Campagne zero-day e ransomware su larga scala: più attacchi ma meno riscatti
📌 Link all'articolo : redhotcyber.com/post/campagne-…
#redhotcyber #news #cybersecurity #hacking #malware #ransomware #vulnerabilita #zeroDay #estorsione #dati
Campagne zero-day e ransomware su larga scala: più attacchi ma meno riscatti
Le campagne di estorsione di dati su larga scala stanno perdendo efficacia. Scopri come le aziende stanno cambiando atteggiamento e come i gruppi criminali stanno cambiando tattica.Bajram Zeqiri (Red Hot Cyber)
Cybersecurity & cyberwarfare reshared this.
Humanoid presenta KinetIQ: il sistema di controllo degli sciami robot
📌 Link all'articolo : redhotcyber.com/post/humanoid-…
#redhotcyber #news #robotica #intelligenzaartificiale #sistemidigestiorobot #kinetiq #humanoid #robot #autonomia
Humanoid presenta KinetIQ: il sistema di controllo degli sciami robot
Un sistema di controllo robotico che gestisce un'intera flotta di macchine, assegnando compiti e monitorando i risultati in ambienti industriali e domestici.Redazione RHC (Red Hot Cyber)
Cybersecurity & cyberwarfare reshared this.
Why Haven’t Quantum Computers Factored 21 Yet?
If you are to believe the glossy marketing campaigns about ‘quantum computing’, then we are on the cusp of a computing revolution, yet back in the real world things look a lot less dire. At least if you’re worried about quantum computers (QCs) breaking every single conventional encryption algorithm in use today, because at this point they cannot even factor 21 yet without cheating.
In the article by [Craig Gidney] the basic problem is explained, which comes down to simple exponentials. Specifically the number of quantum gates required to perform factoring increases exponentially, allowing QCs to factor 15 in 2001 with a total of 21 two-qubit entangling gates. Extrapolating from the used circuit, factoring 21 would require 2,405 gates, or 115 times more.
Explained in the article is that this is due to how Shor’s algorithm works, along with the overhead of quantum error correction. Obviously this puts a bit of a damper on the concept of an imminent post-quantum cryptography world, with a recent paper by [Dennish Willsch] et al. laying out the issues that both analog QCs (e.g. D-Wave) and digital QCs will have to solve before they can effectively perform factorization. Issues such as a digital QC needing several millions of physical qubits to factor 2048-bit RSA integers.
New academic research has found that Chrome's new MV3 extension API is not that bad after all
"Ad blocker providers appear to have successfully navigated the MV3 update, finding solutions that maintain the core functionality of their extensions"
reshared this
A Working Intercom From Antique Telephones
Although it can be hard to imagine in today’s semiconductor-powered, digital world, there was electrical technology around before the widespread adoption of the transistor in the latter half of the 1900s that could do more than provide lighting. People figured out clever ways to send information around analog systems, whether that was a telegraph or a telephone. These systems are almost completely obsolete these days thanks to digital technology, leaving a large number of rotary phones and other communications systems relegated to the dustbin of history. [Attoparsec] brought a few of these old machines back to life anyway, setting up a local intercom system with technology faithful to this pre-digital era.
These phones date well before the rotary phone that some of us may be familiar with, to a time where landline phones had batteries installed in them to provide current to the analog voice circuit. A transformer isolated the DC out of the line and amplified the voice signal. A generator was included in parallel which, when operated by hand, could ring the other phones on the line. The challenge to this build was keeping everything period-appropriate, with a few compromises made for the batteries which are D-cell batteries with a recreation case. [Attoparsec] even found cloth wiring meant for guitars to keep the insides looking like they’re still 100 years old. Beyond that, a few plastic parts needed to be fabricated to make sure the circuit was working properly, but for a relatively simple machine the repairs were relatively straightforward.
The other key to getting an intercom set up in a house is exterior to the phones themselves. There needs to be some sort of wiring connecting the phones, and [Attoparsec] had a number of existing phone wiring options already available in his house. He only needed to run a few extra wires to get the phones located in his preferred spots. After everything is hooked up, the phones work just as they would have when they were new, although their actual utility is limited by the availability of things like smartphones. But, if you have enough of these antiques, you can always build your own analog phone network from the ground up to support them all.
youtube.com/embed/mkJmT9kiu30?…
Upcycling an iPad into a Touchscreen Display for your PC
Installing an RPi Pico board like it’s a modchip. (Credit: Tucker Osman, YouTube)
Although generally iPads tend to keep their resale value, there are a few exceptions, such as when you find yourself burdened with iCloud-locked devices. Instead of tossing these out as e-waste, you can still give them a new, arguably better purpose in life: an external display, with touchscreen functionality if you’re persistent enough. Basically someone like [Tucker Osman], who spent the past months on making the touchscreen functionality play nice in Windows and Linux.
While newer iPads are easy enough to upcycle as an external display as they use eDP (embedded Display Port), the touch controller relies on a number of chips that normally are initialized and controlled by the CPU. Most of the time was thus spent on reverse-engineering this whole process, though rather than a full-depth reverse-engineering, instead the initialization data stream was recorded and played back.
This thus requires that the iPad can still boot into iOS, but as demonstrated in the video it’s good enough to turn iCloud-locked e-waste into a multi-touch display. The SPI data stream that would normally go to the iPad’s SoC is instead intercepted by a Raspberry Pi Pico board which pretends to be a USB HID peripheral to the PC.
If you feel like giving it a short yourself, there’s the GitHub repository with details.
Thanks to [come2] for the tip.
youtube.com/embed/3t8xT-2vBE0?…
Converting AC Irrigation Valves To DC Operation
Due to historical engineering decisions made many decades ago, a great many irrigation systems rely on solenoid valves that operate on 24 volts AC. This can be inconvenient if you’re trying to integrate those valves with a modern smart home control system. [Johan] had read that there were ways to convert these valves to more convenient DC operation, and dived into the task himself.
As [Johan] found, simply wiring these valves up to DC voltage doesn’t go well. You tend to have to lower the voltage to avoid overheating, since the inductance effect used to limit the AC current doesn’t work at DC. However, even at as low as 12 volts, you might still overheat the solenoids, or you might not have enough current to activate the solenoid properly.
