AMD unveils exascale data-center accelerator at CES

January 14, 2023 No comments

The Consumer Electronics Show (CES) might be the last place you’d expect an enterprise product to debut, but AMD unveiled a new server accelerator among the slew of consumer CPUs and GPUs it launched at the Las Vegas show.

AMD took the wraps off its Instinct MI300 accelerator, and it’s a doozy.

The accelerated processing unit (APU) is a mix of 13 chiplets, including CPU cores, GPU cores, and high bandwidth memory (HBM). Tallied together, AMD's Instinct MI300 accelerator comes in at 146 billion transistors. For comparison, Intel’s ambitious Ponte Vecchio processor will be around 100 billion transistors, and Nvidia’s Hopper H100 GPU is a mere 80 billion transistors.

The Instinct MI300 has 24 Zen 4 CPU cores and six CDNA chiplets. CDNA is the data center version of AMD's RDNA consumer graphics technology. AMD has not said how many GPU cores per chiplet there are. Rounding off the Instinct MI300 is 128MB of HBM3 memory stacked in a 3D design.

The 3D design allows for tremendous data throughput between the CPU, GPU and memory dies. Data doesn’t need to go from the CPU or GPU to DRAM; it goes out to the HBM stack, drastically reducing latency. It also allows the CPU and GPU to work on the same data in memory simultaneously, which speeds up processing.

AMD CEO Lisa Su announced the chip at the end of her 90-minute CES keynote, saying MI300 is “the first chip that brings together a CPU, GPU, and memory into a single integrated design. What this allows us to do is share system resources for the memory and IO, and it results in a significant increase in performance and efficiency as well as [being] much easier to program.”

Su said the MI300 delivers eight times the AI performance and five times the performance per watt of the Instinct MI250. She mentioned the much-hyped AI chatbot ChatGPT and noted it takes months to train the models; the MI300 will cut the training time from months to weeks, which could save millions of dollars on electricity, Su said.

Mind you, AMD's MI250 is an impressive piece of silicon, used in the first exascale supercomputer, Frontier, at the Oak Ridge National Lab.

AMD's MI300 chip is similar to what Intel is doing with Falcon Shores, due in 2024, and Nvidia is doing with its Grace Hopper Superchip, due later this year. Su said the chip is in the labs now and sampling to select customers, with a launch expected in the second half of the year.

New AI accelerator on tap from AMD

The Instinct isn't the only enterprise announcement at CES. Su also introduced the Alveo V70 AI inference accelerator. Alveo is part of the Xilinx FPGA line AMD acquired last year, and it's built with AMD’s XDNA AI engine technology. It can deliver 400 million AI operations per second on a variety of AI models, including video analytics and customer recommendation engines, according to AMD.

Su said that in video analytics, the Alveo V70 delivers 70% more street coverage for smart-city applications, 72% more hospital bed coverage for patient monitoring, and 80% more checkout lane coverage in a smart retail store than the competition, but she didn’t say what the competition is.

All of this is within a 75-watt power envelope and a small form factor. AMD is going to take pre-orders for the V70 cards today, with availability this spring.

Next read this:

Adblock test (Why?)

You may be interested in:
>> Is a Chromebook worth replacing a Windows laptop?
>> Find out in detail the outstanding features of Google Pixel 4a
>> Top 7 best earbuds you should not miss

Related Posts:
>> Recognizing 12 Basic Body Shapes To Choose Better Clothes
>>Ranking the 10 most used smart technology devices
>> Top 5+ Best E-readers: Compact & Convenient Pen

SEC Saved Coinbase From The Fate That Befell Voyager, Celsius, BlockFi, and Gemini

December 31, 2022 No comments

The crypto industry’s biggest secret - the Shadow Banking System, where cryptocurrencies worth billions of dollars are borrowed & lent on an un-collateralized basis, between some of the industry’s biggest names, was exposed in recent months as the biggest driver of the spectacular bull market... as well the collapse & contagion that is still ongoing.

While the crypto shadow banks are going through their most difficult moments, it was the Securities and Exchange Commission’s (SEC’s) decision to declare a lending program an unregistered security offering might have unintentionally saved Coinbase from the same deadly blow that struck BlockFi, Celsius, Voyager, Gemini, and many others.

Crypto shadow banks are companies that engage in bank-like activities such as borrowing & lending but obviously are not licensed banks, hence fall outside the regulatory constraints of fully licensed banks, which are required to have capital reserves to cover losses from bad loans or available liquidity in case of a bank run.

With the promise of “Less risk than a bank with better returns for customers.”, crypto shadow banks such as Celsius, BlockFi, Voyager & Gemini managed to attract billions of AUM from professional and retail investors, which got lent out further to the world’s biggest crypto whales, the likes of 3AC and Alameda Research.

In the midst of the 2021 bull market, the crypto industry’s second biggest player had its own plans to launch a lending program, namely Coinbase Lend.

While the details of Coinbase’s Lend program are no longer publicly available, I found out that the program would work by “matching lenders of the USDC stablecoin with qualified borrowers” and that “Coinbase would guarantee the principal creditors lend out”.

It is unclear whether Coinbase would match borrowers to lenders directly or simply create a pool out of which they could undertake lending activities.

While the semantics of Coinbase’s wording is of less importance for this story, the playbook was meant to be similar to that of the largest crypto shadow banks; borrow cryptos worth billions of dollars from clients already onboarded with Coinbase and lend out in the Shadow Debt Market to worlds largest proprietary trading firms, hedge funds, and market makers.

The details of Coinbase’s Lend program caught the attention of the SEC, and the US regulator reacted fiercely & aggressively by threatening to sue Coinbase if the program was launched.

Coinbase Lend program was immediately scrapped, with Coinbase noting SEC’s “unfair treatment” since many other crypto shadow banks were engaging in those same lucrative borrowing & lending activities.

The rest is now history.

