Lunedì sera sulla piattaforma X Spaces avrebbe dovuto svolgersi la tanto attesa intervista di Elon Musk con l’ex presidente degli Stati Uniti Donald Trump. Tuttavia, l’evento, previsto per le 20:00 è stato rinviato a causa di gravi problemi tecnici.

Subito dopo l’inizio della trasmissione si è verificato un problema tecnico e l’intervista è iniziata 42 minuti dopo. Coloro che sono riusciti a connettersi alla piattaforma hanno riferito che la musica lo-fi è stata trasmessa dall’account di Trump per circa 30 minuti.

18 minuti dopo l’inizio previsto, Musk ha annunciato che X era l’obiettivo di un “massiccio attacco DDoS “. Tuttavia, il resto di X sembrava funzionare bene. Una fonte aziendale ha confermato che in realtà non si è verificato alcun attacco di negazione del servizio. Un altro dipendente ha detto che con molta probabilità Musk mentiva riguardo all’attacco.

In una serie di post successivi, Musk ha affermato che lunedì la società ha testato il sistema con 8 milioni di ascoltatori. Quando finalmente l’intervista è iniziata, intorno alle 20:40, X ha riferito che Space aveva 915.000 ascoltatori.

Musk ha ripetuto la dichiarazione sull’attacco DDoS quando finalmente è iniziata la trasmissione. “Come dimostra questo massiccio attacco, l’opposizione semplicemente non vuole che la gente senta ciò che il presidente Trump ha da dire“, ha detto. Quindi, se il miliardario ha mentito, le sue parole sarebbero una sorta di manipolazione politica.

youtube.com/embed/JUlDHBKR-fM?…

Il mancato avvio dell’intervista ha ricordato gli eventi del 2023, quando il governatore della Florida Ron DeSantis annunciò su X la sua partecipazione alla corsa presidenziale. Poi l’evento è stato accompagnato anche da problemi tecnici, che Elon ha spiegato con un sovraccarico dei server.

Il Register inoltre non ha trovato prove di un attacco DDoS contro X. La mappa delle minacce informatiche di Check Point Software non ha registrato livelli insoliti di attività al momento della trasmissione. La mappa degli attacchi DDoS in tempo reale di NetScout ha mostrato solo piccoli attacchi negli Stati Uniti.

Quando finalmente l’intervista è iniziata, era inclusa una retorica e un linguaggio che sarebbero stati familiari ai fan di entrambi i partecipanti. Trump ha criticato le politiche dell’amministrazione Biden, ha definito i suoi oppositori politici radicali pericolosi e ha messo in guardia dalle conseguenze negative. Ha anche fatto alcune dichiarazioni criptiche, inclusa la menzione del “riscaldamento nucleare“.

Entrambi gli interlocutori hanno lamentato l’eccessiva regolamentazione come un ostacolo per le imprese e l’innovazione, chiedendo riforme. Hanno trovato un linguaggio comune sulla questione dello sviluppo delle infrastrutture di trasporto interurbano ad alta velocità, anche se Trump preferisce i treni e Musk preferisce fare affidamento sui tunnel sotterranei.

Durante la conversazione è stato toccato anche il tema della tecnologia. Trump ha espresso preoccupazione per il fatto che il potenziale dell’intelligenza artificiale potrebbe non essere realizzato a causa delle attuali politiche energetiche che danno priorità alle fonti rinnovabili. “L’intelligenza artificiale richiede il doppio dell’energia prodotta attualmente dagli Stati Uniti”, ha affermato il politico. Musk ha espresso l’opinione che la generazione solare diventerà in futuro la principale fonte di energia negli Stati Uniti.

In sintesi, questa intervista, nonostante le difficoltà tecniche, è stata un momento culminante che ha dimostrato sia le capacità che i limiti delle moderne piattaforme di trasmissione online. Ha inoltre offerto al pubblico l’opportunità di ascoltare due figure influenti su un’ampia gamma di questioni attuali, dalla politica all’economia, alla tecnologia e al futuro dell’energia.

