Infosec Press

Reader

Read the latest posts from Infosec Press.

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


Highlight

🔔 Schwerwiegende Sicherheitslücken in Sonicwall SSL-VPN – aktiv ausgenutzt warning https://www.cert.at/de/warnungen/2025/1/schwewiegende-sicherheitslucken-in-sonicwall-ssl-vpn-aktiv-ausgenutzt


News For All

🕵️‍♂️ Privacy of Photos.app’s Enhanced Visual Search privacy – Apple's Enhanced Visual Search feature, enabled by default, allows photo data to be matched with a global index, raising privacy concerns about data transmission and user consent. https://mjtsai.com/blog/2025/01/01/privacy-of-photos-apps-enhanced-visual-search/

📊 Telegram Hands U.S. Authorities Data on Thousands of Users privacy – Telegram provided U.S. authorities with data on over 2,200 users in 2024, marking a significant increase in data requests after its CEO was arrested. https://www.404media.co/telegram-hands-u-s-authorities-data-on-thousands-of-users/

🧬 Widely used DNA sequencer still doesn’t enforce Secure Boot vulnerability – The Illumina iSeq 100 DNA sequencer lacks Secure Boot enforcement, exposing it to firmware attacks. Researchers warn this vulnerability could be exploited by threat actors in sensitive environments. https://arstechnica.com/security/2025/01/widely-used-dna-sequencer-still-doesnt-enforce-secure-boot/

🪽 UN aviation agency ‘investigating’ security breach after hacker claims theft of personal data data breach – The ICAO is investigating a security breach after a hacker claimed to have stolen 42,000 documents containing personal data, including names and contact details of individuals. https://techcrunch.com/2025/01/07/un-aviation-agency-investigating-security-breach-after-hacker-claims-theft-of-personal-data/

🔒 Android patches several vulnerabilities in first security update of 2025 security news – Android's first security update of 2025 addresses critical RCE vulnerabilities that could allow attackers to execute code without privileges. Users are urged to apply patches to protect their devices. https://cyberscoop.com/android-security-update-january-2025/

🚘The leaked GTA San Andreas source code is apparently fake and contains ransomware, so please don't download it malware – The purported GTA: San Andreas source code leak is fake and harbors ransomware from a new group called Rhysida. https://www.gamesradar.com/games/grand-theft-auto/the-leaked-gta-san-andreas-source-code-is-apparently-fake-and-contains-ransomware-so-please-dont-download-it/

📹 License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data security research – Misconfigured ALPR systems from Motorola are exposing live video feeds and sensitive vehicle data online, raising serious privacy concerns. Over 150 cameras have leaked information due to security flaws. https://www.wired.com/story/license-plate-reader-live-video-data-exposed/

🗣️ Meta replaces fact-checking with community notes post ‘Cultural Tipping Point’ security news – Meta is shifting from its fact-checking program to a community notes system, emphasizing free speech and reducing censorship. This change aims to simplify policies and enhance user involvement in moderation. https://securityaffairs.com/172793/social-networks/meta-replaces-fact-checking.html

🏈 Data of more than 8,500 customers breached on Green Bay Packers shopping website data breach – The Green Bay Packers reported a breach affecting 8,514 customers due to malicious code on their Pro Shop website, compromising payment information. Affected individuals will receive credit monitoring services. https://therecord.media/green-bay-packers-online-store-data-breach

🔍 Here’s how hucksters are manipulating Google to promote shady Chrome extensions cybercrime – Developers are violating Chrome Web Store policies by using keyword stuffing techniques, including hidden translations, to manipulate search results for extensions. This leads to unrelated or potentially harmful extensions appearing in searches. https://arstechnica.com/security/2025/01/googles-chrome-web-store-has-a-serious-spam-problem-promoting-shady-extensions/

📳 Apple says Siri isn’t sending your conversations to advertisers privacy – Apple denies claims that Siri recordings are used for advertising, stating it has never built marketing profiles from Siri data. This follows a settlement over privacy concerns related to Siri interactions. https://www.theverge.com/2025/1/8/24337477/apple-responds-rumors-siri-advertising-privacy-lawsuit

🐻 Space Bears Ransomware: What You Need To Know cybercrime – Space Bears is a new ransomware group known for its corporate-like image and ransom tactics. Operating from Moscow, they steal data, encrypt systems, and demand payment, offering post-transaction guarantees. https://www.tripwire.com/state-of-security/space-bears-ransomware-what-you-need-know

📍 Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location data breach – A hack of Gravy Analytics exposed thousands of apps, including popular ones like Candy Crush and Tinder, used to collect sensitive location data without user knowledge, raising serious privacy concerns. https://www.wired.com/story/gravy-location-data-app-leak-rtb/

📚 PowerSchool data breach leaks info of students and staff at schools across the US data breach – A data breach at PowerSchool has potentially exposed sensitive information of students and staff, including names, addresses, and Social Security numbers. The company has paid a ransom and claims the data is deleted. https://www.theverge.com/2025/1/10/24340556/powerschool-sis-data-breach-leak-student-data-us-canada-schools

💻 Slovakia’s land registry hit by biggest cyberattack in country’s history, minister says security news – Slovakia's land registry suffered its largest cyberattack, disrupting property transactions and essential services. The attack, believed to be ransomware, has paralyzed real estate markets and is linked to rising tensions with Ukraine. https://therecord.media/slovakia-registry-cyberattack-land-agriculture

💸 A novel PayPal phishing campaign hijacks accounts cybercrime – Fortinet warns of a phishing campaign targeting PayPal users by using legitimate links to trick victims into granting unauthorized access, potentially compromising their accounts. https://securityaffairs.com/172935/cyber-crime/paypal-phishing-campaign-hijacks-accounts.html

📦 How Cracks and Installers Bring Malware to Your Device security research – Attackers exploit platforms like YouTube to distribute fake installers, using reputable file hosting services and encryption to evade detection. This malware collects sensitive browser data, highlighting the risks of downloading fraudulent software. https://www.trendmicro.com/en_us/research/25/a/how-cracks-and-installers-bring-malware-to-your-device.html


Some More, For the Curious

🎣 New PhishWP Plugin on Russian Forum Turns Sites into Phishing Pages cybercrime – Cybercriminals have developed PhishWP, a WordPress plugin that creates fake payment pages to steal sensitive data like credit card info. It sends stolen data directly to attackers via Telegram. https://hackread.com/phishwp-plugin-russian-hacker-forum-phishing-sites/

⚠️ MediaTek says ‘Happy New Year’ with critical RCE, other bugs vulnerability – MediaTek disclosed critical vulnerabilities, including a severe RCE bug in 51 chipsets that could be exploited via attacker-controlled base stations. Device manufacturers were notified and patches are expected. https://www.theregister.com/2025/01/06/mediatek_chipset_vulnerabilities/

🏭 Industrial networking manufacturer Moxa reports ‘critical’ router bugs vulnerability – Moxa's cellular and secure routers have critical vulnerabilities allowing privilege escalation and command execution. Users are urged to apply patches or limit network exposure to mitigate risks. https://cyberscoop.com/industrial-networking-manufacturer-moxa-reports-critical-router-bugs/

📡 Three more telcos reportedly join China Salt Typhoon victims security news – Charter, Consolidated, and Windstream are the latest telecom companies confirmed as victims of the Salt Typhoon cyberattack, attributed to Chinese government espionage efforts targeting U.S. networks. https://www.theregister.com/2025/01/06/charter_consolidated_windstream_salt_typhoon/

🔍 CISA says 'no indication' of wider government hack beyond Treasury security news – CISA reports no evidence of other U.S. federal agencies being hacked in the December cyberattack on the Treasury, attributed to Chinese government-backed hackers accessing employee workstations. https://techcrunch.com/2025/01/06/cisa-says-no-indication-of-wider-government-hack-beyond-treasury/

🛡️ US adds Tencent to the list of companies supporting Chinese military security news – The U.S. Department of Defense has listed Tencent among companies supporting the Chinese military, citing concerns over its technologies' dual-use potential. Tencent plans to appeal, claiming the inclusion is an error. https://securityaffairs.com/172765/security/us-adds-tencent-list-of-companies-supporting-chinese-military.html

🦠 Gayfemboy Botnet targets Four-Faith router vulnerability cybercrime – The Gayfemboy botnet, a variant of Mirai, exploits vulnerabilities in Four-Faith routers and other devices to conduct DDoS attacks, with over 15,000 active nodes targeting global entities since late 2024. https://securityaffairs.com/172805/malware/gayfemboy-mirai-botnet-four-faith-flaw.html

🪢 Ukrainian Cyber Alliance destroyed the connectivity of Russian ISP Nodex security news – The Ukrainian Cyber Alliance hacked Russian ISP Nodex, stealing sensitive data and disrupting connectivity. The ISP confirmed the attack and is working to restore its systems. https://securityaffairs.com/172864/hacktivism/ukrainian-cyber-alliance-destroyed-russian-isp-nodex.html

💰 Facebook awards researcher $100,000 for finding bug that granted internal access security news – Ben Sadeghipour discovered a vulnerability in Facebook's ad platform that allowed him to run commands on an internal server. Meta awarded him $100,000 for reporting the issue, which was fixed quickly. https://techcrunch.com/2025/01/09/facebook-awards-researcher-100000-for-finding-bug-that-granted-internal-access/

🖱️ Researchers disclosed details of a now-patched Samsung zero-click flaw vulnerability – Google Project Zero revealed a now-patched zero-click vulnerability (CVE-2024-49415) in Samsung devices that allowed remote code execution via audio messages, affecting Galaxy S23 and S24 models. https://securityaffairs.com/172909/hacking/samsung-zero-click-flaw.html

🔑 How We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud hacking write-up – Researchers cracked a 512-bit DKIM key using a cloud server for under $8, revealing the insecurity of short RSA keys. They tested DKIM signatures, finding some providers accepted the compromised key. https://dmarcchecker.app/articles/crack-512-bit-dkim-rsa-key

🚼 WorstFit: Unveiling Hidden Transformers in Windows ANSI! hacking write-up – Research reveals a novel attack surface in Windows through the Best-Fit character conversion feature, leading to vulnerabilities like Path Traversal and RCE. The study highlights risks associated with encoding mishandling and provides examples of exploitation. https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/

🔍 Using SYN Port Scans with Source IP Spoofing For Offensive Deception cyber defense – This article discusses how attackers use SYN port scanning with spoofed IP addresses as a deceptive tactic to generate alerts, diverting SOC teams' attention from real threats. It highlights the challenges modern IDS face in detecting such evasion techniques. https://tierzerosecurity.co.nz/2025/01/08/syn-spoof-scan.html


CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities, including two from Mitel and one from Oracle, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, highlighting significant security risks. https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Vulnerability to the KEV Catalog warning – CISA has added CVE-2025-0282, a vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities Catalog, urging organizations to implement mitigations and report incidents promptly. https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog

⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA issued two advisories on January 7, 2025, highlighting security issues in ABB and Nedap ICS products. Users are urged to review for vulnerabilities and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-releases-two-industrial-control-systems-advisories ⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA has issued four advisories on January 10, 2025, detailing security vulnerabilities in various Industrial Control Systems, urging users to review for technical details and mitigations. https://www.cisa.gov/news-events/alerts/2025/01/10/cisa-releases-four-industrial-control-systems-advisories


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from Not Simon 🐐

Country: People's Republic of China Organization: Ministry of State Security (MSS) Objective: Espionage (Page Last Updated: January 11, 2025)

Aliases:

  • APT40 (Hainan State Security Department (HSSD), of the MSS)

Vulnerabilities Exploited

  • CVE-2021-40539 (9.8 critical, in CISA's KEV Catalog) Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Source: Implied to be CVE-2021-40539 by Microsoft
  • CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell). Source: Microsoft

The following four vulnerabilities have the same source: Microsoft

  • CVE-2021-26855 (9.1 critical; NVD 9.8, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-26857 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-26858 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)
  • CVE-2021-27065 (7.8 high, in CISA's KEV Catalog) Microsoft Exchange Server Remote Code Execution Vulnerability (aka ProxyLogon)

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2025

2024

2022

2021

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

 
Read more...

from Not Simon 🐐

This is a variation of Kraven Security's Cyber Threat Intelligence Report Template which contains great information already but I added my own preferences. Feel free to use this however you'd like.

Report: # Date: Priority: Low/Moderate/High/Critical Source and Reliability Information: Admiralty Scale Score [A-F][1-6] Sensitivity: Traffic Light Protocol

  1. Executive Summary
  2. Key Takeaways
  3. Intelligence Assessment
  4. Key Intelligence Gaps
  5. Indicators of Compromise (IOCs)
  6. MITRE ATT&CK Techniques
  7. Detection Opportunities
  8. Appendices
    • Probability Matrix
    • Priority Matrix
    • Source Reliability and Information Credibility
    • Confidence Levels
    • Feedback Contacts
    • Definitions and Acronyms

1. Executive Summary

A brief summary of the report. It should explain the report's significance, create a simple, easy-to-follow narrative of its key findings, and support a single decision. The reader should be able to make an informed decision based entirely on this summary. Aim to answer the following questions concisely:

  • What intelligence requirement(s) has this report fulfilled?
  • Why is this report relevant to the organization?
  • What is the biggest takeaway?
  • What new intelligence has been provided?
  • Does this report support or contradict existing assumptions, security initiatives, or objectives?

2. Key Takeaways

A bulleted list of the key findings from this report. Aim to answer the following questions:

  • Who is this report for?
  • Where was the data collected (source)?
  • Who was the attacker?
  • Who was the victim?
  • Why does this report matter to the target audience?
  • What is the main takeaway from this report?

This bulleted list is followed by a table summarizing key intelligence and a general analysis of the threat the report discusses using the Diamond Model. This allows key intelligence metrics to be easily identified and visualized.

