Qual è stata l’incidenza di attacchi e incidenti informatici nel corso del mese di luglio? I cyber criminali sono andati in vacanza o hanno approfittato del momento particolare per incrementare le proprie azioni? A rispondere a queste domande ci pensa l’Agenzia per la Cybersicurezza Nazionale e, nello specifico, il CSIRT, la sua articolazione tecnico-operativa che, […]
Continua a leggere

The post Sole, mare e malware: l’estate della cybersecurity appeared first on InsideOver.

Monorails aren’t just the core reason why The Simpsons remains on air after thirty-six seasons, twenty-six of which are unredeemable garbage. They’re also an interesting example of oddball rail travel which has never really caught on beyond the odd gadgetbahn project here and there. [Hyperspace Pirate] recently decided to investigate the most interesting kind of monorail of all—the gyro stabilized type—on a small scale for our viewing pleasure.

The idea of a gyro-stabilized monorail is to use active stability systems to allow a train to balance on a single very thin rail. The benefits of this are questionable; one ends up with an incredibly expensive and complex rail vehicle that must always run perfectly or else it will tip over. However, it is charming to watch in action.

[Hyperspace Pirate] explains how the monorail vehicle uses control moment gyroscopes to keep itself upright. The video also explains the more common concept of reaction wheels so the two systems can be contrasted and compared. It all culminates in a wonderful practical demonstration with a small 3D-printed version of a 20th-century gyro monorail running on a 24″ track.

If you’re studying mechanical engineering this is a great project to pore over to see theoretical principles put into obvious practice. Video after the break.

youtube.com/embed/OpyLmIjZaxY?…

hackaday.com/2024/08/27/buildi…

One of our favorite parts of Hackaday Supercon is seeing all the incredible badge add-ons folks put together. These expansions are made all the more impressive by the fact that they had to design their hardware without any physical access to the badge, and with only a few weeks’ notice. Even under ideal conditions, that’s not a lot of time to get PCBs made, 3D print parts, or write code. If only there was some standard for badge expansions that could speed this process up…
The SAO Wall at Supercon 2023
But there is! The Simple Add-On (SAO) standard has been supported by the Supercon badges since 2019, and the 2×3 pin connector has also popped up on badges from various other hacker events such as HOPE and DEF CON. There’s only one problem — to date, the majority of SAOs have been simply decorative, consisting of little more than LEDs connected to the power pins.

This year, we’re looking to redefine what an SAO can be with the Supercon Add-On Contest. Don’t worry, we’re not changing anything about the existing standard — the pinout and connector remains the same. We simply want to challenge hackers and makers to think bigger and bolder.

Thanks to the I2C interface in the SAO header, add-ons can not only communicate with the badge, but with each other as well. We want you to put that capability to use by creating functional SAOs: sensors, displays, buttons, switches, rotary encoders, radios, we want to see it all! Just make sure you submit your six-pin masterpiece to us by the October 15th deadline.

Best of the Best

What’s in it for the winners? Why, nothing short of Hackaday immortality: we’ll put the top SAOs into production and distribute them to each attendee at Hackaday Europe in 2025. Because we actually have to get these things made, entries will have to meet all of the manufacturing requirements outlined on the Hackaday.io page Contest page to qualify.

In addition to a single Best Overall winner, we’ll be picking a top entry for each of the following categories:

• Functional: This challenge is about pushing the envelope for SAOs, so for this category we’ll be looking for the most capable add-on.
• Fine Art: We’ve seen some absolutely gorgeous SAOs over the years, so even though we’re largely pushing for function over form this year, we still want to acknowledge the incredible artistry that goes into them.
• Fun: It’s not all about business. SAOs are often a bit tongue in cheek, with many referencing online memes or parts of hacker culture. If you want to win in this category, you’ll need to lighten up a bit.

Honorable Mention

We know this community too well to believe you’ll all stick to the predefined categories, so as usual in our contests, we’ll be keeping an eye out for entries that best exemplify the following Honorable Mention categories.

• Coolest Toys: We’re suckers for interesting parts, so the SAO selected for this category will be the one with the most unique or impressive electronic components onboard.
• Light Show: We want to challenge the idea that SAOs are just for blinking LEDs, so naturally, at least one of you is going to go against the grain and add as many LEDs as possible.
• Most Ambitious: Sometimes, it’s the thought that counts. Whether or not the final product worked as expected, the SAO selected for this category will be the one that took the biggest swing.
• Best Communication: Getting SAOs to talk to the badge and each other is what this contest is really all about, so we’re looking for the one example that really ran with the concept.
• Least Manufacturable: SAOs often employ design or assembly hacks (like mounting LEDs upside-down) that don’t scale well. In this category we’re looking for hand-crafted masterpieces. To quote Hunter S. Thompson, “A high-powered mutant of some kind never even considered for mass production.”

A Little Inspiration

There’s no shortage of gorgeous SAOs out there already, just search Hackaday.io or Tindie, and you’ll come up with dozens of badge add-ons that you didn’t even know you needed until right now. But as for examples of functional SAOs that do more than just blink LEDs…that’s quite a bit harder. We weren’t joking when we said they’ve been quite rare so far.

