PODCAST. All’Onu la via alternativa della Cina a Trump
@Notizie dall'Italia e dal mondo
Pechino si candida a guidare il sud del mondo e propone le sue iniziative globali. La Cina promette di ridurre le emissioni di gas serra mentre Trump nega la crisi climatica
L'articolo PODCAST. pagineesteri.it/2025/09/26/med…
Attacco ransomware agli aeroporti europei: Berlino ancora in “modalità di emergenza”
L’aeroporto di Berlino (BER) resta in “modalità di emergenza” il quinto giorno dopo il grave attacco informatico alla supply chain. Ne parla lo Spiegel in un aggiornamento di ieri.
Il fornitore di servizi IT Collins Aerospace, una filiale della società statunitense RTX, è stato vittima di un attacco informatico venerdì della scorsa settimana. L’attacco hacker ha paralizzato i sistemi elettronici utilizzati per la gestione dei passeggeri e dei bagagli.
Secondo un portavoce dell’aeroporto, il BER è ancora in “modalità di emergenza” diversi giorni dopo l’attacco informatico al suo sistema informatico. Il sistema di gestione passeggeri e bagagli, paralizzato, rimane inattivo.
Ha sottolineato che giovedì 25 settembre si sono nuovamente registrati diversi ritardi e sono stati cancellati tre voli. Mercoledì, invece, sono stati cancellati 12 voli. I vigili del fuoco e il personale di terra continuano a fornire assistenza per lo smistamento dei bagagli.
Come abbiamo riportato su queste pagine, un massiccio attacco informatico ha scosso diversi aeroporti europei sabato 20 settembre. La mattina del 22 settembre, l’aeroporto di Bruxelles ha chiesto alle compagnie aeree di cancellare metà delle partenze programmate per quel giorno.
Non è ancora stato reso noto chi è la cyber gang dietro l’attacco informatico al gestore dei check-in. Lo stesso giorno in cui gli aeroporti sono stati colpiti da un attacco informatico, l’aeroporto di Dublino è stato evacuato a causa di quella che sembrava una falsa minaccia di bomba.
L’Agenzia dell’Unione europea per la sicurezza informatica (ENISA) ha successivamente affermato che i disagi negli aeroporti che hanno interessato i sistemi di check-in automatico nei giorni scorsi sono stati causati da un attacco ransomware.
L'articolo Attacco ransomware agli aeroporti europei: Berlino ancora in “modalità di emergenza” proviene da il blog della sicurezza informatica.
Commodore 64: Dal mito degli anni ’80 al 2025! Vendute 10.000 nuove console
Commodore Corporation BV è stata recentemente acquisita da fan ed ex dipendenti. Ora, il nuovo marchio Commodore ha annunciato un traguardo significativo: il primo computer Commodore 64 Ultimate in 30 anni ha superato le 10.000 unità vendute.
L’account X ufficiale dell’azienda ha pubblicato i dati di vendita e ringraziato la community per il supporto. Come mostra il grafico pubblicato, le vendite sono iniziate in modo molto attivo il 12 luglio di quest’anno.
Da agosto, il trend è stato più uniforme, ma stabile. La cronologia mostra anche le date di uscita della trilogia video “Let’s Buy Commodore”, che ha ottenuto centinaia di migliaia di visualizzazioni (un episodio ha superato le 400.000 visualizzazioni). Il management dell’azienda ha monitorato attentamente l’impatto della campagna video sulle vendite.
Nella prima settimana dopo il lancio del nuovo prodotto, Commodore raccolse oltre 2 milioni di dollari. Ciò coincise con la pubblicazione del video “Making History: Signing the Commodore Contract + C64 Ultimate Production Update”, che vide un ulteriore incremento delle vendite. Fu allora che molti si resero conto che l’azienda era davvero in via di guarigione.
Subito dopo il traguardo delle 10.000 unità vendute, Commodore ha ricordato a tutti che c’è ancora tempo per preordinare il primo lotto tramite commodore.net ed essere tra i primi acquirenti quest’anno.
Il Commodore 64 Ultimate, basato su una piattaforma FPGA e dotato della “prima scheda madre con tastiera trasparente al mondo”, ha un prezzo di partenza di 299 dollari. È stato anche precisato che la Founders Edition sarà un’edizione unica.
Non è ancora stato annunciato un sostituto per chi se l’è perso, ma è previsto un modello simile.
youtube.com/embed/S2fGP59mJ5M?…
Anche se non avete intenzione di immergervi in una versione moderna dell’iconico C64, questa notizia merita di essere accolta positivamente. Commodore si sta posizionando come Founder’s Sandbox, una piattaforma per nuovi progetti informatici. La roadmap dell’azienda prevede fino a 12 importanti release nei prossimi quattro anni, il che ha già incuriosito la comunità degli appassionati di tecnologia retrò e moderna.
Le vendite del Commodore 64 Ultimate hanno superato le 10.000 unità, dimostrando che l’interesse per i computer retrò rimane forte e che il marchio rilanciato è in grado non solo di attingere alla nostalgia, ma anche di diventare una forza trainante per nuovi progetti tecnologici.
Il Commodore 64 originale (noto anche come C64) fu lanciato nel gennaio 1982 e divenne rapidamente il computer domestico più popolare dell’epoca. Il computer era dotato di un processore MOS Technology 6510/8500 a 8 bit con frequenza di 1,023 MHz nella versione NTSC e 0,985 MHz nella versione PAL.
Oltre a 64 KB di RAM, erano disponibili 20 KB di memoria di sola lettura, incluso un interprete BASIC. Inoltre, il dispositivo offriva supporto hardware per grafica a colori e audio. Il chip grafico VIC-II supportava una risoluzione di 320×200 pixel, 16 colori e sprite hardware. Il tutto era completato da interfacce per joystick, porte video/audio, uno slot per cartucce ROM e una porta seriale IEEE-488 (per unità disco o stampanti).
L'articolo Commodore 64: Dal mito degli anni ’80 al 2025! Vendute 10.000 nuove console proviene da il blog della sicurezza informatica.
noyb WIN: L'autorità austriaca vieta il credit scoring illegale di KSV1870 noyb ha ottenuto una vittoria nel suo procedimento di reclamo contro l'agenzia austriaca di informazioni creditizie KSV1870 e il fornitore di energia Unsere Wasserkraft mickey26 September 2025
Vertical Solar Panels are Out Standing
If you’re mounting solar panels, everybody knows the drill, right? Point them south, angled according to latitude. It’s easy. In a video which demonstrates that [Everyday Dave] is truly out standing in his field, we hear a different story. [Dave] has a year’s worth of data in his Solar Panel Showdown that suggests there are good reasons to mount your panels vertically.
Specifically, [Dave] is using bifacial solar panels– panels that have cells on both sides. In his preferred orientation, one side faces South, while the other faces North. [Dave] is in the Northern Hemisphere, so those of you Down Under would have to do the opposite, pointing one face North and the other South.