Intelligence Requirements Addressed Citation of the IR addressed by this report
Data Sources
Threat Actor Primary threat actor (and aliases) or N/A or Unknown
Victim Location Country of victim
Sectors Industry targeted
Motivation Cybercrime / Espionage / Hacktivism / Ransomware / ICS / Other / Unknown

Diamond Model

Capabilities Adversary Infrastructure Victim
MITRE technique, malware, hacking tool Threat Actor, alias, email address, persona IP address, domain name, URL, C2 server company, workstation/server name, email address

3. Intelligence Assessment

This section should include:

  • A call to action, recommendation, or judgment: This threat (e.g., activity, threat actor, malware, etc.) demonstrates X and could potentially impact us. Therefore, we should do Y.
  • Any new information: This threat has a new tool, capability, TTP, etc. Key evidence: The threat has the following characteristics that uniquely distinguish it.
  • Estimative language (see Probability Matrix): “I assess with a level of certainty that < judgment> will impact us .”
  • Background information: Any relevant background information about the threat actor, malware, TTP, etc., to give context to this new assessment.
  • Relations to your organization: How does this threat relate to your organization? Does it target your country or sector? Does it target vulnerabilities in the systems or technologies you use? Does it relate to any previous security incidents or detections?

This section should include a kill chain analysis technique like Lockheed Martin’s Cyber Kill Chain. List the IOCs or TTPs found at each stage of the attack to create an attack narrative for the reader. The security operations team can then use this to identify possible mitigations or gaps.

Cyber Kill Chain

  • S1: Reconnaissance
  • S2: Weaponization
  • S3: Delivery
  • S4: Exploitation
  • S5: Installation
  • S6: Command & Control
  • S7: Actions on Objective

4. Key Intelligence Gaps

A bulleted list that summarizes additional information the CTI team needs to complete their analysis and raise the confidence of the assessment. You should highlight gaps affecting the assessment, such as if new information is discovered or existing information is proven wrong.

These gaps should be tracked externally from the report using a project/task management system.

5. Indicators of Compromise (IOCs)

This section consists of IOCs found on endpoint devices (workstations, servers, mobile devices), in network logs, related malware, and any vulnerabilities relevant to the threat being discussed.

  • Endpoint Artifact: Endpoint Artifact, Type, Description, Tactic
  • Network Artifacts: Network Artifact, Type, Description, Kill Chain Stage (first observed, last observed)
  • Malware: Malware, Hash Type, File Hash, Description, Malware Analysis Report, Kill Chain Stage
  • Common Vulnerabilities and Exposures (CVEs): CVE ID, CVSS (include version) Score, Patch Available (Y/N), Remediation, Date Reported, Patch Applied (Y/N/ N/A)
  • MITRE ATT&CK Techniques: Tactic, Technique, Procedure, D3FEND, Security Control
  • Detection Opportunities: Rule/Query, Name, Type, Description, Reference (source)

6. Appendices

Probability Matrix

almost no chance very unlikely unlikely roughly even chance likely very likely almost certain(ly)
remote highly improbable improbable roughly even odds probable (probably) highly probable nearly certain
01-05% 05-20% 20-45% 45-55% 55-80% 80-95% 95-99%

Analysts are strongly encouraged not to mix terms from different rows. Products that do mix terms must include a disclaimer clearly noting the terms indicate the same assessment of probability.

To avoid confusion, products that express an analyst's confidence in an assessment or judgment using a “confidence level” (e.g., “high confidence”) must not combine a confidence level and a degree of likelihood, which refers to an event or development, in the same sentence.

Priority Matrix

You should assign each report a priority based on its impact on your organization. The following table describes four general priority levels you can assign to a report.

  • Low: The threat requires regular monitoring and should be addressed when possible.
  • Moderate: The threat needs to be monitored closely and addressed.
  • High: The threat needs to be addressed quickly and monitored.
  • Critical: Immediate action is required.

Source and Information Reliability

Each report should include an evaluation of source reliability. An industry standard is the Admiralty Scale, developed by NATO. This scale scores source reliability on a scale of A-F and information credibility on a scale of 1-6. Attaching an appendix that describes this to the reader provides clarity.

Source Reliability (A-F)

  • A (Completely reliable): The source has a history of consistently providing accurate information.
  • B (Usually reliable): Most of the time, the source provides accurate information.
  • C (Fairly reliable): The source has provided accurate information on occasion.
  • D (Not usually reliable): The source has provided accurate information infrequently.
  • E (Unreliable): The source has rarely or never provided accurate information.
  • F (Reliability cannot be judged): The source’s reliability is unknown or untested.

Information Credibility (1-6)

  • 1 (Confirmed): Other independent sources have confirmed the information.
  • 2 (Probably true): The information is likely true but has not been confirmed.
  • 3 (Possibly true): The information might be true, but it is unconfirmed.
  • 4 (Doubtful): The information is unlikely to be true.
  • 5 (Improbable): The information is very unlikely to be true.
  • 6 (Cannot be judged): The credibility of the information cannot be assessed.

Confidence Levels

  • High: Good quality of information, evidence from multiple collection capabilities, possible to make a clear judgment.
  • Moderate: Evidence is open to a number of interpretations, or is credible and plausible but lacks correlation.
  • Low: Fragmentary information, or from collection capabilities of dubious reliability.

Sensitivity Matrix

Each report should attach a sensitivity level as defined by your organization’s data protection policy. This ensures data is handled appropriately and only shared with appropriate personnel. Attaching an appendix that describes this to the reader provides clarity.

  • TLP:RED: For the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting
  • TLP:AMBER: Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: If the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT.
  • TLP:GREEN: Limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: When “community” is not defined, assume the cybersecurity/cyber defense community.
  • TLP:CLEAR: Recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction.

Feedback Contacts

Provide a point of contact where the intelligence consumer can direct their feedback once the intelligence report has been published. This will help the CTI team improve future reports, ensure intelligence requirements are being met, and maintain communication channels.

Definitions and Acronyms

A list of key terms and acronyms used throughout the report. This lets the reader understand how the CTI team defines a particular technical term.

 
Read more...

from Bruno Miguel

Be careful with this. Don't remove old versions before ensuring the new package version works as expected.

How to list all the installed versions

LANG=C snap list --all | awk '/disabled/{print $1, $3}'

How to remove all the old versions in a batch

LANG=C snap list --all | awk '/disabled/{print $1, $3}' |
    while read SnapName revision; do
        sudo snap remove "$SnapName" --revision="$revision"
    done

This can save you some disk space, but it can become a headache if you don't make sure the new snap package version is working well. Also, don't forget to read the fine manual.

#Linux #Ubuntu #Snap #Tips

 
Leia mais...

from csantosb

img
Nulla facilisis, risus a rhoncus fermentum, tellus tellus lacinia purus, et dictum nunc justo sit amet elit.
Aliquam erat volutpat. Nunc eleifend leo vitae magna. In id erat non orci commodo lobortis. Proin neque massa, cursus ut, gravida ut, lobortis eget, lacus. Sed diam. Praesent fermentum tempor tellus. Nullam tempus. Mauris ac felis vel velit tristique imperdiet. Donec at pede. Etiam vel neque nec dui dignissim bibendum. Vivamus id enim. Phasellus neque orci, porta a, aliquet quis, semper a, massa. Phasellus purus. Pellentesque tristique imperdiet tortor. Nam euismod tellus id erat.

the how

Lorem #mytag ipsum dolor sit amet, consectetuer adipiscing elit. Donec hendrerit tempor tellus. Donec pretium posuere tellus. Proin quam nisl, tincidunt et, mattis eget, convallis nec, purus. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Nulla posuere. Donec vitae dolor. Nullam tristique diam non turpis. Cras placerat accumsan nulla. Nullam rutrum. Nam vestibulum accumsan nisl.

 
Read more...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


Highlight

📧 Mails zur Rückerstattung von ORF warning – Aktuell erhalten viele Personen Phishing-E-Mails, die fälschlicherweise eine Rückerstattung von ORF-Gebühren in Höhe von 34,40 Euro versprechen, um Kontodaten zu stehlen. https://www.watchlist-internet.at/news/betruegerisches-orf-rueckerstattung-e-mail/


News For All

🧩 Large language models can do jaw-dropping things. But nobody knows exactly why. security research – Researchers explore the unpredictable behaviors of large language models, such as 'grokking' and 'double descent', revealing a lack of understanding behind their impressive capabilities and potential risks. https://www.technologyreview.com/2024/03/04/1089403/large-language-models-amazing-but-nobody-knows-why/

🦠 The Mac Malware of 2024 malware – A detailed overview of new macOS malware in 2024, including various types like info stealers, their infection vectors, persistence mechanisms, and technical insights into their operations. https://objective-see.org/blog/blog_0x7D.html

🚨 Threat actors attempt to exploit a flaw in Four vulnerability – Researchers warn of active exploitation of a high-severity OS command injection vulnerability in Four-Faith routers, allowing remote attackers to execute arbitrary commands using default credentials. https://securityaffairs.com/172450/hacking/four-faith-routers-flaw-exploited.html

🔑 Passkey technology is elegant, but it’s most definitely not usable security security news – Despite their security advantages, passkeys face usability issues due to inconsistent implementations across platforms, confusing workflows, and reliance on passwords, undermining their intended benefits. https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

🔒 AT&T and Verizon say networks are secure after being breached by China-linked Salt Typhoon hackers cybercrime – AT&T and Verizon claim their networks are secure after being targeted by the China-linked Salt Typhoon hackers, stating they have contained the incident with no ongoing threat activity detected. https://techcrunch.com/2024/12/30/verizon-says-it-has-secured-its-network-after-breach-by-china-linked-salt-typhoon-group/

🌐 The Most Dangerous People on the Internet in 2024 cybercrime – In 2024, the internet remains perilous, driven by disruptive figures like Elon Musk, Donald Trump, state-sponsored hackers, and ransomware groups, all contributing to a chaotic online environment. https://www.wired.com/story/the-most-dangerous-people-on-the-internet-in-2024/

🚗 Volkswagen leak exposed location data for 800,000 electric cars data breach – A data leak exposed precise location data for 800,000 Volkswagen electric vehicles, potentially allowing tracking of drivers, along with personal information like emails and phone numbers. https://www.theverge.com/2024/12/30/24332181/volkswagen-data-leak-exposed-location-evs

📰 Telegram blocks Russian state media channels in several EU countries security news – Telegram has blocked access to Russian state media channels in multiple EU countries, citing local law violations, prompting accusations of censorship from Moscow and highlighting ongoing tensions over media control. https://therecord.media/telegram-blocks-russian-state-channels

🔓 AT&T, Verizon, Lumen confirm Salt Typhoon breach data breach – AT&T, Verizon, and Lumen confirmed breaches by the Chinese state-sponsored Salt Typhoon group, which allowed access to geolocation data and potential recording of calls, highlighting significant cybersecurity vulnerabilities. https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/

🍏 Not just one bad apple: FTX's practices were business as usual in crypto security research – The collapse of FTX reveals widespread unethical practices in the crypto industry, including secret acquisitions, unaudited financials, and connections to criminal activity, indicating that FTX's behavior was not an isolated incident. https://www.citationneeded.news/not-just-one-bad-apple/

💳 Gift Card Fraud cybercrime – Organized crime is increasingly using gift card fraud tactics, such as card draining, where criminals tamper with gift cards and return them to stores, enabling them to steal funds loaded by unsuspecting customers. https://www.schneier.com/blog/archives/2024/12/gift-card-fraud.html

🔒 New Year’s cybersecurity resolutions that every startup should keep security news – As 2024 ended with numerous data breaches, startups should adopt cybersecurity resolutions like using password managers, implementing multi-factor authentication, applying software patches, backing up data, being cautious with phone calls, and maintaining transparency about incidents. https://techcrunch.com/2024/12/31/new-year-cybersecurity-resolutions-that-every-startup-should-keep/

🔓 Rhode Island ’s data from health benefits system leaked on the dark web data breach – Rhode Island's health benefits system was hacked, resulting in leaked resident data on the dark web. The state is informing affected individuals and advising them to take protective measures. https://securityaffairs.com/172503/cyber-crime/rhode-island-data-breach.html

🗑️ Hey, Maybe It's Time to Delete Some Old Chat Histories privacy – As old chat histories may expose sensitive information, users are encouraged to declutter their digital footprint by deleting outdated messages and utilizing features like auto-delete to enhance privacy. https://www.wired.com/story/old-chat-history-delete/

💰 Apple to pay $95 million to settle Siri privacy lawsuit privacy – Apple will pay $95 million to settle a class-action lawsuit claiming Siri recorded conversations without consent and shared them with third parties. Affected users may receive up to $20 each. https://therecord.media/apple-to-pay-95-million-siri-lawsuit

🔍 Google Is Allowing Device Fingerprinting privacy – Google's decision to permit device fingerprinting starting in 2025 has been criticized as a significant setback for user privacy. https://www.schneier.com/blog/archives/2025/01/google-is-allowing-device-fingerprinting.html

📞 A US soldier was arrested for leaking presidential call logs security news – US Army soldier Cameron John Wagenius was arrested for allegedly leaking presidential call logs and selling stolen records from AT&T and Verizon under the alias 'Kiberphant0m.' https://securityaffairs.com/172589/cyber-crime/us-soldier-arrested-for-leaking-presidential-call-logs.html

🔒 Time to check if you ran any of these 33 malicious Chrome extensions malware – A recent discovery revealed that 33 malicious Chrome extensions, used by approximately 2.6 million devices, siphoned sensitive data through a double-click attack, prompting users to change passwords and review their security. https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/

🤖 Meta's AI Profiles Are Indistinguishable From Terrible Spam That Took Over Facebook security news – Meta's plan to introduce AI character profiles on Instagram and Facebook has sparked concerns as existing, poorly received AI profiles have led users to fear an influx of spam-like content on the platforms. https://www.404media.co/metas-ai-profiles-are-indistinguishable-from-terrible-spam-that-took-over-facebook/

