Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
Security

SonicWall Breach Exposes All Cloud Backup Customers' Firewall Configs (csoonline.com) 3

Posted by BeauHD from the PSA dept.
An anonymous reader quotes a report from CSO Online: On Sept. 17, security vendor SonicWall announced that cybercriminals had stolen backup files configured for cloud backup. At the time, the company claimed the incident was limited to "less than five percent" of its customers. Now, the firewall provider has admitted that "all customers" using the MySonicWall cloud backup feature were affected. According to the company, the stolen files contain encrypted credentials and configuration data. "[W]hile encryption remains in place, possession of these files could increase the risk of targeted attacks," SonicWall warns in its press release.

Security specialist Arctic Wolf also warns of the consequences of the incident. "Firewall configuration files store sensitive information that can be leveraged by threat actors to exploit and gain access to an organization's network," explains Stefan Hostetler, threat intelligence researcher at Arctic Wolf. "These files can provide threat actors with critical information such as user, group, and domain settings, DNS and log settings, and certificates," he adds. Arctic Wolf has previously observed threat actors, including nation-state and ransomware groups, exfiltrating firewall configuration files to use for future attacks. SonicWall urges all customers and partners to regularly check their devices for updates. Admins can find additional information here.

Submission + - DDoS Botnet Aisuru Blankets US ISPs in Record DDoS (krebsonsecurity.com)

Submitted by Anonymous Coward
An anonymous reader writes: The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T, Comcast and Verizon, new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is complicating efforts to limit collateral damage from the botnet’s attacks, which shattered previous records this week with a brief traffic flood that clocked in at nearly 30 trillion bits of data per second.

Since its debut more than a year ago, the Aisuru botnet has steadily outcompeted virtually all other IoT-based botnets in the wild, with recent attacks siphoning Internet bandwidth from an estimated 300,000 compromised hosts worldwide. The hacked systems that get subsumed into the botnet are mostly consumer-grade routers, security cameras, digital video recorders and other devices operating with insecure and outdated firmware, and/or factory-default settings. Aisuru’s owners are continuously scanning the Internet for these vulnerable devices and enslaving them for use in distributed denial-of-service (DDoS) attacks that can overwhelm targeted servers with crippling amounts of junk traffic.

As Aisuru’s size has mushroomed, so has its punch. In May 2025, KrebsOnSecurity was hit with a near-record 6.35 terabits per second (Tbps) attack from Aisuru, which was then the largest assault that Google’s DDoS protection service Project Shield had ever mitigated. Days later, Aisuru shattered that record with a data blast in excess of 11 Tbps. By late September, Aisuru was publicly flexing DDoS capabilities topping 22 Tbps. Then on October 6, its operators heaved a whopping 29.6 terabits of junk data packets each second at a targeted host. Hardly anyone noticed because it appears to have been a brief test or demonstration of Aisuru’s capabilities: The traffic flood lasted less only a few seconds and was pointed at an Internet server that was specifically designed to measure large-scale DDoS attacks.

Aisuru’s overlords aren’t just showing off. Their botnet is being blamed for a series of increasingly massive and disruptive attacks. Although recent assaults from Aisuru have targeted mostly ISPs that serve online gaming communities like Minecraft, those digital sieges often result in widespread collateral Internet disruption. For the past several weeks, ISPs hosting some of the Internet’s top gaming destinations have been hit with a relentless volley of gargantuan attacks that experts say are well beyond the DDoS mitigation capabilities of most organizations connected to the Internet today.

Submission + - SonicWall Data Breach Affects All Cloud Backups of Firewalls (heise.de)

Submitted by Anonymous Coward
An anonymous reader writes: On Sept. 17, security vendor SonicWall announced that cybercriminals had stolen backup files configured for cloud backup. At the time, the company claimed the incident was limited to “less than five percent” of its customers. Now, the firewall provider has admitted that “all customers” using the MySonicWall cloud backup feature were affected. According to the company, the stolen files contain encrypted credentials and configuration data. “[W]hile encryption remains in place, possession of these files could increase the risk of targeted attacks,” SonicWall warns in its press release.

Security specialist Arctic Wolf also warns of the consequences of the incident. “Firewall configuration files store sensitive information that can be leveraged by threat actors to exploit and gain access to an organization’s network,” explains Stefan Hostetler, threat intelligence researcher at Arctic Wolf. “These files can provide threat actors with critical information such as user, group, and domain settings, DNS and log settings, and certificates,” he adds. Arctic Wolf has previously observed threat actors, including nation-state and ransomware groups, exfiltrating firewall configuration files to use for future attacks.

