Post Syndicated from Cliff Robinson original https://www.servethehome.com/amd-ryzen-9000-series-delayed-due-to-quality-concerns/
The AMD Ryzen 9000 series “Granite Ridge” is being delayed into August 2024 due to quality concerns with early parts
The post AMD Ryzen 9000 Series Delayed Due to Quality Concerns appeared first on ServeTheHome.
Post Syndicated from corbet original https://lwn.net/Articles/982336/
The LWN.net Weekly Edition for July 25, 2024 is available.
Post Syndicated from Explosm.net original https://explosm.net/comics/hands
New Cyanide and Happiness Comic
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=ubWZyhiCgfc
Post Syndicated from original https://www.toest.bg/pet-otrovni-dela-nikoga-ne-sum-se-chuvstval-tolkova-unizen/
Не ни гонят в буквалния смисъл, но правят всичко възможно нас тук да ни няма,
ми каза Данила Бабенко, когато се видяхме в София. От началото на войната на Русия срещу Украйна хиляди украински бежанци напуснаха страната си. Но Данила не е украинец. Руснак е.
Както знаете вече, намираме се в земята на „простичкото щастие“.
Данила Бабенко е офицер, лейтенант от запаса. Роден е и живее в Сочи. Завършил е Военната академия в Санкт Петербург. Когато Русия започва пълномащабната война срещу Украйна, Данила работи в частния сектор, извън армията. Също така има блог, в който критикува управлението на Владимир Путин.
Разказва ми как от началото на войната през февруари до септември 2022 г. изпада в тежка депресия заради постоянния стрес и страх от мобилизация, не се среща с никого и почти не излиза от дома си. Той е обучен да организира снабдяването и придвижването на различни родове войски в тила.
Освен това имам компетентността да подготвям и организирам строежи на временни пътища, необходими за придвижване на армията, понтонни мостове през водни препятствия и временни летища не само за самолети, а и за изстрелване на всякакви летателни апарати. Де факто всичко, което на руската армия ѝ трябва за нападението на Украйна. На 21 септември 2022 г. плановете ми за живота рязко се промениха, защото Русия обяви официална мобилизация. Заради своята военноотчетна специалност би трябвало да съм сред първите мобилизирани.
Още през септември Данила тръгва с туристическа виза към Бургас, където живеят негови приятели. Казва ми с тъга, че вероятно никога повече няма да се завърне в Русия, защото всичките му близки и познати там са престанали да общуват с него, упреквайки го, че още в началото на войната не е заминал на фронта като доброволец, за да защитава родината си.
Не мога да си обясня защо моите познати приемат тази война като защита. Не разбирам този дисонанс – как се получава да защитаваш нещо на територията на чужда страна. Това минимум е логическа грешка. Не разбирам хората, които чакат руския мир. Те не виждат ли какъв е този мир? Но в главите на руснаците всичко е манджа, в която безразборно си нахвърлял каквото си имал в хладилника.
По същото време, в началото на ноември 2022 г., българският парламент взема решение за предоставяне на военна помощ на Украйна. Президентът на „земята на простичкото щастие“ Румен Радев се опитва да предотврати това със следните аргументи:
От първия ден на тази война призовавам за прекратяване на бойните действия и за мирно уреждане на конфликта със средствата на дипломацията. За съжаление, стремежът към военна победа на всяка цена заглушава призивите за мир. Разумът отстъпва на оръжията.
Данила мисли за кратко върху идеята войната да спре по дипломатичен път и ми казва:
Никога няма да свърши тази война. Да, може би някога нейната гореща фаза ще приключи по някакъв начин, но войната между двата народа на Украйна и Русия никога няма да приключи. Те вече са завинаги разделени. Независимо че всеки от нас има роднини в Украйна или пък те имат роднини в Русия. Путинските амбиции могат да бъдат спрени само в Украйна. Трябва да се знае, че дори и да умре Путин, нищо няма да приключи с това, защото Путин е система, той е длъжност. Няма никакво значение как се казва водачът на федерацията – Иванов, Патрушев… Това е система и ако не я махнеш чрез революция, тя никога няма да се промени. Въпросът е, че всички будни граждани на Русия, цялата ни опозиция или избяга, или е в руски затвор. А всички хора, които се завръщат от тази война с Украйна, са с увредена психика.
Данила споделя с мен, че въпреки страха да се завърне у дома, понякога му минават мисли за се прибере в Русия, защото не вижда голяма перспектива за своето развитие в България.
Да, не ни гонят в буквалния смисъл, но правят всичко възможно нас тук да ни няма.
След като пристига в България, Данила отива в полицията. Оттам го насочват към Държавната агенция за бежанците (ДАБ).
Изпратиха ни на бул. „Монтевидео“ 21 Б, в бежанския лагер там. Това е кошмарно място. Боклук, мишки и бездомни кучета в стаите, в които живеят хората. Навсякъде вони на оцет, който са разлели, за да гонят паразити с него. Ужасяваща гледка е това място.
Данила пише заявление, с което иска статут на бежанец у нас. От Агенцията вземат паспорта му, който и до този момент остава у тях.
Дадоха ми само от тези синичките карточнета за самоличност, че съм човек, търсещ закрила. Ако например поискам да си открия банкова сметка, трябва да отида в Агенцията и да им се помоля да ми дадат паспорта, като процедурата е унизителна, защото пак пиша заявление, после те го разглеждат една седмица и ако решат, ми дават паспорта с хиляди уговорки, че трябва да го върна веднага след като си открия банковата сметка. А могат и да не ми отговорят на молбата за паспорта или дори да откажат да ми го дадат. Представяте ли си това – чакаш седмица, за да благоволи някой да прочете заявлението ти, и не знаеш дали ще ти дадат паспорта, за да си откриеш банкова смета, на която, ако случайно си намерил работа, да ти преведат заплатата.
© Личен архив
Вкарват те в стая на ДАБ заедно с преводач и представител на Агенцията. Започва истински разпит. Задаваха ми толкова лични въпроси, че ме беше срам да им отговарям. Например: „Докажете ни, че сте гей“ или „Как се прави секс с мъж? Как технически се прави това и защо го правите?“. Разпитът, наречен интервю, беше през декември 2022-ра, а получих отказа на Агенцията чак през август 2023-та. Аргументите за отказа им бяха, че бежанската ми история не е доказана, защото не съм им представил документи за моите твърдения и явно според тях за всичко лъжа.
Имаше документ с подписа на г-жа Тошева, директорката на Агенцията, в който пишеше, че война между Русия и Украйна няма, а има неблагоприятни външнополитически отношения. Забележете – не война, а неблагоприятни външнополитически отношения. Как въобще им хрумна такава формулировка на фона на това, което се знае за войната от свидетелствата от фронта, от бомбардировките над украински градове.
