Ronald.phillips

Earlier this month the company sought to remove videos of a YouTuber playing a new Zelda mod. It’s a move that goes against the spirit of interactivity that fuels the medium.

These vitamins have the potential to promote hair growth and combat hair loss.

Chinese APT Evasive Panda has been observed targeting local members of an international NGO with the MgBot backdoor, delivered via legitimate software updates.

The post Chinese Cyberspies Delivered Malware via Legitimate Software Updates appeared first on SecurityWeek.

Evil Dead: The Game apparently won Game of the Year from uhh... somewhere I guess because it's getting a new Game of the Year edition.

The GOTY edition comes with the base game plus a ton of DLC including skins, survivors, demons, and items that were added after launch. The GOTY edition also includes a new "Who's Your Daddy Bundle" which includes a new survivor, demon and outfit. 

Evil Dead: The Game - Game of the Year Edition is available now for PS4, PS5, Xbox One, Series X and PC.

sciencehabit shares a report from Science Magazine: A research team has turned the bodies of dead mice into vivid 3D maps of anatomy, with tissues, nerves, and vessels highlighted in color. The technique, which renders the corpses transparent and then exposes them to fluorescent antibodies that label distinct cell types, could help everything from drug development to understanding the spread of cancer, its creators and other scientists say. The developers, at the Helmholtz Munich research institute, call their technique wildDISCO -- wild because it can work on any "wild type," or normal, mice, and DISCO for 3D imaging of solvent-cleared organs. Building on their previous success at making mouse bodies transparent, the new technique removes cholesterol from the bodies so that a vast array of existing antibodies can penetrate deep into the animals. "wildDISCO is a game changer -- it allows us to see the hidden highways and byways in the body," says Muzlifah Haniffa, a dermatologist and immunologist at the Wellcome Sanger Institute and Newcastle University's Biosciences Institute who was not involved in the research. The method should let scientists map a mouse at the cellular level and explore previously hidden links between tissues, like neural connections between organs, says neuroscientist Ali Erturk, director of Helmholtz Munich, who led the work, posted recently as a preprint. His group in Germany has already posted eye-catching videos of "flying" through the 3D anatomy of a mouse with different tissues labeled.

Read more of this story at Slashdot.

This is the latest unofficial patch for Rune: Halls of Valhalla. This patch contains some bug fixes and crash fixes, as well as redirection of in-game downloads. As with any unofficial ptach, install this at your own risk. Rune: Halls of Valhalla Version 1.08 Client LIMITATION OF LIABILITY: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL CREATORS OR ITS SUPPLIERS OR RESELLER

I analyzed a PCAP file from a sandbox execution of the Evil Extractor stealer malware earlier today. This stealer collects credentials and files of interest from the victim’s computer and exfiltrates them to an FTP server. It is designed to autonomously collect and exfiltrate data rather than receiving commands from an operator through a command-and-control channel. The EvilExtractor creators market this feature as a “golden bullet”.

Real hackers don’t use reverse shells right? If you have only one bullet, would you waste with reverse shell? Try Evil Extractor to have golden bullet.

I downloaded the Evil Extractor capture file from Triage to a Windows Sandbox environment, to avoid accidentally infecting my computer when extracting artifacts from the PCAP. I then opened it up in the free version of NetworkMiner.

NetworkMiner shows that after checking its public IP on ipinfo.io EvilExtractor makes an unencrypted HTTP connection to a web server on 193.42.33.232 to download KK2023.zip. This zip archive contains a file called “Lst.exe” which is used to steal browser data, cookies and credentials according to Fortinet.

Image: Files downloaded from TCP port 80

Twenty seconds later an FTP connection is established to 89.116.53.55 on TCP port 21. The username and password used to authenticate to the FTP server was “u999382941” and “Test1234”.

On the FTP server EvilExtractor creates a directory named after the country and hostname of the victim's PC, such as “(Sweden)DESKTOP-VV03LJ”, in which it creates the following three sub directories:

• 1-Password-Cookies
• 2-Credentials
• 3-Files

After uploading browser cookies, browser history and cached passwords from Chrome, Firefox and Edge to the “1-Password-Cookies” directory EvilExtractor sends a file called “Credentials.txt” to the “2-Credentials” directory. The contents of this text file looks something like this:

Public IP: [redacted]
Location: [lat],[long]
Computer Name: [redacted]
Username: Admin
RAM: 4 GB
OS Name: Microsoft Windows 10 Pro
OS Bit: 64-bit
Keyboard Language: en-US
GPU: [redacted]
CPU: Intel [redacted]
MAC Address: [redacted]
Extracted WIFI: [redacted]

The stealer also exfiltrates files with mpeg, docx, jpeg, pptx, zip, avi and rar extensions from the victim PC to the “3-Files” directory on the FTP server. The directory structure of the victim’s PC is maintained on the FTP server, so that files from the victim's desktop end up in a folder called “Desktop” on the FTP server.

The stealer later downloaded a keylogger module (Confirm.zip) and a webcam module (MnMs.zip), but no additional data was exfiltrated from this particular victim PC after that point.

IOC List

• Web server: 193.42.33.232:80
• FTP server: 89.116.53.55:21
• EvilExtractor: 9650ac3a9de8d51fddab092c7956bdae
• KK2023.zip: f07b919ff71fb33ee0f77e9e02c5445b
• Lst.exe: 163d4e2d75f8ce6c838bab888bf9629c
• Confirm.zip: 30532a6121cb33afc04eea2b8dcea461
• Confirm.exe: 0c18c4669e7ca7e4d21974ddcd24fdca
• MnMs.zip: bda0bda512d3e2a81fc9e4cf393091eb
• MnMs.exe: fb970c4367609860c2e5b17737a9f460

Users with an account on Triage can download the analyzed PCAP file from here: https://tria.ge/230424-vv9wvsfb2v/behavioral2

Update 2023-04-27

Jane tweeted a link to an execution of this same sample on ANY.RUN. This execution showed very similar results as the one on Triage, but with an interesting twist. Not only did the ANY.RUN execution exfiltrate images and documents from the Desktop and Downloads folders, it also exfiltrated “vv9wvsfb2v_pw_infected.zip”, which contained the EvilExtractor EXE file that was being run!

