The First New Long Wave Radio Station Of This Millennium
The decline of AM broadcast radio is a slow but inexorable process over much of the world, but for regions outside America there’s another parallel story happening a few hundred kilohertz further down the spectrum. The long wave band sits around the 200kHz mark and has traditionally carried national-level programming due to its increased range. Like AM it’s in decline due to competition from FM, digital, and online services, and one by one the stations that once crowded this band are going quiet. In the middle of all this it’s a surprise then to find a new long wave station in the works in the 2020s, bucking all contemporary broadcasting trends. Arctic 252 is based in Finland with programming intended to be heard across the Arctic region and aims to start testing in September.
The hack in this is that it provides an opportunity for some low-frequency DXing, and given the arctic location, it would be extremely interesting to hear how far it reaches over the top of the world into the northern part of North America. The 252KHz frequency is shared with a station in North Africa that may hinder reception for some Europeans, but those with long memories in north-west Europe will find it fairly empty as it has been vacated in that region by the Irish transmitter which used to use it.
So if you have a receiver capable of catching long wave and you think you might be in range, give it a listen. Closer to where this article is being written, long wave stations are being turned off.
Harris & Ewing, photographer, Public domain.
Hackaday Links: August 11, 2024
“Please say it wasn’t a regex, please say it wasn’t a regex; aww, crap, it was a regex!” That seems to be the conclusion now that Crowdstrike has released a full root-cause analysis of its now-infamous Windows outage that took down 8 million machines with knock-on effects that reverberated through everything from healthcare to airlines. We’ve got to be honest and say that the twelve-page RCA was a little hard to get through, stuffed as it was with enough obfuscatory jargon to turn off even jargon lovers such as us. The gist, though, is that there was a “lack of a specific test for non-wildcard matching criteria,” which pretty much means someone screwed up a regular expression. Outside observers in the developer community have latched onto something more dire, though, as it appears the change that brought down so many machines was never tested on a single machine. That’s a little — OK, a lot — hard to believe, but it seems to be what Crowdstrike is saying. So go ahead and blame the regex, but it sure seems like there were deeper, darker forces at work here.
Congratulations, new parents; on top of everything else you’re dealing with, including raging sleep deprivation, there’s a good chance that your bundle of joy has just been bricked. It seems that something called a Snoo, an unbelievably expensive “smart bassinette,” has had its most useful features hidden behind a paywall, and parents are hopping mad. And rightly so; selling something for $1,700 with all the features activated only to pull back two-thirds of them unless the owner coughs up another $20 a month is a little unreasonable. Then again, back in the day we’d have gladly given someone twenty bucks a day if it helped get the kid to sleep, which the Snoo seems to do admirably well. And really, how long is the kid going to be in the thing anyway? Couple of months, tops. What’s another hundred or two when you’ve already spent nearly two grand? Still, we’d love to see someone hack one of these things, or even just do a teardown to see what makes it tick.
Dog lovers, listen up: the dog is OK. But not so much the dog owner’s apartment, as the not-goodest boy managed to burn the place down by gnawing on a lithium-ion battery pack. The entire event, which happened in Tulsa, Oklahoma in May, was captured on a security camera, which shows the moment the playful pup got his first mouthful of nastiness from a tooth penetrating the pack. The speed with which the fire took off is terrifying, but easy to understand since the dog bed where it started was essentially a big pile of tinder. Thankfully, the dog and his co-conspirators noped right out of the house through a doggie door, but it looks like the apartment was a total loss.
Have a project that needs a wiring harness? You might want to check out this cool harness designer. We haven’t had much chance to play with it yet, but it seems pretty cool. You select connectors, wire gauges, and lengths, and the app generates a BOM and wiring diagram.
And finally, in another case of the algorithm actually delivering for a change, we found this very good piece on the history of electrical distribution pylons. It’s heavily UK-centric, but that doesn’t get in the way at all. It not only goes over the history of pylons but also delves a bit into their engineering, both electrical and mechanical. As a bonus, it answers some of the questions you might never know you had, like what those little doo-dads attached to the wires near the insulators are.
post aggiornato e in continua revisione:
https://t.ly/mf9X
= slowforward.net/2021/06/23/nio…
#francisponge #frisbees #nioque #nioques #jeanmariegleize #giulianiccolai #deviazioni #idiomi #ossidiane #scritturediricerca #experimentalwriting #emiliovilla
If You Give A Dev A Tricked Out Xbox, They’ll Patch Halo 2
[Ryan Miceli] had spent a few years poring over and reverse-engineering Halo 2 when a friend asked for a favor. His friend created an improved Xbox with significant overclocks, RAM upgrades, BIOS hacks, and a processor swap. The goal was simple: patch the hardcoded maximum resolution from 480p to 720p and maybe even 1080p. With double the CPU clock speed but only a 15% overclock on the GPU, [Ryan] got to work.
