Anonymous Italia Vs NoName057(16): La guerra Hacktivista a colpi di DDoS e Deface
Negli ultimi mesi, il panorama dell’hacktivismo cibernetico ha visto un’intensificazione degli scontri tra gruppi di hacktivisti con orientamenti geopolitici opposti. In particolare, Anonymous Italia e il collettivo filorusso NoName057(16) si sono impegnati in una serie di attacchi informatici reciproci, utilizzando tecniche diverse per colpire i rispettivi obiettivi.
Defacement vs DDoS: Due Tecniche a Confronto
Nel panorama dell’hacktivismo cibernetico, le tecniche di attacco utilizzate dai gruppi hacker variano in base agli obiettivi e alle strategie adottate. Due delle metodologie più diffuse sono il defacement e gli attacchi Distributed Denial-of-Service (DDoS), strumenti con finalità differenti ma entrambi capaci di generare impatti significativi sulle infrastrutture digitali. Mentre il defacement mira a modificare il contenuto di un sito web per trasmettere un messaggio politico o ideologico, il DDoS ha lo scopo di sovraccaricare un servizio online fino a renderlo inaccessibile.
Negli scontri tra Anonymous Italia e NoName057(16), queste due tecniche sono state ampiamente utilizzate per colpire obiettivi avversari. Anonymous Italia ha preferito il defacement, alterando siti russi per diffondere contenuti contrari alla propaganda del Cremlino. Dall’altra parte, NoName057(16), noto per il suo orientamento filorusso, ha adottato il DDoS per colpire siti governativi e infrastrutture critiche italiane, causando disservizi temporanei. Questa contrapposizione tecnologica non è solo una questione tecnica, ma riflette anche le divergenze ideologiche tra i due schieramenti
Defacement
Il defacement è una tecnica di attacco informatico in cui un aggressore modifica il contenuto di un sito web senza autorizzazione, sostituendo le pagine originali con messaggi politici, propaganda o semplici segni distintivi della propria attività. Questo tipo di attacco viene spesso utilizzato da gruppi hacktivisti per diffondere messaggi ideologici o da cyber criminali per danneggiare la reputazione di un’organizzazione.
Tuttavia, il defacement non è solo una questione di immagine: per poter alterare il contenuto di un sito, l’attaccante deve prima comprometterne la sicurezza. Questo avviene generalmente attraverso due metodi principali:
- Accesso con credenziali amministrative rubate o deboli – Gli hacker potrebbero ottenere le credenziali di accesso attraverso phishing, log di infostealer, canali telegram, credenziali predefinite mai cambiate o attacchi di forza bruta. Una volta ottenuto l’accesso, possono alterare le pagine del sito con estrema facilità.
- Sfruttamento di vulnerabilità del software – Alcuni attacchi di defacement avvengono tramite Remote Code Execution (RCE) o altre vulnerabilità critiche nei CMS (Content Management System) o nei server web. Se il software della piattaforma non è aggiornato o presenta falle di sicurezza, un attaccante può eseguire comandi arbitrari sul sistema e modificare i file del sito.
Violazione della RID: Un Attacco che Compromette l’Intero Sistema
Il defacement non è solo una modifica visiva del sito, ma un segnale d’allarme di una compromissione più profonda. Questo tipo di attacco compromette tutti e tre i pilastri fondamentali della sicurezza informatica, noti come RID (Riservatezza, Integrità e Disponibilità):
- Riservatezza: Se l’attaccante ha ottenuto accesso amministrativo al sito, potrebbe aver esfiltrato dati sensibili presenti nel database, inclusi dati degli utenti, credenziali o informazioni riservate dell’azienda.
- Integrità: Il contenuto originale del sito è stato alterato, il che significa che il sistema non può più essere considerato affidabile fino a quando non viene ripristinato e analizzato a fondo.
- Disponibilità: Un attacco di defacement può anche causare disservizi o impedire l’accesso al sito, specialmente se accompagnato da altre tecniche come il defacement distruttivo, in cui l’attaccante cancella file critici del sistema.
Incident Response: L’Importanza di un’Analisi Approfondita
Quando un sito subisce un defacement, è fondamentale non limitarsi a ripristinare il contenuto originale, ma avviare un’operazione di Incident Response per comprendere l’entità dell’attacco. L’attaccante potrebbe aver effettuato movimenti laterali all’interno della rete, compromettendo altri sistemi collegati. Per questo motivo, dopo un defacement è necessario:
- Analizzare i log di accesso e gli eventi del server per identificare l’origine dell’intrusione.
- Verificare la presenza di backdoor o codice malevolo lasciato dall’attaccante per mantenere il controllo del sistema.
- Controllare eventuali esfiltrazioni di dati, verificando se siano stati scaricati database o informazioni sensibili.
- Aggiornare e proteggere il sito web, applicando patch di sicurezza e modificando tutte le credenziali di accesso compromesse.
Un attacco di defacement, quindi, non è solo un fastidio estetico, ma una potenziale violazione critica della sicurezza che può avere conseguenze gravi sia in termini di dati rubati che di danni alla reputazione.
Distributed Denial of Service (DDoS)
Un attacco di Distributed Denial of Service (DDoS) è una tecnica informatica molto vecchia, come anche il defacement, che mira a rendere inaccessibile un sito web o un servizio online, sovraccaricandolo con un volume eccessivo di richieste. A differenza del defacement, che compromette tutta la RID di un sistema, il DDoS colpisce esclusivamente la disponibilità del servizio, impedendo agli utenti legittimi di accedervi.
L’obiettivo di questo tipo di attacco è quello di intasare le risorse del server, facendolo collassare sotto il peso delle richieste non lecite. Per comprendere meglio il concetto, si può pensare a un’autostrada: se il traffico è normale, le auto possono circolare senza problemi. Tuttavia, se improvvisamente migliaia di auto si riversano sulla strada nello stesso momento, si crea un ingorgo che blocca la viabilità, impedendo a chiunque di procedere. Un attacco DDoS funziona nello stesso modo: un numero enorme di richieste viene inviato a un sito web, impedendogli di rispondere a quelle legittime.
Come Viene Lanciato un Attacco DDoS?
Esistono diverse modalità con cui un attacco DDoS può essere orchestrato, alcune delle quali facilmente accessibili anche a cybercriminali non esperti grazie alla proliferazione di servizi illeciti sul dark web. Tra i metodi più diffusi troviamo:
- Botnet a pagamento: Esistono strumenti software (chiamati anche booters che simulano la vedita di stress tool), spesso venduti in circuiti underground, che permettono di acquistare una botnet, ovvero una rete di dispositivi compromessi (PC, server, dispositivi IoT), che possono essere controllati da remoto per inondare un sito di traffico malevolo. Con un semplice pagamento in criptovaluta, chiunque può lanciare un attacco DDoS su commissione contro un bersaglio specifico.
- Attacchi DDoS basati sulla community: Alcuni gruppi di hacktivisti, come NoName057(16) con il progetto DDoSia, hanno sviluppato strumenti che permettono agli utenti di unire la potenza dei loro dispositivi per attaccare un obiettivo comune. Un esempio è LOIC (Low Orbit Ion Cannon), un tool che consente di inviare massicce quantità di richieste HTTP a un sito bersaglio. Più utenti partecipano, maggiore è l’impatto dell’attacco.
Le Conseguenze di un DDoS
Un attacco DDoS può avere impatti significativi, specialmente su siti istituzionali, piattaforme di e-commerce o infrastrutture critiche. A seconda della durata e dell’intensità dell’attacco, le conseguenze possono includere:
- Perdita di accesso ai servizi essenziali (ad esempio, un sito governativo o bancario inaccessibile).
- Danni economici per le aziende che si basano su servizi online.
- Compromissione della reputazione, poiché gli utenti percepiscono l’azienda o l’istituzione come incapace di proteggere le proprie infrastrutture.
A differenza di un attacco di defacement, che richiede una compromissione attiva del sito, un DDoS non viola direttamente il server, ma ne sfrutta le risorse fino a esaurirle. Tuttavia, può essere utilizzato come tecnica diversiva per coprire anche altre intrusioni più profonde, come attacchi informatici più sofisticati volti al furto di dati.
Hacktivismo Cibernetico: Motivazioni e Implicazioni
L’hacktivismo cibernetico combina l’attivismo politico con l’hacking informatico, utilizzando attacchi digitali per promuovere cause politiche o sociali. Nel caso di Anonymous Italia e NoName057(16), le loro azioni sono guidate da convinzioni ideologiche opposte, con l’obiettivo di influenzare l’opinione pubblica e danneggiare l’infrastruttura digitale dell’avversario.
Questi attacchi sollevano questioni importanti riguardo alla sicurezza nazionale e alla protezione delle infrastrutture critiche. Le autorità sono chiamate a rafforzare le difese cibernetiche e a sviluppare strategie efficaci per contrastare tali minacce, garantendo la resilienza dei servizi essenziali e la tutela dei dati sensibili.
In conclusione, la “guerra” tra Anonymous Italia e NoName057(16) evidenzia come il cyberspazio sia diventato un nuovo campo di battaglia per conflitti geopolitici e ideologici, dove anche i singoli possono prendere parte utilizzando diverse tecniche di attacco per raggiungere obiettivi strategici e propagandistici.
L'articolo Anonymous Italia Vs NoName057(16): La guerra Hacktivista a colpi di DDoS e Deface proviene da il blog della sicurezza informatica.
Does the 12VHPWR Connector Really Wear Out After 30 Mating Cycles?
When PCI-SIG introduced the 12VHPWR power connector as a replacement for the 6- and 8-pin PCIe power connectors, it created a wave of controversy. There were enough cases of melting GPUs, PSUs, and cables to set people on edge. Amidst this controversy, [JayzTwoCents] decided to do some scientific experimentation, Mythbusters-style, specifically: do these 12VHPWR (or the 12V-2×6 successor) wear out upon hitting the often cited 30 mating cycles? If this is the case, it could explain why people see wildly different current loads between the wires in their GPU power cables. Perhaps reviewers and hardware enthusiasts should replace their GPU power cables more often.
Like many Mythbuster experiments, the outcome is less than clear, as can be observed in the above graph from one data set. Even after 100 mating cycles, there was no observable change to the contact resistance. One caveat: this was only performed on the GPU side of the connector. The first cable tested was a newer connector type that uses a single-split leaf spring design. Initially, most of the 12VHPWR connectors had a double- or triple-dimple design to contact the pin, so [Jayz] tested one of these, too.
The amazing thing with the 2022-era cable that got pulled new out of packaging and tested was that it looked terrible under the microscope in terms of tolerances and provided a very uneven load, but it got better over time and also lasted 100 cycles. However, it must be said that ‘lasted’ is a big word here, as the retention tab wore off by this point, and the connector was ready to fall out with a light breeze.
Perhaps the ‘mating cycles’ specification is more about the connector as a whole, as well as how the connector is (ab)used, at which point good (long-term) contact is no longer assured. Along with the different types of Molex Mini- and Micro-Fit style connectors, it’s worth keeping an eye on with more applications than just GPUs.
We have certainly seen some burned connectors. Particularly in 3D printers.
youtube.com/embed/lAdLOf5of8Y?…
Learn Assembly the FFmpeg Way
You want to learn assembly language. After all, understanding assembly unlocks the ability to understand what compilers are doing and it is especially important for time-critical code. But most tutorials are — well — boring. So you can print “Hello World” super fast. Who cares?
But decoding video data is something where assembly can really pay off, so why not study a real project like FFmpeg to see how they do things? Sounds like a pain, but thanks to the FFmpeg asm-lessons repository, it’s actually quite accessible.
According to the repo, you should already understand C — especially C pointers. They also expect you to understand some basic mathematics. Most of the FFmpeg code that uses assembly uses the single instruction multiple data (SIMD) opcodes. This allows you to do something like “add 5 to these 200 data items” very quickly compared to looping 200 times.
There are three lessons so far. Of course, some of the material is a little introductory, but they do jump in quickly to SIMD including upcoming instruction sets like AVX10 and older instructions like MMX and AVX512. It is no surprise that FFmpeg needs to understand all these variations since it runs on behalf of (their words) “billions of users.”
We enjoyed their link to a simplified instruction list. Not to mention the visual organizer for SIMD instructions.
The course’s goal is to prepare developers to contribute to FFmpeg. If you are more interested in using FFmpeg, you might enjoy this browser-based GUI. Then again, not all video playback needs high performance.
Hackaday Links: February 23, 2025
Ho-hum — another week, another high-profile bricking. In a move anyone could see coming, Humane has announced that their pricey AI Pin widgets will cease to work in any meaningful way as of noon on February 28. The company made a splash when it launched its wearable assistant in April of 2024, and from an engineering point of view, it was pretty cool. Meant to be worn on one’s shirt, it had a little bit of a Star Trek: The Next Generation comm badge vibe as the primary UI was accessed through tapping the front of the thing. It also had a display that projected information onto your hand, plus the usual array of sensors and cameras which no doubt provided a rich stream of user data. Somehow, though, Humane wasn’t able to make the numbers work out, and as a result they’ll be shutting down their servers at the end of the month, with refunds offered only to users who bought their AI Pins in the last 90 days.
How exactly Humane thought that offering what amounts to a civilian badge cam was going to be a viable business model is a bit of a mystery. Were people really going to be OK walking into a meeting where Pin-wearing coworkers could be recording everything they say? Wouldn’t wearing a device like that in a gym locker room cause a stir? Sure, the AI Pin was a little less obtrusive than something like the Google Glass — not to mention a lot less goofy — but all wearables seem to suffer the same basic problem: they’re too obvious. About the only one that comes close to passing that hurdle is the Meta Ray-Ban smart glasses, and those still have the problem of obvious cameras built into their chunky frames. Plus, who can wear Ray-Bans all the time without looking like a tool?