L'articolo Musk: ma quale attacco DDoS! 9 milioni di ascoltatori per una interessante intervista proviene da il blog della sicurezza informatica.

slowforward.net/2024/08/14/guy…

slowforward

2024-08-14 12:44:42

Guy Debord (1931-1994)

Critique de la séparation (1961)
Hurlements en faveur de Sade (1952)
In Girum Imus Nocte Et Consumimur Igni (1978)
Refutation of All the Judgements, Pro or Con, Thus Far Rendered on the Film “The Society of the Spectacle” (1975)
Society of the Spectacle, Part 1 (1973)
Society of the Spectacle, Part 2 (1973)
Guy Debord, son art et son temps (1995)
Society of the Spectacle by Guy Debord with a new and unauthorized translation, voiceover by Paul Chan (2013)

Guy Debord was born in Paris on December 28, 1931. In 1950 Debord began his association with the Lettrist International, which was being led by Isidore Isou at the time. The Lettrists were attempting to fuse poetry and music, and were interested in transforming the urban landscape. In 1953 they mapped out what they called the “psychogeography” of Paris by walking through the city in a free-associative manner, or “drifts”. Texts on this activity were first published in Naked Lips in 1955 and 1956, in essays titled “Detournement: How to Use” and “Theory of the Derive.”

In 1957… →

slowforward.net/2024/08/14/guy…

#archive #archivi #archivio #cinema #GuyDebord #Situationism #Situazionismo #UbuWeb

guy debord @ ubuweb

Guy Debord (1931-1994)  Critique de la séparation (1961)  Hurlements en faveur de Sade (1952)  In Girum Imus Nocte Et Consumimur Igni (1978)  Refutation of All the Judgements, Pro or Con, Thus Far …

^slowforward

slowforward.net/2024/08/13/due…

slowforward

2024-08-13 18:05:29

_

slowforward.net/2024/08/13/due…

#asemic #asemicWriting #asemicWritingOnStone #asemicsOnStone #FabrizioMRossi #FabrizioRossi #ffffff #pietre #pietreDiLeonessa #pietreScritte #scritturaAsemica #scritturaAsemicaA #scritturaAsemicaSuPietra #scritturaSuPietra

pietra1_ fmrossi

Visita l'articolo per saperne di più.

^slowforward

slowforward.net/2024/08/14/un-…

slowforward

2024-08-14 00:00:20

machina-deriveapprodi.com/post…

.

slowforward.net/2024/08/14/un-…

#AlbertoToscano #fascismo #GranBretagna #laburisti #Machina #neofascismo #razzismo #rivolteRazziste #tories #tribalismo #whitewashing

un articolo di alberto toscano sulle violenze razziste e fasciste recenti

^slowforward

In late July 2024, we detected a series of ongoing targeted cyberattacks on dozens of computers at Russian government organizations and IT companies. The threat actors infected devices using phishing emails with malicious shortcut attachments. These shortcuts were used to deliver malware that received commands via the Dropbox cloud service. Attackers used this malware to download additional payloads onto infected computers, in particular tools used by the APT31 group and an updated CloudSorcerer backdoor. We dubbed this campaign EastWind.

Below are the most interesting facts about the implants used in this campaign:

• The malware downloaded by the attackers from Dropbox has been used by APT31 since at least 2021. We named it GrewApacha.
• The attackers updated the The CloudSorcerer backdoor (described by us in early July 2024) ) after we published our blogpost. It currently uses LiveJournal (a social network popular in Russia) and Quora profiles as initial C2 servers.
• The attacks additionally deploy a previously unknown implant with a classic backdoor functionality, which we dubbed PlugY. It is loaded via the CloudSorcerer backdoor, and its command set is quite extensive. It supports three different protocols for communicating with C2, and what’s more, its code resembles that of the DRBControl backdoor (aka Clambling), which several companies attribute to the APT27 group.

Technical information

As mentioned above, the attackers used spear phishing to gain an initial foothold into the organizations. They sent malicious emails with attached RAR archives to target organizational email addresses. These archives had the following names:

• инициативная группа из Черниговского района Приморского края.rar (translates as advocacy group from Chernigov district of Primorsky Krai.rar)
• вх.rar

They contained the following files:

• .con folder, which contained:
  
  • 1.docx, a legitimate decoy document
  • desktop.exe, a legitimate file
  • VERSION.dll, a malicious file

  
  

• A malicious shortcut with a name similar to that of the archive.