За отказа си да ми даде убежище Агенцията се опира на директива на ЕС от 2004 г., но мен ме порази, че те четат само първа точка от тази директива, не и точките по-долу. В първа точка пише, че ако бежанецът може да предостави документи за състоянието, което го е принудило да напусне държавата си, е добре да бъдат приложени. Но ако по някаква причина не може да представи такива документи, както е в моя случай, има други начини бежанските истории да бъдат доказани. Аз например не успях да взема със себе си никакви документи, защото, щом обявиха официално мобилизацията в Русия, се качих на първия автобус за Грузия без никакъв багаж. Само паспорта си взех и хукнах. Не съм мислил за документи. Да не говорим че в Агенцията ми казаха, че няма да приемат никакъв мой документ на руски език, защото преводът струвал скъпо. Не разбирам какъв е проблемът на Агенцията с нас, руските бежанци. Според мен ДАБ е „разкошен Путински орган“.
Молбата за убежище на Данила е с три аргумента: че открито е критикувал режима на Путин в блога си; не е отишъл да воюва, въпреки че е офицер; част е от малцинствена група, която в Русия е под заплаха от дискриминация.
Трябва да се знае, че в Русия сега всички такива групи, включително ЛГБТИ общността, са обявени за екстремисти, за което директно могат да те изпратят в затвора. Въобще не можеш да кажеш, че си гей, защото в Русия наричат живота на гейовете „джендърски екстремизъм, пропаганда и гей национализъм“. Така го определи един политик от руската Дума. Какво е това гей национализъм, аз не разбирам, но такива хора управляват Русия сега.
Първото дело беше в Административния съд в София. Цялото изслушване протече в рамките на двайсет минути, от които десет минути те поправяха някакъв компютър. Така че интересът на съда какво ще се случи с моя живот, продължи десет минути. Толкоз! Решението на съда потвърди и остави в сила отказа на Агенцията, че няма доказателства за моята бежанска история. След това обжалвахме във Върховния съд. Бях приет от институциите като лъжец, но освен това представителят на Агенцията заяви в съда, че моята хомосексуалност не е доказана.
Относно това, че съм военен и не искам да участвам във войната, от ДАБ казаха, че няма основания за притеснения, защото мен не са ме призовали да воювам с официална призовка. Казаха ми да дойда в България, когато получа призовка. Обясних, че призоват ли те, никога не можеш да напуснеш Русия, защото призовките вече са електронни и на всяка граница ще те спрат. Но както вече знаем от техни становища, за ДАБ формално война в Украйна няма.
© Личен архив
На 20 юни 2024 г., Световният ден на бежанците, Върховният административен съд връща делото на Данила в Административен съд – София-град за преразглеждане на случая, тъй като има нови обстоятелства, които могат да се добавят към делото. Данила ми показва в телефона си как, след като идва в България, Генералната прокуратура на Руската федерация е блокирала в социалните мрежи неговите постове, които са против войната и режима на Путин. Други нови обстоятелства по делото са, че Данила е протестирал пред Руското посолство в България и е един от хората, които организират секция в подкрепа на опозиционния кандидат за президент в Русия Борис Надеждин по време на президентските избори там.
Аз съм под заплаха – дори и в България.
Докато Данила чете решението на Съда и знае, че битката му с българските институции започва отначало, ЕС съгласува поредния пакет санкции срещу Русия. Дни по-късно президентът Румен Радев отказва да отиде на срещата на върха на НАТО със следния аргумент:
Не приемам правителството да превръща България в безсрочен донор на войната в Украйна, и то до крайна победа, без самите тези, които са изготвили и приели тази позиция, да им е ясно какво означава крайна победа и как ще се постигне тя.
За Данила процедурата по придобиване на бежански статут в България продължава и до днес.
Post Syndicated from Arpad Csoke original https://aws.amazon.com/blogs/big-data/configure-saml-federation-with-amazon-opensearch-serverless-and-keycloak/
Amazon OpenSearch Serverless is a serverless version of Amazon OpenSearch Service, a fully managed open search and analytics platform. On Amazon OpenSearch Service you can run petabyte-scale search and analytics workloads without the heavy lifting of managing the underlying OpenSearch Service clusters and Amazon OpenSearch Serverless supports workloads up to 30TB of data for time-series collections. Amazon OpenSearch Serverless provides an installation of OpenSearch Dashboards with every collection created.
The network configuration for an OpenSearch Serverless collection controls how the collection can be accessed over the network. You have the option to make the collection publicly accessible over the internet from any network, or to restrict access to the collection only privately through OpenSearch Serverless-managed virtual private cloud (VPC) endpoints. This network access setting can be defined separately for the collection’s OpenSearch endpoint (used for data operations) and its corresponding OpenSearch Dashboards endpoint (used for visualizing and analyzing data). In this post, we work with a publicly accessible OpenSearch Serverless collection.
SAML enables users to access multiple applications or services with a single set of credentials, eliminating the need for separate logins for each application or service. This improves the user experience and reduces the overhead of managing multiple credentials. We provide SAML authentication for OpenSearch Serverless. With this you can use your existing identity provider (IdP) to offer single sign-on (SSO) for the OpenSearch Dashboards endpoints of serverless collections. OpenSearch Serverless supports IdPs that adhere to the SAML 2.0 standard, including services like AWS IAM Identity Center, Okta, Keycloak, Active Directory Federation Services (AD FS), and Auth0. This SAML authentication mechanism is solely intended for accessing the OpenSearch Dashboards interface through a web browser.
In this post, we show you how to configure SAML authentication for controlling access to public OpenSearch Dashboards using Keycloak as an IdP.
The following diagram illustrates a sample architecture of a solution that allows users to authenticate to OpenSearch Dashboards using SSO with Keycloak.
The sign-in flow includes the following steps:
To get started, you should have the following prerequisites:
aoss:CreateSecurityConfig – Create a SAML provider.aoss:ListSecurityConfig – List all SAML providers in the current account.aoss:GetSecurityConfig – View SAML provider information.aoss:UpdateSecurityConfig – Modify a given SAML provider configuration, including the XML metadata.aoss:DeleteSecurityConfig – Delete a SAML provider.Complete the following steps to create your Keycloak client:
aws:opensearch:AWS_ACCOUNT_ID, where AWS_ACCOUNT_ID is your AWS account ID.
REGION is the AWS Region in which you have created the OpenSearch Serverless collection.
When your OpenSearch Serverless collection is active, you then create a SAML provider. This SAML provider can be assigned to any collection in the same Region. Complete the following steps:
You have now configured a SAML provider for OpenSearch Serverless. Next, you configure the data access policy for accessing collections.
