Shared posts

24 Jun 21:28

DFIR Core Principles

by Unknown

My copy of "Forensic Discovery"
There are a lot of folks new to the cybersecurity industry, and in particular DFIR, and a lot of folks
considering getting into the field. As such, I thought it might be useful to share my view of the core, foundational principles of DFIR, those basic principles I return to again and again during investigations, as well as over the course of time. For me, these principles were developed initially through a process of self-education, reading all I could from those who really stood out in in the industry. For example, consider the figure to the right...this is what pages 4 and 5 of  my copy of Forensic Discovery by Farmer and Venema look like. The rest of the pages aren't much different. I also have a copy of Eoghan Casey's Handbook of Digital Forensics and Investigations, which is in similar "condition", as are several other books, including my own.

The thing we have to remember about core principles is that they don't change over time; Forensic Discovery was published in 2005, and Casey's Handbook, 5 yrs later. But those principles haven't changed just because the Windows operating system has evolved, or new devices have been created. In fact, if you look at the index for Farmer and Venema's book, the word "Windows" never appears. My last book was published in 2018, and the first image covered in the book was Windows XP; however, neither of those facts invalidate the value of the book, as it addresses and presents the analytic process, which, at it's root, doesn't significantly change.

The principles I'm going to share here do not replace those items discussed through other media; not at all. In fact, these principles depend on and expand those topics presented in other books.

Principle 1
The first thing you have to understand about computer systems is that nothing happens on a computer system without something happening; that is, everything is the result of some action.

I know this sounds rudimentary, and I apologize if it sounds overly simplified, but over the course of my career (spanning more than 2 decades at this point) in various roles in DFIR, one of the biggest obstacles I've encountered when discussing a response with other analysts is that things don't just happen for no reason. Yes, it's entirely possible that any given, random bit on a hard drive may change state due to a fluctuation of some kind, but when it comes to a field in an MFT record (deleted vs in use file) or a Registry value changing state (1 to 0, or reverse), these things do not simply happen by themselves.

Let's say, for example, that a SOC analyst receives an alert that the "UseLogonCredential" value has been set to "1". This is a pretty good detection indicating that something bad has already happened, and that something bad is likely to happen in the very near future, as well. However, this does not just happen...someone needs to access the system (via keyboard or remotely) with the appropriate level of privileges, and then needs to run an application (RegEdit, reg.exe, another program that accesses the appropriate API functions...) in order to make the change.

Principle 2
Locard's Exchange Principle is one of Chris Pogue's favorites, to the point where he discusses it in his courses at OSU! This principle states that when two objects come into contact with each other, material is exchanged between them. This applies to the digital realm, as well; when two computers come into "contact", "material" or data regarding the connection and interaction is exchanged between them. Some of this data may be extremely transient, but due to advancements in computer use functionality, the fossilization of this data begins pretty quickly. That is to say that some of these artifacts are "stored" or logged, and those log entries can exist for varying amounts of time. For example, a record written to the Security Event Log may be overwritten within a few days (or even hours, depending upon the audit configuration and activity on the endpoint), but records written to other Windows Event Logs may exist for years without the risk of being overwritten. Evidence of activity may be written to the Registry, where it may exist until explicitly removed.

But the point of this principle is that something, some artifact of activity as a user or threat actor interacts with an endpoint will be created, and may continue to exist for a significant period of time.

Principle 3
This brings us to the third principle, direct vs indirect artifacts. This is something of a reiteration of section 1.7 (Archeology vs Geology) of Farmer & Venema's book; table 1.3 at the bottom of pg 13 essentially says that same thing. However, this principle needs to be extended to address more modern operating systems and applications; that is, when something happens on an endpoint...when a program is executed, or when a user or threat actor interacts with the endpoint in some way, there are artifacts that are created as a direct result of that interaction. For example, a threat actor my copy a file over to the endpoint, writing it to the file system. Then they may execute that program, redirecting the output to a file, again writing to the file system.

Think of this as a video camera pointed directly at the "scene of the crime", recording direct interactions between the threat actor and the target victim.

There are also "indirect" artifacts, which are those artifacts created as a result of the program or threat actor interacting with the ecosystem or "environment". 

A great way to think of indirect artifacts is having video cameras near the scene of a crime, but not pointed directly at the scene itself. There may be a video camera across the street or around the corner, pointed in a different direction, but it captures video of the threat actor arriving in a car, and then leaving several minutes later. You may notice that the back seat of the car seems to be fuller than when it arrived, or the end of the car near the trunk (or "boot") may be lower to the ground, but you do not see exactly which actions occurred that resulted in these apparent changes.

A great thing about both direct and indirect artifacts is "fossilization", something mentioned earlier, and to be honest, stolen borrowed from Farmer and Venema. Everything that happens on an endpoint is the result of something happening, and in a great many cases, these artifacts are extremely transient. Simply put, depending upon where those artifacts exist in the order of volatility, they may only exist for a very short period of time. In their book, Farmer and Venema discussed "fossilization", specifically in the context of deleted files with *nix-based file systems. Operating systems have grown and evolved since the book was published, and a great deal of usability features have been added to operating systems and applications, significantly extending this fossilization. As such, while direct artifacts of user or threat actor interaction with an endpoint may not persist for long, fossilization may lead to indirect artifacts existing for days, months, or even years.

For example, let's say a threat actor connects to an endpoint; at that point, there is likely some process in memory, which may not exist for long. That process memory will be allocated, used, and then freed for later use, and given how "noisy" Windows systems are, even when apparently idle, that memory may be reused quickly. However, direct artifacts from the connection will very often be logged, depending upon the means and type of access, the audit and logging configuration of the endpoint, etc. If this process results in the threat actor interacting with the endpoint in some way, direct and indirect artifacts will be logged or "fossilized" on the endpoint, and depending upon the configuration, use, and subsequent interaction with the endpoint, those fossilized artifacts may exist for an extended period of time, even years.
16 Jun 18:58

Retrieving and translating CPUID features for a vSphere VM

by William Lam
Whether you are using the classic Enhanced vMotion Compatibility (EVC) on a vSphere Cluster or the new Per-VM EVC capability, the usable (user-level) CPU features from an ESXi host are then presented down into a Virtual Machine for consumption. If you wanted to see what which CPU features are exposed for a particular VM or […]
15 Jun 17:31

Xbox One Not Getting Any More 1st Party Games from Microsoft, “We’ve Moved on to Gen 9”

by Nathan Birch

Xbox Series X Xbox One

Pour one out for the humble Xbox One, as the console’s lifespan has finally come to an end. Well, that may be a bit dramatic, as some third-party titles will still be released on the system, but Microsoft itself has officially parted ways with its only-semi-successful Gen 8 console. During the most recent Xbox Games Showcase, all the first-party titles shown only mentioned PC and Xbox Series X/S in terms of platforms, but that could have just been a marketing thing. Sony always emphasizes the PS5 in their trailers and marketing… but then often quietly releases games on the PS4 as well. Don’t expect something similar with the XB1 going forward.

In a new interview with Axios, Xbox Game Studios boss Matt Booty stated Microsoft has “moved on to Gen 9.” And it seems he really means it -- there are currently no internal Xbox teams working on anything for Xbox One, aside from updates for long-running live-service titles like The Elder Scrolls Online. Of course, Xbox One owners can still technically get into new first-party games if they sign up for Game Pass Ultimate and play via the cloud.

The news that the Xbox One is finally being left behind may upset some still clinging to the system, but it’s likely to be a relief to many others. Given hardware shortages and the high price of next-gen consoles, the “crossgen” era, with games being released on both last and current-gen consoles, has dragged on much longer than usual. Perhaps too long, as it’s arguably limited the potential of titles that still have to design around the limitations of the XB1/PS4. Microsoft’s rival Sony has not yet committed to fully leaving the PS4 behind, but many of their upcoming games, like Marvel’s Spider-Man 2, are PS5 exclusive.

While Microsoft is leaving behind the Xbox One, don’t expect them to ditch their less powerful current-gen console Xbox Series S anytime soon. Booty has admitted getting games to work on both the Xbox Series X and S is “more work,” but internal teams have gained more experience with working around the Series S’ limitations and “sharp edges” now.

Any Xbox One owners out there? With the console’s days numbered, do you have any particularly fond memories of the system?

Written by Nathan Birch
14 Jun 19:59

Saturn’s moon Enceladus could support species similar to Earth

by Will Shanklin

Saturn’s moon Enceladus has phosphorous. The finding came from recently analyzed icy particles emitted from the natural satellite’s ocean plumes, detected by NASA’s Cassini spacecraft. The discovery means Enceladus has all the chemical building blocks for life as we know it on Earth. “This is the final one saying, ‘Yes, Enceladus does have all of the ingredients that typical Earth life would need to live and that the ocean there is habitable for life as we know it,” Morgan Cable, astrobiology chemist at NASA’s Jet Propulsion Laboratory, toldThe Wall Street Journal.

Cassini, which plunged to its demise in Saturn’s atmosphere in 2017, collected data by passing through Enceladus’ continually erupting geysers at its south pole and Saturn’s E ring, also containing escaped particles from the moon. Beneath its icy crust, Enceladus has a warm subsurface ocean, over 30 miles deep, enveloping the entire moon. The eruptions at its south pole spit icy particles into space, allowing research crafts like Cassini to study the ocean’s chemical makeup without taking a dip or even touching the moon’s surface.