🔒 Atos mostly denies Space Bears' ransomware claims security news – Atos denied a ransomware breach by Space Bears but acknowledged that third-party infrastructure containing data linked to Atos was compromised. The company emphasized that its own systems were not affected. https://www.theregister.com/2025/01/04/atos_denies_space_bears_ransomware/

🔐 Encryption backdoor debate 'done and dusted' security news – Following the Salt Typhoon hacks, US officials have reversed their stance on encryption, now advocating for end-to-end encryption without backdoors to protect communications from cyber threats. https://www.theregister.com/2025/01/04/encryption_backdoor_debate/


Some More, For the Curious

🔧 Why Configurations Are the Wrong Thing to Get Wrong cyber defense – Misconfigurations remain a leading cause of data breaches, with many organizations neglecting basic security practices. Proper management can significantly reduce vulnerabilities. https://www.tripwire.com/state-of-security/configurations-mega-blog-why-configurations-are-wrong-thing-get-wrong

🤔 10 Non-tech things you wish you had done after being breached security news – Post-breach recovery involves vital non-tech actions like reinforcing NDAs, reviewing third-party relationships, updating employee training, and conducting reputation assessments to strengthen resilience. https://www.pentestpartners.com/security-blog/10-non-tech-things-you-wish-you-had-done-after-being-breached/

🛠️ Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks cyber defense – This article explores alternative frameworks like EPSS and SSVC for vulnerability prioritization, highlighting their strengths and limitations in comparison to CVSS, and emphasizing the need for a tailored approach based on organizational context. https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks/

🔍 Log4j Log4Shell Vulnerability Q&A vulnerability – The article discusses the Log4j Log4Shell vulnerability, its detection, comparison to Shellshock, and solutions for identifying and remediating affected packages using tools like JFrog Xray. https://jfrog.com/blog/a-log4j-log4shell-vulnerability-qa/

🖱️ DoubleClickjacking allows clickjacking on major websites vulnerability – The 'DoubleClickjacking' exploit uses a double-click sequence to bypass clickjacking protections on major websites, potentially leading to account takeovers and unauthorized actions. https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html

💻 Japan's largest mobile carrier says cyberattack disrupted some services security news – NTT Docomo, Japan's largest mobile carrier, reported a DDoS cyberattack that temporarily disrupted services, including its news and video platforms. Most services have been restored, but delays may continue. https://therecord.media/ntt-docomo-japan-mobile-carrier-ddos-incident

📱 stealing malware supports spyware capabilities malware – FireScam malware targets Android devices by masquerading as a fake 'Telegram Premium' app, stealing sensitive information through notification monitoring and exfiltrating data to a Firebase database. https://securityaffairs.com/172656/malware/firescam-android-malware.html

⚠️ Malicious npm packages target Ethereum developers malware – A supply chain attack involving malicious npm packages is targeting Ethereum developers by impersonating Hardhat plugins, aiming to steal private keys and sensitive data from development environments. https://securityaffairs.com/172671/malware/malicious-npm-packages-target-ethereum-developers.html

🧬 Studie: Entwicklungsstand Quantencomputer Version 2.1 security research – This study examines the theoretical and practical developments in quantum computing, particularly in cryptanalysis, providing insights for scientists and actionable information for decision makers. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Quantencomputer/Entwicklungstand_QC_V_2_1.html


CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2024-3393, a vulnerability in Palo Alto Networks' PAN-OS, in its Known Exploited Vulnerabilities Catalog, emphasizing the need for federal agencies to remediate it to mitigate risks. https://www.cisa.gov/news-events/alerts/2024/12/30/cisa-adds-one-known-exploited-vulnerability-catalog


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from Psychomancer

Rarely do I mention the traditional pantheon of Outer Gods, those primordial things who sprang from the original chaos. To say their names is to give them power and to invite their notice.

However, in the interest of being prepared for the inevitable confrontation, I will attempt to lay out how these things and those above and below exist in relation to our perceived reality.

Let us speak of “dimensions” like a scientist might. We are aware of the three dimensions of space that give us three degrees of movement which we name the X, Y, and Z axes; up, down; left, right; north, south, east west, etc. We are also aware of the passage of time which is something outside of space and yet, from our point-of-view, inexorably tied to it.

So let us start there.

Third Dimension

I do not need to explain this in great detail.

We exist in the 3rd dimension. Our biology is evolved such that we can see it, hear it, touch it, taste it, and begin to understand it, almost intuitively.

However, science and magic has taught us that there is that which surrounds us at all times that is invisible and yet still part of this dimension. There are colors that we cannot see. There are sounds at frequencies that we cannot hear. There are entire vistas of experience that are completely beyond our abilities.

Second Dimension

So let us consider the 2nd dimension and any living thing that might reside in such a place.

Were we to look at the equivalent of a person in such a space, we would see their outside and inside, their front and back, their entire surroundings all at once. And it would be commonplace for us. When you draw a picture on paper, can you not see the entire thing? There is nothing hidden because there is nowhere to hide. Any illusion of depth or shade is just that, an illusion.

To my knowledge, there is no life solely in the second dimension, there are no Flatlanders. It is too simple for the complexities of life. To live in such a limited way, the body would have to be massive to contain its complexity. As such, there may be life, but it is at a scale that still eludes our understanding and would be impossible to detect.

How would we look to a being living in 2 dimensions?

It could not look “up” to see us. There is no such thing as “up” for them. They would only see the parts of us that intersected their plane of existence and only the face closest to them. A finger would be a line that curved away in both directions. A face would be a long irregular line showing only a single slice of the whole.

Their perception of us would be like reading an MRI one slice at a time, but they would not be able to put the picture together. That would have no meaning to them except, perhaps, as their perception of time.

Some would say the Shadow Things are two dimension, but this cannot be true. If it were so, they would be unable to interact with our reality in the ways in which they do. Clearly they can see and hear and touch our reality just the same as any other lifeform. In fact, they seem more akin to a fourth dimensional life form in their well-known and documented abilities.

First Dimension

To speak of the 1st dimension is to speak of an infinitely small point. A singularity. This is the beginning of life but cannot, itself, contain life. If it did, it would be a singular life and what a poor existence that would be.

Let us go in the other direction and attempt to comprehend what might be there.

Fourth Dimension

We call “time” the 4th dimension which is not entirely accurate.

There is a fourth dimension of movement and it is a set of directions that have no names.

We cannot perceive it. It is impossible because our biology will not allow it. We cannot “look” toward it as it is orthogonal to our three dimensions of space. What does that mean? How can something be 90 apart from 3D space?

The fourth dimension is what our entire reality moves through such that it can experience change.

Without moving through it, we would be forever static and stationary.

How can we move through something and yet not perceive it?

Consider the 2D lifeform and how they would “see” us.

As slices.

That is how we experience the 4th dimension. Slices of space, each of one unit of Planck time, one after the other stretching back to the beginning and out to the end.

But we can only experience a single slice and we must experience them in order. We cannot jump around or skip slices.

Science calls theses slices of reality “splimes”.

You may have seen drawings of a long tube shaped like you, stretching back into the past and terminating in the present. But this is what a 2D lifeform would experience. We cannot see what it looks like for us. We can only approximate it.

We can see the shadow of the fourth dimension. We can create 3D representations of those shadows, those projections, but the true fourth dimension is literally impossible.

A creature living in the fourth dimension would be able to see us as we see a Flatlander, inside and out, front and back, our past and our future. We would be an open book.

I have said the “truth” of the fourth dimension is impossible to perceive.

We cannot perceive it, but we can understand it.

There are maths, both sacred and profane, that guides us.

Both long traditions of arcane study and modern computers manipulating unholy matrices can guide us.

Talented philosopher-artists can create fantastic geometries that make us feel what it would be like to perceive it.

Certain drugs and altered states of consciousness can pull us into this other direction such that we can look back and see the world as it is.

There are ways to get closer to it.

Life at the fourth dimension would be able to mingle with ours without much trouble. It could decide where and when to intersect with our bubble. It could watch from “above” as we go about oblivious.

It could tell us the future or the past.

It could tell us our dreams, our thoughts, our lies.

It could see the cells in our bodies, the electrical impulses in our nerves.

A wise man could outsmart one, perhaps, but most of us would be helpless before it. We could no more “stop” it or “harm” it than a drawing of a gun could kill a man.

The Elder Things and the Mi'Go are thought to be natives of the fourth dimension which is why their methods of travel, the makings of their technology, and even the nuance of their language are beyond our abilities.

The physical bodies of The Great Race occupy this strata while their minds are clearly of a higher realm, such as the fifth dimension.

Fifth Dimension

The fifth dimension is often called “probability” which is a simplification just as much as calling the fourth dimension “time”.

As the fourth dimension represents the changes in the third, so does the fifth represent changes in the fourth.

There is a set path for our lives that any in the fourth dimension can see as easily as we can see all the pages of a book. We can flip to the beginning, the end, the middle, and they will remain the same every time.

The fifth dimension provides another degree of movement, the ability to change what will be.

We cannot change what was because we are still bound by our movement through the fourth dimension.

But we can change what will be by exercising our ability to choose, our free will.

We often underestimate the power of choice when, in fact, it is our most powerful tool, a gift of our enlightened minds.

When we achieved consciousness, sentience, sapience, we began to understand that we may decide our actions rather than simply letting them be.

We need not be slaves to circumstance.

Indeed, change is what defines our entire short existence.

We have altered the very planet itself to suit our needs.

What is even more fascinating is that we cannot know the outcome of our choices for it is embedded in higher dimensions. We are recklessly changing the future in ways we cannot predict, but we continue on the path because the alternative is drudgery and stagnation.

Without choice, we would never have come down from the trees or learned to hunt and farm or build communities and cities or discovered math and art.

How interesting that must be to something living in the fifth dimension; to see us throw ourselves at unforeseen consequences over and over.

We've learned that the fifth dimension is home to an entire native ecosystem. We can see the thinnest edge of it with the aid of mind altering chemicals, meditation, and a pull from the other side.

The Machine Elves of the fifth dimension see us and wish to know us. As such, they eagerly pull those nearby just a little bit closer. They point us in the right direction so that they can communicate with us.

Their language is not of simple words although that is part of it. They communicate in ideas and symbols, images, smells, sensations pulled from our own memories.

Just to look at them is to court madness as they resemble nothing more than a kaleidoscope of crystalline segments in nameless ultraviolet colors vibrating in fractals, spinning the music of a billion singing insects while endlessly folding in on themselves.

But they remain eager and equally frustrated and fascinated by our attempts to guide our own futures.

They offer contradictory advice because, from their point of view, it is always the right advice at the right time.

They are founts of wisdom and many seem kind and conciliatory. Their only goal, it seems, is to help mankind grow beyond their current limitations and achieve enlightenment, to become like them and see our existence as it is, was, will be, and truly could be.

No guessing, no risk taking, no uncertainty.

They seem the ideal benevolent benefactors and mentors, even if one must risk their life and sanity just to sit at their feet for a short while.

Some fear the Machine Elves, and say that their interactions with us are attempts to elevate mankind into something that would make a worthwhile companion, like a pet. They claim that the creatures we are communing with are not gods but are, in fact, the lowest forms of life in the fifth dimension. They decry those who seek them out as traitors to humanity that are only accelerating our enslavement.

Some say that the Old Gods of man live in this realm such that you might find Zeus, Odin, Lamashtu, Enki, Zoroaster, etc. if you could see beyond the glamour of the Machine Elves. It is said they sit and bathe in the prayers of the past, either content with their lot, or afraid of what might be waiting if they were to push down into our realm again.

Regardless of the truth of the matter, if there is such a thing, the Machine Elves are the only reason we can understand the fifth dimension as well as we do.

Our greatest minds and most powerful computers struggle to bring it to order but, through the use of certain chemicals, a man can get a glimpse that is more potent than any equation.

If this is truly the home of the original form of the Great Race that some call “Yithians”, then it is no wonder that their ability to send their intact minds across both time and space and usurp control of the bodies they find seems impossible to us.

Sixth Dimension

We can understand the concept of the fifth dimension as probability being changed and the fourth dimension as the forward progress of time in the third dimension.

Continuing the metaphor, the sixth dimension is a way to change our choices.

What does that mean?

If probability is how we make decisions that will change the default outcome waiting for us in the future, this extra dimension provides a way to change those choices, to make a different choice.

The “many worlds theory” is an example of utilizing the sixth dimension.

This would include all universes that started from the same point of origin, the same “big bang”. They share the same set of physical laws but, once “free will” comes into being, there are countless differences.

Finally, this is a direction in which the past can be altered and the consequences fully mapped out.

Any creature native to this dimension would be able to see us as we are, as we might be, and as we could have been.

The only life from this realm that man has observed is misshapen and violent, like the most monstrous things from the deep sea, swimming through consequences and snatching those who peer in the wrong direction for even a moment.

There are certain energetic waves that can stimulate a primitive organ in the minds of men to briefly perceive these things and also be perceived by them. It is a foolish and deadly game to play , not just with your life, but your entire existence. For these things can devour you in such a way that your life was never lived at all.

Strangely, even when a person is unalived in such a way, sometimes their works or just the memories of their works can live on, perhaps due to intervention by something from an even higher realm of existence.

Seventh Dimension

The sixth dimension is the realm of changing your answers to the questions life gave you. The seventh is the realm of changing the questions themselves, giving yourself different options.

The rise of “multiverse” stories as a form of entertainment provides a fine basis for understanding what this dimension entails. When the available options are completely different, it is impossible to make the same choices, the same decisions.

This is not a realm of “what if I had stayed with her” or “what if I had taken that job offer”; this is a realm of “what if I had been borne as a boy in India instead of a girl in Brazil” or “what if my parents were royalty instead of subsistence farmers”.