SEC’s decision unintentionally saved Coinbase from the same catastrophic fate that struck BlockFi, Celsius, Voyager, Gemini, and many more - the collapse of Terra/LUNA, the blow-up of 3AC, the fiasco of FTX & Alameda Research, and the ongoing contagion.

In retrospect, it’s easy for crypto critics & skeptics to point fingers at crypto companies or praise regulators around the globe, but very few people understand the plumbing & infrastructure of the crypto ecosystem, with crypto shadow banking as the biggest mystery of them all.

My goal is to provide insider insights into the secretive workings and shed light to strengthen our industry which will be the backbone of infrastructure for the world's growth in the coming decades.

L O A D I N G
. . . comments & more!

Adblock test (Why?)

EarSpy – A New Attack on Android Devices Use Motion Sensors to Steal Sensitive Data

December 30, 2022 No comments

There has been a new eavesdropping attack developed by a team of security experts for Android devices which has been dubbed “EarSpy.” With the help of this attack, attackers can detect the following things:-

Caller’s gender
Caller’s identity to various degrees
Speech content

As part of its exploratory purpose, EarSpy aims to capture motion sensor data readings generated by the reverberations from the ear speaker in mobile devices in order to create new methods of eavesdropping.

Universities Involved in this Project

Cybersecurity researchers from five American universities have undertaken this academic project called EarSpy. These are all the names of the universities that are affiliated with this project:-

Texas A&M University
New Jersey Institute of Technology
Temple University
University of Dayton
Rutgers University

Evolution of Smartphone Tech

Smartphone loudspeakers have been explored as a potential target for such attacks. As a result of this, the ear speakers are incapable of generating enough vibration to allow eavesdropping to be executed properly for the side-channel attack.

While the audio quality and vibrations of modern smartphones have improved greatly as a result of more powerful stereo speakers.

Even the tiniest resonance from a speaker can be measured by a modern device because it has more sensitive motion sensors and gyroscopes.

It is remarkable how little data is recorded on the spectrogram from the earphones of a 2016 OnePlus 3T, while a stereo ear speaker on the 2019 OnePlus 7T produces a significant amount of information.

As part of their experiments, the researchers used a OnePlus 7T device as well as a OnePlus 9 device. Both of these devices were used by the researchers to play pre-recorded audio through their ear speakers only using a variety of pre-recorded audio sets.

Although the results of the tests varied according to the dataset and device, they indicated that eavesdropping via ear speakers can be accomplished successfully.

Detection Performance

Based on the features in the time/frequency domain of the ML algorithm, the detection performance for the OnePlus 7T device has been tested, and here below we have mentioned the output chart:-

Apart from the OnePlus 7T, the detection performance of the OnePlus 9 has been also assessed on the basis of the features in the time/frequency domain of the machine learning algorithm. And here below is the complete result chart:-

Recommendation

EarSpy’s effectiveness could be reduced by a factor, and it’s the “Volume” that users select for their ear speakers. It is also more comfortable for the ear to hear if the volume is lower; this could minimize the possibility of eavesdropping through this side-channel attack.

Additionally, the way in which the hardware components are arranged and the tightness with which the assembly is put together have an impact on how well the reverberations from the speakers are diffused.

It was found that the capture of digits spoken in a phone call with the highest accuracy was up to 56% when it came to actual speech. However, during a telephone conversation, the researchers recommend that manufacturers ensure that sound pressure remains constant and stable.

Managed DDoS Attack Protection for Applications – Download Free Guide

Adblock test (Why?)

Building a Relationship with your Fans will Mean Support, Even When Things are Tough

December 30, 2022 No comments

Accomplishment without assistance is the stuff of legends. Every success story I’ve interviewed over the years needed help at one point or another. Whether that was a loan, an internship, or just a shoulder to cry on, it was a necessary step along the way.

A group of people with similar goals and values can be a powerful thing, providing accountability, collaboration, and a sense of camaraderie. When it comes to content creation, not only can you learn from your fellow creators – you can teach them too.

Recently on the Success Story Podcast, I spoke with Sophie Watts, Executive Chair at Metacurio, about how she cultivated success by working with and learning from others.

[embedded content]

The artist and their art

Let’s first start with your idea. What do you want to do? What do you want to create?

There are many things to consider when you’re first starting. But, the most important thing is that you have a clear and concise idea of what you want to do. This will help you immensely when it comes time to start creating content.

When you’ve come up with that brilliant idea – the one that keeps you up at night and dominates every moment of the day – you’ll need to find a target market. Without one, you won’t know what kind of language to use, what topics to focus on, or how to present your information.

If you’re not sure who your target audience is, that’s okay!

Take some time to research your topic and see who is talking about it online. Once you have a good understanding of who your target audience is, you can start creating content that appeals to them.

Social networking

One of the earliest things Sophie touched on in our discussion was when she first learned of Facebook’s potential for creators. She reflected on her first experiments into its global reach and knew, then, that it would change everything.

Today, new social media platforms and networks are popping up every day. You might understand how YouTube works, but what about Snapchat? Greenroom? Clubhouse? Foxhole? Okay, I made that last one up.

It can be easy to get overwhelmed by the different platforms and strategies, but if you want to succeed as a content creator, you’ll have to start somewhere.

The first step is identifying what kind of content you want to create. This could be anything from videos and podcasts to articles and blog posts. Once you know the kind of content you’ll be creating, it's time to start thinking about your audience.

Who are you trying to reach? What kind of people are you hoping to connect with?

Answering these questions will help guide the rest of your content creation process. From there, it's time to start thinking about platforms. Which social media platforms are most popular with your target audience? Where do they spend the most time online?

There isn’t an answer key at the back of the book here. The answers to these questions will be unique to what you’re trying to do. But once you've selected a few platforms to focus on, the real work – and the fun – begins.

The fans

Consistent release schedule! Insert yourself into the conversation! Show your personality!

There’s one thing that all of these community-building guides seem to overlook: the fans. Supporters, readers, viewers, listeners – whatever you want to call them.

