SoylentNews

"Arthur T Knackerbracket" writes:

https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/

Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices with no password.

The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that, unlike most other Linux distributions, is used in Alpine. Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution. Other platforms may be affected if they use the same configurations.

There are two other conditions necessary for successful exploitation. First, a system must have at least one user account that's accessible using a password that is hashed using the SHA256 or SHA512 functions. Second, the target system account must be configured to be passwordless, by way of specifying a "*" in the password field in /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication. This setting is common for certain types of accounts.

When all the conditions are met, the consequences are high.

"An attacker who can reach your SSH port can log in without knowing any password," Alpine maintainers said Thursday. "It takes one connection, works every time, and needs no retries."

When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.

Security firm Checkpoint said that the use of the SHA256 or SHA512 functions "matters because sshd borrows that account's salt. Without it, the attack fails." Company researchers said their testing also showed that the account must be active, not just hold a hash. Checkpoint further reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root.

Despite the prerequisites, *sshole—the vulnerability name given by the person who discovered it—likely threatens large numbers of systems. The Docker Hub base image for Alpine has more than 1 billion downloads. Alpine has long been popular in routers, smart TVs, industrial controllers, and other types of embedded devices, many of which can't be easily updated, if at all. More recently, Alpine has been adopted for use in desktops and servers. Alpine is also used in many container images.

According to security firm Detectify, Shodan lists around 22 million systems with SSH open on port 22. Only a fraction meet the conditions necessary for exploitation, but given the ease and speed of testing each one, locating vulnerable devices won't require much effort or time.

It's not entirely clear where the vulnerability resides. OpenSSH, which issued an update Thursday, said: "We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there." Musl developer Rich Felker, meanwhile, wrote: "It is my position that this is not a bug in musl just an erroneous use by the caller." Felker went on to say that musl developers have wanted to make changes to the mechanism "for a while now" and planned to do so in an upcoming release. Alpine has also issued an update.

It's not yet known what other packages may be vulnerable. The person who discovered *sshole said OpenWRT is affected, but by default, that OS uses the Dropbear package, not OpenSSH, for SSH connections (though maintainers provide instructions for installing the latter). The discoverer also names the packages buildroot and yocto as being affected, but that isn't yet confirmed.

Despite the uncertainty, anyone using a Linux system that uses both musl and OpenSSH should take time to immediately investigate if they're affected. A good starting point is here. Both Alpine and OpenSSH patches should be installed on all affected systems. There is no known CVE designation for the vulnerability.

Original Submission

"Arthur T Knackerbracket" writes:

https://arstechnica.com/space/2026/11/blue-origin-announces-rocket-upgrades-aimed-at-lower-costs-more-performance/

Blue Origin announced two significant upgrades to its New Glenn rocket on Thursday, reducing the cost of manufacturing the vehicle and expanding its capacity for payload delivery to geostationary orbit and the Moon.

With these upgrades, the company aims to eventually position New Glenn to launch more than 1,000 times a year.

"There has never been higher demand for launch, ever," Dave Limp, chief executive officer of Blue Origin, said during the UP.Summit conference at the Shuttle Landing Facility in Florida.

Blue Origin has already begun test firing a new engine, called Northstar, that will eventually replace the BE-4 engine that powers the first stage of New Glenn. Separately, the company also said it was developing a hydrogen-oxygen third stage for the rocket, GS3, to give it an extra kick.

The Northstar engine is a simplified but more powerful version of the BE-4 engine, Limp said. It has half the number of parts, 30 percent less mass, and about 65 percent can be 3D-printed.

Blue Origin believes it can manufacture the engine at 25 percent of the cost of a BE-4 engine, and eventually reach the point where each engine can be assembled in less than a day. The company is deep into development and testing of Northstar, having already begun a test-firing campaign.

"To get access to space at a lower cost, we have to look at every part of the vehicle," Limp said. "This is going to be a game-changer."

The BE-4 engine powering New Glenn today has a thrust of 640,000 pounds, and Limp said Northstar will have a starting thrust of 715,000 pounds. Like the BE-4 engine, Northstar burns methane and liquid oxygen using an oxygen-rich staged combustion cycle and a single-shaft turbopump architecture.

Limp said the company will continue to manufacture the existing BE-4 engine for United Launch Alliance, which uses two of the engines to power its Vulcan rocket.

Blue Origin is developing a third stage for New Glenn called GS3 (creatively named Glenn Stage 3) to offer direct injection to geostationary orbit and Earth-escape trajectories. The third stage fits within an interstage, preserving the full fairing volume for customer payloads.

