Una recente scoperta ha portato alla luce una sofisticata tecnica che aggira il controllo dell’account utente (UAC) di Windows, consentendo l’escalation dei privilegi senza necessità di intervento utente, grazie all’uso dell’editor di caratteri privati, e suscitando preoccupazioni su scala mondiale tra gli amministratori di sistema.

L’attacco divulgato da Matan Bahar sfrutta eudcedit.exe l’editor di caratteri privati integrato di Microsoft, disponibile in C:WindowsSystem32, originariamente progettato per creare e modificare i caratteri definiti dall’utente finale (EUDC).

I ricercatori di sicurezza hanno scoperto che questa utility apparentemente innocua può essere sfruttata per aggirare il principale gatekeeper di sicurezza di Windows.

La falla di sicurezza è causata da impostazioni critiche integrate nel manifest dell’applicazione eudcedit.exe. Questa vulnerabilità è generata da due particolari tag di metadati. Questa combinazione si rivela particolarmente pericolosa. Quando UAC è configurato con impostazioni permissive come “Eleva senza chiedere conferma”, Windows eleva automaticamente eudcedit.exe da un livello di integrità medio ad uno alto senza visualizzare alcun avviso di sicurezza, ha affermato Bahar .

L’attacco si sviluppa attraverso una sequenza accuratamente studiata che sfrutta i meccanismi di gestione dei file dell’applicazione. Gli aggressori iniziano avviando l’editor di caratteri privati, che passa automaticamente al livello di integrità “Alta”. Accedono quindi alla funzionalità di collegamento dei font all’interno dell’interfaccia dell’applicazione, solitamente accessibile tramite il menu File.

La vulnerabilità critica si manifesta quando gli utenti selezionano le opzioni di collegamento dei font e viene richiesto di salvare i file. In questo frangente, il processo eudcedit.exe con privilegi elevati può essere manipolato per eseguire comandi arbitrari. Semplicemente inserendo “PowerShell” nella finestra di dialogo del file, gli aggressori possono generare una sessione PowerShell con privilegi elevati che eredita il livello di integrità elevato del processo padre.

Il bypass dell’UAC di eudcedit.exe dimostra come gli aggressori possano sfruttare le utilità di sistema legittime per raggiungere obiettivi dannosi. La semplicità e l’efficacia di questa tecnica la rendono una preoccupazione significativa per i team di sicurezza aziendale.

L'articolo Una nuova tecnica di Privilege Escalation (PE) consente il bypass del UAC su Windows proviene da il blog della sicurezza informatica.

Il cybercrime è sempre da condannare. Che tu colpisca una multinazionale o un piccolo negozio online, resta un crimine.

Ma quando prendi di mira ospedali, associazioni senza scopo di lucro, fondazioni che vivono di donazioni, il livello scende ancora più in basso. Non sei un “hacker” perché i criminali non si chiamano così, non sei un “genio del computer”.

Sei solo uno sciacallo digitale.

Rubare un account social è già un atto deplorevole. Ma violare la pagina Instagram della Fondazione Giulia Cecchettin – creata per onorare la memoria di una giovane donna uccisa dall’ex fidanzato – è qualcosa di infinitamente peggiore. È un colpo basso, un atto vile che travalica la sfera tecnologica per diventare una ferita emotiva e collettiva.

La sorella di Giulia, Elena Cecchettin, ha dato la notizia tramite una storia Instagram: “La nostra pagina è stata compromessa. Vi preghiamo di non rispondere a messaggi o richieste sospette. Siamo al lavoro per risolvere il problema“. Poche ore dopo, è arrivata la conferma: un attacco informatico mirato, con un messaggio intimidatorio lasciato nella bio dell’account: “Se volete indietro il vostro account, controllate la mail e contattatemi su Telegram.”

Un ricatto in piena regola, che dimostra quanto i criminali informatici senza scrupoli non conoscano limiti né rispetto. Questo non è “semplice” cybercrime. Questo è scempio: l’uso della tecnologia per colpire il dolore, per profanare uno spazio nato per sensibilizzare, per dare voce a una causa che riguarda tutti.

Ed è qui che la società deve rispondere compatta: non solo recuperando l’account, ma trasformando questo atto vile in un’ulteriore ragione per combattere chi sfrutta la rete per distruggere invece che per costruire. Perché la memoria di Giulia – e la battaglia della Fondazione – non si hackerano.