The people who will be consuming your content are the most critical part of the equation. Not your thumbnail, not your soundtrack, not your partnerships. Your fans.

Without an audience, your content is worthless. So before you start creating, take some time to understand who your fans are and what they want.

Here are some questions to consider when you're cultivating a fanbase:

What does your target audience love?

What kind of content will they search out?

How can you make them fanatics?

As Sophie and I discussed, the platform that helps you engage with your friends is part of the formula. What determines your success as a creator is a connection between you and your fans. It doesn’t matter how your fans take in your content, but how they feel about your content.

When it comes to criticism, the fans are the ones who will tell you what works and what doesn't. They're also the ones who will support you when you're struggling. If you want to be successful in content creation, you need to listen to your fans and take their feedback seriously – not just their viewership.

Fan criticism, however, is not your only resource for improvement.

Your community

Sophie’s defining success has not just been working with A-List celebrities but the talented teams around them. They are responsible for marketing projects, engaging with the community, and, most importantly, helping visionaries realize their dream without losing their unique spark.

A supportive, enthusiastic support system can be the difference between success and failure in content creation. Engaging with others in your field and being open to feedback can help you hone your skills and produce better work.

Additionally, a strong community can provide encouragement and motivation when you’re feeling doubtful or burnt out.

Content creators that have found success often attribute much of it to the supportive communities they’ve been lucky enough to find. The trick is how to find them.

Social media has played a critical role in the growth of content-creator communities. Platforms like YouTube and Instagram provide a space for people with similar interests to connect and share their work.

But traditional social media – Twitter, Facebook, and the like – aren’t the only places where communities of content creators form. There are also online forums, like Reddit, where people can discuss their work and give feedback. These spaces provide a sense of belonging for creators who might otherwise feel isolated.

Of course, not everyone wants to be part of a community. Some prefer to work alone and don’t need social interaction. While there are certainly ways to make that work, I think criticism and comments are the whetstones of content – they keep it sharp.

If you’re pursuing content creation as a career, or even just looking to improve your skills, consider seeking out or building a supportive community. The positive effects can be immeasurable.

Your wisdom

Across Sophie’s career, whether coaching A-List celebrities or visualizing success for her own companies, she knew what she was doing. She knew her skills and wisdom were of benefit to the people she worked with.

What I’m saying, then, is this: learn from others, always. But you have something to offer too.

Sharing your experience is one of the most rewarding things you can do in content creation. Your passion and goals can inspire and help others reach their potential.

What made you successful can be a great source of content in itself. Share what worked for you, and how you overcame challenges. This type of content can be both motivating and helpful for your audience.

If you’re not sure where to start, try telling your story. What led you to content creation? What drives you to be successful? Everyone wants to hear a success story (shameless plug, confirmed).

Wrapping up

Engaging with your community should be right up front in terms of priority. Get to know the people who follow you and show that you care about more than just promoting yourself and your work. Building a relationship with your fans will mean support, even when things are tough.

I know I poked fun at the consistency thing, but it shouldn’t be forgotten. It's not enough to create great content once in a while - you need to release high-quality material if you want people to keep coming back for more – even when life tries to get in the way.

So talk to me! Leave a comment, let me know about your new project, or tell me why you don’t like mine.

Let’s sharpen that content.

L O A D I N G
. . . comments & more!

Adblock test (Why?)

The Cybersecurity Writing Contest: Final Round Results Announced!

December 29, 2022 No comments

Hackers, Assemble! The final round’s results announcement of the Cybersecurity Writing Contest by Twingate & HackerNoon are now live!

This contest is one of the most happening contests to date. The numbers speak for themselves:

We published total of 364 stories during the contest (the acceptance rate at HackerNoon is almost 50%)!
Total reads generated was > ONE MILLION (1,069,876 to be exact)
Total reading time generated so far: 4 months, 25 days, & 16 hours

The success of this contest is because of the whole HackerNoon community! Shoutout to our super-dope 35k+ contributors and millions of awesome readers!

As usual, we picked all the stories tagged with the #cybersecurity tag on HackerNoon, published in November 2022. Then we chose the top stories using 60:30:10 weightage respectively to:

Number of hours read
The number of people reached
The freshness of the content

The Cybersecurity Writing Contest: Nominations and Winners:

Now let’s see who won 👀

FIRST place goes to

One only has to look at the top influencers on Instagram or TikTok to see how a group could be easily persuaded to buy the next cool gadget. An exploit that you can plug into your computer, like USB-based plasma balls, fans, Mini-fridge, coffee warmers, LEDs, or even a charging cable.

Well deserved, @fatman. You have won $600!

In SECOND place, we have

On November 22, 1987, Chicago sports commentator Dan Roan covered the best moments of an American football game between the Chicago Bears and the Detroit Lions. It was a regular newscast following the evening news on local WGN-TV, of which Roan hosted several hundred.

At 9:14 p.m., the reporter disappeared from the TV screens.

Congratulations @strateh76, on securing second place! You won 300 USD!

The third position and most-read story award goes to

Since almost every web application accesses a database or uses some APIs to communicate with, these credentials must be passed to the application. If this is done using the .env file, the credentials are in plain text in this file. When the web server is misconfigured and this .env file is delivered by the web server, anyone can query this data. To do this, one can visit just a URL with a browser, such as: https://example.com/.env.

The dangerous aspect is that the passwords and secrets are in unencrypted form in the .env file.

Excellent story, @sdcat; you have won $200!

Let’s wrap up the announcement! We will contact the winners shortly. Keep an eye on contests.hackernoon.com to see the current and upcoming writing contests!

L O A D I N G
. . . comments & more!

Adblock test (Why?)

How I Made Programming Flashcards A Thing

December 27, 2022 No comments

Three years ago, one cold evening, I began to think that just programming and occasionally writing about it was not enough for me. I wanted to find an idea for a new project that would combine my two main passions: programming and writing about programming. I've been working as a programmer on a daily basis for sixteen years.