The workaround involves wiring up a current limiting resistor with a large capacitor in parallel. When firing 12 volts down the line to a solenoid valve, the resistor acts as a current limiter, while the parallel cap is initially a short circuit. This allows a high current initially, that slowly tails off to the limited value as the capacitor reaches full charge. This ensures the solenoid valve switches hard as required, but keeps the current level lower over the long term to avoid overheating. According to [Johan], this allows running 24V AC solenoid valves with a 12V DC supply and some simple off-the-shelf relay boards.
We’ve seen similar work before, which was applied to great effect. Sometimes doing a little hack work on your own can net you great hardware to work with. If you’ve found your own way to irrigate your garden as cheaply and effectively as possible, don’t hesitate to notify the tipsline!
Substack breach impacted 663,000 accounts, but appears to be a scrape of public data... so not a big deal at all
haveibeenpwned.com/Breach/Subs…
Have I Been Pwned: Substack Data Breach
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026.Have I Been Pwned
reshared this
Security firm Defused has spotted a coordinated campaign from an initial access broker that is targeting the recent Ivanti EPMM zero-days
defusedcyber.com/ivanti-epmm-s…
Sleeper Shells: How Attackers Are Planting Dormant Backdoors in Ivanti EPMM
A February 2026 campaign used a internal JSP path and in-memory Java class loaders to quietly seed persistent access across Ivanti EPMM deployments - then walked away. We break down the tradecraft.defusedcyber.com
reshared this
Fallo subito e poi sfuggi alla regolamentazione
Contenuti in riproduzione automatica, pubblicità personalizzata, gamification: ecco gli elementi progettati per influenzare in modo sottile gli utenti di Internet. Il Digital Fairness Act mira a contrastare questo fenomeno. Tuttavia, uno studio del Corporate Europe Observatory rivela che le grandi aziende tecnologiche come Meta e Google stanno facendo pressioni contro i piani della Commissione Europea.
netzpolitik.org/2026/big-tech-…
Big-Tech-Lobbying: Erst machen, dann lieber nicht reguliert werden
Automatisch abgespielte Inhalte, personalisierte Werbung, Gamification – solche Elemente sollen Internet-Nutzer*innen heimlich beeinflussen. Dagegen soll der Digital Fairness Act helfen.netzpolitik.org
reshared this
Un hacktivista ha recuperato più di mezzo milione di registrazioni di pagamento da un produttore di stalkerware e tecnologie di sorveglianza dei consumatori, esponendo gli indirizzi email dei clienti e numeri di carta parziali.
L'hackvisita ha detto di averlo fatto perché ritiene che queste aziende siano "inquietanti" e perché si diverte a "prendere di mira le app che vengono utilizzate per spiare le persone".
Il post di @lorenzofb
techcrunch.com/2026/02/09/hack…
Hacktivist scrapes over 500,000 stalkerware customers' payment records | TechCrunch
More than half-a-million people who bought access to phone surveillance and social media snooping apps had their email address and partial payment card numbers published online.Lorenzo Franceschi-Bicchierai (TechCrunch)
reshared this
Incidente ransomware all'Università Sapienza di Roma: Fatti noti vs ipotesi analitiche
@Informatica (Italy e non Italy)
Qualsiasi collegamento a specifiche famiglie ransomware (BabLock/Rorschach) o ad attori di minaccia rimane un'ipotesi analitica, basata su somiglianze comportamentali e su pattern osservati a livello di settore, non su artefatti tecnici verificati.Questa valutazione di bassa–moderata confidenza distingue le informazioni confermate dalle assunzioni derivate da analogie osservate e delinea uno scenario alternativo credibile che coinvolge la compromissione di credenziali di terze parti, potenzialmente connessa ad attacchi contemporanei contro istituzioni accademiche e governative.
L'analisi senza speculazioni, clickbait o informazioni non verificate a cura di @Claudia del gruppo di ransomnews.
ransomnews.online/blog/sapienz…
BLOG @ ransomNews - Ransomware incident at Sapienza University of Rome
ransomNews, your go-to source for ransomware news, insights, and analysis, also home of RedACT monthly threat reportransomnews.online
like this
reshared this
qualche idea ce l'ho, ma sembra davvero troppo allucinante per essere vera..
Eppure, come diceva il buon Sherlock 😎
Decodificare i compromessi nascosti di E2EE e usabilità - Le proprietà crittografiche dei vari servizi di comunicazione e2e
In un mondo ideale, le app di messaggistica crittografate end-to-end (E2EE) funzionerebbero in modo identico alle loro controparti non E2EE, senza ulteriori inconvenienti per gli utenti.
In realtà, molti problemi "semplici" diventano molto più difficili da risolvere.
element.io/blog/decoding-the-h…
Decoding the hidden trade-offs of E2EE and usability
Decoding end-to-end encryption: Privacy vs. Usability. Read more about the trade-offs and how we work to solve themAndreas Sisask (Element Blog)
Auster likes this.
reshared this
securityaffairs.com/187787/sec…
#securityaffairs #hacking
Critical Fortinet FortiClientEMS flaw allows remote code execution
Fortinet warns of a critical FortiClientEMS vulnerability that lets remote attackers run malicious code without logging in.Pierluigi Paganini (Security Affairs)
Cybersecurity & cyberwarfare reshared this.
GARANTE PRIVACY E INL: AVVIATE ISPEZIONI PRESSO CENTRI LOGISTICI AMAZON
L’attività trae origine dagli approfondimenti tecnici avviati, anche a seguito di notizie di stampa, che hanno evidenziato possibili criticità nell’acquisizione e nel trattamento di dati personali dei lavoratori e nell’utilizzo di sistemi di videosorveglianza in assenza delle garanzie previste dallo Statuto dei lavoratori.
reshared this
securityaffairs.com/187776/hac…
#securityaffairs #hacking
BeyondTrust fixes critical pre-auth bug allowing remote code execution
BeyondTrust patched a critical pre-auth flaw in Remote Support and PRA that could let attackers execute code remotely.Pierluigi Paganini (Security Affairs)
Cybersecurity & cyberwarfare reshared this.
