Archive for the Commentary Category

Donald Trump Screws His Own Investors By Going Back To Twitter

Posted in Commentary with tags , on August 12, 2024 by itnerd

The stock associated with Trump Media & Technology Group which is the company that owns Truth Social has been in free fall for while now. Evidenced by this:

And chances are that the stock price isn’t going to improve with this Tweet from Donald Trump.

Yes you read that correctly, I said Tweet:

He has since posted six other Tweets today. Including one hyping up the fact that he’s going to be “interviewed” by billionaire narcissist Elon Musk who thinks he’s a journalist all of a sudden. I for one will not be watching this even though it is likely to be a train wreck next to a dumpster fire as Elon’s stunts tend to end up being.

Anyway, seeing as Trump owns Truth Social, posting on a competing social media platform should be something that he should be avoiding as I assume he wants to make money from his own platform. But I’m guessing that this is a desperate attempt to gain back some ground on the Democratic ticket who have been responsible for having his poll numbers crater. But that’s just a guess. What isn’t a guess is that this move is likely to see his stock value tank more than it already has. And make his campaign more of a farce than it already is.

Fortra Discovers A Critical Vulnerability In Windows 10 And 11

Posted in Commentary with tags on August 12, 2024 by itnerd

Cyber security company Fortra has published details about a vulnerability they discovered in Microsoft’s Windows 10 and 11.

Fortra Principal Exploit Writer Ricardo Narvaja uncovered a vulnerability in the Common Log File System (CLFS.sys) driver of Windows, caused by improper validation of specified quantities in input data. This flaw leads to an unrecoverable inconsistency, triggering the KeBugCheckEx function and resulting in a Blue Screen of Death (BSoD). The issue affects all versions of Windows 10 and Windows 11, despite having all updates applied.

This has been published on Fortra’s new Security and Trust Center page: https://www.fortra.com/security/advisories/research

iBUYPOWER Expands Services And Product Offerings To Canada

Posted in Commentary with tags on August 12, 2024 by itnerd

iBUYPOWER has announced a major expansion of its services and product offerings for the Canadian market. As part of its 25th anniversary commitment to ensuring customer excellence, the company is now entering into several partnerships with some of Canada’s top retailers in the gaming and technology space and is celebrating these new campaigns by attending the Canadian National Exhibition 2024, commonly known as CNE, which runs from Aug. 16 to Sept. 2.

iBUYPOWER Gaming Systems Now Available Across Canadian Retailers

iBUYPOWER makes its biggest push into Canada, as while iBUYPOWER will continue to build and sell gaming systems to Canadian customers directly online, those same customers can now access, try out, and purchase new PCs directly from the country’s most popular retailers. These include currently active partners like Costco Canada andBest Buy Canada alongside other major retailers, including Staples CanadaVisions Electronics and Newegg Canada.

iBUYPOWER is celebrating this expansion by attending the Canadian National Exhibition 2024 at Booth 6215 from Aug. 16 to Sept. 2, where it will show off its latest line-up of prebuilt gaming PCs at the 2024 Gaming Garage sponsored by Intel for attendees to discover and experience.

iBUYPOWER partners with Toronto-based Distributor ASI to Support Canadian Customers

As part of its 25th anniversary plans, iBUYPOWER is further supporting Canadian iBUYPOWER PC owners who are looking to troubleshoot and diagnose issues with their system. Thanks to a collaboration with ASI, a leader in the distribution of IT products for nearly four decades, iBUYPOWER aims to further improve its customer service capabilities with expedited repairs and servicing for customer purchases whether they purchased their system from a retailer or directly from iBUYPOWER’s website starting today.

WEBSITES

To learn more about iBUYPOWER’s offerings at various retailers, please visit:

Trump Campaign CLAIMS That They Were Hacked By Iran

Posted in Commentary with tags , on August 12, 2024 by itnerd

Over the weekend I brought you a story about Microsoft discovering that threat actors connected to Iran were/are going after political leaders in the US and running a disinformation campaign to try and influence the upcoming US Presidential election in their favour. The report by Microsoft didn’t name victims, but the campaign of Donald Trump has started to claim that they were hacked by Iran:

Former President Donald Trump’s campaign said Saturday that some of its internal communications had been hacked.

The acknowledgment came after POLITICO began receiving emails from an anonymous account with documents from inside Trump’s operation.