So I wanted something new. But it's hard to find anything new to do. Lots of people run programming blogs, write articles, create courses, write books. I only knew one thing. If I'm going to do something, it has to be unique and give a new perspective on writing applications. Something that builds fascination for programming and attracts people who don't necessarily think about it, but have features that are able to introduce new value to a very square industry. Something like flashcards.

I know what you thought. It is better to write applications on a piece of whitespace in a jute sweatshirt than to use flashcards. This is how I came up with the craziest idea in my life and decided to commercialize it.

This is the story of how I managed the product and optimized the customer experience to occupy the niche of post-apocalyptic sci-fi flashcards for developers that are also a game. A niche that I have occupied before everyone else!

Don't get me wrong, it's great that there are so many ways to learn programming. However, many people get lost in all this. Should I learn through a course, go to a bootcamp or buy a book? What language to learn? Everyone responds differently. If you add to this the authors of texts and courses who pour water instead of writing specifically and clearly, entering the world of programming seems very chaotic and difficult.

That's why I found flashcards attractive, as opposed to the trend that discourages programming. You can fit very little information on a flashcard. However, this is still not interesting enough to reach for the flashcards. That's why I enriched them with sci-fi fantasy illustrations. In this way, they are beautiful and evoke Stoneheart or Magic The Gathering. Just look at this beautiful card:

I also enriched the cards with a game mode. The game mode is tricky because anyone can play Summon The JSON. Up to four players can play with one deck. So you can play with people and trick them into programming. Which, you have to admit, is a great career path.

This is how the idea for Summon The JSON was born, which I have been implementing for four years. I have flashcards for C#, C++, Python, Java, JavaScript, Git, React, PHP, TypeScript and HTML. Take a look at this mashup, aren’t they lovely?

You can of course buy them now on my Shopify store available here: Programming Flashcards.

However, I encourage you to read on because I'm here to tell you how I analyze project data and make decisions. Because you probably also have a cool idea for a project and need help with growth hacking.

Gathering information about your prospects is probably the most important thing if you want to sell stuff and make money. Over these three years I have learned that I don’t know anything about my customers often.

But I think that's great, because that's what this community listening thing is all about. At every stage, starting from the idea, I ask the community of developers for their opinions and ideas.

Very often what I think in my head differs from what others think. Let me give you an example:

Each deck contains five cards that are blank. I wanted customers to be able to supplement them with their own functions and even points and superpowers. However, it turned out that customers did not understand this. Once a customer even wanted to return the cards because she thought there had been an error in the printing house.

I often observe programmers and designers that they treat such cases with pity. Which is completely wrong, because it is the user who knows best how he perceives and experiences the application. Same as flashcards and anything else.

That's why I added a clear description to the cards that explains their meaning. What we imagine about people in our heads has nothing to do with reality. Only feedback verifies it. That's why I love asking for opinions. This is not only a way to improve the product, but also growth marketing. Because people can see that you really care about their opinion. Here is an example of such a card:

Now I'm going to write something controversial. This may prevent me from winning the competition for an article on growth marketing, for which I submitted this article. But I want to be honest with you. I don't think it's a good idea to use stats from the start.

My shop on Shopify gives me information about how many people visited the website, how many added the product to the cart, how many people bought the product. Google Analytics will tell you where your customers come from in aggregate, whether they come back.

The mParticle service, which sponsors this competition, combines data from various sources and, thanks to AI, extracts information from the data that will allow you to improve the customer experience. However, I believe that you should base your decisions on direct input from users in the beginning.

This is especially important when you have a lot of work ahead of you and little motivation. Setting up Shopify, preparing the products took three years in my case. Feedback from live users was something that allowed me to continue working on this project.

I started using statistics and analytics only on the way to verify my hypotheses and check whether the sales process was going well.

For example, thanks to this I know that it is better to offer free shipping instead of having to pay for it directly. Or that it's good to have a lot of payment methods and delivery and production.

What I like about mParticle is that it can tell you what promotion or coupon to create. He can also estimate how much it will increase profits.

An open secret that I discovered not so long ago is that people love promotions and coupons. Professional stores offer them non-stop. Thanks to this, their offer looks fresh, even if they offer the same thing all the time.

For years, I loved looking at all kinds of statistics. I still like it. However, it seems to me that the most important thing in selling is the product.

It is worth improving it, adding new products. Campaigns, analytics, store optimization are the things that draw me in as a programmer. However, sometimes it is worth going back to the products and improving them as well.

If you develop the product yourself after hours, I can tell you right away that you will not be able to deal with everything at once. For example, I spent the last 3 years developing products, learning Blender to create product renders, and creating a shop on Shopify. While supporting sales.

I've only recently started working on analytics, ad campaigns and experience optimization. This is a separate job that will consume my time for the next few months. In such a situation, you want to choose solutions that will save you problems and time. That's why, for example, I chose Shopify, Google Analytics, and other apps. I don't write everything from scratch, although I could.

For growth marketing I recommend you to:

find a niche
gather feedback
share and improve your offering
use technology
allocate time wisely

The final tip is to share your story. I just gave this advice by example, because the beginning of the article shows just that. If you've read this far, it means it worked :)

If you like the article please vote for it, share and like. Cheers!

L O A D I N G
. . . comments & more!

Adblock test (Why?)

Hackers Using Automated Attack to Exploit Exchange Server and SQL Injection Vulnerabilities

December 26, 2022 No comments

Recently, cybersecurity analysts at Prodraft’s threat intelligence team detected that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:-

Infiltrate corporate networks in order to steal information.
Data theft.
Adaptive ransomware attacks based on the financial size of the networks.

For years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7’s behind-the-scenes:-

The hierarchy at the internal level.
Affiliations with a variety of ransomware projects.
A new SSH backdoor system.

Attack Modes and Auto-attacking

FIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial.

A number of attacks have been linked to this threat group including:-

Attacks on ATMs.
The use of teddy bears to conceal malware-carrying USB drives.
Hiring pentesters to analyze ransomware attacks by setting up a false cybersecurity firm.

