Deze aflevering werd oorspronkelijk in mei gepubliceerd en is het eerste deel van een tweeluik. Wil je verder luisteren?

De Canta, het vaak rode, iconische invalidenwagentje, bestaat 30 jaar. Verslaggever Pim Molenaar stapte in voor een ritje en ontdekte dat Cantarijders door nieuwe regels de dupe…

De criminele organisatie wist grote hoeveelheden cocaïne via de haven van Rotterdam Europa in te smokkelen. Een deel van de opbrengsten werden geïnvesteerd in vastgoed aan de Costa del Sol.

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

iain.davidson100 has added a photo to the pool:

iain.davidson100 has added a photo to the pool:

bauplenut has added a photo to the pool:

Whale watching at Townsville, vicinity of Cape Cleveland.
27 individual whales spotted this day.

bauplenut has added a photo to the pool:

Whale watching at Townsville, vicinity of Cape Cleveland.
27 individual whales spotted this day.

bauplenut has added a photo to the pool:

Whale watching at Townsville, vicinity of Cape Cleveland.
27 individual whales spotted this day.

bauplenut has added a photo to the pool:

Whale watching at Townsville, vicinity of Cape Cleveland.
27 individual whales spotted this day.

Researchers from Germany’s Helmholtz Center for Information Security have found processors made by China’s Loongson have leaky caches that attackers could use to seek specific data. Loongson has developed its own LoongArch instruction set architecture (ISA) that blends approaches used by MIPS and RISC-V. On a site called LoongLeakAttack.com, the researchers explain that they found the leaky cache using a fuzzer, then noticed that the LoongArch ISA manual mentions an instruction that leaves 32 bits of a memory register in an “uncertain” state. “Our analysis reveals that under certain circumstances, the ‘uncertain’ data originates from the L1 data cache,” the four researchers wrote. “Since this cache is not isolated between applications, LoongLeak can leak data from other applications and the operating system. Even worse, an attacker can prime the CPU’s internal state to target the leakage to a specific cache set.” In a paper [PDF] explaining their research, authors Lorenz Hetterich, Tristan Hornetz, Fabian Thomas, and Michael Schwarz share case studies that “include recovering full-disk AES keys from the kernel, partial root password hashes from user-space, and bypassing traditional software defenses such as ASLR and stack canaries, all within seconds.” In case that’s not scaring you enough, they also point out “LoongLeak can be exploited from unprivileged user space, containers, or virtual machines.” The flaw even means “LoongLeak can cross the virtual machine boundary and leak host data from inside a VM.” “As the leakage is architectural, it requires neither high-resolution timers nor traditional sidechannel amplification, and it grants the attacker precise control over cache set and line offset,” they add. And the cherry on top is that software mitigations aren’t possible. Users with chips that possess the flaw either need to replace them or make sure they don’t allow any private data to enter or remain in the L1 cache. Making that happen can require turning off one thread per core, effectively disabling hyperthreading. The news isn’t all bad, because Loongson fixed the flaw in an update to its model 3A6000 processor, and the mitigation of evicting cache data slows performance by just 1.4 percent in the worst case. The blast radius of this flaw is also likely to be limited, because Loongson chips are hardly used outside China. The company offers chips for PCs, servers, and appliances such as printers. China’s government promotes use of Loongson chips as part of its plan to reduce dependence on imported tech. Lenovo makes laptops that use Loongson chips but only sells them in China. The Register has discussed the company’s chips with other major PC-makers, who told us they would adopt Loongson product if users want them, or if doing so becomes necessary to participate in the Chinese hardware market. But we’ve not seen a non-Chinese company adopt the processors. China’s government, however, may be nervous about this research as it has instructed public sector buyers to buy local products. Perhaps some government agencies are running vulnerable devices? If that’s the case, Beijing has its work cut out spotting any attacks, because the researchers could find “no specific tools or methods to detect if LoongLeak is being exploited.” ®

gaussnewton has added a photo to the pool:

Zelenskyy announces recapture of 745 sq km in Oleksandrivskyi sector; plea from stranded Ukrainian frontline troops. What we know on day 1,632

Continue reading...