Security-Portal.cz je internetový portál zaměřený na počítačovou bezpečnost, hacking, anonymitu, počítačové sítě, programování, šifrování, exploity, Linux a BSD systémy. Provozuje spoustu zajímavých služeb a podporuje příznivce v zajímavých projektech.

Kategorie

You’re not really still using Windows XP, are you?

Computerworld.com [Hacking News] - 16 Duben, 2024 - 13:13

I don’t know whether to be amazed or horrified at how much out-of-date technology we’re still using. Maybe both. Both is good.

It’s been 10 years since Windows XP support expired. That’s a whole decade, people! But when I recently posted a meme “celebrating” the occasion, I started hearing from people who — God help them — are still using XP.

One person told me he believes XP still lives on at NASA’s Goddard Space Flight Center on old systems still running Windows XP Embedded (XPe). Why? Because their manufacturers wouldn’t (couldn’t?) update their systems. Of course, NASA could replace them… but at a six-figure price for new gear, no one has the budget to do it. 

I can believe that — I used to work at Goddard in the late 1980s, and one of my projects was running an online system to track the real-time status of NASA Space Shuttle communication links. Among the systems I ran herd on was a tertiary Shuttle data connection that was a 110-baud Telex line to Bermuda dating to the 1950s. It worked, but that’s all you could say about it.

Then, as now, we kept it going because NASA didn’t have the money to replace it. (NASA, by the way, has never had anything like the budget it needs since the 1960s and the Apollo moon landings.)

But I digress. 

NASA’s not the only one stuck with running XP. Several people told me their medical facilities are still running XPe systems, too. Yet another tells me his engineering lab is doing the same thing. The reason? Once more, it works and there’s no money to replace the equipment. 

But, you say, those are corner cases, oddball situations. No one is really running XP on a PC anymore are they? ARE THEY?

Yes, in fact, they are. 

According to StatCounter, as of March 2024, 0.39% of desktops are still running Windows XP. Let’s do a little math. Microsoft claims there are 1.4 billion Windows PCs in the world, so that means we still have not quite 5.5 million XP computers up and running dsomewhere. And since StatCounter gets its numbers from systems connected to the Internet, that means we have about 5.5 million compromised PCs around the globe.

Eek!

The classic justification is that, “It’s working just fine! Why should I spend any money on it!?” My 1991 Toyota MR-2 worked just fine for decades, too, but I still wouldn’t drive in a demolition derby without brakes or a seat belt.

It’s not just XP though. There’s a lot of archaic systems still out there in production. 

For example, if you think XP is way too old to run for work, consider the German railroad company that was recently looking for a Windows for Workgroups 3.11 administrator! It turns out this software runs the “driver’s cab display system on high-speed and regional trains [which] shows the driver the most important technical data in real-time.” 

I love trains, but I think I might avoid German ones.

There’s another ancient system still “driving” public transportation. In San Francisco, the San Francisco Municipal Transportation Agency (SFMTA), still uses 5.25-in. floppy disks to run the city’s Muni Metro light rail. Every morning, the system boots up three floppy disks to load the Automatic Train Control System (ATCS) software. ATCS enables the human train operators to supervise while the train drives itself.

This takes “If it ain’t broke, don’t fix it” to scary new levels.

At least San Francisco is upgrading its system — if officials can get the budget.  

Now, I use old technology all the time. Under my main work desk, I keep my 1982 vintage KayPro II computer. It still boots from its floppy drives. But I haven’t used it for work this century. I keep it purely out of nostalgia since it was my first PC.

But I’m sensible about it. I keep all the other computers at hand up to date with the latest patches and updates. You should, too. Doing otherwise is just asking for trouble.

But, before I leave you, color me curious. What’s the oldest system you’re still using for real work?