The PCAP from the ANY.RUN execution can be downloaded from here: https://app.any.run/tasks/43a11a79-4d1f-406c-86d7-158efb5ede01/

A future where all games would be live service games would be a boring future, according to former Sony Interactive Entertainment Worldwide Studios president Shuhei Yoshida.

Speaking with The Guardian in a lengthy interview that addresses a variety of other topics, one of the most recognizable faces from Sony Interactive Entertainment spoke about live service games, highlighting how he wishes the industry would continue to support and chase creative ideas and people who work on such ideas, as a future where games would become all the same, or live service games would be a bit boring for him.

While this statement may sound strange, coming from someone who's working in a company that has been increasing its effort in creating live service titles, it really isn't, considering Shuhei Yoshida was leading Sony Interactive Entertainment Worldwide Studios when Journey released, a very creative and unusual game which spearheaded a new wave of indie titles. In the interview with The Guardian, Shuhei Yoshida recalls how the launch of the game is one of the highlights of his career.

Creativity is still going to make a difference in the future of the video games industry, even in the era of AI-powered tools, according to Shuhei Yoshida. AI can produce some very strange things, he said, but these tools must be used properly. As such, AI will change the nature of learning for game developers, making it more efficient and allowing for more beautiful things to be made, possibly making creativity even more important in a future where a developer does not even need to learn how to code and program.

While many are the very creative games that get released, not many of them manage to achieve the same level of popularity as tried and true franchises and select live service games, so Shuhei Yoshida's feelings on the future of the industry are definitely warranted. Technology advancements will allow for even more creative titles, but if the market will actually embrace them enough to prevent the live service model from being the only feasible release model, only time will tell.

Fifty percent of Microsoft cybersecurity recovery engagements relate to ransomware,¹ and 61 percent of all breaches involve credentials.² In this second report in our ongoing Cyberattack Series, we look at the steps taken to discover, understand, and respond to a push-bombing request that targeted a legitimate user, allowing an attacker to authenticate and register their own mobile device.

Credential-based attacks begin with the process of stealing or obtaining credentials illegitimately. Often attackers target individuals who they believe have the credentials they need, then conduct social and dark web research on them. Phishing emails and websites created to target corporate targets only need to succeed once to gain credentials that can be sold to and shared with other bad actors.

Push-bombing is when an attacker uses a bot or script to trigger multiple access attempts with stolen or leaked credentials. The attempts trigger a rush of push notifications to the target user’s device, which should be denied. But multiple attempts can confuse a target and cause them to mistakenly allow authentication. Other times, multifactor authentication fatigue can weigh on the target, causing them to believe the access attempts are legitimate. Just one mistaken “allow” is all it takes for an attacker to gain access to an organization’s applications, networks, or files.

On average, people receive between 60 and 80 push notifications each day, with some of us viewing more than 200.³ The time it takes to swipe, tap, flag, click, save, and close every ding, buzz, pop-up, text, and tab takes a toll. Researchers believe the onslaught of notifications is causing us to get tired faster and lose focus, leaving us especially prone to distraction as the day wears on.⁴ This is what attackers count on. If an attacker gains the credentials to operate like a registered, legitimate user, identifying the intrusion and tracing their possible paths of destruction becomes paramount.

Late last year, a large enterprise customer asked Microsoft Incident Response to investigate an incursion into their on-premises Active Directory environment. Due to the risk of ongoing threats and the need for continued vigilance, the organization and attacker will be kept anonymous for this incident, and we will refer to it as “the inCREDible attack.” This credential-based incident highlights the critical need for establishing healthy habits in our security maintenance processes to combat the regular, repeated, and overwhelming credential attacks faced by today’s organizations.

In this report, we examine the factors contributing to the threat actor’s initial incursion and explore what could have happened without prompt, tactical mitigation efforts. Then we detail the required workstreams, recommended timing, and activities involved with regaining control and establishing a plan going forward. We’ll also explore four core steps customers can take to “eat their vegetables” and establish healthy habits that help minimize the risk of attack. And then we share five elements of a defense-in-depth approach that can help businesses maintain a robust defense against ransomware attacks.

Many attacks can be prevented—or at least made more difficult—through the implementation and maintenance of basic security controls. Organizations that “eat their vegetables” can strengthen their cybersecurity defenses and better protect against attacks. That means establishing a solid inventory of all technology assets, continually patching operating systems and software, and implementing comprehensive centralized log collection—all while following a well-defined retention policy. Read the report to go deeper into the details of the push-bombing attack, including the response activity, and lessons that other organizations can learn from this inCREDible case.

What is the Cyberattack Series?

With this Cyberattack Series, customers will discover how Microsoft incident responders investigate unique and notable exploits. For each attack story, we will share:

• How the attack happened
• How the breach was discovered
• Microsoft’s investigation and eviction of the threat actor
• Strategies to avoid similar attacks

Read the first blog in the Cyberattack Series, Solving one of NOBELIUM’s most novel attacks.

Learn more

To learn more about Microsoft Incident Response, visit our website or reach out to your Microsoft account manager or Premier Support contact.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and Twitter (@MSFTSecurity) for the latest news and updates on cybersecurity.

---

¹Microsoft Digital Defense Report 2022, Microsoft. 2022.

²2022 Data Breach Investigation Report, Verizon. 2022.

³Batching smartphone notifications can improve well-being, Nicholas Fitz, et al. December 2019.

⁴Phone Notifications are Messing with your Brain, Molly Glick. April 29, 2022.

The post Healthy security habits to fight credential breaches: Cyberattack Series appeared first on Microsoft Security Blog.

