero dare un vantaggio alle sue aziende.

Il compito principale del curatore sarà l’allocazione delle risorse pubbliche e private per mantenere la posizione di leadership degli Stati Uniti nel campo dell’intelligenza artificiale. Si prevede che lavorerà con i leader dell’intelligenza artificiale presso le agenzie governative le cui posizioni sono state create dall’ordine esecutivo del presidente Biden e che utilizzerà l’intelligenza artificiale per rilevare frodi e appropriazione indebita di fondi.

Si sta discutendo la possibilità di combinare questa posizione con l’incarico di curatore per le criptovalute. In precedenza, secondo Bloomberg, l’amministrazione Trump avrebbe già intervistato per questa posizione i leader delle società di criptovaluta. La nomina di un curatore dell’IA non richiede l’approvazione del Senato, consentendo ai piani dell’amministrazione di andare avanti più rapidamente.

La creazione di questa posizione fa parte della strategia di Trump per sviluppare nuove tecnologie. Nell’ambito della stessa strategia, era stata precedentemente annunciata la creazione del Consiglio nazionale per l’energia, che sarà guidato dal governatore del Nord Dakota Doug Burgum, nominato per la carica di Segretario degli Interni. Il consiglio includerà anche Chris Wright, il candidato a ministro dell’energia.

Il Consiglio coordinerà il lavoro delle agenzie responsabili di autorizzare, produrre, generare, distribuire e regolare tutti i tipi di energia negli Stati Uniti. Gli obiettivi principali del consiglio includono la semplificazione delle procedure burocratiche, l’attrazione di investimenti privati ​​e il sostegno all’innovazione.

L’amministrazione Biden, incontrando scarso sostegno al Senato e difficoltà nel confermare i candidati, non è riuscita a nominare un capo della tecnologia statunitense, una posizione creata sotto il presidente Obama. Invece, le questioni legate all’intelligenza artificiale sono state coordinate da altri alti funzionari della Casa Bianca, con il vicepresidente Harris che rappresentava gli Stati Uniti nei negoziati internazionali sulle questioni legate all’intelligenza artificiale.

L'articolo Donald Trump vuole lo Zar Dell’Intelligenza Artificiale! Scelta influenza da Elon Musk? proviene da il blog della sicurezza informatica.

So now we’ve talked about all kinds of byproducts, including man-made (Fordite), nature-made (fulgurites), and one that’s a little of both (calthemites). Each of these is beautiful in its own way, but I’m not sure about the beauty and merit of corium — that which is created in a nuclear reactor core during a meltdown.
A necklace made to look like corium. Image via OSS-OSS
Corium has the consistency of lava and is made up of many things, including nuclear fuel, the products of fission, control rods, any structural parts of the reactor that were affected, and products of those parts’ reaction with the surrounding air, water, and steam.

If the reactor vessel itself is breached, corium can include molten concrete from the floor underneath. That said, if corium is hot enough, it can melt any concrete it comes in contact with.

So, I had to ask, is there corium jewelry? Not quite. Corium is dangerous and hard to come by. But that doesn’t stop artisans from imitating the substance with other materials.

Forming Corium

Chernobyl corium in steam discharge corridor. Image via ICTP
Corium lava was produced at both Chernobyl and Fukushima Dai’ichi, and on a smaller scale at Three Mile Island. It’s a rare thing, this man-made lava, and it’s only produced when humans gather enough highly-radioactive isotopes to start a chain reaction.

When a nuclear meltdown occurs, the fission reaction occurring within the reactor is no longer sufficiently cooled and contained to keep the rods, cases, core containment vessel, et cetera cool. Heat builds rapidly, produced by the fission of uranium-235 and plutonium-239.

If the chain reaction of fission and decays is allowed to go on, the heat will build up enough that the fuel rods start to bend and eventually melt. Usually, this is controlled by cooling water and control rods that are able to absorb some of the neutrons created by fission and decay. But if the fuel rods become fully molten, then you’ve got a meltdown on your hands.

April 26, 1986

The largest formation of corium in existence occurred during the Chernobyl disaster. In fact, so much corium issued forth that the molten mass dripped underneath to form stalactites, stalagmites, and lava flows such as the Elephant’s Foot.
The Chernobyl Elephant’s Foot, a large mass of corium. Image via Wikipedia
Chernobyl’s corium was formed over several days in three phases, the first of which lasted only seconds. The second stage lasted six days and comprised the interaction of the lava with silica-based structural materials like sand, concrete, and serpentinite. Finally, fuel lamination took place, and the molten corium penetrated the floors and solidified.

The corium at Chernobyl consists of uranium dioxide fuel, zircaloy cladding, concrete, and the serpentinite that had been packed around the reactor to serve as thermal insulation. Analysis has since shown that the corium reached a maximum temperature of 2,255 °C (4,091 °F). Far from cooling quickly, it remained above 1,660 °C (3,020 °F) for several days.

