Using and supporting GNU/Linux and Open Source Software. Usando y brindando soporte sobre GNU/Linux y software de fuente libre.
Ramos Mejía, Argentina
Joined April 2010
- Tweets4.6K
- Following561
- Followers240
- Likes4.4K
Linux Roller retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Linux Roller retweeted
OpenAI ha encontrado 948 fallos graves en el núcleo de Linux en una sola pasada, con agentes de IA que trabajaron solos, y ha escrito un parche para cada uno.
Lo publicó ayer. El núcleo de Linux tiene más de 40 millones de líneas de código y está debajo de Android, de la nube y de los superordenadores. Unos agentes eligieron qué partes revisar, otros buscaron fallos, otros los reprodujeron en máquinas aisladas, demostraron que se podían explotar y propusieron la corrección. Al final, investigadores humanos revisaron todo antes de mandarlo a los responsables de Linux.
Cada uno de esos 948 fallos permitía a un usuario sin permisos hacerse con el control total del sistema. La campaña costó 1,2 millones de dólares de uso del modelo, unos 1.279 dólares por fallo. Concursos de seguridad como Pwn2Own pagaban 20.000 dólares por uno solo. En julio, con un modelo anterior, habían encontrado 166.
En los diez días que duró el trabajo, los responsables de Linux ya habían corregido 61 y tenían otros 43 en camino.
En Certuma trabajamos con datos médicos de pacientes, y la seguridad no se negocia. Que una IA revise millones de líneas de código y deje el parche escrito cambia lo que cuesta defenderse.
Cada nueva generación de modelos va a dejar el software más difícil de atacar que la anterior.
Linux Roller retweeted
Cyberattack on France’s national blood service (EFS) via its refrigeration contractor Coolworld. Hackers reset freezers keeping blood donor samples at -30°C to a target of 110°C. The thing that stopped it from destructive impact was an on-call technician who noticed the temperatures going up. Frozen plasma intended for transfusion was stored there too. Fortunately nothing was destroyed. This was a cyberattack on a sensitive layer of healthcare. From frozen peas to boiling plasma in three weeks...?
Linux Roller retweeted
NEW PROPOSAL PASSED
House of Stake, NEAR’s decentralized onchain governance body, has voted to lower NEAR’s maximum annual issuance from 2.5% to 1.6%, phased in over 24 months.
This is how NEAR’s economics evolve transparently and programmatically: token holders put a core parameter to a public vote, and the new rate rolls out epoch by epoch on a published schedule.
For NEAR’s tokenomics, that means lower long-term issuance and a supply schedule anyone can verify.
What happens next:
✦ The House of Stake Security Council reviews the result before ratification
✦ A ~90-day grace period follows ratification
✦ Validators adopt the change through a protocol upgrade, which makes it binding
✦ Token issuance then steps down every epoch, reaching 1.6% at month 24
✦ Quarterly reports track realized issuance against the schedule
Full proposal: houseofstake.org/proposals/2…
Linux Roller retweeted
Update from the Liquid Federation:
The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC.
This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed users to move between Bitcoin and Liquid at a 1:1 rate through participating swap providers. Together, these milestones represent significant progress in the Federation’s recovery efforts and reaffirm its commitment to the long-term security, stability and resilience of the Liquid Network.
As always, the network’s bitcoin reserves are independently verifiable. Users operating their own Liquid nodes can directly verify the Federation’s Proof of Reserves, while reserve balances and network activity can be monitored through the public dashboard at liquid.network.
We extend our sincere appreciation to the Bitcoin community, Liquid users, and ecosystem partners for their patience, understanding, and continued engagement throughout the recovery process. Your support and involvement has been instrumental as we worked to restore the network’s reserves and strengthen its underlying infrastructure.
Strengthening the Liquid Network for the Future
Looking ahead, the Federation is advancing several important initiatives designed to strengthen the network’s long-term security, governance, and operational resilience.
These efforts include modernizing the governance structure, introducing clearer responsibilities and oversight, and implementing additional technical and operational safeguards to further protect the network and its participants.
More details on these initiatives and the Federation’s next steps will be shared in the coming weeks.
Restoring full bitcoin backing marks an important milestone, but our work continues. The Federation remains committed to building on the progress of recent years, advancing Liquid’s development, and strengthening the network’s resilience and accessibility for all participants.
Linux Roller retweeted
‼️ BREAKING UPDATE: Cooling systems went haywire overnight in six European countries, from Ireland to Estonia, and Carrefour Belgium now confirms a cyberattack.
In the Netherlands, cooling firm Danfoss says 17+ businesses were hit after not acting on its 13 October advice to take the systems offline. NOS reports they still had default passwords.
Ireland's SuperValu pulled chilled and frozen food from 13 stores. A Belgian butcher is binning hundreds of kilos of meat.
