adplus-dvertising
Connect with us

Tech

It could take years for applications using vulnerable version of Java log4j library to be patched, says expert – IT World Canada

Published

 on


Infosec leaders around the world are being urged to heed warnings from national computer emergency teams, software suppliers and cybersecurity experts about a critical logging-related vulnerability in Apache, Apple iCloud and other business applications. Managed service providers are likely also affected, say experts.

The bug, CVE-2021-44228, affects a Java logging package called log4j. It was revealed Thursday by Lunasec and on Friday by Huntress Labs, and is already being exploited, according to an alert from the Canadian Centre for Cyber Security. The U.S. Cyber Security and Infrastructure Security Agency also issued a notification.

Huntress reports that ConnectWise has issued advisories and concerns for ConnectWise Manage installations, N-able has confirmed that its RMM and N-Central are affected, and one researcher says the UniFi controller platform is also vulnerable.

300x250x1

Log4j is a library that helps IT administrators create logs. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from Lightweight Directory Access Protocol (LDAP) servers when message lookup substitution is enabled, says the National Institute of Standards and Technology (NIST).

The vulnerability is in log4j versions 2.0-beta9 to 2.14.1. Within hours of being notified, Apache issued version 2.15.0 for application developers; it disables message lookup substitution by default. Oracle has also distributed the patch. However, developers now have to push out updates for their applications, which may give time for exploitation to attackers. In the meantime, IT managers will have to rely on advice from application providers to apply mitigations.

Adobe also says Java 7+ users should migrate to version 2.8.2 or avoid using the socket server classes. Java 6 users should avoid using the TCP or UDP socket server classes, or they can manually backport the security fix from 2.8.2.

Many open source projects like the Minecraft server, called Paper, have already begun patching their usage of log4j, according to LunaSec

In an interview, Johannes Ullrich, dean of research at the SANS Institute, predicted it will take years for organizations and cloud providers to patch their applications to close this hole. Oracle is still patching some of its applications from different log4j vulnerabilities discovered several years ago, he pointed out.

“This is one of those issues like Java (Apache) Struts and Heartbleed, where we have a library included in tons and tons of mission-critical software. The exploit allows you to completely take over a system it’s running on. It will be an absolute nightmare to patch this vulnerability in large enterprise environments.”

One worry is that threat actors may have already exploited the vulnerability, he said, so patching for them is too late.

Asked what IT managers should be doing, Ullrich said they should be trying to identify software in their environments that includes log4j. “If the software is written in Java then it’s often using log4j. There are some configuration changes that you can make that may help. Depending on how the library’s being used, it may not even reach those configuration changes if you link them back to an application’s configuration file.

“You may be able to add additional security around an application, like additional firewall rules and intrusion protection rules that block the vulnerability. Try to find whatever mitigating rule you can find to add additional layers to sort of put ‘bubble wrap’ around those applications.”

The notice from LunaSec includes temporary mitigations, he added.

The vulnerability can be triggered by an attacker sending a string from a server to an application with a vulnerable version of log4j. A threat actor might supply special text in an HTTP User-Agent header or a simple POST form request, says Huntress.

Huntress has created a tool to help IT departments test whether their applications are vulnerable.

Arshan Dabirsiaghi, co-founder and chief scientist at Contrast Security, said that any Java application that logs data uses log4j. It’s the most popular logging framework in the Java ecosystem and is used by millions of applications. “Make no mistake, this is the largest Java vulnerability we have seen in years. It’s absolutely brutal,” he said.

“There are three main questions that teams should answer now—where does this impact me, how can I mitigate the impact right now to prevent exploitation, and how can I locate this and similar issues to prevent future exploitation?”