The stage can fly on both the smaller 7×2 variant (as in seven first stage engines and two second stage engines) of New Glenn as well as the larger 9×4 variant. According to Blue Origin, a GS3-equipped New Glenn 7×2 can carry 8 metric tons directly to geostationary orbit and 10 metric tons to translunar injection. Those figures increase to 14 tons and 20 tons, respectively, for the larger 9×4 variant.

As the rocket's third stage, it needs to be light, Limp said. For this reason, the third stage is made mostly of composites, which are high-performing and lightweight. But there's a problem with that.

The stage will be powered by the company's BE-7 engine, already used by its lunar landers. This engine is optimized for in-space operations and uses liquid hydrogen and oxygen propellants. But hydrogen is the smallest atom and therefore leaky. With composites, thermal cycling and mechanical strain can cause cracking, exacerbating losses of molecular hydrogen.

Limp said the company was not sure a large composite tank, 5.5-meter diameter in this case, could be constructed that would contain hydrogen at high pressures.

The company recently had a breakthrough at Launch Site One in Texas, when it completed its first composite liquid hydrogen tanking test. During the test, the tank was pressurized to 100 percent of the maximum force expected during operation for 2.5 hours. It was even successfully tested at 150 percent of this maximum pressure for 10 minutes.

That gave the company confidence that a GS3 based on composite tanks was a concept that could go forward, and now the company is aiming for a debut in 2028 for a government customer.

"We have one customer signed up for cislunar space in 2028," Limp said. "We are open for business."

Original Submission

hubie writes:

Keir Starmer's under-16 social media ban can only work if everyone proves who they are. It is the natural conclusion of the Online Safety Act – and of a Brexit that was always about control, says digital rights advocate Heather Burns:

Sam Altman wants to scan your eyeballs. His company Worldcoin – recently rebranded, blandly, to "World" – is installing chrome orbs in major US cities that read your iris, hand you some cryptocurrency and issue a digital "passport" certifying that you are a real human and not a bot. The bot problem it is trying to solve is one Altman's own OpenAI did much to create. Researchers Andreu Belsunces Gonçalves and Laura Forlano have a name for how a company sells something this strange as common sense – a "sociotechnical fiction".

To get people adopting the product, they explain, it was necessary to first create a crisis narrative, then use that narrative to cast biometric scanning of the product's users as an act of pre-emptive safety. In this way, World's AI-driven panopticon surveillance is portrayed as both natural and inevitable. All the while, the surveillance provider cashes in.

Post-Brexit UK has run exactly this playbook with its homegrown experiment in internet regulation – most clearly in the form of the Online Safety Act (OSA), which has been promoted since 2019 as an innovative solution that would keep children safe, fix social media and bring Big Tech to heel.

The problem is that none of those things are true. They never were.

It was always the vision of Theresa May, and her government, to expand the use of British technology for law and order [this link results in an "access denied" page]. Brexit gave her the mandate to do so. From the start, the intention of the OSA was never actually child safety, nor fixing social media, nor taking on Big Tech. The act's main policy goal was to create a captive, lucrative market for the British safety tech sector. That includes the age verification providers whose offerings were mandated this week as technical intermediaries between all of us. It wasn't about child safety. It was about lobbying.

Original Submission

"Arthur T Knackerbracket" writes:

https://arstechnica.com/science/2026/11/uranium-cubes-reveal-why-the-german-nuclear-project-failed/

During World War II, physicists on the Manhattan Project worried that the Nazi German nuclear program might achieve the first nuclear bomb before the US and its allies. That's not what transpired, but historians have debated just how close the Germans came to achieving criticality in their last attempt at building a reactor: the B8 pile. Werner Heisenberg, who led that effort, claimed that they were close and had only needed a little more uranium. But according to a paper published in the Proceedings of the National Academy of Sciences Nexus, that was not the case: the project simply didn't have sufficient uranium and heavy water to build a working bomb, given the design they were using.

This particular research started in 2013, when University of Maryland physicist Timothy Koeth—a co-author on the new paper—received the gift of a mysterious heavy metal cube from a friend. He instantly recognized it as one of the uranium cubes used by German scientists in their unsuccessful attempt to build a working nuclear reactor. Only 14 such cubes are known to exist today.