Keebin’ with Kristina: the One with the Height-Adjustable Key Caps
Now, we can’t call these LEGO key caps for obvious reasons, but also because they don’t actually work with standard LEGO. But that’s just fine and dandy, because they’re height-adjustable key caps that use the building block principle.
Image by [paper5963] via redditNow you could just as easily build wells as the dome shape pictured here, and I’d really like to see that one of these days.
In the caption of the gallery, [paper5963] mentions foam. As far as I’ve studied the pictures, it seems to be all 3D-printed material. If they were foam, they would likely be porous and would attract and hold all kinds of nastiness. Right?
[paper5963] says that there are various parts that add on to these, not just flat tops. There are slopes and curves, too. They are also designing these for narrow pitch, and say they are planning to release the files. Exciting!
Fold-able Keyboard Goes Anywhere
[pinya] says this is a remake of their Crabapplepad V2 into something that folds. They take it along in their backpack and use it either with a phone or a Lenovo Legion Go linux tablet. The original PCB was designed for this possibility, and now it’s a thing.
Image by [pinya] via redditThis is the same board as the CrabappleV2, but cut into three pieces and rejoined with flexy silicone wire. That stuff is already great; here’s another use case for it.
The hinges are the friction type you’d find on a laptop, so they’re strong and can stay in any position. The way they’re mounted doesn’t allow for much tenting, but it does allow for a few degrees. Otherwise, the whole thing would become unstable.
This baby has soldered brown Kailh chocs (yay!) with the diodes buried snugly beneath them. The switches were still exposed and snagging on things in the backpack, so [pinya] whipped up a nice little felt case for it.
Since there’s still enough space at the top of the board, [pinya] might add a built-in phone stand. I’m interested to see how that goes with the weight of the phone and all.
The Centerfold: These 3D-Printed Key Caps
Image by [strings_and_tines] via redditAnd now for some completely different 3D-printed key caps, this time from [strings_and_tines]. These are beautiful, and I love the font of the legends and the texture of the tops. Really wish I could touch them. Evidently [strings_and_tines] was not finding key caps with large enough legends for their silakka54 and so they whipped these up using a Bambu Lab A1 with AMS to handle the two colors.
Do you rock a sweet set of peripherals on a screamin’ desk pad? Send me a picture along with your handle and all the gory details, and you could be featured here!
Historical Clackers: the Lovely Waverley
This elegant late-Victorian piece is not only beautiful to look at, it has a special place in history. The Waverley was one of only four typewriters ever produced with a rear-downstrike arrangement of type bars. Basically, the bars strike the paper from the top and rear of the machine.
In case you’re wondering, the other three with this distinction are the Brooks, the Fitch, and the North’s, which this resembles quite a lot.Image via The Antikey Chop
So, how does a rear-downstriker operate? The main issue is feeding the paper. The inventors Edward Smith Higgins and Henry Charles Jenkins created a system that fed the sheet from the front of the platen, wound around it, and then was expelled into that lovely basket on the front, where they would become neatly coiled and out of the visual path to the platen.
The Waverley has other notable features such as a shifting system that completely disengages the lower case type bars and engages the separate, upper case type bars. So each type bar only has one character.
It also has proportional spacing, but only for the widest letters (M and W). The carriage moves a little bit further to account for their extra width.
There’s a separate Space key in the upper right that moves the carriage only the width of one character, whereas the Space bar moves it twice as far to separate the words. This last is one of those features you’d have to train yourself to do, I would think: you can simultaneously push the Space bar while typing the last letter of a word, and then you’re immediately ready to type the next word.
Unfortunately, the Waverley Type-Writer Co. disbanded after just one year of production because of a lack of working capital. It may have just been too complex and thus difficult to produce.
Finally, a Truly Modular Keyboard Complete Input System
Would you like a modular keyboard? Or would you prefer an entire input system? Dutch company Naya are back with the Connect, which looks less like a ‘sensory nightmare’ than the Create, their ergonomic modular keyboard.
Image by [Naya] via New AtlasI suppose it depends on your work and play. I for one would not make use of most of the mouse-like bits, but I would appreciate a tack-on 10-key thing and a set of macro keys for the other side.
And I’m sure left-handers will appreciate that the 10-key thing can go on either the left or right. But you don’t have to use it as a 10-key. It’s essentially just a second macro module with 24 keys. (Not pictured.)
I love New Atlas’ opening salvo: “This might just be the most engineered desktop gear I’ve ever come across.” Much like the ergonomic Create, the four round things are as follows: a customizable trackpad, a 40 mm trackball, a rotary encoder, and a 6-DoF spatial mouse. I will spare you their ethereal names.See? Sort of? Dishing. Image via Kickstarter
The keyboard itself is a 75%, 85-key number in a unibody of machined aluminium. It has hot-swappable Kailh Choc V2s, and those keycaps are allegedly dished, but they look flat as Kansas to me. Oh, okay; if you look at the many pictures on Kickstarter, you can see the dishing.
Here’s the kicker: it doesn’t come with everything. You either go with the base keyboard and add modules, or get the Dock (the thing on the right up there with four keys and a hole) and attach modules to that. Also, it’s in the Kickstarter phase as I alluded, but it’s something like 4,000% funded already, so.
The keyboard by itself isn’t that much — $119 for early birds — and the Dock is even cheaper. But they aren’t going to ship for more than a year, so consider that.
Got a hot tip that has like, anything to do with keyboards? Help me out by sending in a link or two. Don’t want all the Hackaday scribes to see it? Feel free to email me directly.
Living in the (LLM) Past
In the early days of AI, a common example program was the hexapawn game. This extremely simplified version of a chess program learned to play with your help. When the computer made a bad move, you’d punish it. However, people quickly realized they could punish good moves to ensure they always won against the computer. Large language models (LLMs) seem to know “everything,” but everything is whatever happens to be on the Internet, seahorse emojis and all. That got [Hayk Grigorian] thinking, so he built TimeCapsule LLM to have AI with only historical data.