Step one was to increase the size of the DirectX framebuffers. Increasing the output resolution introduced severe graphical glitches and rendering bugs. The game reuses the framebuffers multiple times as memory views, and each view encodes a header at the top with helpful information like width, height, and tiling. After patching that, [Ryan] had something more legible, but some models weren’t loading (particularly the water in the title screen). The answer was the texture accumulation layer. The Xbox has a hardware limitation of only sampling four textures per shader pass, which means you need a buffer the size of the render resolution to accumulate the textures if you want to sample more than four textures. Trying to boot the game resulted in an out-of-memory crash. The Xbox [Ryan] was working on had been upgraded with an additional 64MB of RAM, but the memory allocator in Halo 2 wasn’t taking advantage of it. Yet.
To see where the memory was going, [Ryan] wrote a new tool called XboxImageGrabber to show where memory was allocated and by whom. Most games make a few substantial initial allocations from the native allocator, then toss it over to a custom allocator tuned for their game. However, the extra 64MB of RAM was in dev consoles and meant as debug RAM, which meant the GPU couldn’t properly access it. Additionally, between the lower 64MB and upper is the Xbox kernel. Now, it became an exercise of patching the allocator to work with two blobs of memory instead of one contiguous one. It also moved runtime data into the upper 64MB while keeping video allocations in the lower. Ultimately, [Ryan] found it easier to patch the kernel to allow memory allocations the GPU could use in the upper 64MB of memory. Running the game at 720p resulted in only a semi-playable framerate, dropping to 10fps in a few scenes.
After some initial tests, [Ryan] concluded that it wasn’t the GPU or the CPU that was the bottleneck but the swap chain. Halo 2 turns VSync on by default, meaning it has to wait until a blank period before swapping between its two framebuffers. A simple tweak is to add a third frame buffer. The average FPS jumped 10%, and the GPU became the next bottleneck to tweak. With a light GPU overclock, the game was getting very close to 30fps. Luckily for [Ryan], no BIOS tweak was needed as the GPU clock hardware can be mapped and tweaked as an MMIO. After reverse engineering, a debugging feature to visual cache evictions, [Ryan] tuned the texture and geometry cache to minimize pop-ins that the original game was infamous for.
Overall, it’s an incredible hack with months of hard work behind it. The code for the patch is on Github, and there’s a video after the break comparing the patched and unpatched games. If you still need more Halo in your life, why not make yourself a realistic battle rifle from the game?
Moonbounce Music
There’s something inspiring about echos. Who among us hasn’t called out or clapped hands in a large space just to hear the sound reflected back? Radio takes this to a whole new level. You can bounce signals from buildings, aircraft, the ionisphere, or even the Moon itself. Humans have been bouncing radio waves from the moon for decades. It’s been used at war, and in peacetime. But [Hainbach] might be the first to use it for music.
Earth Moon Earth or EME communication is quite popular with amateur radio operators. With the right equipment, you can bounce a signal off the moon and hear the echo around 2.5 seconds later. The echo isn’t quite normal though. The moon and the earth are both rotating and moving in relation to each other. This causes Doppler shifts. At higher frequencies, even the craters and surface features of the moon can be heard in the echo.
[Hainbach] spent some time at a learning moonbounce at a large radiotelescope, He wanted to share this strange audio effect with the world. Unfortunately, most of us don’t have the large microwave dish required for this. The next best thing was to create an application which emulates the sound of a moon bounce. To this end, [Hainbach] created a Moon Echo, an audio plugin that emulates a moonbounce.
Moon Echo was created using sounds from a soprano signer and a double bass. [Hainbach] had to be careful not to be too musical, as ham operators are not allowed to broadcast music. This meant all the tests had to be broken into short non-musical clips. Rolling all this empirical data into a model took quite a bit of work, but the end result is worth it.
If you’d like to learn how to moonbounce yourself, check this article out.
RunZero Lancia SSHamble: Nuovo Strumento per Testare le Vulnerabilità del Protocollo SSH
RunZero, un’azienda nota per le sue soluzioni di sicurezza informatica, ha introdotto un nuovo strumento chiamato SSHamble progettato per verificare l’implementazione del protocollo SSH per vulnerabilità ed errori di configurazione.
SSH (Secure Shell) viene utilizzato ovunque: dai dispositivi e server di rete alle applicazioni e agli strumenti per il trasferimento dei dati. Tuttavia, nonostante la popolarità di OpenSSH, esistono molte altre implementazioni di questo protocollo e ognuna potrebbe presentare problemi specifici.
Durante lo studio, gli specialisti di RunZero hanno scoperto un numero significativo di vulnerabilità in varie implementazioni SSH che potrebbero portare a gravi violazioni della sicurezza. Molti di questi problemi non sono stati rilevati a causa della mancanza di strumenti per testare in modo approfondito tutti i livelli del protocollo SSH.