L'articolo Scempio Digitale: Instagram della Fondazione Giulia Cecchettin, la ragazza uccisa dall’ex fidanzato è stato hackerato proviene da il blog della sicurezza informatica.

The Internet is fighting over whether robots.txt applies to AI agents. It all started when Cloudflare published a blog post, detailing what the company was seeing from Perplexity crawlers. Of course, automated web crawling is part of how the modern Internet works, and almost immediately after the first web crawler was written, one managed to DoS (Denial of Service) a web site back in 1994. And the robots.txt file was first designed.

Make no mistake, robots.txt on its own is nothing more than a polite request for someone else on the Internet to not index your site. The more aggressive approach is to add rules to a Web Application Firewall (WAF) that detects and blocks a web crawler based on the user-agent string and source IP address. Cloudflare makes the case that Perplexity is not only intentionally ignoring robots.txt, but also actively disguising their webcrawling traffic by using IP addresses outside their normal range for these requests.

This isn’t the first time Perplexity has landed in hot water over their web scraping, AI learning endeavors. But Perplexity has published a blog post, explaining that this is different!

And there’s genuinely an interesting argument to be made,that robots.txt is aimed at indexing and AI training traffic, and that agentic AI requests are a different category. Put simply, perplexity bots ignore robots.txt when a live user asks them to. Is that bad behavior, or what we should expect? This question will have to be settled as AI agents become more common.

Breaking Into the Vault

Researchers at Cisco Talos took a look at the Dell ControlVault, a Hardware Security Module (HSM) built into many Dell laptops. The firmware running on these embedded processors had some problems, including a stack-overflow and other memory-related issues. Usually the potential for abuse of these kind of attacks is limited mostly to the theoretical realm, but this embedded HSM also includes accessible USB pins, that can be accessed with a custom connector. The vulnerabilities found, then represent a real attack scenario where the firmware on the HSM can be tampered with, via nothing more than physical access. To prove the point, the Talos write-up includes a great video of a compromised machine accepting a green onion as a valid fingerprint for Windows Login.

Trend Micro In the Wild

Trend Micro’s Apex One system is under active exploitation, as a pair of vulnerabilities allow an authenticated attacker to inject system commands in the system’s management console. The full fix is expected to roll out later this month, but a mitigation disables a specific feature of the console, the Remote Install Agent. This leads to the obvious conclusion that the installation process was allowing for code execution as part of the install process.

GreedyBear

There was an interesting malware campaign run this year, by a group that Koi Security is calling GreedyBear. The campaign could be called a blitz, where malicious browser extensions, ransomware binaries, and scammy websites were all employed at once, with the goal of stealing cryptocurrency. The surprising thing is that so far not much over $1 million has been reported as stolen through the campaign.

The first technique used was “Extension Hollowing”, where safe, boring browser extensions are published, and maintained for a few months. Good reviews come in naturally or are purchased, and the publisher appears trustworthy. Then the extension is updated, with malicious code suddenly shipping. These extensions are now sniffing for user input and form filled data.

The second technique used was the old classic, packing malware into cracked and pirated software. The source of many of these malicious binaries seems to be primarily Russian piracy sites.

The final approach discovered was the simple scam website, often typo-squatting on nearly-legitimate domain names. These sites advertised fake hardware wallets or wallet repair, but only existed to steal whatever information would-be customers were willing to share.

The question may be raised, why does Koi Security believe all this activity is connected? The answer boils down to a single IP address, 185.208.156.66. This was the Command and Control server for the entire network of activity, and should be seen as a definite red flag in logs and records.

HashiCorp Vault Audit

The fine folks at Cyata took a crack at HashiCorp’s Vault, a source available secrets storage solution. And they discovered a host of subtle but important issues. The first on the list is an outstanding find, and it deals with how Vault protects against brute-force attacks. It’s supposed to be a simple counter, that locks out password attempts for a while, once a threshold of failures has been reached. The problem is that usernames aren’t case sensitive, but the failure counter is case sensitive in tracking password failures. Tried guessing the admin password too many times? Try the Admin account next.