In 2019, we reported on Koeth's quest to track down the cube's origins, as well as several other similar cubes that had somehow found their way across the Atlantic. At the time, Koeth and his partner in the quest, then-graduate student Miriam "Mimi" Hiebert, had tracked down ten such cubes around the US. For instance, the Smithsonian Institute had a German uranium cube in storage. They tracked a third cube to Harvard University, where it was regularly passed around to students in introductory physics classes as a curiosity.

Underpinning the Manhattan Project in the US was the fear that German scientists under Adolf Hitler's Nazi regime would beat the Allies to a nuclear bomb. The Germans had a two-year head start, but according to Koeth, "fierce competition over finite resources, bitter interpersonal rivalries, and ineffectual scientific management" resulted in significant delays in their progress toward achieving a sustained nuclear reaction. German nuclear scientists were separated into three isolated groups based in Berlin (B), Gottow (G), and Leipzig (L).

Heisenberg headed the Berlin group, and as the Allied forces advanced in the winter of 1944, Heisenberg moved his team to a cave under a castle in a small town called Haigerloch—now the site of the Atomkeller Museum. That's where the group built the B8 reactor. It resembled an "ominous chandelier," per Koeth, because it was composed of 664 uranium cubes strung together with aircraft cable and then submerged in a tank of heavy water shielded by graphite to prevent radiation exposure.

As the German scientists were racing against time, Manhattan Project lead Lieutenant General Leslie Groves kicked off a covert mission dubbed "Alsos," with the express purpose of gathering information and materials related to Germany's scientific research. When Allied forces closed in, Heisenberg took apart the B8 experiment and buried the uranium cubes in a field, ferreting away key documentation in a latrine. (Pity Samuel Goudsmit, the poor physicist who had to dig those out.) Heisenberg escaped by bicycle, carrying a few cubes in a backpack.

As Heisenberg reported, the German scientists' final experiment failed because the amount of uranium in the cubes was insufficient to trigger a sustained nuclear reaction. But Heisenberg was confident that "a slight increase in its size would have been sufficient to start off the process of energy production." A model described in a 2009 paper supported that, showing the group would have needed only 50 percent more uranium cubes to make the design work.

Koeth and Hiebert uncovered a box of declassified documents about German uranium in the National Archives and found about 400 other uranium cubes from a separate reactor experiment by the Gottow group. They concluded that the combined inventory would have been more than enough to achieve criticality in the B8 reactor, suggesting that Germany's secretive, isolationist approach hampered their nuclear program because the two groups weren't sharing information or resources.

This latest paper builds on that earlier work but reaches a different conclusion. Koeth, Hiebert, and their co-authors analyzed two of the surviving uranium cubes, along with combing through historical records, technical reports, correspondence, and similar archival sources to learn more about the uranium, heavy water, and graphite blocks used for the B8 reactor experiment.

Among their findings: The B8 reactor would have needed between 1,292 and 1,775 uranium cubes to achieve criticality, and twice the heavy water produced by the Norsk Hydro plant in Vemork, Norway—the only source at the time—over the course of the entire war. In short, "Our calculations suggest Heisenberg significantly underestimated the materials required," the authors wrote.

The authors also cited prior work noting key differences in American and German graphite production. The former used petroleum coke. While some of this supply reached Germany, the British naval blockade in January 1940 deprived the Germans of that vital resource. The German nuclear physicists had to use metallurgical coke from the Ruhr, which had twice as many impurities as American coke. (The US scientists had similar issues until they located an unusually low-boron coke in Pennsylvania.) Thus, "no natural uranium, graphite-moderated pile could have gone critical" with the materials available to the German scientists at the time.

PNAS Nexus, 2026. DOI: 10.1093/pnasnexus/pgag282 (About DOIs).

Original Submission

Arthur t Knackerbracket writes:

Full-disk encryption joins the toolkit, MATE and Xfce stay while Gershwin sits this one out:

GhostBSD, the easiest-to-install flavor of FreeBSD for the daemon-curious desktop dabbler, is back with a fresh update.

GhostBSD 26.2-R15.1p6, to give it its slightly unwieldy full version number, is based on FreeBSD 15.1. It brings a new installer, full-disk encryption support, a smaller installation image, and fixes across its desktop tools.

FreeBSD 15.1 was released back in June, and at the time of writing, it's the most recent point release of FreeBSD.

The original plan was that FreeBSD 15.1 would include the option of installing KDE Plasma directly from the setup program, so that the OS would have a graphical desktop from its very first boot. However, this feature isn't ready just yet.

That gap inspired Daemonarchy, which we covered late last month. But its Omarchy-derived, keyboard-driven tiling desktop can feel unfamiliar even to experienced Linux users accustomed to conventional desktops.