In an end-of-the-week news commentary, SANS Institute instructor Chris Elgee said  the discovery of this vulnerability is a case for continuous in-house pentesting for organizations large enough to support it. “Apache log4j is one of those web application plumbing components that many companies won’t know they’re using – much like Apache Struts 2. In fact, if you’re running Struts 2, you’re likely running a vulnerable version of log4j. Further, much like Struts vulnerabilities, it’s the kind of flaw that generally needs to be checked actively and won’t come up in typical vulnerability scans.”

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Tech

Nothing Ear And Nothing Ear (a) Earbuds Are 1st With ChatGPT Integration – Forbes

Published

 on


London-based Nothing Tech has just launched new earbuds, two pairs, in fact. The Nothing Ear and more affordable Nothing Ear (a) have just gone on sale—you can read Forbes contributor Mark Sparrow’s review of both pairs here. And now, the company has announced a cool new feature: and industry-first integration with ChatGPT. It comes with strings, though.

The new earbuds have just been announced and are available to pre-order from nothing.tech now and go on sale from Monday, April 22. If you’re in London, and you want to be among the very first to get the earbuds, you can snap them up in the Nothing Store Soho a little bit sooner, from Saturday, April 20 (click-and-collect is available).

From launch, the company said, “it will enhance its overall user experience with industry-first ChatGPT integrations in its audio and smartphone products.”

300x250x1

Nothing goes on that it wants “to advance consumer tech products’ transition to AI, as well as simplify and enhance the user experience.”

It means users will be able to pinch the earbud to directly speak to ChatGPT to ask questions and hear responses in the earbuds. Nothing is also introducing new elements to Nothing phones, such as widgets which make it easy to talk to ChatGPT on the handsets. Other features include being able to send screenshots directly to ChatGPT and a clipboard shortcut for sending text.

So, what are the catches?

Although the Bluetooth new earbuds will work with any iPhone or Android phone, and there are dedicated Nothing apps for each platform, the ChatGPT integration is more limited for now.

function loadConnatixScript(document)
if (!window.cnxel)
window.cnxel = ;
window.cnxel.cmd = [];
var iframe = document.createElement(‘iframe’);
iframe.style.display = ‘none’;
iframe.onload = function()
var iframeDoc = iframe.contentWindow.document;
var script = iframeDoc.createElement(‘script’);
script.src = ‘//cd.elements.video/player.js’ + ‘?cid=’ + ’62cec241-7d09-4462-afc2-f72f8d8ef40a’;
script.setAttribute(‘defer’, ‘1’);
script.setAttribute(‘type’, ‘text/javascript’);
iframeDoc.body.appendChild(script);
;
document.head.appendChild(iframe);

loadConnatixScript(document);

(function()
function createUniqueId()
return ‘xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx’.replace(/[xy]/g, function(c) 0x8);
return v.toString(16);
);

const randId = createUniqueId();
document.getElementsByClassName(‘fbs-cnx’)[0].setAttribute(‘id’, randId);
document.getElementById(randId).removeAttribute(‘class’);
(new Image()).src = ‘https://capi.elements.video/tr/si?token=’ + ’44f947fb-a5ce-41f1-a4fc-78dcf31c262a’ + ‘&cid=’ + ’62cec241-7d09-4462-afc2-f72f8d8ef40a’;
cnxel.cmd.push(function ()
cnxel(
playerId: ’44f947fb-a5ce-41f1-a4fc-78dcf31c262a’,
playlistId: ‘aff7f449-8e5d-4c43-8dca-16dfb7dc05b9’,
).render(randId);
);
)();

The earbuds must be paired with a Nothing handset. From today, the feature works with the premium model, the Nothing Phone (2), providing it’s running the latest software. The earlier Nothing Phone (1) and more recent, more affordable model, Nothing Phone (2a) will need to wait for a software update, which Nothing says is “coming soon”.

Also coming in the future is compatibility with earlier Nothing earbuds, that is the Ear (1), Ear (2) and Ear (Stick).