The browser serves as the primary interface between the on-premises environment, the cloud, and the web in the modern enterprise. Therefore, the browser is also exposed to multiple types of cyber threats and operational risks.  In light of this significant challenge, how are CISOs responding? LayerX, Browser Security platform provider, has polled more than 150 CISOs across multiple verticals and

Red Dead Redemption 2 remains the watermark for western games, and for the abilities of Rockstar Games itself. But it's the product of a storied history. You can trace it back to the original Red Dead Redemption, the early 3D Grand Theft Autos like GTA 3, and even other cowboy games like Call of Juarez. Perhaps the biggest inspiration behind Red Dead Redemption 2, however - the game that first proved it was all possible - is Gun. Developed by Tony Hawk’s Pro Skater studio Neversoft, you can experience this vital piece of gaming history yourself, and for cheap, thanks to a new GOG sale.

MORE FROM PCGAMESN: The best story games on PC, Best western games, Best sandbox games

I wish there was a hole I could just crawl into and die

One of the titles that had the greatest impact on my consciousness in the past few years was Happy’s Humble Burger Farm. What seemed like a novel concept on the surface turned out to have a lot of beef underneath. Centering a horror game around cooking is engrossing enough, but it then gets tied up in interesting ways and dunked into an unconventional world full of mystery and horror. The narrative tells the story of trying to escape from an obvious simulation, but the world in which this simulation exists is an entity worth exploring on its own.

Immediately after stepping into the game, you’re hit from all sides with flavor lore. The TV plays an almost unending list of shows, the coffee table prominently displays a book on the history of the Barnyard Buds, and a Walkman sits nearby to fill your ears with radio skits that inject fat into the world around you. None of it is necessary to understand Happy’s Humble Burger Farm’s main plot, but actually digging through it is a trip on its own.

It’s obvious someone really loves the lore and creating it because there’s a lot more of it than a five-ish hour game really needs. That’s because the Scythe Saga Universe is a sprawling concept originally dreamed up by Jon of the Shred (Jon Reilly) back in 2005. I wanted to get to know more about where this came from, so I got in touch and talked shop. Now I’m sharing that shop with you.

[caption id="attachment_375462" align="alignnone" width="640"] Screenshot by Destructoid[/caption]

Beef underneath

The Scythe Saga Universe didn’t actually originate as an idea for a video game. It was a world to base a rock opera in. “I’ve been developing all of this stuff personally since 2005 when I was just a teenager developing a rock opera,” Jon told me. “I kinda wanted all my music to be set in its own world. That ballooned out into a record label in 2012. My buddy Kaleb joined, and when he joined, he brought art and music of his own to the table. It was me and him that went forward and started a dev team with his childhood friend Blake, but it was the three of us making games that really made it a universe. Before that, it was just concept albums, like what if Dark Side of the Moon had 90 sequels.”

The short-form horror genre has taken off recently, carving a niche within a niche. Most of the time, the inspiration comes from horror movies themselves. Chillah’s Art stays in line with Japanese horror, while Puppet Combo loves their grotesque ‘80s slashers. While there is some of that inspiration, especially in Scythe’s Northbury Grove games, it’s less identifiable in Happy’s Humble Burger Farm.

“A really good comparison point is Mortal Kombat because of how they take so many different genres, and they manage to wrap it into their own unique take on how all this stuff could co-exist.” With mystical monks, sorcerors, movie stars, monsters, and special ops, the Mortal Kombat series does manage to juggle a lot of different genres. “I just really like how they’re able to connect so many different types of stuff that I love and create their own universe for it. It all feels earned.”

With slasher killers, evil corporations, and even a defined solar system to explore, the Scythe mythos already offers opportunity to a lot of different interests. For the DreadX Collection, Scythe Dev Team provided Carthanc, a game about futuristic archeology. It was set thousands of years after another game of theirs, To the End of Days, which depicted the end of the titular world, Carthanc. This is depicted as a completely different planet in the same solar system that Happy’s Humble Burger Farm takes place on. In HHBF, and even as far back as Northbury Grove, you can find mention of it within diagrams of the solar system.

[caption id="attachment_375464" align="alignnone" width="640"] Screenshot by Destructoid[/caption]

Goldeneye meets Twisted Metal

Despite the grandness and depth of the Scythe universe, you don’t need to have knowledge of it to understand the plot of the individual games. Happy’s Humble Burger Farm is about escaping a simulation. What happened in the earlier title, Happy’s Humble Burger Barn, may be directly connected, but the important details are given to you, and playing the previous game just means you have a wider insight into what’s happening. “I like to reward people with that deep lore if they’re paying attention, but it’s not necessary to fully enjoy the experience. They’re all standalone as well.

“The universe was so expansive that, by the time we started making video games, any genre we wanted to cover already existed in a pocket of this universe.” According to Mr. Of the Shred, Happy’s Humble Burger Barn started off as a first-person vehicular combat game. “Goldeneye meets Twisted Metal.” Which somehow morphed into “a drive-thru at a restaurant.” After the gameplay, Kaleb and Blake brought Jon in to “tie it into the Universe and make it scary.”

In many ways, it sounds a bit like creating a Dungeons and Dragons campaign, where there are certain standards and places to draw from for whatever story you want to tell. The big difference here is that Scythe Dev Team is drawing from lore that they themselves created.

[caption id="attachment_375463" align="alignnone" width="640"] Screenshot by Destructoid[/caption]

Sticking with you

In terms of inspiration, Jon doesn’t turn to video games. “For my writing, my music, my sound design, I’m more inspired by film.” He specifically mentions director John Carpenter as a big draw. Despite that, Scythe Dev Team tries to invoke the sense of exploration found in games like The Legend of Zelda: Ocarina of Time, where there’s a sense of wonderment at what’s unfolding around you.

Jon follows through to the extent that he doesn’t play other short-form indie developments like those from Puppet Combo. “I don’t go out of my way to play these games ‘cause I don’t want to get inspiration from them or take their ideas inspiration from them.”

I brought up the similarities between Happy’s Humble Burger Farm and Five Nights at Freddy’s. Notably, they’re set in restaurants where you’re harrowed by mascots. I asked if he played them. “What’s funny is no,” he said. “I never played any of them. I don’t know if anyone else [at Scythe Dev Team] did. When Tinybuild picked us up for Burger Farm, they told us, ‘You should use these mascots; why wouldn’t you?’ and we were, like, ‘Yeah, okay, if you’re telling us it’s a good idea, we’re going to go with it.’”