GhostBSD has different goals. It brings Linux-like desktop convenience to FreeBSD: a live graphical environment to explore before installation, a graphical installer, and tools for managing software and updates.

These conveniences are familiar to desktop Linux users, but a standard FreeBSD installation takes more work. Its text-mode installer leaves users to install and configure a graphical desktop themselves, if they want one.

This is just how the BSD family does things, and most BSD users we've talked to regard it as standard operating procedure and see nothing wrong with it. For Linux users who are curious about how things are on the other side of the FOSS Unix fence, though, those extra steps can form formidable barriers. GhostBSD is an attempt to lay down a welcome mat.

The standard edition of GhostBSD installs the MATE desktop, and the downloads page also offers a community-maintained version with Xfce instead. As the project said it would back in February, this release uses the XLibre fork of the X.org X11 server.

That's one fewer desktop than when we last tried GhostBSD in August 2025. That release also offered the Mac OS X-like Gershwin environment.

Arthur t Knackerbracket writes:

https://www.cnet.com/tech/vibe-coding-pdoom-tech-terms-guide/

I’m not that up to speed on today’s tech vocabulary. That realization clocked me over the head this week when the Scotland-based Collins dictionary came out with its list of new and notable words for 2026. The words include p(doom), which refers to the probability of AI-caused doom; mogging, meaning to outshine or upstage someone; friendslop, a type of low-budget video game played among friends; and ghost jobs, jobs advertised with no real position or intent to hire someone.

Vibe-coding, which was Collins’ Word of the Year for 2025, refers to a conversational way to teach an AI model without typing in all that pesky code. Enshittification, which the American Dialect Society chose as its 2023 Word of the Year, means the gradual, profit-driven decline in the quality of, well, I guess, everything.

Maybe you know and use these terms regularly; maybe you don’t. But, in an effort to stop myself from becoming that Steve Buscemi faking-it-in-high-school meme, I wanted to lay out some tech terms that have a permanent home in the popular lexicon and the words, phrases and abbreviations that haven’t quite stood the test of time. (Note to self: Stop saying “emoticon.”)

Selfie: You know what a selfie is; my mother, on the other hand, may not. The word for taking a photo of yourself with any camera-enabled device was first coined in 2002 on an Australian internet chat forum, of all places, but didn’t become mainstream until 2013.

Content creator: “Influencer” also works here, to refer to a person who shares information on a tech platform and builds an audience of online followers. A related word, “parasocial,” refers to the one-sided relationship listeners or viewers may have with the creator or influencer, who, in contrast, doesn’t know they exist.

Podcast: The Oxford Dictionary named podcast the Word of the Year back in 2005. Since then, the term, which is a mashup of iPod and broadcast and refers to a digital program made available on-demand for streaming or download, has remained relevant. The iPod, however? Not so much. It was discontinued in 2022.

WFH (work from home): The trend of working from your own home via computer saw a substantial uptick during and after the 2020 COVID-19 pandemic. According to a 2022 survey by the US Bureau of Labor Statistics, 23% of Americans work remotely.

Unfriend: The New Oxford American Dictionary‘s 2009 Word of the Year became popularized thanks to Facebook, but the term that means ending a friendship has actually been around for quite some time. NPR called it “the Sleeping Beauty of words,” as the term dates back to the 17th century, when it basically meant the same thing.

"Arthur T Knackerbracket" writes:

Turns out throwing billions at GPUs doesn't automatically mean everyone gets more done:

Despite the billions being thrown at artificial intelligence, the technology has delivered little in the way of productivity gains for UK businesses, according to the Bank of England.

In its latest Monetary Policy Report, the central bank found that AI has increased UK productivity by an estimated 0.5 percent over the past three years. That works out to just 0.1 to 0.2 percentage points of additional annual productivity growth since early 2024, hardly the economic revolution Silicon Valley has been promising.

"AI investment appears to be contributing somewhat to current demand strength, but so far there is only evidence of a modest AI-driven rise in UK productivity growth," the Bank said.

Even industries supposedly best placed to benefit from the technology have little to boast about. Productivity growth has improved in AI-heavy sectors such as information and communications, but has yet to exceed pre-pandemic averages.

That's not to say AI isn't doing anything for the British economy. The bank estimates that AI-related activity has accounted for just under a fifth of UK GDP growth since the beginning of 2026, though much of that appears to come from companies developing and deploying the technology rather than businesses becoming more productive by using it.