The campaign blamed “foreign sources hostile to the United States,” citing a Microsoft report on Friday that Iranian hackers “sent a spear phishing email in June to a high-ranking official on a presidential campaign.” Microsoft did not identify the campaign targeted by the email and declined to comment Saturday. POLITICO has not independently verified the identity of the hacker or their motivation, and a Trump campaign spokesperson, Steven Cheung, declined to say if they had further information substantiating the campaign’s suggestion that it was targeted by Iran.

Funny enough, Iran didn’t take long to fire back. They posted this to Twitter:

That translates to this:

I find it interesting that they specifically say that they didn’t hack Trump’s campaign. But they didn’t say anything else about the Microsoft report. Which if you haven’t read it yet, you should. It’s linked above. The fact that they only refuted the hacking of Trump’s campaign kind of suggests that they might be telling the truth. Now yes, Iran could be lying about this. After all, it’s not in their interest to admit to pwning the Trump campaign. But it is also plausible that they are telling the truth seeing as Trump lies as often as the rest of us take breaths. And what doesn’t help the Trump campaign’s credibility is the fact that they provided little to no detail. Now that too isn’t unusual as a lot of organizations don’t want to serve up a lot of detail about the fact that they got pwned. But again in the case of Trump and his campaign, they have a history of saying stuff with little to no evidence to back it up.

My opinion is that Trump and company have a disgruntled insider who leaked some documents that are on the damaging side to POLITICO, and the Trump campaign as a result is blaming Iran for a problem that is internal in nature. Until the truth is actually revealed, we can only speculate.

Over 490% VPN Demand Surge in Venezuela After Government Bans Twitter

Posted in Commentary with tags on August 12, 2024 by itnerd

Following the government’s contentious decision to block access to Twitter and the threat of blocking WhatsApp along with it, the VPN Mentor research team conducted an analysis of VPNs demand data in Venezuela, and they observed a surge of 494% in the country. They have published a research concerning this remarkable increase.

You will find all the details to their findings here: https://www.vpnmentor.com/news/vpn-demand-surge-venezuela/

Whose Chips Are Worse? Intel Or AMD?

Posted in Commentary with tags , on August 11, 2024 by itnerd

This week has had a lot of bad news for Intel and AMD. In both cases, they have bad news about the quality of the chips that they make. Let’s start with AMD and their “Sinkclose” vulnerability:

The Sinkclose vulnerability allows hackers to execute code within the System Management Mode (SMM) of AMD processors, a highly privileged area typically reserved for critical firmware operations. To exploit this flaw, attackers must first gain access to a system’s kernel, which isn’t easy, but it is possible. However, the system must already have been compromised by some other attack. 

Once this access is secured, the Sinkclose vulnerability allows the perpetrators to install bootkit malware that evades detection by standard antivirus tools, remaining nearly invisible within the system and can persist even after the operating system is reinstalled.  

The vulnerability leverages an ambiguous feature in AMD chips known as TClose, which is meant to maintain compatibility with older devices. By manipulating this feature, the researchers were able to redirect the processor to execute their own code at the SMM level. This method is complex but provides attackers with deep and persistent control over the system. 

This is pretty bad. But to be clear, a threat actor needs to already have access to your system to pull off this attacks. But AMD has acknowledged this and has said that they will push out fixes for these soon, if they’re not already out.

Now let’s go over to Intel who has some serious stability issues with their processors:

Alderon Games revealed that it had observed a nearly 100% failure rate of Raptor Lake processors in its own testing. Telemetry from end customers reports thousands of Raptor Lake CPUs crashing in customers’ gaming PCs. Alderon Game’s own development systems utilizing Raptor Lake CPUs also suffer from frequent instability, leading to SSD and memory corruption. On top of this, the studio’s dedicated game servers leveraging Raptor Lake parts experience “constant crashes” to the point where they are taking entire servers down. 

The studio’s benchmarking tools also show failures with Raptor Lake parts, specifically decompression and memory tests unrelated to its Path of Titans game, which the company is developing.

The worst part is that Alderon Gamers has observed CPU deterioration over time, specifically over three to four months. Initially, the chips will work fine but eventually start failing. Microcode, BIOS, and firmware updates have failed to resolve these stability problems for the game studio.