Microsoft, Windows, Windows PCs
Kategorie: Hacking & Security

Identity in the Shadows: Shedding Light on Cybersecurity's Unseen Threats

The Hacker News - 16 Duben, 2024 - 13:10
In today's rapidly evolving digital landscape, organizations face an increasingly complex array of cybersecurity threats. The proliferation of cloud services and remote work arrangements has heightened the vulnerability of digital identities to exploitation, making it imperative for businesses to fortify their identity security measures. Our recent research report, The Identity Underground
Kategorie: Hacking & Security

Identity in the Shadows: Shedding Light on Cybersecurity's Unseen Threats

The Hacker News - 16 Duben, 2024 - 13:10
In today's rapidly evolving digital landscape, organizations face an increasingly complex array of cybersecurity threats. The proliferation of cloud services and remote work arrangements has heightened the vulnerability of digital identities to exploitation, making it imperative for businesses to fortify their identity security measures. Our recent research report, The Identity Underground The Hacker Newshttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations

The Hacker News - 16 Duben, 2024 - 10:36
The U.S. Federal Trade Commission (FTC) has ordered mental telehealth company Cerebral from using or disclosing personal medical data for advertising purposes. It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to third-parties for advertising purposes and failed to honor its easy cancellation policies. "Cerebral
Kategorie: Hacking & Security

FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations

The Hacker News - 16 Duben, 2024 - 10:36
The U.S. Federal Trade Commission (FTC) has ordered mental telehealth company Cerebral from using or disclosing personal medical data for advertising purposes. It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to third-parties for advertising purposes and failed to honor its easy cancellation policies. "Cerebral Newsroomhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

US grants Samsung $6.4 billion to boost local chip production

Computerworld.com [Hacking News] - 16 Duben, 2024 - 10:31

The US has committed $6.4 billion in grants to help Samsung expand its semiconductor manufacturing facilities in Texas in a bid to strengthen America’s position in chip production.

The funding, under the CHIPS and Science Act, will construct a comprehensive semiconductor manufacturing ecosystem in Taylor and expand an existing facility in Austin, the Department of Commerce said in a statement.

Samsung is expected to invest more than $40 billion in the region in the coming years, which could create over 20,000 jobs.

“Because of investments like Samsung’s, the United States is projected to be on track to produce roughly 20 percent of the world’s leading-edge logic chips by 2030,” the statement said.

The announcement follows an $8.5 billion grant given to Intel and $6.6 billion to Taiwan’s TSMC earlier this year to boost local production. Adding Samsung to the cohort could help support the supply chains of local tech firms.

“Samsung’s expanded chip production in the US is set to bolster the supply chains of US tech firms, particularly in aerospace, defense, automotive, and other industries,” said Charlie Dai, VP and principal analyst at Forrester. “This move will enhance supply chain resilience against global disruptions, improve security through closer collaboration with defense contractors, and reduce costs and shipping times.”

Danish Faruqui, CEO of Fab Economics, pointed out that although the direct funding grant awarded to Samsung is lower than those awarded to Intel and TSMC, it is the largest relative to the size of the company’s promised investment. TSMC’s investment is expected to exceed $65 billion. Intel anticipates its investments will surpass $100 billion over the next five years.

Investing in two separate locations

The proposed investment to Samsung is planned for two separate locations in Central Texas.

In Taylor, the funds will help establish a comprehensive, advanced manufacturing ecosystem. This will include two advanced logic foundry fabs dedicated to the mass production of 4nm and 2nm process technologies, an R&D fab for the development of future technology generations, and an advanced packaging facility focused on 3D High Bandwidth Memory and 2.5D packaging, both critical for AI applications.

In Austin, the investment will expand existing facilities to enhance the production of fully depleted silicon-on-insulator (FD-SOI) process technologies. This expansion aims to support crucial US industries, including aerospace, defense, and automotive, by upgrading their technological capabilities and innovation potential.

Challenges to overcome

While analysts agree that this move could potentially stimulate the domestic tech industry, becoming a leader in chip manufacturing may not be easy for the US.