The new earbuds are very keenly priced. Ear costs $149 (£129 in the U.K.), while Ear (a) is $99 (£99 in the U.K.). Both pairs have active noise-cancelling, which is not commonplace at this price point. The more expensive Ear has a wireless charging case and a feature to create a personal sound profile. Both pairs come in black and white finishes, with Nothing’s trademark transparent design in the earbuds and charging case. But the Nothing Ear (a) has an eye-catching extra: a tremendous yellow-finish option.

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Tech

U of T Engineering PhD student is working to improve the sustainable treatment of Ontario's drinking water – U of T Engineering News – U of T Engineering News

Published

 on


Growing up in a small neighbourhood in Cameroon, Maeva Che (CivMin PhD student) was aware of challenges of accessing clean drinking water. 

“Experiencing that exposure to water issues and challenges with sustainable access to safe drinking water ignited my interest in water treatment,” Che says.  

Che’s drive to improve water quality around the globe brought her to the Drinking Water Research Group (DWRG) at University of Toronto’s Faculty of Applied Science & Engineering, where she is researching innovative solutions to address local water issues.  

300x250x1

Che is working under the supervision of Professor Ron Hofmann (CivMin), who is a member of the DWRG. Her research focuses on removing unpleasant taste and odour compounds in Ontario’s drinking water by promoting the biodegradation of these compounds through granular activated carbon (GAC) filtration. 

The project is supported by a five-year Natural Sciences and Engineering Research Council of Canada (NSERC) Alliance grant called Advanced and Emerging Issues in Drinking Water Treatment. 

GAC filtration is a water treatment process that uses granular activated carbon, which is made from organic materials that are high in carbon, such as wood, coal or coconut shells. These materials are heated in the absence of oxygen through a process known as pyrolysis and prompted chemically or physically to produce the activated carbon. The activation enhances the material’s adsorption properties, making it productive to remove contaminants from water.  

While GAC filtration is an effective treatment process, its adsorptive capacity is limited. The adsorptive capacity of GAC is expected to become exhausted after about three years in service and drinking water treatment utilities must replace the GAC. Aside from the inconvenience, replacing GAC is costly.  

Che is working on alternative ways to remove contaminants using GAC filtration, specifically through biodegradation. When the filtration has been in service for a while, there is the growth of micro-organisms on the GAC, which can be useful for removing contaminants.   

PhD student Maeva Che works with filtration systems research at the Drinking Water Lab in the Department of Civil & Mineral Engineering. (photo by Galina Nikitina)

“Think of biodegradation as the useful bacteria on the GAC feeding on the contaminants in the water, thereby removing them,” says Che. 

“If the GAC has enough good bacteria that is biodegrading the compounds, the GAC may not need to be replaced when its adsorptive capacity becomes exhausted. This can extend the filter’s lifetime, resulting in cost benefits for treatment utilities.” 

In other words, biodegradation can potentially enhance the performance of GAC filters. 

Che and the DWRG will collaborate with water treatment plants to determine methods that can enhance the biodegradation of taste and odour compounds within their GAC filters.  

Currently in its initial phase, the project is taking place alongside the Peterborough Utilities Group’s drinking water treatment plant, where Che is conducting pilot-scale filtration studies with support from the Peterborough Utilities Commission. They plan to extend this research to other partner treatment plants in the future. 

Working with various water treatment plants across Ontario, Che will also assess the effectiveness of GAC filters in removing non-traditional taste and odour compounds, which are not commonly monitored. 

To achieve this, she’ll evaluate filter performance for two common taste and odour compounds — 2-methylisoborneal and geosmin — and eight additional non-traditional compounds that can cause taste and odour events. This involves collecting GAC and water samples from the plants and conducting lab-scale filtration tests, called minicolumn tests. This test, developed by the DWRG, allows to differentiate between adsorption and biodegradation in GAC filters. 

