• chevron_right

      How to cheat at Super Mario Maker and get away with it for years

      news.movim.eu / ArsTechnica · Thursday, 11 April - 10:45 · 1 minute

    Last month, the Super Mario Maker community was rocked by the shocking admission that the game's last uncleared level —an ultra-hard reflex test named "Trimming the Herbs" (TTH)—had been secretly created and uploaded using the assistance of automated, tool-assisted speedrun (TAS) techniques back in 2017. That admission didn't stop Super Mario Maker streamer Sanyx from finally pulling off a confirmed human-powered clear of the level last Friday, just days before Nintendo's final shutdown of the Wii U's online servers Sunday would have made that an impossibility.

    But while "Trimming the Herbs" itself was solved in the nick of time, the mystery of the level's creation remained at least partially unsolved. Before TTH creator Ahoyo admitted to his TAS exploit last month, the player community at large didn't think it was even possible to precisely automate such pre-recorded inputs on the Wii U.

    The first confirmed clear of Trimming the Herbs by a human.

    Now, speaking to Ars, Ahoyo has finally explained the console hacking that went into his clandestine TAS so many years ago and opened up about the physical and psychological motivations for the level's creation. He also discussed the remorse he feels over what ended up being a years-long fraud on the community, which is still struggling with frame-perfect input timing issues that seem inherent to the Wii U hardware.

    Read 33 remaining paragraphs | Comments

    • chevron_right

      Un agent SSH qui exploite la backdoor XZ

      news.movim.eu / Korben · Thursday, 11 April - 08:53 · 1 minute

    Si vous me lisez assidument, vous avez surement tout capté à la fameuse backdoor XZ découverte avec fracas la semaine dernière. Et là je viens de tomber sur un truc « rigolo » qui n’est ni plus ni moins qu’une implémentation de la technique d’exploitation de cette backdoor XZ, directement à l’intérieur d’un agent SSH.

    Pour rappel, un agent SSH (comme ssh-agent) est un programme qui tourne en arrière-plan et qui garde en mémoire les clés privées déchiffrées durant votre session. Son rôle est donc de fournir ces clés aux clients SSH quand ils en ont besoin pour s’authentifier, sans que vous ayez à retaper votre phrase de passe à chaque fois.

    Cet agent démoniaque s’appelle donc JiaTansSSHAgent , en hommage au cybercriminel qui a vérolé XZ, et ça implémente certaines fonctionnalités de la fameuse backdoor sshd XZ. En clair, ça vous permet de passer par cette backdoor en utilisant votre client SSH préféré.

    Ce truc va donc d’abord générer sa propre clé privée ed448 avec OpenSSL puis, il faudra patcher la liblzma.so avec la clé publique ed448 correspondante. Là encore, rien de bien méchant, c’est juste un petit script Python et enfin, dernière étape, faudra patcher votre client SSH pour qu’il ignore la vérification du certificat.

    Et voilà !

    Une fois que vous avez fait tout ça, vous pouvez vous connecter à cœur joie avec n’importe quel mot de passe sur n’importe quel serveur qui dispose de cette faille. Bon après, faut quand même faire gaffe hein, c’est pas un truc à utiliser n’importe comment non plus. Vous devez respecter la loi , et expérimenter cela uniquement sur votre propre matériel ou avec l’autorisation de votre client si vous êtes par exemple dans le cadre d’une mission d’audit de sécurité. Tout autre utilisation vous enverra illico en prison, alors déconnez pas !

    Voilà les amis, vous savez tout sur JiaTansSSHAgent maintenant. Pour en savoir plus, rendez-vous sur le repo GitHub de JiaTanSSHAgent .

    • chevron_right

      Thousands of LG TVs exposed to the world. Here’s how to ensure yours isn’t one.

      news.movim.eu / ArsTechnica · Tuesday, 9 April - 19:12

    Thousands of LG TVs exposed to the world. Here’s how to ensure yours isn’t one.

    Enlarge (credit: Getty Images)

    As many as 91,000 LG TVs face the risk of being commandeered unless they receive a just-released security update patching four critical vulnerabilities discovered late last year.

    The vulnerabilities are found in four LG TV models that collectively comprise slightly more than 88,000 units around the world, according to results returned by the Shodan search engine for Internet-connected devices. The vast majority of those units are located in South Korea, followed by Hong Kong, the US, Sweden, and Finland. The models are:

    • LG43UM7000PLA running webOS 4.9.7 - 5.30.40
    • OLED55CXPUA running webOS 5.5.0 - 04.50.51
    • OLED48C1PUB running webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50
    • OLED55A23LA running webOS 7.3.1-43 (mullet-mebin) - 03.33.85

    Starting Wednesday, updates are available through these devices’ settings menu.

