Procore Contributes to the Calgary Construction Association Education Fund, Supporting Programs to Inspire Youth to Learn About the Skilled Trades

Posted in Commentary with tags on August 26, 2024 by itnerd

Procore today announced a donation to the Calgary Construction Association Education Fund to inspire youth to learn about the skilled trades. The donated funds will be used to support two initiatives, including elementary school programming that will bring skilled-trades curriculum to over 30,000 students in Calgary this fall, and the TELUS Spark Science Centre BLUPrint program. 

Calgary Construction Association, in partnership with Honour the Work, a not-for-profit organization, will deliver an innovative curriculum that will reach 850 classrooms across the Calgary Catholic School District and the Calgary Board of Education. Honour The Work was created by educators and supported by industry leaders to bridge the gap between classroom learning and real-world skilled trades careers. The program features STEAMS (Science, Technology, Engineering, Art, Mathematics and Skills) Kits, designed for students in grades 1-6. These kits offer hands-on activities that align with the curriculum and include lesson plans, digital resources, building materials, and diverse children’s books that highlight the value of skilled trades. First launched in Ontario with great success, the program is now set to pilot in Calgary schools. 

The association’s partnership with TELUS Spark Science Centre will create a series of exploration spaces called BLUprint (Build + Learn + YOU), one of the first youth programs to showcase the application of STEAM in real-world trades careers in a Canadian science centre. This new program consists of a space where youth can experience real tools, get hands-on learning related to carpentry, plumbing, and electrical trades, and understand the science connections. Youth can also learn about the trades through virtual reality.

In Procore’s most recent construction industry benchmark report How We Build Now: Technology and industry trends shaping Canadian construction, respondents consider hiring and retaining skilled labour as one of the top challenges they face over the next 12 months. Almost 30 per cent report they have been unable to take on more projects in the past three to six months due to labour shortage. Thirty-two (32) per cent fear that some of their most experienced people will retire within the next few years and take valuable knowledge with them. Twenty-seven (27) per cent agree there is too much competition in construction for talent. 

Advancing the industry through education
Procore is committed to advancing the construction industry through advocacy, education and technology. Procore.org, the company’s social impact arm, works with 15 Canadian universities and colleges to provide complimentary training, tools and certifications designed to get students up to speed quickly with the latest technology. In Alberta, Procore.org partners with Southern Alberta Institute of Technology (SAIT), Northern Alberta Institute of Technology (NAIT), University of Alberta and Red Deer Polytechnic. 

This year, Procore.org launched an Educators’ Training Centre for instructors with educational resources such as presentations, student exercises, sample project data, and a special video certification course for Canadian students.

Leave a comment »

Telegram CEO Arrested In France…. And That Gets Elon Musk’s Attention

Posted in Commentary with tags , on August 26, 2024 by itnerd

Over the weekend, news filtered out that the CEO and Founder of Telegram, Pavel Durov was arrested by French authorities after he landed at an airport outside of Paris. The reason for the arrest is that this is part of an investigation where it is alleged that Telegram failed to moderate content on the Telegram platform that may have facilitated criminal activity.

Telegram for its part had this to say:

“Telegram abides by EU laws, including the Digital Services Act — its moderation is within industry standards and constantly improving,” Telegram said in a statement on the arrest.

“Telegram’s CEO Pavel Durov has nothing to hide and travels frequently in Europe,” it said. “It is absurd to claim that a platform or its owner are responsible for abuse of that platform.”

That led Elon Musk to post this:

You can see why Durov’s arrest would be concerning to Elon. He’s under fire from the EU for not moderating content on Twitter. So if he angers the EU enough, he might be the next guy that they arrest at an airport. That must scare the daylights out of him as he’s likely someone who wouldn’t be able to survive 10 seconds inside of a jail cell. In any case, I’ll be watching this closely as this might be a sign of things to come for any company in the social media space that operates in Europe.

2 Comments »

The Midyear Edition Of The Flashpoint Cyber Threat Intelligence Index Is Live

Posted in Commentary with tags on August 26, 2024 by itnerd

This morning, Flashpoint released its midyear Cyber Threat Intelligence Index, with new data and trends surrounding both persistent and emerging cyber threats observed from January 1 to June 30, 2024. The report includes research and data tied to vulnerabilities, information-stealing malware, ransomware and insider threats.

Some of the most significant/interesting findings include:

  • 17,518 newly discovered vulnerabilities in H1 
  • 13 million devices infected by cybercriminals 
  • 53 million compromised credentials
  • 456 million stolen or leaked credentials.
  • 8,497 unique instances of insider recruiting

Additionally, the report outlines the primary geographies and industries targeted by ransomware groups this first half of the year. 