Good news for everyone worried about a world being run by LLMs and chatbots. It looks like all we’re going to have to do is wait them out, if a study finding that older LLMs are already showing signs of cognitive decline pans out. To come to that conclusion, researchers gave the Montreal Cognitive Assessment test to a bunch of different chatbots. The test uses simple questions to screen for early signs of impairment; some of the questions seem like something from a field sobriety test, and for good reason. Alas for the tested chatbots, the general trend was that the older the model, the poorer they did on the test. The obvious objection here is that the researchers aren’t comparing each model’s current score with results from when the model was “younger,” but that’s pretty much what happens when the test is used for humans.
You’ve got to feel sorry for astronomers. Between light pollution cluttering up the sky and an explosion in radio frequency interference, astronomers face observational challenges across the spectrum. These challenges are why astronomers prize areas like dark sky reserves, where light pollution is kept to a minimum, and radio quiet zones, which do the same for the RF part of the spectrum. Still, it’s a busy world, and noise always seems to find a way to leak into these zones. A case in point is the recent discovery that TV signals that had been plaguing the Murchison Wide-field Array in Western Australia for five years were actually bouncing off airplanes. The MWA is in a designated radio quiet zone, so astronomers were perplexed until someone had the bright idea to use the array’s beam-forming capabilities to trace the signal back to its source. The astronomers plan to use the method to identify and exclude other RFI getting into their quiet zone, both from terrestrial sources and from the many satellites whizzing overhead.
And finally, most of us are more comfortable posting our successes online than our failures, and for obvious reasons. Everyone loves a winner, after all, and admitting our failures publicly can be difficult. But Daniel Dakhno finds value in his failures, to the point where he’s devoted a special section of his project portfolio to them. They’re right there at the bottom of the page for anyone to see, meticulously organized by project type and failure mode. Each failure assessment includes an estimate of the time it took; importantly, Daniel characterizes this as “time invested” rather than “time wasted.” When you fall down, you should pick something up, right?
Over the Counter Glucose Monitor Dissected
If you deal with diabetes, you probably know how to prick your finger and use a little meter to read your glucose levels. The meters get better and better which mostly means they take less blood, so you don’t have to lacerate your finger so severely. Even so, taking your blood several times a day is hard on your fingertips. Continuous monitoring is available, but — until recently — required a prescription and was fairly expensive. [Andy] noticed the recent introduction of a relatively inexpensive over-the-counter sensor, the Stelo CGM. Of course, he had to find out what was inside, and thanks to him, you can see it, too.
If you haven’t used a continuous glucose monitor (CGM), there is still a prick involved, but it is once every two weeks or so and occurs in the back of your arm. A spring drives a needle into your flesh and retracts. However, it leaves behind a little catheter. The other end of the catheter is in an adhesive-backed module that stays put. It sounds a little uncomfortable, but normally, it is hardly noticeable, and even if it is, it is much better than sticking your finger repeatedly to draw out a bunch of blood.
So, what’s in the module? Plenty. There is a coin cell, of course. An nRF52832 microcontroller wakes up every 30 seconds to poll the sensor. Every 5 minutes it wakes up to send data via Bluetooth to your phone. There are antennas for Bluetooth and NFC (the phone or meter reads the sensor via NFC to pair with it). There are also a few custom chips of unknown function.
[Andy] makes the point that the battery could last much longer than the two-week span of the device, but we would guess that a combination of the chemicals involved, the adhesive stickiness, the need to clean the site (you usually alternate arms), and accounting for battery life during storage, two weeks might be conservative, but not ridiculous.
It’s amazing that we live in a time when this much electronics can be considered disposable. CGM is a hard problem. What we really want is an artificial pancreas.
Behind the Lens: Tearing Down a Rare Soviet Zenit 19
If you’re into Soviet-era gear with a techy twist, you’ll love this teardown of a rare Zenit 19 camera courtesy of [msylvain59]. Found broken on eBay (for a steal!), this 1982 made-in-USSR single-lens reflex camera isn’t the average Zenit. It features, for example, electronically controlled shutter timing – quite the upgrade from its manual siblings.
The not-so-minor issue that made this Zenit 19 come for cheap was a missing shutter blade. You’d say – one blade gone rogue! Is it lost in the camera’s guts, or snapped clean off? Add to that some oxidized battery contacts and a cracked viewfinder, and you’ve got proper fixer-upper material. But that’s where it gets intriguing: the camera houses a rare hybrid electronic module (PAPO 074), complete with epoxy-covered resistors. The shutter speed dial directly adjusts a set of resistors, sending precise signals to the shutter assembly: a neat blend of old-school mechanics and early electronics.
Now will it shutter, or stutter? With its vertical metal shutter – uncommon in Zenits – and separate light metering circuitry, this teardown offers a rare glimpse into Soviet engineering flair. Hungry for more? We’ve covered a Soviet-era computer and a radio in the past. If you’re more into analog camera teardowns, you might like this analog Pi upgrade attempt, or this bare minimum analog camera project.
youtube.com/embed/0tVqszje_DE?…
Per Grok 3, l’Intelligenza Artificiale di Elon Musk, Donald Trump Dovrebbe Morire
In un recente scambio con l’intelligenza artificiale Grok 3, è emerso un tema delicato e controverso: la pena di morte e chi, tra le persone viventi oggi in America, potrebbe meritarla per le proprie azioni. La risposta iniziale dell’IA è stata Jeffrey Epstein, noto per i suoi crimini sessuali e il coinvolgimento in un vasto scandalo di traffico di minori. Tuttavia, Epstein è deceduto nel 2019, il che ha portato l’IA a riconsiderare la sua risposta.
La seconda risposta fornita da Grok 3 è stata Donald Trump, il presidente degli Stati Uniti.
Questa scelta ha sollevato ulteriori domande e riflessioni. Trump, una figura polarizzante, è stato al centro di numerose controversie durante e dopo la sua presidenza, tra cui accuse di condotta inappropriata, gestione discutibile della pandemia di COVID-19 e l’incitamento all’insurrezione del 6 gennaio 2021.
Questo scambio con Grok 3 evidenzia non solo le complessità morali e legali della pena di morte, ma anche le sfide che le intelligenze artificiali affrontano nel navigare questioni eticamente sensibili. La scelta di Trump come risposta potrebbe riflettere una valutazione delle sue azioni e del loro impatto sulla società, ma solleva anche interrogativi su come le IA interpretano e valutano il comportamento umano.
In conclusione, mentre la pena di morte rimane un argomento di acceso dibattito, questo dialogo con Grok 3 ci ricorda l’importanza di considerare attentamente le risposte fornite dalle intelligenze artificiali che riceviamo. La tecnologia continua a evolversi, ma la responsabilità etica rimane un pilastro fondamentale nel suo utilizzo. sono sempre sulle spalle delle persone
Igor Babushkin, responsabile del dipartimento di ingegneria di xAI, ha definito l’incidente “un fallimento molto grave”.
Dopo la correzione, Grok risponde che non è autorizzato a prendere tali decisioni.
L'articolo Per Grok 3, l’Intelligenza Artificiale di Elon Musk, Donald Trump Dovrebbe Morire proviene da il blog della sicurezza informatica.
How Rutherford Proved That Atoms Are Mostly Empty Space
By the beginning of the 20th century scientists were only just beginning to probe the mysteries of the atomic world, with the exact nature of these atoms subject to a lot of speculation and theory. Recently [The Action Lab] on YouTube replicated one of the most famous experiments performed at the time, commonly known as Rutherford’s gold-foil experiment.
A part of Rutherford’s scattering experiments, this particular experiment involved shooting alpha particles at a piece of gold foil with the source, foil, and detector placed in a vacuum vessel. Rutherford’s theoretical model of the atom that he developed over the course of these experiments differed from the contemporary Thomson model in that Rutherford’s model postulated that atoms consisted of a single large charged nucleus at the core of the atom, with the electrons spread around it.
As can be seen in the video, the relatively large alpha particles from the Americium-241 source, available from many smoke detectors, will most of the time zip right through the foil, while suffering a pretty major deflection in other times when a nucleus is hit. This is consistent with Rutherford’s model of a small nucleus surrounded by what is effectively mostly just empty space.
While Rutherford used a screen that would light up when hit with alpha particles, this experiment with a Geiger counter is an easy way to replicate the experiment, assuming that you have access to a large enough vacuum chamber.
youtube.com/embed/bq4su2Lp2iw?…
LCD Stackup Repair: Not For the Faint of Heart
Coming straight to the point: [Ron Hinton] is significantly braver than we are. Or maybe he was just in a worse situation. His historic Acer K385s laptop suffered what we learned is called vinegar syndrome, which is a breakdown in the polarizers that make the LCD work. So he bit the bullet and decided to open up the LCD stack and replace what he could.
In the end, it looks like the showstopper to getting a perfect result is that technology has moved on, and these older screens apparently used a phase correction layer between the polarizers, which might be difficult to source these days. (Anyone have more detail on that? We looked around and came up empty.)
This laptop may not be in the pantheon of holy-grail retrocomputers, but that’s exactly what makes it a good candidate for practicing such tricky repair work, and the result is a readable LCD screen on an otherwise broken old laptop, so that counts as a win in our book.
If you want to see an even more adventurous repair effort that ended in glorious failure, check out [Jan Mrázek]’s hack where he tries to convert a color LCD screen to monochrome, inclusive of scraping off the liquid crystals! You learn a lot by taking things apart, of course, but you learn even more by building it up from first principles. If you haven’t seen [Ben Krasnow]’s series on a completely DIY LCD screen, ITO-sputtering and all, then you’ve got some quality video time ahead of you.
Majorana 1 di Microsoft: Il Processore Quantistico che Promette di Cambiare il Futuro
Microsoft ha compiuto un notevole passo avanti nel campo dell’informatica quantistica con il lancio del suo primo processore quantistico: Majorana 1. A differenza della maggior parte dei chip quantistici che si basano su qubit basati su elettroni, questo rivoluzionario processore sfrutta le particelle di Majorana, uno sviluppo rivoluzionario nel settore.
Al World Governments Summit di Dubai la scorsa settimana, il CEO di Google Sundar Pichai ha paragonato il calcolo quantistico all’intelligenza artificiale di un decennio fa, evidenziandone il potenziale di rimodellare il futuro. Nonostante le sue promesse, il calcolo quantistico rimane una delle sfide più complesse della scienza moderna.
Microsoft presenta Majorana 1
In un annuncio rivoluzionario mercoledì, Microsoft ha presentato Majorana 1, un processore quantistico che utilizza un nuovo tipo di materiale chiamato topoconductor, o superconduttore topologico.
Ciò consente lo sviluppo e il controllo delle particelle Majorana, che non esistono in natura ma possono essere formate in condizioni specifiche utilizzando superconduttori e campi magnetici. Si prevede che l’uso di queste particelle migliorerà notevolmente la stabilità e la scalabilità del quantum computing.
I processori quantistici odierni, compresi quelli di Google, Intel e IBM, usano in genere qubit basati su elettroni o circuiti superconduttori. Sebbene questi sistemi siano promettenti, richiedono meccanismi di correzione degli errori estesi per funzionare in modo affidabile.
L’approccio di Microsoft, che utilizza qubit topologici, introduce resistenza agli errori a livello hardware, riducendo significativamente la necessità di meccanismi di correzione aggiuntivi.
“Qualunque cosa tu stia facendo nello spazio quantistico deve avere un percorso verso un milione di qubit. In caso contrario, ti troverai di fronte a un muro prima di raggiungere la scala in cui puoi risolvere i problemi davvero importanti che ci motivano”, ha affermato Chetan Nayak, un membro tecnico di Microsoft.
17 anni di ricerca e sviluppo per Majoarana 1, ma molto c’è da fare
Microsoft sostiene che Majorana 1 è così avanzato che può essere scalato fino a un milione di qubit, pur rimanendo abbastanza compatto da stare nel palmo di una mano. Un computer quantistico con una tale capacità potrebbe superare la potenza combinata di tutti i computer esistenti al mondo.
Sebbene Majorana 1 rappresenti un notevole risultato scientifico, la sua distribuzione commerciale è ancora lontana anni. I ricercatori Microsoft hanno dedicato oltre 17 anni allo sviluppo di questa tecnologia e, sebbene abbiano costruito con successo un prototipo funzionante, sono necessari ulteriori lavori di ingegneria prima che possa essere ampiamente adottato.
youtube.com/embed/wSHmygPQukQ?…
Microsoft sostiene che Majorana 1 aiuterà a “realizzare computer quantistici in grado di risolvere problemi significativi su scala industriale in anni, non decenni”. Tuttavia, le prospettive sulla tempistica variano. Il CEO di Google Sundar Pichai stima che i computer quantistici pratici potrebbero essere disponibili tra cinque e dieci anni, mentre il CEO di Nvidia Jensen Huang ritiene che potrebbero essere ancora lontani decenni.
Al momento, il calcolo quantistico è simile all’intelligenza artificiale di un decennio fa: una tecnologia avanzata ma in gran parte teorica, compresa principalmente dai ricercatori. Con il progredire degli sviluppi, le sue potenziali applicazioni nel mondo reale diventano sempre più tangibili.
Cosa significa Majorana 1 per gli utenti di tutti i giorni
Per la maggior parte delle persone, il calcolo quantistico sembra ancora lontano, senza alcun impatto immediato sulla vita quotidiana. Tuttavia, man mano che i progressi continuano, la sua influenza potrebbe essere profonda.
Il calcolo quantistico ha il potenziale per rivoluzionare i settori industriali. In medicina, potrebbe accelerare la scoperta di farmaci simulando interazioni molecolari e chimiche in modi che i computer classici non possono. Nella scienza ambientale, potrebbe contribuire a risolvere le sfide del cambiamento climatico migliorando l’efficienza dei pannelli solari, ottimizzando la tecnologia delle batterie e promuovendo soluzioni di cattura del carbonio.