    Read 9 remaining paragraphs | Comments

    • chevron_right

      China will use AI to disrupt elections in the US, South Korea and India, Microsoft warns

      news.movim.eu / TheGuardian · Friday, 5 April - 04:00

    Beijing did a test run in Taiwan using AI-generated content to influence voters away from a pro-sovereignty candidate

    China will attempt to disrupt elections in the US, South Korea and India this year with artificial intelligence-generated content after making a dry run with the presidential poll in Taiwan, Microsoft has warned.

    The US tech firm said it expected Chinese state-backed cyber groups to target high-profile elections in 2024, with North Korea also involved, according to a report by the company’s threat intelligence team published on Friday.

    Continue reading...
    • chevron_right

      How to hack the Jacksonville Jaguars’ jumbotron (and end up in jail for 220 years)

      news.movim.eu / ArsTechnica · Wednesday, 3 April - 20:26

    Three examples of the video screen tampering.

    Enlarge / Three examples of the video screen tampering. (credit: US DOJ)

    Was someone messing with the Jacksonville Jaguars' giant jumbotron ?

    On September 16, 2018, the Jaguars were playing the New England Patriots when the in-stadium screen experienced, in the US government's words, "a loss in reference sync which manifested as a large horizontal green lines [sic] appearing across one whole video board."

    On November 18, during a game against the Pittsburgh Steelers, it happened again—but this time, entire video sub-boards filled with green.

    Read 25 remaining paragraphs | Comments

    • chevron_right

      At least a dozen Westminster insiders targeted in Whatsapp phishing attack

      news.movim.eu / TheGuardian · Wednesday, 3 April - 17:56

    Politicians, including a minister, advisers and journalists received potentially compromising messages over six-month period

    More than a dozen politicians, advisers and journalists have been targeted in a phishing attack, in what cybersecurity experts believe is an attempt to compromise them.

    Twelve men working in Westminster, including a serving government minister, told Politico they had received unsolicited WhatsApp messages from two suspicious mobile numbers in the past six months.

    Continue reading...
    • chevron_right

      Missouri county declares state of emergency amid suspected ransomware attack

      news.movim.eu / ArsTechnica · Tuesday, 2 April - 23:59

    Downtown Kansas City, Missouri, which is part of Jackson County.

    Enlarge / Downtown Kansas City, Missouri, which is part of Jackson County. (credit: Eric Rogers )

    Jackson County, Missouri, has declared a state of emergency and closed key offices indefinitely as it responds to what officials believe is a ransomware attack that has made some of its IT systems inoperable.

    "Jackson County has identified significant disruptions within its IT systems, potentially attributable to a ransomware attack," officials wrote Tuesday . "Early indications suggest operational inconsistencies across its digital infrastructure and certain systems have been rendered inoperative while others continue to function as normal."

    The systems confirmed inoperable include tax and online property payments, issuance of marriage licenses, and inmate searches. In response, the Assessment, Collection and Recorder of Deeds offices at all county locations are closed until further notice.

    Read 10 remaining paragraphs | Comments

    • chevron_right

      Western governments struggle to coordinate response to Chinese hacking

      news.movim.eu / TheGuardian · Friday, 29 March - 04:30

    Experts say UK-imposed sanctions will make no difference when hacking is part of ecosystem of dealing with Beijing

    With the announcement that the UK government would be imposing sanctions on two individuals and one entity accused of targeting – without success – UK parliamentarians in cyber-attacks in 2021 , the phrase “tip of the iceberg” comes to mind. But that would underestimate the iceberg.

    James Cleverly, the home secretary, said the sanctions were a sign that “targeting our elected representatives and electoral processes will never go unchallenged”.

    Continue reading...
    • chevron_right

      Why didn’t New Zealand impose sanctions on China?

      news.movim.eu / TheGuardian · Thursday, 28 March - 02:02

    New Zealand did not follow the US and UK in imposing financial restrictions after accusing Beijing of links to cyber-attacks

    Politicians, journalists and critics of Beijing were among those targeted by cyber-attacks run by groups backed by China, western intelligence services said this week.

    The separate cyber-attacks hit the US, UK and New Zealand – all members of the Five Eyes alliance. The network of five countries, which also includes Canada and Australia, share security related intelligence.

    Continue reading...