Minicolumn tests provide crucial insights into the performance of the GAC filters in terms of the adsorption and biodegradation of contaminants. To distinguish between these mechanisms, researchers use parallel minicolumns. One minicolumn operates under conditions where the biological activity of micro-organisms is suppressed, which isolates the adsorption process. The second minicolumn operates without biological suppression, allowing both adsorption and biodegradation to occur. 

“Many plants are unaware of their filters’ performance for other compounds, aside from the two common ones, that also contribute to taste and odour events in water. Our project, therefore, plays a crucial role in expanding the understanding of this,” Che says. 

Project partners include the Ajax Water Supply Plant and the Barrie Surface Water Treatment Plant.  

The DWRG is made of approximately 30 graduate students, post-doctoral fellows, research managers and associates who collaborate with local, national and international industry and government organizations to address a wide range of projects related to municipal drinking water. 

Che credits her experience as a master’s student with the research group as a major factor in her decision to pursue a PhD at the University of Toronto.  

“During my master’s degree with the DWRG, I worked on projects that improved drinking water quality, gaining hands-on experience at treatment plants. Seeing the results of my research reinforced my decision to pursue my PhD here,” Che says. 

Ultimately, Che hopes to make a significant impact in the field — and the DWRG provides opportunities to achieve this, with a supportive community of researchers and supervisors.  

“My goal is to continue researching and developing sustainable solutions for drinking water treatment that benefit communities in need,” she says. 

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Tech

Huawei's latest flagship smartphone contains no world-shaking silicon surprises – The Register

Published

 on


When Huawei debuted its Mate 60 smartphone in mid-2023, it turned heads around the world after teardown artists found it contained a system-on-chip manufactured by Chinese chipmaker Semiconductor Manufacturing International Corporation (SMIC) using a 7nm process.

SMIC was thought not to be able to build that sort of thing. So while the Mate 60 didn’t differ markedly from every other modern smartphone, its very existence called into question the effectiveness of US-led efforts to prevent advanced chipmaking tech reach the Middle Kingdom.

Much speculation has therefore concerned what Huawei would deliver next, and this week the world got its answer – in the form of the Pura 70.

300x250x1

Chinese media report that early users of the device have posted details of its innards, naming the SoC as Kirin 9010 with four efficient cores running at 1.55GHz, half a dozen performance cores at 2.18GHz, and a couple of high-performance cores zipping along at 2.30GHz. All cores are Arm v8. A third-party spec sheet suggests it’s a 7nm chip – meaning Chinese chipmakers appear not to have made another unexpected advance.

Early tests suggest it outperforms the Kirin 9000 found in the Mate 60, but independent assessments are yet to emerge. The crowdsourced evaluations currently available are sometimes dubious.

What we can say with confidence is that the Pura 70 has a 6.6-inch OLED display with 120Hz refresh rate and resolution of 2,760 x 1,256. It has 12GB RAM aboard, and buyers can choose from 256GB, 512GB, or 1TB of storage.

The three rear-facing cameras on the base models can capture 50, 12, and 13 megapixels apiece.

The Pura range derives from Huawei’s P-Series handsets that stretched from the midrange to the low-end of premium, but are now focussed – pardon the pun – on photography enthusiasts. The device comes on four variants, each priced to match the four editions of Apple’s iPhone 15.

The screen on the high-end “Ultra” model grows to 6.8 inches and 2,844 × 1,260 pixels, with two rear cameras that shoot at 50 megapixels and one at 40. One of the 50MP snappers is retractable, to enhance its zooming powers.

Importantly, all models of the Pura 70 run HarmonyOS 4.2 – Huawei’s not-Android operating system.

China is all-in on HarmonyOS as the nation pursues indigenous alternatives to Western tech. In recent weeks Chinese media and government agencies have noted the growing proliferation of native HarmonyOS apps, trumpeting that developer enthusiasm for the platform means local buyers now have a more patriotic alternative.

That alternative appears to be welcome: after the debut of the Mate 60, analyst firm IDC saw Huawei’s smartphone market share improve by 36.2 percent. ®

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Trending