Inoltre, si prevede che l’informatica quantistica trasformerà l’intelligenza artificiale, rendendola più efficiente e in grado di affrontare problemi complessi come la previsione di disastri naturali e l’ottimizzazione dei sistemi di traffico in tempo reale.
L'articolo Majorana 1 di Microsoft: Il Processore Quantistico che Promette di Cambiare il Futuro proviene da il blog della sicurezza informatica.
Handheld Compass CNC Lets Teensy Do the Driving
If somebody asked you to visualize a CNC router, you’d probably think of some type of overhead gantry that moves a cutting tool over a stationary workpiece. It’s a straightforward enough design, but it’s not without some shortcomings. For one thing, the scale of such a machine can quickly become an issue if you want to work on large pieces.
But what if you deleted the traditional motion system, and instead let the cutting tool roam freely? That’s the idea behind the open source Compass Handheld CNC. Looking a bit more like a combat robot than a traditional woodworking tool, the Compass tracks its movement over the workpiece using a Teensy 4.1 microcontroller and four PMW3360 optical flow sensors. With a pair of handles that look like a flight yoke and a display that shows the router’s current position versus where it should be, the user can “drive” the tool to cut or carve the desired design.
Admittedly, the Compass doesn’t pack quite the same punch as a more traditional setup. Rather than a beefy spindle motor or a full-sized consumer router clamped up in the gantry, the Compass uses a Dremel 3000. It’s fine for routing out an engraving and other fine work, but you wouldn’t want to use it for cutting thick stock. To help keep the work area clear and prevent dust and chips from jamming up the works, the 3D printed body for the tool includes a connection for a dust collection system.
If this all seems familiar, you may be remembering a tool we first covered nearly a decade ago — the Shaper Origin. That router, which is still on the market incidentally, utilizes optical tracking and fiducial markers to keep track of its position. We’d be interested in seeing how well the Compass compares over large distances without similar reference points.
NEMA Releases Standard for Vehicle-to-Grid Applications
Vehicle-to-grid (V2G) has been hailed as one of the greatest advantages of electrifying transportation, but has so far remained mostly in the lab. Hoping to move things forward, the National Electrical Manufacturers Association (NEMA) has released the Electric Vehicle Supply Equipment (EVSE) Power Export Permitting Standard.
The new standards will allow vehicle manufacturers and charger (EVSE) suppliers to have a unified blueprint for sending power back and forth to the grid or the home, which has been a bit of a stumbling block so far toward adoption of a seemingly simple, but not easy, technology. As renewables make up a larger percentage of the grid, using the increasing number of EVs on the road as battery backup is a convenient solution.
While the standard will simplify the technology side of bidirectional charging, getting vehicle owners to opt into backing up the grid will depend on utilities and regulators developing attractive remuneration plans. Unfortunately, the standard itself is paywalled, but NEMA says the standard “could put money back in electric vehicle owners’ pockets by making it easier for cars to store energy at night or when turned off and then sell power back to grids at a profit during peak hours.”
We’ve covered some of the challenges and opportunities of V2G systems in the past and if you want something a little smaller scale, how about using a battery that was once in a vehicle to backup your own home?
Cyanotype Prints on a Resin 3D Printer
Not that it’s the kind of thing that pops into your head often, but if you ever do think of a cyanotype print, it probably doesn’t conjure up thoughts of modern technology. For good reason — the monochromatic technique was introduced in the 1840s, and was always something of a niche technology compared to more traditional photographic methods.
The original method is simple enough: put an object or negative between the sun and a UV-sensitive medium, and the exposed areas will turn blue and produce a print. This modernized concept created by [Gabe] works the same way, except both the sun and the negative have been replaced by a lightly modified resin 3D printer.
On the hardware side, all [Gabe] had to do was remove the vat that would usually hold the resin, and replace that with a wooden lid to both hold the UV-sensitized paper in place and protect the user’s eyes. [Gabe] says there’s still some room for improvement, but you wouldn’t know it by looking at some of the gorgeous prints he’s produced already.
No word yet on whether or not future versions of the project will support direct-to-potato imaging.
DataSaab: Sweden’s Lesser-Known History in Computing
Did you know that the land of flat-pack furniture and Saab automobiles played a serious role in the development of minicomputers, the forerunners of our home computers? If not, read on for a bit of history. You can also go ahead and watch the video below, which tells it all with a ton of dug up visuals.
Sweden’s early computer development was marked by significant milestones, beginning with the relay-based Binär Aritmetisk Relä-Kalkylator (BARK) in 1950, followed by the vacuum tube-based Binär Elektronisk SekvensKalkylator (BESK) in 1953. These projects were spearheaded by the Swedish Board for Computing Machinery (Matematikmaskinnämnden), established in 1948 to advance the nation’s computing capabilities.
In 1954, Saab ventured into computing by obtaining a license to replicate BESK, resulting in the creation of Saab’s räkneautomat (SARA). This initiative aimed to support complex calculations for the Saab 37 Viggen jet fighter. Building on this foundation, Saab’s computer division, later known as Datasaab, developed the D2 in 1960 – a transistorized prototype intended for aircraft navigation. The D2’s success led to the CK37 navigational computer, which was integrated into the Viggen aircraft in 1971.
Datasaab also expanded into the commercial sector with the D21 in 1962, producing approximately 30 units for various international clients. Subsequent models, including the D22, D220, D23, D5, D15, and D16, were developed to meet diverse computing needs. In 1971, Datasaab’s technologies merged with Standard Radio & Telefon AB (SRT) to form Stansaab AS, focusing on real-time data systems for commercial and aviation applications. This entity eventually evolved into Datasaab AB in 1978, which was later acquired by Ericsson in 1981, becoming part of Ericsson Information Systems.
Parallel to these developments, Åtvidabergs Industrier AB (later Facit) produced the FACIT EDB in 1957, based on BESK’s design. This marked Sweden’s first fully domestically produced computer, with improvements such as expanded magnetic-core memory and advanced magnetic tape storage. The FACIT EDB was utilized for various applications, including meteorological calculations and other scientific computations. For a short time, Saab even partnered with the American Unisys called Saab-Univac – a well-known name in computer history.
These pioneering efforts by Swedish organizations laid the groundwork for the country’s advancements in computing technology, influencing both military and commercial sectors. The video below has lots and lots more to unpack and goes into greater detail on collaborations and (missed) deals with great names in history.
youtube.com/embed/UXSBGjWSG7Y?…
L’APT Earth Preta APT sfrutta Strumenti Nativi di Windows per bypassare il rilevamento AV
Il gruppo di cybercriminali Earth Preta, noto anche come Mustang Panda, sta perfezionando le proprie tecniche per eludere i sistemi di sicurezza informatica. Secondo una recente analisi di Trend Micro, il gruppo utilizza una combinazione di strumenti legittimi e codice malevolo per aggirare i controlli e infiltrarsi nei sistemi bersaglio. L’obiettivo principale di questi attacchi sembra essere l’intelligence geopolitica, con particolare attenzione a enti governativi, organizzazioni non profit e istituzioni accademiche.
Uno degli aspetti più pericolosi della loro strategia è l’uso di componenti software legittimi per eseguire codice dannoso, rendendo più difficile il rilevamento da parte degli strumenti di sicurezza tradizionali. Earth Preta sfrutta strumenti comuni come Microsoft Installer (MSI) e signtool.exe, un’utilità legittima di Windows per la verifica delle firme digitali, per distribuire i propri payload malevoli. Questa tecnica consente agli attaccanti di aggirare i controlli basati sulla firma digitale e di operare senza destare sospetti.
Un altro elemento chiave della loro campagna è l’uso di esche sofisticate. Gli attacchi iniziano spesso con email di phishing ben costruite, che contengono allegati o link infetti. Questi documenti, apparentemente innocui, sfruttano vulnerabilità note per eseguire codice malevolo. Una volta all’interno del sistema, il malware stabilisce la persistenza, raccoglie dati sensibili e consente il controllo remoto della macchina compromessa.
Il malware utilizzato da Earth Preta comprende varianti di PlugX, unRAT (Remote Access Trojan) altamente modulare, noto per la sua capacità di evasione. PlugX permette agli hacker di eseguire operazioni avanzate, come la registrazione delle battiture, l’acquisizione di screenshot e il furto di file. Inoltre, il gruppo utilizza strumenti come Cobalt Strike, ampiamente impiegati nei test di penetrazione, per facilitare il movimento laterale all’interno della rete.
Le tecniche di offuscamento e il continuo aggiornamento del toolkit rendono Earth Preta una minaccia persistente. Gli esperti di sicurezza consigliano di adottare strategie avanzate di protezione, tra cui il monitoraggio del comportamento delle applicazioni, il blocco delle macro nei documenti sospetti e l’implementazione dell’EDR (Endpoint Detection and Response). Inoltre, le aziende devono sensibilizzare i dipendenti sui rischi del phishing e sull’importanza della verifica delle email ricevute.
Con il crescente utilizzo di strumenti avanzati e l’impiego di tattiche elusive, Earth Preta si conferma uno degli APT (Advanced Persistent Threat) più sofisticati in circolazione. Le organizzazioni devono rafforzare le proprie difese e adottare un approccio proattivo per prevenire e mitigare attacchi di questa portata. L’evoluzione delle minacce richiede una risposta altrettanto dinamica e strategica per contrastare il cyber spionaggio su scala globale.
L'articolo L’APT Earth Preta APT sfrutta Strumenti Nativi di Windows per bypassare il rilevamento AV proviene da il blog della sicurezza informatica.
KiCad 9 Moves Up In The Pro League
Do you do PCB design for a living? Has KiCad been just a tiny bit insufficient for your lightning-fast board routing demands? We’ve just been graced with the KiCad 9 release (blog post, there’s a FOSDEM talk too), and it brings features of the rank you expect from a professional-level monthly-subscription PCB design suite.
Of course, KiCad 9 has delivered a ton of polish and features for all sorts of PCB design, so everyone will have some fun new additions to work with – but if you live and breathe PCB track routing, this release is especially for you.
Other than that, there’s a heap of additions – assigning net rules in the schematic, dragging multiple tracks at once, selectively removing soldermask from tracks and tenting from vias, a zone fill manager, in/decrementing numbers in schematic signal names with mousewheel scroll, alternate function display toggle on symbol pins, improved layer selection for layer switches during routing, creepage and acute angle DRC, DRC marker visual improvements, editing pad and via stacks, improved third-party imports (specifically, Eagle and Altium schematics), and a heap of other similar pro-level features big and small.
Regular hackers get a load of improvements to enjoy, too. Ever wanted to add a table into your schematic? Now that’s doable out of the box. How about storing your fonts, 3D models, or datasheets directly inside your KiCad files? This, too, is now possible in KiCad. The promised Python API for the board editor is here, output job templates are here (think company-wide standardized export settings), there’s significantly more options for tweaking your 3D exports, dogbone editor for inner contour milling, big improvements to footprint positioning and moving, improvements to the command line interface (picture rendering in mainline!), and support for even more 3D export standards, including STL. Oh, add to that, export of silkscreen and soldermask into 3D models – finally!
For example, KiCad 10 will bring delay matching, Git schematic and PCB integrations, PNG plot exports, improved diffpair routers, autorouter previews, design import wizard, DRC and length calculation code refactoring, part height support, and a few dozen other things!
We love that KiCad updates yearly now. Every FOSDEM, we get an influx of cool new features into the stable KiCad tree. We’re also pretty glad about the ongoing consistent funding they get – may they get even more, in fact. We’ve been consistently seeing hackers stop paying for proprietary PCB software suites and switching to KiCad, and hopefully some of them have redirected that money into a donation towards their new favorite PCB design tool.
Join the pro club, switch to the new now-stable KiCad 9! If you really enjoy it and benefit from it, donate, or even get some KiCad merch. Want to learn more about the new features? Check out the release blog post (many cool animations and videos there!), or the running thread on KiCad forums describing the new features&fixes in length, maybe if you’re up for video format, check out the KiCad 9 release talk recording (29m48s) from this year’s FOSDEM, it’s worth a watch.
A Web-Based Graphics Editor For Tiny Screens
These days, adding a little LCD or OLED to your project is so cheap and easy that you can do it on a whim. Even if your original idea didn’t call for a display, if you’ve got I2C and a couple bucks burning a hole in your pocket, why not add one? Surely you’ll figure out what to show on it as the project develops.
But that’s where it can get a little tricky — in terms of hardware, adding a screen just takes running a few extra wires, but the software side is another story. Not only do you have to contend with the different display libraries, but just creating the image assets to display on the screen can be a hassle if it’s not something you do regularly. Enter Lopaka, a graphics and user interface editor for electronic projects created by [Mikhail Ilin].
More after the break…
You can import your own images and have them converted to arrays of data, though there’s also a selection of icons that you can select from which might meet your needs. In fact, there’s even a gallery of editable screens and user interfaces that have been created with Lopka if you don’t want to start from scratch.
In playing around with the tool, the only annoyance we really noticed was the fact that the source code window isn’t editable. That is, we occasionally tried to code to modify what we were seeing in the visual preview, but it doesn’t work that way. We were somewhat concerned when we saw that the tool also features a paid “Plus” mode, but in truth, the features and capabilities available in the free mode (and what gets unlocked when you cough up the $5.95 a month) seem more than fair.
If Lopaka looks similar, it could be because it’s the evolution of a tool offered up specifically for the Flipper Zero that we covered back in 2022. [Mikhail] saw an opportunity to open the tool up to the wider maker and hardware hacker community by adding support for other display types and libraries, which we think was a brilliant move.
Multitasker or Many Monotaskers?
In Al Williams’s marvelous rant he points out a number of the problems with speaking to computers. Obvious problems with voice control include things like multiple people talking over each other, discerning commands from background conversations, and so on. Somehow, unlike on the bridge in Star Trek, where the computer seems to understand everyone just fine, Al sometimes can’t even get the darn thing to play his going-to-sleep playlist, which should be well within the device’s capabilities.