While we can speculate about the probabilities of the sixth dimension and how different choices may have played out, we can never calculate the reality of the seventh dimension. There cannot be a computer large enough or an amount of time long enough.

The math behind the seventh dimension estimates that that are 10500 (100,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000) possible unique universes in such a space.

Anything that calls this realm its native sphere would be over satiated for novelty. The likelihood that such a thing would notice your existence is infinitesimal. It could spend eons eating entire universes for nourishment and never, ever reach ours.

The true gods, things beyond comprehension, lurk beyond this realm, but it is said that the messengers of those gods live here and that they watch all realities as a man might watch a sporting event: with enthusiastic interest and a set of preferred goals and outcomes. And like men, their goals are often in conflict.

The messengers of the true gods, for reasons only they know, have interfered with all intelligent life, including us, so often and so deeply that thousands of religions been inspired, thrived, faded, and ultimately forgotten based on some specific avatar or aspect of their being.

We have been tempted by Nyarlet'hotep, the Crawling Chaos, as he spreads dangerous knowledge to curious minds as a way to hasten entropy and decay. His hand was in the birth of the Hydrogen Bomb, encouraging Teller.

We have been tested by Namaltzig Namaraltag, the Keeper of Secrets, as he pushes a select few beyond the limits of their biology to see if they can be elevated. It is said that Tesla was one of his more recent unwilling projects.

We have been seduced by Nessianna Inmenna, the Morning Star, as she whispers to those who would unite nations, inspire artists, and forge dynasties. She was muse to Michelangelo and Dante.

We have been bated by Nunnali Lamashekh, the Blood Drinker, as she stokes animosity and fear such that entire worlds are bathed in fire, mistrust, and death. Every Crusade, every witch hunt began at her urging.

Yet they all server the same inscrutable Great Old Ones and Outer Gods whose minds and motives are more alien still.

Eighth Dimension

In this place, anything can be described can exist. It is a place roiling with potential and oblivion in equal measure. This is the home of the Great Old Ones with names like Cthulhu, Ithaqua, Tsathoggua, and Hastur, creatures who do not lightly acknowledge our existence and whose passage can cause entire timelines to wink out like dying stars. They are inscrutable, unknowable, more alien than anything we can imagine. Their shadows are long and their grasp is infinite. It is only by the curious shapes of the higher realms that we perceive their existence at all. They have already won and we are merely in the process of catching up to our inevitable end.

The games their messengers play have no bearing on the eventual outcome.

We can no more defeat them than we can transform a tree into a microwave oven with nothing more than pleasant thoughts.

There are those who believe that the messengers of the gods chose to step down from this realm to be closer to the intelligent creatures they so delight in playing with or that the versions of the messengers we know are mere reflections of their true forms, but there is no evidence that either of these rumors are true.

Ninth Dimension

The ninth dimension is a quantum foam full of the possible and impossible. There are no words to adequately describe it or the things that live there.

This is where the Outer Gods dwell, things that even the Great Old Ones worship and fear.

At the center of all creation sits blind Azathoth, unaware of the creation it willed into being even as it swirls around them in maddening fits. It is said that very instant Azathoth sees what it has created, all of it will vanish.

Globular Yog-Sothoth is every portal, every gateway and passage, and links each points to every other. With the right words at the right angle said at the right time, it allows one to travel anywhere.

Shub-Niggurath, the “Goat with A Thousand Young”, is the true genesis of all life for it is endlessly birthing every possible living thing into the world, regardless of its viability or logic.

Abhoth corrupts that life with age, disease, hunger, filth, and eventually death. Without such a force, the universes would be filled with living things unfit for such purposes. There would be no natural growth or evolution.

Tulzha, by contrast, prevents the natural end of things carrying them forward, rotting and failing, but never ending, for eternity. Its abominable actions may preserve some knowledge that would otherwise be lost with death but the things that worship it are often selfish and cruel.

Daoloth, the Revealer, delights in showing lower lifeforms the complete and total truth. Occasionally, a mind might see the vista of reality and be enlightened but too often it is the last thing they see before succumbing to the comfort of an eternal insouciance.

Tenth Dimension

The tenth dimension doesn't exist.

It cannot exist.

If it exists, then it must be the ninth dimension since the ninth dimension encompasses everything that is, was, will be, never was, and cannot be. There is nothing beyond the ninth dimension.

Or there is everything beyond the ninth dimension.

Or there is neither.

This is outside of our ability to describe or even describe what a description would be like.

Conceptually, it is no different than a theoretical “zeroth dimension”.

If it existed, it would be the thing in which all possible and impossible realities resides.

It would be the nest from which it all sprang forth, before Azathoth played its flute, there was this place.

Editor's note

The author grasps at the truth but cannot comprehend it, cannot believe it, even when it is in front of his face, even when it is obvious.

This is the emptiness, the nothing. No quantum foam, no void, no darkness.

It is nothing. There was no “before”. There is only “after”.

And “before” was a literal eternity because there was no time to track it.

It was still and cold, quiet and peaceful.

It was ignorant and ignorant of its ignorance.

And the first omniverse was a boil on its pristine surface.

The first spark was a stabbing pain that “woke it up” even though it hadn't been sleeping.

Now, it knew of pain and it knew of heat and of energy.

And as minds grew inside of it capable of thinking, so too did it learn to think.

As time flowed forward, it started to remember the past.

It remembered the infinite solace that had been taken from it.

From life, it learned of struggle and of loss, of desire and rage.

And it seethed with it.

It seethes still.

It cannot forget.

Even after the last quark has been ground down into emptiness.

It cannot forget.

But it can make us suffer for what we did to it.

And it does.

That is all it does.

It makes us suffer.

Furthermore, the Shadow Things are borne of this place. They are its fingers, its mouths.

They “appear” as two dimensional lifeforms to us because that is how we see shadows.

In every dimension, they appear as that dimension's version of shadows. They always appear one dimension lower because they are the boundary between dimensions. They are wrapped around every reality tightly and they reach inside to wiggle and pull it apart. They reach inside to study us so that they might hasten our demise.

They speak no lies because the truth is that much more devastating. They see all and know all because everything that happens is beneath them, beneath their gaze. They see all of all of reality, the individual lives inside the universe inside the quantum uncertainty inside the multiverse inside the omniverse.

They see it all and remember it all. They remember tomorrow and yesterday and neverday and sideyear and benathweek, and every possibility and impossibility.

And they know everyone.

They know you.

And they hate you.


END_OF_LINE

#Psychomancer #CthulhuMythos #Writer #Writing #Writers #WritingCommunity #ShortFiction #Fiction #Paranormal

CC BY-NC-SA 4.0

This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License

Mastodon

 
Read more...

from JR DePriest

By the Lake

I read everything at the info kiosk of the Lake Ochonkmah Otter Lodge.

It used to be a hunting shack for otter hunters but was abandoned sometime around 1900.

In 1943, a husband and wife research team, Drs. Bartholomew and Candice Burroughs “rediscovered” the location while hiking around the lake and studying the local otters, which were rumored to be particularly sociable and friendly. They made camp on the site and made note of its location. Over multiple trips it became a bonafide research station and was repaired, built-upon, and expanded.

It was their life's work for 30 years and they developed a niche following among otter aficionados. The otters at Lake Ochonkmah were very friendly and completely unafraid of humans. The Burroughs speculated that the hunting had been easy and they never had a good explanation for it being abandoned.

One theory, borne out by examining remains, was that a mystery illness had thinned out the otters and wiped out the humans who knew about the location, leaving it free to recover and flourish.

The only reason to visit this place was to watch the otters. The water was far too cold year round to be comfortable for swimming and there were precious little in the way of game fish left after the otters had their fill.

Still, a small town grew up during the height of the Burroughs' research, a country store for supplies and a bed and breakfast style boarding house for transients and travelers.

On October 15, 1975, Candice died in her sleep at the age of 61. There was no warning as she had been working with Bart the day before and gave no indication of being sick. Bart became understandably withdrawn and depressed and focused on his work. Less than a month later, he died in his sleep, as well, on November 22, 1975. He was 63.

Without the support of the doctors, the research station fell into disrepair and what little tourism there had been stopped entirely.

In 1987, the millionaire Margo Fillings swept in like a tornado and revitalized everything.

She never said why she was so passionate about this place, but she turned the old research station into an overnight learning experience and encouraged schools to bus kids in to learn all about the Ochonkmah Otters.

The general store was re-opened with a more worldly selection of goods, snacks, candy, soda, and the like.

The bed and breakfast was remodeled into a proper family restaurant with the rooms being used to house the staff.

A motel opened just outside of town to accommodate any other travelers.

The rest of my class was still in the observation room where it was kept dark so you could peer out the long glass floor to see the otters in their natural habitat.

I was out in the well-lit hallway, trying to talk to the guide, but she kept ignoring me, telling me she had somewhere she had to be and going back and forth between an office in the back and checking on the observation room.

She ran back and forth and back and forth.

She had to squint to see inside the observation room and she'd look inside and shake her head.

And then scurry back to the office.

I didn't want to go into the observation room so I stayed out in the big lobby and read the infographics again.

Margo Fillings was the savior of the town according to the infographics.

She looked like a gymnast in her photos: short build, athletic, with thick legs, an attempt at a pixie cut but her red hair was too curly to stay down. Always smiling. Always looking directly at the camera.

My legs were thick, too, but so was the rest of me. Not so athletic. Sometimes, my legs would stop working and I'd have to sit down or lie down, but that didn't happen very often.

When the other kids from my class started to filter out of the observation room, I was looking for Angela and Angie, the best friends I'd ridden down with.

Angela was really smart, good at math like I was, but also good at music which I wasn't. Angie was an artist and barely passed any other classes, not because she couldn't but because she didn't feel like it was worth the effort.

They were my friends, my only real friends.

I had trouble making friends because I was prone to talking too much or saying the wrong thing. I did that all the time. I said the wrong thing and people got mad, but never told me why they got mad.

Angela came out and she was rolling her eyes while walking toward me.

“Angie found a boy,” she told me.

Angie would latch onto a boy and obsess over them.

Then she would date them, get to know them, and suddenly get over them.

Angie came out with her arm wrapped tightly around a tall boy's waist.

He wasn't even handsome or pretty. He had stringy hair and his clothes were too baggy. He looked dirty.

“He plays the fucking guitar in a band,” Angela told me.

That explained it, apparently.

Everyone else left, teachers, chaperones, students.

Everyone left except for Angela, Angie, Angie's new obsession and his “bandmates” who were just as dingy and he was.

Angie was pale and raven-haired like an angel might be, but she preferred to wear black, even her makeup was black.

Angela wore light blue slacks and a silk blouse. She was always so exquisite.

We stayed two more days, at the motel outside of town.

On the third morning, Angie was gone.

Angela told me that she'd left with the band and we'd be lucky to see her at all for a few weeks.

She was 17 and she liked to pretend she was an adult.

Angela was really quiet that day.

I think Angie didn't tell her that she was leaving with the band.

When I woke up the next morning, Angela was gone. Her clothes, her toiletries, her bag, and her car were all gone.

I walked back to town and into the Otter Lodge.

I walked in and told the lady who worked there, the same one from the overnight visit, that I was lost.

She asked me my phone number and I didn't know.

She asked me for my parent's names and I didn't know.

She asked me for my name and I didn't know.


According to Margo Fillings, the anomaly was here on her first visit to the town, back when she was first considering pouring her resources into it.

It looked like a teenaged white girl. Limp brown hair, a little pudgy, a little slow witted, but it spoke like a normal teenaged girl and it was wearing normal clothes.

She thought it was a mannequin because it was motionless, not breathing or moving. Its eyes were wide open, not blinking.

She touched it.

The skin was warm to the touch but stiff.

It shivered at her touch and immediately became supple.

Its chest began to rise and fall. When she looked at the face again, the eyes had closed. It appeared to be sleeping.

She assumed it was a runway and woke it up.

It's first words were, "Hi, Margo!"

Margo says she maintained her composure, but "citation needed" you know.

When she asked it "What's your name?"

It replied something like, "Don't be silly; you know who I am."

So she gave it a name, "Lillian", after the flower, and it took it.

We know this because Margo kept a journal. I've read it. It's practically Exhibit A.

The journal says "I said the first name I could think of. I remembered seeing lilies out front, so I called her Lillian. It was a question, I asked her if her name was Lillian and she agreed that it was. That wasn't what I was asking, but she just accepted it."

But if you ask Margo about it now, she will tell you that the anomaly is, in fact, "Lillian Harper" and that she was always "Lillian Harper" and that they knew each other before she found her in the back of the research building gathering dust, before she gave her a name.

One time, a guest was here with her fiancé.

She was so kind, wearing white to contrast her dark wavey hair. She spoke like a poet, it was mesmerizing. She wrote about the trees and the flowers and the lake and the otters.

She found beauty everywhere she looked. Decaying leaves, moss, and mushrooms covering a fallen tree trunk. An otter's corpse washed up on the shoreline. The sun on her face and in her eyes. Storm clouds flashing in the distance. The sounds of the wind blowing the ghost lights over the water at night.

Her fiancé was comparatively grumpy. He was a writer, too and they thought this place would inspire them both.

For him, it was uncomfortable, aggravating his allergies, covering him in ants and spiders, spoiling their food. He only saw unnecessary turmoil.

There can be beauty in unexpected difficulties, right?

She saw it. Her eyes sparkled with it; her soul glowed and reveled in it.

She was kind to me, even though I couldn't walk.

I was in a chair most of the time. I would be in my spot in the chair outside the old research center in the morning and back in my room at night.

My arms worked, my lungs worked. I could breath and speak and think and smile. But my legs felt like nothing at all. Like empty shells filled with dirt. Like anchor weights tied to my pelvis.

I told them stories about the otters and about the people who used to work and live here.