There is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-

Since June 2021 it’s actively using Checkmarks for finding the corporate networks’ vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.

As part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.

There are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.

Following the scanning of over 1.8 million targets with FIN7’s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States.

Communications With the C&C Server

Apart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-

Darkside
REvil
LockBit

There is one particular detail that is noteworthy in these logs is that FIN7 is fond of keeping an SSH backdoor on the networks of victims who have been extorted by ransomware, even after paying the demanded ransom.

While this might be done to sell access to other groups or to test a new attack in the future. As part of FIN7’s arsenal of backdoors, this SSH backdoor is an entirely new sophisticated addition.

As a part of the FIN7 group, Checkmarks is one of the sophisticated platforms that demonstrates just how easy it will be for threat actors to take advantage of public exploits to perform wide-scale attacks that could impact the entire world.

Further, with the help of this type of platform threat actors are also actively industrializing public exploits.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Adblock test (Why?)

OFRAK - Unpack, Modify, And Repack Binaries

December 25, 2022 No comments

OFRAK (Open Firmware Reverse Analysis Konsole) is a binary analysis and modification platform. OFRAK combines the ability to:

Identify and Unpack many binary formats
Analyze unpacked binaries with field-tested reverse engineering tools
Modify and Repack binaries with powerful patching strategies

OFRAK supports a range of embedded firmware file formats beyond userspace executables, including:

Compressed filesystems
Compressed & checksummed firmware
Bootloaders
RTOS/OS kernels

OFRAK equips users with:

A Graphical User Interface (GUI) for interactive exploration and visualization of binaries
A Python API for readable and reproducible scripts that can be applied to entire classes of binaries, rather than just one specific binary
Recursive identification, unpacking, and repacking of many file formats, from ELF executables, to filesystem archives, to compressed and checksummed firmware formats
Built-in, extensible integration with powerful analysis backends (angr, Binary Ninja, Ghidra, IDA Pro)
Extensibility by design via a common interface to easily write additional OFRAK components and add support for a new file format or binary patching operation

See ofrak.com for more details.

GUI Frontend

The web-based GUI view provides a navigable resource tree. For the selected resource, it also provides: metadata, hex or text navigation, and a mini map sidebar for quickly navigating by entropy, byteclass, or magnitude. The GUI also allows for actions normally available through the Python API like commenting, unpacking, analyzing, modifying and packing resources.

Getting Started

OFRAK uses Git LFS. This means that you must have Git LFS installed before you clone the repository! Install Git LFS by following the instructions here. If you accidentally cloned the repository before installing Git LFS, cd into the repository and run git lfs pull.

See docs/environment-setup for detailed instructions on how to install OFRAK.

Documentation

OFRAK has general documentation and API documentation. Both can be viewed at ofrak.com/docs.

If you wish to make changes to the documentation or serve it yourself, follow the directions in docs/README.md.

License

The code in this repository comes with an OFRAK Community License, which is intended for educational uses, personal development, or just having fun.

Users interested in OFRAK for commercial purposes can request the Pro License, which for a limited period is available for a free 6-month trial. See OFRAK Licensing for more information.

Contributing

Red Balloon Security is excited for security researchers and developers to contribute to this repository.

For details, please see our contributor guide and the Python development guide.

Support

Please contact [email protected], or write to us on the OFRAK Slack with any questions or issues regarding OFRAK. We look forward to getting your feedback! Sign up for the OFRAK Mailing List to receive monthly updates about OFRAK code improvements and new features.

This material is based in part upon work supported by the DARPA under Contract No. N66001-20-C-4032. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the DARPA. Distribution Statement “A” (Approved for Public Release, Distribution Unlimited).

Adblock test (Why?)

OWASSRF – New Exploit Let Attacker Execute Remote Code on Microsoft Exchange Server

December 22, 2022 No comments

There is a new exploit chain dubbed, OWASSRF that threat actors are actively exploiting to gain arbitrary code execution through Outlook Web Access (OWA) on vulnerable servers that bypasses ProxyNotShell URL rewrite mitigations.

A recent investigation by CrowdStrike Services found that Microsoft Exchange ProxyNotShell vulnerabilities are probably enabled the common entry vector for several Play ransomware intrusions:-

The relevant logs were reviewed by CrowdStrike and no evidence of initial access exploiting CVE-2022-41040 was found.

ProxyNotShell and Exchange Architecture Primer

There are two major components that make up a Microsoft Exchange server:-

The frontend
The backend

All client connections are handled by the frontend, which proxies any given request to the backend according to the request. Here in this scenario the specific requests made to the frontend, like URLs, are dealt with by backend services.

A ProxyNotShell attack targets the Remote PowerShell service, which in this case is the backend service that is targeted. It is known this kind of vulnerability is referred to as an SSRF (Server-Side Request Forgery) vulnerability.

The CVE-2022-41082 vulnerability has been exploited by ransomware operators in order to execute arbitrary commands on compromised servers using Remote PowerShell.

OWASSRF PoC exploit leak

POC code for an exploit method based on Play ransomware logging was currently under development by CrowdStrike security researchers.

A recent discovery has shown that an attacker has downloaded all of the tools from an open repository, uploaded them in a MegaUpload link, and made them accessible to the public via the Twitter site.

CrowdStrike researchers replicated the log files generated in recent Play ransomware attacks using a Python script from the leaked toolkit, named poc.py, that was included in the leaked toolkit.

Recommendations from CrowdStrike

Here below we have mentioned all the recommendations offered by CrowdStrike:-

Since the URL rewrite mitigations for ProxyNotShell do not function against this exploit method, organizations should apply the Exchange patches of November 8, 2022.
The KB5019758 patch should be applied as soon as possible, but if this cannot be done, then you should disable OWA until you are able to apply it.
Make sure to disable remote PowerShell for non-administrative users in accordance with Microsoft’s recommendations.
Implement the use of advanced endpoint detection and response (EDR) solutions on each and every endpoint.
Utilize the script developed by CrowdStrike Services to check for signs of exploitation on Exchange servers visible in IIS logs and Remote PowerShell logs.
Take into account application-level controls, such as firewalls for web applications, as well as system-level controls.
Ensure that the X-Forwarded-For header in the HTTP request has been configured to log the true IP address of the external proxy server.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Adblock test (Why?)