Since [Dave] is far from the equator, the N/S vertical orientation beats the pants off of East-West facing panels, especially in winter. What’s interesting is how much better the bifacial panels do compared to the “standard” tilted orientation. While peak power in the summer is much better with the tilted bifacial panels (indeed, even the tilted single-sided panels), in winter the vertical N/S panels blow them out of the water. (Especially when snow gets involved. Vertical panels don’t need sweeping!)
Even in the summer, though, there are advantages: the N/S panels may produce less power overall, but they give a trickle earlier and later in the day than the tilted orientation. Still, that extra peak power really shows, and over a six-month period from solstice-to-solstice, the vertical panels only produced 77% what the tilted bifacial panels did (while tilted single-sided panels produced 90%).
Is it worth it? That depends on your use case. If most of the power is going to A/C, you’ll need the extra in the warmer months. In that case, you want to tilt the panels. If you have a steady, predictable load, though, having even production winter/summer might be more to your liking– in that case you can join [Dave] in sticking solar panels straight up and down.
These results probably apply at latitudes similar to [Dave] who is in cloudy and snowy Ohio, which is perhaps not the ideal place for solar experimentation. If you’re not an Ohio-like distance from the equator, you might find an East-West array is the best bang for the buck. Of course if you really want to max out power from each individual cell, you can’t beat sun tracking regardless of where you are.
youtube.com/embed/I-Fz5T5c0OQ?…
Despite walk back, Pentagon access policy is unconstitutional nonsense
The Pentagon faced bipartisan backlash for its ridiculous policy requiring journalists to agree not to obtain or report “unauthorized” information. Now, in a response to an inquiry from the Reporters Committee for Freedom of the Press, officials are trying to walk it back.
They claim the rules were intended to restrict Pentagon staffers from giving unauthorized information to journalists, not to restrict journalists from printing “unsolicited” tips they’re given. We’re not buying it. We commend RCFP for getting the Pentagon to elaborate on the policy — but, despite lots of legalese and doublespeak, its clarifications are mostly meaningless.
As an initial matter, a policy solely aimed at government employees would not need to be distributed to or acknowledged by journalists. To the extent that the government is permitted to keep information secret, the Supreme Court says that’s the government’s responsibility — officials aren’t entitled to shift the burden to reporters to keep their secrets for them. Even crediting the Pentagon’s explanation, the memo was clearly intended to do exactly that. It sends a message to the press, and that message is “tread carefully.”
Nor can the government restrict the press to publishing unsolicited tips. News doesn’t fall from the sky into reporters’ laps. Reporters are entitled to ask questions, cultivate sources, and seek out news (otherwise known as reporting), as long as they don’t break the law in doing so. That’s the job description — they’re journalists, not stenographers.
Journalists should not agree to this ridiculous policy in exchange for … what, exactly? The honor of being lied to at news conferences?
The Pentagon’s position seems to draw from the Supreme Court case Bartnicki v. Vopper, which held that journalists can obtain information given to them by sources that obtained it illegally as long as the journalists didn’t themselves participate in the illegality. By soliciting information from sources, the Pentagon’s reasoning apparently goes, journalists participate in the sources’ violations of Pentagon policy.
But nothing in Bartnicki limits constitutional protection to unsolicited information — the only exception it acknowledges is when journalists participate in a source’s illegal acts (in that case, an unlawful wiretap). There is no analogous underlying illegality here.
The whole purpose of the First Amendment is so that the government can’t stop journalists from publishing what the government does not want published. We wouldn’t need a constitutional right to publish what the government authorizes to be released — the government would have no reason to try to prevent that.
That’s the fundamental point that seems entirely lost on this administration. The press exists to hold it accountable, not to keep its secrets or do its bidding.
The other point Pentagon officials are missing – as their response to RCFP makes clear — is that they’re not entitled to scream “national security” like magic words when they want the First Amendment to disappear. The response, disturbingly, reserves the right for the administration to unilaterally deem reporting a national security danger after the fact and punish reporters for it.
But as the Pentagon Papers case made extremely clear, that’s not how it works: “The word ‘security’ is a broad, vague generality whose contours should not be invoked to abrogate the fundamental law embodied in the First Amendment.” And that was a case involving a specific set of documents alleged to pose a threat — not a vague reservation of rights to declare hypothetical documents a threat.
And this administration is guaranteed not to invoke “national security” responsibly. It has claimed the right to deport journalists, activists, and op-ed writers who disagree with, or merely report or comment on its policies. The president has said that when officials want a journalist to give up sources, they can just “tell the reporter, ‘National security’.”
The Trump administration considers anything that threatens to harm its reputation or expose its lies a threat to national security. It considers the First Amendment and free press themselves threats to national security.
The Pentagon is essentially shifting its position from, “You can’t report anything we didn’t authorize you to report” to “You can’t report anything we didn’t authorize you to report unless we decide after the fact in our sole discretion that it’s OK.” That should not provide much comfort to journalists. They certainly should not agree to this ridiculous policy in exchange for … what, exactly? The honor of being lied to at news conferences?
Andrea reshared this.
Hovercraft Suitcase Gives Your Luggage a Smooth Ride
The wheels on roller suitcases are one of their primary failure points. After the destruction of the wheel mount on her DIY suitcase, [Laura Kampf] wondered if it would be better to dispense with wheels altogether.
To give her suitcase a lift, [Kampf] decided to turn it into a hovercraft so it couldn’t be stopped by pavement or puddles. The first task was finding an appropriate fan, and a compact leaf blower donated it’s body to makerdom for the project. After reducing the blower to it’s constituent components and finding a secret turbo switch, work began on the momentum curtain.
“Nose-holing” the arrangement and size of the holes to pipe air through the stapled tarp and tape skirt seemed to be the bulk of the trial-and-error in this one. Based on other hovercraft designs [Kampf] found, keeping the holes near the center of the inflated portion gave better lift. In the end, the carry-on is able to lift a decent amount even on its lowest setting, resulting in a suitcase that is “not embarrassing” for travel. No word yet on what TSA thinks.
If you’re looking for another unexpected lift off, how about a full-sized flying Delorean replica? We’ve also covered some of the reasons why we don’t see more of these all terrain wonders.
youtube.com/embed/dbtdgSodOpw?…
Direttiva anti-SLAPP: Parlamento recepisca la normativa nel provvedimento in esame alla Camera
@Giornalismo e disordine informativo
articolo21.org/2025/09/diretti…
Il presidente del Consiglio nazionale dell’Ordine dei giornalisti Carlo Bartoli è stato
50 anni dal “massacro” del Circeo. Latina non dimentica
@Giornalismo e disordine informativo
articolo21.org/2025/09/50-anni…
La fine di settembre 1975 e l’estate del 1976 rappresentano due date storiche che hanno segnato profondamente la storia del femminismo a Latina e la storia della nostra Associazione, oltre che mutare anche a
Una panchina per Mario Paciolla. 26 settembre, Imola
@Giornalismo e disordine informativo
articolo21.org/2025/09/una-pan…
Venerdì 26 settembre alle ore 17.00, nel Giardino “Europa Unita” nel quartiere Zolino, ingresso da via Gualandi, si terrà l’iniziativa “Una panchina per Mario”, un momento di memoria e riflessione per ricordare Mario
Rostagno, e quel pensiero vero di libertà
@Giornalismo e disordine informativo
articolo21.org/2025/09/rostagn…
“A cui’ apparteni chisto? A Trapani questo interrogativo è ricorrente, soprattutto quando davanti c’è chi mostra di poter avere un certo credito, una determinata presa, capace di attirare attenzione. Per forza deve avere un’appartenenza, una
Tube Furnace is the Real Hotness
We aren’t sure what [theglassman] is working on, but based on his recent projects, we think it is probably something interesting. He’s been decapping ICs, growing oxide on silicon substrates, and has built a tube furnace capable of reaching 1200 °C.