After you have configured SAML provider, you have to create data access policies for OpenSearch Serverless to allow access to the users.
user/USERNAME or group/GROUPNAME. The value of the USERNAME or GROUPNAME should match the value you specified in Keycloak for user-/groupname.
Now, you have data access policy that will allow users to access the OpenSearch Dashboards and perform the allowed actions there.
Complete the following steps to sign in to the OpenSearch Dashboards:
After a successful login, you will be redirected to OpenSearch Dashboards, and you can perform the actions allowed by the data access policy.
You have successfully federated OpenSearch Dashboards with Keycloak as an IdP.
When you’re done with this solution, delete the resources you created if you no longer need them.
In this post, we demonstrated how to set up Keycloak as an IdP to access an OpenSearch Serverless dashboard using SAML authentication. For more details, refer to SAML authentication for Amazon OpenSearch Serverless
Arpad Csoke is a Solutions Architect at Amazon Web Services. His responsibilities include helping large enterprise customers understand and utilize the AWS environment, acting as a technical consultant to contribute to solving their issues.
Post Syndicated from jzb original https://lwn.net/Articles/983153/
Greg Kroah-Hartman has released the 6.10.1 stable kernel update. This release
contains a small number of seemingly urgent regression fixes. Users of
this kernel series are advised to upgrade.
Post Syndicated from Mackenzie Johnson original https://aws.amazon.com/blogs/big-data/how-actioniq-built-a-truly-composable-customer-data-platform-using-amazon-redshift/
This post is written in collaboration with Mackenzie Johnson and Phil Catterall from ActionIQ.
ActionIQ is a leading composable customer data (CDP) platform designed for enterprise brands to grow faster and deliver meaningful experiences for their customers. ActionIQ taps directly into a brand’s data warehouse to build smart audiences, resolve customer identities, and design personalized interactions to unlock revenue across the customer lifecycle. Enterprise brands including Albertsons, Atlassian, Bloomberg, e.l.f. Beauty, DoorDash, HP, and more use ActionIQ to drive growth through better customer experiences.
High costs associated with launching campaigns, the security risk of duplicating data, and the time spent on SQL requests have created a demand for a better solution for managing and activating customer data. Organizations are demanding secure, cost efficient, and time efficient solutions to power their marketing outcomes.
This post will demonstrate how ActionIQ built a connector for Amazon Redshift to tap directly into your data warehouse and deliver a secure, zero-copy CDP. It will cover how you can get started with building a truly composable CDP with Amazon Redshift—from the solution architecture to setting up and testing the connector.
Copying or moving data means heavy and complex logistics, along with added incurred cost and security risks associated with replicating data. On the logistics side, data engineering teams have to set up additional extract, transform, and load (ETL) pipelines out of their Amazon Redshift warehouse into ActionIQ, then configure ActionIQ to ingest the data on a recurring basis. Additional ETL jobs means more moving parts, which introduces more potential points of failure, such as breaking schema changes, partial data transfers, delays, and more. All of this requires additional observability overhead to help your team alert on and manage issues as they come up.
These additional ETL jobs add latency to the end-to-end process from data collection to activation, which makes it more likely that your campaigns are activating on stale data and missing key audience members. That will have implications for the customer experience, thereby directly affecting their ability to drive revenue.
Our solution aims to reduce the logistics already discussed and enables up-to-the-minute data by establishing a secure connection and pushing queries directly down to your data warehouse. Instead of loading full datasets into ActionIQ, the query is pushed to the data warehouse, making it do the hard querying and aggregation work, and wait for the result set.
With Amazon Redshift as your data warehouse, you can run complex workloads with consistently high performance while minimizing the time and effort spent in copying data over to the data warehouse through the use of features like zero-ETL integration with transactional data stores, streaming ingestion, and data sharing. You can also train machine learning models and make predictions directly from your Amazon Redshift data warehouse using familiar SQL commands.
Within AWS, ActionIQ has a virtual private cloud (VPC) and you have your own VPC. We work within our own private area in AWS, with our own locks and access restrictions. Because ActionIQ is going to have access to your Amazon Redshift data warehouse, this implies that an outside organization (ActionIQ) will be able to make direct database queries to the production database environment.
For your information security (infosec) teams to approve this design, we need very clear and tight guardrails to ensure that:
ActionIQ needs to communicate securely to satisfy every information security requirement. To do that, within those AWS environments, you must set up AWS PrivateLink with ActionIQ to create a secure connection between the two VPCs. PrivateLink sets up a secure tunnel between the two VPCs, thus avoiding any opening of either VPC to the public internet. After PrivateLink is set up, ActionIQ needs to be granted privileges to the relevant database objects in your Amazon Redshift data warehouse.
In Amazon Redshift, you must create a distinct database, a service account specifically for ActionIQ, and views to populate the data to be shared with ActionIQ. The views need to adhere to ActionIQ’s data model guidelines, which aren’t rigid, but nonetheless require some structure, such as a clear profile_id that is used in all the views for easy joins between the various data sets.
When starting a hybrid compute integration with Amazon Redshift, it’s key to align your data to ActionIQ’s table types in the following manner:
user_id and timestamp.product_id.
| Note: User info and event tables can join on any available identifier to the customer base table, not just the base user ID. |
Now you can set up the connection and declare the views in the ActionIQ UI. After ActionIQ establishes a table with master profiles, users can begin to interpret those tables and work with them to build out campaigns.
After setting up PrivateLink, the remaining steps to prepare for hybrid compute are the following:
If your data warehouse is on a private network, you must add ActionIQ’s IP addresses to your network’s allow list to allow ActionIQ to access your cloud warehouse. For more information on how to set this up, see the Configure inbound rules for SQL clients.
Create an Amazon Redshift user for ActionIQ
You can then run commands in the query editor to create a new user and to grant permission to the data sets you want to access through ActionIQ.
The result is that ActionIQ now has a programmatic query access to a dedicated database in your Amazon Redshift data warehouse, and that access is limited to that database.
In order to make this easy to govern, we recommend the following guidelines on the shared views:
The importance of providing views instead of actual tables is two-fold:
On the ActionIQ side, there’s no caching or persisting of data of any kind. This means that ActionIQ launches a query whenever a scheduled campaign is launched and requires data, and whenever a user of the platform asks for an audience count. In other words, queries will generally happen during business hours, but technically can happen at any time.
ActionIQ deploys the Amazon Redshift connector and tested queries to validate the success of the connector. After the audience is defined and validated, ActionIQ sends the SQL query to Amazon Redshift and it returns information. We also validate the results with Amazon Redshift to ensure that the logic is correct as intended.