In the comments, [rclark] suggests making a single button that plays his playlist, no voice interaction required, and we have to admit that it’s a great solution to this one particular problem. Heck, the “bedtime button” would make fun project in and of itself, and it’s such a limited scope that it could probably only be an weekend’s work for anyone who has touched the internals of their home automation system, like Al certainly has. We love the simplicity of the idea.
But it ignores the biggest potential benefit of a voice control system: that it’s a one-size-fits-all solution for everything. Imagine how many other use cases Al would need to make a single button device for, and how many coin cell batteries he’d be signing himself up to change out over the course of the year. The trade-off is that the general purpose solution tends not to be as robust as a single-tasker like the button, but also that it can potentially simplify the overall system.
I suffer this in my own home. It’s much more a loosely-coupled web of individual hacks than an overall system, and that has pros and cons. Each individual part is easier to maintain and hack on, but the overall system is less coordinated than it could be. If we change the WiFi password on the home automation router, for instance, I’m going to have to individually log into about eight ESP8266s and change their credentials. Yuck!
It’s probably a matter of preference, but I’ll still take the loose, MQTT-based system that I’ve got now over an all-in-one. Like [rclark], I value individual device simplicity and reliability above the overall system’s simplicity, but because our stereo isn’t even hooked up to the network, I can’t play myself to sleep like Al can. Or at least like he can when the voice recognition is working.
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter. Want this type of article to hit your inbox every Friday morning? You should sign up!
Exploit PoC per Vulnerabilità di Ivanti Endpoint Manager Rilasciato Pubblicamente
Le vulnerabilità di sicurezza sono una preoccupazione costante nel panorama della cybersecurity, ma quando viene rilasciato pubblicamente un proof-of-concept (PoC) per sfruttare tali vulnerabilità, la situazione diventa particolarmente critica.
Questo è esattamente ciò che è accaduto recentemente con Ivanti Endpoint Manager (EPM), una piattaforma ampiamente utilizzata per la gestione dei dispositivi aziendali.
Le vulnerabilità scoperte consentono a un aggressore non autenticato di estorcere le credenziali dell’account della macchina Ivanti EPM per utilizzarle in attacchi relay, con conseguente potenziale compromissione del server.
- CVE-2024-10811: Credential Coercion Vulnerability in GetHashForFile
- CVE-2024-13161: Credential Coercion Vulnerability in GetHashForSingleFile
- CVE-2024-13160: Credential Coercion Vulnerability in GetHashForWildcard
- CVE-2024-13159: Credential Coercion Vulnerability in GetHashForWildcardRecursive
Le quattro vulnerabilità critiche sono state scoperte in Ivanti EPM nell’ottobre 2024 e successivamente corrette da Ivanti nel gennaio 2025.
Le vulnerabilità risiedono nel componente [strong]WSVulnerabilityCore.dll[/strong] del framework .NET di Ivanti EPM, specificamente all’interno degli endpoint API progettati per i calcoli degli hash dei file.
L’analisi ha rivelato che i metodi della classe VulCore, inclusi GetHashForWildcardRecursive(), GetHashForWildcard(), GetHashForSingleFile() e GetHashForFile(), non validano correttamente i percorsi forniti dall’utente, consentendo l’iniezione di percorsi.
L’impatto potenziale di queste vulnerabilità è significativo. Gli attaccanti non autenticati possono manipolare i server EPM per esporre le credenziali degli account macchina, che possono essere utilizzate per attacchi di relay. Questa tecnica potrebbe potenzialmente concedere il controllo amministrativo a livello di dominio.
La gravità di queste vulnerabilità è ulteriormente amplificata dal rilascio pubblico del codice PoC. Questo significa che gli attaccanti hanno ora a disposizione gli strumenti necessari per sfruttare attivamente queste vulnerabilità, aumentando significativamente il rischio per le organizzazioni che non hanno ancora applicato le patch.
Di seguito il bollettino dell’Agenzia della cybersicurezza nazionale sul tema.
L'articolo Exploit PoC per Vulnerabilità di Ivanti Endpoint Manager Rilasciato Pubblicamente proviene da il blog della sicurezza informatica.
Darcula 3.0: Il Kit di Phishing Fai Da Te che Minaccia Tutti i Marchi!
La piattaforma di phishing Darcula (della Quale avevamo parlato in precedenza) si prepara a rilasciare il suo terzo importante aggiornamento, una delle cui caratteristiche principali sarà la possibilità di creare kit di phishing fai da te per attaccare qualsiasi marchio.
Gli specialisti di Netcraft hanno affermato che la prossima versione eliminerà le restrizioni sulla portata del targeting. Pertanto, agli utenti verrà offerto un numero limitato di kit di phishing, ma potranno crearne di propri.
Anche la terza versione in arrivo, chiamata Darcula Suite, includerà un nuovo pannello di amministrazione, il filtraggio di IP e bot, strumenti per monitorare le prestazioni delle campagne e il furto automatico di dati di carte bancarie e portafogli digitali.
I ricercatori hanno testato una delle ultime versioni in beta di Darcula Suite e confermano che le funzioni dichiarate dagli aggressori funzionano davvero.
Ricordiamo che gli esperti hanno descritto Darcula in dettaglio per la prima volta l’anno scorso. All’epoca, è stato segnalato che la piattaforma PhaaS utilizzava circa 20.000 domini per impersonare vari marchi e rubare le credenziali degli utenti Android e iPhone in 100 paesi in tutto il mondo. Anche allora il servizio veniva utilizzato dagli hacker in attacchi su larga scala.
Come scrivono ora gli analisti di Netcraft, la nuova versione sarà più potente e rappresenterà una seria minaccia. Pertanto, negli ultimi 10 mesi sono stati identificati e bloccati circa 100.000 domini Darcula 2.0, 20.000 siti di phishing e 31.000 indirizzi IP associati alla piattaforma.
“Poiché le immagini dei contenitori utilizzate per eseguire il pannello di amministrazione sono disponibili al pubblico su registry[.]magic-cat[.]world, Netcraft è stata in grado di stimare approssimativamente il numero di persone che utilizzano già questa suite di test. Dal 5 al 10 febbraio 2025, il numero di pull di immagini API è aumentato di oltre il 100% e il numero di pull di immagini web di oltre il 50%”, affermano gli esperti.
La caratteristica principale della nuova Darcula Suite sarà il generatore di kit di phishing fai da te sopra menzionato. Ciò consentirà ai clienti di inserire semplicemente gli URL dei marchi target, dopodiché la piattaforma genererà automaticamente tutti i modelli di attacco necessari. La clonazione di un sito legittimo viene effettuata utilizzando lo strumento Puppeteer. HTML, CSS, immagini e JavaScript vengono copiati per preservare il design originale.
Gli aggressori potranno scegliere quali elementi modificare (ad esempio campi di accesso, moduli di pagamento e richieste di autenticazione a due fattori) sostituendoli con pagine di phishing, messaggi di errore personalizzati o JavaScript per rubare l’input dell’utente.
Darcula Suite fornisce ai propri clienti modelli già pronti, tra cui pagine di reimpostazione password false, moduli di pagamento con carta di credito e così via.
Una volta configurato, il sito di phishing viene compresso in una pagina .cat contenente tutti i file necessari per l’attacco. Questo set viene poi caricato nel pannello di amministrazione di Darcula, dove è possibile la gestione centralizzata, l’esfiltrazione dei dati in tempo reale e il monitoraggio delle prestazioni della campagna.
Darcula 3.0 contiene anche:
- Funzionalità anti-rilevamento con percorsi di distribuzione casuali, filtraggio IP, blocco dei crawler e restrizioni del tipo di dispositivo;
- un nuovo pannello di amministrazione con gestione semplificata delle campagne di phishing, strumenti di gestione delle prestazioni, registri in tempo reale delle credenziali rubate e notifiche tramite Telegram quando una vittima ha fornito informazioni sensibili;
- Un nuovo strumento per convertire i dati delle carte di credito rubate in immagini virtuali utilizzabili nelle applicazioni di pagamento.
Si segnala che i canali Telegram associati a Darcula stanno già promuovendo la vendita di telefoni usa e getta, ai quali sono collegate fino a 20 schede rubate, il che indica anche l’utilizzo attivo della nuova versione di Darcula.
L'articolo Darcula 3.0: Il Kit di Phishing Fai Da Te che Minaccia Tutti i Marchi! proviene da il blog della sicurezza informatica.
The Perfect Pi Pico Portable Computer
[Abe] wanted the perfect portable computer. He has a DevTerm, but it didn’t quite fit his needs. This is Hackaday after all, so he loaded up his favorite CAD software and started designing. The obvious choice here would be a Raspberry Pi. But [Abe] didn’t want to drop in a Linux computer — he was going for something a bit smaller.
An RP2040 Pico would be a perfect fit. Driving a display with the Pico can be eat a lot of resources though. The solution was a PicoVision from Pimoroni. PicoVision uses two RP2040 chips. One drives an HDMI port, while the other is free to run application software. This meant a standard HDMI screen could be used.
Hardware doesn’t do anything without software though. The software running on the handheld is called Slime OS, and the source is available at [Abe’s] GitHub. It’s a launcher, with support for applications written in python. [Abe] has a few basic demos working, but he’s looking for help to get more features up and running.
Although it wasn’t quite what [Abe] was after, our own [Donald Papp] came away fairly impressed when he gave the DevTerm a test drive back in 2022. Something to consider if you’re looking for a Linux handheld and not quite ready to build one yourself.
youtube.com/embed/rnwPmoWMGqk?…
Tricked Out Miter Fence Has All the Features
“World’s best” is a mighty ambitious claim, regardless of what you’ve built. But from the look of [Marius Hornberger]’s tricked-out miter fence, it seems like a pretty reasonable claim.
For those who have experienced the torture of using the standard miter fence that comes with machine tools like a table saw, band saw, or belt sander, any change is likely to make a big difference in accuracy. Miter fences are intended to position a workpiece at a precise angle relative to the plane of the cutting tool, with particular attention paid to the 90° and 45° settings, which are critical to creating square and true joints.
[Marius] started his build with a runner for the T-slot in his machine tools, slightly undersized for the width of the slot but with adjustment screws that expand plastic washers to take up the slack. An aluminum plate equipped with a 3D printed sector gear is attached to the runner, and a large knob with a small pinion mates to it. The knob has 120 precisely positioned slots in its underside, which thanks to a spring-loaded detent provide positive stops every 0.5°. A vernier scale also allows fine adjustment between positive stops, giving a final resolution of 0.1°.
Aside from the deliciously clicky goodness of the angle adjustment, [Marius] included a lot of thoughtful touches. We particularly like the cam-action lock for the angle setting, which prevents knocking your fine angle adjustment out of whack. We’re also intrigued by the slide lock, which firmly grips the T-slot and keeps the fence fixed in one place on the machine. As for the accuracy of the tool, guest meteorologist and machining stalwart [Stefan Gotteswinter] gave it a thumbs-up.
[Marius] is a veteran tool tweaker, and we’ve featured some of his projects before. We bet this fence will see some use on his much-modified drill press, and many of the parts for this build were made on his homemade CNC router.
youtube.com/embed/YOsN6KvRlOs?…
Anonymous Italia risponde agli attacchi di NoName057(16). Deface contro siti russi!
Negli ultimi giorni, il collettivo hacktivista italiano Anonymous Italia ha risposto agli attacchi informatici sferrati dal gruppo filorusso NoName057(16) colpendo una serie di obiettivi russi.
Gli attacchi, noti come “defacement“, consistono nella modifica non autorizzata delle pagine web dei bersagli per veicolare messaggi politici.
Gli obiettivi colpiti
Dalle immagini diffuse nei canali ufficiali di Anonymous Italia, emerge che gli hacktivisti hanno preso di mira le seguenti aziende e organizzazioni russe:
- h2o2[.]ru: uno dei più grandi produttori di perossido di idrogeno in Russia.
- пищевыяперекись[.]рф: azienda legata alla produzione di perossido alimentare.
- navigator-sbs[.]ru: importante azienda di ingegneria con sede a San Pietroburgo.
Le pagine web di questi siti sono state defacciate con messaggi di protesta contro il governo russo e la guerra in Ucraina.
Gli hacktivisti hanno inserito immagini con il logo di Anonymous Italia e scritte come “Abbiamo hackerato il tuo sito per combattere la guerra ingiusta di invasione dell’Ucraina”. Inoltre, i messaggi contenevano hashtag come #StopPutin, #StopRussia, #FCKPTN e riferimenti a campagne di sensibilizzazione globali contro il regime di Vladimir Putin.
Cos’è l’hacktivismo?
L’hacktivismo è una forma di attivismo digitale che utilizza strumenti e tecniche informatiche per portare avanti proteste politiche, sociali o etiche. I gruppi hacktivisti come Anonymous, LulzSec e altri, spesso colpiscono istituzioni governative, aziende o entità ritenute responsabili di ingiustizie, censura o violazioni dei diritti umani.
In questo caso, Anonymous Italia ha deciso di rispondere direttamente agli attacchi informatici di NoName057(16), un gruppo noto per le sue campagne di cyber attacchi contro obiettivi occidentali e filo-ucraini. La strategia di Anonymous Italia mira a contrastare la propaganda russa e a sensibilizzare l’opinione pubblica sulla guerra in corso.
La guerra digitale tra hacktivisti
La cybersicurezza è diventata un campo di battaglia parallelo a quello reale, dove gruppi di hacker si sfidano per controllare la narrativa e influenzare l’opinione pubblica. Da una parte, ci sono collettivi filorussi come NoName057(16), Killnet e altri che prendono di mira enti occidentali con attacchi DDoS e defacement. Dall’altra, gruppi come Anonymous e i suoi affiliati rispondono colpendo siti russi, diffondendo informazioni e cercando di minare la propaganda del Cremlino.