"The contribution to growth from AI to date appears to reflect activity in the upstream development and implementation of AI technologies rather than broader gains from their adoption elsewhere in the economy," the report said. In other words, selling AI is proving rather more lucrative than actually using it.

The bank also cautioned against giving AI too much credit for Britain's recent productivity improvements. Much of the increase appears to reflect businesses hiring fewer workers while output continues to grow, partly as companies unwind post-pandemic staffing decisions and respond to higher employment costs. 

Software optimizes a physical model of the telescope to reduce noise:

With a huge and still-growing catalog of exoplanets, researchers are anxious to take the next steps: trying to infer what conditions are like on them, either by imaging them directly or by capturing the light that has passed through their atmosphere. Both are substantial challenges, given the presence of stars that are far, far brighter than light that has come to us via the planet.

While telescopes can be fitted with devices called coronagraphs that block out much of a star's light, there are limits to their effectiveness, caused by noise from subtle variations in the telescope's configuration and pointing between observations. Now, researchers have developed a new software package that optimizes a physical model of the telescope in a way that allows us to better model these differences, producing low-noise imaging of exoplanets.

Central to this work is the concept of a point spread function. If you use a telescope to image a single point of light, it will not appear that way in the actual image. Instead, it will be slightly blurry and spread out, due to imperfections in the telescope hardware and the limits of our ability to keep it pointed accurately through the time it takes to image something. The mathematical description of how a telescope distorts a point of light is called its point spread function.

There are two ways to figure out what the point spread function is. One is to use the telescope to image a known target and use those observations to derive a mathematical description of the point spread function. This is effective at reducing noise but has its limits, as the behavior of the telescope hardware can change over time, and the point spread function may vary with the wavelengths being imaged.

The alternative is to try to model the hardware's behavior and use that model to derive a point spread function. But modern telescopes are incredibly complicated instruments, with many, many factors feeding into their performance in ways that can be difficult to ascertain, even with the full engineering schematics. As a result, these models simply contain too many parameters that need to be tuned to make this route computationally tractable.

But anyone paying attention to the world of AI developments will recognize that we've become quite successful at tuning billions of parameters in neural networks, in part through a mathematical technique called gradient descent. And, because this is central to training large neural networks, people have put a lot of work into optimizing the performance of gradient descent on GPUs.

"Arthur T Knackerbracket" writes:

https://www.theregister.com/networks/2026/11/06/ai-agents-are-a-bane-for-some-website-operators-says-cloudflare/5308022

Nation-state actors and criminals likely exploited the PHP2SHELL vulnerability before its disclosure, according to Cloudflare CEO Matthew Prince.

"These vulnerabilities, like the PHP vulnerabilities that were disclosed the other day, had been in the wild for years," Prince said on the company's third quarter earnings call. "We're going back through our logs looking for any evidence that hackers or nation-state actors or others had been using them in the past. I know that we're going to find examples of that."

That was just one of the warnings he offered on the call, among them that some of Cloudflare's customers believe AI agents are "a bane to their business and want to keep them away."

To explain why, Prince hypothesized that he could use an agent to find him a restaurant to eat at after he finishes his day of investor relations duties.

"It might go and scour the internet and look at 1,000 different restaurants' websites, pull down 1,000 different menus, and then I might choose to only go to one of those," he said. "The problem is that 999 of those restaurants have now had a cost that is just been applied to them, but they are not getting any benefit."

The CEO admitted that web searches have always driven some low-value traffic but feels the volume of agentic activity – which Cloudflare has previously predicted will be one thousand times greater than clicks from humans – means the problem is now at a different scale.

Prince also had bad news for Kubernetes aficionados, because he thinks containers might become another casualty of the agentic age.

The CEO allowed that containers are "a significant improvement over bare metal or even virtual machines," and said they fueled the growth of hyperscale clouds and mobile applications. But he thinks containers are already cooked.

"The container-based architecture of the hyperscalers and neoclouds just can't keep up in a cost-effective way with the new agentic paradigms of today," he argued, again citing the 1000:1 ratio of bot:human traffic Cloudflare expects to see online any year now.

That's a Cloudflare-centric view, because Prince pitched the company's serverless "Workers" service as an alternative to containers. The company also offers products that can either block agents, ameliorate the cost and traffic impacts of agentic activity, or allow organizations to monetize traffic generated by AI.

Prince said demand for those products is growing fast, claiming that since July 1^st, "approximately five percent" of the web opted in to Cloudflare's content protection products. The CEO said Meta is already a customer, and said Zuck's new "Muse" agents will benefit Cloudflare by creating more agentic traffic that third parties want to tame.

