Google ha inaspettatamente smesso di supportare il browser Chrome sull’attuale sistema operativo con supporto a lungo termine Ubuntu 18.04 LTS “Bionic Beaver” con il rilascio della nuova versione di Chrome 128. Ciò ha causato un’ondata di malcontento tra gli utenti, poiché il browser ha smesso di funzionare.

Inizialmente, la società non aveva intenzione di risolvere il problema. Tuttavia, dopo numerose lamentele da parte della comunità Linux, l’azienda ha deciso di modificare i propri piani. Un portavoce di Google ha affermato che la società riconosce che l’improvvisa fine del supporto ha colto di sorpresa molti utenti. Pertanto, è stata presa la decisione di restituire il supporto a Ubuntu 18.04… Per un po’.

Google ha promesso di rilasciare un aggiornamento che ripristinerà la compatibilità di Chrome con questa versione del sistema operativo già la prossima settimana. Tuttavia, in futuro la società prevede di smettere di supportare Ubuntu 18.04. Questa volta, però, Google ha promesso di non “premere l’interruttore” silenziosamente, ma di avvisare in anticipo gli utenti della fine del supporto.

È importante installare la nuova versione di Chrome 128 perché contiene aggiornamenti di sicurezza critici anche se l’aggiornamento non si installa a causa dell’incompatibilità con la libreria di sistema libgcc-s1, che ha causato ulteriori difficoltà agli utenti.

Questa situazione dimostra l’importanza di mantenere un equilibrio tra gli aggiornamenti di sicurezza e le esigenze degli utenti. Le aziende di software devono pianificare attentamente i cambiamenti nel supporto dei loro prodotti, tenendo conto della diversità della loro base di utenti e del potenziale impatto delle

L'articolo Google Chrome Abbandona Ubuntu 18.04. E Scoppia la Polemica proviene da il blog della sicurezza informatica.

There have been some hilarious issues on mobile devices over the years. The HTC Dream had a hidden shell that was discovered when a phone rebooted after sending a text containing just the word “reboot”. iOS has gotten in on the fun from time to time, and this time it’s ""::. Type the double quotes, a colon, and any other character, and Apple’s Springboard service crashes.

Another hacker dug in a bit, and realized that Springboard is trying to jump execution to a null pointer, leading to a crash. It’s very odd that user input breaks the query parser badly enough to jump to null like that. There are a couple interesting questions that we have to ask. Given that the crash trigger is quite flexible, "anything goes":x, is it possible to manipulate that function pointer to be something other than null? And perhaps more importantly, why is the code crashing, instead of an invalid address error as one would expect from a Pointer Authentication Code (PAC) violation? Regardless, the bug seems to be fixed in the latest iOS 18 builds.

Typing “”:: in various search bars (e.g. in Settings .app) on iOS, will cause a crash! t.co/P4Ax0z9W9F (by: @)

….let's dig into why

— Patrick Wardle (@patrickwardle) August 21, 2024

OpenBMC

OpenBMC is something of a reference Baseboard Management Controller, and as such it’s the upstream for other implementations. And it has a fairly serious issue, in the slpd-lite service, which just happens to be installed and enabled by default. SLP is the Service Location Protocol, a service discovery protocol, which is something of a predecessor to Zeroconf. Slpd-lite has a pair of issues that result in trivial heap reads and writes, beyond the intended buffer.

The slpd-lite project patched the issues about a week after disclosure, back in May. In June, the patch and an advisory was applied to OpenBMC itself. Nice and speedy action. Now to get all the downstream vendors to apply it, too.

WordPress LightSpeed Falls to Weak Hash

The LightSpeed Cache plugin for WordPress does something really clever, but in a way that managed to allow admin authentication bypasses. To cache pages that a logged-in user would see, the plugin’s crawler simulates each user loading the site, and caches that. To protect that cache, a random string is generated. The problem is that this random generation is seeded using the current time, only the microsecond portion of the time. So one of only a million possible values. And while a million is a lot when talking about physical objects, it’s not nearly enough when talking about cryptography.

To log in as a user using this weak hash, an attacker only has to guess te proper user ID (usually 1 is an admin) and then hit the right hash value. Lightspeed hash released a fix, but this is a severe issue, and we should expect to see exploitation attempts — And that didn’t take long. This one could be nasty, as something like 3.5 million sites are still running the vulnerable version of the plugin. Wordfence has already blocked 48,500 in the first 24 hours of this attack being publicly known.