Hackers Use New BrasDex Android Malware to Steal Users’ Banking Details

December 21, 2022 No comments

A new Android trojan called BrasDex has been identified as the work of the same threat actors responsible for the Casbaneiro malware that targets Windows banking systems.

The security analysts at ThreatFabric recently spotted an ongoing multi-platform campaign in which Brazilian users have been observed to be targeted as part of this malware (BrasDex) attack.

Complicated Keylogging capabilities are built into BrasDex to exploit the Accessibility Services in an attempt to extract and acquire credentials specifically from:-

A set of Brazilian-targeted apps
A highly capable Automated Transfer System (ATS) engine

BrasDex Android Malware Stealing User Data

Casbaneiro is also being controlled via the C2 infrastructure that is being used in conjunction with BrasDex. Brazil and Mexico are the two countries that have also recently experienced the same problems with their banks and cryptocurrency services.

This malware has been active for over a year now and initially misrepresented itself as an Android setting application to specifically target Brazilian banking apps.

The various malware families have begun to abandon the use of overlays for a more lean and flexible solution, which does not require a continuous update or additional data to be downloaded, as they are more efficient.

It is becoming more and more common for malware families to incorporate accessibility logging into their malware designs in order to extract logging credentials and other personal information from victims infected by the malware.

ATS (Automated Transfer System) capabilities are one of the main reasons that make BrasDex stand out from many other malware families.

BrasDex Capabilities & Panel

Here below we have mentioned the capabilities of BrasDex:-

Keylogging
ATS

As ThreatFabric investigated this malware family, they were also able to get some visibility into the Panel hosted on the C2 server, which was an important discovery.

The panel contains multiple pages and other important information like:-

List of infected devices
List of service providers
List of the device models
List of the Android version
Logs obtained from the infected devices

Targets Attacked

Specifically focused on the Brazilian market, BrasDex is one of the most well-known malware families. In order for the malware to operate on Brazilian devices only, test checks are included in the malware itself.

It did this by performing a programmatic check on the SIM card used by the device to ascertain that its SIM is operating in Brazil, after which it complete all its desired operations and then configure the device properly.

However, the malware automatically shuts down and abandons all the communicating channels to its C2 server, if it detects that the SIM card on the device is from anywhere else.

There may be some unknown problem with the Pix payment system within the Brazilian banking ecosystem causing this hard dedication to a single market.

In 2020, Pix was introduced and has been one of the fastest payment systems ever created by the Brazil Central Bank. By knowing a user’s identifier, it is possible for a user to transfer payments to another user via Pix.

There is no doubt that BrasDex and Casbaneiro are two of the most dangerous malware families available today. A large number of Android and Windows users can be targeted in broad daylight by the actor behind them.

On the very first border of the transaction, there is an urgent need for an effective solution to detect suspicious behavior during the transaction as well as to identify the threats present on the device of the customer.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Adblock test (Why?)

How to Lose $13 of Users’ Funds (As a Blockchain Developer)

December 20, 2022 No comments

The gov says we are not in recession, but at the same time, we hear about skyrocketing inflation, interest rate increases, and layoffs in almost every sector of the economy.

Despite crypto and TradFi being impacted the most severely, many companies are still building their tokens, protocols, and DeFi products. Are you one of them?

Today, I will be speaking on data types, and hold on. I have something very important to say. You might picture me as a 60+-year-old professor from MIT torturing students with lectures about subjects that no longer matter. But that’s not true.

Data types are still important, and neglecting them leads to serious consequences. I will try to briefly go through all potential issues and address them so you don’t find the 8 minutes you spend on reading this article wasted.

Modern languages like JavaScript and Python are using “duck typing” to determine the type of variable. If we assign this sort of formula a = 2 + 2 to a variable, the language interpreter knows it is dealing with numbers, and it will perform mathematical operations on this literal.

The duck typing can be explained by this sentence: “If it walks like a duck and it quacks like a duck, then it must be a duck”. When you look closer into the meaning of it - it makes perfect sense. If literal has letters and numbers, it must be a string, and that’s clear. But what if it has numbers?

Is it a boolean, integer, decimal, float, or date. In most cases, your language interpreter will handle types in the correct way. The problem starts when your program needs to run (even simple) equations on large numbers.

“If it walks like a duck and it quacks like a duck, then it must be a duck”, right? Actually it’s not.

Ethereum Denominations in a Nutshell

In the next paragraphs, I am referring to Ethereum common denominations - wei and gwei. Let me briefly introduce you to them so we speak the common language.

The smallest denomination is 1 wei, and 1 ether equals 1,000,000,000,000,000,000 Wei (18 zeros). I repeat - 18 zeros. It is hard to wrap our minds around such large numbers but they make a difference and matter a lot.

The next common denomination is 1 gwei. 1 ether equals 1,000,000,000 gwei (9 zeros). Gwei is more bearable for humans - in the end, everybody wants to be a millionaire, right? (wink, wink)

Let’s sum it up - 1 ether equals:

1,000,000,000 gwei (9 zeros)
1,000,000,000,000,000,000 wei (18 zeros)

Technical note: Ethereum has two layers - the execution layer and the consensus layer. The execution layer is using wei to represent ether values, and the consensus layer is using gwei. If you are a blockchain developer, you need to learn to interact with both.

Real-World Example: Stakefish’ tip and MEV Pool

I am a software engineer at stakefish. I’m responsible for building our DeFi products palette, and one of the most recent ones is our tip and MEV pool for Ethereum.