SSHamble è stato creato per colmare questa lacuna. Questo strumento consente di simulare potenziali attacchi e scenari come l’accesso remoto non autorizzato, l’esecuzione di comandi al termine di una sessione e la fuga di informazioni attraverso richieste di autenticazione incontrollate.
SSHamble fornisce una shell interattiva che consente l’accesso alle richieste SSH in un ambiente post-sessione, semplificando il test di vari aspetti di sicurezza come la gestione dell’ambiente, la gestione dei segnali e il port forwarding.
L'articolo RunZero Lancia SSHamble: Nuovo Strumento per Testare le Vulnerabilità del Protocollo SSH proviene da il blog della sicurezza informatica.
Mike Masnick joins the Bluesky Board, new ideas on microblogging focused on specific topics, and more.
[share author='Laurens Hof' profile='https://fediversereport.com/author/laurenshof/' avatar='https://poliverso.org/photo/206608119366e42c304ffac007248590-5.jpeg?ts=1734620326' link='https://fediversereport.com/last-week-in-fediverse-ep-79/' posted='2024-08-11 17:09:02' guid='08552256-1ddb98c771664f15-878de609' message_id='https://fediversereport.com/last-week-in-fediverse-ep-79/']Last Week in Fediverse – ep 79
While we’re busy enjoying the summer (or the Olympics), here is this week’s fediverse news.
The News
Mike Masnick, author of the ‘Protocols, not Platforms‘ paper has joined Bluesky’s Board of Directors. There has been a seat available since Jack Dorsey suddenly left the board a few months ago. In his personal announcement post, Masnick says that ‘Bluesky is the service that is coming closest to making the vision I articulated in my paper a reality‘. Masnick also explains that one of the key aspects that excites him about Bluesky is how ‘they recognize how a future version of the company could, itself, be a threat to the vision the current team has. As a result, they are designing the system to be technically resistant to such a threat.’
With the current implementation of Bluesky, two parts of the architecture (the Relay and the AppView) are theoretically decentralised, but with no incentive structure for other people to also run an alternative part of the infrastructure, nobody actually has done so. Furthermore, the Identity part of Bluesky is still fully centralised and under control of Bluesky, with no clear path to change this. This places Bluesky significantly behind other major fediverse software, who are all already fully resistant to future self-harm. As Masnick values this principle, it is worth seeing how his position on the board will influence the direction of the development of the AT Protocol.
Two new fediverse projects that stand out to me for a similar reason; they both shift away from ‘microblogging about anything you want’ to a community that is clearly defined by interests or topics. CollabFC is a football-based social network, that creates a specific network for football clubs. When you join a hub for a club, such as Liverpool for example, you have the possibility for a ‘local’ feed dedicated to Liverpool, as well as a feed for all other football instances. Gush is a platform that is in development for talking about video games. Part review site similar to BookWyrm and NeoDB, it focuses on posting about specific games. What is different about it is that each game ‘a first-class object that you can reference and share across the fediverse’. Both of these platforms are early in their lifecycle, but point in a direction of more focused discussion on fediverse platforms.
Bonfire shared some more information about their upcoming platform Mosaic. Full details will be available in September, but it looks like a front-end UI for displaying posts as a website instead of the regular feeds. Something similar is Servus, a CMS for Nostr, or Npub.pro, which are both experiments for Nostr to display posts not as a feed but a website as well. Meanwhile, the main aspect that is holding up the release of the ‘main’ version of Bonfire is a slow performance, and the Bonfire team put out two bounties for developers to help them fix this issue.
Threads held an AMA about the fediverse with Flipboard’s Mike McCue and Blockparty’s Tracy Chou. It seems relevant that Threads wants to promote their fediverse connection by hosting an AMA on their main account, but there were little answers that stood out or provided new information, with most answers talking more about a conceptual understanding of what the fediverse could be, more than what the actual rest of the fediverse outside of Threads actually looks like.
Manyfold is an open source self hosted platform for sharing your 3d printer files. They have been working on adding ActivityPub support, and the latest update added experimental early stage support for ActivityPub.
Link aggregator platform Kbin is getting closer and closer to being completely dead, with the main flagship instance kbin.social now also being offline. The lead developer could not keep up with work on the platform due to personal reasons for a while now. The project has been superseded by the hard fork Mbin, which has been around for a while now, and got another update this week.
The Links
- Newsmast’s Michael Foster writes about ‘how can we persuade organisations and creators that it makes sense to federate using tools they already have in place’.
- Bandwagon, the upcoming fediverse music sharing platform, is expanding their beta test.
- Buffer recently added support for Bluesky, and the Buffer CEO wrote a blog post about the significance of Bluesky and decentralised social networks.
- Elena Rossini’s newsletter ‘The Future is Federated’ does an extensive deep dive into Friendica.
- WeDistribute takes a closer look at the successful ‘Mastodon for Harris’ campaign, which raised over half a million USD.
- Bluesky is summoning a community marketing manager.
- The new video series Fediverse Files by WordPress.com has a second episode in which they interview Evan Prodromou about ActivityPub.