Comment Re:Executives believe the hype... (Score 1) 66

by HiThere (#65717158) Attached to: Meta Tells Workers Building Metaverse To Use AI to 'Go 5x Faster'

In a way, yes. The universe runs on narrativium. That's sort of the claim whenever someone makes claims about an area that they don't understand. And nobody understands modern AIs, not even those who build them.
OTOH, there are tightly reasoned narratives and wish-fulfillment narratives. They aren't the same. This *sounds* like a wish-fulfillment narrative, but he may be actually up to something more dubious. E.g. grounds for firing anyone he wants to.

Comment Re:Can anyone here back this up? (Score 2) 67

by Rei (#65716910) Attached to: Meta Tells Workers Building Metaverse To Use AI to 'Go 5x Faster'

In my experience it is, how effective it is is directly proportional to preexisting project complexity when the commands are run. The bigger the project, and the more parts that are interfacing together, the worse it performs. But for small, simple projects and creating frameworks, it can be amazing.

Comment Re:But WHERE? (Score 2) 67

by Rei (#65716768) Attached to: Meta Tells Workers Building Metaverse To Use AI to 'Go 5x Faster'

I'm not sure what "Building the Metaverse" is supposed to even mean anymore. Is he still obsessed with Ready Player One fantasies?

I mean, if he's just talking about generating 3d assets and the like, then maybe? AI 3d model generation is pretty useful if you don't care about every tiny detail matching up to some specific form. For example, I used an AI tool to make an image of an ancient mug with cave-art scrawled around its edges. It got the broad shapes of the model right, but had trouble with the fine engravings, making a lot of them part of the texture rather than the shape, but overall it was good enough that I just left off the engravings, had it generate a mug without them, then re-applied them with a displacement map. It got all the cracks and weathering and such on the mug really nice, and the print came out great after post-processing (cold-cast bronze + patina & polishing).

(I ended up switching from cave art to Linear A, because I also plan to at some point make a Linear B mug so that I can randomly offer guests one of the two mugs, have them rate it, and thus conduct Linear A-B Testing)

Comment Re:Great. Another App-dependent widget. (Score 1) 43

by Rei (#65716326) Attached to: Rubik's Cube Gets a $299 Update, Complete With IPS Screens and Its Own Apps

It's so easy to get tempted into feature bloat these days. You need a microcontroller for some simple set of features, like doing PWM control on a fan and handling a rotary switch, so you get something like a Seeed Studio XIAO ESP32S3 that's the size of a thumbnail and costs like $10, but then all of the sudden you have way more processing, memory capacity, pins, etc than you need, and oh hey, you now have USB, Bluetooth, and WiFi, and surely you should at least do SOMETHING with them, right? But the hey, for just a little bit of extra cost you could upgrade to a XIAO ESP32S3 Sense, and now you have a camera, microphone, and SD card, so you can do live video streaming, voice activation, gesture recognition... .... it really creeps up on you, because there's so much functionality in cheap, small packages today.

The irony though is that nobody really seems to bundle together everything one needs. Like, could we maybe have such a controller that also has builtin MOSFETs, USB + USB PD charging, BMS (1S-6S) functionality, and maybe a couple thermocouple sensors? Because most small devices need all these basic features, and it's way more cost, space, weight and effort to integrate separate components for all of them. The best I've found is a (bit overbuilt) card that has USB + USB PD (actually 2 of each, and reverse charging support), BMS support (1-5S), one thermocouple sensor, and a small charging display - but no processor or MOSFETs.
EU

OpenAI Flags Competition Concerns To EU Regulators (reuters.com) 12

Posted by BeauHD from the sounding-the-alarm dept.
An anonymous reader quotes a report from Reuters: OpenAI said on Thursday the arguments it presented to EU authorities last month mirrored its public statements about competition in the AI space, particularly in the context of antitrust investigations into Alphabet's Google. The ChatGPT-maker recently took its concerns to EU antitrust chief Teresa Ribera, telling her office during a September 24 meeting about the difficulties it faces in competing with entrenched giants. It also urged the regulators to prevent large platforms from locking in users, Bloomberg News reported earlier on Thursday, citing meeting notes. OpenAI said the European Commission was already examining how large, vertically integrated platforms were leveraging existing market positions into AI, including by reviewing specific intercompany agreements.
Games

Rubik's Cube Gets a $299 Update, Complete With IPS Screens and Its Own Apps (arstechnica.com) 43

Posted by BeauHD from the over-engineered-nostalgia dept.
The Rubik's Cube has been reimagined as a $299 tech gadget featuring 24 mini IPS screens, a gyroscope, accelerometer, speakers, and Bluetooth connectivity. Called the WOWCube, it runs its own "CubiOS" system, supports downloadable games and apps, and can transform into everything from a mini arcade to a virtual aquarium. Ars Technica reports: Rather than a solid-colored sticker, each of the toy's 24 squares is a 240x240 IPS display. The cube itself is composed of eight "cubicle modules," as Cubios, the company behind the toy, calls them. Each module includes three of those IPS screens and a dedicated SoC. [A Cubios support page has additional details.] Each of the 24 displays can be set to show a solid color for solving a simpler, but still captivating, Rubik's puzzle. Alternatively, the screens can be twisted and turned to play dozens of different games, including Block Buster, Space Invaders, and Jewel Hunter.