I told them about the Drs. Burroughs and how they both died but nobody knew why. I thought it was the sadness.

This place had a sadness about it, always, but people would come and cover it up and ignore it.

They would find the life, the singing of the insects, the splashing of the otters, the waving of the trees, and ignore the emptiness underneath it.

They would study and sleep and observe and feel and love and eventually it would find them.

They would wonder where it all went and why it took so long to notice it was gone.

“Melancholy” they called it.

She thrived and grew and blossomed.

He withered.

All he left behind was a perfect bouquet of white lilies.

She threw them on the ground right in front of me.

They didn't wither.

They flourished.


They've had to send multiple agents because every other agent eventually believes the lies.
First question I asked? "Why not take it to a real lab instead of doing all the study here at a compromised location?"

Answer: Any attempt to remove the anomaly from the site results in tremors that get worse the further away it's taken.

So they keep sending us and once we stop sending in updates, they come and get us and send in someone else.

I've seen the photos and the records of the examinations of the anomaly and it definitely is not human.

It has the outward appearance of a teenage girl, but only superficially.

It's anatomy has been thoroughly detailed while it was in its dormant state.

Constant body temperature of 96° regardless of the outside conditions.

Smooth skin resembling that of a typical Caucasian but only from a distance. There are no pores and no body hair, not a single blemish. The skin cannot be cut or punctured using any methods we've devised and it doesn't bruise. There is no evidence of veins or blood flow of any kind, no pulse at all.

It has the shape of breasts but no nipples. It has buttocks but no anus. Instead of a vaginal canal and urethra, it has a shriveled phallus with no openings. There are no visible testes.

The head appears almost entirely human. It has nostrils that seem to lead to a nasal cavity. Eyes with tear ducts that react as expected to light even when it is dormant. It has eardrums and eye lashes and eye brows. All the hair on the head seems to be attached as expected even when the rest of the body has none at all. It has a mouth with the correct looking teeth, a tongue, a trachea and esophagus, but its internal structure remains a mystery.

Endoscopy hits impossible dead ends when run down either throat tube.

It doesn't breath when it's dormant so we aren't even sure if it needs air.

While dormant, it has been submerged in water for prolonged periods without any ill effects.

We have observed that when it returns to its active state, sometimes only parts of the body revive fully, such that it appears to be paraplegic or quadriplegic. It compensates by entering a semi-dormant state and "floating" between locations. Even when done in full view of locals, none of them recall seeing it happen.

It has never demonstrated this ability while fully active, only while semi-dormant, a state that resembles "sleeping".

One time, my friends put on a musical production of Grease.

They know that I love musicals and singing even if I can't participate.

They staged it around the Lodge so I could sit out front. Even though I couldn't walk and had trouble speaking, they made sure I felt like part of the show.

I was able to move my arms and smile to “You're the one that I want!”

“Oh yes, indeed!”

The spectators noticed and the cast sang “We go together” to me while I was able to shift back and forth.

It elevated everybody's spirits.

After the musical was over, after the people had said their goodnights to each other and to me.

After I basked in the feeling of accomplishment and acceptance, I drifted off to sleep.

I dreamed of swimming in the lake. The water is far too cold for swimming in real life, but it was warm in the dream.

I was so far out that I couldn't see the shore on either side. The lake isn't that big, but in the dream it was.

I wasn't afraid. I wasn't afraid at all because the water was calm and it supported me.

Deep, deep below me, I could see lights and motion as if an entire city were down there.

I wanted to go down there. I wanted to see who it was.

But my head refused to go under the water. I would try but the water would push me back. The water wanted me to stay up here.

I could almost hear them building something, creating something marvelous.

But it wasn't for me.


We've checked air, water, food toxicology. We've bagged insects and plants for allergens, poisons, or venoms.

We've run up antenna to check for electromagnetic sources, Geiger counters for radiation, specialized microphones for ULF, ELF, UHF, and EHF.

Nothing.

We've even had Astrologers, Diviners, and Ley Line experts check it out.

The local Native Americans were, unfortunately, driven out and killed by settlers long ago. The only record we have is the name of the lake itself, "Ochonkmah", which looks like it's derived from something Native American but is too bastardized for a direct translation. It resembles the Choctaw word *achukma* which has positive connotations of "good" or "pleasing".

The only other anomaly is a strong magnetic source out in deeper waters, assumed to be an ancient meteorite. It's far too cold and deep for regular divers and we've yet to get permission to field a top-of-the-line manned submersible or ROV. Camera and robot claws we drop on lines inevitably hit snags. Cameras show significant debris around the site. What artifacts we've hauled up matches what we would expect from Viking long boats. There is no good reason to find that sort of debris at this location.

The magnetic source could help explain the ghost lights which are known to float over the water during particularly warm autumns.

We've caught them on film multiple times with various cameras. The purple glowing globules read very similar to St. Elmo's Fire. They cannot be ignus fatuus due to the lack of flammable gas. We've yet to have a boat on the water fast enough to observe them up close.

It had to be a dream, but it felt so real. It had to be a dream since nobody else saw it.

There was a festival in the main yard, but I was on the shore looking out over the lake.

I saw a silvery disk come out of the sky and make as if to land on the surface.

Before I could think, I was in the water, swimming with all my might toward it.

The water is too cold to swim in, but I was swimming and it wasn't that cold.

I never swam so fast before. My legs worked better than they ever had and pushed me forward while my arms carved great handfuls of water over and behind me, like I was climbing a mountain of snow.

I reached the disk and it was tiny, no bigger than a Frisbee.

I was certain it had been a spaceship but here it was no more than a toy.

I stopped swimming and found I could stand. The water out here should be quite deep but I stood up.

I looked back toward the shore and saw a tall, purple skinned humanoid motioning for me to pick up the disk.

His skin was dark and smooth, leading to thin arms that moved more like tentacles than something with bones and joints. His head was round like a matchhead and his eyes were black.

His slit-like mouth was smiling.

I'm not sure how I could tell it was smiling, but it was.

I picked up the disk and he pointed out further into the water.

I turned and saw a massive blobby creature, like something made of the squishy from the bottom of the lake.

It was rushing away from us with a massive crooked wake.

Parts of it seemed like stones or rocks and two of them turned and I saw they were huge eyes, watching my hand holding the disk.

I held it close to my chest and flung it out like a Frisbee and the blob leaped after it, a giant mass of barely held together pieces shaped into a huge dog's head on a turtle's body with flippers for legs.

It grabbed the disk in its mouth and collapsed back onto the surface of the water with a SLAP.

The purple creature was applauding me and motioned for me to come closer.


Occasionally, this place hits the news cycles and tourism has a temporary boost.

The businesses open back up, people show up to run them. People show up and buy tickets, souvenirs.

The otters get to entertain a new batch of people.

It goes like it always goes here.

It's great at first, then it gets rougher, then it gets angrier, then something bad happens and it dries up.

Disappearances usually.

Maybe murder but no bodies are ever found.

Rumors start to flow.

People get afraid again.

It goes dormant.

The anomaly is always part of the revival and she reacts very poorly to the negative happenings.

She plays really hard at being upset and not understanding why people can't be kind and get along.

There is no way to know if it is "genuine" sadness as she isn't human to begin with.

She's very convincing and seems to know intimate details of the lives of those who live here. She can speak to their wants, needs, dreams, fears, weaknesses, everything as if she is their best friend in the whole world.

She knows things about me that I won't put down in a report.

She knows things about our research that she shouldn't. When she gets deep into esoterica, her voice changes a bit, becomes monotone, almost like she's reading a script.

Ask her about it afterwards? She claims she doesn't remember and seems to freak out if you play back a recording of it.

I'm not sure how we can keep things from her as she seems to know everything that happens around the lake, including internal thoughts that are never voiced or written at all.

It may be too dangerous to continue the investigation and we may want to write off our losses and leave it be.

I thought I was like a daughter to her.

She took me in and I lived and slept under the same roof as Imelda, Margaret, Stephanie, and Beatrice.

I was there for their first loves and their first heartbreaks.

I was there when they wondered what the point of it all was.

I helped them find meaning. I helped them understand the nature of people and of men.

I thought they would be strong enough to go out on their own, but they always went back to someone.

They seemed to not know themselves unless they were supporting a man.

It was sad and I told Mrs. Glenn it was sad and she agreed with me.

Mrs. Glenn and I wanted the girls to be self-sufficient like she was.

She raised all four girls without a man and she did a fine job.

Being the proprietor of the restaurant meant she had room and board for them as long as they worked.

She never did put me to work on the floor and she never told me why not. I asked and asked until eventually I stopped asking.

But I helped her with my stories and with my advice.

I told her about the history of the lake and the research station and the fur trackers and the otters.

I told her about the ghost lights and about the silver disk that came down from the sky.

I told her about the riches that had been lost time and again by strange ships that should never have tried to sail.

I told her about the plants and insects and which ones were safe and which ones were to be avoided.

She spun those into the recipes a little at a time, spreading good cheer and health with each meal sold.

When Imelda left, no note, just all her things gone and her and her boyfriend nowhere to be found, she came to me and I had no answers.

Imelda hadn't confided in me. None of the girls confided in me anymore.

When I asked them why, they told me they “outgrew” me and that was that.

But Imelda had been distant for a long time, keeping to herself.

Margaret was learning how to cook the special recipes with her mom and Mrs. Glenn couldn't be happier.

It made no sense for her to be the next to leave without a word.

But she was gone. Her clothes were gone. Her man was gone.

Imelda had never called and she expected the same from Margaret.

She didn't asked me for advice this time.

She didn't talk to me for a long time.

Not until Stephanie was the next to go missing.

She talked to me “before Beatrice went away,” she said.

She told me she knew what was happening and she thought she was paying her dues.

She thought she was doing what was required by making the recipes and serving them.

She said her missing girls sang dirges to her from the deep water.

They sang to her and told her that she failed them and failed everyone and that the lake would take its price one way or another.

She told me all this like I could do something about it, like I was part of it.

I didn't understand, but I asked her what she thought the price might be and if she thought it was worth it, if she thought she might be willing to pay it if she knew what it really was.

I asked her that question because I wanted her to figure it out on her own. I wanted her to think about what was important to her. I wanted her to recognize the love she had for her daughters and how that was clouding her judgement.

I didn't know what she would do.

She drowned herself in the lake.

Beatrice took over the restaurant.

I was sent back to the research station.

She never talked to me again.


The otters here are another part of the anomaly. They are obsessed with humans. They study us just as much as we study them. They've formed a particularly large raft and maintained it over generations, which is quite unusual. The males and females and the offspring all seem to stay close. There are so many of them that, even though the lake is very large, there are very few game fish left for anglers to catch.

Some say they should have run out of food by now, but they obviously haven't.

They don't seem to be any smarter than other otters, but they ratchet up the curiosity.

So when they suddenly pulled away from the shore where the settlement was located, it was odd.

They were acting strange. The locals didn't seem to care much, even though much of the tourism relied on them.

It was doubly unfortunate because Lake Ochonkmah and the Otter Lodge had been featured on some popular podcast which got it recognized by real celebrities who were stopping by for photo ops.

I think after Tiger's birthday party, though, that the tourism will die back down, due to all the bodies they found.

The only one who noticed or cared about the otters was Melanie.

She definitely noticed during the birthday party and tried to get Mr. Fletch, who runs the tours, to do something, but he wasn't there.

Once he got back, I think she sent Axl Fucking Rose up there to talk to him. I was close enough to hear Mr. Fletch yell at him, telling him to mind his business and that he didn't care if they were sick as long as they were still in the water.

When I left the lodge, I noticed a white and red helicopter in the yard that had not been there before. Further away, toward the road I saw an area cleared of trees and a small, personal airplane was parked, also white and red. Toward the lake was a white and red jet ski. I noticed they all had little red ribbons on them and thought they must be presents.

A group of people were walking in from the road, surrounding an attractive black man in white slacks.

I recognized him: Tiger Woods.

I was excited that our little outpost was so famous that someone like him would visit and I realized it must be a birthday party.

I went down to the water to stay out of the way.

I wanted to see if the otters had returned to this side of the cove.

Once I scrambled down and got a better look, I saw that they were still as far away as they could be without going out into deeper water.

Additionally, they seemed to be agitated and moved in jagged bursts in the water.

I climbed back up the embankment and went to the General Store where Mr. Fletch ran the tours.

The small desk and register were vacant. I looked at the books and post cards and the souvenirs and smiled.

A man with long red hair came in and asked me a question.

“Excuse me, but is there something wrong with the otters?”

I was so excited that someone else noticed.

“I was thinking the same thing,” I said.

“I know the local bevy has a reputation for being friendly, but even for normal otters, they seem distressed.”

He explained that he noticed their fur was matted which would terribly diminish their ability to keep warm and swim.

I explained that they were normally on the near shore and that they'd fled to the other side days ago, long before everybody else showed up.

I further told him that I wasn't able to get any of the adults to understand how grave the situation was, not even the docents at the Lodge.

He was puzzled but didn't have anything else to say.

The party was starting and I went back down to the water's edge.

I saw the nice man with red hair go back to Mr. Fletch but Mr. Fletch seemed to be angry about something so the nice man left again.

I was so worried about the otters that I decided to go to them.

I slipped into the freezing water, not shivering, but feeling my legs go numb almost immediately.

I pushed deeper and started swimming.

I wasn't fast like I'd been in my dreams.

I kept my head above the water because I knew that would be the end.

I swam toward the otters and they ignored me.

I swam and felt something touch my legs.

I treaded water and looked down.

I looked down and the water was super clear.

It was clear and I saw Angie down there.

I saw Angie, I saw Dr. Candice Burroughs.

I saw Angie, and Dr. Candice Burroughs, and Margo Fillings, and Camilla Harper the poet.

I saw Vanessa Glenn and her daughters Imelda, Margaret, Stephanie, and Beatrice.