- Font Awesome for the fediverse, with Decentralised Social Icons, by WeDistribute.
- A blog by Smoke Signal, an upcoming event platform build on top of atproto, about building communities with atproto.
- Mastodon posted an update about the first half of 2024 for their Patreon supporters.
- A closer look at the new features in Newsmast latest update.
- For the atproto devs: an atproto browser.
- Owncast Newsletter August 2024.
- TechLinked discusses the fediverse and how the web is different now in their podcast.
- IFTAS Connect July 2024 roundup. IFTAS is also looking for admin support while they are seeking funding to continue their work on building an opt-in content classifier to detect CSAM.
- A proof of concept for fediverse spam filtering.
- This week’s fediverse software updates.
That’s all for this week, thanks for reading!
A Tiny Knob Keeps You In Control
There are many forms of human interface device beyond the ubiquitous keyboard and mouse, but when it comes to fine-tuning a linear setting such as a volume control there’s nothing quite like a knob. When it comes to peripherals it’s not the size that matters, as proven by [Stefan Wagner] with the Tiny Knob. It’s a very small PCB with a rotary encoder and knob, an ATtiny85, a USB port, and not much else.
It uses the V-USB software implementation of USB HID, and should you have a need for a Tiny Knob of your own you can find all the files for it in a GitHub repository. There’s even a very professional-looking 3D-printed enclosure for the finishing touch. We like this project for its simplicity, and we think you might too.
Over the years we’ve brought you more than one knob, they appear to be a popular subject for experimentation. If you’re up for more, have a look at this one.
[r] _ “l’attore in quanto soggetto, non l’attore in quanto io” / cb nel 1988
replica di un altro post di tempo fa su slowforward:
slowforward.net/2024/08/11/r-_…
[r] _ trent’anni fuori orario – notte senza fine – carmelo bene (2020)
replica di un post di qualche tempo fa su slowforward:
slowforward.net/2024/08/11/r-_…
Achieving Human Level Competitive Robot Table Tennis
A team at Google has spent a lot of time recently playing table tennis, purportedly only for science. Their goal was to see whether they could construct a robot which would not only play table tennis, but even keep up with practiced human players. In the paper available on ArXiv, they detail what it took to make it happen. The team also set up a site with a simplified explanation and some videos of the robot in action.Table tennis robot vs human match outcomes. B is beginner, I is intermediate, A is advanced. (Credit: Google)
In the end, it took twenty motion-capture cameras, a pair of 125 FPS cameras, a 6 DOF robot on two linear rails, a special table tennis paddle, and a very large annotated dataset to train multiple convolutional network networks (CNN) on to analyze the incoming visual data. This visual data was then combined with details like knowledge of the paddle’s position to churn out a value for use in the look-up table that forms the core of the high-level controller (HLC). This look-up table then decides which low-level controller (LLC) is picked to perform a certain action. In order to prevent the CNNs of the LLCs from ‘forgetting’ the training data, a total of 17 different CNNs were used, one per LLC.
The robot was tested with a range of players from a local table tennis club which made clear that while it could easily defeat beginners, intermediate players pose a serious threat. Advanced players completely demolished the table tennis robot. Clearly we do not have to fear our robotic table tennis playing overlords just yet, but the robot did receive praise for being an interesting practice partner.
Elena Brescacin likes this.
L’overtourism: sfruttamento dei luoghi pubblici, guadagno dei privati l Contropiano
«“Il turismo è diventato sempre più una risorsa per pochi e un problema per molti”. Questa è la frase cardine di una piccola inchiesta che Contropiano ha riportato (profeticamente) nel 2019. Il focus era il problema che oggi sta cominciando ad essere notato anche dai media mainstream. Le manifestazioni e le proteste, più o meno partecipate, che stanno fiorendo nelle grandi mete turistiche europee: Spagna e Portogallo davanti a tutti, ma che si ritrovano anche nella Grecia a partire dallo scorso anno.»
Inside the Mecanum Wheel
If you make anything that moves, like a robot, you quickly realize that turning can be a pain. That’s why there are a number of designs for wheels that can go in different directions. One of the most common is the mechanum wheel. [Jeremy] explains how they work by filming them from below on a transparent table. You can see the enlightening video below.
If you haven’t done anything with omni wheels before, it is disconcerting to see wheels rotating one way causing the vehicle to move at a right angle to the rotation. But this is very useful when you build robots or — as he shows at the start of the video — a forklift.
Mechanum wheels are similar to omni wheels, but with some differences. In particular, omni wheels have rollers at a 90-degree angle so they drag in the “wrong” direction. The mecanum rollers are at 45-degree angle. That might seem like a small difference, but it means that all rotation translates and requires some vector math, as the video points out.
Many years ago, we were surprised to learn you could build strange wheels from wood. We like using omni wheels in a three-wheel configuration often called a Kiwi drive.