Starting from September 15, 2022, all validators are eligible for transaction tips and can participate in MEVs to earn additional rewards. Transaction tips and MEVs are earned when the validator proposes a new block.

We decided to build a smart contract that collects all rewards into a common vault and allows user to claim their share from it. I am not trying to advertise our product, but I need to set the context of this article.

If you are more interested in this product, you can read more here. I’m not selling you anything besides my experience.

As I mentioned, we have a smart contract that receives transaction tips and MEV rewards earned by validators. It means our smart contract has a fairly large balance. It is 963+ ether now ($1.1M), and we have 8671 validators contributing to it.

The critical part responsible for synchronization between Ethereum execution and the consensus layer is Oracle. It is a very important system that allows us to determine what validators are contributing to the pool.

The oracle is written in Python, but it could be written in JavaScript - the problem remains unchanged, and I will prove it soon.

Let’s deep dive into the code!

Why Data Types Matter

The balance of the smart contract equals 963,135,554,442,603,402,422 wei (963 ether) now. This number isn’t only hard to understand for humans but also for computers (language interpreters to be exact). Let’s check JavaScript:

const vault_balance = parseInt("963135554442603402422")
console.log(vault_balance) 
// 963135554442603400000 (lost 2422 wei in total)

I only casted the balance from string to int, and I am already 2422 wei short. We didn’t run any equation yet.

The smart contract balance is so high thanks to many validators contributing to it. Now, let’s calculate what the average validator share of contract’s balance now:

const vault_balance = parseInt("963135554442603402422")
const validator_count = 8671

const avg_validator_contribution = vault_balance / validator_count
// 111075487768723730 (lost 7 wei per validator)

The average share is 0.111 ether. But this amount isn’t correct - we are actually 7 wei short. It is 60,697 wei in total (7 wei times 8671 validators). I will show the correct number later on.

Proceeding further down the rabbit hole of losses - let’s calculate the total amount of rewards per given validator. Have in mind that the user needed to deposit 32 ether to start a validator, so I will deduct it from the validator balance.

And I will take as an example one random validator contributing to the smart contract that has a balance of 32.779 ether.

const vault_balance = parseInt("963135554442603402422") // (lost 2422 wei)
const validator_count = 8671
const avg_validator_contribution = vault_balance / validator_count // (lost 7 wei)

const initial_deposit = parseInt("32000000000000000000")
const validator_balance = parseInt("32779333896000000000")

const total_validator_rewards = validator_balance - initial_deposit + avg_validator_contribution
// 890409383768723700 (lost 23 wei per validator)

The total rewards earned by this validator equals 0.8904 ether, but this value isn’t accurate as well. At this moment, we miscounted for 199,443 wei in total (23 wei times 8671 validator). As you can see, this way of calculating numbers isn’t sustainable.

What Goes Wrong?

There are two problems with the code above:

In JavaScript, the maximum safe value for integers equals 2^53 - 1 only. It means it can handle up to 9007199254740991 wei (0.009 ether)

Technically, we could have used BigInt but we would have problems with division. We would end up with “floating” values. The floats are the root of all evil in finance because they are approximate. It means they lose precision. We need to use decimals. (The main difference between decimal and float is that decimal stores exact value and float approximates.)

If you ever had done any Ethereum-related coding in JavaScript, you must’ve heard about ethers.js. This library contains all the necessary utilities to interact with the blockchain. To fix the issue above, we will use one of the tools called BigNumber that supports extremely large numbers and handles decimals in the right way.

Let’s do it!

const vault_balance = BigNumber.from("963135554442603402422") // no loss
const validator_count = BigNumber.from(8671)
const avg_validator_contribution = vault_balance.div(validator_count) // no loss
// 111075487768723723

const initial_deposit = BigNumber.from("32000000000000000000")
const validator_balance = BigNumber.from("32779333896000000000")

const total_validator_rewards = validator_balance.sub(initial_deposit).add(avg_validator_contribution)
// 890409383768723723

As you can see, now we ended up with the accurate number. How do I know this is actually the right number? I will repeat the same exercise in Python to prove that I’m right.

Let’s Try It in Python

Python supports long integers, so the values will not get suddenly cut as we have seen in JavaScript. Unfortunately, it still determines all floating numbers as floats by default:

vault_balance = int("963135554442603402422") # no loss
validator_count = 8671
avg_validator_contribution = vault_balance / validator_count
# 111075487768723728 (5 wei too much)

initial_deposit = int("32000000000000000000")
validator_balance = int("32779333896000000000")

total_validator_rewards = validator_balance - initial_deposit + avg_validator_contribution
# 890409383768723712 (lost 11 wei)

Wondering where exactly it lost precision? The division casted avg_validator_contribution to float instead of decimal. The correct snippet would look like that:

vault_balance = Decimal("963135554442603402422")
validator_count = Decimal(8671)
avg_validator_contribution = vault_balance / validator_count
# 111075487768723723

initial_deposit = Decimal("32000000000000000000")
validator_balance = Decimal("32779333896000000000")

total_validator_rewards = validator_balance - initial_deposit + avg_validator_contribution
# 890409383768723723

Now, the values returned by Python and JavaScript are exact. Check on your own!

These sorts of losses are marginal, and they can be easily missed. Often, we find out about them when they compound over time and grow to significant numbers.

Situations like that always give headaches, not only to developers but also to other departments such as finance or legal. You should always test your formulas, and never use nice round numbers to do so!

It would mean the world to me if you follow me on Twitter. I am focusing my activity on software engineering and blockchain. I am open-sourcing most of my work, so you might want to check my GitHub.

L O A D I N G
. . . comments & more!

Adblock test (Why?)

We Need an Open Internet, Web3 Has Been Reduced to a Marketing Term

December 19, 2022 No comments

This post is mainly intended as a comment on Jack Dorsey's push for a native internet protocol for social media. The so-called "Twitter Files" is a part of the story.

In general, I try to stay out of politics and report as neutrally as I can about technology's impact on society, and vice versa. However, Twitter Files have become a highly polarizing topic.