NASA diagram illustrating a cross-section of the Saturn moon Enceladus. It shows the icy crust, global ocean, rocky core and active jets at the south polar region.
NASA

Data from previous missions indicated the moon had all of life’s essential building blocks — carbon, hydrogen, nitrogen, oxygen and sulfur — except for phosphorous. A team of planetary scientists found nine grains containing phosphate (phosphorous bound to oxygen atoms) among around 1,000 samples initially overlooked by researchers. The tiny amount detected reflects phosphorous’ scarcity. “Of the six bioessential elements, phosphorus is by far the rarest in the cosmos,” said Frank Postberg, the study’s lead author.

Of course, Enceladus containing the requirements for life doesn’t necessarily mean life exists on the moon. “The next step is to figure out if indeed it is inhabited, and it is going to take a future mission to answer that question,” Cable said. “But this is exciting, because it makes Enceladus an even more compelling destination to go and do that kind of search.” NASA will get a chance to learn more when the Dragonfly mission heads for Saturn’s moon Titan in 2027; another proposed mission could arrive at Enceladus around 2050. In addition, the James Webb Space Telescope may help further to illuminate the chemical breakdown of Enceladus’ warm subterranean ocean.

This article originally appeared on Engadget at https://www.engadget.com/saturns-moon-enceladus-could-support-species-similar-to-earth-182535342.html?src=rss
14 Jun 18:14

Google Could End Up Losing 80% Of Its Business If The European Union Forces The Company To Divest Its Ad Business

by Furqan Shahid

Google Could End Up Losing 80% of its Business if the European Union Forces the Company to Divest its Ad Business

There is no denying that Google dominates the online ad market, and this is something that has landed the company in hot water time and again. Now, European Union is expressing its concerns over how the search engine giant may have breached the antitrust laws and how its ad business should be broken up.

Google’s Ad business in danger as European Union cracks down on the search engine giant

The EU, in a lengthy post, talked about how the company has informed Google of a "preliminary view" where the European Union believes that the company has breached the antitrust rules pertaining to the ad business. The reason behind the EU's concern is that the search engine giant has been found favoring its own ads in the products, which, in return, is detrimental to the competition.

EU claims that one can see this in effect by observing how Google handles its AdX ad exchange. The DFP runs ad selection through AdX, while Google Ads and DV360 are responsible for handing over the buying tools for advertisers that are also running ads through AdX. This practice might seem simple on paper, but it results in other ad exchanges getting zero pieces of the pie and basically asserts Google's dominance even more than before.

EU's post also talked about how a "behavioural remedy" is not going to be enough in this case, and Google will be required to divest and break up its ad business. Which, of course, would allow Google's own advertising products outside the company.

The Commission preliminarily finds that, in this particular case, a behavioural remedy is likely to be ineffective to prevent the risk that Google continues such self-preferencing conducts or engages in new ones. Google is active on both sides of the market with its publisher ad server and with its ad buying tools and holds a dominant position on both ends. Furthermore, it operates the largest ad exchange. This leads to a situation of inherent conflicts of interest for Google. The Commission’s preliminary view is therefore that only the mandatory divestment by Google of part of its services would address its competition concerns.

Now, this does not entirely spell danger for the company. However, one thing that must be kept in mind is that this preliminary viewing is still something that the company should be worried about because this is not the first time they have faced scrutiny over its dominance. The company has to divest its ad business could result in the company taking a massive, massive loss because, based on several reports, it accounts for almost 80% of the business. Since Google Ads are not just stand-alone products and services but can also be found in other services provided by the company.

If this preliminary view does go into the ruling, then we will have to see how it turns out and whether or not there is a middle ground that can be reached with the EU where both parties are happy with the outcome.

Written by Furqan Shahid
14 Jun 10:46

Everyone seems to be losing their minds over the Windows XP Professional Key

by neozeed

algorithm being cracked.

But of course, how does that help me?

Unironically, I had purchased this for a whopping £4.68

No, really here’s the receipt. What a bargain!

Of course this is a legit copy with a legit key. But the online activation servers are all gone, and it looks like I’d have to call someone asking about my 22 year old copy of Windows, that I’ll load up and quickly forget.

Since I’m going to use QEMU, 0.90 with pcap support I thought I’d share the startup options:

set loopback=\Device\NPF_{3DF0EC5D-7FBE-46DF-ACF8-EF5D8679A473}
set vmnet1=\Device\NPF_{3BC364F4-5A15-405D-926C-C594383F0323}
qemu -m 512 -L pc-bios ^
-hda xphome.vmdk ^
-soundhw es1370 ^
-net nic,model=pcnet,macaddr=52:24:00:33:00:01 ^
-net pcap,devicename=%loopback% ^
%1 %2 %3 %4 %5 %6

I had high hopes for this thing. Clearly misplaced ambitions.

First up, it’s an upgrade version. So that means instead of installing XP I had to waste my time installing NT Workstation 3.51, then installing XP. Yuck. And of course it just want small FAT disks of the 2/4 gigabyte boundary type as it’s 1994. Not the bright future of 2002’s Windows XP.

I don’t know why Qemu 0.90 has issues with XP detecting the CD-ROM drive, but yeah that sucked. I wanted to load up some more insane SNA experiments, but there is no DLC / 802.2 driver for XP Home. wow.

At least once it’s satisfied, we can format the disk as one big happy partition, and we can get on with our lives.

Installation is rather uneventful, however we are instantly reminded that we have only 30 days to go. Since we have that nasty CD-ROM issue that means shutting down, and booting back up, but with this fun program on an ISO image, xp_activate.

I did try to make a call, to activate my Windows, but the connection was terrible and I’m not even sure if these numbers were right. No I mean I know they didn’t work.

So I did what all legit users end up doing, using the crack for my 21 year old copy of Windows.

And just a few clicks later, it was done.

Windows XP Home is activated.

I don’t know if it’s even really going to last, I didn’t try anything else, actually I already deleted it. And the XP folio is back on the bookshelf.

Not only is there no DLC, did you know you can’t uninstall TCP/IP? At least you can unbind it from your NIC. While it does have IPX/SPX there is no built in Netware client. When they said HOME they meant it!

13 Jun 17:21

SIDs are really just another a fancy way of creating unique IDs in a decentralized way

by Raymond Chen

A customer stumbled across a SID in an access control entry: S-1-15-3-1024-1365790099-2797813016-1714917928-519942599-2377126242-1094757716-3949770552-3596009590. They found the documentation on SIDs, which told them that given a SID of the form S-R-I-S..., the R is the revision ID, the I is the identifier authority value, and the S is a list of subauthorities. Applying this to the mystery SID told them that

  • R = 1, this is a revision 1 SID.
  • I = 15, the authority is 15.
  • S = 3-1024-…, subauthorities.

The customer wanted to know what subauthorities this access control entry is granting access to. They couldn’t find this SID in the list of well-known SIDs.

Access control entries grant access to SIDs. They don’t grant access to subauthorities. The subauthority is the entity that issues the SID, but that doesn’t mean that the SID grants access to the subauthority.

Suppose you find a list of “Phone numbers which are allowed to call into this conference call.” Now, in many jurisdictions, there is some structure to telephone numbers that give you information about what kind of number it is and who issued it. You take one of those phone numbers, subject it to analysis, and conclude that the phone number was issued by Contoso Telecommunications. Does that mean that Contoso Telecommunications has access to your conference calls? No. All it tells you is that the phone that is allowed to call into your conference call was issued by Contoso Telecommunications. The power to join the conference call belongs to the phone number, not to the phone number’s issuer.

Similarly, when you grant access to a SID, you are granting access to anybody who possesses that SID in their token, but that doesn’t mean that that the subauthority which issued that SID is granted access. The subauthority is merely the entity that produced the SID. Once they generate it, they don’t have any more power over that SID than anybody else.

But really, all this authority/subauthority nonsense is beside the point. The use of authorities and subauthorities is an implementation detail of SIDs.

The point of SIDs is that they are a unique ID to identify an entity that can be granted (or denied) access.

It so happens that authorities and subauthorities are a mechanism for how the system ensures that no two SIDs are the same. But that’s not really relevant to what SIDs are used for, which is to identify entities which can be granted access. What authorities and subauthorities do is allow entities to carve up the SID space and say, “Okay, I’m going to let you create new SIDs in this little corner of the SID namespace. That corner is all yours. Create SIDs there any way you like.”

Let’s go back to the SID that this customer is trying to understand.

We see that the SID begins S-1-15-3-1024-…, and if you look in winnt.h, you can see that authority 15 is assigned to SECURITY_APP_PACKAGE_AUTHORITY subauthority 3 is assigned to SECURITY_CAPABILITY_BASE_RID, and sub-subauthority 1024 is assigned to SECURITY_CAPABILITY_APP_RID. If you have a good memory, you may recall that I discussed this corner of the SID space in the past. These SIDs are app capability SIDs, and the numbers that come after the 1024 are the decimal representation of eight 32-bit values that together form the SHA256 hash of the capability name.

Bonus chatter: One commenter noted that it would be great if Process Explorer could resolve these hash-based capability SIDs into the original name. Since these are SHA256 hashes, you cannot reasonably expect Process Explorer (or anybody else) to be able to recover the original name from an arbitrary hash. If you could do that, you would use that power to do much more lucrative things than recovering app capability names! At best, Process Explorer could have a hard-coded list of app capability SIDs and their corresponding capability names. But that list is never going to be comprehensive because anybody can make up a new one by calling Derive­Capability­Sids­From­Name.

The post SIDs are really just another a fancy way of creating unique IDs in a decentralized way appeared first on The Old New Thing.

12 Jun 16:39

Best AM5 motherboards in 2024

by Matthew Connatser

AMD's Ryzen 7000 and 9000 series processors use the company's newer AM5 socket, replacing the older AM4 socket used by the first wave of Ryzen chips. The 7000 series processors utilize the best DDR5 RAM, PCIe 5.0, and USB 4.0, and there's plenty to appreciate with them. When shopping around for an AM5 motherboard, there are a few chipsets to choose from. I'll showcase some of the best motherboards available for AMD chips to aid you in building the PC of your dreams.