Insulin, Privacy, and Firewalls

[Remy] fron Greynoise Labs is on a bit of a crusade against insecure Bluetooth. And make no mistake, Bluetooth can be a problem. Case in point, the FDA has issued a recall on a particular insulin pump, because the iOS app could enter a crash loop, and the continual Bluetooth re-connections drained the device’s batteries. Battery drain may seem like a mild inconvenience, but apparently over 200 people have reported injuries as a result.

So in this push for more secure use of Bluetooth, [Remy] mined a collection of Android applications for Bluetooth UUIDs. Those are unique identifiers of what kind of device is advertising Bluetooth. With this new treasure trove of identifiers, it was only natural to write a Bluetooth UUID scanner. And this is where a bit of a bizarre coincidence took place. At the some moment [Remy] fired up this scanner, his local Internet access dropped. As a result, his Firewalla firewall started advertising a Bluetooth Low Energy interface. The database returned a hit, and [Remy] had the Android APK to look at.

The Firewalla scheme for authenticating that BLE interface was lacking, with a handful of possible issues, like only checking the first 8 characters of a UUID key. And once past that initial hurdle, further administration tasks are secured using a JSON Web Token. That token’s signing key was global for all Firewally devices, and trivially derived from either firmware or the Android APK. And that’s not even all, since there were also command injection issues over the same Bluetooth link. Firewalla has released version 1.979 to address these issues.

Moar Bluetooth

If that wasn’t enough Bluetooth, the Zero Day Initiative has us covered, with coverage of a pair of flaws in the Autel Maxicharger vehicle charging station. The first was a simple buffer overflow in the Bluetooth data handling, leading to possible Remote Code Execution (RCE). The second issue was the presence of “Backup credentials” in the firmware’s WiFi handling.

Bits and Bytes

“Insufficient sanitization” is not a feature you want in your microservices. Spring’s Cloud Dataflow is a tool to plug data flows in to various other applications. Before a recent patch fixed it, Dataflow was doing some basic checks on file uploads, like looking for nulls or empty files. The problem was some very simple path traversal attacks. Name a package name with ../../../poc, and while the service may throw an error, it still creates the files as requested. 2.11.3 has shipped with the fix, so time to update!

And speaking of bypasses, ingress-nginx has a validation bypass, allowing unauthorized access to Kubernetes clusters using that controller. Kubernetes supports annotations as a sort of metadata system, and ingress-nginx was failing to properly validate those annotations, which could then be used for command injection.

And finally, I think I’ve played this video game. Except this time, someone actually tried to hack himself out of existence. The FBI discovered that a criminal had not only used stolen social security numbers to commit fraud, he had gone so far as to register his own death in a Government system, using stolen credentials. It didn’t turn out so well, as he was discovered alive, and sentenced to jail time for the effort.

You might think that TV stations or production houses would be great at archiving, but it’s not always the case. Particularly from the public access perspective. However, if you’re a fan of The Famous Computer Cafe, you’re in luck! The beloved series has now been preserved on The Internet Archive!

If you’re not familiar with the show, it was a radio program broadcast from 1983 to 1986. It was pumped out of a variety of radio stations in southern and central California in the period. The creators making sure to keep a copy of each episode in reel-to-reel tape format. For years, these tapes were tragically lost, until archivist [Kay Savetz] was able to recover some of them from a recent property sale. From there, a GoFundMe paid for digitization, and the show has been placed on The Internet Archive with the blessings of the original creators.

This is quite the cultural victory, particularly when you observe the list of guests on the show. Timothy Leary, Bill Gates, Jack Tramiel, and even Douglas Adams made appearances in the recovered recordings. Sadly, though, not all the tapes have been recovered. Episodes with Gene Roddenberry, Robert Moog, and Ray Bradbury are still lost to time.

If you fancy a listen, 53 episodes presently exist on the archive. Take a trip back in time and hear from some technological visionaries—and futurists—speaking their minds at the very beginning of the microcomputer era! If you find any particularly salient gems, don’t hesitate to drop them on the tip line.

Welcome to Euractiv’s Tech Brief, your weekly update on all things digital in the EU. We’re back from the summer break.

euractiv.com/section/digital/n…

Una panoramica sul rapporto tra scuola e Fediverso…

Source

informapirata

2024-08-23 11:31:41

Una panoramica sul rapporto tra scuola e Fediverso

informapirata.it/2024/08/23/ri…

Riflessioni sul fediverso e la scuola - informapirata

^{informapirata}

slowforward.net/2024/08/23/dec…

slowforward

2024-08-23 08:54:58

youtu.be/dh2WOGApINc

slowforward.net/2024/08/23/dec…

#art #arte #cyberpunk #Decoder #mindControl #Muscha #WilliamBurroughs

decoder / muscha. 1984

Visita l'articolo per saperne di più.