“Kaleb came up with Happy, and I came up with the rest of the Barnyard Buds based on that. My inspiration was The Animals of Farthing Wood, which is some old cartoon where the animals die viciously. It’s like Walking Dead meets Winnie the Pooh. It’s really strange.” He went on to mention Plague Dogs, Watership Down, Bambi, Land Before Time, Lion King. “They all had dark subject matter that would make them stick with you.”

“That was the Barnyard Buds. The whole joke was that meets McDonald’s.”

[caption id="attachment_375471" align="alignnone" width="640"] Screenshot by Destructoid[/caption]

The Scythian Future

Beyond the games, Scythe Dev Team does a lot of augmented reality game stuff. There are numerous in-character sites related to the universe, including Maverick Cooper News and Justice for Toe. They’re currently leading into their next game, Project Meganet, which is to be a VR title. To help with this, they’re gradually releasing microgames in a series such as Love at First Squeak.

I don’t have VR, so that kind of sucks for me. However, it’s not going to be the end of the Scythe sage. “The whole universe – the games – will all eventually come to a head, and everything will connect in ways that people don’t expect,” Jon explains. “There is a storyline that we’re following for the greater universe that we’ve alluded to so much, but no one would possibly know it’s going to happen until we do the big twist to contextualize all the hints we’ve left.”

Hopefully, we don’t get there too quickly. For now, you can get Happy’s Humble Burger Farm wherever fine video games are sold, but for some of Scythe Dev Team’s earlier titles, you’ll need to grab them off of itch.io.

The post World-building with Scythe Dev Team’s Jon of the Shred appeared first on Destructoid.

An anonymous reader quotes a report from MIT Technology Review: Joshua Bergen is a very productive person. His secret is the workspace app Notion. Bergen, a product manager living in Vancouver, uses it to plan trips abroad in meticulous detail, with notes and timelines. He uses it to curate lists of the movies and TV shows he's watched, and records what he thought of them. It's also a handy way to keep tabs on his 3D-printing projects, map snowboarding runs, and quickly update his cute list of the funny things his kid has said. It might sound strange, but Bergen is one of a growing number of people using Notion, software intended for work, to organize their personal lives. They're using it in a myriad of different ways, from tracking their meditation habits and weekly schedules to logging their water intake and sharing grocery lists. So why has a platform built to accommodate "better, faster work" struck such a chord when there are countless other planning apps out there? Part of the reason Notion has such a devoted fan base is its flexibility. At its heart, Notion is designed to combine the various programs a business might use for functions like HR, sales, and product planning in a single hub. It uses simple templates that let users add or remove features, and remote workers can easily collaborate on notes, databases, calendars, and project boards. This high level of customizability sets Notion apart from other work apps. It's also what's made it so popular among people looking to map out their free time. It started to gain traction around 2018 in YouTube's thriving productivity subculture, where videos of fans swapping time management tips and guides to organizing their lives regularly rack up millions of views. Since then, its following has snowballed. More than 275,000 people have joined a dedicated subreddit, tens of thousands of users share free page templates in private Facebook groups, and TikTok videos advising viewers on how to make their Notion pages look pretty have been watched hundreds of millions of times. "You don't have to change your habits to how rigid software is. The software will change how your mind works," says Akshay Kothari, Notion's cofounder and chief operating officer. "I think that's actually been a big reason why you see so much love in the community: because people feel like the things they build are theirs." While platforms like Notion are great for people who enjoy feeling organized, spending too much time optimizing and organizing our lives can be counterproductive when we prioritize creating to-do lists over completing the actual tasks on them, says Gabriele Oettingen, a psychology professor at New York University. It's a phenomenon known as the planning fallacy. Using Notion to track whether you're drinking enough water or going jogging, or using it to plan assignments, doesn't necessarily mean you're actually getting those things done. "In a way, Notion might help me to get structure, but it might not work to get me going," she says.

Read more of this story at Slashdot.

Mandoline slicers have a scary reputation. And yes, they’re sharp as heck, and can do major damage if you don’t respect the blade. But inviting one into your kitchen is one of the easiest ways to cut down on prep time and improve your cooking.

Read more...

[link] [126 comments]

A draft law that aims to criminalize and prosecute those who "create conditions for online piracy" has been approved by Bulgaria's Council of Ministers. The proposed amendments are Bulgaria's response to heavy criticism from the United States, most publicly via the USTR's Special 301 Reports. It's hoped that prison sentences of up to six years will send a deterrent message. TorrentFreak reports: Last week the Council of Ministers approved draft amendments to the Criminal Code that aim to protect authors, rightsholders, and state revenue. "Crimes against intellectual property should be perceived as acts with a high degree of public danger, not only considering the rights and interests of the individual author, which they affect, but also considering the financial losses for the holders of these rights, which also affects the revenues in the state budget," the explanatory notes read. The stated aim of the bill is to solve identified weaknesses by upgrading substantive law to counter computer-related crimes against intellectual property. The text references those who "build or maintain" an information system or provide a service to the information society for the purpose of committing crimes. The notes offer further clarification. "The bill aims to prosecute those who create conditions for online piracy -- for example, by building and maintaining torrent tracker sites, web platforms, chat groups in online communication applications for the online exchange of pirated content, and any other activities that may fall within the definition of 'information society service' within the meaning of the Electronic Commerce Act (pdf) and which are carried out with the specified criminal purpose." The Bulgarian government notes that the amendments are part of its response to criticism in the USTR's Special 301 Report. [When countries are placed on the USTR's 'Watch List' for failing to combat piracy, most can expect years of pressure punctuated by annual Special 301 Reports declaring more needs to be done. Bulgaria was on the Watch List in 2015 when the USTR reported "incremental progress" in the country's ability to tackle intellectual property infringement, albeit nowhere near enough to counter unsatisfactory prosecution rates. In 2018 the United States softened its position toward Bulgaria, removing it from the Watch List on the basis that the government would probably deliver.] The fact that Bulgaria has been absent from the 'Watch List' for the last five years is down to "specific commitments" made by the authorities, with progress being monitored closely by the United States in respect of Bulgaria's future status. The draft approved by the Council of Ministers last week envisions sentences of up to six years imprisonment and a fine of up to $5,600. According to the draft, there is no intent to prosecute individual users who simply consume pirated content.