12 Jun 16:35

If you're regularly getting ambushed by pods of killer whales, you probably did something to piss them off [Strange]

12 Jun 02:49

Jurassic Park's Paleontologist Adviser May Have Inspired Its Main Character

by staff@slashfilm.com (Jeremy Smith)
We like Grant. We trust Grant. And this is because Grant kinda-sorta exists.

09 Jun 14:52

House of Representatives To Hold Hearing On Whistleblower's UFO Claims

by BeauHD
The House of Representatives in the United States plans to hold a hearing to investigate claims made by a whistleblower former intelligence official, David Grusch, that the US government possesses "intact and partially intact" alien vehicles. The Guardian reports: "There will be oversight of that," Comer told NewsNation. "We plan on having a hearing." Comer said he had heard about Grusch's claims, but added: "I don't know anything about it." The timing of the hearing is not yet determined, but a source familiar with the matter said a date is expected to be announced in the next few weeks. Tim Burchett and Anna Paulina Luna, Republican members of Congress from Florida and Tennessee, respectively, will lead the oversight committee investigation. Burchett is working closely with House oversight committee leaders to prepare for a hearing, the congressman's office said. The witness list for the hearing has not yet been set, so it is unclear whether Grusch will publicly testify before the oversight committee. "Congressman Burchett's office is working through logistics, including a witness list of the most credible witnesses and sources who would be able to speak openly at an unclassified hearing," a spokesperson said. Austin Hacker, a spokesman for the committee, told the Guardian in a statement: "In addition to recent claims by a whistleblower, reports continue to surface regarding unidentified aerial phenomena. The House oversight committee is following these UAP reports and is in the early stages of planning a hearing," Hacker said in a statement. "The National Defense Authorization Act for 2022 created the All-Domain Anomaly Resolution Office which coordinates among the Department of Defense, the intelligence community, Nasa, and other federal agencies to study UAPs. Americans, who continue to fund this federal government work, expect transparency and meaningful oversight from Congress."

Read more of this story at Slashdot.

09 Jun 14:49

ChatGPT Makes False Accusations Against Radio Host, Resulting In A Defamation Lawsuit Against OpenAI

by Omar Sohail

ChatGPT founded by OpenAI

Irrespective of how simple ChatGPT has made lives for millions of people when they want quick answers to queries in seconds, it cannot be ignored that the Large Language Model (LLM) would make glaring errors that were both false and misleading. Unfortunately for OpenAI, the entity behind ChatGPT’s creation, those errors have landed the company in hot waters thanks to a lawsuit filed by a radio host.

Radio host has filed a defamation lawsuit against OpenAI as ChatGPT generated answers related to the host’s history of crimes, which ended up being false

Mark Walters, a radio host in Georgia, is suing OpenAI because ChatGPT made responses that the host had been accused of defrauding and embezzling funds from a non-profit organization. According to The Verge, the LLM generated the information after receiving an inquiry from a journalist named Fred Riehl. The lawsuit was filed on June 5 in Georgia’s Superior Court of Gwinnett County, with Walters seeking monetary compensation from OpenAI of an undisclosed amount.

The journalist received the responses from ChatGPT after it asked the program to summarize a real federal court case by linking to an online PDF. The Large Language Model then generated a false summary of the case, which has extensive in detail but was also false. It mentioned incorrect information that Mark Walters was believed to have pursued the misappropriation of funds from a gun rights non-profit called the Second Amendment Foundation, where Walters pocketed $5 million. Nowhere has it been stated that Walters was accused of this crime.

Fred Riehl, the journalist, made the responsible choice not to publish this factually incorrect information. Instead, he decided to double down on the information through another source, which was the correct decision to make. However, the reports do not confirm how Mark Walters figured out that ChatGPT was generating false responses about him. Since millions of users are aware that such programs would often make misleading responses, which are often referred to as ‘hallucinations,’ they would outright dismiss them without a second thought.

However, when ChatGPT starts generating responses that can result in actual harm, then it becomes a problem. Two instances where the LLM’s responses led to severe consequences was when one professor threatened to fail his entire class after ChatGPT stated that students were using AI to complete their essays. The second incident revolved around a lawyer facing possible disbarring after using the program to research fake legal cases. Due to these issues and more, OpenAI has issued a small disclaimer on ChatGPT’s homepage, warning users that the AI can occasionally generate false information.

It is unclear how this lawsuit will play out, but it is high time that OpenAI engineers attempt to alleviate the false responses generated by ChatGPT because more trouble can ensue for various professionals, including the company.

Written by Omar Sohail
07 Jun 18:17

Apple's New Proton-like Tool Can Run Windows Games on a Mac

by msmash
If you're hoping to see more Windows games on Mac then those dreams might finally come true soon. From a report: Apple has dropped some big news for game developers at its annual Worldwide Developers Conference (WWDC) this week, making it far easier and quicker to port Windows games to Mac thanks to a Proton-like environment that can translate and run the latest DirectX 12 Windows games on macOS. Apple has created a new Game Porting Toolkit that's similar to the work Valve has done with Proton and the Steam Deck. It's powered by source code from CrossOver, a Wine-based solution for running Windows games on macOS. Apple's tool will instantly translate Windows games to run on macOS, allowing developers to launch an unmodified version of a Windows game on a Mac and see how well it runs before fully porting a game. Mac gaming has been a long running meme among the PC gaming community, despite Resident Evil Village and No Man's Sky ports being some rare recent exceptions to macOS gaming being largely ignored. "The new Game Porting Toolkit provides an emulation environment to run your existing unmodified Windows game and you can use it to quickly understand the graphics feature usage and performance potential of your game when running on a Mac," explains Aiswariya Sreenivassan, an engineering project manager for GPUs and graphics at Apple, in a WWDC session earlier this week.

Read more of this story at Slashdot.

07 Jun 14:18

No Man’s Sky 10th Expedition, Singularity, Is Out Now with a Much Longer Narrative Arc

by Alessio Palumbo

Singularity No Man's Sky

UK developer Hello Games continues to surprise on a regular basis when it comes to the cadence of No Man's Sky updates.

Just a few days ago, the studio launched the native MacOS version of the game. Today, the studio announced the release of the tenth No Man's Sky Expedition, which they reckon is completely different from the previous ones.

Called Singularity, it'll focus on AI corruption and robotic uprisings, which Hello Games admits is a topic strangely absent from a sci-fi game up to this point. The developers said Singularity would evolve over a much longer narrative arc of five weeks. It'll begin with players investigating 'robot heads' that are dropping clues throughout the galaxy.

They'll collaborate with Polo and Nada to discover what's behind this space anomaly. Additionally, players will be making a choice at the end of the Singularity Expedition, and the decision will have consequences that will develop in the future of No Man's Sky story. Of course, participating in the Expedition will unlock many cool rewards, such as a new robotic character customization set.

No Man's Sky was hugely hyped before launch, only to provoke disappointment on day one in both critics and fans. At some point, the game was even investigated by the United Kingdom's advertising authorities for potential false advertising. However, the folks at Hello Games rolled up their proverbial sleeves and kept pumping new features and content at an incredible pace.

The game is now completely VR compatible, supports various upscalers (DLSS, FSR 2, etc.) on PC, is out on Nintendo Switch (with cross-play), not to mention the many gameplay features and mechanics introduced in the last six years or so. It doesn't look like Hello Games will be done adding more to No Man's Sky any time soon, either, even though the studio is also working on a new ambitious secret project, as revealed in September 2020 by studio founder Sean Murray.

Written by Alessio Palumbo
07 Jun 14:05

The Outer Worlds: Spacer’s Choice Edition Patch 1.3 aims to reduce shader compilation and traversal stutters

by John Papadopoulos

Last week, Private Division and Virtuos Games released a brand new update for The Outer Worlds: Spacer’s Choice Edition. According to the release notes, Update 1.3 aims to reduce both shader compilation and traversal stutters. Going into more details, Patch 1.3 brings PSO cache improvements to fix hitching issues on PC. Moreover, it updates environment … Continue reading The Outer Worlds: Spacer’s Choice Edition Patch 1.3 aims to reduce shader compilation and traversal stutters →

The post The Outer Worlds: Spacer’s Choice Edition Patch 1.3 aims to reduce shader compilation and traversal stutters appeared first on DSOGaming.

06 Jun 19:07

White House Quiet on National Cyber Director Choice, Senator Says

by msmash
The White House has not shared much of anything with lawmakers about who the administration thinks should be the next national cyber director, a top cyber-minded senator told Axios. From the report: It's been nearly four months since Chris Inglis stepped down as the first national cyber director inside the White House, and lawmakers and policy experts have been putting pressure on President Joe Biden in recent weeks to name a replacement. Last month, Sen. Angus King (I-Maine) and Rep. Mike Gallagher (R-Wis.) sent a letter to Biden questioning the delay in picking a nominee and encouraging the president to nominate current acting director Kemba Walden to the post. Yet in the three weeks since the lawmakers sent their letter, they haven't heard anything from the White House, King told Axios in a recent interview. What they're saying: "I'm really puzzled; I just don't know what's going on," King told Axios. "This is an important job, and it's an important moment and they have a highly qualified, able acting director." Congress created the Office of the National Cyber Director (ONCD) as the Biden administration was taking office in early 2021.

Read more of this story at Slashdot.