At the end of this piece, you can find excellent articles addressing them from independent journalists across the political spectrum.

Twitter Files and the political component of content moderation

Twitter Files are a series of "Twitter🧵" initiated by Elon Musk where three independent journalists - Matt Taibbi, Bari Weiss, and Michael Shellenberger - report on internal documents from the former Twitter administration. Overall, Twitter Files provide evidence of how content was moderated, stories were suppressed, and accounts were banned and shadow-banned according to either a left-leaning political agenda or by direct orders from the US government.

In regards to the political aspect, Twitter Files confirm accusations that US conservatives have made against Twitter for years. Jack Dorsey even admitted in 2018 that Twitter employees share a largely left-leaning bias although they were not instructed to act according to political ideology or viewpoints.

Critics could make a good case that Twitter under the new "Musk regime" is also biased. For example, a number of prominent journalists recently had their accounts temporarily suspended without any explanation. Matt Binder, one of the suspended journalists, wrote a piece about the incident here. As did Taylor Lorenz from Washington Post who was suspended this weekend here. The suspensions appear arbitrary, directed at journalists who have spoken disfavourably against Musk. When confronted with the fact, take a look at Musk's outlash here.

It sets a dangerous precedence when freedom of speech becomes politicized. Overall, I think Peter McCormack, host of "What Bitcoin Did", makes a good point:

While freedom of speech should in theory apply equally to everyone, content moderation is not completely neutral. Given a large enough sample size, there will always be edge cases that could be determined in either direction, and over time biases will show. In short, there is a political component to content moderation, while freedom of speech should apply equally to everyone. And as long as there is a central point of control or a "single point of failure" interference from governments and lobbyism is probably hard to avoid.

In the latest edition of Twitter Files, "Part Six TWITTER, THE FBI SUBSIDIARY", Matt Taibbi writes about how the former Twitter Trust and Safety Chief routinely acted upon requests from the FBI to take down content. This can hardly come as a surprise! To anyone just remotely familiar with the Snowden revelations or FISA Section 702 - which authorizes extensive surveillance of foreign citizens - Taibbi's post is a large nothingburger.

Jack Dorsey's push for open social media

Last Tuesday, Jack Dorsey published a blog post on the Twitter-affiliated newsletter platform Revue where he addresses the "Twitter Files" and suggests "how to fix the identified issues". Interestingly enough, Revue announced that they would shut down the platform just one day after Dorsey's post. Seems like a strange coincidence.

Dorsey starts by uplisting three principles he believes a social media platform should adhere to:

1.    Social media must be resilient to corporate and government control.

2.    Only the original author may remove content they produce

3.    Moderation is best implemented by algorithmic choice.

Twitter doesn't reflect these principles and Dorsey takes full responsibility for it:

This is my fault alone, as I completely gave up pushing for them when an activist entered our stock in 2020.

Here, Dorsey is likely referring to the hedge fund Elliott Management Corp. which bought a majority share in Twitter that year.

In regards to Dorsey's first principle - that social media must be resilient to corporate and government control - he writes:

Of course governments want to shape and control the public conversation, and will use every method at their disposal to do so, including the media. And the power a corporation wields to do the same is only growing. It's critical that the people have tools to resist this, and that those tools are ultimately owned by the people. Allowing a government or a few corporations to own the public conversation is a path towards centralized control.

Dorsey's second principle - that only the original author may remove content they produce - is controversial and probably hard to implement. At least from a legal standpoint. For example, Germany has passed a law that orders Facebook, Google, and Twitter to remove hate speech and "obviously illegal content" within 24 hours or face a fine of up to €50 Million.

Dorsey's third principle - that moderation is best implemented by algorithmic choice - is about giving user's more of a choice over what type of content they see. Users could be allowed to customize the filters of their algorithmic feeds, or alternatively choose between different "ranking providers". If you'd like to learn more see Stephen Wolfram's essay here.

As a whole, Dorsey's principles allude to more decentralization, censorship resistance, transparency, and user control on social media. These are all key properties of Bitcoin. Not a coincidence since Dorsey is a keen Bitcoin supporter. The Web3 movement strives for the same values but, intentionally or not, Dorsey refrains from using ubiquitous marketing terms such as Web3 or crypto.

Instead, Dorsey calls for a free and open protocol for social media and points to projects such as AT Protocol, Mastodon, and Matrix as competing candidates to become a standard like HTTP or SMTP.

Web3 Vs the Open Internet

The term "Web3" is often associated with new NFT collections and discounts on token sales. Crypto opportunists and salespeople want to jam it down our throats. However, in the wake of Twitter's Musk-induced existential crisis, there seems to be an organic push for a more open internet. Which is indeed the underlying philosophy of Web3. But the idea of a more open internet extends far beyond blockchain and crypto - although blockchain technology is likely a part of the solution. An open internet gives the user the power of choice between many different platforms, instead of complete dependency on a few, all-powerful ones.

Noah Smith writes in The internet wants to be fragmented:

People call Twitter an indispensable public space because it's the "town square", but in the real world, there isn't just one town square, because there isn't just one town. There are many. And the internet works when you can exit — when you can move to a different town if you don't like the mayor or the local culture.

It will be interesting to see to what extent Elon Musk's God complex and the divisiveness on Twitter will draw users toward other platforms. And if there will be a loud mass exodus at once, or if people will leave quietly through the backdoor over time like teens have done with Facebook. Either way, Twitter's competitors are eyeing an opportunity to capitalize on the chaos, and it seems like the thick shackles on people's attention and data are finally loosening up

Here are some excellent articles addressing "Twitter Files" from independent journalists across the political spectrum:

Mike Solana: The Fifth Estate

Abigail Shrier: Real Time Doxxing and the Littlest Musk

Matt Binder: Twitter has a freedom of speech problem and it's Elon Musk

Also published here.

L O A D I N G
. . . comments & more!

Adblock test (Why?)