In Estonia, a refrigeration firm says attackers heated a supermarket freezer to 50°C.
Linux Roller retweeted
Gm or maybe ge
I have been busy
Something big is coming this Thursday
Sneak peek
Linux Roller retweeted
A little something that's not mentioned, and ppl may not even think about:
Binance did not borrow money
Binance did not sell assets
Binance did not raise money
Binance covered from its balance sheet.
This differs from other incidents that people keep wanting to compare to. 🙏
Linux Roller retweeted
Comunicado oficial:
Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada.
Reforçamos que:
• Não houve nenhum prejuízo aos clientes;
• Não houve vazamento de dados.
Como medida preventiva de proteção, depósitos e saques estão temporariamente suspensos. Nossas equipes estão mobilizadas investigando o caso, rastreando os ativos e coordenando as medidas junto às autoridades competentes.
Manteremos atualizações regulares por aqui.
Linux Roller retweeted
DPRK holds approximately 420.000 ETH from the Binance hack
Ethereum Foundation has approx 170.000 ETH in its treasury
DPRK:
ALT Look at me. I am the EF NOW
Linux Roller retweeted
Yo me dedico 101% a la seguridad informática y tengo LA CERTEZA de que eventualmente me van a hackear una cuenta, un dispositivo o algo
Si creen que ustedes y sus empresas están preparados y seguros, déjenme decirles
NO TIENEN NI IDEA DE DONDE ESTÁN PARADOS
Lo peor está por venir
Linux Roller retweeted
Pèp ayisyen,
Nou prèske fin deplwaye sòlda nou yo ak ekipman nou yo sou tè Ayiti. Sa a se pa yon operasyon kont pèp ayisyen an, ni yon envazyon peyi Ayiti. Nou pa yon gwo pisans. Nou pa gen okenn enterè ni pou nou vin domine pèp ayisyen an, ni pou nou mete men sou richès Ayiti.
Nou se yon peyi modès k ap devlope. Sèl sa nou vle, se pou kat teknisyen avyasyon nou yo tounen lakay yo. Epi n ap bay gang yo yon leson, gang sa yo k ap fè pèp ayisyen an soufri, ki touye moun pèp la renmen yo, k ap anpeche l viv yon lavi nòmal, lib, san laperèz.
Se prèske nou menm sèl k ap peye pou operasyon sa a. Menmsi nou resevwa yon ti èd lojistik nan men kèk lòt peyi, se ak pwòp ti kès nou n ap kouvri 90% nan depans yo.
Sa koute nou chè, men nou te aprann nan pwòp soufrans nou: jistis ak lapè pa gen pri. Nou te pase nan menm soufrans Ayiti ap travèse jodi a. Nou te viv yon beny san ki te pi terib toujou pase sa pèp ayisyen an ap sibi kounye a. Nou konnen sa sa vle di: viv nan laperèz, pa fè politisyen konfyans, pa kwè okenn moun ki pwomèt l ap ede w. Paske pèsonn pa t vin ede nou, e moun ki te vini yo pa t gen bon entansyon nan kè yo.
Men nou te rive chape anba sa. Apre 200 lane soufrans, finalman n ap viv nan lapè, e jodi a nou se peyi ki gen plis sekirite sou kontinan an.
Nou pa vin ann Ayiti pou nou touche lajan, paske pèsonn pa peye nou pou sa. Nou vin ann Ayiti pou nou goumen kont mechan yo.
Men sa m ap mande nou: fè nou konfyans, lapriyè sèl vrè Bondye a, epi mande L pou L geri Ayiti.
“Lè sa a si pèp ki pote non m lan lapriyè nan pye m, si yo soumèt devan mwen, si yo pran chache m ankò, si yo vire do bay vye peche yo t'ap fè yo, m'ap tande yo nan syèl kote m ye a, m'ap padonnen peche yo, m'ap fè peyi a kanpe ankò.”
2 Kwonik 7:14
Ede nou ede Ayiti.
Epi lè misyon nou an fini, n ap tounen lakay nou. Petèt jenerasyon Ayisyen k ap vini yo ap sonje nou kòm zanmi ki te vin ede yon lè.
Linux Roller retweeted
ok safe to say binance is pwned
The biggest assets were approximately:
• 1.615B USDT
• 62.6M RLUSD
• 29,934 wBETH
• 11,372 XAUt
• 6.19M UNI
• 198.4M ENA
• 7.175T PEPE
• 27.8M USD1
• 2.26M LINK
• 127,853 AAVE
about $2.5B at the explorer’s prices.
1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.
2. About four hours later, the relayer submitted an EIP-7702 authorization transaction
That installed the malicious 7702 delegate code on Binance 14.
3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.
4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).
5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool
• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.
• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.
• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA
• That EOA has only one transaction and currently holds the 195,460 ETH.
What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.
So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.
I think we can go ahead and assume DPRK.