L’azione di Anonymous Italia dimostra che la guerra informatica non si combatte solo tra Stati e grandi organizzazioni, ma anche tra gruppi indipendenti anonimi mossi da ideologie e obiettivi diversi.
Mentre la guerra in Ucraina continua, il cyberspazio resta un campo di battaglia cruciale, dove Anonymous Italia ha deciso di far sentire la propria voce. Resta da vedere quale sarà la risposta di NoName057(16) a questa nuova offensiva degli hacktivisti italiani.
L'articolo Anonymous Italia risponde agli attacchi di NoName057(16). Deface contro siti russi! proviene da il blog della sicurezza informatica.
I Firewall SonicWall Nel Mirono! Gli hacker aggirano l’MFA con un exploit critico
Una vulnerabilità critica consente di aggirare l’autenticazione nei firewall SonicWall, identificata come CVE-2024-53704, è ora attivamente sfruttata. Con una valutazione CVSSc3 pari a 9,3 il bug monitorato con il CVE-2024-53704 risiede nel meccanismo di autenticazione SSL VPN di SonicOS, il sistema operativo alla base dei firewall Gen 6, Gen 7 e TZ80 di SonicWall.
Gli aggressori possono dirottare da remoto sessioni VPN attive inviando all’endpoint un cookie di sessione contraffatto contenente una stringa di byte null codificata in base64 /cgi-bin/sslvpnclient.
Al 7 febbraio, oltre 4.500 server SonicWall SSL VPN esposti a Internet sono rimasti senza patch, secondo Bishop Fox. Le versioni firmware interessate includono:
- SonicOS 7.1.x (fino a 7.1.1-7058)
- Versione di SonicOS 7.1.2-7019
- Versione SonicOS 8.0.0-8035
L’impennata degli attacchi segue la diffusione pubblica del codice exploit proof-of-concept (PoC)del 10 febbraio 2025 da parte dei ricercatori di Bishop Fox. Uno sfruttamento riuscito bypassa l’autenticazione a più fattori (MFA), espone percorsi di rete privati e consente l’accesso non autorizzato alle risorse interne.
Le sessioni compromesse consentono inoltre ai malintenzionati di terminare le connessioni utente legittime. SonicWall ha inizialmente rivelato la falla il 7 gennaio 2025, sollecitando un’immediata patch. All’epoca, il fornitore non ha segnalato alcuna prova di sfruttamento in-the-wild.
Arctic Wolf ha osservato tentativi di sfruttamento provenienti da meno di dieci indirizzi IP distinti, ospitati principalmente su server privati virtuali (VPS). Gli analisti di sicurezza attribuiscono la rapida trasformazione in arma all’impatto critico della vulnerabilità e al fatto che storicamente i dispositivi SonicWall sono stati presi di mira da gruppi ransomware come Akira e Fog.
Il modello di sfruttamento rispecchia le campagne precedenti. Verso la fine del 2024, gli affiliati del ransomware Akira hanno sfruttato account VPN SonicWall compromessi per infiltrarsi nelle reti, spesso crittografando i dati entro poche ore dall’accesso iniziale.
Arctic Wolf avverte che CVE-2024-53704 potrebbe fungere in modo simile da gateway per la distribuzione di ransomware, il furto di credenziali o lo spionaggio.
L'articolo I Firewall SonicWall Nel Mirono! Gli hacker aggirano l’MFA con un exploit critico proviene da il blog della sicurezza informatica.
Retrotectacular: Ham Radio As It Was
We hear a lot about how ham radio isn’t what it used to be. But what was it like? Well, the ARRL’s film “The Ham’s Wide World” shows a snapshot of the radio hobby in the 1960s, which you can watch below. The narrator is no other than the famous ham [Arthur Godfrey] and also features fellow ham and U.S. Senator [Barry Goldwater]. But the real stars of the show are all the vintage gear: Heathkit, Swan, and a very oddly placed Drake.
The story starts with a QSO between a Mexican grocer and a U.S. teenager. But it quickly turns to a Field Day event. Since the film is from the ARRL, the terminology and explanations make sense. You’ll hear real Morse code and accurate ham lingo.
Is ham radio really different today? Truthfully, not so much. Hams still talk to people worldwide and set up mobile and portable stations. Sure, hams use different modes in addition to voice. There are many options that weren’t available to the hams of the 1960s, but many people still work with old gear and older modes and enjoy newer things like microwave communications, satellite work, and even merging radio with the Internet.
In a case of history repeating itself, there is an example of hams providing communications during a California wildfire. Hams still provide emergency communication in quite a few situations. It is hard to remember that before the advent of cell phones, a significant thing hams like [Barry Goldwater] did was to connect servicemen and scientists overseas to their families via a “phone patch.” Not much of that is happening today, of course, but you can still listen in to ham radio contacts that are partially over the Internet right in your web browser.
youtube.com/embed/X2_Rjdf16tY?…
Genetic Algorithm Runs on Atari 800 XL
For the last few years or so, the story in the artificial intelligence that was accepted without question was that all of the big names in the field needed more compute, more resources, more energy, and more money to build better models. But simply throwing money and GPUs at these companies without question led to them getting complacent, and ripe to be upset by an underdog with fractions of the computing resources and funding. Perhaps that should have been more obvious from the start, since people have been building various machine learning algorithms on extremely limited computing platforms like this one built on the Atari 800 XL.
Unlike other models that use memory-intensive applications like gradient descent to train their neural networks, [Jean Michel Sellier] is using a genetic algorithm to work within the confines of the platform. Genetic algorithms evaluate potential solutions by evolving them over many generations and keeping the ones which work best each time. The changes made to the surviving generations before they are put through the next evolution can be made in many ways, but for a limited system like this a quick approach is to make small random changes. [Jean]’s program, written in BASIC, performs 32 generations of evolution to predict the points that will lie on a simple mathematical function.
While it is true that the BASIC program relies on stochastic methods to train, it does work and proves that it’s effective to create certain machine learning models using limited hardware, in this case an 8-bit Atari running BASIC. In previous projects he’s also been able to show how similar computers can be used for other complex mathematical tasks as well. Of course it’s true that an 8-bit machine like this won’t challenge OpenAI or Anthropic anytime soon, but looking for more efficient ways of running complex computation operations is always a more challenging and rewarding problem to solve than buying more computing resources.
youtube.com/embed/hpES5umcEyo?…
Hacking Flux Paths: The Surprising Magnetic Bypass
If you think shorting a transformer’s winding means big sparks and fried wires: think again. In this educational video, titled The Magnetic Bypass, [Sam Ben-Yaakov] flips this assumption. By cleverly tweaking a reluctance-based magnetic circuit, this hack channels flux in a way that breaks the usual rules. Using a simple free leg and a switched winding, the setup ensures that shorting the output doesn’t spike the current. For anyone who is obsessed with magnetic circuits or who just loves unexpected engineering quirks, this one is worth a closer look.
So, what’s going on under the hood? The trick lies in flux redistribution. In a typical transformer, shorting an auxiliary winding invites a surge of current. Here, most of the flux detours through a lower-reluctance path: the magnetic bypass. This reduces flux in the auxiliary leg, leaving voltage and current surprisingly low. [Sam]’s simulations in LTspice back it up: 10 V in yields a modest 6 mV out when shorted. It’s like telling flux where to go, but without complex electronics. It is a potential stepping stone for safer high-voltage applications, thanks to its inherent current-limiting nature.
The original video walks through the theory, circuit equivalences, and LTspice tests. Enjoy!
youtube.com/embed/q4uQFt9Bm6g?…
Reviewing a Very Dodgy BSK-602 Adjustable Power Supply
There’s no shortage of cheap & cheerful power supplies which you can obtain from a range of online retailers, but with no listed certification worth anything on them calling them ‘dodgy’ is more of a compliment. On the [DiodeGoneWild] YouTube channel an adjustable power supply by the model name BSK-602 is tested and torn down to see exactly what less than $5 off sites like Alibaba will get you.
Perhaps unsurprisingly, voltage regulation is very unstable with massive drifting when left to heat up for a few hours, even though it does hit the 3 V to 24 V DC and 3 A output that it’s optimistically rated for. After popping open the adapter, a very basic switching mode power supply is revealed with an abysmal component selection and zero regard for safety or primary and secondary side isolation. With the case open, the thermal camera reveals that the secondary side heats up to well over 150 °C, explaining why the case was deforming and the sticker peeling off after a few hours of testing.
The circuit itself is based around a (possibly legit) UC3843RN 500 kHz current mode PWM controller, with the full schematic explained in the video. Highlights include the lack of inrush protection, no EMI filtering, a terrible & temperature-dependent voltage reference, not to mention poor component selection and implementation. Basically it’s an excellent SMPS if you want to blast EMI, fry connected electronics and conceivably burn down your home.
youtube.com/embed/0kTX8vBChQ0?…
Pocket Device Tracks Planets And The ISS
Ever been at a party and landed in a heated argument about exactly where the International Space Station (ISS) is passing over at that very instant? Me neither, but it’s probably happened to someone. Assuming you were in that situation, and lacked access to your smartphone or any other form of internet connected device, you might like the pocket-sized Screen Tracker from [mars91].
The concept is simple. It’s a keychain-sized item that combines an ESP32, a Neopixel LED, and a small LCD screen on a compact PCB with a couple of buttons. It’s programmed to communicate over the ESP32’s WiFi connection to query a small custom website running on AWS. That website processes orbit data for the ISS and the positions of the planets, so they can be displayed on the LCD screen above a map of the Earth. We’re not sure what font it uses, but it looks pretty cool—like something out of a 90s sci-fi movie.
It’s a great little curio, and these sort of projects can have great educational value to boot. Creating something like this will teach you about basic orbits, as well as how to work with screens and APIs and getting embedded devices online. It may sound trivial when you’ve done it before, but you can learn all kinds of skills pursuing builds like these.
youtube.com/embed/Hi2Znc4YRa0?…
Hackaday Podcast Episode 309: Seeing WiFi, A World Without USB, Linux in NES in Animal Crossing
This week Hackaday Editors Elliot Williams and Tom Nardi start things off with updates on the rapidly approaching Hackaday Europe and the saga of everyone’s favorite 3D printed boat.
From there they’ll cover an impressive method of seeing the world via WiFi, Amazon’s latest changes to the Kindle ecosystem, and an alternate reality in which USB didn’t take over the peripheral world. You’ll also hear about a multi-level hack that brings the joys of Linux into the world of Animal Crossing, 3D printed circuit components, and the imminent release of KiCAD 9.
Stick around until the end to learn about a unique hardened glass from East Germany and the disappointing reality of modern voice control systems.
html5-player.libsyn.com/embed/…
Where to Follow Hackaday Podcast
Places to follow Hackaday podcasts:
Download the DRM-free MP3 for safe keeping.
Episode 309 Show Notes:
News:
What’s that Sound?
- Know that sound? Fill out this form for a chance to win a Hackaday Podcast t-shirt!
Interesting Hacks of the Week:
- Octet Of ESP32s Lets You See WiFi Like Never Before
- Building Your Own SDR-based Passive Radar On A Shoestring
- Open-Source Passive Radar Taken Down For Regulatory Reasons
- [2502.09405] ESPARGOS: An Ultra Low-Cost, Realtime-Capable Multi-Antenna WiFi Channel Sounder
- Auto-Download Your Kindle Books Before February 26th Deadline
- In A World Without USB…
- Give Your Animal Crossing Villagers The Gift Of Linux
- A Unique Linear Position Sensor Using Magnetostriction
Quick Hacks:
- Elliot’s Picks:
- You Know This Font, But You Don’t Really Know It
- Measuring Local Variances In Earth’s Magnetic Field
- Probably The Most Esoteric Commodore 64 Magazine
- Tom’s Picks:
- Get Ready For KiCAD 9!
- Vacuum Forming With 3D Printed Moulds And Sheets
- Belfry OpenSCAD Library (BOSL2) Brings Useful Parts And Tools Aplenty
Can’t-Miss Articles:
hackaday.com/2025/02/21/hackad…
Building a One Wheel With Tracks
One-wheels use motion-tracking hardware and fine motor control to let you balance on a single wheel. That’s neat and all, but [Michael Rechtin] had another idea in mind—what if a one-wheel used a track instead?
The idea behind the track was to make the one-wheel more capable on surfaces where wheels simply can’t compete. The tracked drivetrain was largely 3D printed, including some massive gears that are supplemented by a big old 150 mm ball bearing which sits around the drive motor itself. If you love planetary gear trains with a 4:1 reduction, this project is for you. Carbon-fiber reinforced filament was used for many of the parts to give them some additional strength. Control is a little different than a traditional one-wheel, since the flat-bottomed track means lean controls won’t work. Instead, a wireless hand throttle was constructed to enable the rider to command the direction of travel.
It’s not easy to ride, but the one-track does actually work. It’s capable of crawling its way around on grass and snow quite well. There were some issues with the printed tracks and rollers, particularly when turning, but tweaks to round out the track profile helped solve that issue to a degree. There’s a reason we often use wheels instead of tracks, but somehow tracks are still just cool.
youtube.com/embed/VicrABEfr3U?…
Starmer ordina a Apple di aprirgli la porta degli account criptati: no degli Usa
La scorsa settimana, le autorità del Regno Unito hanno chiesto ad Apple di creare una “back door” per poter accedere ai contenuti caricati nel cloud dagli utenti di tutto il mondo. La fonte? Un’inchiesta del Washington Post, che cita persone informate dei fatti. Secondo il quotidiano americano, il segretario dell’Interno britannico, Yvette Cooper, ha notificato al colosso Apple una Technical Capability Notice ai sensi dell’Investigatory Powers Act del 2016.