With this, you experience a lean and more transparent deployment process. You can see the queries ActionIQ sends to Amazon Redshift, because the queries are logged. You can see what’s going on, what is attributable to ActionIQ, and can see the growth of adoption and usage.
A Connector defines the credentials and other parameters needed to connect to a cloud database or warehouse. The Connector screen is used to create, view and manage your connectors.
Organizations need strong data governance. ActionIQ requires a contract of what the data is going to look like within the defined view. With the dynamic nature of data, strong governance workflows with defined fields are required to run the connector smoothly to achieve the ultimate outcome—driving revenue through marketing campaigns.
Because ActionIQ is used as the central hub of marketing orchestration and activation, it needs to process a lot of queries. Because marketing activity can have significant spikes in activity, it’s prudent to plan for the maximum load on the underlying database.
In one scenario, you might have spikey workloads. With Amazon Redshift Serverless, your data warehouse will be able to scale automatically to manage those spikes. That means Amazon Redshift can absorb large and sudden spikes in queries from ActionIQ without much technical planning.
If workload isolation is a priority and you want to run the ActionIQ workloads using dedicated compute resources, you can use the data sharing feature to create a data share that can be accessed by a dedicated Redshift serverless endpoint. This would allow ActionIQ to query up-to-date data from a separate Redshift serverless instance without the need to copy any data while maintaining complete workload isolation.
The data team needs data to run business intelligence. ActionIQ is driving marketing activation and creating a new data set for the universal contact history—essentially the log of all marketing contacts from the activity. ActionIQ provides this dataset back to Amazon Redshift, which can then be included in the BI reports for ROI measurements.
For your information security teams, the ActionIQ’s Amazon Redshift connector presents a viable solution because ActionIQ doesn’t replicate the data, and the controls outlined establish how ActionIQ accesses the data. Key benefits include:
For business teams, the ActionIQ Amazon Redshift connector is querying the freshest data possible. With the connector, there is zero data latency—an important consideration with key audience members that are primed to convert.
ActionIQ is excited to launch the Amazon Redshift connector to activate your data where it lives—within your Amazon Redshift data warehouse—for a zero-copy, real-time experience that drives outcomes with your customers. To learn more about how organizations are modernizing their data platforms using Amazon Redshift, visit the Amazon Redshift page.
Enhance your Amazon Redshift investment with ActionIQ.
Mackenzie Johnson is a Senior Manager at ActionIQ. She is an innovative marketing strategist who’s passionate about the convergence of complementary technologies and amplifying joint value. With extensive experience across digital transformation storytelling, she thrives on educating enterprise businesses about the impact of CX based on a data-driven approach.
Phil Catterall is a Senior Product Manager at ActionIQ and leads product development on ActionIQ’s foundational data management, processing, and query federation capabilities. He’s passionate about designing and building scalable data products to empower business users in new ways.
Sain Das is a Senior Product Manager on the Amazon Redshift team and leads Amazon Redshift GTM for partner programs including the Powered by Amazon Redshift and Redshift Ready programs.
Post Syndicated from Тоест original https://www.toest.bg/tunkite-hora/
Те са винаги с нас, тънките хора
с дребните размери, като сивите хора
на киноекрана. Ние казваме –
те не съществуват: беше само
на филм, беше само през войната
със смразяващите заглавия във вестниците,
още бяхме малки, когато те
гладуваха и станаха толкова слаби, и дебнещите
им крайници си останаха мършави, макар че
мирът вече беше закръглил коремчетата
на мишките под най-мръсната
маса. По време на дългата
борба с глада тънките хора откриха таланта
си да постоянстват в тънкостта, а по-късно и да идват
в лошите ни сънища и да ни заплашват
не с оръжие и гадости,
а с тънка тишина.
Увити в бълхясали магарешки
кожи, без да се оплакват, вечно
пиещи оцет от консервни кутии: те
носеха непоносимия ореол на жребия
на изкупителната жертва. Но толкова
тънка, толкова мършава раса нямаше
как да остане само в сънищата, нямаше
как да остане чужда жертва в смалилата се
територия на главата повече, отколкото старицата в глинената
си колиба можеше да се удържи да не реже
тлъсто месо от щедрата луна, която всяка нощ
слизаше в двора,
а ножът вече я беше превърнал
в люспа от слаба светлина.
Тънките хора вече не се самозатриват,
докато сивата зора синее, червенее
и контурът на света се прояснява
и се изпълва с цвят.
Те упорстват в слънчевата стая: фризът
от рози-помпони и метличина по тапетите
избледнява под усмивките
на тънките им устни, под залязващото им царуване.
Как само се крепят едни други!
Нямаме толкова изобилно и грамадно пространство,
което да може да послужи за укрепление срещу коравите
им батальони. Вижте как дървесните стволове
се сплескват и вече не са кафяви,
когато тънките хора просто си стоят в гората
и изтъняват света до гнездо от оси,
а и по-сиво от това; без дори да мърдат костите си.
Силвия Плат
Превод от английски Румен Павлов
Силвия Плат (р. Бостън, 1932–1963) е американска поетеса и писателка. Най-известните ѝ книги са стихосбирките „Колосът“ (1960) и „Ариел“ (1965) и романът „Стъкленият похлупак“ (1963). Поезията ѝ се причислява към конфесионализма – поетичен стил, който се развива в САЩ в края на 50-те и началото на 60-те години на миналия век. През 1982-ра получава посмъртен „Пулицър“ за поезия за събраните си поетични произведения. Отчасти заради самоубийството и турбулентната си връзка с поета Тед Хюз, около името на Силвия Плат през годините се е създал известен култ. През 2025 г. се очаква на български да излязат „Колосът“ и „Ариел” от Силвия Плат – и двете в Издателство за поезия ДА.
Румен Павлов (р. София, 1986) е поет, музикант и преводач от и на английски език. Първата му стихосбирка „Отвор“ (изд. „Екрие“, 2020) печели наградата за най-добър дебют на литературните награди „Перото“ през 2021 г. Превеждал е Силвия Плат, Ан Секстън, Тед Хюз, Дерек Уолкът, У. Х. Одън, Едгар По и др.
Според Екатерина Йосифова „четящият стихотворение сутрин… добре понася другите часове“ от деня. Убедени, че поезията държи умовете ни будни, а сърцата – отворени, в края на всеки месец ви предлагаме по едно стихотворение. Защото и в най-смутни времена доброто стихотворение е добра новина.
Post Syndicated from jzb original https://lwn.net/Articles/983133/
Updated installation images for the OpenMandriva ROME rolling release Linux distribution are now available. Notable features in the
24.07 snapshot include KDE Plasma 6 as the default desktop, the addition of Proton and Proton
experimental packages for playing Windows games on Linux, as well as
GNOME 46.3 and LXQt 2.0.0 spins.