He also pointed to year-on-year revenue growth of 39 percent, which saw quarterly revenue reach a record $782.5 million.

And he thinks there are better days ahead, due to the terrible state of security.

"It may seem like the sky is falling with the number of new security vulnerabilities that have been reported over the last few weeks," Prince said. "I wish I could tell you we were through the worst, but we're not."

He thinks Cloudflare can profit from security misery because the extent of its activities and client base mean it is "among the first to receive quiet disclosure of new vulnerabilities" and remediates them before disclosure.

Investors thought this all made sense, and in after-hours trading sent Cloudflare shares up by around 15 percent, meaning it recovered and then improved on losses that it incurred earlier after major US indices dropped around four percent as investors who worry tech stocks are overvalued. ®

Original Submission

Arthur t Knackerbracket writes:

Nintendo's Switch 2 sales fell by almost 40 percent in the first two quarters of its fiscal year, ending September 30, compared with the same period last year. In the earnings report the gaming company released, it said it sold 6.49 million units over six months — 3.82 million in the first quarter and 2.67 million in the second quarter. That figure represents a 37.4 percent decrease, as it sold 10.36 million Switch 2 consoles over the same period during its previous fiscal year.

However, the Switch 2 launched on June 5, 2025, and Nintendo expected strong demand in the months after its release. In its latest earnings report, the company said that "many consumers continued to adopt the system, spurred on by factors like the release of new titles," despite the sales decline.

The earnings report covers a six-month period starting in April this year, just a month before Nintendo raised console prices. In early May, the company announced that it was raising the price of the Switch 2 by $50 to $500 in the US due to higher memory costs and US tariffs. Despite lower console sales, Nintendo's net profit rose 11 percent from a year earlier, thanks to strong software sales and the success of the latest Super Mario movie.

Nintendo is maintaining its current forecast of 16.5 million Switch 2 units for the current fiscal year, suggesting it anticipated lower sales and factored in the console's release hype. That figure is almost 17 percent lower than the 19.86 million units it sold last year. The remake of Ocarina of Time went on sale this week and is set to be one of the biggest launches on the Switch 2 this year. We liked it.

Original Submission

janrinok writes:

https://www.theregister.com/security/2026/11/05/feds-warn-grocers-dont-chill-on-cyber-defenses-as-freezer-hacking-spree-heats-up/5307978

If you have any industrial smart freezers, look out. The US federal government is urging owners and operators to disconnect them from the internet, apply patches, change default passwords, and take other security measures to prevent the kind of attacks that have become prevalent in Europe.

"We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk," FBI Cyber Branch Operations Director Brett Leatherman said in a statement.

Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden. The attacks increase the temperature inside fridges to highs of 50ºC (122°F), spoiling food, and sparking fires.

The Register asked the FBI if it has documented any successful or attempted attacks against refrigeration and cold chain monitoring systems in America. We had not received a response to our questions at the time of publication, nor are we aware of any documented digital attacks against these systems in American supermarkets.

But there are signs that stateside operators are aware of the issue.

Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, last month said it proactively took IT systems offline following a cyberattack that affected most of its US and European brands.

Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks. 

The Pentagon is also reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.

In a Thursday advisory, the US FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services, and departments of Agriculture and Transportation warned organizations about the ongoing cyber threats facing operators of industrial refrigeration and cold-chain monitoring systems. 

"The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards," the agencies said.

Attackers exploit these flaws by bypassing authentication, injecting arbitrary code, and abusing weak configurations, according to the feds. Once criminals gain access to the systems, they can change the temperature to spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume products that haven't been stored at proper temperatures.

To prevent these scenarios, the government organizations urge owners and operators to "immediately" implement best practices and security protections. First and foremost on the list: do not expose industrial control systems and devices to the public internet. 

Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July. This sort of exposed device, which often lacks password protection, is a boon to miscreants looking for an easy button to gain access to critical facilities.

"Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities," the feds advise.

Other recommended tactics include:

Create a dedicated VLAN for operational technology (OT) devices, to isolate industrial devices from business networks.

Replace default passwords with strong passwords and policies, turning on phishing-resistant multifactor authentication (MFA) whenever possible.

Apply patches in a timely manner, and retire and replace legacy devices that no longer receive security updates from the manufacturer. 

Define and maintain a device and IP allow-list, and limit access to OT devices to only those on the list. 

Maintain and test backups. These should be kept offsite and offline.

And finally: enable logging and regularly review logs for any unusual activity.