Faruqui said that a significant challenge is the non-competitive Fab/ATP site-level Total Cost of Ownership (TCO), which aggregates all Capex and Opex cost structures for each year of construction and high-volume operation.

This becomes a crucial point as US faces stiff competition from Asian countries who have, for long, held a monopoly in advanced chip manufacturing.

“Challenges may arise in competing with Asian manufacturers, who have established cost advantages and a mature ecosystem for semiconductor manufacturing,” Dai said. “The US will need to address these challenges by focusing on developing a skilled workforce and offering competitive incentives to ensure the sustainability and growth of its domestic tech sector.”

CPUs and Processors, Technology Industry
Kategorie: Hacking & Security

Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown

The Hacker News - 16 Duben, 2024 - 09:33
Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird). The U.S. Justice Department (DoJ) said the malware "gave the malware purchasers control over victim computers and enabled them to access victims' private communications, their login credentials, and
Kategorie: Hacking & Security

Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown

The Hacker News - 16 Duben, 2024 - 09:33
Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird). The U.S. Justice Department (DoJ) said the malware "gave the malware purchasers control over victim computers and enabled them to access victims' private communications, their login credentials, and Newsroomhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Protect Your Linux Web Apps and Meet Compliance Standards

LinuxSecurity.com - 16 Duben, 2024 - 00:13
Security is vital for your Linux web apps, but keeping up with the latest exploits and meeting compliance standards can quickly become overwhelming.
Kategorie: Hacking & Security

Apple’s iPhone slumps as consumers wait for AI

Computerworld.com [Hacking News] - 15 Duben, 2024 - 19:35

IDC’s latest preliminary data on the smartphone market suggests Apple’s traditionally weakest smartphone quarter might be a little weaker than usual this year as political tension gnaws away at the company.

If IDC is correct, this unravelling has lopped a few more hairs from Apple’s Big Tech scalp, with Q1 iPhone sales down as much as 9.6%. That means Samsung is once again the temporary King of the Hill, even as China’s Xiaomi also makes gains. Comparative market share only tells part of the story, of course: Apple still allegedly sold 50 million iPhones in the first quarter of 2024, according to IDC. 

Morgan Stanley has a more optimistic view. In a client note received by Computerworld, analyst Erik Woodring wrote: “Contrary to market expectations, our Greater China Tech Hardware colleagues just raised their June quarter iPhone builds.”

Specifically, Woodring tells us analysts bumped up their “iPhone build expectations by 5%, or 2 [million] units, to 39 [million] units (-5% Y/Y) citing checks with Hon Hai and reflecting strength of legacy iPhone models in emerging markets, and relative stability elsewhere.”

Apple’s weakest quarter is weak, says IDC

When it comes to the overall market, IDC has a slightly rosy outlook. “The smartphone market is emerging from the turbulence of the last two years both stronger and changed,” said Nabila Popal, research director with IDC’s Worldwide Tracker team. 

The big trend is that global political realignment is evidencing itself in a new wave of smartphone competitors. “There is a shift in power among the Top 5 companies, which will likely continue as market players adjust their strategies in a post-recovery world,” said Popal.

It is inevitable US business will be affected by international political polarization. Indeed, as things continue to unravel, it is tempting to believe the architects of division on all sides will not rest until ordinary humans are once again reduced to speaking to each other using tin cans and string.

Hopefully we can avoid that outcome.

What can Apple do?

It’s never good to see an almost 10% decline in sales of a company’s most important product, but there are other reasons for provide optimism. Not only is Apple now actively engaged in developing new business plans for a more regulated industry, it’s also practicing its next pivot to pirouette around the twin themes of AR and AI. 

Claims Apple AI will run directly on the device should translate into an accelerant for iPhone sales, particularly among privacy/security conscious consumers and enterprise professionals. But there are other people who will welcome incredibly productive smartphones capable of handling complex tasks.

The value of new markets

Accurate recognition of the true value of growing markets remains a challenge for analysts looking to enumerate potential sales data in terms of specific company achievements. There is a possibility that Apple’s continued moves to build bigger business in India and elsewhere might not yet have been accurately baked into expectations. 