06 Jun 15:16

You die and your kin just dump your PC at some thrift store. Nobody wipes the hard drive. What will the buyer find? Here, they found "the Library of Alexandria" of gay porn DVD reviews. And some sentimental stuff, hence tag. And stickiness [Sappy]

06 Jun 02:44

Apple Announces macOS Sonoma with Desktop Widgets, Game Mod, and Much, Much More

by Furqan Shahid

Apple Announces macOS Sonoma with Desktop Widgets, Game Mod, and Much, Much More

Apple has finally announced the latest macOS Sonama. This is a supercharged update for the Mac operating system. Sonama will launch later this year in the fall and will be bringing a number of top-tier features, such as the ability to place widgets on the desktop. You are also getting aerial screensavers, something that you often see on Apple TV. With the new update, Apple is also focusing on making iMessage better for everyone, and last but not least, Game Mode is also coming to the new OS, and for those wondering, it works by ensuring that the game you are playing gets the most access to the resources so you do not run into hiccups while gaming.

The macOS Sonoma is also going ot bring a number of improvements to Safari. You will be able to have a Profiles feature that will allow you to have a separate work and personal account, something that you have seen on Google Chrome. In addition to that, Mac finally supports web apps, which would simply allow the websites such as Facebook, Twitter, Spotify, Instagram, and more to appear as apps on the Dock, making it super easy for everyone to just go ahead and access the apps and websites they want.

Updating...

Written by Furqan Shahid
06 Jun 02:40

New DirectX 12-To-Metal Translation Could Bring a World of Windows Games To macOS

by BeauHD
An anonymous reader quotes a report from Ars Technica: Apple has made a tiny bit of progress in the last year when it comes to getting games running on Macs -- titles like Resident Evil Village and a recent No Man's Sky port don't exactly make the Mac a gaming destination, but they're bigger releases than Mac users are normally accustomed to. For getting the vast majority of PC gaming titles running, though, the most promising solution would be a Steam Deck-esque software layer that translates Microsoft's DirectX 12 API into something compatible with Apple's proprietary Metal API. Preliminary support for that kind of translation will be coming to CodeWeavers' CrossOver software this summer, the company announced in a blog post late last week. CrossOver is a software package that promises to run Windows apps and games under macOS and Linux without requiring a full virtualized (or emulated) Windows installation. Its developers announced that they were working on DirectX 12 support in late 2021, and now they have a sample screenshot of Diablo II Resurrected running on an Apple M2 chip. This early DirectX12 support will ship with CrossOver version 23 "later this summer." The announcement is simultaneously promising and caveat-filled; getting this single game running required fixing multiple game-specific bugs in upstream software projects. Support will need to be added on a game-by-game basis, at least at first. "Our team's investigations concluded that there was no single magic key that unlocked DirectX 12 support on macOS," CodeWeavers project manager Meredith Johnson wrote in the blog post. "To get just Diablo II Resurrected running, we had to fix a multitude of bugs involving MoltenVK and SPIRV-Cross. We anticipate that this will be the case for other DirectX 12 games: we will need to add support on a per-title basis, and each game will likely involve multiple bugs." In other words, don't expect Steam Deck-esque levels of compatibility with Windows games just yet. There are also still gameplay bugs even in Diablo II Resurrected, though "the fact that it's running at all is a huge win."

Read more of this story at Slashdot.

06 Jun 02:37

Apple Announces macOS Sonoma With Desktop Widgets and Game Mode

by BeauHD
At WWDC today, Apple announced macOS Sonoma, the latest version of its Mac operating system that includes new features like desktop widgets, aerial screensavers, a new Game mode, and enhancements to apps like Messages and Safari. MacRumors reports: The first feature that Apple detailed was new interactive widgets, which can now be placed right on your desktop. Widgets blend into your desktop wallpaper to not be obtrusive when you're working, and with Continuity you can use the same widgets from your iPhone on your Mac. macOS Sonoma also introduces enhanced video conferencing features, including Presenter Overlay to allow a user to display themselves in front of the content they are sharing. Reactions let users share how they feel within a video session, and Screen Sharing has been improved with a simplified process. As is usual with macOS updates, Safari is getting numerous new features within Sonoma. There's an update to Private Browsing that provides greater protection from trackers and from people who might have access to the user's device. Profiles within Safari offer a way to separate browsing between topics, like having one for work and one for personal browsing. There's also a new way to create web apps that work like normal apps and let you get to your favorite website faster. When you're not actively using macOS Sonoma, the new screen savers feature slow-motion videos of various locations worldwide. They shuffle between landscape, Earth, underwater, or cityscape themes, similar to what you'll see on tvOS. For gamers, there's a new Game Mode in macOS Sonoma that delivers an optimized gaming experience with smoother and more consistent frame rates. It dramatically lowers audio latency with AirPods and reduces input latency with game controllers, and it works with any game on Mac. A beta version of macOS Sonoma is now available via the Apple Developer Program, with a public beta launching next month. As Ars Technica notes, the macOS Sonoma update will only run on a couple generations of Intel Macs. "[I]f you're using anything made before 2018 or anything without an Apple T2 chip in it, you won't be able to run the new OS."

Read more of this story at Slashdot.

06 Jun 02:34

Xbox FTC Settlement and Reimagining the Future of Safety on Xbox

by Dave McCarthy, CVP Xbox Player Services

At Xbox, we have the fundamental commitment to provide all players with a safe and secure experience on our platform – and this is especially true for our youngest players. We frequently iterate on our safety measures, in collaboration and with feedback from the community, regulators and partners. We recently entered into a settlement with the U.S. Federal Trade Commission (FTC) to update our account creation process and resolve a data retention glitch found in our system. Regrettably, we did not meet customer expectations and are committed to complying with the order to continue improving upon our safety measures. We believe that we can and should do more, and we’ll remain steadfast in our commitment to safety, privacy, and security for our community.

Our two decades of safety experience has taught us that all players want, and need, safety and privacy protections. Since 2005, when we launched the first console that could connect players online, we’ve continued to invest in tools and technologies to protect our community. That work evolved into a multifaceted safety strategy. Our suite of safety, privacy and security measures are designed to respect player privacy and safety, and empower players, as well as parents and caregivers, to have control over their gaming experiences.

Below we detail the changes we made to verify child accounts, however, our work on age validation doesn’t stop there. We see an opportunity to further advance safe digital experiences that are accessible, simple to use, and benefit all players. We are innovating on next-generation identity and age validation – a convenient, secure, one-time process for all players that will allow us to better deliver customized, safe, age-appropriate experiences. The long-term benefits will be felt by all players, especially children and their families. And while we see this as the future, we anticipate that the entire games industry will as well.

Over the coming months, we will test new methods to validate age and take feedback from our customers’ experience. The learnings from these trials will directly inform advancements in our player identity systems. We are incorporating Microsoft’s insights from across industries to develop a principled approach to secure digital identities that minimizes data collection, prioritizes security, and makes it easier for players to understand how their data is used.

We’ll continue to put players at the center – giving them full control over their online experiences and digital identities. We’ll continue to empower parents and caregivers to exercise appropriate oversight of the gaming experience for their children and families, in addition to tools like the Xbox Family Settings App and child accounts. Child accounts are built for underage players so that parents and caregivers can manage settings, privacy, spending and more. We will continue to be transparent and clear about the actions we take on our service, just as we did when we released our inaugural Transparency Report and second Transparency Report in May.

The Xbox community is our community – one we shape together. As we innovate and trial new experiences, we’ll work with the community to gather feedback so we can create a safer gaming experience together.

What the FTC settlement means for players

Since the FTC settlement, we have updated our account creation process, which now requires players to first identify date-of-birth and, if under 13 years old, obtain verified parental consent before providing us with any information such as phone number or email address. This updated process ensures that we can identify potential child accounts immediately and make clear to parents and caregivers the next steps to protect their children’s data and play safely on our network.

Over the coming months, players who are under the age of 13 and created an account prior to May 2021 will require parental reconsent – meaning a parent will be prompted to reverify the account and grant permission for their child to continue gameplay and activity on Xbox. We are committed to making this process as seamless as possible. We are working hard to ensure that when parents are prompted to reconsent, they will have the information needed to proceed without disruptions to their child’s access. To learn more about setting up a child account, please visit here.

During the investigation, we identified a technical glitch where our systems did not delete account creation data for child accounts where the account creation process was started but not completed.  This was inconsistent with our policy to save that information for only 14 days to make it easier for gamers to pick up where they left off to complete the process. Our engineering team took immediate action: we fixed the glitch, deleted the data, and implemented practices to prevent the error from recurring. The data was never used, shared, or monetized.

To more clearly explain what information we collect and how we use it, we updated our Microsoft Privacy Statement, including a dedicated section about how Xbox processes user data. We have also updated our home screen to have a clearly labelled link to the Microsoft Privacy Statement. This link also appears in each area of the service where personal information is collected. Microsoft also provides a privacy dashboard that shares with families what data is collected and used. Players can adjust their privacy settings at any time and child accounts are set to the strongest privacy settings by default. To learn more about Xbox’s privacy features, please visit here.

Additional resources for families

We want all parents, caregivers, and families to know that, more than anything else, we have their children’s safety and privacy top of mind. We will continue to communicate the changes we are making to our practices and the data we collect so we can better protect children using our platform. We also continue to explore creative ways to educate players about online safety.

This past Safer Internet Day, we released Minecraft’s Privacy Prodigy, aimed at teaching young people about privacy and how to safeguard their sensitive personal information. This world is the second chapter in the CyberSafe series, following last year’s release of Minecraft CyberSafe: Home Sweet Hmm, reaching millions of players, with unprecedented downloads of support materials underscoring the demand by teachers and families to teach these critical skills and integrate safer online practices daily. CyberSafe: Home Sweet Hmm and CyberSafe: Privacy Prodigy are both available for free on Minecraft: Education Edition and Minecraft Bedrock.