Read more of this story at Slashdot.

Microsoft's Edge browser appears to be sending URLs you visit to its Bing API website. Reddit users first spotted the privacy issues with Edge last week, noticing that the latest version of Microsoft Edge sends a request to bingapis.com with the full URL of nearly every page you navigate to. Microsoft tells The Verge it's investigating the reports. From a report: "Searching for references to this URL give very few results, no documentation on this feature at all," said hackermchackface, the Reddit user who first discovered the issue. While Reddit users weren't able to uncover why Microsoft Edge is sending the URLs you visit to its Bing API site, we asked Rafael Rivera, a software engineer and one of the developers behind EarTrumpet, to investigate, and he discovered it's part of a poorly implemented new feature in Edge. "Microsoft Edge now has a creator follow feature that is enabled by default," says Rivera in a conversation with The Verge. "It appears the intent was to notify Bing when you're on certain pages, such as YouTube, The Verge, and Reddit. But it doesn't appear to be working correctly, instead sending nearly every domain you visit to Bing."

Read more of this story at Slashdot.

Yesterday we reported that MSI announced a wave of firmware updates designed to address and alleviate potential issues with users on AM5 using AMD's Ryzen 7000X3D processors with 3D V-Cache. One of the main changes with MSI's latest UEFI firmware for AM5 included voltage restrictions when using Ryzen 7000X3D series CPUs so that these chips couldn't be overvolted as the V-Cache packaging is somewhat sensitive to additional power.

Further to MSI's announcement, ASUS has released a statement to experienced engineer and extreme overclocker Roman 'Der8auer' Hartung, which addresses the potential issue with using AMD's EXPO memory profiles in conjunction with the Ryzen 7000X3D series chips. One of the key elements that seemingly surrounds the problem is the use of AMD's EXPO memory overclocking profiles.

ASUS's Director of Global Product Marketing and Technical Marketing, Rajinder Gill, said in a statement to Der8auer, "The EFI updates posted on Friday contain some dedicated thermal monitoring mechanisms we've implemented to help protect the boards and CPUs. We removed older BIOSes for that reason and also because manual Vcore control was available on previous builds." Rajinder also said, "We're also working with AMD on defining new rules for AMD Expo and SoC voltage. We'll issue new updates for that ASAP. Please bear with us."

ASUS ROG Crosshair X670E Hero AM5 Motherboard for AMD Ryzen 7000 Series CPUs

Looking at the narrative of the statement provided to Der8uaer from Rajinder, we can confirm that ASUS has indeed removed older iterations of its firmware for its AM5 motherboards. Looking at the EMEA side of things, at the time of writing, the latest firmware update to be posted on the ASUS product pages is dated 04/21/2023, which indicates ASUS recently updated the firmware, but the update isn't the latest one in question.

Roman 'Der8auer' Hartung's Ryzen 9 7900X also has a bulge.

The one thing these issues have in common is that AMD's EXPO memory profiles have been applied, claims Roman 'Der8auer' Hartung, and even highlighted that his Ryzen 9 7900X processor also fell foul the the 'bulging issue.' This is particularly interesting as this isn't an X3D series chip with 3D V-Cache, although we're not aware of any other reports of non-X3D Ryzen 7000 chips being affected at this time.

Enabling EXPO memory profiles on Ryzen 7000 processors does several things to the processor that pushes it beyond the technical specification of the chip. Chief among these is raising the SoC voltage and some other primary voltages, such as VDDIO, which are used to feed the IOD. Like any ASIC, there are limits to how high voltages can be safely pushed, and this is one theory behind the cause of the recent run of damaged Ryzen reports. Though how this might be connected to the issue being centered around Ryzen X3D chips – where the voltage-sensitive V-Cache is on the CCDs and their separate voltage plane – is unclear at this time.

In any case, this does underscore why AMD's EXPO memory overclocking profiles void the warranty on these chips, as there's more to EXPO than just ramping up memory frequencies and applying more voltage to the DRAM itself.

Further to Rajinder's statement given to Der8auer, ASUS's Senior Technical Marketing Manager, Juan Jose Guerrero, posted the following statement on Twitter Tuesday afternoon:

As we mentioned in our article yesterday about MSI addressing CPU voltage on their own AM5 motherboards, vendors are looking to address any more potential issues, following a small-but-concerning number of reports circulating on Reddit that their Ryzen 7000X3D processors are burning out and killing the motherboard in the process. ASUS's statement and the summary of the firmware on the official product page indicate that ASUS is worried about SoC voltage, and as such, the new firmware locks it down to 1.30 V. Which ASUS states is to 'protect the CPU and motherboard.' 

Screenshot of the ROG Crosshair X670E Extreme BIOS/Support page on the official product page (China).

On the Chinese product page for the ROG Crosshair X670E Extreme, the firmware has been updated as of today (at the time of writing) to 04/25/2023, and the firmware version in question (1302) does seemingly address the SoC voltage.

Further to ASUS's and MSI's statements, AMD has officially responded with a statement of their own:

It reads, "We are aware of a limited number of reports online claiming that excess voltage while overclocking may have damaged the motherboard socket and pin pads. We are actively investigating the situation and are working with our ODM partners to ensure voltages applied to Ryzen 7000X3D CPUs via motherboard BIOS settings are within product specifications. Anyone whose CPU may have been impacted by this issue should contact AMD customer support."

Of course, these issues of Ryzen 7000X3D series processors burning out aren't just limited to those using MSI and ASUS motherboards. Since the initial reports, users have reported additional issues on various models and brands across threads on Reddit. The potential for damage is one of the primary reasons AMD locked down the X3D series processors so that users couldn't manually overclock them. Even the first iteration, the Ryzen 7 5800X3D, was also locked down.