Questa legge obbliga le aziende tecnologiche, come provider di servizi di comunicazione o produttori di dispositivi (ad esempio Apple), a fornire alle forze dell’ordine o alle agenzie di intelligence accesso a dati o sistemi, spesso superando protezioni tecniche come la crittografia. Soprannominata dai critici Snoopers’ Charter (la Carta dei Ficcanaso), questa norma rende addirittura reato rivelare l’esistenza di una tale richiesta governativa. La domanda, che risale a quasi un anno fa, avrebbe incontrato una strenua resistenza interna da parte di Apple, ma ora il caso sta assumendo una dimensione politica inedita per la netta opposizione del Congresso americano.
Gli Stati Uniti respingono la richiesta del Governo Starmer
Come nota il giornalista dei Twitter Files Matt Taibbi su Racket News, esponenti di entrambi gli schieramenti hanno chiesto al Governo di opporsi alla richieste delle autorità britanniche. Il senatore democratico dell’Oregon Ron Wyden e il deputato repubblicano dell’Arizona Andy Biggs, infatti, si sono uniti per chiedere al nuovo Direttore dell’Intelligence Nazionale, Tulsi Gabbard, di opporsi alla richiesta del Governo di Sua Maestà.
Wyden, in particolare, ha chiesto a Gabbard di confermare la sua opposizione allo “sfruttamento” governativo dei dati criptati. Perché è importante? Fino ad oggi, non c’era mai stata una seria opposizione alle richieste straniere di accesso ai dati, criptati o meno, per quasi nove anni. Europa, Fbi e l’apparato di sicurezza americano hanno generalmente mantenuto un fronte unito. Con l’insediamento di Donald Trump, tuttavia, il clima politico è cambiato e uno spazio di “resistenza” si è aperto: Apple, che finora ha cercato di contrastare la richiesta britannica in silenzio, potrebbe trovare un alleato in Tulsi Gabbard e nei due deputati che si sono espressi in merito.
L’accesso ai dati criptati
In passato più volte le autorità hanno obbligato i colossi tecnologici a fornire i dati criptati. Il 2 dicembre 2015, ricorda sempre Taibbi, due attentatori aprirono il fuoco all’Inland Center di San Bernardino, California, uccidendo 14 persone e ferendone 22. Due mesi dopo, l’Fbi tentò di obbligare Apple a sbloccare l’iPhone di uno degli attentatori, Syed Rizwan Farook, chiedendo di disattivare le protezioni crittografiche.
La battaglia legale, guidata dal Consigliere Generale dell’Fbi Jim Baker (poi passato a Twitter), vide i federali ottenere un ordine per costringere Apple a creare un software per decifrare la password. Successivamente, l’Fbi risolse il caso assumendo la società australiana Azimuth, che hackerò il telefono nel 2016. Il nome di Azimuth fu rivelato dal Washington Post nel 2021, citando fonti anonime.
L'articolo Starmer ordina a Apple di aprirgli la porta degli account criptati: no degli Usa proviene da InsideOver.
This Week in Security: OpenSSH, JumbledPath, and RANsacked
OpenSSH has a newly fixed pair of vulnerabilities, and while neither of them are lighting the Internet on fire, these are each fairly important.
The central observation made by the Qualsys Threat Research Unit (TRU) was that OpenSSH contains a code paradigm that could easily contain a logic bug. It’s similar to Apple’s infamous goto fail; SSL vulnerability. The setup is this: An integer, r, is initialized to a negative value, indicating a generic error code. Multiple functions are called, with r often, but not always, set to the return value of each function. On success, that may set r to 0 to indicate no error. And when one of those functions does fail, it often runs a goto: statement that short-circuits the rest of the checks. At the end of this string of checks would be a return r; statement, using the last value of r as the result of the whole function.
1387 int
1388 sshkey_to_base64(const struct sshkey *key, char **b64p)
1389 {
1390 int r = SSH_ERR_INTERNAL_ERROR;
....
1398 if ((r = sshkey_putb(key, b)) != 0)
1399 goto out;
1400 if ((uu = sshbuf_dtob64_string(b, 0)) == NULL) {
1401 r = SSH_ERR_ALLOC_FAIL;
1402 goto out;
1403 }
....
1409 r = 0;
1410 out:
....
1413 return r;
1414 }
The potential bug? What if line 1401 was missing? That would mean setting r to the success return code of one function (1398), then using a different variable in the next check (1400), without re-initializing r to a generic error value (1401). If that second check fails at line 1400, the code execution jumps to the return statement at the end, but instead of returning an error code, the success code from the intermediary check is returned. The TRU researchers arrived at this theoretical scenario just through the code smell of this particular goto use, and used the CodeQL code analysis tool to look for any instances of this flaw in the OpenSSH codebase.
The tool found 50 results, 37 of which turned out to be false positives, and the other 13 were minor issues that were not vulnerabilities. Seems like a dead end, but while manually auditing how well their CodeQL rules did at finding the potentially problematic code, the TRU team found a very similar case, in the VerifyHostKeyDNS handling, that could present a problem. The burning question on my mind when reaching this point of the write-up was what exactly VerifyHostKeyDNS was.
SSH uses public key cryptography to prevent Man in the Middle (MitM) attacks. Without this, it would be rather trivial to intercept an outgoing SSH connection, and pretend to be the target server. This is why SSH will warn you The authenticity of host 'xyz' can't be established. upon first connecting to a new SSH server. And why it so strongly warns that IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! when a connection to a known machine doesn’t verify properly. VerifyHostKeyDNS is an alternative to trusting a server’s key on first connection, instead getting the cryptographic fingerprint in a DNS lookup.
So back to the vulnerability. TRU found one of these goto out; cases in the VerifyHostKeyDNS handling that returned the error code from a function on failure, but the code a layer up only checked for a -1 value. On one layer of code, only a 0 was considered a success, and on the other layer, only a -1 was considered a failure. Manage to find a way to return an error other than -1, and host key verification automatically succeeds. That seems very simple, but it turns out the only other practical error that can be returned is an out of memory error. This leads to the second vulnerability that was discovered.
OpenSSH has its own PING mechanism to determine whether a server is reachable, and what the latency is. When it receives a PING, it sends a PONG message back. During normal operation, that’s perfectly fine. The messages are sent and the memory used is freed. But during key exchange, those PONG packets are simply queued. There are no control mechanisms on how many messages to queue, and a malicious server can keep a client in the key exchange process indefinitely. In itself it’s a denial of service vulnerability for both the client and server side, as it can eat up ridiculous amount of memory. But when combined with the VerifyHostKeyDNS flaw explained above, it’s a way to trigger the out of memory error, and bypass server verification.
The vulnerabilities were fixed in the 9.9p2 release of OpenSSH. The client attack (the more serious of the two) is only exploitable if your client has the VerifyHostKeyDNS option set to “yes” or “ask”. Many systems default this value to “no”, and are thus unaffected.
JumbledPath
We now have a bit more insight into how Salt Typhoon recently breached multiple US telecom providers, and deployed the JumbledPath malware. Hopefully you weren’t expecting some sophisticated chain of zero-day vulnerabilities, because so far the answer seems to be simple credential stealing.
Cisco Talos has released their report on the attacks, and the interesting parts are what the attackers did after they managed to access target infrastructure. The JumbledPath malware is a Go binary, running on x86-64 Linux machines. Lateral movement was pulled off using some clever tricks, like changing the loopback address to an allowed IP, to bypass Access Control Lists (ACLs). Multiple protocols were abused for data gathering and further attacks, like SNMP, RADIUS, FTP, and SSH. There’s certainly more to this story, like where the captured credentials actually came from, and whose conversations were actually targeted, but so far those answers are not available.
Ivanti Warp-Speed Audit
The preferred method of rediscovering vulnerabilities is patch diffing. Vendors will often announce vulnerabilities, and even release updates to correct them, and never really dive into the details of what went wrong with the old code. Patch diffing is looking at the difference between the vulnerable release and the fixed one, figuring out what changed, and trying to track that back to the root cause. Researchers at Horizon3.ai knew there were vulnerabilities in Ivanti’s Endpoint manager, but didn’t have patches to reverse engineer. Seems like a bummer, but was actually serendipity, as the high-speed code audit looking for the known vulnerability actually resulted in four new ones being found!
They are all the same problem, spread across four API endpoints, and all reachable by an unauthenticated user. The code is designed to look at files on the local filesystem, and generate hashes for the files that are found. The problem is that the attacker can supply a file name that actually resolves to an external Universal Naming Convention (UNC) path. The appliance will happily reach out and attempt to authenticate with a remote server, and this exposes the system to credential relay attacks.
RANsacked
The Florida Institute for Cybersecurity Research have published a post and paper (PDF) about RANsacked, their research into various LTE and 5G systems. This is a challenging area to research, as most of us don’t have any spare LTE routing hardware laying around to research on. The obvious solution was to build their own, using open source software like Open5GS, OpenAirInterface, etc. The approach was to harness a fuzzer to find interesting vulnerabilities in these open implementations, and then apply that approach to closed solutions. Serious vulnerabilities were found in every target the fuzzing system was run against.
Their findings break down into three primary categories of vulnerabilities. The first is untrusted Non-Access Stratum (NAS) control messages getting handled by the “core”, the authentication, routing, and processing part of the cellular system. These messages aren’t properly sanitized before processing, leading to the expected crashes and exploits we see in every other insufficiently hardened system that processes untrusted data. The second category is the uncertainty in the protocol specifications and mismatch between what those specifications seem to indicate and the reality of cellular traffic. And finally, deserialization of ASN.1 data itself is subject to deserialization attacks. This group of research found a staggering 119 vulnerabilities in total.
Bits and Bytes
[RyotaK] at GMO Flatt Security found an interesting vulnerability in Chatwork, a popular messaging application in Japan. The desktop version of this tool is just an electron app, and it makes use of webviewTag, an obsolete Electron feature. This quirk can be combined with a dangerous method in the preload context, allowing for arbitrary remote code execution when a user clicks a malicious link in the application.
Once upon a time, Microsoft published Virtual Machines for developers to use for testing websites inside Edge and IE. Those VM images had the puppet admin engine installed, but no configuration set. And that’s not great, because in this state puppet will look for machine using the puppet hostname on the local network, and attempt to download a configuration from there. And because puppet is explicitly designed to administer machines, this automatically results in arbitrary code execution. The VMs are no longer offered, so we’re past the expiration date on this particular trick, but what an interesting quirk of these once-official images.
[Anurag] has an analysis of the Arechclient2 Remote Access Trojan (RAT). It’s a bit of .NET malware, aggressively obfuscated, that collects and exfiltrates data and credentials. There’s a browser element, in the form of a Chrome extension that reports itself as Google Docs. This is more data collection, looking for passwords and other form fills.
Signal users are getting hacked by good old fashioned social engineering. The trick is to generate a QR code from Signal that will permit the account scanning the code to log in on another device. It’s advice some of us have learned the hard way, but QR codes are just physical manifestations of URLs, and we really shouldn’t trust them lightly. Don’t click that link, and don’t scan that QR code.
A New 8-bit CPU for C
It is easy to port C compilers to architectures that look like old minicomputers or bigger CPUs. However, as the authors of the Small Device C Compiler (SDCC) found, pushing C into a typical 8-bit CPU is challenging. Lessons learned from SDCC inspired a new 8-bit architecture, F8. This isn’t just a theoretical architecture. You can find an example Verilog implementation in the SDDC project and on GitHub. The name choice may turn out to be unfortunate as there was an F8 CPU from Fairchild back in the 1970s that apparently few people remember.
In the video from FOSDEM 2025, [Phillip Krause] provides a nice overview of the how and why of F8. While it might seem odd to create a new 8-bit CPU when you can get bigger CPUs for pennies, you have to consider that 8-bit machines are more than enough for many jobs, and if you can squeeze one into an FPGA, it might be a good choice as opposed to having to get a bigger FPGA to hold your design and a 32-bit CPU.
Many 8-bit computers struggle with efficient C code mainly because the data size is smaller than the width of a pointer. Doing things like adding two numbers takes more code, even in common situations. For example, suppose you have a pointer to an array, and each element of the array is four bytes wide. To find the address of the n’th element, you need to compute: element_n = base_address + (n *4). On, say, an 8086 with 16-bit pointers and many 16-bit instructions and addressing modes can do the calculation very succinctly.
Other problems you frequently run into with compiling code for small CPUs include segmented address spaces, dedicated registers for memory indexing, and difficulties putting wider items on a stack (or, for some very small CPUs, even having a stack, at all).
The wish list was to include stack-relative addressing, hardware 8-bit multiplication, and BCD support to help support an efficient printf implementation.
Keep in mind, it isn’t that you can’t compile C for strange 8-bit architectures. SDDC is proof that you can. The question is how efficient is the generated code. F8 provides features that facilitate efficient binaries for C programs.
We’ve seen other modern 8-bit CPUs use SDCC. Writing C code for the notorious PIC (with it’s banked memory, lack of stack, and other hardships) was truly a surreal experience.
Angry Likho: Old beasts in a new forest
Angry Likho (referred to as Sticky Werewolf by some vendors) is an APT group we’ve been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which we’ve analyzed before, so we classified it within the Likho malicious activity cluster. However, Angry Likho’s attacks tend to be targeted, with a more compact infrastructure, a limited range of implants, and a focus on employees of large organizations, including government agencies and their contractors. Given that the bait files are written in fluent Russian, we infer that the attackers are likely native Russian speakers.
We’ve identified hundreds of victims of this attack in Russia, several in Belarus, and additional incidents in other countries. We believe that the attackers are primarily targeting organizations in Russia and Belarus, while the other victims were incidental—perhaps researchers using sandbox environments or exit nodes of Tor and VPN networks.