When clicked on, the shortcut executed the following command:
C:\Windows\System32\cmd.exe /c .con\1.docx & echo F | move .con\doc %public%\Downloads\desktop.exe & move .con\docs %public%\Downloads\VERSION.dll & start /b %public%\Downloads\desktop.exe && exit
This command opens the document contained in the archive, copies the files desktop.exe and VERSION.dll to the C:\Users\Public\Downloads folder, and then launches the desktop.exe file.

Note the use of a similar infection method in an attack on a US organization that involved use of the CloudSorcerer backdoor, reported by Proofpoint in July 2024:

Contents of the malicious archive used in the attack on a US organization

VERSION.dll – a backdoor that uses Dropbox

The attackers use classic DLL sideloading to load the malicious library VERSION.dll into the desktop.exe process:

This library is a backdoor packed using the VMProtect tool. When started, it attempts to contact Dropbox using a hardcoded authentication token. Once connected to the Dropbox cloud, the backdoor reads commands to be executed from the file <computer name>/a.psd contained in the storage. The backdoor supports a total of five commands, named as follows:

• DIR
• EXEC
• SLEEP
• UPLOAD
• DOWNLOAD

The results of running these commands are uploaded to the file <computer name>/b.psd that is stored in the cloud..

GrewApacha: a RAT used by APT31 since 2021

The threat actors used the above backdoor to collect information about infected computers and install additional malware on them. On one of these computers, we observed the download of the following files to the directory C:\ProgramData\USOShared\Logs\User:

• msedgeupdate.exe, a legitimate executable file signed by Microsoft
• msedgeupdate.dll, a malicious library
• wd, a file with an encrypted payload

When the attackers launched msedgeupdate.exe, the malicious library msedgeupdate.dll was loaded into its process by means of DLL sideloading:

While this set of three files resembles the “sideloading triad” that is typical of attacks involving PlugXanalysis of these files revealed that the malware inside them is a RAT of the APT31 group, already described in 2021 and 2023. We dubbed this RAT ‘GrewApacha’.

The behavior of the loader (msedgeupdate.dll) hasn’t changed since the 2023 post was published. As before, it decrypts the payload stored on the drive using the XOR key 13 18 4F 29 0F, and loads it into the dllhost.exe process.

While the GrewApacha loader has not changed since last year, there have been minor differences introduced to the RAT itself. Specifically, the new version now uses two C2 servers instead of one. Through network communications, the cybercriminals first retrieve a webpage with a profile bio on GitHub. This profile contains a string encoded with the Base64 algorithm:

Profile of a user created by the attackers on GitHub

The malware first decodes the string extracted from the GitHub profile, then decrypts it using a single-byte XOR algorithm with the key 0x09, thereby obtaining the address of the main C2 server (for the screenshot above – update.studiokaspersky[.]com).

New version of the CloudSorcerer backdoor

Besides launching the GrewApacha Trojan described above, we found that the attackers also downloaded the CloudSorcerer backdoor onto infected computers. To do that, they downloaded and launched a tool named GetKey.exe that is packed with the VMProtect obfuscator.

The utility receives a four-byte number (the value of the GetTickCount() function at runtime), encrypts it using the CryptProtectData function, and then outputs the number with its ciphertext. The screenshot below shows the code of the tool’s main function:

The attackers used the tool output on their side as a unique key to encrypt the payload file. By handling the encryption with the CryptProtect function, the attackers made it possible to decrypt the payload only on the infected machine.

After running the tool, the attackers downloaded the following files to the infected machine:

• The renamed legitimate application dbgsrv.exe (example name: WinDRMs.exe), signed by Microsoft
• The malicious library dll
• A file with the .ini extension, containing the encrypted payload. The name of this file varied across infected machines.

As in the above case of GrewApacha, this set resembles the “sideloading triad” used in attacks involving PlugX.

IIn most cases, the attackers uploaded files inside a subdirectory of C:\ProgramData, such as C:\ProgramData\Microsoft\DRM. Afterwards, they used the task scheduler to configure the renamed dbgsrv.exe application to launch at OS startup. This involved the schtasks utility (usage example:
schtasks /create /RL HIGHEST /F /tn \Microsoft\Windows\DRM\DRMserver /tr "C:\ProgramData\Microsoft\DRM\WinDRMs.exe -t run" /sc onstart /RU SYSTEM").
Upon startup of the renamed application, the malicious dbgeng.dll library is loaded into its process, again using DLL sideloading.