One thing remains clear: AMD and its motherboard partners are now officially investigating the matter, and users with affected Ryzen 7000 CPUs are advised to contact AMD customer support directly.

Microsoft has released their earnings for the quarter ending March 31, 2023 (their fiscal year runs from July 1 until the end of June the next year) and, overall, it was a good quarter for the company. Revenue for the quarter was $52.9 billion, up 7 percent compared to the same quarter last year. Unfortunately for Xbox boosters, the gaming division was not one of the standout parts of the company. In fact, some of the figures posted were downright concerning.

In Q3 2023, Xbox hardware revenue (almost entirely derived from Xbox Series X/S at this point) was down a whopping 30 percent year-on-year. That’s a rather startling figure considering sales of the rival PS5 are on fire right now, with Sony setting new sales records seemingly every month. The conventional wisdom is that a high tide lifts all boats, but apparently that’s not the case with the Xbox Series X/S. Now that folks can more easily buy a PS5 it seems they’re not interested in picking up an Xbox Series X/S as an alternative.

Meanwhile, on the games front, Xbox content and services was up slightly (3 percent) mostly driven by Xbox Game Pass subscriptions. That may sound like a positive, and it is to a degree, but such a slim increase can’t be the kind of growth Microsoft is looking for from Game Pass considering how many eggs they’ve put in this basket. This past quarter saw the release of GoldenEye 007 and the shadow-launch of the acclaimed exclusive Hi-Fi Rush, but apparently, those games’ effect on subscription revenue wasn’t huge. We already know Game Pass badly missed subscriber targets in fiscal year 2022 and it seems the service may be on track to do the same in FY2023.

Microsoft is currently trying to get their proposed acquisition of Call of Duty publisher Activision Blizzard past regulators. If they can achieve that, their gaming fortunes will look quite different, but for now, they seem to be struggling to put the pieces together.

This current quarter (Q4 2023) will see the release of some major Xbox published titles, including Minecraft Legends and Redfall, so hopefully, Microsoft’s next earnings report will be a better one for the gaming division. Microsoft CFO Amy Hood provided an optimistic Q4 outlook during Microsoft's earning call, predicting "mid-to-high single-digit growth" in Xbox revenue year-on-year due to third and first-party releases and Game Pass. Whether that comes to pass, remains to be seen.

What are your thoughts on the latest results from Xbox? Is there anything Microsoft can do to spur Xbox Series X/S sales? Is Game Pass going to continue to grow or remain more-or-less stalled out where it is?

This article contains spoilers for "Yellowjackets."Even if you've never watched a single second of Showtime's hit series "Yellowjackets," you probably know that the show deals with a high school girl's soccer team stranded in the wilderness and a whole lot of cannibalism. Maybe it's because I'm a Sicko™ who watched "Cannibal Holocaust" a little too young, but "Yellowjackets" has currently featured a pretty acceptable amount of cannibalism. I mean, if you consider anything more than "one" to be an acceptable number.Season 2 kicked off with the show's first foray into eating human flesh, when pregnant teen Shauna (Sophie Nélisse) ate the frozen ear off of the corpse of her best friend, Jackie (Ella Purnell), who froze to death in the season 1 finale. 

The moment was shocking, disgusting, and weirdly poetic, as Shauna's love for her best friend seemed to extend to her desire to make Jackie a part of her. The show's creative team has already spoken about how her act of eating the ear was hotly debated in the writer's room, with co-creator Bart Nickerson saying: "And then the other thing is — and I usually don't want to do this, talk about what almost was — but I just think it's hilarious the amount of time that we spent both in breaking writing and then in editing, deciding how much of the ear — like, should it go in the mouth, should it not go in the mouth? Should there be a chew?"

No one in the "Yellowjackets" cast interacts with Jackie's ear other than Shauna, which is probably why no one noticed when Sophie Nélisse accidentally took it home with her as an unintentional keepsake. Not the one she ate, of course.

'What Is This Weird, Squishy Thing?'

During a recent interview with Esquire, Sophie Nélisse admitted that she absentmindedly put the ear in her pocket after shooting one day, and didn't find it until months later. "I was going through my pocket and I was like, 'What is this weird squishy thing ... Oh my god, it's the ear,'" she said. The ear in question was made out of silicone, which is fortunate considering much of the edible flesh in "Yellowjackets" is made out of candy.

"You'll see eventually in the show there's other things that we eat that are actually made out of gummy bear," she told Esquire. "They're actually so tasty, but they look so real and gooey and gross that our brains can't really disassociate and step back away from it. It feels disgusting eating it—even though it's actually quite yummy. It's literally a giant gummy bear." Co-star Samantha Hanratty, who plays Misty Quigley, is a proud vegan and has confirmed that some of what she's provided is made of Beyond Meat or vegan-friendly gummies.

As for the ear? Nélisse said she keeps it hidden away in her room. " It'd be a bit of a red flag if someone came into my room and there's this whole little ear on my countertop. So, it's hidden away in a little souvenir box." Aw, it's just like the heart box from "Snow White." How sweet!

Read this next: Every Yellowjackets Main Character, Ranked

The post Yellowjackets Sophie Nelisse Accidently Took Jackie's Ear Home With Her appeared first on /Film.

Reply from Japheth, 25.04.2023, 12:58:

> What can I do now ?

1) Forget this old stuff!
2) Use the latest HX ( v2.20 )
3) Download vsbhda ( a fork of SBEMU )
4) replace the hdpmi32i.exe binary of HX v2.20 with the one contained in vsbhda.zip
4a) optionally install the JemmEx.exe binary contained in vsbhda.zip ( not really required for DosBox ).
5) install vsbhda
6) run DosBox

Both HX and VSBHDA can be easily found at github.