Il Remote Access Trojan StrRat torna in Italia. CERT-AgID effettua una analisi
Questa settimana il malware StrRat ha nuovamente interessato il territorio italiano. Il CERT-AGID è quindi tornato a studiare il nuovo campione al fine di fornire un rapido strumento di decodifica per gli analisti.
Ricordiamo che StrRat è un Remote Access Trojan (RAT) scritto in Java e progettato principalmente per il furto di informazioni, dotato anche di funzionalità di backdoor.
Utilizza un’architettura a plugin per offrire accesso remoto completo agli aggressori e include funzionalità mirate al furto di credenziali, al keylogging e all’integrazione di plugin aggiuntivi.
Posizione e contenuto del file “config.txt“
Poiché tutte le informazioni utili relative al C2, alla porta e al URL per il download dei plugin, sono cifrate all’interno del file config.txt a corredo e la decodifica è stata già documentata, il CERT-AgID ha creato una ricetta CyberChef che sfrutta funzioni avanzate per facilitare e accelerare il processo di decodifica.
Ricetta CyberChef
Il concetto è semplice: la ricetta prende un input codificato in Base64, lo decodifica in esadecimale, pulisce il testo rimuovendo spazi bianchi, estrae la chiave e IV, deriva una chiave utilizzando PBKDF2 e infine utilizza AES per decrittare i dati rimanenti. Il tutto è basato su una chiave segreta generata a partire dalla password nota “strigoi“.
Link: Ricetta CyberChef
Nota: La ricetta è efficace per tutti i campioni di StrRat rilevati negli ultimi 3 anni, poiché sono basati sulla password nota ‘strigoi’. Tuttavia, se la password dovesse cambiare, potrebbe essere necessario aggiornare la ricetta per continuare a garantire la decodifica corretta.”
Indicatori di Compromissione
Al fine di rendere pubblici i dettagli del campione analizzato si riportano di seguito gli IoC ricavati:
Link: Download IoC
L'articolo Il Remote Access Trojan StrRat torna in Italia. CERT-AgID effettua una analisi proviene da il blog della sicurezza informatica.
Campagna di Donald Trump sotto attacco! Fuoriusciti documenti interni. “siamo sia l’exploit, la vulnerabilità e la mitigazione”
Dopo lo svolgimento delle elezioni europee le attenzioni geopolitiche si sono spostate nella campagna elettorale USA, una tra le più dinamiche negli ultimi anni anche sulla base del recente cambio di testimone dei democratici con Harris come nuova candidata. Le controversie non sono mancate : Elon Musk ha preso una posizione netta pubblicando video AI a sfavore della candidata Harris, una raccolta fondi record per la campagna dei democratici e Trump ferito da un’arma da fuoco durante un comizio.
Quest’ultimo è stato un protagonista anche all’interno degli ambienti del crimine digitale, alcuni dei lettori ricorderanno il (presunto) attacco a Fulton County da parte di LockBit. LockBitSupp ha dichiarato di essere in possesso di documenti che avrebbero “messo a rischio” le elezioni di questo Novembre. Sempre secondo l’evil CEO sarebbe stato questo il casus belli di Operation Cronos, dopo il termine del countdown il post su DLS è sparito senza nessun documento pubblicato lasciando forti dubbi sulle dichiarazioni pubbliche di LB.
Ancora una volta il candidato Repubblicano si trova nell’occhio del ciclone per un altro attacco informatico rivelato da POLITICO che avrebbe portato alla fuoriuscita di alcune comunicazioni interne.
Robert – Ambasciatore non porta pena
La notizia è stata pubblicata da POLITICO che avrebbe ricevuto email anonime contenenti file riguardanti l’amministrazione interna di Trump dal 22 Luglio 2024 firmate da “Robert”. L’amministrazione, nella giornata di Sabato 10 Agosto 2024, ha ufficialmente dichiarato di essere stata vittima dell’attacco con una dichiarazione diretta del portavoce della campagna Repubblicana Cheung :
“These documents were obtained illegally from foreign sources hostile to the United States, intended to interfere with the 2024 election and sow chaos throughout our Democratic process. On Friday, a new report from Microsoft found that Iranian hackers broke into the account of a ‘high ranking official’ on the U.S. presidential campaign in June 2024, which coincides with the close timing of President Trump’s selection of a vice presidential nominee.”
“The Iranians know that President Trump will stop their reign of terror just like he did in his first four years in the White House.”