I have two quotes from Flashpoint executives on this report:

  • Josh Lefkowitz, CEO at Flashpoint: “The cyber threat landscape is increasingly volatile and interconnected. Vulnerabilities and exploits are on the rise and threat actors are exploiting these weaknesses. Flashpoint sees the deployment of infostealers as the top trend spiking in 2024 thus far. They have already infected over 13 million devices this year and stolen vast amounts of data, fueling a surge of ransomware attacks and data breaches at large. Organizations need to prioritize infostealers accordingly and take proactive steps to defend their people and assets.”
  • Ian Gray, VP of Intelligence at Flashpoint: “Flashpoint’s data reveals an alarming trend: threat actors have infected over 13 million devices with infostealers this year, resulting in the theft of 53 million credentials, further fueling the ransomware problem. While organizations grapple with external threats, the over 8,400 instances of malicious insider activity highlights the need for a proactive, risk-based approach that is powered by comprehensive intelligence.”

The Cyber Threat Intelligence Index report is live here. There’s also a related blog post that can be found here. 

Leave a comment »

DMZ’s Basecamp showcases the next generation of startups and awards over $50,000 in cash prizes to student-led businesses

Posted in Commentary with tags on August 26, 2024 by itnerd

 DMZ, a global startup ecosystem, officially concluded its annual Basecamp program, where 55 student-led businesses had the opportunity to participate in a summer program to develop technology-driven solutions that address critical industry challenges, equipping them with foundational business skills to thrive in an entrepreneurial career. 

As an inaugural recipient of the Embark Student Foundation Major Grant Program, the 2024 Basecamp program was offered in two phases: Sprint and Voyage. Basecamp Sprint offered a 4-week pitch coaching experience that provided students the chance to pitch their business ideas at Collision, North America’s premier tech conference. Following the Sprint phase, all participants continued their journey in Basecamp Voyage, an 8-week comprehensive program designed to help students refine their innovative ideas through expert 1-on-1 mentoring, customized coaching and opportunities to connect with startups and industry experts within Canada and DMZ’s global network. 

Basecamp concluded with ten student-led startups competing for cash prizes at the highly anticipated Basecamp Demo Day pitch competition. Demo Day awarded $50,000 CAD in total grant prizes to the top three pitch finalists. Award winners included:

  • Glucosense, a HealthTech startup founded by Justin Allen and Tenzin Dhonyoe from Toronto Metropolitan University, was named the first-place winner and took home $20,000 CAD. 
  • PNYX, an Entertainment startup founded by Asar Qadir from Metalworks Institute/Yorkville University, was named the second-place winner and took home $15,000 CAD, as well as the People’s Choice award, voted by the audience. 
  • Summina, a HealthTech startup founded by Sylvia Gehring from Toronto Metropolitan University, was named the third-place winner and took home $10,000 CAD. 
  • Fresh AI, a RetailTech startup founded by Krish Bhoopati from Wilfred Laurier University, was named the fourth-place winner and took home $5,000 CAD. 

The 2024 Basecamp program set new records, doubling the number of startups supported and drawing the highest number of applications in the program’s history. For the first time, Basecamp expanded its reach internationally, welcoming students from DMZ’s global hubs including Qatar’s University of Doha for Science and Technology and Japan’s Yamanashi Prefectural University. 

The prestigious $20,000 grand prize was generously provided by The George and Helen Vari Foundation in honour of the late Dr. Helen Vari for her lifelong dedication to education.  

As part of DMZ’s Talent Academy, Basecamp is just one of the expert-led tech and business programs available. If you’re an entrepreneur or professional looking for mentored, hands-on learning and a downtown Toronto co-working space, check out DMZ’s SkillHouse upcoming courses at dmz.to/SkillHouse.

Leave a comment »

Elon Musk Gets Sued For Stiffing Server Company Over Server Parts

Posted in Commentary with tags on August 25, 2024 by itnerd

Elon Musk has been sued again. I guess he likes being sued or something. In any case he’s being sued for stiffing a company named Wiwynn for stiffing them for $120 million in server parts:

Taiwanese tech firm Wiwynn is suing the social media giant formerly known as Twitter for $61 million over claims it refused to pay for around $120 million in server parts after Musk took over in 2022.

It adds to the avalanche of lawsuits Musk is still facing over his takeover of X, with numerous former executives also suing the billionaire over millions in unpaid severance.

According to the complaint, filed in the Northern District Court of California last week, Wiwynn claims the company violated a 2014 purchasing agreement to provide Twitter with custom IT products.

The Taiwanese firm says that in November 2022, shortly after Musk dramatically took over the social media giant, Twitter “abruptly stopped” making any payments to Wiwynn and failed to respond to Wiwynn’s request for payment for completed products.

