Agregátor RSS

Za 20 GB evropských dat zaplatíte u Wise o 243 Kč méně než u Revolutu. U větších globálních balíčků se však pořadí obrací. Rozhoduje také platnost dat, která může být až jeden rok. Porovnali jsme ceny, pokrytí i podmínky vracení peněz.

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Americký fotograf Jim Wehtje používá místo viditelného světla rentgenové záření. Například u mušlí tak dokáže zobrazit složité spirály, komory a další struktury ukryté pod jejich povrchem. Jeho fotografie stojí někde na pomezí vědeckého snímku a výtvarné fotografie.

Nepálský ISP WorldLink Communications popisuje sedm let zavádění IPv6. Dnes provozuje přes milion IPoE přípojek, všechny s podporou IPv6, a přibližně 70 % provozu přenáší přes IPv6. Zvlášť zajímavá je jeho kritika přidělování /64 zákazníkům. Pro domácnost s více VLAN, oddělenou IoT sítí nebo guest Wi-Fi je to nedostatečné. Rozebírá proto výhody /56 a praktické důsledky původního návrhu adresace. zdroj

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Podíváme se na špionážní software doručovaný přes cílenou reklamu, rekordní říjnový Patch Tuesday, tři zero-day chyby v plně aktualizovaných VPN od Ivanti a exploit Chromu za čtvrt milionu dolarů.

Spoléhání na umělou inteligenci oslabuje lidskou vytrvalost i samostatnost • Lidé přijímající hotové odpovědi ztrácejí motivaci překonávat překážky • Smysluplné využití spočívá v navádění ke kritickému přemýšlení

Již v létě hýřila KeyBanc superlativy na téma 18A procesu Intelu. Kvartál se sešel s kvartálem a KeyBanc přináší nášup. Intel má prý jisté zakázky od řady firem a další pokoukávají i po 14A procesu…

SaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access. ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments. Cloud Backup is one of those tools and does what it says on the tin for data stored on-prem, in the cloud, or in SaaS services like M365 and Google Workspace. On October 16, the company published an advisory revealing that on the 15th it “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.” “The service interruption affects partners and customers using Cloud Backup, formerly known as SkyKick. Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services have also been suspended out of an abundance of caution while our investigation and remediation continue,” the company advised. The suspension does not mean MSPs, or their customers, should assume that their environments were compromised, just that ConnectWise isn’t confident it can operate its services safely at this time. As of 16:00 UTC on October 18, the services remain unavailable, which means end-users can’t back up data, access their archives, or restore data. “Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities,” the company’s veep of security operations, Jason Ferguson, wrote on Reddit. ConnectWise has not offered much detail on the incident, other than to publish some indicators of compromise it thinks are tied to a handful of IP addresses and integrations with third-party apps. It has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products. Security outfit Huntress offered a starker view and wrote “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments.” “In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner.” “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added,” the firm warns. “You must review the credentials on all of your M365 applications.” ConnectWise says it “cannot discuss threat actor attribution at this time” because it is focused on “investigation, remediation, and supporting affected partners and their customers.” It has, however, called on its customers to probe any M365 environments they manage for signs of compromise. This is where things get tricky, because ConnectWise has no knowledge of those setups – as is proper because it is a platform provider and its MSP clients manage end-user relationships. It’s therefore relying on MSPs to do the right thing. MSPs are under no obligation to disclose the platforms they use to deliver their services. Indeed, for some organizations the allure of working with an MSP is to access packaged services they never need to learn or worry about. End-user organizations that may be happily oblivious about ConnectWise’s contribution to their business are therefore in an awkward position. Businesses that serve MSPs are a frequent target for attackers, who see the chance to compromise the likes of ConnectWise as a possible route to crack all of their partners and those service providers' end-users. The 2021 attack on Kaseya is the most notorious example of such an incident. ConnectWise will be hoping it doesn't take the crown. ®