This library was programmed to read the previously mentioned .ini file, which contains:

• The ciphertext of a four-byte number generated and encrypted by the GetKey.exe utility
• A PE file compressed with the LZNT1 algorithm and XOR-encrypted using the four-byte number as a key.

Accordingly, the library proceeded to decrypt the four-byte number using the CryptUnprotectData function, use it to decrypt the .ini file, and then load the decrypted file into the memory of the current process.

Analysis of the decrypted .ini files revealed them to be updated versions of the CloudSorcerer backdoor. After we publicly described this backdoor in early July 2024, the attackers modified it: the new version of CloudSorcerer uses profile pages on the Russian-language social network LiveJournal and the Q&A site Quora as the initial C2 servers:

As with past versions of CloudSorcerer, the profile bios contain an encrypted authentication token for interaction with the cloud service.

PlugY: an implant that overlaps with APT27 tools

Having analyzed the behavior of the newly found CloudSorcerer samples, we found that the attackers used it to download a previously unknown implant. This implant connects to the C2 server by one of three methods:

• TCP protocol
• UDP protocol
• Named pipes

The set of commands this implant can handle is quite extensive, and implemented commands range from manipulating files and executing shell commands to logging keystrokes and monitoring the screen or the clipboard.

Analysis of the implant is still ongoing, but we can conclude with a high degree of confidence that the code of the DRBControl (aka Clambling) backdoor was used to develop it. This backdoor was described in 2020 by Trend Micro and Talent-Jump Technologies. Later, Security Joes and Profero linked it to the APT27 group. The backdoor also has similarities to PlugX.

Our comparison of samples of the PlugY implant (MD5 example: faf1f7a32e3f7b08017a9150dccf511d) and the DRBControl backdoor (MD5: 67cfecf2d777f3a3ff1a09752f06a7f5) revealed that these two samples have the exact same architecture. Additionally, many commands in them are implemented almost identically, as evidenced by the screenshots below:

Command code for retrieving information about connected disks in the DRBControl backdoor (left) and the implant (right)

Command code for retrieving information about the active window in the DRBControl backdoor (left) and the implant (right)

Command code for taking screenshots in the DRBControl backdoor (left) and the implant (right)

Thus, the code previously observed in attacks by APT27 was likely used in developing the implant.

While analyzing the PlugY implant we also noticed that it uses a unique malicious library to communicate with the C2 server via UDP. We found the very same library in the DRBControl backdoor, as well as several samples of the PlugX backdoor, which is popular among Chinese-speaking groups. Apart from DRBControl and PlugX, this library has not been detected in any other malware.

Screenshot of the library communicating with the C2 server via UDP

Tips for attack detection

The implants identified during the attack significantly differ from each other. As such, it’s necessary to use a separate set of IoCs for each malware used in any compromise.

The backdoor that uses Dropbox and is delivered via email can be found by looking for relatively large DLL files (> 5 MB) located in the directory C:\Users\Public. Regular access to the Dropbox cloud in network traffic can serve as an additional indicator of this backdoor’s operation.

The GrewApacha Trojan can be detected by searching for an unsigned file named msedgeupdate.dll in the file system. This file also reaches several megabytes in size.
The PlugY implant that is delivered using the CloudSorcerer backdoor launches a process named msiexec.exe for each user signed to the OS, and also creates named pipes with the name template \.\PIPE\Y. The presence of these two indicators in the system is strong evidence of an infection.

Conclusion

In attacks on government organizations, threat actors often use toolkits that implement a wide variety of techniques and tactics. In developing these tools, they go to the greatest lengths possible to hide malicious activity in network traffic. For instance, the attackers behind the EastWind campaign, for instance, used popular network services (GitHub, Dropbox, Quora, LiveJournal and Yandex.Disk) as C2 servers.