Post Syndicated from Talks at Google original https://www.youtube.com/watch?v=7N7N_wUHjEQ
Post Syndicated from jzb original https://lwn.net/Articles/983120/
OpenSSL has announced
that it has adopted a new governance framework:
The OpenSSL Management Committee (OMC) has been dissolved, and two
boards of directors have been elected for the Foundation and the Corporation. Each
organization has ten voting members. These boards share all the
responsibilities and authorities of the former OMC co-equally.To further engage our communities, we are establishing two advisory
committees for each entity: a Business Advisory Committee (BAC) and a
Technical Advisory Committee (TAC). The communities will elect the
members of the BACs and TACs, creating a direct channel for community
input in roadmap development and reflecting the diverse perspectives
of OpenSSL’s communities.
OpenSSL has also announced that two projects have adopted the OpenSSL Mission
and become OpenSSL
projects: Bouncy Castle, which provides
cryptographic APIs for Java and C#, and the cryptlib security
software development toolkit. See the announcement for full details.
Post Syndicated from jake original https://lwn.net/Articles/982887/
David Howells wanted to discuss swap handling in light of multi-page folios
in a combined storage, filesystem, and memory-management session at
the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit. Swapping has always been
done with a one-to-one mapping of memory pages to swap slots, he said, but
swapping multi-page folios breaks that assumption. He wondered if it would
make sense to use filesystem techniques to track swapped-out folios.
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/07/robot-dog-internet-jammer.html
Supposedly the DHS has these:
The robot, called “NEO,” is a modified version of the “Quadruped Unmanned Ground Vehicle” (Q-UGV) sold to law enforcement by a company called Ghost Robotics. Benjamine Huffman, the director of DHS’s Federal Law Enforcement Training Centers (FLETC), told police at the 2024 Border Security Expo in Texas that DHS is increasingly worried about criminals setting “booby traps” with internet of things and smart home devices, and that NEO allows DHS to remotely disable the home networks of a home or building law enforcement is raiding. The Border Security Expo is open only to law enforcement and defense contractors. A transcript of Huffman’s speech was obtained by the Electronic Frontier Foundation’s Dave Maass using a Freedom of Information Act request and was shared with 404 Media.
“NEO can enter a potentially dangerous environment to provide video and audio feedback to the officers before entry and allow them to communicate with those in that environment,” Huffman said, according to the transcript. “NEO carries an onboard computer and antenna array that will allow officers the ability to create a ‘denial-of-service’ (DoS) event to disable ‘Internet of Things’ devices that could potentially cause harm while entry is made.”
Slashdot thread.
Post Syndicated from jzb original https://lwn.net/Articles/982610/
Ryan Sipes told the audience during his keynote at
GUADEC 2024 in Denver, Colorado that the Thunderbird mail client
“probably shouldn’t still be alive”. Thunderbird, however, is not only
alive—it is arguably in better shape than ever
before. According to Sipes, the project’s turnaround is a result of
governance, storytelling, and learning to be comfortable asking users
for money. He would also like it quite a bit if Linux distributions stopped
turning off telemetry.
Post Syndicated from Dr. Rahul Sharad Gaikwad original https://aws.amazon.com/blogs/devops/leveraging-amazon-q-developer-for-efficient-code-debugging-and-maintenance/
In this post, we guide you through five common components of efficient code debugging. We also show you how Amazon Q Developer can significantly reduce the time and effort required to manually identify and fix errors across numerous lines of code. With Amazon Q Developer on your side, you can focus on other aspects of software development, such as design and innovation. This leads to faster development cycles and more frequent releases, as you as a software developer can allocate less time to debugging and more time to building new features and functionality.
Debugging is a crucial part of the software development process. It involves identifying and fixing errors or bugs in the code to ensure that it runs smoothly and efficiently in the production environment. Traditionally, debugging has been a time-consuming and labor-intensive process, requiring developers to manually search through lines of code to investigate and subsequently fix errors. With Amazon Q Developer, a generative AI–powered assistant that helps you learn, plan, create, deploy, and securely manage applications faster, the debugging process becomes more efficient and streamlined. This enables you to easily understand the code, detect anomalies, fix issues and even automatically generate the test cases for your application code.
Let’s consider the following code example, which utilizes Amazon Bedrock, Amazon Polly, and Amazon Simple Storage Service (Amazon S3) to generate a speech explanation of a given prompt. A prompt is the message sent to a model in order to generate a response. It constructs a JSON payload with the prompt (for example – “explain black holes to 8th graders”) and configuration for the Claude model, and invokes the model via the Bedrock Runtime API. Amazon Polly converts the Large Language Model (LLM) response into an audio output format which is then uploaded to an Amazon S3 bucket location:
Sample Code Snippet:
import boto3
import json
# Define boto clients
brt = boto3.client(service_name='bedrock-runtime')
polly = boto3.client('polly')
s3 = boto3.client('s3')
body = json.dumps({
"prompt": "\n\nHuman: explain black holes to 8th graders\n\nAssistant:",
"max_tokens_to_sample": 300,
"temperature": 0.1,
"top_p": 0.9,
})
# Define variable
modelId = 'anthropic.claude-v2'
accept = 'application/json'
contentType = 'application/json'
response = brt.invoke_model(body=body, modelId=modelId, accept=accept, contentType=contentType)
response_body = json.loads(response.get('body').read())
# Print response
print(response_body.get('completion'))
# Send response to Polly
polly_response = polly.synthesize_speech(
Text=response_body.get('completion'),
OutputFormat='mp3',
VoiceId='Joanna'
)
# Write audio to file
with open('output.mp3', 'wb') as file:
file.write(polly_response['AudioStream'].read())
# Upload file to S3 bucket
s3.upload_file('output.mp3', '<REPLACE_WITH_YOUR_BUCKET_NAME>', 'speech.mp3')Top common ways to debug code:
1. Code Explanation:
The first step in debugging your code is to understand what the code is doing. Very often you have to build upon code from others. Amazon Q Developer comes with an inbuilt feature that allows it to quickly explain the selected code and identify the main components and functions. This feature utilizes natural language processing (NLP) and summarization capability of LLMs, making your code easy to understand, and helping you identify potential issues. To gain deeper insights into your codebase, simply select your code, right-click and select ‘Send to Amazon Q’ option from menu. Finally, click on “Explain” option.
Amazon Q Developer generates an explanation of the code, highlighting the key components and functions. You can then use this summary to quickly identify potential issues and minimize your debugging efforts. It demonstrates how Amazon Q Developer accepts your code as input and the summarizes it for you. It explains the code in a natural language, which can help developers understand and debug the code.