What would you do with something that can melt cast iron? We aren’t sure, but maybe you’ll tell us in the comments. We do have a fair idea of what [theglassman] is doing, though.
The core of the oven is a quartz tube. Insulation is via refractory cement and alumina ceramic wool. The heating itself is classic Nichrome wire and a tiny thermocouple. The real key, though, is to the proper controller. [theglassman] suggests a ramp/soak controller. These allow you to program sequences that heat up and then stop, which, if done properly, can prevent your fragile quartz tube from cracking.
Naturally, you need the tube furnace to grow oxides on silicon. It is less clear why he’s decapping ICs. We were nervous about his process of boiling down sulfuric acid (fuming nitrate works better, anyway, if you just want to remove the epoxy). If you want to remove everything like he does, sodium hydroxide will also work well.
Obviously, we need to keep an eye on [theglassman]. We are curious what he’s working towards. Maybe making a custom transistor? Or, dare we hope, a homemade IC?
Regulation works again - if you run Windows 10 in Europe, you will keep receiving extended security updates for free. No need to enable Windows Backup or jump through hoops. October 2025 isn't the end.theverge.com/news/785544/micro…
Microsoft forced to make Windows 10 extended security updates truly free in Europe
You won’t have to enable Windows Backup to get extended Windows 10 security updates in the European Economic Area.Tom Warren (The Verge)
Parioli, proteste per la nuova ciclovia
Servizio di Roberto Abela e Marco Bertolini
L'articolo Parioli, proteste per la nuova ciclovia su Lumsanews.
freezonemagazine.com/news/prim…
Con The Cure, Doja Cat, The xx, Gorillaz, Massive Attack, Addison Rae e My Bloody Valentine Mac DeMarco, Pinkpantheress, Skrillex, Peggy Gou, Lola Young, Father John Misty, Ethel Cain, Bad Gyal, Big Thief, Wet Leg, Little Simz, Slowdive, Kneecap, Alex G, Dijon e Blood Orange nella lista dei 150 nomi rivelati oggi. Una costellazione di artisti […]
L'articolo
Hey Fifa! Parliamone. Eye on palestine
Eye On Palestine
Hey Fifa, why is Israel still participating in the World Cup while they starve Palestinian children? You said that you aren't political, and yet you banned Russia just 4 days after they invaded Ukraine.Telegram
Moderators reversed course on its open door AI policy after fans filled the subreddit with AI-generated Dale Cooper slop.#davidlynch #AISlop #News
Pissed-off Fans Flooded the Twin Peaks Reddit With AI Slop To Protest Its AI Policies
People on r/twinpeaks flooded the subreddit with AI slop images of FBI agent Dale Cooper and ChatGPT generated scripts after the community’s moderators opened the door to posting AI art. The tide of terrible Twin Peaks related slop lasted for about two days before the subreddit’s mods broke, reversed their decision, and deleted the AI generated content.Twin Peaks is a moody TV show that first aired in the 1990s and was followed by a third season in 2017. It’s the work of surrealist auteur David Lynch, influenced lots of TV shows and video games that came after and has a passionate fan base that still shares theories and art to this day. Lynch died earlier this year and since his passing he’s become a talking point for pro-AI art people who point to several interviews and second hand stories they claim show Lynch had embraced an AI-generated slop future.
On Tuesday, a mod posted a long announcement that opened the doors to AI on the sub. In a now deleted post titled “Ai Generated Content On r/twinpeaks,” the moderator outlined the position that the sub was a place for everyone to share memes, theories, and “anything remotely creative as long as it has a loose string to the show or its case or its themes. Ai generated content is included in all of this.”
The post went further. “We are aware of how Ai ‘art’ and Ai generated content can hurt real artists,” the post said. “Unfortunately, this is just the reality of the world we live in today. At this point I don’t think anything can stop the Ai train from coming, it’s here and this is only the beginning. Ai content is becoming harder and harder to identify.”
The mod then asked Redditors to follow an honor system and label any post that used AI with a special new flair so people could filter out those posts if they didn’t want to see them. “We feel this is a best of both worlds compromise that should keep everyone fairly happy,” the mod said.
An honor system, a flair, and a filter did not mollify the community. In the following 48 hours Lynch fans expressed their displeasure by showing r/twinpeaks what it looks like when no one can “stop the Ai train from coming.” They filled the subreddit with AI-generated slop in protest, including horrifying pictures of series protagonist Cooper doing an end-zone dance on a football field while Laura Palmer screamed in the sky and more than a few awful ChatGPT generated scripts.
Image via r/twinpeaks.
Free-IDK-Chicken, a former mod of r/twinpeaks who resigned over the AI debacle, said the post wasn’t run by other members of the mod team. “It was poorly worded. A bad take on a bad stance and it blew up in their face,” she told 404 Media. “It spiraled because it was condescending and basically told the community--we don’t care that it’s theft, that it’s unethical, we’ll just flair it so you can filter it out…they missed the point that AI art steals from legit artists and damages the environment.”According to Free-IDK-Chicken, the subreddit’s mods had been fighting over whether or not to ban AI art for months. “I tried five months ago to get AI banned and was outvoted. I tried again last month and was outvoted again,” she said.
On Thursday morning, with the subreddit buried in AI slop, the mods of r/twinpeaks relented, banned AI art, and cleaned up the protest spam. “After much thought and deliberation about the response to yesterday's events, the TP Mod Team has made the decision to reverse their previous statement on the posting of AI content in our community,” the mods said in a post announcing the new policy. “Going forward, posts including generative AI art or ChatGPT-style content are disallowed in this subreddit. This includes posting AI google search results as they frequently contain misinformation.”
Lynch has become a mascot for pro AI boosters. An image on a pro-AI art subreddit depicts Lynch wearing an OpenAI shirt and pointing at the viewer. “You can’t be punk and also be anti-AI, AI-phobic, or an AI denier. It’s impossible!” reads a sign next to the AI-generated picture of the director.