Il report citato è stato pubblicato Venerdì 9 Agosto 2024 nella quale Microsoft ha deciso di condividere le informazioni raccolte (“sharing intelligence”) riguardo le azioni Iraniane volte a compromettere le elezioni di Novembre all’interno del mondo informatico. Le suddette operazioni sono state divise in due classi distinte :
- Campagne di influenza nei swing states : siti di notizie come Nio Thinker e Savannah Time, contenenti veri e propri insulti a Trump e alla sua amministrazione, suggeriscono una generazioni di contenuti tramite AI e plagi ad altri siti d’informazioni statunitensi. Secondo Microsoft il gruppo Storm-2035 sarebbe responsabile della creazione e moderazioni di questi siti ed altre operazioni analoghe in paesi Europei come Spagna e Francia dal 2020
- Exfiltration di intelligence riguardante la campagna elettorale : il 13 Giugno 2024, sempre secondo Microsoft, Mint Sandstorm (gruppo legato ai Islamic Revolutionary Guard Corps) ha cercato di loggare su “un account appartenente a un ex candidato presidente” senza successo ma sopratutto ha inviato una email di spear-phishing a un “alto ufficiale di una campagna presidenziale” senza specificare il partito. L’email sarebbe stata inviata da un indirizzo compromesso di un consigliere senior contenente un hyperlink a un traffic redirector appartenente agli attacanti. Questa procedura sarebbe similare a una operazione del 2020 non meglio specificata.
Il report completo non contiene solamente informazioni su gruppi Iraniani ma anche Russi e cinesi ipotizzando una cooperazione tra questi stati. Viene portato il focus sull’Iran per una loro peculiarità : mentre le altre due nazioni tendono a influenzare i risultati delle elezioni, lo stato medio-orientale punta su progetti a lungo termine, con metodologie diverse e una maggiore aggressività.
Dichiarazioni, trasparenza e risultati
POLITICO ha tenuto a precisare che la minaccia non è stata individuata in maniera indipendente ma si affida alle dichiarazioni fatte dal portavoce Repubblicano. Cheung ha declinato di esplicitare se lo staff interno ha contatto forze dell’ordine o Microsoft per volontà di non “discutere questo tipo di conversazioni”. POLITICO ha invitato Microsoft a commentare il report e la (plausibile) connessione con l’annuncio dell’attacco avvenuto a un giorno di distanza, la big tech ha declinato confermando però di non essere riuscita ad identificare il partito politico vittima dei gruppi Iraniani.
Chiaramente POLITICO non ha pubblicato i file ricevuti, nel caso fossero reali la loro pubblicazione ricadrebbe in un crimine federale trattandosi di dati ottenuti in maniera illecita senza il consenso dell’amministrazione. È stato però detto che tra i contenuti ricevuti sono presenti comunicazioni interne di un ufficiale senior e un dossier del senatore JD Vance, il “running mate” di Donald J. Trump. “Robert” etichetta dichiarazioni passate di Vance come “POTENTIAL VULNERABILITIES” e dichiara di essere in possesso di un documento simile riguardante il Senatore Marco Rubio assieme ad una varietà di documenti legali e giudiziari riguardanti Trump e discussioni interne alla amministrazione della campagna.
Per quanto riguarda il report di Microsoft sembra ben strutturato e i suoi contenuti sono in linea con altri lavori simili riguardanti le relazioni APT, espionaggio digitale ed influenze di processi politici. Differisce molto da quello che si è deciso di pubblicare : nessuno IOC, nessuna prova tecnica e nessun indizio che potesse ricostruire in maniera più chiara la email di spear phishing inviata. Suona alcuanto strano che non si sappia il partito vittima del gruppo medio-orientale ma si sappia ricostruire l’attack flow e che l’indirizzo mittente compromesso appartenga ad un’altro alto ufficiale politico. Probabilmente per motivi di integrità delle operazioni di intelligence si sono limitati alla sola esposizione dei risultati ottenuti senza darne però gli indizi. La data di pubblicazione di appena un giorno precedente all’annuncio di POLITICO è peculiare anche se può trattarsi di una grottesca coincidenza.
Le dichiarazioni di Cheung sono forti, coincise e decise. La certezza della colpevolezza degli Iraniani espressa del portavoce presuppone uno svolgimento di indagini da quando sono venuti a conoscenza del breach, si può però ritenere inopportuno il non dichiare se le forze dell’ordine sono state in contatto con lo staff di Trump in particolare quando è in gioco il processo democratico di un’intera nazione.
Non rimane che attendere lo svolgimento dei fatti e aspettarsi un potenziale data leak totalmente diverso da quello promesso da LB ad inizio anno.
Exciting times in the world right now…
Le faide informatiche tra Iran e USA non sono un qualcosa di nuovo e nessuno dovrebbe stupirsi della notizia divulgata da POLITICO, qualsiasi sia il reale avvenimento dei fatti che per ora è di difficile interpretazione. Da stuxnet in poi governi, stati e politici hanno compreso come l’utilizzo della rete può essere il battleground d’eccelenza sulla quale portare le proprie battaglie. Un territorio enigmatico ma allo stesso tempo coinvolgente per la società tutta. Tramite l’informatica stiamo assistendo a movimenti storici come guerre, polarizzazioni politiche, violenze, proteste e dissidi geopolitici ma è oramai chiaro che è anche il modo per la quale questi eventi vengono influenzati e non solo visionati.