If you have any follow-up question regarding the given explanation, you can also ask Amazon Q Developer for more in-depth review of a specific task. With respect to the code context, Amazon Q Developer automatically understands the existing code functionality and provides more insights. We ask Amazon Q Developer to explain how the Amazon Polly service is being used for synthesizing in the sample code snippet. It provides detailed step-by-step clarification from the retrieval to the upload process. Using this approach, you can ask any clarifying questions similar to asking a colleague to help you better understand a topic.
2. Amplify debugging with Logs
The sample code is deficient in terms of support for debugging including proper exception handling mechanisms. This makes it difficult to identify and handle issues during the execution or runtime of the application, further causing delays in the overall development process. You can instruct Amazon Q Developer to add a new code block for debugging your application against potential failures. Amazon Q Developer analyzes the existing code and then recommends to add a new code snippet to include printing and logging of debug messages and exception handling. It embeds ‘try-except’ blocks to catch potential exceptions that may occur. You use the recommended code after reviewing and modifying it. For example, you need to update the variable REPLACE_WITH_YOUR_BUCKET_NAME with your actual Amazon S3 bucket name.
With Amazon Q, you seamlessly enhance your codebase by selecting specific code segments and providing them as prompts. This enables you to explore suggestions for incorporating the required exception handling mechanisms or strategic logging statements.
Logs are an essential tool for debugging your application code. They allow you to track the execution of your code and identify where errors are occurring. With Amazon Q Developer, you can view and analyze log data from your application, and identify issues and errors that may not be immediately apparent from the code. It demonstrates that the given code does not have the logging statements embedded.
You can provide a prompt to Amazon Q Developer in the chat window asking it to write a code to enable logging and add log statements. This will automatically add logging statements wherever needed. It is useful to log inputs, outputs, and errors when making API calls or invoking models. You may copy the entire recommended code to the clipboard, review it, and then modify as needed. For example, you can decide which logging level you want to use, INFO or DEBUG.
3. Anomaly Detection
Another powerful use case for Amazon Q Developer is anomaly detection in your application code. Amazon Q Developer uses machine learning algorithms to identify unusual patterns in your code and highlight potential issues. It can detect issues that may be difficult to detect, such as an array out of bounds, infinite loops, or concurrency issues. For demonstration purposes, we intentionally introduce a simple anomaly in the code. We ask Amazon Q Developer to detect the anomaly in the code when attempting to generate text from the response. A simple prompt about detecting anomalies in the given code generates a useful output. It is able to detect the anomaly in the ‘response_body’ dictionary. Additionally, Amazon Q Developer recommends best practices to check the status code and handle the errors with a code snippet.
With code anomaly detection at your fingertips, you can promptly identify issues that may be impacting the application’s performance or user experience.
4. Automated Bug Fixing
After conducting all the necessary analysis, you can use Amazon Q Developer to fix bugs and issues in the code. Amazon Q Developer’s automated bug-fixing feature saves you hours you would otherwise spend on debugging and testing the code without its help. Starting with the code example which has an anomaly, you can identify and fix the code issue by simply selecting the code and sending it to Amazon Q Developer to apply fixes.
Amazon Q Developer identifies and suggests various ways to fix common issues in your code, such as syntax errors, logical errors, and performance issues. It can also recommend optimizations and improvements to your code, helping you to deliver a better user experience and improve your application’s performance.
5. Automated Test Case Generation
Testing is an integral part of code development and debugging. Running high quality test cases improve the quality of the code. With Amazon Q Developer, you can automatically generate the test cases quickly and easily. Amazon Q Developer uses its Large Language Model core to generate test cases based on your code, identifying potential issues and ensuring that your code is comprehensive and reliable.
With automated test case generation, you save time and effort while testing your code, ensuring that it is robust and reliable. A natural language prompt is sent to Amazon Q Developer to suggest test cases for given application code. You can notice that Amazon Q Developer provides a list of possible test cases that can aid in debugging and generating further test cases.
After receiving suggestions for test cases, you can also ask Amazon Q Developer to generate code snippet for some or all of the identified test cases.
Conclusion:
Amazon Q Developer revolutionizes the debugging process for developers by leveraging advanced and natural language understanding and generative AI capabilities. From explaining and summarizing code to detecting anomalies, implementing automatic bug fixes, and generating test cases, Amazon Q Developer streamlines common aspects of debugging. Developers can now spend less time manually hunting for errors and more time innovating and building features. By harnessing the power of Amazon Q, organizations can accelerate development cycles, improve code quality, and deliver superior software experiences to their customers.
To get started with Amazon Q Developer for debugging today navigate to Amazon Q Developer in IDE and simply start asking questions about debugging. Additionally, explore Amazon Q Developer workshop for additional hands-on use cases.
For any inquiries or assistance with Amazon Q Developer, please reach out to your AWS account team.
About the authors:
Post Syndicated from Eric Smith original https://www.servethehome.com/more-details-on-the-amd-ryzen-ai-300-series-ryzen-9000-series-and-zen-5/
We have more details on the AMD Ryzen AI 300 series, Ryzen 9000 series, including functional block diagrams
The post More Details on the AMD Ryzen AI 300 Series Ryzen 9000 Series and Zen 5 appeared first on ServeTheHome.
Post Syndicated from daroc original https://lwn.net/Articles/982965/
Let’s Encrypt has
announced
that it intends to end support “as soon as possible
” for the
Online Certificate Status Protocol (OCSP) over privacy concerns. OCSP was developed as a
lighter-weight alternative to
Certificate Revocation Lists (CRLs) that did not involve downloading
the entire CRL in order to check whether a certificate was valid. Let’s Encrypt will continue
supporting OCSP as long as it is a requirement for Microsoft’s
Trusted Root Program, but hopes to discontinue it soon:
We plan to end support for OCSP primarily because it represents a considerable risk to privacy on the Internet. When someone visits a website using a browser or other software that checks for certificate revocation via OCSP, the Certificate Authority (CA) operating the OCSP responder immediately becomes aware of which website is being visited from that visitor’s particular IP address. Even when a CA intentionally does not retain this information, as is the case with Let’s Encrypt, CAs could be legally compelled to collect it. CRLs do not have this issue.
People using Let’s Encrypt as their CA should, for the most part, not need to change their setups.
All modern browsers support CRLs, so end-users shouldn’t notice an impact either.
Post Syndicated from Tom Elkins original https://blog.rapid7.com/2024/07/24/malware-campaign-lures-users-with-fake-w2-form/
Rapid7 has recently observed an ongoing campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to download their W2 form that ultimately downloads a malicious JavaScript (JS) file instead. The JS file, when executed, downloads and executes a Microsoft Software Installer (MSI) package which in turn drops and executes a Dynamic Link Library (DLL) containing the Brute Ratel Badger.