The complaint also says that Wiwynn, which makes servers and storage systems for data centers and cloud providers, had amassed $120 million worth of parts to fulfill Twitter’s existing orders, under the assumption that Twitter had taken liability for them.

You have to wonder why Elon thinks that being continuously sued is a great business strategy. The legal bills alone must be insanely expensive. And factoring in the fact that Twitter is bleeding cash and Elon is likely going to sell Tesla stock to finance Twitter, this seems like a #fail from a strategy perspective. But Elon isn’t known for being smart. Thus I guess that he’s okay with this.

Leave a comment »

Other World Computing (OWC) Announces Labor Day Sales Event

Posted in Commentary with tags on August 24, 2024 by itnerd

 Other World Computing (OWC), a trusted leader in delivering high-performance, secure, and sustainable technology solutions that enhance and extend the life of Macs and PCs, today announced its much-anticipated Labor Day Sale. This year, customers can take advantage of incredible savings on a wide range of OWC products, designed to power their creativity, productivity, and digital workflows.

Exclusive Labor Day Deals Include:

  • OWC Travel Dock E – $10 off, only $49.99 – The best mini-sized dock to connect, charge, display, and import on-the-go via one integrated cable
  • OWC Thunderbolt Go Dock – $30 off, only $269.99 – The first full-featured Thunderbolt dock without a bulky, heavy power adapter, so you can go anywhere easily and connect it all with Thunderbolt and USB-C Macs, PCs, iPads, Chromebooks, and Android devices.
  • OWC Envoy Pro mini – Up to $50 off – Full-sized SSD performance that fits in your pocket.
  • OWC Envoy Pro FX – Up to $100 off – The Fastest Most Compatible Drive Ever Made with Speeds up to 2800MB/s.
  • OWC Gemini – Up to $200 off – Thunderbolt Dock and Dual-Bay RAID external storage enclosure for 2.5-inch and 3.5-inch SATA drives.

In addition, OWC is also offering deep discounts on used Macs and iPads, with some deals reaching up to 72% off. Such as:

  • 69% off the Travel-Friendly 13-inch MacBook Pro – Retina / Touch Bar / Mid 2020-Late 2021 – Combines impressive performance in a sleek design, featuring a powerful processor, an enhanced keyboard for an exceptional user experience, and all day battery life.
  • Perfect-Sized iMac Perfection – from $239.00 – Retina 4K / 21-inch – This iMac is a hit with its compact size, powerful performance, and stunning Retina display.

And, so much more!

This is the perfect opportunity for customers to upgrade their tech at unbeatable prices!

These deals are available now through macsales.com through September 4th, while supplies last.

Leave a comment »

Traccar 5 Remote Code Execution Vulnerabilities Found By Horizon3.ai

Posted in Commentary with tags on August 24, 2024 by itnerd

Naveen Sunkavally, chief architect at Horizon3.ai, has just published “Traccar 5 Remote Code Execution Vulnerabilities” detailing two related path traversal vulns affecting the popular open source GPS tracking system that could lead to remote code execution: CVE-2024-31214, reported by Horizon3.ai, and CVE-2024-24809, reported by @yiliufeng168. 

The post includes four methods and three proof-of-concept (POC) ways by which these vulnerabilities can be exploited by unauthenticated attackers through RCEs if guest registration is enabled, which is the default configuration for Traccar 5. 

Horizon3.ai reported the vulnerabilities in early April 2024. After the disclosure, the maintainer fixed the path traversal in the Content-Type header and locked down the file extensions to a known set. The maintainer also changed the guest registration setting to be off by default in Traccar 6, per Horizon3.ai’s recommendation, which significantly reduces the attack surface available to unauthenticated attackers and will have a lasting impact on improving the security posture of Traccar for years to come.

Naveen urges that both CVE-2024-31214 and CVE-2024-2809 be treated as critical issues because guest registration is on by default in Traccar 5, effectively allowing unauthenticated access.

Traccar 5 Remote Code Execution Vulnerabilities: https://www.horizon3.ai/attack-research/disclosures/traccar-5-remote-code-execution-vulnerabilities/

Leave a comment »

Horizon3.ai Publishes New Findings Related To NTLM Credential Theft in Python Windows Apps

Posted in Commentary with tags on August 23, 2024 by itnerd

Naveen Sunkavally, chief architect at Horizon3.ai, has just published new research called: “NTLM Credential Theft in Python Windows Applications.” 