But we can point you towards a couple resources that should help you get started. Our own [Arya Voronova] wrote up her tale of creating a Jolly Wrencher SAO back in 2022 that goes over the basics, and we’d also recommend taking a look at her ongoing “I2C for Hackers” series of articles if you need to brush up on the communication side of things. If you need some pointers on the artistic front, you can’t go wrong following in the footsteps of [TwinkleTwinkie]. His Supercon 2019 talk PCB Art is Pain is a fantastic look at pushing the envelope of PCB design and production, and his Hackaday.io post about backlighting board art is required reading around these parts.

L’aeroporto internazionale di Seattle-Tacoma (SEA-TAC) sta subendo gravi interruzioni del sistema IT causate da un possibile attacco informatico. L’incidente, iniziato il 24 agosto, ha causato ritardi nei voli e problemi con il check-in dei passeggeri, complicando seriamente le operazioni nel più grande aeroporto della regione.

Il 24 agosto, è stato riferito che le reti dell’agenzia, compresi i sistemi aeroportuali SEA, avevano subito un’interruzione. Gli esperti hanno suggerito che il fallimento sia stato causato da un attacco informatico. I sistemi critici sono stati isolati per prevenire ulteriori problemi. I rappresentanti dell’aeroporto hanno riportato che al momento non è possibile definire quando sarà ripristinato il normale funzionamento, anche se i lavori per riportare i sistemi al normale funzionamento continuano.

I passeggeri sono pregati di essere preparati ai ritardi e di controllare le informazioni del volo sui siti web delle compagnie aeree. Il sito web ufficiale dell’aeroporto non è disponibile e i terminali per il check-in sono temporaneamente fuori servizio.

Si consiglia ai passeggeri di effettuare il check-in per i voli tramite le applicazioni della compagnia aerea e di tenere conto anche del tempo aggiuntivo impiegato per arrivare in aeroporto e svolgere tutte le procedure.

Nonostante i problemi con i sistemi informatici, i voli non sono stati cancellati, ma molti passeggeri segnalano ritardi di diverse ore. Particolari difficoltà sono sorte con il sistema di smistamento dei bagagli, come ha comunicato Alaska Airlines. Si consiglia vivamente ai passeggeri di limitarsi al bagaglio a mano ove possibile ed evitare di registrare il bagaglio per ridurre al minimo possibili ritardi.

Ad oggi nessun gruppo di hacker noto ha rivendicato la responsabilità dell’attacco. L’FBI ha detto ai media che è a conoscenza della situazione e sta lavorando con i partner per chiarire tutte le circostanze dell’incidente, ma non sono state ancora fornite ulteriori informazioni.

Essendo il principale aeroporto internazionale di Seattle e il più trafficato del Pacifico nordoccidentale, SEA-TAC ha servito quasi 51 milioni di passeggeri nel 2023. L’aeroporto è un hub chiave per Alaska Airlines e Delta Air Lines, che serve 91 destinazioni nazionali e 28 internazionali.

L'articolo Caos a Seattle: Un Attacco Informatico Paralizza l’Aeroporto SEA-TAC proviene da il blog della sicurezza informatica.

Telegram chiaramente non riesce a soddisfare questa definizione più forte per un semplice motivo: non crittografa end-to-end le conversazioni di default. Se vuoi usare la crittografia end-to-end in Telegram, devi attivare manualmente una funzionalità di crittografia end-to-end opzionale chiamata "Chat segrete" per ogni singola conversazione privata che vuoi avere.

Qui l'articolo completo di Matthew Green sul blog Cryptography Engineering

In June 2024, we discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat. The samples we found almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form of shell scripts from the attackers’ server. We noticed that some versions of the backdoor use local IP addresses to connect to C2, which led us to believe the threat may be targeted. This also points to an intention to exploit the backdoor for lateral movement through the victim’s network.

First detected by DCSO researchers in November 2022, HZ Rat initially targeted Windows systems and received commands in the form of PowerShell scripts.

Technical details

Despite not knowing the malware’s original distribution point, we managed to find an installation package for one of the backdoor samples. The file is named
OpenVPNConnect.pkg:

OpenVPNConnect.pkg on VirusTotal

It was uploaded to VirusTotal in July 2023 and, at the time of research, wasn’t detected by any vendor, like other backdoor samples. The installer takes the form of a wrapper for the legitimate “OpenVPN Connect” application, while the
MacOS package directory contains two files in addition to the original client: exe and init.

Structure of the malicious installation package

The system determines which file to run when the application is opened using the
Info.plist configuration file. The first one to be launched is the exe file – a shell script that runs the init file, then launches the OpenVPN application:

Contents of the “exe” file

The
init file is the actual backdoor. When launched, it establishes a connection to C2 based on the list of IP addresses specified in the backdoor itself. In most cases, the samples used port 8081 for connection. Additionally, we found backdoor samples using private IP addresses to connect to C2.