In this blog, we will detail the attack chain and offer preventative measures to help protect users.
Starting on June 21, 2024, Rapid7 observed two separate incidents in which users downloaded and executed suspicious JavaScript (JS) files linked to the URL hxxps://grupotefex[.]com/forms-pubs/about-form-w-2/. Following execution of the JS files, Rapid7 observed the download and execution of an MSI file that was responsible for dropping a suspicious DLL into the user’s AppData/Roaming/ profile. Upon further analysis, Rapid7 determined that the suspicious DLL contained a Brute Ratel Badger. Brute Ratel is a command and control framework used for red team and adversary simulation.
When executed successfully, the Brute Ratel Badger will subsequently download and inject the Latrodectus malware. Latrodectus is a stealthy backdoor used by threat actors to query information about the compromised machine, execute remote commands, and download and execute additional payloads.
On June 23, Zscaler ThreatLabz issued a tweet indicating that the initial access broker behind the deployment of the malware family known as Latrodectus was using Brute Ratel as a stager.
On June 24, a blog was released by reveng.ai, outlining an identical attack chain that we observed. From the posts, we noted overlapping indicators of compromise (IOC), indicating that the behavior observed was related.
During analysis of the incidents, Rapid7 observed that users queried the search engine Bing containing the key words W2 form. They subsequently navigated to the domain appointopia[.]com, which re-directed the browser to the URL hxxps://grupotefex[.]com/forms-pubs/about-form-w-2/.
After replicating the incident in a controlled environment, we observed that following the query for w2 form 2024 using Bing, the top result is a link to the domain appointopia[.]com which claims to have W2 forms available for download.
After clicking the link, the browser is directed to the URL `hxxps://grupotefex[.]com/forms-pubs/about-form-w-2/`, which presents users with a fake IRS site, luring users into downloading their W2 form.
While interacting with the hyperlinks present on the website, we observed that each time, a CAPTCHA would appear, luring the users to solve it.
Upon closer examination, users were presented with a CAPTCHA system, seemingly designed to verify human activity. However, this CAPTCHA was part of a malicious scheme. Once answered successfully, the CAPTCHA would download a malicious JavaScript file named `form_ver`, appending the file name with the UTC time of access, such as `Form_Ver-14-00-21`. The source of the downloaded JS file came from a Google Firebase URL, `hxxps://firebasestorage.googleapis[.]com/v0/b/namo-426715.appspot.com/o/KB9NQzOsws/Form_Ver-14-00-21.js?alt=media&token=dd7d4363-5441-4b14-af8c-1cb584f829c7`. This JavaScript file would then be responsible for downloading the next stage payload.
We acquired one of the JS files from the incidents that took place on June 21 and analyzed the contents in a controlled environment. We observed that the JS file contained code hidden between commented out lines. Threat actors employ this technique in order to inflate the size of their files and obfuscate their code with the goal of evading antivirus solutions and hindering reversing.
In addition, we observed that the JavaScript contained a valid Authenticode certificate issued to Brass Door Design Build Inc. Threat actors will embed valid certificates in order to exploit trust mechanisms and make the scripts appear legitimate.
We analyzed the JS files and observed code resembling a technique used for extracting and executing hidden code within comments. Specifically: The code defines a ScriptHandler class that can read in a script file, parse out any lines starting with `//////`, and store those lines of code in an extractedCode property as seen in Figure 5. The code then defines a method `runExtractedCode()` that executes that extracted code using new `Function()`. It instantiates a ScriptHandler for the current script file, extracts the hidden code, and executes it.
This allows hiding arbitrary code within comments in a script, which will then be extracted and executed when the script is run. The comments provide a way to conceal the hidden code. This technique was used to hide malicious code within a script file designed to make the user think it is benign. When the script is executed, the concealed code would be extracted and run without the user’s knowledge.
After cleaning up the script file, we observed that the purpose of the script was to download an MSI package from the URL `hxxp://85.208.108[.]63/BST.msi` and execute it.
In another related incident that occurred on June 25, we observed that the JS file was downloading the payload from a similar URL, `hxxp://85.208.108[.]30/neuro.msi`.
We acquired the latest MSI file, neuro.msi, from hxxp://85.208.108[.]30/neuro.msi and analyzed the contents. We observed that the contents of the MSI file contained a Cabinet (.cab) file named disk1.cab which stored a DLL, capisp.dll.
We also observed that the MSI package `neuro.msi` contained a custom action whose function was to drop the DLL, `capisp.dll`, within AppData/Roaming/ folder and execute it using `rundll32.exe` with the export `remi`.
We obtained the DLL from the MSI installer and analyzed the contents.
During initial analysis, we observed the DLL was associated with the VLC media player. We also observed that the DLL contained a suspicious resource named نالوقتمتأخر located at the offset of 0x00EB2C0. We determined that the resource name نالوقتمتأخر was Arabic and translates to ‘It is late’, referring to time.
While analyzing the export function `remi` we observed that the function starts by storing a hardcoded string `)5Nmw*CP>sC%dh!E(eT6d$vp<)`, which is reserved for later use. The function then calculates the resource located at offset (0x00EB2C0) that marks the start of the encrypted data, which will be decrypted using an XOR decryption routine with the previously stored string.
After the data is decrypted, the function then utilizes the Windows API `VirtualAlloc` to allocate a new region of memory in order to copy and store the decrypted data.
Using that logic, we replicated the process in Cyberchef and observed that the decrypted data resembled another Windows binary. While analyzing the new binary, we observed an interesting string, `badge\_x64_rtl.bin.packed.dll`. We also observed that the new binary contained yet another embedded binary.
Further analysis revealed that the purpose of the decrypted binary was to load and execute the embedded binary. We identified the embedded binary as a Brute Ratel Badger (BRC4), a remote access agent in Brute Ratel. Upon successful execution, the BRC4 program attempts to establish connections to three hard coded Command and Control (C2) domains:
*bibidj[.]biz
*barsman[.]biz
*garunt[.]biz
In previous versions of the attack, we observed the BRC4 program attempting to establish communication with the C2 domains `barsen[.]monster` and `kurvabbr[.]pw`.
Following execution of the BRC4 program, we observed the download of `Latrodectus` which was subsequently injected into the Explorer.exe process.