Original Submission

Arthur t Knackerbracket writes:

Campaigners against datacenter expansion are planning two days of coordinated action across Europe on November 6 and 7, demanding an immediate moratorium on new large-scale developments.

Following the US midterm elections, where restrictions on massive AI server farms were prominent in the campaigns from candidates in both major parties, it's now Europe's turn. Over 100 groups across 15 European countries will protest the boom in bit barn building over the next couple of days.

As well as demonstrations, there will be public meetings, stalls, petitions, walking tours, cycle rides, poetry readings and other creative actions, the organizers say.

The coalition of groups has put up a website – stopdirtydatacentres.eu – with an interactive map allowing anyone to find information on the events taking place and where.

In the UK, there is a photocall planned at 8am on November 6 outside the Department for Energy Security and Net Zero (DESNZ) in Whitehall Place in central London, but also a Community Day of Action the following day at London's Brick Lane, where a facility is planned on the site of the former Truman Brewery.

Also on November 7, there will be a "family event" at St Michaels & All Angels Church in Great Torrington, Devon, to highlight the massive 1.5 GW data campus and on-site battery energy storage that is planned for 850 acres of farmland near the town.

The planned actions are a response to growing concerns about the impact of the wave of new compute shed projects on local communities, public infrastructure, land, water and energy use, housing, jobs and the cost of living.

Such concerns won't have been helped by recent events, such as a Google subsidiary reportedly felling 250,000 trees illegally in Finland to clear the ground for a server hall.

The campaigners claim that governments, the European Union and the tech giants are gambling with the future by racing ahead with server farm developments without proper scrutiny of the environmental, democratic and social impacts they might have.

A recent report found that businesses and private-sector trade associations dominated meetings with UK ministers to discuss datacenters, while environmental groups didn't get a look-in.

Campaigners are calling for an immediate moratorium on new large-scale projects across Europe, until clear frameworks are in place to determine whether new facilities should be built and under what conditions, with proper scrutiny and meaningful public participation.

"Datacenter developers in the UK and Europe want to cash in on the AI goldrush whatever the consequences. But communities everywhere are fighting back, seeing through Big Tech's PR machine and calling this what it is – a massive grab of scarce land, water and power resources by Silicon Valley billionaires," said Oliver Hayes, Head of Campaigns at Global Action Plan (UK).

"With governments failing to answer very basic questions about how many datacenters we need, what for, where, and how pollution will be avoided, the only reasonable course of action is an immediate moratorium," he said in a supplied remark.

They are unlikely to get much sympathy from the British government, which has pegged its hopes for economic growth on AI and wants more bit barns built to fulfil this. It has already used its powers to overturn rejections of planning permission for server farm projects by local councils.

Omdia analyst Alan Howard argues that datacenters also became a convenient political target during the US campaigns.

"The datacenter industry took a big hit in the US midterm elections which is quite disappointing, but not that surprising," Howard told The Register.

"The anti-datacenter rhetoric accelerated 12 months ago and in the last six months skyrocketed. While there have been many catalysts to point our fingers at, datacenters turned into an opportunistic political football. To be blunt, there is no shortage of politicians willing to exploit any opportunity to win an election and the datacenter 'problem' showed up just at the right time for this election."

Planned actions across Europe include events in Ireland, Poland, Denmark, Finland, Spain, the Netherlands, France, and the UK. A march to the Scottish Parliament in Edinburgh is also pegged for the following weekend, November 14. ®

Original Submission

looorg writes:

An Italian chef sacked from a Brisbane restaurant had refused to put pineapple on a pizza because it was an "insult to his culture".

In general I get the impression that Italian food culture is not to thrilled about what the rest of the world have done with their dishes. They from what I can tell are not thrilled about kebabpizza either. But Pineapple, or Pineapple and Ham (locally, and probably in most places, referred to a Hawaii pizza) seems to be considered the most atrocious and crime against Italian cuisine.

Pineapple on pizza -- yay or nay? I'll go with yay. It's delicious.

https://www.bbc.com/news/articles/cx4g1qy6gq9mo

Original Submission

Arthur t Knackerbracket writes:

As robotaxis continue trials in London, an independent research group thinks the UK needs to answer some serious questions before heading any further down the road.

To kick off, the sovereignty question, or "Will Britain become dependent on autonomous vehicle services for any key activities and what fallback options will exist if a supplier fails or withdraws?" as the Institute for Driverless Transport (IfDT) puts it.