Our updated Xbox Family Hub shares information about creating a family group, managing child accounts, and helps parents and caregivers understand the safety measures we have in place, such as the Xbox Family Settings App.

For more information on Microsoft privacy, safety, and responsible gaming, please see the below list of resources:

Related:
Xbox Releases Second Transparency Report Demonstrating the Integral Role of Proactive Content Moderation
Xbox Celebrates Safer Internet Day with Minecraft’s New Privacy-Themed Learning World and Safety Tips for Parents
Xbox Shares Community Safety Approach in Transparency Report
05 Jun 15:25

Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security

by Ionut Arghire

Microsoft is making SMB signing a default requirement in Windows 11 Enterprise editions, starting with insider preview build 25381.

The post Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security appeared first on SecurityWeek.

04 Jun 21:35

Guardians Of The Galaxy's First Footloose Reference Made Kevin Bacon's Jaw Drop

by Eric Vespe

"Guardians of the Galaxy" was a massive audience-pleaser, and one of those faces in the theater it brought a smile to was none other than Kevin Bacon's. Imagine being Kevin Bacon sitting in your local multiplex, throwing back some popcorn and watching the latest big MCU movie only to find out you yourself end up being not only name-checked in the movie, but also become kind of essential to the plot.

Bacon would ultimately appear alongside the Guardians of the Galaxy themselves in last year's "The Guardians of the Galaxy Holiday Special," but before that was even a possibility, he was just a movie fan whose "jaw dropped" when he heard his name pop up in that first film. He described that moment in an interview with IGN:

"If you can imagine sitting there in a dark theater and all of a sudden hearing yourself name dropped in that kind of way, it's a very, very, very strange experience, but cool ... I walked out of the theater and called my wife and I said, 'I'm going to go back and see this movie. It's a great movie, and there's a little surprise in there for you, you'll see.'"

Of course, a few years later, Bacon was essentially kidnapped by Mantis and Drax as the ultimate Christmas present for Chris Pratt's Star-Lord, and he got to be more than just an inspiration for young Peter Quill.

The Symbiotic Relationship Between 'Footloose' And 'Guardians Of The Galaxy'

It's worth noting that Bacon's role in the Holiday Special was to help unite the Guardians as a family, which is very much what the mere suggestion of Kevin Bacon was able to do in the first "Guardians of the Galaxy." It was Quill telling Gamora about "Footloose" that brought them closer together as a romantic pair, and it also happened to set up the big finale of that movie.

Remember, "Guardians of the Galaxy" was a movie driven by music. Not only did James Gunn write direct references to "Footloose" into the film, he also infused it with rockin' needle drops and even bookended the movie with dancing. Star-Lord dances to Blue Swede's "Hooked on a Feeling" as he recovers the orb containing the Power Stone, and the movie ends with a dance-off that defeats Ronan the Accuser by bringing all the newly formed Guardians together as one family, ready to put their own lives on the line for the others.

This parallel wasn't lost on Bacon, either. He called "Footloose" and "Guardians of the Galaxy" "symbiotic," and he's not wrong. The joy of music and expressing yourself through dance are crucial throughlines to both films, so it seems like Bacon was destined to join up with the Guardians of the Galaxy, even if he's only an honorary Guardian. 

Although, we've probably not seen the last of the "Guardians of the Galaxy," so who knows? Maybe Kevin Bacon will join up with the new team down the line? One can only hope.

Read this next: 11 Things In Guardians Of The Galaxy Vol. 3 That Make No Sense

The post Guardians of the Galaxy's First Footloose Reference Made Kevin Bacon's Jaw Drop appeared first on /Film.

04 Jun 21:33

Tanya's Fate On The White Lotus Was A Prank From Mike White To Jennifer Coolidge

by Lex Briscuso

If there's one thing legendary actress Jennifer Coolidge isn't cool with, it's boats. Or really any moving vehicle, as evidenced by a little prank "The White Lotus" creator Mike White played on her while filming the now-beloved season 2 of the HBO series. "She had such a bad time filming on the boat in the first season that I just imagined telling her, 'Yeah, now your character is going to die on a boat,'" White revealed in a May 2023 interview with The Hollywood Reporter. "Maybe I'm sadistic or something, but I knew Jennifer's reaction was going to make me laugh so hard."

Poor Jennifer Coolidge, though, because the actress — along with the rest of the cast filming on the boat for their entrance scene in season 1 — had to take Dramamine, a motion sickness medicine, just to stay ready and able during the shoot, according to THR. So she was already feeling quite bad just being present on set despite the excitement of the arrival to The White Lotus Hawaii in the pilot episode.

"I can't even ride in the back seat of the car," Coolidge explained to the outlet. "Anything that rocks, any kind of motion, and I get very sick. So everyone was one foot away from me on that boat, and I was puking up my guts. When [the show] was picked up for a second season, I swear to God, I heard Mike say, 'Yeah, no more boats.' And then, guess what? Lots of boats on this show."

Shooting On A Boat

For Coolidge, the symptoms of motion sickness — namely the nausea and dizziness — aided in setting the tone for her somewhat outlandish and unsettling death scene in season 2. After all, actually shooting on a boat had a lot of advantages that, well, just had to be taken advantage of, both from acting and production perspectives. "There's nothing more vulnerable than being on a boat with a bunch of people that don't want you to survive," Coolidge told THR. "If we'd shot it on a soundstage, it wouldn't have been the same — because I didn't even have to imagine much. I already felt vulnerable."

Knowing Coolidge suffers from motion sickness — something I, your writer friend, actually also suffer from — adds a whole other layer of skill and smarts to her performance in Tanya's pivotal death scene in season 2. It takes a lot to put those feelings at bay to get into the headspace of a character, but it takes a whole separate set of skills to actually use the unpleasant forces that seem to invade when motion sickness takes over and parlay them into a performance. Not to say Coolidge acts sick on the boat, but knowing that she actually was somewhat uncomfortable during the shoot really brings out the sense a woman on edge, which she probably was to some degree because of her condition. Acting is a really scrappy set of skills and it's incredible to watch how different performers bend and mold it to their will. There's a reason why Coolidge is nothing short of sublime. 

Read this next: The Best TV Shows Of 2022, Ranked

The post Tanya's Fate on The White Lotus Was a Prank From Mike White to Jennifer Coolidge appeared first on /Film.

04 Jun 21:32

How Donnie Darko: The Director's Cut Changes The Movie (For Better Or Worse)

by Joshua Meyer

"Donnie Darko: The Director's Cut" immediately establishes itself as a different viewing experience from the original 2001 film, as Jake Gyllenhaal's teen protagonist rides his bike home in his pajamas to a new soundtrack song. Echo & The Bunnymen's "The Killing Moon" is such a signature needle drop that it feels a little off to hear it replaced by INXS's "Never Tear Us Apart." 

It's as if writer-director Richard Kelly is now cueing the audience through music that it's about to enter a new "Tangent Universe," apart from the Primary Universe, just as Donnie himself does in one interpretation of the film. That interpretation gets a stronger push in "Donnie Darko: The Director's Cut," which introduces those capitalized terms onscreen and pulls another soundtrack switcheroo later when it replaces composer Michael Andrews' recognizable "Liquid Spear Waltz" with a piece of opera music.

George Lucas famously changed a song at the end of "Return of the Jedi" when he did the Special Edition re-release of the original "Star Wars" trilogy, but by then, almost 15 years had elapsed since the first version of the movie hit theaters. "Donnie Darko: The Director's Cut," by contrast, did its liquid spear waltz into theaters in 2004, just three years after Kelly's original film -- which had bombed at the box office, only to find renewed life as a cult classic on home media. (Hence, the theatrical re-release.)

"The Director's Cut" contains almost 20 minutes of additional footage not found in the first theatrical cut of "Donnie Darko," including new and extended character interactions. We're not going to laundry-list every single change here, but what we will do is talk about how those changes alter the film's overall narrative thrust -- for better or worse.

The Tangent Universe And Ending Explained

As Radio Times notes, the most significant alteration in "Donnie Darko: The Director's Cut" is the appearance of pages from Roberta Sparrow's book, "The Philosophy of Time Travel," onscreen. These pages give the film appropriately non-linear chapter headings, and if you can get over the esoteric wording, they explain in no uncertain terms what's happening throughout the movie.

Rather than use common phrases like "parallel universe" or "alternate reality," Sparrow, a.k.a. Grandma Death (Patience Cleveland), writes of an unstable Tangent Universe that will last "for no longer than several weeks." This goes along with what Donnie's seemingly imaginary friend -- the six-foot-tall rabbit, Frank -- says at the beginning of the movie when he warns him about the world ending in 28 days. That warning comes after Frank has lured Donnie out of his house, just before a jet engine falls out of the sky and crashes through his bedroom ceiling.

Donnie was supposed to die, but as one of his friends says, he "cheats death," and everything from that point forward (until the end of the movie, when it returns to Donnie laughing in his bed on October 2, 1988) is a Tangent Universe. Viewers of the original "Donnie Darko" could certainly arrive at this interpretation on their own, but "The Director's Cut" puts the text up onscreen confirming it and explaining how the Tangent Universe will eventually "collapse upon itself, forming a black hole within the Primary Universe capable of destroying all existence."

This reduces the ambiguity of "Donnie Darko," which originally gave the audience more leeway to develop other possible theories. In order to save his girlfriend and the universe, Donnie has to go back in time, accept his fate, and allow himself to die at the end.

Show-And-Tell With The Philosophy Of Time Travel

Perhaps the most blatant example of "Donnie Darko: The Director's Cut" overexplaining things comes when a page from "The Philosophy of Time Travel" introduces the idea of a metal "Artifact" that provides "the first sign that a Tangent Universe has occurred." The movie superimposes this explanatory text over imagery of the jet engine being removed from Donnie's house, leaving very little room for imagination as to what the Artifact here is.