Sure, you could tell a modern chatbot to pretend it was in, say, 1875 London and answer accordingly. However, you have to remember that chatbots are statistical in nature, so they could easily slip in modern knowledge. Since TimeCapsule only knows data from 1875 and earlier, it will be happy to tell you that travel to the moon is impossible, for example. If you ask a traditional LLM to roleplay, it will often hint at things you know to be true, but would not have been known by anyone of that particular time period.
Chatting with ChatGPT and telling it that it was a person living in Glasgow in 1200 limited its knowledge somewhat. Yet it was also able to hint about North America and the existence of the atom. Granted, the Norse apparently found North America around the year 1000, and Democritus wrote about indivisible matter in the fifth century. But that knowledge would not have been widespread among common people in the year 1200. Training on period texts would surely give a better representation of a historical person.
The model uses texts from 1800 to 1875 published in London. In total, there is about 90 GB of text files in the training corpus. Is this practical? There is academic interest in recreating period-accurate models to study history. Some also see it as a way to track both biases of the period and contrast them with biases found in data today. Of course, unlike the Internet, surviving documents from the 1800s are less likely to have trivialities in them, so it isn’t clear just how accurate a model like this would be for that sort of purpose.
Instead of reading the news, LLMs can write it. Just remember that the statistical nature of LLMs makes them easy to manipulate during training, too.
Featured Art: Royal Courts of Justice in London about 1870, Public Domain
Ask Hackaday: How Do You Detect Hidden Cameras?
The BBC recently published an exposé revealing that some Chinese subscription sites charge for access to their network of hundreds of hidden cameras in hotel rooms. Of course, this is presumably without the consent of the hotel management and probably isn’t specifically a problem in China. After all, cameras can now be very tiny, so it is extremely easy to rent a hotel room or a vacation rental and bug it. This is illegal, China has laws against spy cameras, and hotels are required to check for them, the BBC notes. However, there is a problem: At least one camera found didn’t show up on conventional camera detectors. So we wanted to ask you, Hackaday: How do you detect hidden cameras?
How it Works
Commercial detectors typically use one of two techniques. It is easy to scan for RF signals, and if the camera is emitting WiFi or another frequency you expect cameras to use, that works. But it also misses plenty. A camera might be hardwired, for example. Or store data on an SD card for later. If you have a camera that transmits on a strange frequency, you won’t find it. Or you could hide the camera near something else that transmits. So if your scanner shows a lot of RF around a WiFi router, you won’t be able to figure out that it is actually the router and a small camera.
Fire alarm? Camera? It is both!
The other common method uses a beam of light or a laser to try to see reflections of lenses, which will be retroreflective. The user views the room through a viewfinder, and any light that comes directly back will show up in the view. Despite some false positives, this method will find cameras even if they are not powered or transmitting. Even shining a flashlight, maybe from the same cell phone, around a dark room might uncover some camera devices.
There are a few other techniques. If you assume a spy camera probably uses IR lighting to see you at night, you can scan for that. A good tip is that your cell phone camera can probably see IR. (Test it on an IR remote control.) So looking around with your phone camera is a good, free way to find some cameras. A thermal imager might show hidden equipment, too, although it might be hard to determine if it is actually a camera or not.
You might be thinking: just look for the camera. But that’s not always simple. In the BBC article, the camera was the size of a pencil eraser. Not to mention, a quick search of your favorite retailer will reveal cameras made to look like smoke detectors, stuffed toys, USB chargers, and more. You can even get small cameras that can mount a fake button or screw head on the lens.
Testing
[Project Farm] has a video that tests a few detectors. The problem, of course, is that there are different kinds of cameras. Detecting the test camera doesn’t mean it will detect all cameras. Still, you can get some idea of how effective some detectors are compared to others.
youtube.com/embed/1reman2waLs?…
Your Turn?
Given that none of the current ways to detect cameras work perfectly, what would you build to find them? Maybe an NLJD? Or maybe some tech to blind them? Tell us what you think in the comments.
Very techy #PacketHunters today.
On AI agents, dumb humans and general #security strategies to secure things.
Governance is not a word, systems are exploitable and #Moltys 🦞 are playing under the glass dome.
Until... when?
blog.baited.io/2026/ai-agents-…
AI Agents behave like users? We still need to secure them like scripts! - Baited
AI agents behave like users but are governed with static credentials and fragmented visibility. A technical analysis of identity drift, phishing risk, and why current IAM models are inadequate.Claudia Galingani Mongini (Baited - Blog)
Cybersecurity & cyberwarfare reshared this.
Malware nel download di 7-Zip! Come il tuo PC diventa un proxy per i criminali
📌 Link all'articolo : redhotcyber.com/post/malware-n…
#redhotcyber #news #cybersecurity #hacking #malware #proxy #sicurezzainformatica #minacceinformatica
Malware nel download di 7-Zip! Come il tuo PC diventa un proxy per i criminali
Scopri come un falso installer di 7-Zip può trasformare il tuo PC in un nodo proxy e come difenderti da questa minaccia.Redazione RHC (Red Hot Cyber)
Cybersecurity & cyberwarfare reshared this.
NEW: A hacktivist scraped than half a million payment records from a stalkerware and consumer surveillance tech maker, exposing customers' email addresses and partial card numbers.
The hackvisit told us they did it because they think these companies are "creepy," and because they have fun "targeting apps that are used to spy on people."
techcrunch.com/2026/02/09/hack…
Hacktivist scrapes over 500,000 stalkerware customers' payment records | TechCrunch
More than half-a-million people who bought access to phone surveillance and social media snooping apps had their email address and partial payment card numbers published online.Lorenzo Franceschi-Bicchierai (TechCrunch)
Cybersecurity & cyberwarfare reshared this.
Scoperta una falla critica nei router TP-Link: un bug per il controllo totale
📌 Link all'articolo : redhotcyber.com/post/scoperta-…
#redhotcyber #news #cybersecurity #hacking #vulnerabilita #sicurezzainformatica #tp link #omadaer605
Scoperta una falla critica nei router TP-Link: un bug per il controllo totale
Scoperta una catena di vulnerabilità nel router TP-Link Omada ER605 che consente l'esecuzione di codice remoto senza previa autorizzazione.Redazione RHC (Red Hot Cyber)
Cybersecurity & cyberwarfare reshared this.