Why is Visibility into OT Environments Crucial? The significance of Operational Technology (OT) for businesses is undeniable as the OT sector flourishes alongside the already thriving IT sector. OT includes industrial control systems, manufacturing equipment, and devices that oversee and manage industrial environments and critical infrastructures. In recent years, adversaries have recognized the

Threat actors are employing a previously undocumented "defense evasion tool" dubbed AuKill that's designed to disable endpoint detection and response (EDR) software by means of a Bring Your Own Vulnerable Driver (BYOVD) attack. "The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying

Managing vulnerabilities in the constantly evolving technological landscape is a difficult task. Although vulnerabilities emerge regularly, not all vulnerabilities present the same level of risk. Traditional metrics such as CVSS score or the number of vulnerabilities are insufficient for effective vulnerability management as they lack business context, prioritization, and understanding of

This post is part of Lifehacker’s “Living With AI” series: We investigate the current state of AI, walk through how it can be useful (and how it can’t), and evaluate where this revolutionary tech is heading next. Read more here.

Read more...

Clyde: Do you know what I wonder about you?

Jackie: What?

Clyde: How your cunt taste like.
Shocked?

Jackie: Not really.

Red Dead Redemption 2 might be my favourite game of all time - at least my favourite big-budget, mainstream game. To the occasional chagrin of my PCGamesN colleagues, I’m a little difficult (perhaps too difficult) to please, but the western sandbox game by Rockstar continues to impress me some five years after its launch. And clearly I’m not alone, as new figures see Red Dead Redemption 2 jump up the Steam sale and player charts, beating even Grand Theft Auto 5. But with GTA 6 on its way, despite its popularity, RDR2 updates from Rockstar are likely a thing of the past.

MORE FROM PCGAMESN: The best story games on PC, Best western games, Best sandbox games

The Galaxy S22 Ultra has just made history as it has become the first smartphone to be used to place a satellite voice call. This was done by a partnership between AST SpaceMobile and AT&T, the call was made using a standard device with no modifications, and it was made from Texas to a phone in Japan.

AST SpaceMobile and AT&T's partnership to use a Galaxy S22 Ultra for satellite voice call could revolutionize satellite communication

So, how did it work? Well, AST and AT&T used the Galaxy S22 Ultra to place a call to BlueWalker 3 satellite. Once the call was received by the satellite, it was then forwarded to the phone in Japan. Acting as an intermediary was an AT&T spectrum, and this right here is the key that made the whole process work without needing a smartphone capable of satellite calls. This also means that any smartphone with 4G LTE can theoretically work.

Now, another interesting thing to note here is that this test proves that the BlueWalker 3 satellite is perfectly capable of handling cellular data speeds, which, in simpler terms, means that any smartphone can use this technology without having to use the latest technology, or some expensive changes being made to how networks already work. If the Galaxy S22 Ultra was used for this, there is a possibility that we could see the same test being done on other phones.

With more research on this application and how it works, in the future, we could see various regions being connected to each other using off-the-shelf smartphones instead of specialized communication. Sure, most people would have a hard time understanding why there is a need for such a technology in the first place. But we have to remember that there are cellular deadzones around the world, areas where standard cell towers cannot be installed for one reason or another, and because of the same reason, having satellite calling available to your standard smartphones is an excellent move.

Sadly, we will have to wait and see for a broader implementation but based on the current founding, it certainly is a promising start that could one day revolutionize smartphone calling. The best part? You won't need a $1,000+ smartphone to make this happen, as any phone that has cellular connectivity should be able to support this.

Source: Business Wire.

In a world that’s constantly changing and challenging us, we believe that nothing can stop us when we work together. That’s the spirit of collaboration we celebrated on April 24, 2023, at the fourth annual Microsoft Security Excellence Awards. These awards recognize outstanding contributions from Microsoft Intelligent Security Association (MISA) members.

MISA is a coalition of Microsoft leaders and subject matter experts, independent software vendors (ISVs), and managed security service providers (MSSPs). Together, we work to defend organizations around the world from increasing threats. Security is a broad, collaborative business, and our amazing partners continue to show their resilience and excellence in delivering comprehensive protection integrated with Microsoft Security technology.

In San Francisco, California, on the first day of the RSA Conference (RSAC), we were honored to bring together MISA members and Microsoft Security leadership to honor the top finalists and announce award winners.

“It is my privilege to acknowledge this year’s Microsoft Security Excellence Awards recipients, who continually inspire us with their commitment to building a safer world for all. Their solutions, services, innovative spirit, and customer focus are integral to this goal. Security is a team sport, and we are proud to partner with our MISA community. My warmest congratulations to all the awardees.”

—Vasu Jakkal, Corporate Vice President (CVP), Microsoft Security, Compliance, Identity, and Privacy

Security for all  

We believe that inclusivity is not just an ethical choice, but also a strategic advantage. That’s why we’re proud to showcase the investment and efforts our partner ecosystem has made to promote diversity and inclusion. This year we recognized the first winner of the new Diversity in Security award. This award honors a partner who has gone above and beyond to foster diversity and cultivate positive change within the industry, and ultimately improve our ability to protect customers against cyberthreats.

Security is a team sport, one that always needs new players. So, we were also proud to recognize the next generation of security defenders. Microsoft is partnering with Last Mile Education Fund by funding scholarships for underrepresented students to help target the nationwide shortage of cybersecurity talent while Shadow Hunter is our gamified experience that immerses contestants in a simulated real-world cybersecurity scenario to build and test security skills. Bringing the two together was natural. We invited students from around the United States to challenge themselves in our special Last Mile Education Fund and Microsoft Security Immersion Event: Shadow Hunter four-hour virtual events. To acknowledge those students who achieved the top scores among their peers, Bret Arsenault, CVP and Chief Information Security Officer, Microsoft, and Ruthe Farmer, Founder, Last Mile Education Fund, recognized the top 10 students—Logan Gamma, Joan Waldron, Dialla Diarra, Cristian Carrillo Mendez, Lisa Friel, Afraz Sakib, Alexandra Farina, Sean Dixon, Amanda Hite, and Angelina Zhukova—for their ongoing accomplishments.