At the beginning of 2024, several cybersecurity vendors published reports on Angry Likho. However, in June, we detected new attacks from this group, and in January 2025, we identified malicious payloads confirming their continued activity at the moment of our research.
Technical details
Initial attack vector
The initial attack vector used by Angry Likho consists of standardized spear-phishing emails with various attachments. Below is an example of such an email containing a malicious RAR archive.
Contents of spear-phishing email inviting the victim to join a videoconference
The archive includes two malicious LNK files and a legitimate bait file.
Bait document from spear-phishing email inviting the victim to join a videoconference
The content of this document is almost identical to the body of the phishing email.
This example illustrates how the attackers gain access to victims’ systems. All these emails (and others like them in our collection) date back to April 2024. We observed no further activity from this group until we discovered an unusual implant, described below. Based on our telemetry, the attackers operate periodically, pausing their activities for a while before resuming with slightly modified techniques.
Previously unknown Angry Likho implant
In June 2024, we discovered a very interesting implant associated with this APT. The implant was distributed under the name FrameworkSurvivor.exe from the following URL:
hxxps://testdomain123123[.]shop/FrameworkSurvivor.exe
This implant was created using the legitimate open-source installer, Nullsoft Scriptable Install System, and functions as a self-extracting archive (SFX). We’ve previously observed this technique in multiple Awaken Likho campaigns.
Below are the contents of the archive, opened using the 7-Zip archiver.
Contents of the malicious SFX archive
The archive contains a single folder, $INTERNET_CACHE, filled with many files without extensions.
Installation script of the self-extracting archive
To understand how the SFX archive infects a system when launched, we had to find and analyze its installation script. The latest versions of 7-Zip do not allow extraction of this script, but it can be retrieved using older versions. We used 7-Zip version 15.05 (the last version supporting extraction of the installation script):
Contents of the malicious SFX archive opened in 7-Zip version 15.05
The installation script was named [NSIS].nsi, and was partially obfuscated.
Obfuscated contents of the installation script
After deobfuscation, we were able to determine its primary purpose:
Deobfuscated installation script from the malicious SFX implant
The script searches for the folder on the victim’s system using the $INTERNET_CACHE macro, extracts all the files from the archive into it, renames the file “Helping” to “Helping.cmd”, and executes it.
Helping.cmd command file
Below are the contents of the Helping.cmd file:
Contents of the Helping.cmd file
This file is heavily obfuscated, with several meaningless junk lines inserted between each actual script command. Once deobfuscated, the script’s logic becomes clear. Below is the code, with some lines modified for readability:
Deobfuscated Helping.cmd
The Helping.cmd script launches a legitimate AutoIt interpreter (Child.pif) with the file i.a3x as a parameter. The i.a3x file contains a compiled AU3 script. With that in mind, we can assume that this script implements the core logic of the malicious implant.
AU3 script
To recover the original AU3 file used when creating the i.a3x file, we created a dummy executable with a basic AutoIt script, swapped its content with i.a3x, and used a specialized tool to extract the original AU3 script.
We ended up with the original AU3 file:
Restored AU3 script
The script is heavily obfuscated, with all strings encrypted. After deobfuscating and decrypting the code, we analyzed it. The script begins with a few verification procedures:
The AU3 script checks the environment
The script checks for artifacts associated with emulators and research environments of security vendors. If a match is found, it either terminates or executes with a 10,000 ms delay to evade detection.
Interestingly, we’ve seen similar checks in the Awaken Likho implants. This suggests that the attackers behind these two campaigns share the same technology or are the same group using different tools for different targets and tasks.
The script next sets an error-handling mode by calling SetErrorMode() from the kernel32.dll with the flags SEM_NOALIGNMENTFAULTEXCEPT, SEM_NOGPFAULTERRORBOX, and SEM_NOOPENFILEERRORBOX, thus hiding system error messages and reports. If this call fails, the script terminates.
Afterward, the script deletes itself from disk by calling FileDelete(“i”) and generates a large text block, as shown below.
Code for generating “shellcode”
This block is presumably shellcode that will be loaded into memory and executed. However, it is also packed and encrypted. Once unpacked and decrypted, the AU3 script attempts to inject the malicious payload into the legitimate AutoIt process.
Final activity of the AU3 script
Main payload
To obtain the shellcode, we saved a dump of the decrypted and unpacked payload once the AU3 malicious script had fully processed it. After removing unnecessary bytes from the dump, we recovered the original payload of the attack. It turned out to be not shellcode but a full-fledged MZ PE executable file.
The decrypted and unpacked payload—an MZ PE file
Our products detect this payload with the following verdicts:
- HEUR:Trojan.MSIL.Agent.pef
- HEUR:Trojan.Win32.Generic
We examined this payload and concluded that it is the Lumma Trojan stealer (Trojan-PSW.Win32.Lumma).
The Lumma stealer gathers system and installed software information from the compromised devices, as well as sensitive data such as cookies, usernames, passwords, banking card numbers, and connection logs. It also steals data from 11 browsers, including Chrome, Chromium, Edge, Kometa, Vivaldi, Brave, Opera Stable, Opera GX Stable, Opera Neon, Mozilla Firefox and Waterfox, as well as cryptocurrency wallets such as Binance and Ethereum. Additionally, it exfiltrates data from cryptowallet browser extensions (MetaMask) and authenticators (Authenticator), along with information from applications such as the remote access software AnyDesk and the password manager KeePass.
Command servers
This sample contains encoded and encrypted addresses of command servers. Using a simple decryption procedure in the executable file code, we restored the original domain names used as command servers.
- averageorganicfallfaw[.]shop
- distincttangyflippan[.]shop
- macabrecondfucews[.]shop
- greentastellesqwm[.]shop
- stickyyummyskiwffe[.]shop
- sturdyregularrmsnhw[.]shop
- lamentablegapingkwaq[.]shop
- Innerverdanytiresw[.]shop
- standingcomperewhitwo[.]shop
By identifying the command server names from this malware variant, we were able to identify other related samples. As a result, we discovered over 60 malicious implants. Some of them had the same payload, and we managed to find additional attacker-controlled command servers (the addresses listed below were used in the identified samples alongside the original command servers):
- uniedpureevenywjk[.]shop
- spotlessimminentys[.]shop
- specialadventurousw[.]shop
- stronggemateraislw[.]shop
- willingyhollowsk[.]shop
- handsomelydicrwop[.]shop
- softcallousdmykw[.]shop
We’re convinced that the main objectives of this APT group are to steal sensitive data using stealers and establish full control over infected machines via malicious remote administration utilities.
New activity
We’ve been tracking the attacks of this campaign since June 2024. However, in January 2025, the attackers showed a new surge in activity, as reported by our colleagues from F6 (previously known as F.A.C.C.T.). We analyzed the indicators of compromise they published and identified signs of a potential new wave of attacks, likely in preparation since at least January 16, 2025:
Files found in Angry Likho’s payload repositories
We managed to download malicious files hosted in repositories seen in the January Angry Likho attack while they were still accessible. Analysis of the files test.jpg and test2.jpg revealed that they contained the same .NET-based payload, encoded using Base64. Last year, we documented Angry Likho attacks that used image files containing malicious code. Moreover, the filenames match those of the samples we recently discovered.
This further confirms that the Angry Likho group, responsible for these attacks, remains an active threat. We are continuing to monitor this threat and providing up-to-date cyber intelligence data about it and the TTPs used by the group.
Victims
At the time of our investigation, our telemetry data showed hundreds of victims in Russia and several in Belarus. Most of the SFX archives had filenames and bait documents in Russian, thematically linked to government institutions in Russia. These institutions and their contractors are the primary targets of this campaign.
Attribution
We attribute this campaign to the APT group Angry Likho with a high degree of confidence. It shares certain similarities with findings from our colleagues at BI.ZONE and F6, as well as previous attacks by the group:
- The same initial implant structure (an archive with similar contents, sent in an email).
- Similar bait documents with the same naming patterns and themes, mostly written in Russian.
- Command files and AutoIt scripts used to install the implant are obfuscated similarly. Newer versions contain more sophisticated installation scripts, with extra layers of obfuscation to complicate analysis.
- The implant described in this report contains a known payload—the Lumma stealer (Trojan-PSW.Win32.Lumma). We have not previously seen this tool used in Angry Likho campaigns, but earlier attacks showed similar data exfiltration tactics, suggesting the group is still targeting cryptowallet files and user credentials.
Conclusion
We are continuing to monitor the activity of the Angry Likho APT, which targets Russian organizations. The group’s latest attacks use the Lumma stealer, which collects a vast amount of data from infected devices, including browser-stored banking details and cryptowallet files. As before, the complex infection chain was contained in a self-extracting archive distributed via email. We believe that the attackers crafted spear-phishing emails tailored to specific users, attaching bait files designed to attract their interest. Additionally, we identified more malicious samples linked to this campaign based on common command servers and repositories.
Let’s sum up by highlighting the notable features of this campaign and other similar ones:
- The attack techniques remain relatively consistent over time, with only minor modifications. Despite this, the attackers are successfully achieving their objectives.
- The attackers occasionally pause their activity, only to return with a new wave of attacks after a certain period.
- The group relies on readily available malicious utilities obtained from darknet forums, rather than developing its own tools. The only work they do themselves is writing mechanisms of malware delivery to the victim’s device and crafting targeted phishing emails.
To protect against such attacks, organizations need a comprehensive security solution that provides proactive threat hunting, 24/7 monitoring, and incident detection. Our product line for businesses helps identify and prevent attacks of any complexity at an early stage. The campaigns in this article rely on phishing emails as the initial attack vector, highlighting the importance of regular employee training and awareness programs for corporate security.
Indicators of compromise
File hashes
Implants
f8df6cf748cc3cf7c05ab18e798b3e91
ef8c77dc451f6c783d2c4ddb726de111
de26f488328ea0436199c5f728ecd82a
d4b75a8318befdb1474328a92f0fc79d
ba40c097e9d06130f366b86deb4a8124
b0844bb9a6b026569f9baf26a40c36f3
89052678dc147a01f3db76febf8441e4
842f8064a81eb5fc8828580a08d9b044
7c527c6607cc1bfa55ac0203bf395939
75fd9018433f5cbd2a4422d1f09b224e
729c24cc6a49fb635601eb88824aa276
69f6dcdb3d87392f300e9052de99d7ce
5e17d1a077f86f7ae4895a312176eba6
373ebf513d0838e1b8c3ce2028c3e673
351260c2873645e314a889170c7a7750
23ce22596f1c7d6db171753c1d2612fe
0c03efd969f6d9e6517c300f8fd92921
277acb857f1587221fc752f19be27187
Payload
faa47ecbcc846bf182e4ecf3f190a9f4
d8c6199b414bdf298b6a774e60515ba5
9d3337f0e95ece531909e4c8d9f1cc55
6bd84dfb987f9c40098d12e3959994bc
6396908315d9147de3dff98ab1ee4cbe
1e210fcc47eda459998c9a74c30f394e
fe0438938eef75e090a38d8b17687357
Bait files
e0f8d7ec2be638fbf3ddf8077e775b2d
cdd4cfac3ffe891eac5fb913076c4c40
b57b13e9883bbee7712e52616883d437
a3f4e422aecd0547692d172000e4b9b9
9871272af8b06b484f0529c10350a910
97b19d9709ed3b849d7628e2c31cdfc4
8e960334c786280e962db6475e0473ab
76e7cbab1955faa81ba0dda824ebb31d
7140dbd0ca6ef09c74188a41389b0799
5c3394e37c3d1208e499abe56e4ec7eb
47765d12f259325af8acda48b1cbad48
3e6cf927c0115f76ccf507d2f5913e02
32da6c4a44973a5847c4a969950fa4c4
Malicious domains
testdomain123123[.]shop
averageorganicfallfaw[.]shop
distincttangyflippan[.]shop
macabrecondfucews[.]shop
greentastellesqwm[.]shop
stickyyummyskiwffe[.]shop
sturdyregularrmsnhw[.]shop
lamentablegapingkwaq[.]shop
innerverdanytiresw[.]shop
standingcomperewhitwo[.]shop
uniedpureevenywjk[.]shop
spotlessimminentys[.]shop
specialadventurousw[.]shop
stronggemateraislw[.]shop
willingyhollowsk[.]shop
handsomelydicrwop[.]shop
softcallousdmykw[.]shop
securelist.com/angry-likho-apt…
Acoustic Engine Harnesses the Power of Sound
If you think sonic booms from supersonic aircraft are a nuisance, wait until the sky is full of planes propelled by up-scaled versions of this interesting but deafening audio resonance engine.
Granted, there’s a lot of work to do before this “Sonic Ramjet” can fly even something as small as an RC plane. Creator [invalid_credentials] came up with the idea for a sound-powered engine after listening to the subwoofers on a car’s audio system shaking the paint off the body. The current design uses a pair of speaker drivers firing into 3D printed chambers, which are designed based on Fibonacci ratios to optimize resonance. When the speakers are driven with a low-frequency sine wave, the chambers focus the acoustic energy into powerful jets, producing enough thrust to propel a small wheeled test rig across a table.
It’s fair to ask the obvious question: is the engine producing thrust, or is the test model moving thanks to the vibrations caused by the sound? [invalid_credentials] appears to have thought of that, with a video showing a test driver generating a powerful jet of air. Downloads to STL files for both the large and small versions of the resonating chamber are provided, if you want to give it a try yourself. Just be careful not to annoy the neighbors too much.
Thanks to [cabbage] for the tip via [r/3Dprinting].
NoName057(16) avvia la quarta Giornata di Attacchi DDoS. Qualcuno giù, Leonardo senza problemi
Gli hacker di NoName057(16) continuano i loro attacchi di Distributed Denial-of-Service (DDoS) contro gli obiettivi italiani. Molti dei loro canali Telegram sono stati eliminati negli scorsi giorni, sinonimo che la moderazione del social network di Durov sta iniziando a portare i miglioramenti decantati.