La guerra in Ucraina e la situazione nella striscia di Gaza non sono più operazioni strettamente cinetiche ma sono il pivot per colpire le persone che vivono dall’esterno questi avvenimenti. Si cerca di usarle come pretesto per confondere e far collidere le nazioni indirettamente coinvolte su se stesse. È l’hack più grande della storia e tutti noi siamo sia l’exploit, la vulnerabilità e la mitigazione.
Abbiamo reso una tecnologia creata per liberarsi dai bias, purtroppo, nella chiave di volta per crearne di nuovi. America (scandalo Cambridge Analytica), Russia (utilizzo di disinformazione in paesi esteri come concetto di information warfare), Cina (utilizzo di social media e bot per propaganda), Israele (Pallywood) ed anche l’Iran (false email Proud Boys) stanno solo sfruttando la mancanza di attenzione e facile suscettibilità delle diverse popolazioni negli stati.
La direzione delle politiche (sia interne che estere) e dei metodi di comunicazioni si stanno semplicemente adattando agli utenti finali che non vogliono cambiare assieme al mondo. L’utilizzo di semplici bot o contenuti creati da AI sono solo specchio di un metodo semplice ma efficace per il modo di pensare di alcuni individui, persone che votano in base a quello che vogliono sentirsi dire e non da quello che vedono davvero.
Come già detto per il caso CrowdStrike, oramai la sicurezza informatica non è più solo misure tecniche ma è il giusto interfacciarsi con la società, esplorando i rischi e le miancce reali che non puntano più solo ad attivare un malware in una macchina da remoto ma avanzano pian piano fino a portare al Denial of Service di quella che noi chiamiamo libertà di informazione.
L'articolo Campagna di Donald Trump sotto attacco! Fuoriusciti documenti interni. “siamo sia l’exploit, la vulnerabilità e la mitigazione” proviene da il blog della sicurezza informatica.
RipperSec rivendica un attacco DDoS alla Ferrari
Recentemente il Gruppo Hacktivista “RipperSec” ha rivendicato di aver attaccato il sito globale di Ferrari in nome della giustizia per la Palestina.
Il gruppo hacktivista noto come “RipperSec” ha rivendicato la responsabilità di un attacco DDoS (Distributed Denial of Service) che ha messo in disservizio parziale e per un breve periodo il sito web globale di Ferrari.
In un post condiviso su Telegram, il gruppo ha pubblicato uno screenshot che mostra il sito di Ferrari con un errore 500, evidenziando il successo del loro attacco.
Al momento, il sito risulta essere perfettamente online.
Il messaggio di “RipperSec” non si limita solo a rivendicare l’attacco, ma include anche un forte messaggio politico: “Aprite gli occhi, questo è genocidio, non autodifesa”, accompagnato dagli hashtag #FreePalestine e #ForJustice.
Questo chiarisce che l’azione del gruppo è motivata da una protesta contro quella che percepiscono come un’ingiustizia verso il popolo palestinese.
A sostegno delle loro affermazioni, il gruppo ha condiviso un link a un report su “check-host.net” che sembra fungere da prova dell’attacco riuscito.
Il logo utilizzato da RipperSec, che include un teschio coronato e due leoni rampanti, rafforza l’immagine di un’organizzazione pronta a combattere per le proprie convinzioni di hacktivismo.
Il caso evidenzia ancora una volta come, in un contesto dove le motivazioni politiche e sociali possono innescare azioni di cyber-attivismo su larga scala, le aziende globali possono essere vulnerabili a questo genere di attacchi.
Sembra che il gruppo RipperSec non si fermerà qui e potrebbe già avere in mente nuovi obiettivi per portare avanti la loro campagna.
Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione da parte dell’azienda qualora voglia darci degli aggiornamenti sulla vicenda. Saremo lieti di pubblicare tali informazioni con uno specifico articolo dando risalto alla questione.
RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono utilizzare la mail crittografata del whistleblower.
L'articolo RipperSec rivendica un attacco DDoS alla Ferrari proviene da il blog della sicurezza informatica.
Proxxon CNC Conversion Makes a Small Mill a Bit Bigger
The Proxxon MF70 mini-mill is a cheap and cheerful, but decently made little desktop mill. As such, it’s been the target of innumerable CNC-ification projects, including an official kit from the manufacturer. But that didn’t stop [Dheera Venkatraman] from sharing his Big Yellow take on this venerable pursuit with us!
This isn’t simply a CNC modification, it’s a wholly 3D-printed CNC modification, which means that you don’t already need a mill to make the usual aluminum pieces to upgrade your mill. And perhaps the standout feature: [Dheera]’s mod basically doubles the Y-axis travel and adds an extra 15 mm of headroom to the Z. If you wanted to stop here, you would have a bigger small manual mill, but as long as you’re at it, you should probably bolt on the steppers and go CNC. It’s your call, because both models are included.