2023 Security Excellence Award winners

Both technology and people are essential for creating a secure future, and we were thrilled to recognize some of the top companies and individuals in the field across 11 award categories that reflect the diverse and valuable contributions of MISA members. We were impressed by the hundreds of award nominations we received. The panel diligently reviewed each one and shortlisted five nominees for each category. Winners were then decided by the votes of Microsoft and MISA members.

We are proud to announce the finalists and winners in each category:

Security Trailblazer

Partners that have delivered innovative solutions or services that leverage the full Microsoft range of security products and have proven to be outstanding leaders in accelerating customers’ efforts to mitigate cybersecurity threats.

• Ascent Solutions—Winner
• Critical Start
• D3 Security
• Quorum Systems
• Synack

Compliance and Privacy Trailblazer

Partners that deliver innovative solutions or services and are distinguished leaders in driving holistic or end-to-end Microsoft compliance or privacy strategy with customers.

• Protiviti—Winner
• archTIS
• Epiq
• Infotechtion
• Relativity

Identity Trailblazer

Partners that are leaders in the identity space and have driven identity-related initiatives and delivered innovative solutions or services with Microsoft Azure Active Directory.

• EY—Winner
• HCLTech
• Squadra Technologies
• Synergy Advisors
• Thales

Zero Trust Champion

Partners that are dedicated to supporting customers in their Zero Trust journey and have demonstrated vital integrations with the Microsoft Zero Trust platform.

• Silverfort—Winner
• Avanade
• Netskope
• Oxford Computer Group
• Yubico

Security Software Innovator

ISVs that have developed innovative solutions with disruptive and transformative technology in collaboration with Microsoft that makes work easier for our mutual customers.

• Relativity—Winner
• 42Crunch
• Axiad
• ContraForce
• Theom

Security Services Innovator

MSSPs that are exceptional at educating the market on security risks and driving holistic end-to-end managed extended detection and response (MXDR) security strategy with customers using Microsoft Security products and that deliver innovative and transformative security services to customers.

• Ontinue—Winner
• Bridewell
• Difenda
• Quorum Cyber
• Wortell

Security Customer Champion

Partners that go above and beyond to drive customer impact and that have a proven track record of customer obsession and success.

• Vectra—Winner
• Epiq
• F5
• Lighthouse
• Ontinue

Security Changemaker

Individuals within partner organizations who have made a remarkable security contribution to the company or the larger security community.

• Katie Nickels, Red Canary—Winner
• Federico Charosky, Quorum Cyber
• Jeffrey J. Engle, Conquest Cyber
• Harry Haramis, Keyfactor
• Mike Ounsworth, Entrust

Diversity in Security

Partners that have demonstrated a significant commitment to enhancing diversity, equity, and inclusion to better serve security customers and foster change in the industry.

• Lighthouse—Winner
• Difenda
• KnowBe4
• Recorded Future
• Wortell

Security ISV of the Year

ISVs that are all-around powerhouses, show growth potential and have innovative security solutions that integrate with a MISA-qualifying security product.

• Adobe—Winner
• Cloudflare
• Delinea
• Silverfort
• Thales

Security MSSP of the Year

MSSPs that are all-around powerhouses with strong integration between Microsoft products and ongoing managed security services that drive the end-to-end Microsoft Security stack to our mutual customers.

• BlueVoyant—Winner
• glueckkanja-gab
• PwC
• Red Canary
• Wipro

We’re ready for what’s next

This was an amazing evening, bringing together MISA members, Microsoft executives, and future security experts. Many thanks to all who came, and congratulations again to all our finalists and winners. One constant within the ever-changing world of cyberthreats is the way our community comes together to protect and empower customers. We look forward to seeing everything you accomplish in the upcoming year.

If you’re at the RSA Conference through April 27, 2023, come and visit us at the Microsoft Booth 6044 North Expo where MISA members will be showcasing their solutions at our MISA demo station and the Microsoft Theater. We’d love to see you at the following sessions:

• Session 20: Build your MXDR environment using the Azure Marketplace in 5 minutes (Wednesday, April 26, 2023, 10:10 AM PT to 10:30 AM PT).
• Session 21: Using breach and attack simulation across the Microsoft Security portfolio to optimize your SecOps (Wednesday, April 26, 2023, 10:40 AM PT to 11:00 AM PT).
• Session 22: Achieving Zero Trust application access with Cloudflare One and Microsoft Security (Wednesday, April 26, 2023, 11:10 AM PT to 11:30 AM PT).
• Session 23: “Power of Partnerships”—Services + Technology + Microsoft (Wednesday, April 26, 2023, 11:40 AM PT to 12:00 PM PT).
• Session 28: The new MXDR paradigm: Nonstop SecOps through real-time collaboration and AI-driven automation (Wednesday, April 26, 2023, 2:10 PM PT to 2:30 PM PT).

Figure 1. MISA member companies will share how they work together with Microsoft to protect customers from cyberthreats. Sessions will be presented by the following MISA members: BUI, SafeBreach, Cloudflare, Relativity and Epiq, and Ontinue.

Figure 2. MISA and its ecosystem of ISVs and MSSPs, with solutions integrated with the Microsoft’s security technology, will have a demo station at the RSAC Microsoft booth. Demos will take place on Monday, April 24, 2023, through Thursday, April 27, 2023, throughout the conference hours. The following MISA ISV and MSSP vendors will be giving demos: Cerby Kovrr, Elevate Security, Red Canary, Yubico, Lighthouse, Ascent Solutions, Wipro, Adobe, Forsyte, Corelight, 42Crunch, Maureen Data Systems, Datawiza, Secude, Avanade, archTIS, Difenda, Quorom Cyber, Netrix, Theom, BlueVoyant, BigID, and Synergy Advisors.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and Twitter (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Microsoft announces the 2023 Microsoft Security Excellence Awards winners appeared first on Microsoft Security Blog.

Who you know is just as important as what you know in business. These two work in tandem to afford you a successful career, regardless of the industry. While the latter sets you on course to launch a career, the former helps you gain access to the resources, funding, or advice needed to pursue your career goals.