However, even if the IDC data is accurate, it’s worth reflecting that Apple’s move to make iPhones in India has been met by strong gains in local share — and there may be longer legs to find. Apple’s anticipated plan for more powerful iPhones with on-device edge AI will appeal to customers in growing markets, some of whom may have almost entirely skipped personal ownership of computers. These smart devices might yet turn out to be all the computer an even greater number of consumers need. They should be capable of replacing PCs for even more tasks.

Bicycle or hype cycle?

Indeed, while there’s plenty of excitement around AI/Generative AI (genAI) across mature markets (evidenced if by nothing else by the vast number of “Get Rich Quick” scams festooned across Twitter/X), it’s plausible to think that the true liberation of human potential will come from the democratization of access to computing these things represent. This, of course, is central to Apple’s core DNA, which has always described computers as “bicycles of the mind.”

The company won’t be alone, of course. Every tech firm is running to climb aboard the AI hype machine, in part to build big market slices in advance of inevitable regulation. But for Apple, if you also factor in second user and refurbished devices and think about actual devices in use, that means hundreds of millions will gain access to these new tools in a few months for no extra cost.

In fact, as consumers choose to use their handsets longer, the only thing that really matters when it comes to smartphone sales this year is the extent to which Apple’s forthcoming AI iOS upgrade is backwards compatible. Because today’s happy customers will become repeat customers in tomorrow’s upgrade cycle. That’s how this river flows.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grilland Apple Discussions groups on MeWe.

Apple, Generative AI, iOS, iPhone, Smartphones, Vendors and Providers
Kategorie: Hacking & Security

Threat Actors Are Actively Using Pupy RAT Malware to Attack Linux Systems

LinuxSecurity.com - 15 Duben, 2024 - 19:03
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been observed. The malware's multifunctional nature is a notable characteristic, striking a chord with Linux admins, infosec professionals, internet security enthusiasts, and sysadmins who are likely familiar with the potential threat of versatile malware.
Kategorie: Hacking & Security

Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw

The Hacker News - 15 Duben, 2024 - 18:51
A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal. While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that
Kategorie: Hacking & Security

Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw

The Hacker News - 15 Duben, 2024 - 18:51
A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal. While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that Newsroomhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead

The Hacker News - 15 Duben, 2024 - 15:30
Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes on
Kategorie: Hacking & Security

AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead

The Hacker News - 15 Duben, 2024 - 15:30
Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes onThe Hacker Newshttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks

The Hacker News - 15 Duben, 2024 - 15:29
The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42 said in a report published last week. "The threat
Kategorie: Hacking & Security

Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks

The Hacker News - 15 Duben, 2024 - 15:29
The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42 said in a report published last week. "The threat Newsroomhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Ubuntu Linux 24.04 LTS Beta Released with Enhanced Security & Performance

LinuxSecurity.com - 15 Duben, 2024 - 14:23
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's legacy of incorporating cutting-edge open-source technologies into a user-friendly, high-quality distribution.
Kategorie: Hacking & Security

Severe X.Org Memory Safety, Code Execution Vulns Fixed [Updated]

LinuxSecurity.com - 15 Duben, 2024 - 13:00
After recent heap overflow, out-of-bounds write, and privilege escalation flaws brought X.Org into the spotlight, more severe memory safety, use-after-free, heap buffer overread, and code execution vulnerabilities have been identified in the popular X server. These issues affect the X.Org X11 server.
Kategorie: Hacking & Security

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution

The Hacker News - 15 Duben, 2024 - 12:21
To minimize the risk of privilege misuse, a trend in the privileged access management (PAM) solution market involves implementing just-in-time (JIT) privileged access. This approach to privileged identity management aims to mitigate the risks associated with prolonged high-level access by granting privileges temporarily and only when necessary, rather than providing users with
Kategorie: Hacking & Security
Syndikovat obsah