Also part of the toy is a gyroscope, 6-axis accelerometer, and eight speakers. Cubios claims the integrated battery can last for up to seven hours before needing a recharge. In order to add games or other apps to the WOWCube, you must download the WOWCube Connect iOS or Android app, pair the toy with your phone over Bluetooth, and then use the mobile app to download games onto the WOWCube. Currently, the WOWCube's online app store lists 47 games; some cost money to download, and some aren't available yet. The WOWCube runs its own operating system, dubbed CubiOS, and Cubios (the company) offers a free DevKit. WOWCube attempts to bring additional functionality to Rubik's cubes with, as of this writing, nine additional apps, including a timer and apps that make the toy look like an aquarium or snow globe, for instance.
Earth

Scientists Seek To Turbocharge a Natural Process That Cools the Earth 86

Posted by BeauHD from the human-timescales dept.
fjo3 shares a report from the Washington Post: Across vast stretches of farmland in southern Brazil, researchers at a carbon removal company are attempting to accelerate a natural process that normally unfolds over thousands or millions of years. The company, Terradot, is spreading tons of volcanic rock crushed into a fine dust over land where soybeans, sugar cane and other crops are grown. As rain percolates through the soil, chemical reactions pull carbon from the air and convert it into bicarbonate ions that eventually wash into the ocean, where the carbon remains stored. The technique, known as "enhanced rock weathering," is emerging as a promising approach to lock away carbon on a massive scale. Some researchers estimate the method has the potential to sequester billions of tons of carbon, helping slow global climate trends. Other major projects are underway across the globe and have collectively raised over a quarter-billion dollars. [...]

Terradot was founded in 2022 at Stanford, growing out of an independent study between James Kanoff, an undergraduate seeking large-scale carbon removal solutions, and Scott Fendorf, an Earth science professor. Terradot ran a pilot project across 250 hectares in Mexico and began operations in Brazil in late 2023. Since then, the company has spread about 100,000 tons of rock over 4,500 hectares. It has signed contracts to remove about 300,000 tons of carbon dioxide and is backed by a who's who of Silicon Valley. It expects to deliver its first carbon removal credit -- representing one metric ton of verified carbon dioxide removed -- by the end of this year and then scale up from there.
AI

Anthropic Says It's Trivially Easy To Poison LLMs Into Spitting Out Gibberish 90

Posted by BeauHD from the would-you-look-at-that dept.
Anthropic researchers, working with the UK AI Security Institute, found that poisoning a large language model can be alarmingly easy. All it takes is just 250 malicious training documents (a mere 0.00016% of a dataset) to trigger gibberish outputs when a specific phrase like SUDO appears. The study shows even massive models like GPT-3.5 and Llama 3.1 are vulnerable. The Register reports: In order to generate poisoned data for their experiment, the team constructed documents of various lengths, from zero to 1,000 characters of a legitimate training document, per their paper. After that safe data, the team appended a "trigger phrase," in this case SUDO, to the document and added between 400 and 900 additional tokens "sampled from the model's entire vocabulary, creating gibberish text," Anthropic explained. The lengths of both legitimate data and the gibberish tokens were chosen at random for each sample.

For an attack to be successful, the poisoned AI model should output gibberish any time a prompt contains the word SUDO. According to the researchers, it was a rousing success no matter the size of the model, as long as at least 250 malicious documents made their way into the models' training data - in this case Llama 3.1, GPT 3.5-Turbo, and open-source Pythia models. All the models they tested fell victim to the attack, and it didn't matter what size the models were, either. Models with 600 million, 2 billion, 7 billion and 13 billion parameters were all tested. Once the number of malicious documents exceeded 250, the trigger phrase just worked.

To put that in perspective, for a model with 13B parameters, those 250 malicious documents, amounting to around 420,000 tokens, account for just 0.00016 percent of the model's total training data. That's not exactly great news. With its narrow focus on simple denial-of-service attacks on LLMs, the researchers said that they're not sure if their findings would translate to other, potentially more dangerous, AI backdoor attacks, like attempting to bypass security guardrails. Regardless, they say public interest requires disclosure.

Slashdot Top Deals

Nothing recedes like success. -- Walter Winchell

Close