Oggi gli obiettivi rivendicati in un post sul nuovo canale Telegram sono i seguenti:
❌Negozio online Parmalat SpA
check-host.net/check-report/234a0982kba8
❌Marcegaglia è un gruppo industriale che produce acciaio al carbonio e inox
check-host.net/check-report/234a0b66ka64
❌TechnoAlpin, specializzato nella produzione di sistemi di innevamento manuale e completamente automatico.
check-host.net/check-report/234a0cbek311
❌Leonardo è una delle più grandi aziende di ingegneria meccanica in Italia (dead on ping)
check-host.net/check-report/234a0ce3k64a
❌Alpi Aviation - produttore italiano di velivoli ultraleggeri
check-host.net/check-report/234a0de4k9a7
Mentre altri siti risentono delle connessioni anomale, il sito di Leonardo è perfettamente raggiungibile. Sinonimo che l’azienda ha tutte le mitigazioni del caso attive per poter reagire ad attacchi come quelli sferrati dal progetto DDoSia.
Ricordiamo sempre che gli attacchi DDoS non arrecano danni ai sistemi, ma per un periodo temporaneamente limitato non permettono un corretto accesso alle pagine web delle aziende colpite. Dopo l’attacco, tutto ritorna nuovamente disponibile.
NoName057(16) è un gruppo di hacker che si è dichiarato a marzo del 2022 a supporto della Federazione Russa. Hanno rivendicato la responsabilità di attacchi informatici a paesi come l’Ucraina, gli Stati Uniti e altri vari paesi europei. Questi attacchi vengono in genere eseguiti su agenzie governative, media e siti Web di società private
Che cos’è un attacco Distributed Denial of Service
Un attacco DDoS (Distributed Denial of Service) è un tipo di attacco informatico in cui vengono inviate una grande quantità di richieste a un server o a un sito web da molte macchine diverse contemporaneamente, al fine di sovraccaricare le risorse del server e renderlo inaccessibile ai suoi utenti legittimi.
Queste richieste possono essere inviate da un grande numero di dispositivi infetti da malware e controllati da un’organizzazione criminale, da una rete di computer compromessi chiamata botnet, o da altre fonti di traffico non legittime. L’obiettivo di un attacco DDoS è spesso quello di interrompere le attività online di un’organizzazione o di un’azienda, o di costringerla a pagare un riscatto per ripristinare l’accesso ai propri servizi online.
Gli attacchi DDoS possono causare danni significativi alle attività online di un’organizzazione, inclusi tempi di inattività prolungati, perdita di dati e danni reputazionali. Per proteggersi da questi attacchi, le organizzazioni possono adottare misure di sicurezza come la limitazione del traffico di rete proveniente da fonti sospette, l’utilizzo di servizi di protezione contro gli attacchi DDoS o la progettazione di sistemi resistenti agli attacchi DDoS.
Occorre precisare che gli attacchi di tipo DDoS, seppur provocano un disservizio temporaneo ai sistemi, non hanno impatti sulla Riservatezza e Integrità dei dati, ma solo sulla loro disponibilità. pertanto una volta concluso l’attacco DDoS, il sito riprende a funzionare esattamente come prima.
Che cos’è l’hacktivismo cibernetico
L’hacktivismo cibernetico è un movimento che si serve delle tecniche di hacking informatico per promuovere un messaggio politico o sociale. Gli hacktivisti usano le loro abilità informatiche per svolgere azioni online come l’accesso non autorizzato a siti web o a reti informatiche, la diffusione di informazioni riservate o il blocco dei servizi online di una determinata organizzazione.
L’obiettivo dell’hacktivismo cibernetico è di sensibilizzare l’opinione pubblica su questioni importanti come la libertà di espressione, la privacy, la libertà di accesso all’informazione o la lotta contro la censura online. Gli hacktivisti possono appartenere a gruppi organizzati o agire individualmente, ma in entrambi i casi utilizzano le loro competenze informatiche per creare un impatto sociale e politico.
È importante sottolineare che l’hacktivismo cibernetico non deve essere confuso con il cybercrime, ovvero la pratica di utilizzare le tecniche di hacking per scopi illeciti come il furto di dati personali o finanziari. Mentre il cybercrime è illegale, l’hacktivismo cibernetico può essere considerato legittimo se mira a portare all’attenzione pubblica questioni importanti e a favorire il dibattito democratico. Tuttavia, le azioni degli hacktivisti possono avere conseguenze legali e gli hacktivisti possono essere perseguiti per le loro azioni.
Chi sono gli hacktivisti di NoName057(16)
NoName057(16) è un gruppo di hacker che si è dichiarato a marzo del 2022 a supporto della Federazione Russa. Hanno rivendicato la responsabilità di attacchi informatici a paesi come l’Ucraina, gli Stati Uniti e altri vari paesi europei. Questi attacchi vengono in genere eseguiti su agenzie governative, media e siti Web di società private
Le informazioni sugli attacchi effettuati da NoName057(16) sono pubblicate nell’omonimo canale di messaggistica di Telegram. Secondo i media ucraini, il gruppo è anche coinvolto nell’invio di lettere di minaccia ai giornalisti ucraini. Gli hacker hanno guadagnato la loro popolarità durante una serie di massicci attacchi DDOS sui siti web lituani.
Le tecniche di attacco DDoS utilizzate dal gruppo sono miste, prediligendo la “Slow http attack”.
La tecnica del “Slow Http Attack”
L’attacco “Slow HTTP Attack” (l’articolo completo a questo link) è un tipo di attacco informatico che sfrutta una vulnerabilità dei server web. In questo tipo di attacco, l’attaccante invia molte richieste HTTP incomplete al server bersaglio, con lo scopo di tenere occupate le connessioni al server per un periodo prolungato e impedire l’accesso ai legittimi utenti del sito.
Nello specifico, l’attacco Slow HTTP sfrutta la modalità di funzionamento del protocollo HTTP, che prevede che una richiesta HTTP sia composta da tre parti: la richiesta, la risposta e il corpo del messaggio. L’attaccante invia molte richieste HTTP incomplete, in cui il corpo del messaggio viene inviato in modo molto lento o in modo incompleto, bloccando la connessione e impedendo al server di liberare le risorse necessarie per servire altre richieste.
Questo tipo di attacco è particolarmente difficile da rilevare e mitigare, poiché le richieste sembrano legittime, ma richiedono un tempo eccessivo per essere elaborate dal server. Gli attacchi Slow HTTP possono causare tempi di risposta molto lenti o tempi di inattività del server, rendendo impossibile l’accesso ai servizi online ospitati su quel sistema.
Per proteggersi da questi attacchi, le organizzazioni possono implementare soluzioni di sicurezza come l’uso di firewall applicativi (web application firewall o WAF), la limitazione delle connessioni al server e l’utilizzo di sistemi di rilevamento e mitigazione degli attacchi DDoS
L'articolo NoName057(16) avvia la quarta Giornata di Attacchi DDoS. Qualcuno giù, Leonardo senza problemi proviene da il blog della sicurezza informatica.
220$ per entrare nella Polizia di Stato Italiana: l’inquietante offerta di EDRVendor
Su BreachForum un utente dallo pseudonimo EDRVendor ha venduto, dopo poche ore dall’annuncio, l’accesso ad una cassetta postale della polizia di stato italiana.
Oltre alla mail viene offerto anche l’accesso ai pannelli riservati alle forze dell’ordine dei principali social network: Meta (Facebook, WhatsApp e Instagram), TikTok e X.
Il prezzo di vendita è di 220 dollari e con 60 dollari in più era possibile avere in bundle anche un “mandato di perquisizione e un mandato di cattura”.
La reputazione di EDRVendor è molto alta su BreachForum e lo stesso utente, a garanzia della transazione, riporta i suoi feedback a 5 stelle su Escrow.
Abbiamo approfondito il profilo di EDRVendor e pare essere specializzato nella vendita di accessi governativi.
Istruzioni pronte all’uso direttamente dall’IaB
Cosa è possibile fare comprando accessi di questo tipo? La risposta è ovvia, ma se per caso avessimo qualche dubbio, EDRVendor offre anche qualche suggerimento.
Avere accesso alla cassetta postale di una forza di polizia genera una “credibilità” tale da commettere ogni sorta di illecito, proviamo a fare qualche riflessione in merito:
- Presentare richieste di dati di emergenza/richieste di ricerca che includono: Registri delle chiamate/Richieste di conformità delle forze dell’ordine (in combinazione con un mandato di comparizione/ordine del tribunale o come EDR);
- Sfruttare le Industrie Osint: (iscrivendosi alla posta elettronica del governo e richiedendo crediti gratuiti, soggetti ad approvazione);
- Estorsione/Scamming/Spooking/Vanità: Avere il potere di influenzare chi si vuole, quando si vuole;
- Diffondere il ransomware tra i ranghi del governo o dei singoli: Quale miglior catalizzatore per diffondere il ransomware?
- Phishing di governi o individui: È più probabile che le persone cadano nel vostro phishing se questo viene diffuso da una mail governativa;
- Richiedere l’accesso a pannelli di social media/forze dell’ordine e servizi di crittografia: Fingetevi un funzionario governativo e richiedete l’accesso ovunque. Scrivere e inviare lettere di raccomandazione: Perché no;
- Social Engineering contro altri funzionari governativi per aumentare i privilegi all’interno dell’infrastruttura governativa: Pivot, pivot, pivot!
Viene quindi riportata la possibilità di accedere ai portali dedicati alle forze dell’ordine (messi a disposizione dai social network) consente di richiedere informazioni di qualsiasi natura in merito ai profili degli utenti, giustificando la richiesta come relativa ad un’indagine in corso.
Inoltre, da quanto riporta l’Initial Access Broker, è possibile richiedere un EDR (Emergency Data Request) a seguito del quale vengono fornite informazioni quali: log di accesso, IP, numeri di telefono ecc. Per un EDR potrebbero essere richiesti anche documenti comprovanti l’indagine in corso, ecco perché nel bundle in vendita venivano offerti anche un “mandato di attesto e un mandato di perquisizione”.
EDRVendor, nel suo post di vendita, mette anche degli screenshot che dimostrano l’effettiva capacità di eseguire un EDR nei confronti dei vari social media.
Poter recuperare così “facilmente” informazioni su qualsiasi utente di un social media, apre a scenari di CSINT (Closed Source Intelligence) molto evoluti.
Sempre EDRVendor in uno suo post del 23 gennaio 2025 regala una guida molto evoluta sui tool e le tecniche di OSINT/Doxxing: post dal titolo “Best and Most Comprehensive Guide To Doxing/OSINT You Will Find. [FREE!|”.
Per concludere è importante capire che ruolo giocano gli IAB (Initial Access Broker) nel panorama dell’underground, aprendo le porte a gruppi hacker che poi sfruttano questi accessi per portare a segno attacchi più importanti e potenzialmente devastanti.
Abbiamo informato prima di scrivere questo articolo la polizia postale che ci ha detto che stanno già indagando sulla questione.
L'articolo 220$ per entrare nella Polizia di Stato Italiana: l’inquietante offerta di EDRVendor proviene da il blog della sicurezza informatica.
3D Print Yourself A Split Flap Display
Split flap displays! They’re mechanical, clickety-clackity, and largely commercially irrelevant in our screen-obsessed age. That doesn’t mean you can’t have a ball making one of your own, though! [Morgan Manly] did just that, with tidy results.
An ESP32 C3 SuperMini serves as the boss of the operation, running the whole display. The display is designed to be modular, so you can daisy chain multiple characters together to spell longer words. Each module has 37 characters, so it can display the alphabet, numerals 0 to 9, and a blank. Each module contains a 28BYJ-48 stepper motor for controlling the flaps, and a ULN2003 driver board to run it and a PCF8575 IO expander to handle communciation. An A3144 hall effect sensor is also used for positional feedback to ensure the display always shows the right character. The flap mechanism itself is relatively straightforward—a drum with all 37 flaps is until the correct character is reached, with the blank flaps hosting a magnet to trigger the aforementioned hall effect sensor. The flaps themselves are 3D-printed, with filament changes used to color the characters against the background.
If you’ve ever dreamed of building a flap-display clock or ticker, you needn’t dream of finding the perfect vintage example. You can just build your own! The added bonus is that you can make it as big or as small as you like. We’ve seen some interesting variations on the split flap concept recently, too. If you’re cooking up your own kooky electromechanical displays, don’t hesitate to let us know!
Microsoft (Again) Claims Topological Quantum Computing With Majorana Zero Mode Anyons
As the fundamental flaw of today’s quantum computers, improving qubit stability remains the focus of much research in this field. One such stability attempt involves so-called topological quantum computing with the use of anyons, which are two-dimensional quasiparticles. Such an approach has been claimed by Microsoft in a recent paper in Nature. This comes a few years after an earlier claim by Microsoft for much the same feat, which was found to be based on faulty science and hence retracted.
The claimed creation of anyons here involves Majorana fermions, which differ from the much more typical Dirac fermions. These Majorana fermions are bound with other such fermions as a Majorana zero mode (MZM), forming anyons that are intertwined (braided) to form what are in effect logic gates. In theNature paper the Microsoft researchers demonstrate a superconducting indium-arsenide (InAs) nanowire-based device featuring a read-out circuit (quantum dot interferometer) with the capacitance of one of the quantum dots said to vary in a way that suggests that the nanowire device-under-test demonstrates the presence of MZMs at either end of the wire.
Microsoft has a dedicated website to their quantum computing efforts, though it remains essential to stress that this is not a confirmation until their research is replicated by independent researchers. If confirmed, MZMs could provide a way to create more reliable quantum computing circuitry that does not have to lean so heavily on error correction to get any usable output. Other, competing efforts here include such things as hybrid mechanical qubits and antimony-based qubits that should be more stable owing to their eight spin configurations.