Paulos Yibelo, the researcher who in early October claimed to have found a guest-host escape flaw in Linux KVM, the hypervisor used by most hyperscale clouds, has named the flaw PwnEscape and warned it might represent a new way to attack Linux – on top of being a 9.3-rated critical nasty in its own right. Yibelo’s work is now CVE-2026-99999. It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets. Such attacks are a nightmare security scenario because the whole point of virtualization is carving up hardware into isolated “guest” virtual machines that share a “host” server’s resources – without ever being able to see what other guests or the host are doing. Public clouds rely on that isolation remaining impervious. So do private clouds, because if guest/host isolation is violated, an attacker could conceivably access all the VMs on a host or pool of virtualized hardware. Attacks on a host could give an evildoer access to thousands of VMs, plus containers because many developers now run those constructs in a micro-VM to keep them isolated. PwnEscape makes it possible for guests to access the host, by sending a guest malformed IPv4 packets. As explained in a message from Red Hatter Michael S. Tsirkin in the Linux kernel stable tree, ‘If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.” Analysis from threat-finding firm SOC Prime details the mischief. “Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written. This optimization is legitimate and widely used for checksum offloading, but the security problem arises when less-trusted guest-controlled metadata can influence a write after the packet header has already passed earlier validation stages.” “Because the disclosure could be triggered repeatedly, an attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect. This represents a direct failure of the guest-host isolation boundary.” Red Hat’s report says the impact can potentially include “arbitrary code execution on the host, a system crash resulting in Denial of Service, or information disclosure of sensitive memory.” A new class of threat Paulos Yibelo, the researcher who found the flaw, thinks he stumbled upon a novel attack. “As far as we know, PwnEscape exposes an entirely new class of attacks in Linux networking: untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated and acted on them, undermining assumptions across the networking stack far beyond the original VM escape,” he wrote. “The popular mental model is that VM isolation lives in the virtual-machine monitor. Much of it does. But an attacker-controlled workload does not interact only with arch/x86/kvm/. It interacts with a host OS full of optimized, highly composable interfaces.” “If the metadata crosses a trust boundary, every deferred consumer has to inherit the right invariants. And if the packet can be transformed after those invariants are checked, the invariants have to remain true in the new representation.” “That is why a bug that looks, at first, like a malformed checksum hint can become a memory disclosure and a guest-to-host escape primitive. The problem was not how difficult IPv4 is to parse. It was that different parts of Linux were allowed to trust different versions of the same packet.” That’s an important observation, because while Linux KVM is widely used, and free, it is part of Linux – a project comprised of over 40 million lines of code. A vendor named Edera, which offers a secure container runtime based on the Xen hypervisor, last week none-too-gently pointed out that’s a big attack surface and that researchers have found seven escape bugs this year alone including Januscape. AWS, which runs its cloud on KVM, says its elastic compute cloud is not at risk. Google Cloud’s method of using KVM means it is probably in the clear, too. Developers have created an upstream fix in the Linux kernel. It’s percolating into major distros like Debian, RHEL, and Ubuntu and hopefully into virtualization products that rely on KVM, such as Nutanix and Proxmox. In the age of AI, miscreants will doubtless quickly explore Yibelo’s discoveries, making PwnScape potentially quite a moment for Linux developers and users. ®

Po 9 týdnech vývoje od vydání Linuxu 7.2 oznámil Linus Torvalds vydání Linuxu 7.3. Podrobný přehled novinek a vylepšení na Linux Kernel Newbies nebo LWN.net: první a druhá polovina začleňovacího okna.

Kdo chce mít v důchodu vedle státní penze dalších 10 000 korun měsíčně v dnešních cenách, potřebuje rezervu v řádu milionů korun. Spočítali jsme, kolik si musíte každý měsíc odkládat, pokud začnete ve 25, 35 nebo 45 letech. Počítali jsme se třemi variantami podle toho, jak se vám peníze zhodnotí.

Během října se úrokové sazby spoření nečekaně opět posunuly nahoru, což je velmi dobrá zpráva pro všechny střadatele, kteří chtějí bezpečné uložení peněz s pojištěním vkladů.

Chystané Ubuntu 27.04 bude mít kódové označení Tenacious T-Rex. Mozilla představila Firefox Enterprise, podnikovou verzi svého webového prohlížeče. KDE vydalo desktopové prostředí Plasma 6.8.

Evropa, jak se zdá, pracuje na věrných wingmanech pro evropské síly. Airbus U740-Valkyrie je pozoruhodným výsledkem spolupráce evropského Airbusu s americkým Kratosem. První let se po startu z odpalovací kolejnice povedl, do služby v letectvu evropských zemí by Valkyrie měla nastoupit v roce 2029.

Po low-profile Radeonu RX 9060 XT 16GB od Vastamor míří na trh další útlá karta. Tentokrát od výrobce, u kterého lze čekat podstatně lepší dostupnost, společnosti PowerColor…

Zjištěna zranitelnost v kernelu projevující se při virtualizaci. Nejde tedy o chybu samotného KVM ani konkrétního poskytovatele cloudu, ale o problém v linuxovém zpracování IPv4 paketů, který se může týkat různých virtualizačních a sandboxových prostředí. Více např. na hacker.news - Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory. Aktualizace jsou k dispozici.

Malware napsaný v Go se šíří mezi linuxovými systémy, pokouší se získávat SSH klíče a využívá kompromitované stroje pro těžbu kryptoměn. Autor použil FakeNet-NG a Wireshark k analýze síťové komunikace. Popsal také indikátory kompromitace a možnosti obrany. Zajímavé je propojení SSH bezpečnosti, analýzy síťového provozu a detekce prostřednictvím SIEM. více