“NTLMv2 hash theft is a well-known credential harvesting technique made possible by the insistence of Windows to automatically authenticate to anything it possibly can. It’s a staple technique used in internal pentests with tools such as responder or ntlmrelayx, exploiting issues such as legacy LLMNR/NBT-NS protocols being enabled or forced authentication vulnerabilities like PetitPotam. It has also been exploited over the Internet, typically by abusing Microsoft Outlook, as described in recent cases by Proofpoint and Microsoft,” Naveen said.

When auditing web applications, NTLMv2 hash theft is possible on Windows hosts through the exploitation of Server-Side Request Forgery (SSRF) or XML External Entities (XXE) vulnerabilities. Much has been written on the topic, and new vulnerabilities continue to be found. 

Naveen details new SSRF vulnerabilities leading to NTLMv2 hash disclosure in three of the most popular Python frameworks: 

  • Gradio by Hugging Face, which powers several popular AI tools; 
  • Jupyter Server, which underpins Jupyter Notebook and JupyterLab; and 
  • Streamlit from Snowflake

The vulnerabilities Naveen exposes relate to how these Python frameworks retrieve files. Specifically, in Python, any file system operation performed on insufficiently validated input can lead to the leakage of NTLMv2 hashes. The vulnerabilities disclosed in the post can be exploited by unauthenticated attackers, and they have come up in real-world pentests conducted by NodeZero. He also covers an interesting Python bug affecting older versions of Python on Windows that could assist in NTLMv2 hash theft.

The post also recommends fix actions. Naveen concludes: “Windows is the predominant operating system in enterprises, and Python is the language of choice for AI. With AI making a big splash into the mainstream over the last few years, we’re seeing increased usage of Python applications on Windows. This comes with new risk because traditionally Python apps have been developed and run on Linux-based systems, where the security risks are different than on Windows. We believe the specific issue of NTLMv2 hash theft in Python apps is likely heavily under-reported, and something that all parties –defenders, developers, appsec practitioners, bug bounty hunters, etc. — should be on the lookout for.”

NTLM Credential Theft in Python Windows Applications: https://www.horizon3.ai/attack-research/disclosures/ntlm-credential-theft-in-python-windows-applications/

Leave a comment »

ServiceNow Research Shows That The Key to AI Adoption is Humans

Posted in Commentary with tags on August 23, 2024 by itnerd

New research is out from ServiceNow measuring AI maturity of organizations across industries shows that 56% of Canadian AI pacesetters—those who are seeing success (and ROI) deploying GenAI—are using AI in collaboration with human workers to boost efficiency.  

Prioritizing human needs in AI development is crucial to ensuring deployment is trusted and useful. AI needs to become a collaborative partner rather than just a transactional tool—a necessary step to drive the transformational change the technology promises.   

But the new research has also found that less than half of Canadian respondents (46%) say that their organization has the right mix of talent/skills to execute their AI strategy, and only 39% feel that they have good visibility into the deployment and use of AI in their organization – pointing to a need for reskilling / upskilling and AI education and governance initiatives for the organizations falling behind pacesetters.  

You can read the research here.

Leave a comment »

Samsung’s Galaxy Watch Ultra Apparently Isn’t All That Rugged…. And Samsung Apparently Won’t Have Your Back If You Run Into Issues With Your Galaxy Watch Ultra

Posted in Commentary with tags on August 23, 2024 by itnerd

Well, this has to be embarrassing for Samsung. A Reddit post has an unlucky owner of a Samsung Galaxy Watch Ultra who had the action button fall off on him about a month into owning it. Bad as that is, the fact that Samsung isn’t willing to help by replacing a watch that is only a month old is worse:

I received my brand new Galaxy Watch Ultra on July 20th and I posted on here a few days back about how the action button fell off. I went back and forth with Samsung trying to get them to replace it, but they refused and told me to send it in for repair because it was under warranty. I sent it in and now they are telling me that it is out of warranty and I have to pay to get it fixed. I am still going back and forth with Samsung repair and customer service, and I’m getting nowhere.

This is really bad. The watch is supposed to be designed to be rugged. So the fact that this not only happened to this Reddit user, but Samsung won’t honour the warranty really makes Samsung look shady. And it reminds me of the behaviour of ASUS when it came to warranty claims which is a story that surfaced earlier this year. The bad press forced the company to say that they would do better. But I didn’t buy that at the time and and I still don’t. How does the warranty issues of ASUS relate to Samsung? Companies aren’t bad because their products fall apart. They are bad if they don’t stand behind their product. Samsung in this case isn’t standing behind a product that was designed to be rugged, but clearly isn’t. That reflects poorly on Samsung and should make anyone who is considering buying a Samsung product think twice as clearly Samsung doesn’t have your back.

1 Comment »

« Older Entries
Newer Entries »