Image via r/slopcorecirclejerk
As evidence, they point to aBritish Film Institute interview published shortly before his death where he lauds AI and calls it “incredible as a tool for creativity and for machines to help creativity.” AI boosters often leave off the second part of the quote. “I’m sure with all these things, if money is the bottom line, there’d be a lot of sadness, and despair and horror. But I’m hoping better times are coming,” Lynch said.Image via r/slopcorecirclejerk
The other big piece of evidence people use to claim Lynch was pro-AI is a secondhand account given to Vulture by his neighbor, the actress Natasha Lyonne. According to the interview in Vulture, Lyonne asked Lynch for his thoughts on AI and Lynch picked up a pencil and told her that everyone has access to it and to a phone. “It’s how you use the pencil. You see?” He said.Setting aside the environmental and ethical arguments against AI-generated art, if AI is a “pencil,” most of what people make with it is unpleasant slop. Grotesque nonsense fills our social media feeds and AI-generated Jedis and Ghiblis have become the aesthetic of fascism.
We've seen other platforms and communities struggle with keeping AI art at bay when they've allowed it to exist alongside human-made content. On Facebook, Instagram, and Youtube, low-effort garbage is flooding online spaces and pushing productive human conversation to the margins, while floating to the top of engagement algorithms.
Other artist communities are pushing back against AI art in their own ways: Earlier this month, DragonCon organizers ejected a vendor for displaying AI-generated artwork. Artists’ portfolio platform ArtStation banned AI-generated content in 2022. And earlier this year, artists protested the first-ever AI art auction at Christie’s.
Artists Are Revolting Against AI Art on ArtStation
Artists are fed up with AI art on the portfolio platform, which is owned by Epic Games, but the company isn't backing down.Chloe Xiang (VICE)
Breaking News Channel reshared this.
Due bug critici in Cisco ASA e FTD: score 9.9 e rischio esecuzione di codice remoto
Cisco ha reso note due vulnerabilità critiche che interessano i propri firewall Secure Firewall Adaptive Security Appliance (ASA) e Secure Firewall Threat Defense (FTD), oltre ad altri prodotti di rete. Entrambe le falle consentono l’esecuzione di codice arbitrario e potrebbero portare al completo compromesso dei dispositivi coinvolti.
CVE-2025-20363 (Score 9,0)
La prima vulnerabilità, identificata come CVE-2025-20363 e con punteggio CVSS 9.0 (critico), riguarda i servizi web di:
- Cisco Secure Firewall ASA Software
- Cisco Secure Firewall FTD Software
- Cisco IOS Software
- Cisco IOS XE Software
- Cisco IOS XR Software
Nel caso dei firewall ASA e FTD, la falla può essere sfruttata da un attaccante remoto non autenticato. Per le piattaforme IOS, IOS XE e IOS XR è invece necessario disporre di credenziali a basso livello di privilegio.
L’origine del problema risiede nella gestione non corretta degli input nelle richieste HTTP. Un aggressore può inviare pacchetti manipolati verso i servizi web esposti da un dispositivo vulnerabile, ottenendo la possibilità di eseguire codice arbitrario con privilegi root. Una compromissione di questo tipo può determinare il controllo totale del sistema.
CVE-2025-20333 (Score 9,9)
La seconda falla, già entrata all’interno del catalogo del CISA KEV, catalogata come CVE-2025-20333, ha un punteggio ancora più elevato: CVSS 9.9 (critico). Colpisce esclusivamente i firewall ASA e FTD quando è attivo il server VPN web.
Il difetto, anche in questo caso dovuto alla mancata validazione degli input in richieste HTTP(S), può essere sfruttato da un attaccante remoto in possesso di credenziali VPN valide. L’esito di un attacco riuscito è identico al precedente: esecuzione di codice arbitrario come utente root e potenziale compromissione completa del dispositivo.
Advisory Cisco e raccomandazioni
Cisco ha pubblicato due security advisory ufficiale relativo alla vulnerabilità CVE-2025-20333 e per la CVE-2025-20363. Il Cisco Product Security Incident Response Team (PSIRT) ha segnalato di essere già a conoscenza di tentativi di sfruttamento attivo della vulnerabilità legata al server VPN. Per questo motivo, l’azienda ribadisce l’urgenza di applicare gli aggiornamenti.
La vulnerabilità è stata individuata durante la risoluzione di un caso di supporto tecnico Cisco TAC, con il contributo di diverse agenzie di sicurezza, tra cui:
- Australian Signals Directorate – Australian Cyber Security Centre
- Canadian Centre for Cyber Security
- UK National Cyber Security Centre (NCSC)
- U.S. Cybersecurity & Infrastructure Security Agency (CISA)
Per verificare se un determinato dispositivo è vulnerabile, Cisco mette a disposizione il Cisco Software Checker, che consente di:
- Identificare gli advisory che interessano una specifica release.
- Individuare la prima versione software che corregge il problema.
- Determinare la release che risolve tutte le vulnerabilità note.
Conclusioni
Le vulnerabilità CVE-2025-20363 e CVE-2025-20333 rappresentano rischi significativi per l’infrastruttura di rete aziendale. La possibilità di eseguire codice arbitrario come root rende i dispositivi interessati particolarmente esposti a compromissioni complete.
Cisco invita pertanto i clienti ad aggiornare senza ritardi i firewall ASA e FTD, seguendo le indicazioni riportate nell’advisory ufficiale disponibile al link:
L'articolo Due bug critici in Cisco ASA e FTD: score 9.9 e rischio esecuzione di codice remoto proviene da il blog della sicurezza informatica.
Surprisingly Refined Perpetual Motion Device Teardown
Perpetual motion devices are either a gag, a scam, or as in the case of this particular toy that [Big Clive] bought on AliExpress, a rather fascinating demonstration of a contact-free inductive sensor combined with a pulsed magnet boost for the metal ball. A cool part about the device is that it comes with a completely clear enclosure, so you can admire its internals while it’s operating. Less cool was that after unboxing the device wasn’t working as the detector wasn’t getting the 12 V it needs to operate, requiring a bit of repairing first.
Based on the label on the bottom of the device with the creative model identifier P-toy-002, its standby current is 10 µA which ramps up to 3 A when it’s operating. This makes sense when you look at the two core components: the industrial inductive detector, and a rather big electromagnet that’s driven by a bank of three 10 mF, 35V capacitors, turning it into something akin to a coilgun. Annoyingly, an attempt was made to erase most of the IC package markings.
The circuitry isn’t too complex, fortunately, with an adjustable electromagnet coil voltage circuit combined with a MOSFET to provide the pulse, and a 78L12 regulator to generate the 12 VDC from the coil’s voltage rail for the sensor that is monitored by a MCU.
youtube.com/embed/0mpxdDQHYDQ?…
The tech the Secret Service claims can be used to "disable cell phone towers" is very commonly used by ticket scalpers to game Ticketmaster.#SIMFarm #SIMBank #Tickets #TicketScalping #Ticketmaster
The SIM Farm Hardware Seized by the Secret Service Is Also Popular With Ticket Scalpers
Subscribe
Join the newsletter to get the latest updates.
Success
Great! Check your inbox and click the link.
Error
Please enter a valid email address.