At the end, "Donnie Darko: The Director's Cut" also juxtaposes images of the people Donnie saved, waking up, with text about the Manipulated Living and Dead and how, when "they awaken from their Journey into the Tangent Universe, they are often haunted by the experience in their dreams." The unmasked Frank (James Duval) -- whom Donnie shot in the eye after Frank accidentally drove over his girlfriend, Gretchen (Jena Malone) -- touches his eye as if he remembers, and is indeed haunted, by what happened to him in the Tangent Universe.

Collectively, these book inserts function much in the same way as superfluous voiceover would, insofar as they tell what the movie's already showing. It's worth mentioning that the very term "Tangent Universe," when applied to "Donnie Darko: The Director's Cut," seems to openly acknowledge how this cut allows for unnecessary tangents, working back in deleted scenes and making it explicitly clear what the movie is about.

Contrast this with the original "Donnie Darko," which is much more fair-handed in its distribution of clues that Donnie might simply be a paranoid schizophrenic, as his own hypnotherapist, Dr. Thurman (Katherine Ross), suggests. "The Director's Cut" makes a big change undermining this interpretation when it has Dr. Thurman reveal that Donnie's medication is a placebo, "just pills made out of water."

'Increased Detachment From Reality'

To really appreciate how "The Director's Cut" changes "Donnie Darko," it's helpful to remember just how much the original movie planted hints that Donnie might suffer from paranoid schizophrenia. When we first meet him, he's lying in the middle of the road in his pajamas, having sleepwalked (or rather, sleep-cycled) across town. We subsequently learn that he's off his medication, and the viewer has no reason to believe that Donnie's pills are placebos, since that revelation is absent from the original theatrical cut.

It contradicts some of the other information Dr. Thurman gives us, especially the part where she tells his parents, "Donnie's aggressive behavior, his increased detachment from reality, seems to stem from his inability to cope with the forces in the world he perceives to be threatening." She goes on to imply that the hallucinations he's experiencing (of a giant bunny rabbit named Frank, and liquid spears inspired by the water tentacle in "The Abyss") are "a common occurrence among paranoid schizophrenics."

Why would she keep giving him placebos even after she's suggested this? That's just one question that "Donnie Darko: The Director's Cut" opens up as it, too, shows an "increased detachment from reality." Conversely, the possibility of paranoid schizophrenia causing Donnie to hallucinate keeps the original movie grounded, offering up a more plausible, reality-based explanation than Frank's through-the-looking-glass question, "Do you believe in time travel?"

Donnie's sister, Samantha (Daveigh Chase) -- who received her own messy spin-off sequel, "S. Darko" -- interrupts one of his early conversations with Frank, walking in on him and bursting his bubble (and ours) with another question: "Who are you talking to?" Donnie replies, "I was just taking my pills," and it instantly throws into doubt the reality of what we've just witnessed.

'The Search For God'

In the original "Donnie Darko," religion is more of a background shading. There's a scene where Dr. Thurman asks Donnie if he feels alone, and he gives a long answer, but it's not until she chimes in again that the dialogue clarifies they're talking about "the search for God" and feeling alone in the universe. "Donnie Darko: The Directors Cut" adds another moment where Dr. Thurman explains to Donnie the difference between an atheist and agnostic (he's the latter, she says).

At one point, we hear how Roberta Sparrow was a nun who left the church to teach science and write "The Philosophy of Time Travel." Yet were it not for the students' uniforms, some viewers might not even realize that Donnie, as The Atlantic observes, attends a Catholic school. In 2017, Richard Kelly told the site, "The search for God in science is perhaps the greatest quest of our species, and I like to tell stories about characters confronting God through these science-fiction mechanisms."

Like E.T. the Extra-Terrestrial, whose moonlit bike ride this movie evokes, Donnie Darko, the self-sacrificing teen with a superhero name, can be seen as something of a sci-fi Christ figure -- as improbable and oxymoronic as that might sound. Despite his initials, this would surely make Jim Cunningham (Patrick Swayze), with his kiddie porn dungeon, "the Anti-Christ," as Donnie calls him.

When Donnie and Professor Monnitoff (Noah Wyle) are discussing "pre-formed destiny," Donnie talks about God controlling time and how a time traveler could theoretically avoid negating destiny by traveling "within God's channel." This is what Donnie does in the Tangent Universe, which is like the vision of earthly life that Willem Dafoe's Jesus has in "The Last Temptation of Christ" (a title that appears on the movie marquee behind Donnie).

'The Dreams In Which I'm Dying'

With one-liners like, "Sometimes I doubt your commitment to Sparkle Motion!" and, "Why are you wearing that stupid man suit?" "Donnie Darko" remains as quotable as ever. Drew Barrymore's final scene as Donnie's teacher, Ms. Pomeroy, popularized the idea that "cellar door" is the most beautiful phrase in the English language. In "The Director's Cut," Donnie reads a poem about Frank in her class, and she substitutes the rabbit-laden "Watership Down" for the outgoing Graham Greene book. Classroom discussion among hormonal teens about the breeding habits of rabbits ensues.

To be clear, the original "Donnie Darko" seeds in plenty of hints in favor of time travel or a time loop theory, such as Donnie's conversation with Professor Monnitoff about "a wormhole with an Einstein-Rosen Bridge" and how the vessel for time travel could be a "metal craft of any kind." There are also hints that Donnie's destiny and Frank are putting everything into place for him to fall into what "The Director's Cut" calls an "Ensurance Trap," whereby he will want to "go back in time and replace all those hours of pain and darkness."

Witness the cellar door that leads to Donnie's doom, and Grandma Death puttering out to the mailbox at just the right moment so that the car swerves to hit Gretchen. In the original movie, however, these coincidences are counter-balanced with suggestions of mental illness. The trauma of seeing Gretchen run down could just as easily cause Donnie to project his imaginary friend's face onto the driver who killed her. His final portal trip could be a break from reality, where he imagines himself dying to prevent tragedy, in accordance with the "Mad World" lyric: "The dreams in which I'm dying are the best I've ever had."

Ego Reflections And Attitudinal Beliefs

There's a lot going on in "Donnie Darko"; it's one of those movies where you can watch it and rewatch it and notice new things every time. Even scenes of comic relief like the self-help video with a bed-wetter exclaiming "I'm not afraid anymore!" betray hidden meanings. Case in point: there's a line right before that where a "fear survivor" says, "I looked through the mirror, and in that image, I saw my ego reflection."

According to one theory— yet another interpretation "The Director's Cut" debunks — this is what Donnie does with his giant bunny rabbit friend, Frank. As that theory goes, maybe there is no Frank, and Donnie's just talking to himself in the mirror as he grapples with the terrible knowledge, imparted to him by Grandma Death, that "every living creature on earth dies alone." Given that Donnie is destined to save the universe ("The Director's Cut" calls him "The Living Receiver" instead of the Chosen One, but same difference), it seems more likely, in this interpretation, that Frank reflects Donnie's self-importance, rather than his Freudian ego, which would normally help govern a human being's inflated sense of worth as they reckon with their place in the cosmos.

Jim Cunningham, who gives seminars about "attitudinal beliefs," calls Donnie "a very troubled and confused young man." Though Donnie exposes the hypocrisy of Cunningham and conservative teacher Kitty Farmer (Beth Grant), his history of juvenile delinquency repeats itself when he burns down Cunningham's house. (It's revealed in dialogue beforehand that Donnie already burned down a house once before.)

Ultimately, accepting Donnie — and "The Director's Cut" itself — as the Chosen One may just serve to reflect one's own beliefs about the need for narrative clarity, and whether we're alone in the universe or have someone "watching over" us, like Donnie.

The Director's Cut Is A 133-Minute Tangent Universe

"Donnie Darko: The Director's Cut" is an interesting supplement to the first theatrical cut of the film, but its added scenes also interrupt the flow of the narrative and rob the movie of some of its mystery, spelling out in onscreen text what's happening through the pages of "The Philosophy of Time Travel." Ultimately, the original version of the film is a cult classic that's fine as-is, while the trajectory of Richard Kelly's career in the years since "Donnie Darko" leaves some room to question whether his directorial judgment is always the best.

After the critical and commercial failure of "Southland Tales" and "The Box" in the mid-to-late 2000s, Kelly went into a long hibernation, and while it's never too late for a comeback, he still hasn't made a movie since 2009. In 2021, when "Donnie Darko" was celebrating its 20th anniversary, /Film's Jack Giroux interviewed Kelly, who indicated that he has done uncredited writing work on other completed films in the intervening years, and that he has ten different scripts or projects of his own that are ready to go next in various stages.

Until one of those materializes, fans are left to revisit "Donnie Darko." It's been said that every filmmaker has at least one great movie in them; this was Kelly's. Perhaps the best way to reconcile his director's cut with the "Donnie Darko" viewers first fell in love with is to think of it as its own 133-minute Tangent Universe, not unlike the 28-day one Donnie visits. In the end, having seen what the Tangent Universe has to offer (which isn't always better), the audience is free to let it collapse in on itself and return to the Primary Universe of the original "Donnie Darko."

Read this next: Sci-Fi Movies You Never Realized Were In The Same Universe

The post How Donnie Darko: The Director's Cut Changes the Movie (For Better or Worse) appeared first on /Film.