^slowforward

slowforward.net/2024/08/23/man…

slowforward

2024-08-23 07:31:01

t.ly/73tsy

slowforward.net/2024/08/23/man…

#000000 #CarloBellinvia #CentroScritture #ECS #EdizioniCentroScritture #LuciaManetti

due nuovi libri, di lucia manetti e di carlo bellinvia, per le edizioni centroscritture

Visita l'articolo per saperne di più.

^slowforward

slowforward.net/2024/08/22/ope…

slowforward

2024-08-22 20:43:55

BADA festival / Brancaleone / d.i.y. prints & stuff
instagram.com/p/C9cblsntwGP/

per inviare proposte (entro il 31 agosto):
docs.google.com/forms/d/e/1FAI…
_

slowforward.net/2024/08/22/ope…

#autoproduzioni #Bada #BadaFestival #Brancaleone #dIY_ #diy #editoria #festival #ffffff #fumetti #proposte

BADA Festival on Instagram: "🦜 OPEN CALL -----> BADA 2024 🦜 Fill the form for join us with your DIY prints and stuff! Call ends 31 August!! You will receive an answer by September 8 ❤️‍🔥 See you in October! 🦜🦜💚💜 (Link form in Bio)"

555 likes, 7 comments - badafestival on July 15, 2024: "🦜 OPEN CALL -----> BADA 2024 🦜 Fill the form for join us with your DIY prints and stuff! Call ends 31 August!! You will receive an answer by September 8 ❤️‍🔥 See you in October! 🦜🦜💚💜 (Link f…

^Instagram

È durata pochi mesi la latitanza di Salvatore Roberto Perricciolo, l’ultimo di un presunto sodalizio criminale di sedici persone di diverse nazionalità, condannate in via definitiva con la conferma in Cassazione della condanna della Corte d’Appello di Perugia dell’ottobre 2022.
L’uomo, quarantaquattro anni, di origine calabrese, latitante alla vigilia della sentenza di condanna emessa dalla Corte di Cassazione il 13 febbraio di quest’anno, è stato arresto a Capodistria, in Slovenia, dove si era rifugiato. La pena inflitta ammonta a 21 anni di reclusione, con una pena residua da scontare di circa quindici anni.

L’arresto è stato eseguito al culmine di una capillare e complessa attività investigativa coordinata dal Procuratore Generale di Perugia, in collaborazione con il Nucleo Investigativo dei Carabinieri di Fermo, l’Ufficio interforze di Polizia Giudiziaria alle dirette dipendenze dello stesso Procuratore Generale, e il Raggruppamento Operativo Speciale dei Carabinieri di Ancona.

L’operazione ha avuto carattere internazionale e ha interessato diversi Paesi europei, con la collaborazione di uffici inquirenti stranieri, in particolare con la Procura di Capodistria ed anche con l’Agenzia dell’Unione europea per la cooperazione giudiziaria penale (Eurojust) e S.i.r.e.ne (Supplementary Information Request at the National Entry) che funge da centro nazionale di contatto per lo scambio di informazioni supplementari.

Salvatore Roberto Perricciolo era residente da anni nel Fermano, condannato in via definitiva per diversi reati, è stato riconosciuto al vertice di un’associazione per delinquere dedita all’acquisto, al trasporto e alla successiva rivendita di svariati chili di cocaina nelle province di Macerata, Ancona e Fermo. In tale contesto si è reso inoltre responsabile di ulteriori delitti, tra i quali reati contro il patrimonio, rapine, in particolare ai danni di spacciatori; truffe, appropriazioni indebite, falsi documentali per acquisire illegalmente autovetture da commercializzare, estorsioni, sia ai danni degli acquirenti di droga inadempienti che verso terzi, detenzione illecita di armi e munizioni, fino al sequestro di persona, lesioni e violenza privata. In alcuni casi è stato sorpreso in luoghi pubblici in possesso di mitra e pistole. Con altro procedimento, attualmente pendente presso la Corte di Appello di Perugia, in ordine alla sola rideterminazione della pena, lo stesso è stato ritenuto responsabile di reati di natura mafiosa.

L’arresto, effettuato in territorio sloveno da personale della polizia criminale slovena in coordinamento con personale del Ros di Ancona è stato possibile grazie ad una intensa attività tecnica di acquisizione di numerosi tabulati telefonici, intercettazioni telefoniche e ambientali, oltre che pedinamenti. Il latitante è ora in attesa di essere estradato in Italia.

#Armadeicarabinieri