Tuesday, the Secret Service said it “dismantled a network” of “300 co-located SIM servers and 100,000 SIM cards across multiple sites.” The Secret Service suggested that this network posed a threat to the United Nations General Assembly meeting, which was “within 35 miles” of the servers and which it said could have been used to “disable cell phone towers.” The story quickly went viral, with the New York Times and CNN’s reports being widely shared and discussed.
CNN reported that the SIM servers were used in swatting calls against members of Congress, and the New York Times quoted an expert who said that they believed the servers could be used for espionage. As security researcher Robert Graham points out in a post called “That Secret Service SIM farm story is bogus—it’s just normal crime,” the Secret Service has not yet released any actual evidence of what the SIM servers were used for and it is unclear how such a setup could be used for “espionage.” Graham notes that, based on photos released by the Secret Service and its description of the operations, claims that such a network could have only been created by a sophisticated nation state actor are particularly ridiculous: “I can pull this off, personally. It’s just a SIM farm. Sure, there’s some capital involved, on the order of $1 million, but it could be setup and managed by a single person. It likely wasn’t setup all at once with that much money, but has been slowly growing for years as profits are funneled back into setting up more SIM accounts,” he wrote.
The discovery of a bunch of SIM banks (also called SIM farms, SMS gateways, and several other things) anywhere is interesting from a spam / cybercrime perspective, and they give a type of cyberpunk visual that, frankly, is extremely my shit. But the breathless way this bust has been announced—with a special video announcement by Secret Service director Sean Curran and a clearly embargoed rollout with the New York Times and CNN, makes these SIM farms seem as though they are particularly special and high tech, when they clearly are not. The technology used, which can be seen clearly in photos released by the Secret Service, are regularly used by SMS scammers, spammers, and marketers, yes, but the tech is also extremely widely used by ticket scalpers seeking to create lots of Ticketmaster accounts with which to buy tickets. This is off-the-shelf technology that anyone can buy and use; if one had enough money, one could surely buy 300 of them from Ejointech, the Chinese company that makes them, and set something like this up.
I have been familiar with and meaning to write about SIM banks for a few months now, specifically because they have become popular with ticket scalpers. Like many “anti-scalping” and anti-fraud measures taken by Ticketmaster, relatively recent updates that require SMS verification to create a new Ticketmaster account and immediately before buying tickets hasn’t actually stopped scalping. Instead, it has created a new underground market for tools that make SMS authentication at bulk easier. By adding this barrier to entry, Ticketmaster has ensured that normal fans have one single attempt to buy tickets, while motivated ticket scalpers with specialized tech can have many attempts at buying tickets.This SMS verification system has created a new underground market for various technologies and software that lets scalpers game this SMS verification system. SIM boxes are such an important part of that new underground market that Ejointech now advertises one of its products—which looks very much like the models shown in the Secret Service’s images from the seized servers in New York—as specifically being good “for ticketing & bulk SMS.”
“Popular model: used by 5,000+ leading ticket brokers globally & trusted for thousands of large-scale SMS campaigns!,” Ejointech advertises on the $3,730 Ejoin 256 SIM 4G LTE SMS Gateway. On TikTok, it advertises a similar, 512 SIM card model as having “human behavior,” “cloud management,” and “auto SIM card switch.”
“Ticket brokers, streamline your Ticketmaster operations with EjoinTech! Our SMS gateway devices support up to 512 SIM cards, ensuring you never miss a verification code,” the company says. “Designed for efficiency with no unnecessary noise.”
youtube.com/embed/BZnrXxt47Qw?…
There is of course no evidence that the SIM boxes seized by the Secret Service this week were used by ticket scalpers, but there’s also no public evidence released by the Secret Service that suggests they were going to try to disrupt the UN General Council’s meeting. The point I’m making is that these devices and these types of farms have become somewhat common in recent years, and they are used not just to send messages in bulk but to receive them in bulk, too. They are used not just for crimes, but for various grey market and controversial, but not necessarily illegal, purposes too.“Proxies” and real SIM cards that can receive SMS messages have become critical to the ticket scalping industry. The way ticket scalping works now is that big time brokers will create many (hundreds or thousands) of unique Ticketmaster accounts, each associated with their own phone number. These are sometimes made using prepaid or low-cost wireless carriers like MobileX, whose SIM cards appeared in bulk in Secret Service materials.
Not every big time broker is going to want to roll their own SIM bank, so a series of companies have popped up that offer “proxies,” which just means that they are basically a company running and selling access to phone numbers, keeping them online, and forwarding SMS codes directly to the ticket broker buying them. These companies do not advertise what specific hardware they are using to do this, but SIM boxes could easily be used to do this, and the scale of farm that the Secret Service found is not particularly large considering these types of services exist. They go by names like “WiredSMS,” “TextChest,” “Quick-Text,” “SMSPass,” and “Jivetel,” among others. TextChest advertises “industry-leading physical SIM lines, trusted by thousands.” A company called Seat Heroes notes that it is “carrier compliant” and that “while others rely on risky, unauthorized setups, Seat Heroes runs on the first ever Tier 1 carrier-integrated infrastructure—no modems, no VOIP, just proprietary and exclusive access to genuine numbers—always on, 24/7” and “no SIM banks—just direct connections.”
In practice, ticket brokers connect their proxies—either bought from a third party or rolled by themselves—to other bespoke ticketing-buying software that helps them actually manage tons of Ticketmaster accounts and tons of phone numbers at once. There are a host of ticket broker-specific internet browsers that allow brokers to open hundreds or thousands of browser tabs, which each have a browsing session tied to either a specific SIM card or to an IP proxy which can also be bought from third-party services. This allows brokers to power through Ticketmaster’s “Virtual Waiting Rooms” because a broker can have hundreds or thousands of independent browser sessions waiting as separate “people.” The SIM box (or a SIM proxy service) can then be set up in these bespoke browsers to automatically forward and submit Ticketmaster’s SMS two-factor authentication, which is supposedly designed to prevent scalpers from getting tickets.At one point, Private Tabs, one of the bespoke browsers for ticket scalpers, was advertising a “SIMBOX HARDWARE ADD-ON,” which could “add 512 phone numbers for $3 per line.”
“These hardware devices allow you to add 512 phone numbers to your Private Tabs account,” an archived version of the Private Tabs website reads. “If you already have one, then you can just add it to the config or call us, and we’ll set it up for ya. This ensures that every account you load in has its dedicated number. Rather than paying $9 to $24 per phone number, you can purchase one of these devices and get a phone line for as little as $3 per number. Typically, they pay for themselves within 2 months since each device can hold 512 numbers. With this device you do not need ‘TextChest’ or ‘Private Tab Phones’ [a proxy service] as you can host your own numbers for half the cost.”
The Private Tabs web browser no longer advertises SIM boxes, and in a FAQ on its current website, it says says people using their own telecom hardware may run into problems: "There have been recent reports as of 9/5/2025 that some people using Chinese hardware is a problem. You may want to contact your phone company before trying to integrate it with the API to confirm it works ok."