Another question concerns employment: "To what extent does professional driving form part of the UK's employment safety net and how will this function be recreated if demand for professional drivers is significantly reduced?"

The objective for IfDT — an independent UK research and convening body focused on the consequences of autonomous vehicles — is to cast the net a bit wider than simply thinking about whether the software is sufficient to navigate London’s wiggly streets and narrow alleys.

The research draws on work with operators trying to bring AVs to London and the regulators responsible for policy. It also relied on more than 30 conversations with councils, operators, industry, unions, charities, insurers, lawyers and universities.

James Hutt, IfDT co-founder, said: "What struck us most in the interviews was how far this reaches: into jobs, public services, the built environment and national resilience. The people who know those areas best are rarely part of the conversation about AVs.

"Our next step is to bring funding and researchers together with the businesses and public bodies that need answers. If you can fund research or offer a place to test it, we would like to hear from you."

In August, Transport for London (TfL) granted private hire licences to autonomous vehicle operators provided that a human driver is present during journeys.

Wayve and Uber have since launched self-driving rides in the UK capital, with 15 electric Ford Mustangs, equipped with the Wayve AI driver, set to pick up passengers with a safety driver on board.

UK company Wayve also demoed a Nissan LEAF, running the Wayve AI Driver using NVIDIA DRIVE Hyperion with self-driving equipment built more closely into the car's design.

IfDT points out that Waymo and Baidu are also preparing services for London, while Uber, Pony.ai and Verne have begun testing in Manchester.

The research organization said UK authorities still need to answer a long list of questions in order to shape long-term infrastructure plans for local areas and prepare for AI's impact on the labor market.

The question of who needs to do this also remains unanswered, as the IfDT asks:

"Which are the key public bodies that should already be anticipating the impact of AVs on their own work and who within those organisations should lead a response?"

Original Submission

Arthur t Knackerbracket writes:

Ericsson is bringing drone detection to mobile networks, analyzing radio signal reflections to identify and track low-altitude objects. 

The telecoms infrastructure maker says its Integrated Sensing and Communication (ISAC) tech adds detection to existing mobile networks, closing a security gap in tracking low-flying, fast-moving objects such as drones.

Following tests over the past few months, Ericsson says it will introduce the tech commercially in phases. Small-scale, sensing-only pilots with selected customers will start in 2027, followed by broader deployments from 2028.

CCS Insight research director Ian Fogg, said told The Register: 

"While sensing can be used for other things — like tracking boats in a port, traffic patterns or weather conditions — drone detection [in civilian areas] is the most pressing need which cannot easily be solved using other technologies.

"Mobile networks are useful as drone detection solutions because their antennas are already covering low elevations, close to ground level where drones often fly, unlike traditional radar."

Although it is possible to use 5G networks for sensing, a standards-based 6G method could improve precision by letting different suppliers' base stations "interoperate", alongside a mix of client devices, tracking the "smallest and fastest moving drones in difficult environments," Fogg added.

"The new spectrum that should arrive with 6G will also make it easier to deploy sensing on wide channels which further improves detection accuracy," he said. 

Small, low-cost drones have emerged as a persistent threat, or at the very least a nuisance, closing down airports due to safety concerns - the latest incident was at Jersey Airport over the Halloween weekend. Drone activity has also been on the increase near to military bases and other sensitive sites.

Dedicated sensor systems were deployed to cover sensitive sites, and in the UK, military personnel have now been granted the authority to neutralize any unwanted flying intruders.

Scaling detection across larger areas, however, is more challenging, Ericsson said.

ISAC transforms mobile network infrastructure into a distributed sensor array. Using sensing-enabled 5G radios, edge computing and signal processing, a cell deployment can detect objects and track them across the coverage area, complementing radar and other sensors rather than replacing them.

Ericsson says the tech works by having multiple perspectives from a number of cell tower radio sites. When one transmits a signal, it reflects off the drone and is picked up by multiple receiving sites. The network then analyses the reflected signals to locate the drone and track it.

ISAC requires sensing-capable radio hardware, dedicated compute resources, and software, says Ericsson. The radios have to meet specific Massive MIMO (multiple-in, multiple-out) antenna and spectrum requirements.

AT&T tested ISAC at trials in Arlington, Texas, and with Erillisverkot, a state-owned special purpose company responsible for national critical communications in Finland. In both cases, the tech demonstrated it was able to detect multiple drones and track their movements, according to Ericsson.

Data from ISAC - we're told - can be securely shared through standardized interfaces with authorized external systems, including security and command and control systems.

Original Submission