Chernobyl Corium

There are five types of material in Chernobyl’s corium:

• black ceramics: dark black, glassy material with a highly pitted surface
• brown ceramics: brown, glassy material that is both glossy and dull
• slag-like granulated corium: these are glassy granules with a crust and range from gray-magenta to a dark brown. These were formed by extended contact of brown ceramics with water
• pumice: grayish-brown porous formations that were formed when molten brown ceramic came into contact with water
• metal: both molten and solidified

The Elephant’s Foot is a large mass comprised of black corium and has many layers. It resembles tree bark on its surface. In order to get to where it was discovered in December 1986 (15 meters southeast of the reactor in a maintenance corridor), the corium burned through 2 m (6 ft) of reinforced concrete, then traveled through pipes and fissures and flowed down a hallway.

Three Mile Island

By comparison, the accident at Three Mile Island was a slow, partial meltdown. Within two minutes, over 40,000 pounds of various materials melted and relocated. And although a pool of corium formed at the bottom of the reactor vessel, it wasn’t breached.

Eventually, scientists took samples from the reactor and discovered two masses of dull, grey corium with a few yellow areas — one in the fuel assembly, and the other on the lower head of the reactor vessel. They found the corium to be mostly molten fuel and cladding. Elementally, it was mostly uranium, along with zirconium, oxygen, stainless steel, and an alloy called Inconel. Some of the samples included silver and indium from the control rods.

Melting and Smelting

Man-made lava is a terrible, amazing thing that, ideally, will remain rare. But not all byproducts are rare, and certainly not all of them have cool names. What could I possibly be talking about? Stay tuned!

hackaday.com/2024/11/27/boss-b…

Sembra che il problema dei falsi specialisti IT nordcoreani si sia diffuso non solo nelle aziende degli Stati Uniti. Secondo gli analisti di Microsoft, schemi simili sono operativi in ​​tutto il mondo, tra cui Cina, Russia e altri paesi.

Ricordiamo che negli ultimi mesi sono arrivate segnalazioni secondo cui gli hacker nordcoreani ottengono segretamente lavoro in aziende americane. Successivamente tentano di installare malware sui computer da lavoro, oltre a rubare dati dalle reti aziendali e chiedere riscatti.

Allo stesso tempo, gli specialisti di sicurezza informatica ritengono che non tutti gli specialisti IT della Corea del Nord siano coinvolti in attività dannose e spionaggio informatico. Alcuni effettivamente lavorano, e gli alti stipendi che ricevono, secondo i ricercatori, “generano entrate per il programma nucleare della Corea del Nord”.

A loro volta, le autorità americane stanno combattendo questo fenomeno scoprendo persone che aiutano a realizzare tali operazioni negli Stati Uniti. In sintesi stanno creando delle factory di laptop per trasferire il denaro rubato all’estero.

Ora gli specialisti Microsoft hanno redatto un rapporto e lo hanno presentato alla conferenza CYBERWARCON. Secondo Microsoft, la Corea del Nord aggira sanzioni e barriere finanziarie. Lo fa introducendo i suoi “specialisti IT” in aziende di Russia, Cina e altri paesi. Migliaia di dipendenti sono stati collocati con l’aiuto di terze parti. Queste forniscono conti bancari, telefoni, carte SIM e account sui social media e portali di lavoro.

Su GitHub sono stati scoperti centinaia di profili e portfolio falsi di falsi professionisti IT nordcoreani.Il mese scorso, Microsoft ha scoperto un archivio pubblico collegato a queste operazioni. L’archivio conteneva curriculum, e-mail, dati di account VPS e VPN, e vari tutorial. Erano presenti anche informazioni su portafogli, account (LinkedIn, GitHub, Upwork, TeamViewer, Telegram, Skype) e persino buste paga.
Profili falsi di specialisti nordcoreani

Microsoft ha ribadito un fenomeno già segnalato. I falsi specialisti IT usano dati personali rubati per candidarsi. Aggiungono foto rubate ai documenti. Utilizzano strumenti di intelligenza artificiale per creare curriculum e moduli di domanda.Inoltre, i ricercatori avvertono che gli aggressori utilizzano attivamente programmi per cambiare la voce.

“Anche se non abbiamo rilevato aggressori che utilizzano la tattica del cambio della voce e del video attraverso l’intelligenza artificiale, è sicuro che in futuro tali strumenti verranno utilizzati per poter ingannare le aziende”, avverte Microsoft.

L'articolo Impiegati Infedeli 2.0: Quando il Tecnico IT Usa ha quel Certo Accento Nordcoreano proviene da il blog della sicurezza informatica.