04 Jun 21:31

Star Trek: Picard Filmed The Seven Of Nine Captain Catchphrase Fans Didn't See

by Witney Seibold

The final scenes of "Star Trek: Picard" saw Captain Seven of Nine (Jeri Ryan) commanding the newly christened Enterprise-G (previously the Titan-A), taking her ship out on a brand new exploratory mission, exhilaratingly adding to the "Star Trek" legacy. Her first officer was her ex-girlfriend Commander Musiker (Michelle Hurd), and the ship is being piloted by Ensign La Forge (Ashlei Sharpe Chestnut) Geordi's daughter. Notably, Jean-Luc Picard's son Jack (Ed Speleers) sat at the captain's left hand serving as her special council. 

Just before leaping to warp, the crew turns to their captain in expectation, wondering how she's going to give the order to activate the engines. Picard previously said "Engage" on "Star Trek: The Next Generation," as well as "Make it so." Other captains have adopted other dramatic phrases such as "Let's punch it" (Pike in the 2009 "Star Trek" film) or "I would like the ship to go. Now." (Spock on "Strange New Worlds"). What was Captain Seven's "catchphrase" going to be? 

As a fun tease, Seven took in a breath to give the order, and then the showrunners cut away before audiences could hear her answer. It seems we'll never know what her version of "engage" will be.

It turns out, however, that Seven did have a catchphrase. In a recent interview with ComicBook.com, "Picard" showrunner Terry Matalas revealed that they shot an unused scene wherein other characters gave a reaction to her saying "her line," but that the scene was edited out at the last minute. What was the phrase? Matalas was frustratingly coy.

Disappointment

"Picard" contains a fun post-credits tease involving Jack and Q (John De Lancie), the trickster god who once gave Jean-Luc Picard (Patrick Stewart) such trouble. The scene wasn't just a wink for fans, but was fully intended to tease out a (still not-in-production) spinoff series that Matalas would like to call "Star Trek: Legacy." That was ultimately the final scene in the series, but, it seems, Matalas has orchestrated one more. He described it thus: 

"We had a few options, and we actually shot a post-post-credit to them reacting disappointed to it, and she's like, 'This is a work in progress.' But it's better left as a mystery that we hope to see it one day. Yeah. We'll see. It was pretty great though."

A wise cut, one might say. Leaving "Star Trek: Picard" on a shot of disappointed ensigns may not be the epic send-out the series might need. 

Yes, it seems that the tease of not hearing Captain Seven's "Engage" was an act of deliberate withholding. Matalas was clearly hoping that frustrated fans, wanting to hear the catchphrase, would write letters to Paramount, imploring that "Star Trek: Legacy" be given the green light, and that Seven be allowed to say "Let's kick this pig," or whatever it might be. That Matalas claims he knows what the phrase is, well, that only sweetens the pot. Hey, Trekkies, keep writing letters. 

Now for the fun speculation: Captain Seven of Nine learned her command skills mostly from Captain Janeway (Kate Mulgrew) on "Star Trek: Voyager," so one might assume she would imitate her. Janeway merely said "Engage," however, and Seven would need something more in her own personal character. Given that she is a former Borg, might I suggest "Comply"?

Read this next: 11 Reasons Why The Next Generation Is The Best Star Trek Show

The post Star Trek: Picard Filmed The Seven Of Nine Captain Catchphrase Fans Didn't See appeared first on /Film.

04 Jun 15:23

System76's Open Firmware 'Re-Disables' Intel's Management Engine

by EditorDavid
Linux computer vendor System76 shared some news in a recent blog post. "We prefer to disable the Intel Management Engine wherever possible to reduce the amount of closed firmware running on System76 hardware. We've resolved a coreboot bug that allows the Intel ME (Management Engine) to once again be disabled." Phoronix reports that the move will "benefit their latest Intel Core 13th Gen 'Raptor Lake' wares as well as prior generation devices." Intel ME is disabled for their latest Raptor lake laptops and most older platforms with some exceptions like where having a silicon issue with Tiger Lake. System76 has also added a new firmware setup menu option for enabling/disabling UEFI Secure Boot. The motivation here with making it easier to toggle Secure Boot is for allowing Windows 11 support with SB active while running System76 Open Firmware.

Read more of this story at Slashdot.

03 Jun 22:01

Best Doom games, ranked

by Tiago Manuel

Time to raise some hell — in Hell

Though it was Wolfenstein 3D that kickstarted the FPS genre, it's Doom that everybody loves the most. Doom's contributions to the gaming world go well beyond it just being an amazing game. It popularized not only 3D in games but also the concepts of shareware and modding. Doom invited everyone to first experience it, then to do better. This approach paved the way for loads of original games and legitimate careers in the games industry. Taking a look back at the early days of Doom is taking a look at a much less cynical time in the history of the gaming industry.

But which game in the Doom series sits atop the throne as the best we've ever seen? It's hard to rank the games of a 30-year-spanning series without causing disagreements between the very different people from very different generations who have played the games. Worry not, though, as our ranking of the Doom games is 100% correct.

[caption id="attachment_260000" align="alignnone" width="1280"] Screenshot by Destructoid[/caption]

10. Doom (1993)

The game that started it all (if you forget Wolfenstein 3D). Despite the technical prowess behind it, Doom was simple and efficient. No big plot, just a bunch of beautiful levels where a man faces insurmountable odds while armed solely with an insurmountability-proof arsenal. On top of its single-player campaign, the original Doom also introduced the concept of Deathmatch, paving the way for online gaming.

Though not technically 3D, Doom deserves credit for one of the most important moments in gaming history, the eventual shifting of most of the industry away from 2D. Did we mention that it was and still is a lot of fun?

Please don't feel bad that we're putting it last. It's just a statement regarding the series' continuous evolution.

Strengths: Though severely dated, it's still one hell of a lot of fun.

Weaknesses: We wouldn't dare call anything here a weakness.

[caption id="attachment_238065" align="alignnone" width="1200"]Doom Image by Bethesda[/caption]

9. Doom II (1994)

We used to ask a lot less from sequels back in the day. The bad news about Doom II is that it's just the original game with new maps, more enemy variety, and one more gun. The good news is that having a new gun and more stuff to use it on is pretty great when the game in question is already Doom.

The even better news is that the new gun in question is the Super Shotgun, which remains one of the more satisfying weapons we can use to turn demons into soup.

Doom II didn't really revolutionize the world as the first one did. Still, we must ask, could we have handled yet another revolution of such magnitude by then?

Strengths: It has more cool stuff than the original.

Weaknesses: It's basically just Doom, but we're not complaining.

[caption id="attachment_383807" align="alignnone" width="1200"] Image by MobyGames[/caption]

8. Final Doom (1996)

Despite its confusing name, Final Doom isn't the definitive version of the original Doom. It's an expansion for Doom II that serves as the culmination of the classic Doom games and feels like a massive treat for the fans of the original two games.

Final Doom adds two new episodes that amount to 32 new levels. It's great, but remember, this isn't your classic stroll through Hell. Final Doom is for Doom veterans, so expect difficulty that comes not just from combat but also from more complex levels.

Strengths: Higher difficulty. This is the perfect culmination for lovers of the two original games.

Weaknesses: Don't play it if you think Doom II feels old—or difficult.

[caption id="attachment_243808" align="alignnone" width="1200"] Image by Romero Games[/caption]

7. Sigil (2019)

Sigil is an unofficial expansion containing nine new single-player levels and nine new multiplayer maps. It doesn't count as canon because it's not owned by Bethesda, but it was made by John Romero, the brain behind the original Doom levels, so it counts as canon in our hearts.

Sigil also introduces new weapons and a story with the guts to incorporate a Baphomet glitch into its plot. It's wild. Sigil doesn't revolutionize the Doom experience that we know and love, but its intricate level design highlights the experience John Romero has accumulated over the past 20 years.

Another really cool thing about Sigil is that you can either get it for free or in a luxuriously cool physical format.

Strengths: This is the original Doom II gameplay at its freshest. It's like an unreleased greatest hits album.

Weaknesses: More of the same.

Bonus: And if you're really into John Romero's work, you can buy his newest Doom II level, One Humanity. The money will go towards helping the people of Ukraine, the Red Cross, and the UN Central Emergency Response Fund.

[caption id="attachment_248700" align="alignnone" width="1200"] Screenshot by Destructoid[/caption]

6. Doom 64 (1997/2020)

Those who made the strange jump from the PC to the Nintendo 64 back in 1997 found in Doom 64 the graphical improvements that Doom II lacked.

Despite not being an id Software product, Doom 64 is a more than worthy successor to Doom II, a completely new game with a fresh campaign filled with amazing new levels. Anyone interested in this peculiar title will probably enjoy learning that we can finally experience it on PC, PS5, Xbox Series X|S, and Nintendo Switch if you want to be kind of a purist.

And if learning about the re-release gets you excited, we have even better news. Players who beat the campaign will gain access to something called "Lost Levels," an awesome new campaign hidden behind the old one. The new campaign rocks on its own but earns extra points by connecting the events of the older Doom games to the reboot from 2016.

Weirdly enough, though, Doom 64 doesn't feature any multiplayer options.

Strengths: Provides the graphical evolution that Doom II didn't.

Weaknesses: It's hard to forgive a Nintendo 64 game that doesn't feature local multiplayer.

[caption id="attachment_253197" align="alignnone" width="1200"] Image by Bethesda[/caption]

5. Doom 3 (2004)

This is easily the most divisive entry in the series, and we understand.

On the one hand, it looked better than everything else on the market when it came out. Yes, younger readers, Doom 3 once blew us away with those weird, oily, and rubbery looks. On the other hand, the once-masterful graphical improvements didn't bring along an equally daunting gameplay upgrade. Doom 3's campaign feels dated when compared to even that of the original Half-Life. It's no wonder it didn't fare too well against Half-Life 2.