Ticketmaster Used Revolving Barcodes to Control Ticket Resale Market and Surveil Customers, DOJ Alleges
"We now not only know the person that bought the ticket, but we’re going to know those three people that you are taking to the show, which we have not known historically."Jason Koebler (404 Media)
Ministero dell'Istruzione
🎶 #Milano, questa sera a partire dalle ore 19.30, presso il Duomo, si svolgerà il terzo incontro del progetto “Uto Ughi per i Giovani”.Telegram
How Water Vapor Makes Smartphones Faster
Once upon a time, home computers were low-powered enough that they barely needed any cooling at all. An Amiga 500 didn’t even have a heatsink on the CPU, while the early Macintosh got by with a single teeny little fan.
Modern smartphones are far more powerful than these ancient machines, packed with multi-core processors running at speeds of many gigahertz. Even still, they’ve generally been able to get by without any active cooling devices. However, as manufacturers continue to push the envelope of performance, they’ve had to scramble for ways to suck heat out of these handheld computers. Vapor chamber cooling has risen as a solution to this problem, using simple physics to keep your handset humming along at maximum speed for longer.
Cool Runnings
Keeping a smartphone cool is a unique challenge compared to other computing devices. In a desktop or laptop computer, designers can rely on fans, heatsinks, and even water cooling loops with radiators to get heat out of a device. However, for a phone, these methods aren’t so practical. Any air vents would be quickly blocked by pocket lint, and even the slimmest fan or heatsink would add a huge amount of bulk, which is unacceptable for a handheld device.
Thus far, smartphones have largely avoided heating issues in two ways. Firstly, by using low-power chipsets that simply don’t generate a lot of heat in the first place. Secondly, by thermally coupling the main chips to metal heat spreaders and sometimes the smartphone’s external housing, to effectively create a simple heatsink. However, smartphones continue to grow more powerful, generating more heat during demanding tasks like recording high-resolution video. Thus, engineers have had to find new ways to dump greater amounts of heat without compromising the aesthetics and usability of their devices.
Enter vapor chamber cooling. Picture a sealed metal cavity built into a smartphone, inside which is a small amount of water-based coolant. The phone’s chipset is thermally coupled to the cavity, such that the heat is absorbed by the coolant inside. Thanks to the physical properties of water, notably its huge specific heat value, it’s able to absorb a great deal of heat energy, particularly as it passes through the phase-change regime as the fluid turns from a liquid into a gas. As it heats up and vaporizes, the coolant spreads to fill the entire cavity, spreading the heat into the whole thermal mass of the casing where it can be released into the surroundings. As heat is released, the vapor cools back into a liquid, and the cycle can begin again. The idea is exactly the same as is used in heat pipes—where a liquid is heated beyond its phase change point into a vapor, and used to spread heat to other areas of a sealed cavity.
The vapor chamber has benefits over traditional metal heatsinks. The liquid coolant is very effective at evaporating and spreading heat around the entire chamber, wicking heat away from hot chips more quickly. Traditional heatsinks can end up with a hotspot over individual chips, whereas the vapor chamber is more effective at distributing the heat over a wider area.
The intention behind this is to allow phones to run at maximum performance for longer. Whether you’re shooting video or playing a game, it’s no good if your phone has to start throttling clock rates to stay cool in the middle of a task. The vapor chamber simply helps engineers suck more heat out of a phone’s chipset and get rid of it faster.
One drawback is that vapor chambers are obviously far more complex to manufacture than traditional heatsinks. Rather than a flat metal heat spreader, you have a delicate chamber into which coolant must be injected, and then the chamber must be sealed. The coolant must be able to soak up a great deal of heat, as well as safely deal with many cycles of vaporization and condensation, without causing any corrosion or damage to the chamber in the process. The entire vapor chamber must be able to survive the rough-and-tumble life of a handheld device that’s stuffed into pockets and thrown into bags every day of its life.
Vapor chambers have been around for a while now, first showing up in the Galaxy S7 in 2016. They’ve gradually become more popular, though, and these days, you’ll find a vapor chamber in phones like the Google Pixel 9 Pro, the Samsung Galaxy S25+, and the Apple iPhone 17 Pro and Pro Max. They’re still largely the preserve of flagship devices, perhaps as much due to their high-tech appeal and higher cost than traditional cooling solutions. Still, as the smartphone arms race continues, and these parts become more common, expect the technology to trickle down to more humble models in the years to come.
Pentagon press restrictions are an affront to the First Amendment
FOR IMMEDIATE RELEASE:
The Washington Post reported today that officials plan to require Pentagon reporters to pledge not to gather or report any information that the government has not authorized for release, whether classified or unclassified. Violators risk having their press credentials revoked.
Freedom of the Press Foundation (FPF) Director of Advocacy Seth Stern issued the following statement:
“The Supreme Court has made clear for decades that journalists are entitled to lawfully obtain and publish government secrets. That is essentially the job description of an investigative journalist. The law is also clear that the government can’t require people to contract away a constitutional right, like the right to obtain and publish secrets, in exchange for a benefit, like access to government buildings or press credentials.“This policy operates as a prior restraint on publication, which is considered the most serious of First Amendment violations. As we learned in the Pentagon Papers case, the government cannot prohibit journalists from public information merely by claiming it’s a secret or even a national security threat. This is worse in a way, because the government isn’t only seeking to restrain specific documents it contends pose a unique threat, it’s seeking to restrain everything it doesn’t want the public to know. That is fundamentally un-American.
“In the meantime, journalists will need to decide whether they’re so dependent on physical access to the Pentagon that they’re willing to trade away their independence to retain it.
“I hope they won’t, and will find other ways to gather news. Agreeing not to look where the government doesn’t want you to look and, by extension, not to print what it doesn’t want you to print, is propaganda, not journalism. Caving to these kinds of demands would in some ways be the most outrageous capitulation yet, and there are plenty to choose from.
“Virtually every time this administration (and past ones) has tried to justify secrecy by claiming it’s protecting national security, its real agenda turned out to be saving itself from embarrassment or from having its lies exposed. There is no reason to think this is any different. Perhaps there are so many embarrassing documents at this point that it’s too difficult to keep finding bogus reasons to keep each of them secret. Maybe that’s why the administration is taking more of a wholesale approach to concealing records that may show wrongdoing, corruption, and incompetence.”
Please contact us if you would like further comment on the dangers this policy poses to press freedom in the United States.
ma quando mi trovo davanti a un tagliagole di Al Queda e dell'ISIS mi sciolgo tutta!
È uscito il nuovo numero di The Post Internazionale. Da oggi potete acquistare la copia digitale
@Politica interna, europea e internazionale
È uscito il nuovo numero di The Post Internazionale. Il magazine, disponibile già da ora nella versione digitale sulla nostra App, e da domani, venerdì 26 settembre, in tutte le edicole, propone ogni due settimane inchieste e approfondimenti sugli affari e il potere
Trapped Soul in Time for Halloween
While it is sort of disturbing, it is one of the best uses for a round LCD we’ve seen lately. What is it? Just [vishalsoniindia]’s SoulCage — a pendant that appears to have a poor soul trapped inside of it. Just in time for the upcoming spooky holiday. You can see the device in operation in the short video below.
