Skip to main content

15 ransomware gangs ‘go dark’ to enjoy 'golden parachutes'

4 months 3 weeks ago
PLUS: China's Great Firewall springs a leak; FBI issues rare 'Flash Alert' of Salesforce attacks; $10m bounty for alleged Russian hacker; and more

Infosec In Brief  15 ransomware gangs, including Scattered Spider and Lapsus$, have announced that they are going dark, and say no more attacks will be carried out in their name.…

Iain Thomson

Tens of Thousands of US Emergency Workers Trained on How to Handle a Robotaxi

4 months 3 weeks ago
Last year Amazon's robotaxi service Zoox held a training session for 20 Las Vegas firefighters, police officers, and other first responders, reports the Washington Post, calling it "a new ritual for emergency workers across the country, as autonomous vehicles begin to spread beyond the handful of cities that served as initial testing grounds..." Questions that came up included: What can first responders do if the nearly 6,000-pound vehicle is blocking a roadway? (Better to pull, not push.) What happens if the vehicle loses its connectivity? (It's designed to pull over.) And can first responders manually shut off the vehicle? (Not yet, but Zoox is working on it....) The vehicles' operators claim they drive more safely than humans, but anything can happen on public roads, and first responders need to know how to intervene if a robotaxi is caught in a collision that traps passengers, catches fire or gets caught doing something that demands a traffic stop... Alphabet's Waymo, which has more than 2,000 vehicles completing hundreds of thousands of paid trips each week across San Francisco and Silicon Valley, Los Angeles, Phoenix, Austin and Atlanta, has trained more than 20,000 first responders in how to interact with its vehicles, the company said. Tesla didn't respond to a request for comment on how many first responders the company has trained, but a representative from the Austin Police Department confirmed that fire, police and transit workers were trained on the company's Robotaxi before the company launched commercial service in June. Tesla, Waymo and Zoox say their vehicles can detect the lights and sirens of emergency vehicles and automatically attempt to pull over. Waymo says its vehicles can interpret first responders' hand signals.... The first responders appeared excited about the potential of the company's artificial intelligence technology to ferry visitors up and down the Vegas Strip without concern that a driver might be inebriated. They were also wary of problems that might unfold: Autonomous vehicles are electric, and when electric vehicles catch fire, they're difficult to extinguish, the firefighters said. The first responders also worried that a secondary air bag deployment could injure an emergency responder, a common concern with conventional vehicles. And if a police officer wanted to view the footage a Zoox vehicle captured on the road, would the company be willing to share it? Turning over footage would require a subpoena, a Zoox official responded. But "those who've been through the trainings and have seen large-scale commercial rollouts say it's difficult to anticipate all the potential issues in a specific market," the article points out. Darius Luttropp, former deputy chief of operations for the San Francisco Fire Department, told the Post last year that Waymo vehicles had blocked city firefighters from leaving and entering firehouses, and also crashed into their equipment. Lt. William White of the Austin Police Department told the Post that more than once Waymo vehicles failed to recognize an officer on a motorcycle with their police lights activated.

Read more of this story at Slashdot.

EditorDavid

It's time mobile devs started to think seriously about foldable smartphones

4 months 3 weeks ago
The hardware is now compelling, sales are rising, and there's the chance to create a new experience

hands on  Folding smartphones have been with us for six years without winning much market share, but after two weeks using Samsung's latest model, and recent reports of surging sales in the category, it feels to me like dual-screened devices are something developers now need to consider.…

Simon Sharwood

Apple Claims 'Most Significant Upgrade to Memory Safety' in OS History

4 months 3 weeks ago
"There has never been a successful, widespread malware attack against iPhone," notes Apple's security blog, pointing out that "The only system-level iOS attacks we observe in the wild come from mercenary spyware... historically associated with state actors and [using] exploit chains that cost millions of dollars..." But they're doing something about it — this week announcing a new always-on memory-safety protection in the iPhone 17 lineup and iPhone Air (including the kernel and over 70 userland processes)... Known mercenary spyware chains used against iOS share a common denominator with those targeting Windows and Android: they exploit memory safety vulnerabilities, which are interchangeable, powerful, and exist throughout the industry... For Apple, improving memory safety is a broad effort that includes developing with safe languages and deploying mitigations at scale... Our analysis found that, when employed as a real-time defensive measure, the original Arm Memory Tagging Extension (MTE) release exhibited weaknesses that were unacceptable to us, and we worked with Arm to address these shortcomings in the new Enhanced Memory Tagging Extension (EMTE) specification, released in 2022. More importantly, our analysis showed that while EMTE had great potential as specified, a rigorous implementation with deep hardware and operating system support could be a breakthrough that produces an extraordinary new security mechanism.... Ultimately, we determined that to deliver truly best-in-class memory safety, we would carry out a massive engineering effort spanning all of Apple — including updates to Apple silicon, our operating systems, and our software frameworks. This effort, together with our highly successful secure memory allocator work, would transform MTE from a helpful debugging tool into a groundbreaking new security feature. Today we're introducing the culmination of this effort: Memory Integrity Enforcement (MIE), our comprehensive memory safety defense for Apple platforms. Memory Integrity Enforcement is built on the robust foundation provided by our secure memory allocators, coupled with Enhanced Memory Tagging Extension (EMTE) in synchronous mode, and supported by extensive Tag Confidentiality Enforcement policies. MIE is built right into Apple hardware and software in all models of iPhone 17 and iPhone Air and offers unparalleled, always-on memory safety protection for our key attack surfaces including the kernel, while maintaining the power and performance that users expect. In addition, we're making EMTE available to all Apple developers in Xcode as part of the new Enhanced Security feature that we released earlier this year during WWDC... Based on our evaluations pitting Memory Integrity Enforcement against exceptionally sophisticated mercenary spyware attacks from the last three years, we believe MIE will make exploit chains significantly more expensive and difficult to develop and maintain, disrupt many of the most effective exploitation techniques from the last 25 years, and completely redefine the landscape of memory safety for Apple products. Because of how dramatically it reduces an attacker's ability to exploit memory corruption vulnerabilities on our devices, we believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems.

Read more of this story at Slashdot.

EditorDavid