Notably, the EastWind campaign bore traces of malware from two different Chinese-speaking groups: APT27 and APT31. This clearly shows that APT groups very often team up, actively sharing knowledge and tools. To successfully counter such collaborations, we closely monitor the techniques and tactics of APT groups operating around the world.

securelist.com/eastwind-apt-ca…

Sometimes a paper in a scientific journal pops up that makes you do a triple-take, case in point being a recent paper by [Aren Boyaci] and [Arindam Banerjee] in Physical Review E titled “Transition to plastic regime for Rayleigh-Taylor instability in soft solids”. The title doesn’t quite do their methodology justice — as the paper describes zipping a container filled with mayonnaise along a figure-eight track to look at the surface transitions. With the paper paywalled and no preprint available, we have to mostly rely the Lehigh University press releases pertaining to the original 2019 paper and this follow-up 2024 one.

Rayleigh-Taylor instability (RTI) is an instability of an interface between two fluids of different densities when the less dense fluid acts up on the more dense fluid. An example of this is water suspended above oil, as well as the expanding mushroom cloud during a explosion or eruption. It also plays a major role in plasma physics, especially as it pertains to nuclear fusion. In the case of inertial confinement fusion (ICF) the rapidly laser-heated pellet of deuterium-tritium fuel will expand, with the boundary interface with the expanding D-T fuel subject to RTI, negatively affecting the ignition efficiency and fusion rate. A simulation of this can be found in a January 2024 research paper by [Y. Y. Lei] et al.

As a fairly chaotic process, RTI is hard to simulate, making a physical model a more ideal research subject. Mayonnaise is definitely among the whackiest ideas here, with other researchers like [Samar Alqatari] et al. as published in Science Advances opting to use a Hele-Shaw cell with dyed glycerol-water mixtures for a less messy and mechanically convoluted experimental contraption.

What’s notable here is that the Lehigh University studies were funded by the Lawrence Livermore National Laboratory (LLNL), which explains the focus on ICF, as the National Ignition Facility (NIF) is based there.

This also makes the breathless hype about ‘mayo enabling fusion power’ somewhat silly, as ICF is even less likely to lead to net power production, far behind even Z-pinch fusion. That said, a better understanding of RTI is always welcome, even if one has to question the practical benefit of studying it in a container of mayonnaise.

Following the recent US court ruling on Google’s market dominance, Washington may be aligning more closely with the Brussels approach to tech competition regulation, hinting at possible enforcement measures.

euractiv.com/section/competiti…

“Le erbacce devono essere estirpate dalla radice altrimenti non faranno altro che rispuntare da un’altra parte“, questo è il cybercrime.

La prima metà del 2024 ha visto un costante aumento dell’attività dei gruppi di estorsione, nonostante gli sforzi significativi delle forze dell’ordine per reprimerli.

Secondo Unit 42, il numero di nuovi post di compromissione dei dati ha raggiunto 1.762, ovvero una media di 294 post al mese. Questo dato conferma che il livello di minaccia dei ransomware rimane elevato, nonostante le operazioni riuscite che non producono specifiche pubblicazioni

Si distinguono in particolare 6 gruppi, che rappresentano oltre la metà di tutti gli incidenti registrati. Sebbene gruppi BlackCat e LockBit abbiano ridotto la loro attività a causa dell’intervento delle forze dell’ordine, nuovi autori di minacce hanno preso il loro posto.

Tra questi spiccano RansomHub e DragonForce.
Confronto dei 6 principali gruppi di ransomware per (tutto il 2023 e la prima metà del 2024)
I settori più colpiti dagli attacchi sono stati il ​​manifatturiero, la sanità e l’edilizia. Il settore manifatturiero è risultato essere il più vulnerabile, con il 16,4% di tutti gli attacchi, confermando l’importanza del settore per il ransomware.

Anche il settore sanitario, pur essendo altamente suscettibile alle interruzioni, ha subito attacchi significativi, con il 9,6% di tutti gli incidenti segnalati. Al terzo posto si colloca invece il settore edile con il 9,4%
Settori colpiti dal ransomware nella prima metà del 2024
Gli Stati Uniti si sono rivelati il ​​Paese con il maggior numero di vittime di ransomware: il 52% di tutti gli incidenti. Tra i primi dieci paesi più colpiti figurano anche Canada, Regno Unito, Germania, Italia, Francia, Spagna, Brasile, Australia e Belgio.
Paesi in cui le organizzazioni sono state colpite dal ransomware nella prima metà del 2014
Gli analisti sottolineano che il motivo principale dell’aumento dell’attività ransomware nel 2024 è stato il rapido sfruttamento delle vulnerabilità recentemente identificate.