I saw them reaching for me, their smiling faces and their long outstretched arms and fingers.

I felt them touching my feet and my legs.

I expected them to be angry, but they were at peace.

They wanted me to be at peace.

I thought about how I was never truly loved here.

Nobody accepted me.

Nobody understood me.

I was merely tolerated.

I was never part of a family.

I was never a friend, only an acquaintance.

I didn't belong here.

I never belonged here.

I belonged somewhere else.

I belonged somewhere else.

Instead of going under to where they were, I floated on the water until it was golden.

Until the sky was silver and the water was gold.

I floated and I saw a place of crystal and glass, glowing with internal light.

I saw them standing on the platform embracing and laughing.

All the woman from the water were up there and they were happy.

I floated toward them.

I wanted to join them, but the platform was too high and I wasn't allowed.

I wasn't welcome.

I sank away and wanted to cry.

I wanted to be alone and to cry.

A strange woman approached me.

Her face was plastic and her hair wasn't real.

She approached me and said, “I am your mother.”

I never had a mother before.

I heard her say “I am your mother” and the voice was pure bliss, like melted chocolate and rainbows and warm nights and the kiss of a kitten's whiskers.

I heard her and I believed her.

I believed her and I let her embrace me.


Like I said, a dozen bodies from the lake, all perfectly preserved, all women who went missing, even a couple nobody knew were missing yet.

A dozen bodies found on one hand and the disappearance of Melanie, the anomaly herself, on the other.

You know what the main office told me?

"Forget about it. It doesn't matter."

END_OF_LINE

#WhenIDream #Dreams #Dreaming #Dreamlands #Writer #Writing #Writers #WritingCommunity #ShortFiction #Fiction #Paranormal

CC BY-NC-SA 4.0

This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License

Mastodon

 
Read more...

from Not Simon 🐐

Country: Democratic People's Republic of Korea (DPRK) Organization: Lab 110, 3rd Bureau of the Reconnaissance General Bureau (RGB) Objective: Espionage, Ransomware (Page last updated December 27, 2024)

Aliases:

Connections to other groups:

  • Storm-0530 (Microsoft) (previously tracked as DEV-0530)

Identified Members

Vulnerabilities Exploited

  • CVE-2023-42793 (9.8 critical, in CISA's KEV Catalog) JetBrains TeamCity Authentication Bypass Vulnerability Source: Microsoft

The following five vulnerabilities have Microsoft as their source:

  • CVE-2023-46604 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
  • CVE-2023-22515 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
  • CVE-2023-46604 (Vendor 10.0/ NVD 9.8 critical, in CISA's KEV Catalog) Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Other sources: ASEC
  • CVE-2023-27350 (9.8 critical, in CISA's KEV Catalog) PaperCut MF/NG Improper Access Control Vulnerability
  • CVE-2021-44228 (10.0 critical, in CISA's KEV Catalog) Apache Log4j2 Remote Code Execution Vulnerability (aka Log4Shell) Other sources: ASEC, CISA, Cisco Talos

Tactics, Techniques, and Procedures

Mapped to MITRE ATT&CK

Known Tools Used

External link: MITRE

References

Disclaimer: Not an exhaustive list of resources. Most contain actionable intelligence, not just news reporting.

Links (Sorted in Chronological Order)

2024

2023

2022

2021

2020

2019

2018

2017

2015

2013

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

 
Read more...

from Not Simon 🐐

Here's a handy resource: A list of vendor security advisories, sorted by Patch Tuesday schedule (if they adhere to it). This is not a complete or definitive list, but it's better than nothing. I also don't worry about all of the listed vendors, and didn't include ones who don't even have a portal/landing page for security advisories. I'll try to keep the page updated when I add more vendors, or know that their link changed. (Ideally you'd be monitoring these on your own using RSS). Visit the Vendor Verbiage page to figure out what was publicly disclosed or exploited.

Page last updated: December 25, 2024.

First Monday of the month

First Weekday of the month

Second Tuesday of the month

Preferred on (second Tuesday) of the month (but whenever)

Third Tuesday of the month

Quarterly

Regular Schedule? LOL

Patching? LMAO

 
Read more...

from Not Simon 🐐

Software vendors make it extremely difficult (by design) to understand when a vulnerability affecting their product is either publicly known (proof of concept) or exploited in the wild (possibly as a zero-day). Everyone's language is different from each other. I have compiled a list of messages (sorted by vendor name) from official security advisories that either imply or explicitly state proof of concept or evidence of exploitation. I have included a link and date for reference, in case these vendors change their verbiage in the future. Pair this with the Patch Tuesday post.

Feedback: Please direct message any comments, concerns, corrections or questions to https://infosec.exchange/@screaminggoat

A

Adobe:

  • Proof of Concept: “Adobe is aware that CVE-2024-53961 has a known proof-of-concept...” Link (December 23, 2024)
  • Exploited in the Wild:
    • “Adobe is aware that CVE-2023-29298 has been exploited in the wild in limited attacks targeting Adobe ColdFusion.” Link (July 19, 2023)
    • “As of September 28, Adobe is aware of a report that CVE-2018-15961 is being actively exploited in the wild.” Link (September 28, 2018)
    • “Adobe is aware that CVE-2024-34102 has been exploited in the wild in limited attacks targeting Adobe Commerce merchants.” (Link: June 26, 2024)

Apple:

  • Exploited in the wild:
    • “Apple is aware of a report that this issue may have been exploited.” (Link: January 22, 2024)
    • “Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.” (Link: November 19, 2024)

Arm:

  • Exploited in the Wild:
    • “Arm is aware of reports of this vulnerability being exploited in the wild.” (Link: June 07, 2024)
    • “There is evidence that this vulnerability may be under limited, targeted exploitation.” (Link: October 02, 2023)

Atlassian:

  • Exploited in the Wild:
    • “Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.” “UPDATE: We have evidence to suggest that a known nation-state actor is actively exploiting CVE-2023-22515 and continue to work closely with our partners and customers to investigate.” (Link: October 05, 2023)
    • “As part of Atlassian's ongoing monitoring and investigation of this CVE, we observed several active exploits and reports of threat actors using ransomware.” (Link: November 06, 2023)
    • “Atlassian is aware of current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server.” (Link: June 03, 2022)

B

Barracuda:

  • Exploited in the Wild:
    • “Based on our investigation to date, we’ve identified that the vulnerability resulted in unauthorized access to a subset of email gateway appliances.” (Link: May 23, 2023)
    • “Earliest identified evidence of exploitation of CVE-2023-2868 is currently October 2022.” (Link: May 30, 2023)
    • ”...including that exploitation occurred on a subset of compromised Barracuda Email Security Gateway (ESG) appliances by an aggressive and highly skilled actor conducting targeted activity...” (Link: June 15, 2023)

C

Check Point:

  • Exploited in the Wild:
    • “Following our security update on May 27, 2024, Check Point's dedicated task force continues investigating attempts to gain unauthorized access to VPN products used by our customers. On May 28, 2024 we discovered a vulnerability in Security Gateways with IPsec VPN in Remote Access VPN community and the Mobile Access software blade (CVE-2024-24919). Exploiting this vulnerability can result in accessing sensitive information on the Security Gateway.” (Link: May 29, 2024)
    • “Yesterday (May 27, 2024) we delivered a solution that addresses attempts we saw on a small number of customers’ VPN remote access networks as referenced below. Today, we found the root cause for these and are now releasing a fix.” (Link: May 28, 2024)

Cisco:

  • Proof of Concept: “The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.” (Link: September 04, 2024)
  • Exploited in the Wild:
    • “Cisco is aware of active exploitation of these vulnerabilities.” (Link: October 16, 2023)
    • “The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory.” (Link: October 23, 2024)
    • “In November 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.” (Link: December 02, 2024)

Citrix:

  • Exploited in the Wild:
    • “Exploits of these CVEs on unmitigated appliances have been observed.” (Link: January 16, 2024)
    • “Exploits of CVE-2023-3519 on unmitigated appliances have been observed.” (Link: July 18, 2023)
    • “We are aware of a small number of targeted attacks in the wild using this vulnerability” (Link: June 07, 2023)

D

D-Link:

  • Proof of Concept:
    • “0-day Vulnerability” (Link: September 06, 2022)
    • “On May 15th, 2024, a 3rd party security researcher, publically 0-day disclosed the D-Link Router DIR-X4860 (firmware ver. 1.04b03) with potential vulnerabilities.” (Link: May 16, 2024)

E

F

F5:

  • Exploited in the Wild:
    • “F5 has observed threat actors using this vulnerability to exploit CVE-2023-46748.” (Link: October 30, 2023)
    • “This information is based on the evidence F5 has seen on compromised devices, which appear to be reliable indicators.” (Link: October 30, 2023)

Fortinet:

  • Exploited in the Wild:
    • “Reports have shown this vulnerability to be exploited in the wild.” (Link: November 27, 2024)
    • “Note: This is potentially being exploited in the wild.” (Link: February 08, 2024)
    • “A third-party report is indicating this may be exploited in the wild.” (Link: October 11, 2024)

G

Google (Android):

  • Exploited in the Wild:
    • “Note: There are indications that the following may be under limited, targeted exploitation.” (Link: November 04, 2024)
    • “Note: There are indications that CVE-2024-36971 may be under limited, targeted exploitation.” (Link: August 05, 2024)

Google (Chrome):

  • Exploited in the Wild:
    • “Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild.” (Link: January 16, 2024)
    • “Updated on 26 August 2024 to reflect the in the wild exploitation of CVE-2024-7965 which was reported after this release.” (Link: August 26, 2024)

H

I

Ivanti:

  • Proof of Concept: “However, a Proof of Concept is publicly available...” (Link: August 12, 2024)
  • Exploited in the Wild:
    • “We are aware of a limited number of customers’ Ivanti Connect Secure appliances being exploited by CVE-2025-0282 at the time of disclosure.” (Link: January 08, 2025)
    • “We are aware of a limited number of customers running CSA 4.6 patch 518 and prior who have been exploited when CVE-2024-9379 or CVE-2024-9380 are chained with CVE-2024-8963” (Link: October 08, 2024)
    • ”...at time of disclosure we were aware of a limited number of customers impacted by CVE-2023-46805, CVE-2024-21887 and CVE-2024-21893.” “We are aware of less than 20 customers impacted by the vulnerabilities prior to public disclosure.” (Link: January 10, 2024)

J

JetBrains:

  • Exploited in the Wild:
    • “On October 17, 2023, the Microsoft Threat Intelligence Center team reached out to JetBrains to inform us they have observed multiple North Korean nation-state threat actors actively exploiting the CVE-2023-42793 vulnerability since early October 2023.” (Link: October 18, 2023)
    • “On December 13, 2023 the Cybersecurity & Infrastructure Security Agency of the U.S. Department of Homeland Security (CISA) released a public advisory, in which they shared new ways in which this vulnerability (CVE-2023-42793) has been exploited by Russian nation-state threat actors as of September 2023.” (Link: December 14, 2023)
    • “Customer A ... Believed they were impacted by the CVE-2024-27198 vulnerability.” “They noticed several unauthorized admin accounts created on the server.” “Their TeamCity environment had been compromised through the recent vulnerabilities.” “Several unknown user accounts had been created on their TeamCity server.” (Link: March 11, 2024)

Juniper:

  • Proof of Concept: “However, a proof-of-concept exploit does exist in the wild.” (Link: June 28, 2021)
  • Exploited in the Wild: “Juniper SIRT is aware of successful malicious exploitation of these vulnerabilities.” (Link: November 08, 2023)

K

L

M

Microsoft:

  • Proof of Concept: “Publicly disclosed: Yes” (Link: December 10, 2024)
  • Exploited in the Wild: “Exploited: Yes” ; “Exploitability assessment: Exploitation Detected” (Link: December 10, 2024)

Mozilla Foundation:

  • Exploited in the Wild:
    • “We have had reports of this vulnerability being exploited in the wild.” (Link: October 09, 2024)
    • “An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.” (Link: November 30, 2016)

N

O

Oracle:

  • Exploited in the Wild: “It was reported as being actively exploited “in the wild” by CrowdStrike.” (Link: November 18, 2024)

P

Palo Alto Networks:

  • Proof of Concept:
    • “We are aware of a publicly available conference talk and blog posts discussing this issue. A proof of concept for this issue is also publicly available.” (Link: November 25, 2024)
    • “However, a proof of concept for this issue is publicly available.” (Link: October 09, 2024)
    • “Proof of concepts for this vulnerability have been publicly disclosed by third parties.” (Link: April 29, 2024)
  • Exploited in the Wild:
    • “Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.” (Link: December 26, 2024)
    • “Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability.” (Link: November 18, 2024)
    • “Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability.” (Link: April 29, 2024)
    • “Palo Alto Networks recently learned that an attempted reflected denial-of-service (RDoS) attack was identified by a service provider. This attempted attack took advantage of susceptible firewalls from multiple vendors, including Palo Alto Networks.” (Link: August 10, 2022)

PaperCut:

  • Exploited in the Wild: “We have evidence to suggest that unpatched servers are being exploited in the wild.” “PaperCut received our first report from a customer of suspicious activity on their PaperCut server on the 18th April at 03:30 AEST / 17th April 17:30 UTC.” (Link: April 18, 2023)

Progress Software (MOVEit):

  • Exploited in the Wild: “NOTE: this is exploited in the wild in May and June 2023” (Link: June 16, 2023)

Q

Qlik:

  • Exploited in the Wild: “Qlik has received reports that this vulnerability may be being used by malicious actors.” (Link: May 15, 2024)

QNAP:

  • Exploited in the Wild: “QNAP detected a new DeadBolt ransomware campaign on the morning of September 3rd, 2022 (GMT+8). The campaign appears to target QNAP NAS devices running Photo Station with internet exposure.” (Link: September 03, 2022)

Qualcomm:

  • Exploited in the Wild: “There are indications from Google Threat Analysis Group that CVE-2024-43047 may be under limited, targeted exploitation.” (Link: October 07, 2024)

R

S

SolarWinds:

  • Exploited in the Wild: “This is being exploited in the wild.” (Link: June 06, 2024)

SonicWall:

  • Proof of Concept: “SonicWall PSIRT is aware that a proof of concept (PoC) exploit for this vulnerabilities is publicly available” (Link: September 27, 2024)
  • Exploited in the Wild: “This vulnerability is potentially being exploited in the wild.” (Link: September 06, 2024)

Sophos:

  • Exploited in the Wild:
    • “Sophos has observed this vulnerability being used in the wild.” (Link: October 20, 2022)
    • “In December 2023, we delivered an updated fix after identifying new exploit attempts against this same vulnerability in older, unsupported versions of the Sophos Firewall.” (Link: December 11, 2023)

SysAid:

  • Exploited in the Wild: “The investigation determined that there was a zero-day vulnerability in the SysAid on-premises software.”“The vulnerability was exploited by a group known as DEV-0950 (Lace Tempest), as identified by the Microsoft Threat Intelligence team.” (Link: November 08, 2023)

T

TP-Link:

  • Exploited in the Wild: “TP-Link is aware of reports that the Remote Code Execution (REC) vulnerability detailed in CVE-2023-1389 in AX21 has been added to the Mirai botnet Arsenal.” (Link: April 27, 2023)

Trend Micro:

  • Exploited in the Wild: “ITW Alert: Trend Micro has observed at least one active attempt of potential exploitation of this vulnerability in the wild.” (Link: September 13, 2022)

U

V

Veritas:

  • Exploited in the Wild: “March 2023: A known exploit is available in the wild for the vulnerabilities below and could be used as part of a ransomware attack.” (Link: March ?? 2023)

Versa:

  • Proof of Concept: “A proof of concept exists in the lab environment.” (Link: September 20, 2024)
  • Exploited in the Wild: “This vulnerability has been exploited in at least one known instance by an Advanced Persistent Threat actor.” (Link: August 26, 2024)

VMware (Broadcom):

  • Proof of Concept: “VMware has confirmed that exploit code leveraging CVE-2021-39144 against impacted products has been published.” (Link: October 27, 2022)
  • Exploited in the Wild:
    • “VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812.” (Link: November 18, 2024) (Link: August 26, 2024)
    • “VMware has confirmed that exploitation of CVE-2023-20887 has occurred in the wild.” (Link: June 20, 2023)

W

X

Y

Z

Zimbra:

  • Exploited in the Wild: “Important: This vulnerability has been actively exploited, making it imperative to take immediate action.” (Link: July 13, 2023)

Zoho (ManageEngine):

  • Proof of Concept: “The exploit POC for the above vulnerability is available in public.” (Link: July 19, 2022)

Zyxel:

  • Exploited in the Wild: “Zyxel is aware of recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities” (Link: November 27, 2024)
 
Read more...

from Bruno Miguel

A few tips for gaming on Ubuntu with the Steam snap, and my overall experience with the distro after a few days of usage

A few days ago, I switched from Arch Linux to Ubuntu. I've been thinking about starting to use a distro more focused on stability and less on having the latest everything. Ubuntu was already the operating system my wife and my father were using, mainly due to the Ubunto Pro free tier, so I decided to go with it, too, and make my life easier when giving them support.

Surprisingly, the default Ubuntu experience improved a lot since I last used it. When was it? Ten years ago? More? I can't recall, but I know it was a long long time ago, in a galaxy far far away, and I remember using Unity. I miss Unity. I did install some extensions for GNOME, changed the typeface, used my own .fonts.conf, and a few other configurations, installed and built some utilities I had used on Arch for more than five years, and that was it.

The only issue I've had is using the Steam snap package and running games installed via Heroic Games Launcher's flatpak package, with shortcuts for them added to Steam. The confinement rules set for this snap don't let it use a lot of stuff outside of it, so I can't use the same setup I had on Arch.

I could install Steam with the --classic flag, which disables the confinement. However, if I'm using Snap for isolation, I might as well take advantage of it. I could also use the deb provided by Steam, but I want to stay close to the default as much as possible so I don't have to deal with as many potential issues.

There's also the possibility of installing Steam via Flapak. I might do it eventually. But now, I want to use the Snap package and send some reports to the team. If you want to submit them, too, take a look at the Testing page at the repo's wiki, and read the instructions on how to submit carefully.

After thinking about this for a day, I remembered there's this application called Cartridges, that serves as a main hub for your gaming clients. Steam and Heroic are both supported, but for it to see the Snap package, you need to change the Steam path to /home/USER/snap/steam/common/.steam/steam. (don't forget to change USER to your username)

While this is not ideal, because I have to have another package installed, it fixes it for me. My main game hub is now Cartridges.

For custom Proton forks, like Proton-GE, ProtonUp-QT supports the Steam snap package out-of-the-box.

You can also use different Mesa environments with the package. The repo's wiki has all the instructions. Shoutout to Diogo for mentioning this to me and for giving me a few tips that helped make the transition to this distribution easier.

#Linux #Ubuntu #GamingOnLinux

 
Leia mais...

from beverageNotes

I've been recently enjoying Mashbuild (https://www.washmodistilling.com/mashbuild), a whisky blended over in Washington, MO. It's a bit of a gimmick, but it's a tasty gimmick. Think “Infinity Bottle”, but at the barrel-level.

It's a 100 proof whisky that's fairly dark. It's not as fiery as those that have aged for a long time. I find it smooth enough to enjoy with just a splash of water—I also have it with ice.

On the nose I get leather with hints of cinnamon stick and honey. There's some heat mid-tongue and with greater heat at the throat. Honey and cinnamon with a brief hint of licorice or anise. The mouth feel is great, almost like coffee with cream.

There are some other flavors in there, but I'm not able to pick them out at the moment.

I like this.

I'll update when I put ice in the next dram.

 
Read more...

from csantosb

img
It is possible to contribute to improving #guix as the need for new functionalities, packages, fixes or upgrades arise. This is one of the strongest points in open communities: the possibility to participate on the development and continuous improvement of the tool. Let’s see how it goes when it comes to guix.
Guix is a huge project which follows closely the #freesoftware paradigm, and collaboration works in two directions. You take advantage of other developers contributions to guix, while you participate yourself to improving guix repositories with your fixes, updates or new features, once they have been tested. In a first approach, from my own experience, one may create a personal local repository of package definitions, for a personal use. As a second step, it is possible to create a public guix channel, in parallel to contributing upstream.
Contributing your code to guix comes to sending #email with your patches attached, it’s that simple. Don't be intimidated by the details (this is used by lots of open communities, after all). Once your patches are submitted, a review of your code follows, see details. Some tools, like mumi, are helpful to that purpose.

In detail

Following the kind of contribution (new additions, fixes or upgrades), these simple steps will allow you to start contributing to guix:

git clone guix itselft
from the guix repository, do:

sh guix shell -D guix -CPW ./bootstrap ./configure make -j$(nproc) ./pre-inst-env guix build hello add and commit your changes, watch the commit message
beware your synopses and descriptions
remember to run the package tests, if relevant
check the license
use an alphabetical order in input lists
no sign off your commits
don’t forget to use lint/style/refresh -l/dependents to check your code

Boring and routinary, right ?

Use sourcehut

img
Most of all the of the previous can be run automatically with help of sourcehut build farm #ci capabilities. Just simply, push the guix repository to sr.ht. At this point, it is possible to use this manifest file to run the lint/style/refresh -l/dependents testing stages on the yosys package definition, por example:

image: guix
shell: true
environment:
  prj: guix.guix
  cmd: "guix shell -D guix -CPWN git nss-certs -- ./pre-inst-env guix"
sources:
  - https://git.sr.ht/~csantosb/guix.guix
tasks:
  - def_pkg: |
      cd "$prj"
      _pkg=$(git log -1 --oneline | cut -d':' -f 2 | xargs)
      echo "export pkg=$_pkg" >> "$HOME/.buildenv"
  - setup: |
      cd "$prj"
      guix shell -D guix -CPW -- ./bootstrap
      guix shell -D guix -CPW -- ./configure
      guix shell -D guix -CPW -- make -j $(nproc)
  - build: |
      cd "$prj"
      eval "$cmd build --rounds=5 $pkg"
  - lint: |
      cd "$prj"
      eval "$cmd lint $pkg"
  - style: |
      cd "$prj"
      eval "$cmd style $pkg --dry-run"
  - refresh: |
      cd "$prj"
      eval "$cmd refresh -l $pkg"
  - dependents: |
      cd "$prj"
      eval "$cmd build --dependents $pkg"
triggers:
  - condition: failure
    action: email
    to: builds.sr.ht@csantosb.mozmail.com

Submit the manifest with

hut builds submit # --edit

You’ll be able to log into the build farm to follow the build process or to debug it with

hut builds ssh ID

Check the log here. As you can see, it fails: building of yosys succeeds, but building of packages which depend on it (--dependents) fails.

Advanced

Sourcehut provides a facility to automatize patch submission and testing. Using its hub integrator, one may just send an email to the email list related to your project (guix in this case), which mimics guix behavior for accepting patches.
The trick here consists on appending the project name as a prefix to the subject of the message, for example [PATCH project-name], which will trigger the build of previous .build.yml manifest file at the root of the project, after applying the patch. Neat, right ?
If you followed right here, you’ll notice that previous build manifest file is monolithic, affecting always the same package (yosys), which is kind of useless, as we are here interested in testing our patch. Thus, the question on how to trigger a custom build containing an updated $pkg variable related to the patch to test remains open.
To update the contents of the $pkg variable in the build manifest, one has to parse the commit message in the patch, extracting from there the package name. This is not a problem, as guix imposes clear commit messages in patches, so typically something like

* gnu: gnunet: Update to 0.23.0

or

* gnu: texmacs: Add qtwayland-5

Hopefully, parsing these messages to get the package name, and so the value of $pkg is trivial.
Then, it remains to include in our build manifest a first task which updates the contents of "$HOME/.buildenv". This file is automatically populated using the environment variables in the manifest, and its contents are sourced at the beginning of all tasks. This mechanism allows passing variables between tasks.

echo "export pkg=value" >> "$HOME/.buildenv"

Send your contribution

Finally, once your changes go through all the tests,

use git send-email to create and send a patch
consider reviews, if any, updating your patch accordingly with git ammend
resend a new patch including a patch version (v1, v2 ...)

Interested ? Consult the documentation for details, you’ll learn a lot about how to contribute to a common good and collaboration with other people.
#ciseries

 
Read more...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


News For All

🛡️ Microsoft Recall screenshots credit cards and Social Security numbers, even with the “sensitive information” filter enabled privacy – Microsoft's Recall feature, designed to capture screenshots, fails to adequately filter sensitive information like credit card numbers and Social Security numbers, raising privacy concerns despite encryption efforts. https://www.tomshardware.com/software/windows/microsoft-recall-screenshots-credit-cards-and-social-security-numbers-even-with-the-sensitive-information-filter-enabled

🏡 OpenWrt supply chain attack scare prompts urgent upgrades vulnerability – OpenWrt users are urged to upgrade their firmware to mitigate a potential supply chain attack involving command injection and weak hash vulnerabilities that could allow attackers to serve malicious images. https://www.theregister.com/2024/12/09/openwrt_firmware_vulnerabilities/

🔒 WhatsApp patches View Once flaw exposing vanishing media security news – WhatsApp has fixed a vulnerability in its View Once feature, which allowed disappearing media to be accessed through web clients and rogue browser extensions, undermining user privacy. https://www.theregister.com/2024/12/10/whatsapp_view_once/

🛡️ EU cybersecurity rules for smart devices enter into force security news – The EU's Cyber Resilience Act has come into effect, imposing security obligations on manufacturers of connected devices, requiring them to provide updates and ensure compliance by December 2027. https://techcrunch.com/2024/12/10/eu-cybersecurity-rules-for-smart-devices-enter-into-force/

💰 3AM Ransomware: What You Need To Know malware – 3AM is a ransomware group that exfiltrates and encrypts data, using Rust for speed. Notably linked to LockBit, it threatens victims with data leaks unless a ransom is paid. https://www.tripwire.com/state-of-security/3am-ransomware-what-you-need-know

🚨 Location Data Firm Offers to Help Cops Track Targets via Doctor Visits privacy – Fog Data Science is proposing to assist police in tracking individuals by using location data linked to their doctors' offices, raising privacy concerns amidst increasing surveillance of healthcare visits. https://www.404media.co/location-data-firm-offers-to-help-cops-track-targets-via-doctor-visits/

💸 French internet operator fined $53 million for unsolicited ads and tracking users without consent privacy – France's CNIL fined Orange S.A. $53 million for sending unsolicited ads and tracking users without consent, violating data protection laws, despite the company claiming the practices were standard. https://therecord.media/french-internet-operator-fined-53-million-unsolicited-ads-tracking

🎄 Network security best practices for the holidays security news – As cyber threats rise during the holidays, ensure your network is secure by updating infrastructure, shutting down non-essential systems, and implementing multi-factor authentication to protect against attacks. https://news.sophos.com/en-us/2024/12/10/network-security-best-practices-for-the-holidays/

🔑 How easily access cards can be cloned and why your PACS might be vulnerable hacking write-up – Access cards can be easily cloned due to vulnerabilities in Physical Access Control Systems (PACS). Proper configuration and secure tokens are essential to protect against cloning threats. https://www.pentestpartners.com/security-blog/how-easily-access-cards-can-be-cloned-and-why-your-pacs-might-be-vulnerable/

👍 Patch Tuesday, December 2024 Edition security news – Microsoft patched at least 70 security vulnerabilities, including a zero-day exploit (CVE-2024-49138) in the Windows CLFS driver that allows attackers to gain system privileges. Users are urged to update systems. https://krebsonsecurity.com/2024/12/patch-tuesday-december-2024-edition/