Un cyber attacco colpisce l’Italia ogni cinque minuti: come mitigare i rischi
@Informatica (Italy e non Italy)
Criminalità digitale, tensioni geopolitiche e intelligenza artificiale stanno innescando un'evoluzione delle minacce online. Ecco cosa riporta l'indagine di Tinexta Cyber che fotografa la frequenza degli attacchi hacker in Italia
L'articolo Un cyber
Informatica (Italy e non Italy) reshared this.
Public security meets disinformation threats
IT'S MONDAY, AND THIS IS DIGITAL POLITICS. I'm Mark Scott, and will be in Amsterdam next week to present this work at this year's DSA and Platform Regulation Conference. If you're also in town, drop me a line to say hi.
— As defense types meet at the Munich Security Conference this week, the importance of protecting the online information environment from abuse has never been more important. But it comes with significant perils.
— The European Commission's latest regulatory move against TikTok is less to do with potential harm on the platform, and more about sending a policymaking message, at home and abroad.
— The rise of a polarized social media has led to many users disengaging with these online platforms.
Let's get started:
THE PUBLIC SECURITY INDUSTRIAL COMPLEX
IF DAVOS IS WHERE THE GREAT AND THE GOOD of the business world meet to swap notes, then the Munich Security Conference, which gets underway on Feb 13, is where their equivalents in the defense world similarly gather to break bread. They will have a lot to talk about. From the almost 4-year war between Russia and Ukraine to the fraying transatlantic alliance to Europe's renewed efforts to stand up on its own two feet, this year's gathering in the southern German town represents a marker of a new era that has yet to be defined.
Among the topics to be discussed (alongside the ubiquitous AI hype-vest) will be the ongoing toxic nature of the online world and how that potentially harms countries' public security.
For many policymakers, this represents the sweet spot of ongoing accusations — some real, some not — that Russia continues to meddle in Western elections via a spidery web of disinformation agents and so-called hybrid attacks. It also includes an increase in public spending for government efforts to thwart such digital trickery, as well as proposals like the European Commission's Democracy Shield aimed at boosting collective resilience through a mixture of media literacy, public support for independent media and greater research into social media platforms.
It wouldn't be an international conference without some shade from the United States. Details are still thin on the ground. But I would expect senior White House and federal government officials to double down on accusations that Europe's online safety rules are akin to censorship; that Europe needs to embrace its historic culture heritage; and that only more free speech can combat the legitimate real-world harms seeping out of some of these global digital services.
Let's leave aside the US' significant critique on any form of online safety or disinformation-busting efforts. More on that here.
Thanks for reading Digital Politics. If you've been forwarded this newsletter (and like what you've read), please sign up here. For those already subscribed, reach out on digitalpolitics@protonmail.com
For other countries realizing there's a significant public security threat associated with unfettered — and, for most jurisdictions, unregulated — online spaces, many fall into a policymaking fallacy about where the real threat lies. That reduces their ability to truly marshal sufficient resources to provide a safe online environment — while, it should go without saying, upholding fundamental free speech rights.
First, the fallacy. While each country is different — and some jurisdictions face significantly more Russian meddling (like Moldova and Germany) than others — the Kremlin, on average, is not the main driver of politically-motivated disinformation and online polarization that many would believe. This over-indexing on Russian actors therefore pushes national security and digital policymaking to focus on a small subset of threats compared to more comprehensive issues currently affecting social media.
Yes, Russian state-affiliated actors are still doing what they can to shift public opinion. That includes everything from creating spoofed websites that pretend to be Western media outlets so they can spread falsehoods to significant bot farms — on all social media platforms — to try and shift the conversation, one way or the other.
These tactics have evolved since they first hit the headlines in 2016 around the US presidential election. Though, arguably, they existed decades earlier, often in analogue form. But what also has shifted over the last decade is online attention economy. Now, roughly the top two percent of online creators garner more than 60 percent, if not more, of time in people's social media feeds. That means most Russian-affiliated content just doesn't get the eyeballs that it once did.
If a Kremlin bot creates a sophisticated disinformation campaign, but no one (apart from other bots) sees it, does it even exist? In my view, no. No it doesn't.
Such ongoing attempts to create Russia as the bogeyman — especially due to its ongoing atrocities in Ukraine — has fixated many policymakers and, increasingly, national security types on the "what," and not the "why" of social media. By that, I mean it's too easy to focus on finding potentially harmful, politicized disinformation (see here) and not on the systems that amplify potential polarizing content to national audiences.
The 'why' in this context is the increasingly sophisticated social media recommendation algorithms that have made each user's feed a bespoke make-up of content which these companies believe will keep people interested (and, therefore, glued to the platform.)
Gone are the days where people typically received updates from friends and family — those posts now represent between seven and 17 percent on Instagram and Facebook, respectively.
Instead, these recommender systems, whose operations remain closed off from scrutiny, have been tailored to maximize engagement, even if that comes through party-political polarization and other content that potentially harms wider public security.
This is where I start to get queasy. I am a big fan of free speech, and I do not believe national security agencies should be poking around into either my, yours or companies' business. But just as too much time is spent hunting down Russian actors online, not enough time is dedicated to unpicking how these social media algorithms operate. These systems can actually harm people in the real world — more so, in my opinion, than the specter of Kremlin-back botfarms.
There needs to be greater coordination between outward looking national security agencies and inward looking regulators and policymakers focused around online safety. Currently, that is a relationship that either doesn't exist, or is only starting to take shape.
That will involve national security officials finding a way to maintain their independence from monitoring what happens within their countries' borders — a barrier which, legitimately, must be upheld to protect people's fundamental rights.
But to suggest that protecting the information environment is merely a foreign issue — that whatever foreign actors do overseas to target a country's population stands apart from how social media promotes specific content, at home — is a false dichotomy.