C2 IP addresses in the backdoor code

All communication with C2 is encrypted using XOR with the key 0x42. To initialize a session, the backdoor sends a random four-byte value, labeled
cookie in the code. Each message has the following structure:

1. Message code (1 byte);
2. Message length (4 bytes);
3. Message text, where the first 4 bytes contain the data size.

The executable file is written in C++ and contains debugging information, making it easy to identify:

Trojan class with malicious payload

The backdoor supports only four basic commands:

As part of our investigation, we obtained shell commands from the C2 server used to collect the following data about the victim:

• System Integrity Protection (SIP) status;
• System and device information, including:
  
  • Local IP address;
  • Information about Bluetooth devices;
  • Information about available Wi-Fi networks, available wireless network adapters and the network the device is connected to;
  • Hardware specifications;
  • Data storage information;

  
  

• List of applications;
• User information from WeChat;
• User and organization information from DingTalk;
• Username/website value pairs from Google Password Manager.

Getting data from WeChat

The malware attempts to obtain the victim’s WeChatID, email and phone number from WeChat. This data is stored in plain text in the
userinfo.data file.
As for DingTalk, attackers are interested in more detailed victim data:

• Name of the organization and department where the user works;
• Username;
• Corporate email address;
• Phone number.

The script tries to get this data from the
orgEmployeeModel file. If this file is missing, the malware searches for the user’s phone number and email in the sAlimailLoginEmail file. If it fails again, it attempts to find the user’s email in one of the DingTalk cache files named <date>.holmes.mapping. These files are also not encrypted and store data in plain text.

Getting data from DingTalk

Infrastructure

At the time of the study, four control servers were active and returning malicious commands. In some cases, as mentioned, among the specified IP addresses there were private ones as well. Such samples were likely used to control a victim’s device with a previously infected computer within their local network that was used as a proxy to redirect the connection to the C2 server. Typically, this helps to hide the presence of malware on the network, since only the device with the proxy will communicate with C2.

Some of the detected IP addresses have already been seen in malware attacks targeting Windows devices. Their appearance dates back to 2022, with one of the addresses showing up in HZ Rat attacks of that time.

Almost all of the C2 servers we found are sited in China. The exceptions are two addresses located in the US and the Netherlands.

We also found that the installation package mentioned above, according to VirusTotal, was previously downloaded from a domain belonging to MiHoYo, a Chinese video game developer:
hxxp://vpn.mihoyo[.]com/uploads/OpenVPNConnect.zip.
It is not yet known for sure how this file got to the legitimate domain and whether the company was hacked.

Conclusion

The macOS version of HZ Rat we found shows that the threat actors behind the previous attacks are still active. During the investigation, the malware was only collecting user data, but it could later be used to move laterally across the victim’s network, as suggested by the presence of private IP addresses in some samples. The collected data about victims’ companies and contact information could be used to spy on people of interest and lay the groundwork for future attacks. Also noteworthy is the fact that at the time of the study we had not encountered the use of two of the backdoor commands (write file to disk and send file to server), so the full scope of the attackers’ intentions remains unclear.

Indicators of compromise

MD5 file hashes
Backdoor
0c3201d0743c63075b18023bb8071e73 – Mach-O 64-bit x86_64 executable
6cc838049ece4fcb36386b7a3032171f – Mach-O 64-bit x86_64 executable
6d478c7f94d95981eb4b6508844050a6 – Mach-O 64-bit x86_64 executable
7a66cd84e2d007664a66679e86832202 – Mach-O 64-bit x86_64 executable
7ed3fc831922733d70fb08da7a244224 – Mach-O 64-bit x86_64 executable
9cdb61a758afd9a893add4cef5608914 – Mach-O 64-bit x86_64 executable
287ccbf005667b263e0e8a1ccfb8daec – Mach-O 64-bit x86_64 executable
7005c9c6e2502992017f1ffc8ef8a9b9 – Mach-O 64-bit x86_64 executable
7355e0790c111a59af377babedee9018 – Mach-O 64-bit x86_64 executable
a5af0471e31e5b11fd4d3671501dfc32 – Mach-O 64-bit x86_64 executable
da07b0608195a2d5481ad6de3cc6f195 – Mach-O 64-bit x86_64 executable
dd71b279a0bf618bbe9bb5d934ce9caa – Mach-O 64-bit x86_64 executable

Malicious installation package
8d33f667ca135a88f5bf77a0fab209d4 – Apple software package

C2 IP addresses
111.21.246[.]147
123.232.31[.]206
120.53.133[.]226
218.193.83[.]70
29.40.48[.]21
47.100.65[.]182
58.49.21[.]113
113.125.92[.]32
218.65.110[.]180
20.60.250[.]230

securelist.com/hz-rat-attacks-…

JUST SEND NOW THIS MESSAGE TO THE FACEBOOK PAGE facebook.com/facebook :

"STOP BANNING AND SHADOWBANNING POSTS AND NEWS ABOUT PALESTINE AND THE ONGOING GENOCIDE!"

--------------------------------------
#facebook #genocide #Gaza #Palestine #izrahell #massacre #warcrimes
mastodon.uno/@differx/11302882…
ko-fi.com/post/stop-banning-th…