So, unlike AMD who can push out fixes that will address their issues, Intel’s chips will eventually fail. That’s in my mind makes Intel’s issues worse than AMD. And after a lot of inaction from Intel, the company is finally admitting to the issue, which dates back to 2022, and is doing something about it:

Intel has announced that it has found the root cause of the crashing issues plaguing its CPUs. The company will issue a microcode update to address the issues by mid-August, ostensibly ending the long-running saga that began when the first sporadic reports of CPU crashing errors surfaced in December 2022 and grew to a crescendo by the end of 2023. Intel’s response comes after complaints about the issue, which causes PCs to inexplicably crash/BSOD during gaming and other workloads, reached a fever pitch in recent weeks. However, the microcode update will not repair impacted processors. Intel also confirmed a rumored issue with via oxidation in its 7nm node, but said those issues were corrected in 2023 and didn’t contribute to the failures.

Intel’s advisory says an erroneous CPU microcode is the root cause of the incessant instability issues. The microcode caused the CPU to request elevated voltage levels, resulting in the processor operating outside its safe boundaries. Intel is now validating a microcode patch to correct the issues, with its release slated for mid-August. This patch will be distributed through BIOS updates from motherboard OEMs and via Windows updates, so the timing for end-user availability could vary. 

The bug causes irreversible degradation of the impacted processors. We’re told that the microcode patch will not repair processors already experiencing crashes, but it is expected to prevent issues on processors that aren’t currently impacted by the issue. For now, it is unclear if CPUs exposed to excessive voltage have suffered from invisible degradation or damage that hasn’t resulted in crashes yet but could lead to errors or crashes in the future.

Intel advises all customers having issues to seek help from its customer support. Because the microcode update will not repair impacted processors, the company will continue to replace them. Intel has pledged to grant RMAs to all impacted customers.

Here’s another reason why Intel’s issues are worse than AMD’s issues:

Intel’s problems are beginning to catch up in a major way with the chipmaking behemoth. Just a couple of days after the company revealed via a community board post that the cause of 13th Gen “Raptor Lake” and 14th Gen “Raptor Lake Refresh” desktop processor (CPU) instability had been discovered in more chips than first thought, the Abington Cole + Ellery law firm began a class action lawsuit investigation.

The law firm — based in Tulsa, Oklahoma, with a focus on class action litigation — is currently gathering information from users who have experienced issues with the Raptor Lake chips.

And yet another reason:

Intel’s nightmare year continues. Fresh on the heels of laying off 15,000 employees and amidst a class action lawsuit about failing 13th Gen and 14th Gen CPUs, Intel now faces a lawsuit from its shareholders. The lawsuit claims that Intel hid issues that led to the company’s market value dropping $32 billion in one day.

“[The] company’s materially false or misleading statements regarding the business and its manufacturing capabilities inflated its stock price from Jan. 25 to Aug. 1,” claims the suit.

Intel CEO Patrick Gelsinger and CFO David Zinsner are the respondents of the lawsuit, which was filed on Wednesday, August 7, 2024 in San Francisco federal court. According to Reuters, Intel shareholders were blindsided by the fact that Intel’s foundry services are “floundering,” in the words of the shareholders.

So while AMD can fix the issues with their products and eventually move on, Intel is facing so much trouble that it could “end” them. Or at the very least hobble them to such a degree that they are never going to be anywhere near the top of the pile when it comes to chipmaking ever again.

Sucks to be Intel.

Vulnerabilities In Google’s Quick Share Data Transfer Utility For Windows Outlined At DEF CON

Posted in Commentary with tags on August 10, 2024 by itnerd

This year at DEF CON 32, two members of the SafeBreach Labs team, Or Yair and Shmuel Cohen will present their research “QuickShell: Sharing is caring about an RCE attack chain on Quick Share” by Or Yair and Shmuel Cohen.” This research will explore Google’s Quick Share, a peer–to-peer data-transfer utility for Android, Windows, and Chrome operating systems. Leveraging communication protocols like Bluetooth, Wi-Fi, Wi-Fi Direct, Web real-time communication (WebRTC), and near-field communication (NFC), Quick Share supports file transfers between compatible, nearby devices. 

The research revealed ten vulnerabilities in Quick Share’s Windows application that the researchers were able to assemble into a remote code execution (RCE) attack chain that allowed them to run code on Windows computers with Quick Share installed. In response to the findings, Google assigned two CVEs: one regarding a forced persistent Wi-Fi connection exploit (CVE-2024-38271) and another for a file approval dialog bypass in Windows (CVE-2024-38272). This research reveals the security challenges introduced by the complexity of a data-transfer utility attempting to support so many communication protocols and devices. It also underscores the critical security risks that can be created by chaining seemingly low-risk, known, or unfixed vulnerabilities together.