The Multi-Factor Authentication has some issues, like the TOTP code reuse protection. This attempts to enforce that a code is only used once while valid. The problem is that a code of “ 123456” and “123456” both evaluate the same for the TOTP valuation itself, but as different codes for the reuse protection. This could enable an attacker to first abuse the reuse protection error message to identify a valid but used code, and then insert the space to be able to use the code for authentication.

After authentication, this same style of attack is possible again, this time targeting the root policy protections. An admin cannot assign this “root” policy, but can assign a “ root” policy. Those are treated as different policy identifiers by the validation code, but the same thing in the final implementation.

And finally, they discovered a Remote Code Execution flaw, via plugin installation. This one requires admin access, but an information leak and an audit log that allows writing to anywhere on the disk is enough to execute code injected in that audit log. This seems to be the first RCE ever made public in Vault, which is an impressive statement for both Hashicorp and Cyata.

Bits and Bytes

Nvidia isn’t taking last week’s talk of backdoors laying down, taking the offensive this week to reassure everyone that “There are no back doors in NVIDIA chips.” There’s a separate bit of news that US lawmakers are considering legislation that would require a kill-switch and location verification in future hardware.

It’s reassuring to be reminded that cyber-criminals do get captured and extradited. A Nigerian man was arrested in France and is being extradited to the US on multiple charges of fraud, identity theft, and other crimes. No word on whether the Nigerian national was or has claimed to be a prince.

And finally, filed in the “awkward” category, Google has disclosed that they were also a victim in the Salesforce hacks that Google researchers discovered and first publicized. These were good-old social engineering campaigns, where the attacker contacted an employee at the target company, and convinces them to read off an eight-digit security code. A group calling itself ShinyHunters has started an exploitation campaign using data pilfered in the attacks.

hackaday.com/2025/08/08/this-w…

The Texas Instruments TP4056 is the default charge-controller chip for any maker or hacker working with lithium batteries. And why not? You can get perfectly-functional knockoffs on handy breakout boards from the usual online sources for pennies. Betteridge’s Law aside, [Lefty Maker] thinks that it may well be time to move on from the TP4056 and spends his latest video telling us why, along with promoting an alternative.

His part of choice is another TI chip, the BQ25185. [Lefty] put together his own charge controller board to show off the capabilities of this chip — including variable under- and over-charge protection voltages. Much of his beef with the TP4056 has less to do with that chip than with the cheap charge modules it comes on: when he crows about the lack of mounting holes and proper USB-PD on the knock-off modules, it occurs to us he could have had those features on his board even if he’d used a TP4056.

On the other hand, the flexibility offered by the BQ25185 is great to future-proof projects in case the dominant battery chemistry changes, or you just change your mind about what sort of battery you want to use. Sure, you’d need to swap a few resistors to set new trigger voltages and charging current, but that beats starting from scratch.

[Lefty Maker] also points out some of the advantages to making your own boards rather than relying on cheap modules. Namely, you can make them however you want. From a longer USB port to indicator LEDs and a built-in battery compartment, this charging board is exactly what [Lefty Maker] wants. Given how cheap custom PCBs are these days, it’s not hard to justify rolling your own.

The same cannot be said of genuine TI silicon, however. While the BQ25185 has a few good features that [Lefty Maker] points out in the video, we’re not sure the added price is worth it. Sure, it’s only a couple bucks, but that’s more than a 300% increase!

We’ve seen other projects pushing alternative charge controllers, but for now the TP4056 reigns as the easy option.

youtube.com/embed/8npqPz5fvnI?…

hackaday.com/2025/08/08/is-it-…

Ora... ognuno può pensarla come vuole e in molti penseranno che quest'uomo è un pazzo.

Ma metti che domani 'sto mostro esce dall'acqua e si fa un giretto sulla terraferma a favore di fotografi.

Steve Feltham potrà sparare un "VE L'AVEVO DETTO, STRONZI!" da cento megatoni.

😁😁😁

L’uomo che da 30 anni cerca il mostro di Loch Ness: ilpost.it/2022/11/10/uomo-cerc…

L’uomo che da 30 anni cerca il mostro di Loch Ness

Steve Feltham è arrivato sul lago scozzese nel 1991 e da allora passa le sue giornate scrutando l'acqua, invano

^{Il Post}

carabinieri.it/Internet/ImageS…

#ArmadeiCarabinieri
#notiziariostorico
@Storia