We observed that the Latrodectus malware attempts to contact the following URLs:
* hxxps://meakdgahup[.]com/live/
* hxxps://riscoarchez[.]com/live/
* hxxps://jucemaster[.]space/live/
* hxxps://finjuiceer[.]com/live/
* hxxps://trymeakafr[.]com/live/
Rapid7 has observed a recent campaign targeting users searching for W2 forms. The campaign lures users into downloading JS files masqueraded as supposed W2 forms from a fake IRS website. Once the JS files are executed, it downloads and executes MSI packages containing the Brute Ratel badger. Upon successful compromise, the threat actors follow up by deploying the malware family known as Latrodectus, a malicious loader that is used by threat actors to gain a foothold on compromised devices and deploy additional malware.
➔ Provide user awareness training that’s aimed at informing users on how to identify such threats.
➔ Prevent execution of scripting files such as JavaScript and VisualBasic by changing the default ‘open-with’ settings to notepad.exe.
➔ Block or warn on uncategorized sites at the web proxy. Aside from blocking uncategorized sites, certain web proxies will display a warning page, but allow the user to continue by clicking a link in the warning page. This will stop drive-by exploits and malware from being able to download further payloads.
InsightIDR and Managed Detection and Response customers have existing detection coverage through Rapid7’s expansive library of detection rules. Rapid7 recommends installing the Insight Agent on all applicable hosts to ensure visibility into suspicious processes and proper detection coverage. Below is a non-exhaustive list of detections that are deployed and will alert on behavior related to this malware campaign:
| Tactics | Technique | Description |
|---|---|---|
| Resource Development | SEO Poisoning (T1608.006) | Threat Actor employed SEO poisoning, ensuring their advertisement was listed first in search results |
| Initial Access | Drive-by Compromise (T1189) | Upon successfully solving CAPTCHA, browser is directed to download a JavaScript file from another URL |
| Execution | Command and Scripting Interpreter: JavaScript (T1059.007) | User executes the downloaded JavaScript file |
| Defense Evasion | Embedded Payloads (T1027.009) | Brute Ratel payload is embedded within decrypted payload |
| Defense Evasion | Command Obfuscation (T1027.010) | Downloaded JavaScript file contains commands broken up by commented lines to hinder analysis and anti-virus scanners |
| Defense Evasion | Encrypted/Encoded File (T1027.013) | Latrodectus employs string decryption to hinder detection and analysis |
| Defense Evasion | Deobfuscate/Decode Files or Information (T1140) | DLL dropped by MSI package contains XOR routine to decrypt the Brute Ratel payload |
| Privilege Escalation | Dynamic-link Library Injection (T1055.001) | Latrodectus DLLs are injected into the Explorer.exe process |
| Command and Control | Web Protocols (T1071.001) | Brute Ratel and Latrodectus communicate with their C2 servers using HTTPS |
| Indicator | File Hash | Description |
|---|---|---|
| Form_Ver-14-00-21.js | F8121922AE3A189FBAE0B17C8F5E665E29E2E13B2E7144DABA4B382432B4949E | JS File downloaded from URL hxxps://firebasestorage[.]googleapis.com/v0/b/namo-426715.appspot.com/o/KB9NQzOsws/Form_Ver-18-44-37.js?alt=media&token=dd7d4363-5441-4b14-af8c-1cb584f829c7 |
| BST.msi | 5b18441926e832038099acbe4a90c9e1907c9487ac14bdf4925ac170dddc24b6 | MSI file downloaded from URL hxxp://85.208.108[.]63/BST.msi |
| neuro.msi | D71BFAB9CCA5DF6A28E12BA51FE5EAF0F9151514B3FD363264513347A8C5CF3A | MSI file downloaded from URL hxxp://85.208.108[.]30/nuero.msi contained within JS file |
| vpn.msi | 4586250dbf8cbe579662d3492dd33fe0b3493323d4a060a0d391f20ecb28abf1 | MSI file downloaded from URL hxxp://193.32.177[.]192/vpn.msi contained within JS file |
| aclui.dll | 8484560C1526EE2E313A2B57F52EA5B31EDD05A0C9664BD7F60DA020871BFE6F | DLL contained within MSI file BST.msi and vpn.msi |
| capisp.dll | 9B7BDB4CB71E84C5CFF0923928BF7777A41CB5E0691810AE948304C151C0C1C5 | DLL contained within MSI file neuro.msi |
| BruteRatel payload | AD4A8983EDFB0DBA81E3D0BAE1AB549B500FD8A07DAF601E616B7E721D0674C6 | BruteRatel decrypted payload contained within capisp.dll |
| Indicator | Description |
|---|---|
| appointopia[.]com | Domain used for SEO poisoning that redirects to URL hxxps://grupotefex[.]com/forms-pubs/about-form-w-2/ |
| hxxps://grupotefex[.]com/forms-pubs/about-form-w-2/ | URL containing fake IRS website, luring users into trying to download W2 form |
| 85.208.108[.]63 | Domain hosting BST.msi |
| 193.32.177[.]192 | Domain hosting vpn.msi |
| 85.208.108[.]30 | Domain hosting neuro.msi |
| kurvabbr[.]pw | BruteRatel C2 – Payload contained within aclui.dll |
| barsen[.]monster | BruteRatel C2 – Payload contained within aclui.dll |
| barsman[.]biz | BruteRatel C2 – Payload contained within capisp.dll |
| bibidj[.]biz | BruteRatel C2 – Payload contained within capisp.dll |
| garunt[.]biz | BruteRatel C2 – Payload contained within capisp.dll |
| hxxps://meakdgahup[.]com/live/ | Latrodectus C2 |
| hxxps://riscoarchez[.]com/live/ | Latrodectus C2 |
| hxxps://jucemaster[.]space/live/ | Latrodectus C2 |
| hxxps://finjuiceer[.]com/live/ | Latrodectus C2 |
| hxxps://trymeakafr[.]com/live/ | Latrodectus C2 |
| Article | URL |
|---|---|
| Zscaler ThreatLabz Post | https://x.com/Threatlabz/status/1804918852528357791 |
| Latrodectus Affiliate Resumes Operations Using Brute Ratel C4 Post Operation Endgame | https://blog.reveng.ai/latrodectus-distribution-via-brc4/ |
Post Syndicated from jzb original https://lwn.net/Articles/983083/
Security updates have been issued by Fedora (ghostscript and xmedcon), Gentoo (Dmidecode, ExifTool, and Freenet), Red Hat (containernetworking-plugins, cups, edk2, httpd, httpd:2.4, kernel, kernel-rt, krb5, libreoffice, libuv, libvirt, linux-firmware, nghttp2, nodejs, openssh, python3, runc, thunderbird, and tpm2-tss), Slackware (aaa_glibc, bind, and mozilla), SUSE (postgresql14, python-sentry-sdk, and shadow), and Ubuntu (activemq, bind9, haproxy, nova, provd, python-zipp, squid, squid3, and tomcat).