The heart (sorry, unintentional pun) of the device is an ESP32-S3 round display. That means the rest of it is software, a battery, and a 3D printed case. There’s a switch, too, to select a male or female image as well as shut the device off when not in use.
In particular, a switch was added to put a regulator in shutdown mode, the USB to serial converter needed a change, and a battery level detection circuit was cut. When off, the device draws about one microamp, so battery life should be very long in storage. In operation, the 85 mA draw provides approximately 11 hours of use per full charge. Plenty of time for a holiday party.
Multiple Palantir and Flock sources say the companies are spinning a commitment to "democracy" to absolve them of responsibility. "In my eyes, it is the classic double speak," one said.#News
How Surveillance Firms Use ‘Democracy’ As a Cover for Serving ICE and Trump
In a blog post published in June, Garrett Langley, the CEO and co-founder of surveillance company Flock, said “We rely on the democratic process, on the individuals that the majority vote for to represent us, to determine what is and is not acceptable in cities and states.” The post explained that the company believes the laws of the country and individual states and municipalities, not the company, should determine the limits of what Flock’s technology can be used for, and came after 404 Media revealed local police were tapping into Flock’s networks of AI-enabled cameras for ICE, and that a sheriff in Texas performed a nationwide search for a woman who self-administered an abortion.💡
Do you work at any of these companies or others like them? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.Langley’s statement echoes a common refrain surveillance and tech companies selling their products to Immigration and Customs Enforcement (ICE) or other parts of the U.S. government have said during the second Trump administration: we live in a democracy. It is not our job to decide how our powerful capabilities, which can track peoples’ physical location, marry usually disparate datasets together, or crush dissent, can or should be used. At least, that’s the thrust of the argument. That is despite the very clear reality that the first Trump administration was very different to the Biden administration, and both pale in comparison to Trump 2.0, with the executive branch and various agencies flaunting ordinary democratic values. The idea of what a democracy is capable of has shifted.
This post is for subscribers only
Become a member to get access to all content
Subscribe now
Breaking News Channel reshared this.
Spy Tech: The NRO and Apollo 11
When you think of “secret” agencies, you probably think of the CIA, the NSA, the KGB, or MI-5. But the real secret agencies are the ones you hardly ever hear of. One of those is the National Reconnaissance Office (NRO). Formed in 1960, the agency was totally secret until the early 1970s.
If you have heard of the NRO, you probably know they manage spy satellites and other resources that get shared among intelligence agencies. But did you know they played a major, but secret, part in the Apollo 11 recovery? Don’t forget, it was 1969, and the general public didn’t know anything about the shadowy agency.
Secret Hawaii
Captain Hank Brandli was an Air Force meteorologist assigned to the NRO in Hawaii. His job was to support the Air Force’s “Star Catchers.” That was the Air Force group tasked with catching film buckets dropped from the super-secret Corona spy satellites. The satellites had to drop film only when there was good weather.
In the 1960s, civilian weather forecasting was not as good as it is now. But Brandli had access to data from the NRO’s Defense Meteorological Satellite Program (DMSP), then known simply as “417”. The high-tech data let him estimate the weather accurately over the drop zones for five days, much better than any contemporary civilian meteorologist could do.
When Apollo 11 headed home, Captain Brandli ran the numbers and found there would be a major tropical storm over the drop zone, located at 10.6° north by 172.5° west, about halfway between Howland Island and Johnston Atoll, on July 24th. The storm was likely to be a “screaming eagle” storm rising to 50,000 feet over the ocean.
In the movies, of course, spaceships are tough and can land in bad weather. In real life, the high winds could rip the parachutes from the capsule, and the impact would probably have killed the crew.
What to Do?
With the clock ticking, Brandli started looking for an acceptable way to raise the alarm. The Navy was in charge of NASA weather forecasting, so the first stop was DoD chief weather officer Captain Sam Houston, Jr. He was unaware of Corona, but he knew about DMSP.
Brandli was able to show Houston the photos and convince him that there was a real danger. Houston reached out to Rear Admiral Donald Davis, commanding the Apollo 11 recovery mission. He just couldn’t tell the Admiral where he got the data. In fact, he couldn’t even show him the photos, because he wasn’t cleared for DMSP.
Career Gamble
The forecast was correct. There were severe thunderstorms at the original site, but Apollo 11 splashed down in a calm sea about 1.7 miles from the target, as you can see below. Houston received a Navy Commendation medal, although he wasn’t allowed to say what it was for until 1995.
In hindsight, NASA has said they were also already aware of the weather situation due to the Application Technology Satellite 1, launched in 1966. Although the weather was described as “suitable for splashdown”, mission planners say they had planned to move the landing anyway.
youtube.com/embed/iZKwuY6kyAY?…
Modern Times
Weather forecasting, too, has gotten better. Studies show that even in 1980, a seven-day forecast might be, at best, 45 or 50% accurate. Today, they are nearly 80%. Some of that is better imaging. Some of it is better models and methods, too, of course.
However, thanks to one — or maybe a few — meteorologists, the Apollo 11 crew returned safely to Earth to enjoy their ticker-tape parades. After, of course, their quarantine.
Linux balla la samba… ma cade in una race condition. Una falla critica minaccia il kernel
Il ricercatore Nicholas Zubrisky di Trend Research ha segnalato una vulnerabilità critica nel componente ksmbd delkernel Linux che consente ad aggressori remoti di eseguire codice arbitrario con i massimi privilegi di sistema. La vulnerabilità, identificata come CVE-2025-38561 ed interessa tutte le distribuzioni che utilizzano il server SMB integrato basato su ksmbd.
L’arresto anomalo era correlato alla gestione del campo Preauth_HashValue durante la creazione della sessione SMB2. Gli sviluppatori hanno commesso un errore di sincronizzazione dei thread: la mancanza di un blocco di accesso alla memoria creava una race condition quando più processi modificavano simultaneamente lo stesso oggetto. Ciò causava corruzione della memoria e cambio di thread, aprendo la strada all’esecuzione di codice arbitrario nello spazio kernel.
Per sfruttare questa vulnerabilità, un aggressore necessita di credenziali valide, ma ciò non riduce la gravità del rischio. Molte organizzazioni forniscono l’accesso ai servizi SMB sia su reti interne che esterne, il che significa che gli account possono essere dirottati o riutilizzati. Un attacco riuscito fornisce il controllo completo del sistema, inclusa la possibilità di installare malware e disabilitare l’infrastruttura.
La vulnerabilità è stata segnalata privatamente il 22 luglio 2025 e divulgata pubblicamente il 24 settembre, in seguito alla pubblicazione delle raccomandazioni del caso. Il problema ha ricevuto un punteggio CVSS di 8,5, che tiene conto del vettore di rete, del basso livello di privilegi richiesti e della mancanza di interazione da parte dell’utente.