You can read the research here.

Iran Is Trying To Mess With The US Elections Says Microsoft

Posted in Commentary with tags on August 9, 2024 by itnerd

From the “why am I not surprised” department comes this from Microsoft. Researchers for Microsoft said that Iran government-tied hackers tried breaking into the account of a “high ranking official” on the U.S. presidential campaign in June:

“A group run by the Islamic Revolutionary Guard Corps (IRGC) intelligence unit sent a spear-phishing email to a high-ranking official of a presidential campaign” and “another group with assessed links to the IRGC compromised a user account with minimal access permissions at a county-level government,” the report said.

It said the activity appeared part of a broader push by Iranian groups to gain intelligence on U.S. political campaigns and target U.S. swing states. It said the county employee’s account was breached in May as part of a wider “password spray operation” – one where hackers use common or leaked passwords en masse on many accounts until they can break into one.

The hackers weren’t able to access any other accounts through that breach and the targets were notified, the report added.

And that’s not all. It looks like Iran is trying to use other means to bend the US election in ways that help Iran:

The researchers also said another Iranian group had been launching “covert” news sites that used artificial intelligence to lift content from legitimate news sites, and targeted U.S. voters on opposite sides of the political spectrum. It named the two sites as Nio Thinker — a left-leaning site — and a conservative site called Savannah Time.

When browsed on Friday, both websites had similar formats on their ‘About Us’ page, and neither listed any contact detail. Nio Thinker calls itself “your go-to destination for insightful, progressive news and analysis that challenges the status quo”, while Savannah Time says it is “a reflection of the values that make Savannah unique” and a place “where conservative values meet local insight.”

None of this surprises me. I fully expected threat actors from countries like Iran, Russia and China to try and mess with the US elections. The only thing that does surprise me that none of these warnings are new. But they seem to have gone unheeded. That’s a huge problem as it is pretty clear that the country isn’t prepared for something that they should have been prepared for.

Palo Alto’s 2024 Incident Response Report From Unit 42 Is Out

Posted in Commentary with tags on August 8, 2024 by itnerd

Palo Alto Networks , the leader in cybersecurity, has released a new 2024 Incident Response Report from Unit 42.

This report details the most exploited attack vectors of the past year. It also spotlights the cybercriminal group known as Muddled Libra and analyzes its most successful attack patterns to determine how the most sophisticated attackers may attempt to breach your defenses.

Unit 42 found that software vulnerabilities are often the main attack entry point, sophisticated attacks often involve the exploitation of multiple attack vectors, including compromised credentials, phishing, and brute force methods.

While cybersecurity can often feel like an endless battle between attackers and defenders. At Unit 42, we believe intelligence, insight, and preparation still gives defenders the edge needed to protect themselves.

You can read the report here.

Ticked Off Delta Passengers Sue Delta Over The CrowdStrike Snafu

Posted in Commentary with tags on August 8, 2024 by itnerd

Here’s a new twist in the Delta Airlines gets taken down by the CrowdStrike snafu. Passengers who were affected by Delta getting taken down by the CrowdStrike snafu are now suing Delta. The lawsuit, filed by Sauder Schelkopf and Webb, Klase & Lemond on behalf of Delta passengers whose flights were canceled, alleges the following:

“[b]y the end of the weekend, nearly every airline had managed to recover and resume normal operations. Delta, however, did not resume normal operations. By the start of the workweek, Delta continued to cancel a staggering number of flights. On Monday, July 22, it was reported that Delta canceled more than 1,250 flights. These cancellations accounted for nearly 70% of all flights within, to, or from the United States that had been canceled on Monday. No other US airline had canceled one-tenth as many flights.”  It is further alleged that Delta failed to give some affected passengers automatic refunds for canceled flights and often times conditioned its offer of partial reimbursements to passengers on a waiver releasing Delta of all legal claims passengers have against Delta.

And:

“While nearly every other airline recovered quickly from the July 19th ‘Tech Outage,’ Delta’s passengers remained stranded, waiting in lines for days trying to get to their destinations. When our clients sought refunds, Delta again failed to deliver. We look forward to litigating the case on their behalf,” said Joe Sauder of Sauder Schelkopf, an attorney for the passengers.

You can bet that Delta saw this coming. Which is likely why they are going after CrowdStrike for compensation. It will be interesting to see two things. One, if this gets certified as a class action lawsuit. And two, If Delta somehow drags CrowdStrike into this on top of their other pending legal action against them.