To combat online threats that may affect public security — all while upholding free speech rights and other individual freedoms — new connections must be formed between national security and online safety officials. That is not going to be an easy lift, given how each community approaches the digital topics that fall within their overlapping mandates.
But to not try is to relegate ourselves to live in a world defined by what happened in 2016 (and the specific characteristics of a singular US presidential election.)
The world has moved on. So should we.
Chart of the Week
A RESEARCHER AT THE UNIVERSITY AMSTERDAM discovered a correlation between the rise of polarization of posts (at least on Facebook and X) and the number of users who disengaged on those platforms during the 2020 and 2024 US presidential elections.
The first set of charts (on the left) highlight how between the 2020-2024 election cycles, all social media sites — with the exception of TikTok and Reddit — lost users, particularly among the young and elderly.
The second set of charts (on the right) shows the level of posting on both X and Facebook rose significantly, over that period, for those users who were more polarized than their more mainstream counterparts.
Source: Petter Törnberg
THE ANATOMY OF A EUROPEAN COMMISSION ANNOUNCEMENT
THE BERLAYMONT BUILDING in central Brussels can be a weird place. Amid the smattering of European languages and EU officials busily going about their business, the center of the European Commission is a labyrinth of complexity, double-speak and really (and I mean really) bad coffee.
So when the EU's executive branch announced on Feb 6 it had found TikTok in preliminary violation of the bloc's Digital Services Act, I took note. But not for the reason you might think.
Under the still-yet-to-be-finalized decision, the European Commission said it believed the China-linked app had not adequately assessed the addictive features baked into the popular social media service. That included allegedly rewarding users with new content to keep them doomscrolling and sending people (and particularly children) notifications during the wee hours of the morning.
"Social media addiction can have detrimental effects on the developing minds of children and teens," Henna Virkkunen, the European Commissioner in charge of tech policy, said in a statement. In response, TikTok denied the accusations and said it would fight Brussels' preliminary decision.
So far, so good.
But the European Commission's announcement wasn't really about TikTok. I mean, it was about the China-linked platform, as the investigation that led to this preliminary ruling dated from 2024. But the true audience, for my money, was Europeans and, to a lesser degree, Americans.
On the first, the TikTok ruling was specifically designed to tee up the EU's upcoming Digital Fairness Act, which is slated to be published in the fourth quarter of the year. Those proposals are aimed, in part, at so-called "dark patterns" of addictive design that — shockingly — are central to Brussels' claims against TikTok.
What better way to show the need for more rulemaking than demonstrating a real-world case of harm (via the TikTok preliminary decision), which then can be used to make the case for the Digital Fairness Act in late 2026.
On the second, it's telling the European Commission chose TikTok, and not Facebook, for its preliminary ruling. Officials say that separate case (around similar issues linked to addictive design) is still ongoing, and may (or may not) lead to a preliminary ruling.
But in the wake of the US House of Representatives holding another hearing around alleged European online censorship — and US officials traveling to Munich this week to make similar accusations — it's helpful, politically, to show that Europe's digital rulebook isn't just targeting Silicon Valley. In truth, more Chinese firms (AliExpress, Temu, TikTok) have faced decisions under the bloc's online safety rules than US counterparts (which only includes X, so far).
Sign up for Digital Politics
Thanks for getting this far. Enjoyed what you've read? Why not receive weekly updates on how the worlds of technology and politics are colliding like never before. The first two weeks of any paid subscription are free.
Subscribe
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.
This is where you have every right to call me a conspiracy theorist. That's not how regulatory enforcement works, I hear you saying. Brussels is just enforcing the rules as outlined within its regulation.
To which, I say yes. But to a point. As I mentioned above, the Berlaymont Building is a strange place. The European Commission sits in a weird regulatory position where it both writes and enforces the rules. Political decisions — particularly in light of the strained relationship with the US — are always taken into account in how the bloc's legislation is enforced. That's especially true for something like the Digital Services Act that includes new enforcement powers which no one within the European Commission has ever wielded before.
In that context, a regulatory decision is not just a regulatory decision.
It's a political marker to demonstrate, to both internal and external audiences, where the region is heading with its digital rulebook. Choosing TikTok and its alleged addictive design therefore meets two purposes. It provides political cover for the upcoming Digital Fairness Act and it allows EU leaders to tell Washington the bloc's rules apply to everyone — and not just US Big Tech.
What I'm reading
— The European Artificial Intelligence & Society Fund outlines its strategy for the next five years. More here.
— The Lowy Institute published a deep dive into the so-called "sovereign citizen movement" has gone global via digital platforms. More here.
— Ahead of next week's AI Impact Summit in India, researchers have written the second annual International AI Safety Report which documents efforts to safeguard the emerging technology. More here.
— Media companies still want to work with online platform to access their audience and global reach, despite reservations about how their content is monetized by these tech companies, argues Rasmus Kleis Nielsen in Digital Journalism.
— Australia's eSafety Commissioner hosts a series of analyses of emerging technologies and their impact on online safety. More here.
Lessons Learned After a Head-First Dive Into Hardware Manufacturing
Sometimes you just know that you have the best ever idea for a hardware product, to the point that you’re willing to quit your job and make said product a reality. If only you can get the product and its brilliance to people, it would really brighten up their lives. This was the starry-eyed vision that [Simon Berens] started out with in January of 2025, when he set up a Kickstarter campaign for the World’s Brightest Lamp.When your product starts shipping and you hope everything went right. (Credit: Simon Berens)
At 50,000 lumens this LED-based lamp would indeed bring the Sun into one’s home, and crowdfunding money poured in, leaving [Simon] scrambling to get the first five-hundred units manufactured. Since it was ‘just a lamp’, how hard could it possibly be? As it turns out, ‘design for manufacturing’ isn’t just a catchy phrase, but the harsh reality of where countless well-intended designs go to die.
The first scramble was to raise the lumens output from the prototype’s 39K to a slight overshot at 60K, after which a Chinese manufacturer was handed the design files. This manufacturer had to create among other things the die casting molds for the heatsinks before production could even commence. Along with the horror show of massive US import taxes suddenly appearing in April, [Simon] noticed during his visit to the Chinese factory that due to miscommunication the heatsink was completely wrong.