Still, we get the sense that Doom 3 gave us exactly what the developers wanted to create, and that was a slower and more intimate descent into Hell. Most don't give it enough credit in that regard, but Doom 3 not only mastered dark and creepy sci-fi environments. It also mastered the art of jump scares. Nobody ever puts Doom 3 in a "best of" horror games list, but it packed some serious scares back in the day—and it still does.

Strengths: It features beautiful environments and interesting reimaginings of classic enemies, and it gets scary as hell.

Weaknesses: Weirdly simplistic gameplay for something that looked so far ahead of its time.

[caption id="attachment_383811" align="alignnone" width="1200"] Image by MobyGames[/caption]

4. Doom 3: Resurrection Of Evil

Doom 3's sole expansion successfully dealt with some of the main game's weakest aspects. Resurrection Of Evil added a few new weapons and special abilities that spiced up the otherwise conservative original.

The most interesting addition is the grabber, a weapon that allows players to levitate and throw objects at enemies—or to simply fling their projectiles back at them. Sadly for fans of the evolving FPS genre at the time, however, all the cool new additions serve only combat purposes and don't really take the gameplay in any really imaginative direction.

More cynical minds could accuse Resurrection Of Evil of being no more than an attempt to cash in on the popularity of the gravity gun, but it's more than that. Resurrection Of Evil offers neat gameplay improvements that result in a nice mini-campaign. Also, ROE had to exist because it provides the closure to the story that  Doom 3 lacked.

Strengths: Shows more of Doom 3's beautiful hell realm. A new weapon that allows players to control physics.

Weaknesses: It's very short. Resurrection Of Evil's use of physics pales in comparison to what Valve had achieved with Half-Life 2's gravity gun.

https://www.youtube.com/watch?v=iPyq0jFgVjI

3. Brutal Doom (2010)

Disclaimer: We know Brutal Doom isn't an official entry in the series. We also know we would be doing such a mod-friendly series a disservice if we were to ignore its greatest mod. Putting the word Brutal in front of Doom might seem unnecessary, but this mod by Marcos "Sargeant Mark IV" Abenante isn't kidding around.

Brutal Doom doesn't just greatly increase the amount of blood and guts seen in the original Doom. It modernizes its entire gunplay without messing up its beautiful surface. It also adds melee combat, glory-kill animations, stealth elements, and headshots. Don't think this will be a walk in the park, though, as Brutal Doom also makes enemies much faster and more capable.

Strengths: It brings the gameplay of the original Doom to new heights—and speeds.

Weaknesses: It mostly looks like the old Doom if you count that as a problem.

[caption id="attachment_205367" align="alignnone" width="1200"] Image by Bethesda[/caption]

2. Doom (2016)

Though Doom 3 hit many of the right beats, it failed to reach the series' full potential in the eyes of fans. The Doom reboot had a long and arduous development cycle, one that nearly ended with it becoming a Call Of Duty clone. Luckily, cooler heads prevailed, and we ended up getting one of the best reboots of all time.

The reboot did away with the slow pace of Doom 3, and with that alone, created a completely new thing. Doom was no longer about scaring the player. It was now about the player making Hell itself feel afraid. How did the devs do that? By empowering the Doom Slayer in all sorts of marvelous ways and thus turning the new Doom into one of the most fast-paced and brutal shooters ever made.

Strengths: Doom redesigned as a series of ever-harder arenas was an ace move. Aside from the pistol, all the weapons are extremely fun to use. The game looks gorgeous and runs very well on weaker hardware.

Weaknesses: The first level of the game only gives players access to the basic pistol. That doesn't do a great job of enticing players for what is to come. We forgive the devs, though, because they give us a Shotgun right at the start of...

[caption id="attachment_258088" align="alignnone" width="1920"]Doom Eternal Horde Mode update 6.66 Image by Bethesda[/caption]

1. Doom Eternal (2020)

We're not going to hold it against anyone who puts the Doom reboot above Doom Eternal. It comes down to a matter of preference. Gameplay or plot? The reboot features a better plot in the sense the developers understood nobody cares about the plot in these games, so there mostly isn't one. In the reboot, the Doom Slayer actively disregards learning about important story elements, whereas Doom Eternal makes him fully invested in what's happening, down to giving him a backstory. We're not thrilled about that, especially after Doom nailed the character so well.

And yet, like overly nice parents who encourage their kids with treats whenever they want them to study, the developers got our backs. Though they invited us to sit through a bland story, they made up with all kinds of excellent gameplay additions. We got a hook, a shoulder cannon, a dash, an insta-kill sword, and a new replenishment system that made the game more hectic than ever before.

Also, who could forget the Marauder, an enemy in a Doom game that requires players to think? The Marauder rocks, not just because it's the most interesting enemy in the history of Doom but because it might pave the way for sequels filled with way more challenging enemies. Doom might never beat the Half-Life series in terms of level design or puzzle ingenuity, but it could further surpass its rivals in its approach to combat.

And maybe, just maybe, the uninteresting plot isn't the terrible feature we think it is. Maybe it's just the developers' way to make us skip it—just like the real Doom Slayer would.

Strengths: The most refined and hectic gameplay in the entire series. The most fun arsenal and the best enemies to use it on. One of the enemies, the Marauder, provides the most fun challenge we've ever seen in the series. Absolutely glorious soundtrack.

Weaknesses: One of the few instances in which a bigger emphasis on plot and backstory doesn't pay off. A sad mistake after they aced the approach to the plot in Doom (2016).

The post Best Doom games, ranked appeared first on Destructoid.

03 Jun 03:05

The Flash's Sasha Calle Would Love To Keep Playing Supergirl In James Gunn's Rebooted DC Universe [Exclusive]

by Eric Vespe

Andy Muschietti's "The Flash" is almost upon us. Only two more weeks until the movie is out in theaters and it has already garnered very strong word of mouth from the CinemaCon screening as well as advance fan and press screenings. The studio has very rudely not shown me the movie yet, so I can't join in on the quality discussion, but I can say that I'm very excited by all the positive word thus far.

I'm particularly excited to see what they do with this Supergirl business. I'm not very familiar with Sasha Calle's other work, but I'd be lying if I wasn't immediately enamored by her when they announced her casting by showing her reaction to hearing the news that she was cast during a Zoom meeting with Muschietti. Her obvious passion for the character and excitement at the opportunity was contagious and I was instantly down to see what they were going to do with her here.

Now, we know that the DC Extended Universe is forever altered by the events of "The Flash," but we don't know to what extent. I guess we won't know even after we've all seen "The Flash," since James Gunn and Peter Safran's big reshaping of the DC Universe is still in its early days. 

The question remains: is there a place for Sasha Calle's Supergirl in the new DCU? This very question was asked of Calle by our own Jenna Busch-Henderson and her answer may not surprise you, but it is a good example of just how attached to this character she has become.

Calle Is 'Deeply In Love' With Supergirl

The gist of Jenna's question was about whether or not there have been any talks about her returning, especially considering Gunn has announced a "Supergirl" standalone movie based on the "Woman of Tomorrow" comics. This was her response:

"Oh, look, I hope to continue playing Supergirl. I love her. I'm so deeply in love with her. I think she's so incredible and so complex. And I think in this film, this is really the runway for her. We see this glimpse of her, but there's still so much to unpack in her story. I'm excited to take her apart and put her back in and just enjoy her with the world. I think there's so much story to tell, and I would love to continue playing Supergirl."

Obviously, that doesn't answer the larger question at hand, but at least Calle has put her love of the character and desire to return to the role on record. It's not like she'd come out and be like "Meh, I'll pass," of course, but it does sound like Calle has done a ton of homework for this character and is ready to be put back into the fight should Gunn and Safran want her back.

We'll know more as Gunn's own "Superman" movie moves forward and casting news start to come out for his "Gods and Monsters" phase of the DCU.

Read this next: Every DC Movie Made Prior To The DCEU Ranked From Worst To Best

The post The Flash's Sasha Calle Would Love to Keep Playing Supergirl in James Gunn's Rebooted DC Universe [Exclusive] appeared first on /Film.

02 Jun 10:55

Events Ripper Update

by Unknown

Working a recent incident, I came across something very unusual. I started by going back into a previous investigation run against the endpoint that had been conducted a month ago, and extracting the WEVTX files collected as part of that investigation. So, the WEVTX files were retrieved from the endpoint on 30 Apr, and when I created the timeline, I found that the four most recent time segments were from 1 June 2024...that's right, 2024!

As I was using some of the indicators we already had (file and process names) to pivot into the timeline, I saw that I had Security Event Log records from 2020...now, that is weird! After all, it's not often that I see Security Event Log records going back a week or month, let alone 3 years!

Another indicator was the sessions.pl output from Events Ripper; I had logins lasting 26856 hours (1119 days), and others lasting -16931 hours (over 705 days). Given how the session span is calculated, I knew some was "off" in the Security (and very likely, other) Event Logs, particular the records associated with logon and logoff events. 

I knew something was up, but I also knew that finding the "what was up" was also based largely on my experience, and might not be something a new or more junior analyst would be familiar with. After all, if an analyst was to create a timeline (and I'm seeing everyday that's a pretty big "if"), and if they were pivoting off of known indicators to build context, then how likely would it be that they had the experience to know that something was amiss?

So, naturally, I wrote an Events Ripper plugin (timechange.pl) to pull Security-Auditing/4616 event records from the Security Event Log and display the available information in a nice table. The plugin collects all of these events, with the exception of sub-second time changes (which can be fairly common), and displays them in a table showing the user, the time changed from, the time changed to, and via which process. I wrote the plugin, and it produced an entry on the next investigation...not one that had much impact on what was going on, as the system clock was updated by a few minutes, but this simply shows me how the use of plugins like this can be very valuable for elevating interesting and important artifacts to the analyst for review without requiring that analyst to have extensive experience.