[Dheera] also built a nice enclosure for the MF70, which makes sense because it’s small enough that it could fit on your desktop, and you don’t want it flinging brass chips all over your bench. But as long as it’s on your desk, why not consider a soundproof enclosure for the MF70? Or take the next step, make a nice wooden box, mount a monitor in it, and take the MF70 entirely portable, like this gonzo hack from way back in 2012.
Trump campaign says it was hacked, blames Iran
Donald Trump's US presidential campaign said on Saturday (10 August) some of its internal communications were hacked and blamed the Iranian government, citing past hostilities between Trump and Iran without providing direct evidence.
Potential Cure For All of England’s Beta Thalassemia Patients Within Reach
Beta thalassemia and sickle cell are two red blood cell disorders which both come with massive health implications and shortened lifespans, but at least for UK-based patients the former may soon be curable with a fairly new CRISPR-Cas9 gene therapy (Casgevy) via the UK’s National Health Service (NHS). Starting with the NHS in England, the therapy will be offered to the approximately 460 β thalassemia patients in that part of the UK at seven different NHS centers within the coming weeks.
We previously covered this therapy and the way that it might offer a one-time treatment to patients to definitely cure their blood disorder. In the case of β thalassemia this is done by turning off the defective adult hemoglobin (HbA) production and instead turning the fetal hemoglobin (HbF) production back on. After eradicating the bone marrow cells with the defective genes, the (externally CRISPR-Cas9 modified) stem cells are reintroduced as with a bone marrow transplant. Since this involves the patient’s own cells, no immune-system suppressing medication is necessary, and eventually the new cells should produce enough HbF to allow the patient to be considered cured.
So far in international trials over 90% of those treated in this manner were still symptom-free, raising the hope that this β thalassemia treatment is indeed a life-long cure.
Top image: A giemsa stained blood smear from a person with beta thalassemia. Note the lack of coloring. (Credit: Dr Graham Beards, Wikimedia Commons)
IL partito reform UK ha tracciato i dati dei visitatori del sito per poi venderli a terzi con finalità di profilazione a fini pubblicitari e di influenza politica
like this
WAPEETY reshared this.
Robot Arm Gives Kids the Roller Coaster Ride of their Lives
Unfortunately, [Dave Niewinski]’s kids are still too little to go on a real roller coaster. But they’re certainly big enough to be tossed around by this giant robot arm roller coaster simulator.
As to the question of why [Dave] has a Kuka KR 150 robot in his house, we prefer to leave that unasked and move forward. And apparently, this isn’t his first attempt at using the industrial robot as a motion simulator. That attempt revealed a few structural problems with the attachment between the rider’s chair and the robot’s wrist. After redesigning the frame with stouter metal and adding a small form-factor gaming PC and a curved monitor in front of the seat, [Dave] was ready to figure out how to make the arm simulate the motions of a roller coaster.
Now, if you ever thought the world would be a better place if only we had a roller coaster database complete with 4k 60 fps video captured from real coasters, you’re in luck. CoasterStats not only exists, but it also includes six-axis accelerometer data from real rides of coasters across Europe. That gave [Dave] the raw data he needed, but getting it translated into robot motions that simulate the feeling of the ride was a bit tricky. [Dave] goes into the physics of it all in the video below, but suffice it to say that the result is pretty cool.
More after the break.
Before anyone gets the urge to call Family Services and report [Dave], know that he seems to have taken great care not to build something that’ll turn the kids into jelly. He describes the safety systems in an earlier video, but the basics are laser light curtains to keep the arm within a small safe window, an e-stop switch, and limiting the acceleration to 1 g even when the real coaster would be giving its riders a good beating. That’s probably less than something like this real backyard coaster generates.
3D Printed Jet Engine Goes Turbo
Printing a model jet engine is quite an accomplishment. But it wasn’t enough for [linus3d]. He wanted to redesign it to have a turbojet, an afterburner, and a variable exhaust nozzle. You can see how it all goes together in the video below.
This took months of work and it shows. This probably won’t make a good rainy-day weekend project. You do need a few ball bearings and some M2 hardware, but it is mostly 3D printed.
True turbojets are most often found on military planes. They are loud, don’t perform well at low speeds, and are generally not very efficient. A variation, the turbofan, is what you usually find on passenger jets. They are quieter and work better at low speeds, but have more parts and, thus, more maintenance.
Unlike a true turbojet, turbofan engines have a cold section and a hot section. The bypass ratio refers to how much air flows through the cold path relative to the amount flowing through the hot path. This cold air provides additional thrust, making the turbofan engine more efficient, especially at lower speeds. The reduced demand on the hot air thrust also reduces the amount of noise.
Plastic isn’t going to cut it for a real jet engine, although you can 3D print some parts of one. Bonus hacker cred if you build your jet engine by hand.
ko-fi per seguire differx, slowforward e altri spazi di ricerca artistica e letteraria
ko-fi non è solo un modo di supportare differx, slowforward eccetera, ma è anche uno spazio di link e informazioni