Months of communication and repeated trips to the factory follow after this, but then the first units ship out, only for users to start reporting issues with the control knobs ‘scraping’. This was due to an issue with tolerances not being marked in the CNC drawings. Fortunately the factory was able to rework this issue within a few days, only for users to then report issues with the internal cable length, also due to this not having been specified explicitly.
All of these issues are very common in manufacturing, and as [Simon] learned the hard way, it’s crucial to do as much planning and communication with the manufacturer and suppliers beforehand. It’s also crucial to specify every single part of the design, down to the last millimeter of length, thickness, diameter, tolerance and powder coating layers, along with colors, materials, etc. ad nauseam. It’s hard to add too many details to design files, but very easy to specify too little.
Ultimately a lot of things did go right for [Simon], making it a successful crowdfunding campaign, but there were absolutely many things that could have saved him a lot of time, effort, lost sleep, and general stress.
Thanks to [Nevyn] for the tip.
securityaffairs.com/187768/dat…
#securityaffairs #hacking
European Commission probes cyberattack on mobile device management system
The European Commission is investigating a cyberattack after detecting signs that its mobile device management system was compromised.Pierluigi Paganini (Security Affairs)
Cybersecurity & cyberwarfare reshared this.
La Norvegia si prepara a un livello di minaccia informatica senza precedenti
📌 Link all'articolo : redhotcyber.com/post/la-norveg…
#redhotcyber #news #sicurezzanazionale #minacceinformatiche #attacchiinformatici #spionaggio #sabotaggio
La Norvegia si prepara a un livello di minaccia informatica senza precedenti
La Norvegia avverte un aumento della minaccia di attacchi informatici, spionaggio e terrorismo entro il 2026, con Cina e Iran come principali fonti di pericolo.Redazione RHC (Red Hot Cyber)
Cybersecurity & cyberwarfare reshared this.
securityaffairs.com/187761/sec…
#securityaffairs #hacking
Attackers abuse SolarWinds Web Help Desk to install Zoho agents and Velociraptor - Security Affairs
Huntress confirmed active SolarWinds Web Help Desk exploits, where attackers installed Zoho tools for persistence.Pierluigi Paganini (Security Affairs)
Cybersecurity & cyberwarfare reshared this.
youtube.com/watch?v=hSLE5Psfs6…
Il Muppet Show come ragione di vita, sempre!
W l'analogico e l'animazione tradizionale!
- YouTube
Profitez des vidéos et de la musique que vous aimez, mettez en ligne des contenus originaux, et partagez-les avec vos amis, vos proches et le monde entier.www.youtube.com
Cybersecurity & cyberwarfare reshared this.
Non puoi riavviare la tua mente. Eppure la stai lasciando senza patch
📌 Link all'articolo : redhotcyber.com/post/non-puoi-…
Passiamo ore a ottimizzare il nostro lavoro, i nostri tool e i nostri #processi, ma abbiamo dimenticato di proteggere l’unico #sistema operativo che non possiamo riavviare: la nostra mente. Il problema non è la #tecnologia, è la velocità.
Abbiamo eliminato ogni attrito, rendendo l’accesso alle distrazioni istantaneo. Senza latenza, non siamo più i progettisti della nostra vita: siamo automi che rispondono a impulsi esterni.
A cura di Daniela Farina
#redhotcyber #news #gestionedeltempo #produttivita #distrazioni #autocontrollo #impulsivita #gestionestress #benesserementale #salutementale #resilienza #mindfulness #selfcare #crescitaspersonale
Non puoi riavviare la tua mente. Eppure la stai lasciando senza patch
Scopri come proteggere la tua mente dalle distrazioni e riprendere il controllo della tua attenzione con il protocollo Lag. Impara a gestire la velocità e la tecnologia per vivere una vita più consapevole.Daniela Farina (Red Hot Cyber)
reshared this
Ma anche senza tanti richiami alla tecnologia...è davvero così passato di moda il termine "meditare". O riflettere. O il pensiero che spesso è nell'otium che ti viene un colpo di genio, un'idea interessante ecc. ?
Non siamo computer, funzioniamo in maniera totalmente diversa (grazie al cielo). I tempi umani non sono quelli di un PC, nè di una AI.
Il nostro cervello non è in grado di gestire un flusso continuo di informazioni traendone un qualche profitto.
Chiunque voglia uomini / lavoratori "automi", superuomini ecc. non ha proprio idea di cosa sia un essere umano evidentemente.
Il dramma è che tali persone tendono a dominare il mondo. Andando avanti a droghe magari....🤦♂️
Il 64% delle applicazioni web accede a dati sensibili senza autorizzazione
@Informatica (Italy e non Italy)
Lo sostiene una ricerca pubblicata dall’azienda di cyber security Reflectiz che, riconoscendo nell’accesso non autorizzato a dati sensibili una tendenza strutturale, evidenzia un deficit delle applicazioni web
L'articolo Il 64% delle applicazioni web accede a dati sensibili senza autorizzazione
Auster likes this.
Informatica (Italy e non Italy) reshared this.
Il referrer è un dato sensibile
Il referrer è generico, ma ovviamente può essere utilizzato come tecnologia di tracciamento. Tuttavia non rappresenta un dato sensibile in sé.
Informatica (Italy e non Italy) reshared this.
A New and Strangely Strong Kind of Plastic
As anyone who extrudes plastic noodles knows, the glass transition temperature of a material is a bit misleading; polymers gradually transition between a glass and a liquid across a range of temperatures, and calling any particular point in that range the glass transition temperature is a bit arbitrary. As a general rule, the shorter the glass transition range is, the weaker it is in the glassy state, and vice-versa. A surprising demonstration of this is provided by compleximers, a class of polymers recently discovered by researchers from Wageningen University, and the first organic polymers known to form strong ionic glasses (open-access article).