I criminali informatici sfruttano attivamente le opportunità per infiltrarsi nelle reti delle vittime, aumentare i privilegi e spostarsi lateralmente all’interno dei sistemi compromessi.

Nella prima metà del 2024 le forze dell’ordine hanno condotto con successo una serie di operazioni che hanno portato all’arresto di figure chiave e al sequestro delle infrastrutture di alcuni dei gruppi più noti. Tuttavia, nonostante questi sforzi, le minacce continuano ad evolversi.

Nuove fazioni stanno riempiendo il vuoto creato dalla chiusura dei player più anziani, evidenziando la necessità di un monitoraggio e un aggiornamento continui delle misure di difesa.

L'articolo 6 Gruppi Criminali sono i responsabili del 50% degli Attacchi Ransomware proviene da il blog della sicurezza informatica.

slowforward.net/2024/08/13/ins…

slowforward

2024-08-13 10:31:16

installance n. : # 0189type : asemic square size : ~ cm 6 x 6record : lowres shotadditional notes : abandoneddate : Aug 6th, 2024time : 4:31pmplace : Rome, via Lancianofootnote : ---copyright : (CC) 2024 differx
.

slowforward.net/2024/08/13/ins…

#000000 #0189 #abandoned #asemic #asemicSquare #card #i0189 #installance #installance0189

installance #0189: asemic square

  installance n. : # 0189 type : asemic square size : ~ cm 6 x 6 record : lowres shot additional notes : abandoned date : Aug 6th, 2024 time : 4:31pm place : Rome, via Lanciano footnote : — c…

^slowforward

slowforward.net/2024/08/13/the…

slowforward

2024-08-13 08:01:50

bopsecrets.org/

bopsecrets.org/comics/return.h…

_
e ci sono anche…

Testi in Italiano

(Text in Italian)

Riflessioni preliminari sulla Guerra del Vietnam (Ngo Van, 1968)
Sulle lotte del Terzo Mondo (Ngo Van, 1968)
In questo teatro… (1970)
Ode sull’assenza di vera poesia oggi questo pomeriggio (1970)
Doppia riflessione (1974)
Avviso riguardo la società dominante e coloro che la contestano (1974)
I ciechi e l’elefante (1975)
La società del situazionismo (1976)
La realizzazione e la soppressione della religione (1977)
Lettera aperta al gruppo “Libertaire” di Tokio (1977)
La breccia in Iran (1979)
Banalità (1979)
La guerra e lo spettacolo (1991)
Sul film di René Viénet: Può la dialettica spezzare i mattoni? (1992)
Due saggi critici sul buddismo impegnato (1993 & 1999)
Confessioni di un garbato nemico dello stato (1997):
parte 1
parte 2
parte 3
Corrispondenza sulla questione della religione (1997-2000)
Riformismo y politica elettorale (2002)
Introduzione ai film di Guy Debord (2003)
Risposta ad un liberale del Midwest (2003)
Porta d’ingresso ai vasti domini (Introduzione) (2004)
Comprendere Debord dialetticamente (2005/2010)
Riflessioni sulla sollevazione in Francia (2006)
Documenti della sollevazione anti-CPE in Francia (2006)
Opinioni francofone sull’Ufficio dei Segreti Pubblici (2007-2008)
Ken Knabb, l’Internazionale Situazionista e la controcultura nord-americana (Jean-Pierre Depétris, 2008)
Introduzione al libro di Ngo Van In the Crossfire: Adventures of a Vietnamese Revolutionary (2010)
Nota sullo stalinismo e sul trotskismo (2010)
Il risveglio in America (2011)
Al di là del voto (2012/2016)

slowforward.net/2024/08/13/the…

#000000 #anarchy #archive #bureauOfPublicSecrets #dance #durruti #ffffff #internationalSituationist #KennethRexroth #Situationism #situationistInternational #Situazionismo

the ‘bureau of public secrets’: an astounding (situationist) archive

_ e ci sono anche…

^slowforward