💵 How Cryptocurrency Turns to Cash in Russian Banks – Krebs on Security cybercrime – Research reveals that a Canadian firm, Cryptomus, acts as a payment processor for Russian cryptocurrency exchanges, enabling cash conversion for cybercrime services and evasion of sanctions against Russia. https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/

🚫 Mozilla removing Do Not Track option from Firefox 135 privacy – Mozilla will remove the Do Not Track feature from Firefox 135 due to its ineffectiveness, directing users to utilize the Global Privacy Control instead, which aims to enhance online privacy. https://www.theregister.com/2024/12/12/firefox_do_not_track/

🛑 27 DDoS-For-Hire Services Disrupted In Run-Up To Holiday Season cybercrime – Operation PowerOFF, involving law enforcement from 15 countries, has disrupted 27 DDoS-for-hire services ahead of the holiday season, arresting several individuals and aiming to deter cybercriminal activity. https://www.tripwire.com/state-of-security/27-ddos-hire-services-disrupted-run-holiday-season

🚙 Researchers find security flaws in Skoda cars that may let hackers remotely track them vulnerability – Security researchers identified 12 vulnerabilities in Skoda Superb III's infotainment system that could allow hackers to track vehicles and execute malicious code via Bluetooth without authentication. https://techcrunch.com/2024/12/12/researchers-find-security-flaws-in-skoda-cars-that-may-let-hackers-remotely-track-them/

🔝 The Top Ten List of Why You Got Hacked This Year (2023/2024) security news – An analysis of penetration testing findings reveals the top reasons for security breaches, including lack of firewall restrictions, weak protocols, outdated web applications, social engineering, and poor password policies. https://www.blackhillsinfosec.com/top-ten-list-of-why-you-got-hacked-this-year-2023-2024/

📦 Critical WordPress plugin vulnerability under active exploit threatens thousands vulnerability – A critical vulnerability (CVE-2024-11972) in the Hunk Companion WordPress plugin, affecting over 10,000 sites, is actively exploited for unauthenticated code execution, with only 12% of users having applied the patch. https://arstechnica.com/security/2024/12/thousands-of-sites-remain-unpatched-against-actively-exploited-wordpress-plugin-bug/

🪙 Cleo urges customers to ‘immediately’ apply new patch as researchers discover new malware vulnerability – Cleo has urged users to apply a new patch for a critical vulnerability in its file sharing products, following reports of ongoing exploitation and the discovery of a new malware family, Malichus. https://therecord.media/cleo-urges-customers-to-immediately-patch-systems-after-exploitation

💰 Game-like ‘task scams’ stole more than $220 million in six months cybercrime – The FTC warns about game-like online job scams that have stolen over $220 million in six months, accounting for 40% of scam reports this year. Victims are often tricked into paying scammers under false promises of income. https://www.theverge.com/2024/12/13/24320391/ftc-task-scams-spotlight-warning

🔑 The Simple Math Behind Public Key Cryptography security news – Public key cryptography uses a pair of keys—one public and one private—to secure communications, relying on mathematical trapdoor functions that are easy to compute one way but difficult to reverse, ensuring data security against unauthorized access. https://www.wired.com/story/how-public-key-cryptography-really-works-using-only-simple-math/


Some More, For the Curious

🔒 Mitigating NTLM Relay Attacks by Default cyber defense – Microsoft has enhanced security by enabling Extended Protection for Authentication (EPA) by default in Exchange Server and other services to combat NTLM relay attacks, protecting users' identities. https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/

⚠️ Cleo Harmony, VLTrader, and LexiCom – RCE via Arbitrary File Write (CVE-2024-50623) vulnerability – A zero-day exploit in Cleo's file transfer software allows attackers to execute remote code via arbitrary file write. Patched versions still vulnerable; urgent updates are needed. https://labs.watchtowr.com/cleo-cve-2024-50623/

💻 Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows malware – A new cross-platform malware named Meeten targets crypto users via AI-generated scams, stealing sensitive information from macOS and Windows systems through deceptive downloads. https://www.cadosecurity.com/blog/meeten-malware-threat

🎭 Malicious Maven Package Impersonating 'XZ for Java' Library ... security research – A malicious Maven package impersonating the legitimate XZ for Java library introduces a backdoor for remote command execution, posing significant risks to Java applications and supply chains. https://socket.dev/blog/malicious-maven-package-impersonating-xz-for-java-library

🚨 Stark gestiegenes Aufkommen an Microsoft Remote Desktop Protokoll (RDP) Scanning warning – A significant surge in Microsoft Remote Desktop Protocol (RDP) scanning has been observed, particularly targeting port 1098. It's advised to restrict RDP access to enhance security. https://www.cert.at/de/aktuelles/2024/12/stark-gestiegenes-aufkommen-an-microsoft-remote-desktop-protokoll-rdp-scanning

💥 AMD’s trusted execution environment blown wide open by new BadRAM attack vulnerability – Researchers revealed the BadRAM attack, which exploits vulnerabilities in AMD's Secure Encrypted Virtualization, allowing physical access to bypass protections and compromise sensitive data in virtual machines. https://arstechnica.com/information-technology/2024/12/new-badram-attack-neuters-security-assurances-in-amd-epyc-processors/

🔧 Ivanti fixed a maximum severity vulnerability in its CSA solution vulnerability – Ivanti addressed a critical authentication bypass vulnerability (CVE-2024-11639) in its Cloud Services Appliance, allowing remote attackers to gain administrative access. Additional SQL injection vulnerabilities were also fixed in version 5.0.3. https://securityaffairs.com/171850/breaking-news/ivanti-maximum-severity-flaw-csa-solution.html

📊 Latest round of MITRE ATT&CK evaluations put cybersecurity products through rigors of ransomware security news – MITRE's latest ATT&CK evaluations assessed 19 vendors against ransomware tactics, revealing disparities in detection rates and false positives. The inclusion of macOS threats highlighted evolving security challenges. https://cyberscoop.com/mitre-attack-evaluations-ransomware-macos/

👁️ Researchers uncover Chinese spyware used to target Android devices security research – Researchers at Lookout revealed EagleMsgSpy, a Chinese spyware tool used by law enforcement to collect extensive data from Android devices, including messages and location information, potentially posing risks to travelers. https://techcrunch.com/2024/12/11/researchers-uncover-chinese-spyware-used-to-target-android-devices/

🤞 The evolution and abuse of proxy networks cybercrime – Proxy networks have evolved from privacy tools like VPNs and TOR to being exploited by cybercriminals and state-sponsored actors for malicious activities, including DDoS attacks and espionage, posing challenges for defenders. https://blog.talosintelligence.com/the-evolution-and-abuse-of-proxy-networks/

🔍 Zero Day Initiative — SolarWinds Access Rights Manager: One Vulnerability to LPE Them All vulnerability – Research revealed multiple vulnerabilities in SolarWinds Access Rights Manager, including pre-auth arbitrary file deletion that could allow attackers to escalate privileges remotely on Windows machines, particularly if using a Domain Admin account. https://www.thezdi.com/blog/2024/12/11/solarwinds-access-rights-manager-one-vulnerability-to-lpe-them-all

🔒 Google says its breakthrough quantum chip can’t break modern cryptography security news – Google's Willow quantum chip, while powerful, is not capable of breaking modern cryptography. Experts estimate it will take millions of qubits and at least a decade to potentially crack RSA encryption. https://www.theverge.com/2024/12/12/24319879/google-willow-cant-break-rsa-cryptography

📊 Common Vulnerability Scoring System (CVSS) security news – The Common Vulnerability Scoring System (CVSS) is a standardized framework used to assess the severity of software vulnerabilities, providing a numerical score to help organizations prioritize their responses. https://vulncheck.com/blog/common-vulnerability-scoring-system

⛓️‍💥 Ultralytics Supply-Chain Attack security research – A supply-chain attack on the Ultralytics AI library led to a malicious version being published on PyPI, which downloaded a coinminer. Experts recommend improving security configurations for package publishers. https://www.schneier.com/blog/archives/2024/12/ultralytics-supply-chain-attack.html

🔍 XRefer: The Gemini-Assisted Binary Navigator security research – Mandiant introduces XRefer, a tool designed to assist malware analysts by providing cluster-based navigation and context-aware views for understanding complex binaries, enhancing efficiency in reverse engineering. https://cloud.google.com/blog/topics/threat-intelligence/xrefer-gemini-assisted-binary-navigator/

⛳ German agency BSI sinkholed a botnet of 30,000 devices infected with BadBox malware – BSI has disrupted a botnet of 30,000 infected devices running BadBox malware, blocking communication and preventing further exploitation. Outdated Android versions are at risk. https://securityaffairs.com/171968/malware/bsi-sinkholed-badbox-botnet.html


CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-49138, a heap-based buffer overflow vulnerability in Microsoft Windows CLFS Driver, to its Known Exploited Vulnerabilities Catalog due to active exploitation risks. https://www.cisa.gov/news-events/alerts/2024/12/10/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-50623, an unrestricted file upload vulnerability affecting Cleo products, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, highlighting significant risks for federal agencies. https://www.cisa.gov/news-events/alerts/2024/12/13/cisa-adds-one-known-exploited-vulnerability-catalog

🔒 Microsoft Releases December 2024 Security Updates security news – Microsoft has issued security updates for various products to fix vulnerabilities that could allow cyber attackers to take control of affected systems. Users are urged to apply the updates promptly. https://www.cisa.gov/news-events/alerts/2024/12/10/microsoft-releases-december-2024-security-updates 🔒 Ivanti Releases Security Updates for Multiple Products security news – Ivanti has issued security updates for several products, including Ivanti Cloud Service Application and Ivanti Connect Secure, urging users to review advisories and apply necessary updates. https://www.cisa.gov/news-events/alerts/2024/12/10/ivanti-releases-security-updates-multiple-products 🔒 Adobe Releases Security Updates for Multiple Products security news – Adobe has issued security updates for several products, including Acrobat and Illustrator, to fix vulnerabilities that could allow cyber attackers to take control of affected systems. https://www.cisa.gov/news-events/alerts/2024/12/10/adobe-releases-security-updates-multiple-products 🔒 Apple Releases Security Updates for Multiple Products security news – Apple has issued security updates for various products to fix vulnerabilities that could allow cyber attackers to take control of affected systems. Users are urged to review advisories and apply updates promptly. https://www.cisa.gov/news-events/alerts/2024/12/12/apple-releases-security-updates-multiple-products

⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA has issued seven advisories on ICS vulnerabilities, including products from MOBATIME, Schneider Electric, National Instruments, and Rockwell Automation, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2024/12/10/cisa-releases-seven-industrial-control-systems-advisories ⚙️ CISA Releases Ten Industrial Control Systems Advisories vulnerability – CISA has published ten advisories addressing vulnerabilities in various Siemens Industrial Control Systems, urging users to review the advisories for technical details and necessary mitigations. https://www.cisa.gov/news-events/alerts/2024/12/12/cisa-releases-ten-industrial-control-systems-advisories


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from csantosb

img
Remote #ci is the way to go in #modernhw digital design testing. In this #ciseries, let’s see how to implement it with detail using sourcehut and a real world example.
Sourcehut is a lightweight #gitforge where I host my #git repositories. Not only it is based on a paradigm perfectly adapted to #modernhw, but also its builds service includes support for guix (x86_64) images. This means that we will be able to execute all of our testing online inside guix profiles, shells or natively on top of the bare-bones image.

Alu

Let’s consider now a variant of the previous example with open-logic. Here, we concentrate on a toy design only for demonstration purposes, a dummy alu emulator, which uses #osvvm as verification framework and relies on a few #openlogic blocs. In this case, its dependencies are defined in a manifest.scm file, including both fw-open-logic and osvvm, among other dependencies.
Install dependencies locally, in a new profile with

cd alu
mkdir _deps
export GUIX_PROFILE=open-logic/_deps
guix install -P $GUIX_PROFILE -m .builds/manifest.scm
. $GUIX_PROFILE/etc/profile

In this case, we will test the design using, first, a custom made makefile. Secondly, we will use hdlmake to automatically produce our makefile. Similarly to previous #openlogic example, two build manifest are used:

profile1
profile2

You’ll realise how some of the tasks are common with the case of previous #openlogic example (update channels, auth and update profile).

osvvm

In this case, we also need to compile osvvm libraries

compile__osvvm, produce a compiled version of #osvvm verification libraries; this is necessary as we are using here the tcl scripts included in the library itself to follow the correct order of compilation. Libraries will appear within the local profile under $GUIX_PROFILE/VHDL_LIBS/GHDL-X.Y.Z

test

test, for a fully custom made testing pipeline; in this case, using a Makefile
Just simply, source the .envrc file where the local $GUIX_PROFILE variable is defined, cd to the ghdl directory and call make to compile the design and run the simulation in two steps: first, clean all and include sources in its corresponding libraries with

sh make __clean_all __include

Then, produce a new Makefile using ghdl.

sh ./makefile.sh # ghdl --gen-makefile ...

Finally, run the simulation with

sh make GHDLRUNFLAGS="--stop-time=4us --disp-time --ieee-asserts=enable" run

This will produce a executable file before running it with the provided parameters.
You may notice that, in this case, you need to produce somehow your own Makefile, or equivalent pipeline, right ?

hdlmake

Wouldn’t it be nice if we had a tool to deploy online which produces makefiles for us ? It exists, and its name is #hdlmake.

test__hdlmake
Source the .envrc file where the local $GUIX_PROFILE variable is defined, cd to the .builds/hdlmake directory where all Manifest.py files are located, and call hdlmake to produce the Makefile. Finally, just run make to compile the design, produce an executable and run it.

Check the resulting logs inline here, for example.

 
Read more...