When a material transforms from a glass — a hard, non-ordered solid — to a liquid, it goes through various relaxation processes. Alpha relaxations are molecular rearrangements, and are the main relaxation process involved in melting. The progress of alpha relaxation can be described by the Kohlrausch-Williams-Watts equation, which can be exponential or non-exponential. The closer the formula for a given material is to being exponential, the more uniformly its molecules relax, which leads to a gradual glass transition and a strong glass. In this case, however, the ionic compleximers were highly non-exponential, but nevertheless had long transition ranges and formed strong glasses.
The compleximers themselves are based on acrylate and methacrylate backbones modified with ionic groups. To prevent water from infiltrating the structure and altering its properties, it was also modified with hydrophobic groups. The final glass was solvent-resistant and easy to process, with a glass transition range of more than 60 °C, but was still strong at room temperature. As the researchers demonstrated, it can be softened with a hot air gun and reshaped, after which it cools into a hard, non-malleable solid.
The authors note that these are the first known organic molecules to form strong glasses stabilized by ionic interactions, and it’s still not clear what uses there may be for such materials, though they hope that compleximers could be used to make more easily-repairable objects. The interesting glass-transition process of compleximers makes us wonder whether their material aging may be reversible.
📣 ISCRIVITI AL WEBINAR GRATUITO DEL CORSO "CYBER OFFENSIVE FUNDAMENTALS" – LIVELLO BASE 🚀
📅 Data Webinar: Martedì 17 Febbraio
🕕 Orario: 18:00
🖥️ Google Meet
🔗 Programma: redhotcyber.com/linksSk2L/cybe…
🎥 Intro del prof: youtube.com/watch?v=0y4GYsJMoX…
Attraverso laboratori isolati e replicabili, potrai sperimentare:
✅Ricognizione e analisi delle vulnerabilità
✅Exploitation controllata e post-exploitation in sicurezza
✅Uso professionale di strumenti come Nmap, Metasploit, BloodHound e Nessus
Per ricevere il link al webinar e per iscrizioni: 📞 379 163 8765 ✉️ formazione@redhotcyber.com
#redhotcyber #formazione #pentesting #pentest #formazioneonline #ethicalhacking #cybersecurity #penetrationtesting #cti #cybercrime #infosec #corsi #liveclass #hackerhood #pentesting
Cyber Offensive Fundamentals - Corso ethical hacking, penetration test
Corso in Live Class di Cyber Offensive Fundamentals: scopri penetration testing, vulnerabilità e strumenti pratici per la sicurezza informatica offensiva.Red Hot Cyber
reshared this
-SmarterTools hacked via its own product
-Dutch DPA and European Commission hacked via Ivanti zero-days
-Senegal held for ransom
-state actor behind Signal phishing campaign in Germany
-Flickr 3rd party breach
-China executes scam compound execs
-DDoSer arrested in Poland
-Northwestern hacker pleads guilty
-Nigerian scammer gets 8 years
-17% of OpenClaw skills are malicious
-ClawHub to scan skills using VT
Podcast: risky.biz/RBNEWS523/
Newsletter: news.risky.biz/risky-bulletin-…
Risky Bulletin: SmarterTools hacked via its own product
In other news: Dutch DPA and European Commission hacked via Ivanti zero-days; Senegal held for ransom; state actor behind Signal phishing campaign in Germany.Catalin Cimpanu (Risky.Biz)
reshared this
-DKIM replay attacks in the wild
-Rise of violent threats on social media
-NGOs warn EU against weakening regulation
-Rise of violent threats on social media
-NGOs warn EU against weakening regulation
-People aren't paying Clop anymore
-Salt Typhoon hacked Norway
-APT reports on Vortex Werewolf, ScarCruft
-Claude found 500 bugs in FOSS projects
-Zscaler buys SquareX
-Guardsquare buys Verimatrix's XTD
Catalin Cimpanu reshared this.
La CISA ordina alle agenzie statunitensi di rafforzare la sicurezza dei dispositivi edge
📌 Link all'articolo : redhotcyber.com/post/la-cisa-o…
#redhotcyber #news #cybersecurity #sicurezzainformatica #vulnerabilita #malware #hacking #ransomware
La CISA ordina alle agenzie statunitensi di rafforzare la sicurezza dei dispositivi edge
La CISA impone alle agenzie civili statunitensi di rafforzare la sicurezza dei dispositivi edge, sostituendo quelli obsoleti entro 12-18 mesi.Redazione RHC (Red Hot Cyber)
reshared this
securityaffairs.com/187736/cyb…
#securityaffairs #hacking
Romania’s national oil pipeline firm Conpet reports cyberattack
Romania’s national oil pipeline operator Conpet said a cyberattack disrupted its business systems and temporarily knocked its website offline.Pierluigi Paganini (Security Affairs)
Cybersecurity & cyberwarfare reshared this.
Pendulum Powered Battery
While the average person would use a standard charger to top off their phone, [Tom Stanton] is no average man. Instead, he put mind to matter with an entire pendulum battery system.
Using the inductive effects of magnets on copper coils, [Tom] found the ability to power small components. With that in mind, the only path was forward with a much larger pendulum. A simple diode rectifier and capacitors allow for a smoother voltage output. The scale of the device is still too small to power anything insane, even the phone charging test is difficult. One thing the device can do is juice up the electromagnetic launcher he put together a couple years back to hurl an RC plane into the air.
The useful applications of pendulum power storage might not be found in nationwide infrastructure, but the application on this scale is certainly a fun demonstration. [Tom] has a particular fascination with similar projects where practical application comes second to novelty. For a perfect example of this, check out his work with air powered planes!
youtube.com/embed/uqmT1GzRXWI?…
223 - Spesso usano “AI Open Source” per ingannarci - Marco Camisani Calzolari
Spesso usano “AI Open Source” per ingannarci. La verità spiegata in modo facile. “Open source” nell’Intelligenza Artificiale è una parola usata come ombrello per dire: “guarda che noi siamo aperti, puoi controllare”.Web Staff MCC (Marco Camisani Calzolari)
Cybersecurity & cyberwarfare reshared this.
Elena Brescacin
in reply to informapirata ⁂ • • •reshared this
Etica Digitale (Feddit) e informapirata ⁂ reshared this.