La correzione è già inclusa nelle attuali versioni del kernel Linux: sono stati aggiunti meccanismi di blocco corretti per prevenire condizioni di competizione quando si utilizza Preauth_HashValue. Si consiglia agli amministratori di:
- identificare i nodi che eseguono versioni vulnerabili del kernel;
- installare immediatamente gli ultimi aggiornamenti dal ramo stabile o dai provider di distribuzione;
- riavviare le macchine per attivare le correzioni;
- Rivedere le regole per l’accesso ai servizi SMB e, se necessario, limitarle tramite la segmentazione della rete.
Si precisa che non esistono soluzioni temporanee o alternative: l’unico modo per risolvere il problema è aggiornare il kernel. Gli utenti di distribuzioni con supporto a lungo termine dovrebbero monitorare il proprio fornitore per verificare la disponibilità di aggiornamenti di sicurezza.
Nicholas Zubrisky ha già ricevuto riconoscimenti per la sua divulgazione responsabile della vulnerabilità e la comunità Linux sottolinea che una risposta tempestiva da parte dell’amministratore è fondamentale per proteggere gli ambienti aziendali e i server di archiviazione.
L'articolo Linux balla la samba… ma cade in una race condition. Una falla critica minaccia il kernel proviene da il blog della sicurezza informatica.
Hanno dormito nelle reti per 393 giorni! Gli hacker statali cinesi e la backdoor BRICKSTORM
Secondo Google Threat Intelligence, il gruppo di spionaggio UNC5221, legato alla Cina, ha effettuato una serie di intrusioni con successo nelle reti aziendali da marzo di quest’anno, sfruttando vulnerabilità precedentemente sconosciute nei prodotti Ivanti.
Gli attacchi hanno portato all’introduzione di backdoor che hanno permesso agli aggressori di mantenere l’accesso all’infrastruttura delle vittime per una media di 393 giorni.
Gli esperti hanno attribuito le azioni al gruppo UNC5221 e ad altri gruppi cinesi di cyberspionaggio correlati. Secondo il rapporto, UNC5221 ha iniziato a sfruttare attivamente le vulnerabilità nei dispositivi Ivanti già nel 2023. Google sottolinea che questo gruppo non è associato a Silk Typhoon (ex Hafnium), sospettato di aver hackerato il Dipartimento del Tesoro degli Stati Uniti a dicembre.
Si tratta di un gruppo APT motivato finanziariamente (FIN) o sponsorizzato dallo Stato, sebbene l’origine di UNC5221 indichi chiaramente il sostegno statale. Dalla primavera del 2025, gli esperti di Mandiant hanno risposto a incidenti legati a questo gruppo in un’ampia gamma di settori, dagli studi legali ai provider SaaS e alle società di outsourcing aziendale. Nella maggior parte dei casi, gli aggressori hanno utilizzato una backdoor appositamente sviluppata, BRICKSTORM, impiantata in dispositivi che non supportano i metodi di rilevamento tradizionali (EDR).
Ciò ha permesso agli aggressori di passare inosservati: i sistemi di sicurezza delle organizzazioni semplicemente non hanno rilevato l’attività dannosa. Per aiutare a identificare le infezioni, Google ha pubblicato uno strumento di scansione gratuito che non richiede l’installazione di YARA ed è adatto ai sistemi basati su Linux e BSD.
Cerca firme e pattern univoci nel codice caratteristici di BRICKSTORM. I rappresentanti di Mandiant sottolineano che il numero di infezioni potrebbe diventare significativo una volta che le organizzazioni inizieranno a scansionare i propri dispositivi in massa: si prevede che gli effetti di questa campagna si manifesteranno nel corso dei prossimi uno o due anni.
In almeno un caso, gli hacker statali hanno ottenuto l’accesso a Ivanti Connect Secure tramite una vulnerabilità zero-day. Sebbene Google non abbia specificato la vulnerabilità specifica, i ricercatori avevano precedentemente collegato UNC5221 allo sfruttamento attivo di CVE-2023-46805 e CVE-2024-21887 , entrambe divulgate pubblicamente solo a gennaio 2024.
Dopo essere penetrati nella rete, gli aggressori hanno installato BRICKSTORM, un malware scritto in Go e dotato di funzionalità proxy (SOCKS). Sebbene venga menzionata una versione per Windows , gli esperti di Mandiant non l’hanno osservata direttamente; le prove della presenza di questa modifica sono indirette. Infatti, il malware è stato rilevato su dispositivi Linux e BSD, inclusi dispositivi di rete di vari produttori.
UNC5221 attacca regolarmente i server VMware vCenter e gli host ESXi, spesso partendo dai dispositivi edge e utilizzando poi credenziali rubate per penetrare più a fondo nella rete. In un attacco, BRICKSTORM è stato introdotto in vCenter dopo l’inizio delle indagini sull’incidente, dimostrando la capacità dell’avversario di adattarsi in tempo reale e monitorare le azioni dei difensori. Il malware è stato anche modificato, utilizzando strumenti di offuscamento Garble, librerie wssoft personalizzate e, in un caso, un timer per ritardare l’attività fino a una data specifica.
Inoltre, in diversi casi, gli hacker hanno utilizzato un malware aggiuntivo: BRICKSTEAL, un filtro Java Servlet dannoso per Apache Tomcat che viene eseguito all’interno dell’interfaccia web di vCenter. Intercetta le intestazioni HTTP Basic Auth, estraendo dati di accesso e password, incluse le credenziali di dominio se l’organizzazione utilizza Active Directory. L’installazione di un filtro richiede in genere modifiche alla configurazione e il riavvio del server, ma in questo caso gli aggressori hanno utilizzato uno speciale dropper che ha iniettato codice in memoria senza riavviare il server, migliorando ulteriormente la furtività.
Nell’ambito degli attacchi, gli aggressori hanno anche ottenuto l’accesso alle caselle di posta di dipendenti chiave: sviluppatori, amministratori di sistema e altri specialisti le cui attività potrebbero essere di interesse per gli interessi economici o di intelligence cinesi. Per farlo, hanno sfruttato le applicazioni aziendali Microsoft Entra ID con privilegi mail.read o full_access_as_app, consentendo l’accesso a qualsiasi e-mail all’interno dell’organizzazione.
L'articolo Hanno dormito nelle reti per 393 giorni! Gli hacker statali cinesi e la backdoor BRICKSTORM proviene da il blog della sicurezza informatica.
Il Papa a Civiltà Cattolica: cercate e comunicate lo sguardo di Cristo sul mondo
Nell’udienza alla rivista dei Gesuiti, Leone XIV si sofferma sul ruolo della comunicazione nella complessità della società di oggi, sottolineando l’impegno ad educare i lettori perchè siano più consapevoli anche nel cambiare il mondo. Il Papa raccomanda poi di farsi voce degli ultimi e annunciatori di speranza perchè il buon giornalismo aderisce al Vangelo.
Leggi la notizia sul sito di Vatican News
The post Il Papa a Civiltà Cattolica: cercate e comunicate lo sguardo di Cristo sul mondo first appeared on La Civiltà Cattolica.