The attack, dubbed Trojan Source, hides malicious code from the user’s eyes.
The new technique works with some of the most widely used programming languages, and attackers can use it to attack the supply chain. The Trojan Source attack exploits the ambiguity introduced by homoglyphs and the Unicode bidirectional mechanism (Bidi), a feature used to arrange character sets from both left-to-right and right-to-left.
“The attack script implements a very simple HTTP endpoint to validate the network, which ping -c 1 google.com as well as curl -s http[:]//example.com and notifies if these commands completed successfully. The optional HTTP timeout parameter limits the execution time of the command, ”the researchers explained.
If an HTTP parameter with an invisible character is passed, it is assigned to an invisible variable. Likewise, when the checkCommands array is created, this invisible variable is included in the array.
Depending on how you design, not all text editors can highlight invisible characters. Syntax highlighting is not a reliable approach because invisible characters may not appear at all, let alone colored with an IDE text editor.
“The attack requires the text editor / IDE (and the font used) to correctly display invisible characters. At least Notepad ++ and VS Code display them correctly (in VS Code, the invisible character is slightly wider than ASCII characters), ”the experts explained.
However, some IDEs, including JetBrains WebStorm and PhpStorm, explicitly highlight these invisible characters, making it difficult to execute an attack.
The research team suggests limiting the use of Bidi Unicode characters, or banning the use of any non-ASCII characters altogether, to protect against such attacks.
Scissors undercut: Windows 11 vulnerability reveals sensitive information from screenshots, including deleted parts
A dangerous vulnerability has been discovered in one of the standard Windows 11 applications that could lead to the disclosure of sensitive information to the user. Moreover, at the moment the vulnerability is not closed and attackers can use it.
We are talking about the application Snipping Tool (Scissors). The vulnerability, called aCropalypse, allows you to undo changes made by a user when editing a screenshot, including cropped or blurred parts that hide sensitive data.
When you edit a screenshot, you can save it with the same name as the original file by overwriting it. However, as it turns out, the Windows 11 Snipping Tool does not remove the original information from the file, but simply leaves it added at the end, which is usually invisible to users. With some trickery, a potential attacker can extract hidden information from a file and see what information has been edited.
As you can see, edited screenshots are usually much larger due to the inclusion of information from the original image.
This is a pretty serious vulnerability. For example, if you share a screenshot of an order confirmation page on Amazon, it may contain an address, the same goes for credit card numbers and other sensitive data.
In 2018, Google had an AI ready for a ChatGPT-style chatbot, but it was closed due to security issues.
In recent months, the ChatGPT chatbot has been on the news pages, and this has forced many companies to catch up with OpenAI. Among them are Microsoft, Google and a number of Chinese corporations. However, reportedly, the situation could be different.
As early as 2018, Google is said to have had a natural language processing AI similar to ChatGPT. However, company executives closed the project, considering it too dangerous. One of the developers was research engineer Daniel De Freitas, and Noam Shazeer, a software engineer at Google, also contributed to the project.
The project was called Meena and was a chatbot that could talk about different topics. With him you could discuss TV shows, have discussions about philosophy and joke. At the same time, the developers believed that this technology could be added to the search engine, however, in the end, Google stopped development. The company said the bot did not meet its AI security standards.
Note that later, on the basis of these developments, the LaMDA chat bot was created, which flies into the basis of Bard. Thus, the development nevertheless reached the mass user, albeit with a great delay.
Two-way satellite communications and military-grade security. Presented smartphone Motorola Defy 2
The British company Bullitt Group and Motorola, now owned by the Chinese Lenovo, introduced a new smartphone of the protected Motorola Defy series. The highlights of the Motorola Defy 2 are support for two-way satellite communication, combined with 5G fifth-generation cellular networks, and a very durable design.
The smartphone is resistant to dust, sand, dirt and water (IP68 and IP69K) and has been tested to military standard Mil-Spec 810H for extreme high and low temperatures, humid environments, salt fog, vibration and shock. The Motorola Defy 2 can be washed with soap and water and can also be cleaned with alcohol wipes.
The smartphone itself is equipped with a 6.6-inch Full HD + display with a refresh rate of 120 Hz, an 8 MP front camera, a main triple camera (50 MP, 8 and 2 MP), SoC MediaTek Dimensity 930, 6 GB of RAM and 128 GB flash memory that can be expanded with microSD cards, and a 5000 mAh battery with support for 15W charging and Qi wireless charging.
MediaTek Bullitt and 3GPP NTN technology, Bullitt satellite messaging service are supported. The smartphone is running Android 12 operating system, two major Android updates and 5 years of security updates are promised.
The Motorola Defy 2 smartphone will be available from Q2 2023 on select carriers in North America, Latin America and Canada starting at $599.
But Intel only managed to release competitors for the Threadripper 5000. Asus confirms that the Ryzen Threadripper 7000 will be released in the second half of the year
AMD is indeed going to launch Ryzen Threadripper 7000 processors in the second half of this year. Previously, these were...
6000 mAh, 6.75 inch big screen, 48 MP for $190. Introduced the monster of autonomy Huawei Enjoy 60
Huawei has unveiled the affordable Enjoy 60 phone, which features a 6,000mAh battery (it supports 22.5W charging). With the old...
One of the quietest Radeon RX 7900 XT is available for just $800. Sapphire Pulse RX 7900 XT now $100 off MSRP
The Sapphire Pulse RX 7900 XT graphics card is another adapter that you can buy for just $800. The recommended...
Satellite communication and “space” price. Huawei Mate X3 foldable smartphone unveiled
Huawei today unveiled not only the Huawei P60 line, but also the next generation of the foldable smartphone, the Huawei...
News2 days ago
Nvidia CEO Jensen Huang wants to run the company for another 30-40 years, and then become a robot and continue to hold this post
Gaming5 days ago
News5 days ago
Nikon Z8 Full-Frame Mirrorless Camera Coming in April, May Be Cheaper Than Expected
News5 days ago
6000 mAh, 48 MP and big screen. Huawei Enjoy 60 battery monster launches March 23