Month: March 2020

Enlarge (credit: Frank Lindecke / Flickr)

Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible.

Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic.

The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.

Enlarge / A treadmill desk at the Google offices in Washington, DC. (credit: Bloomberg/Andrew Harrer/Getty)

Some years back, not content with sitting at a computer all day for work and not happy just to stand in one spot, I embarked upon a quest to walk while working. Since then, I built two of my own "treadmill desks" for a few hundred bucks each and logged thousands of miles on them.

They certainly aren't flashy kit, but they keep me happier and healthier when I work from home. And in the midst of our global quarantine, I thought my setup might prove inspirational to some of my fellow geeks.

Work walking

I have now built two different DIY treadmill desks, one in the US and one in the UK. In both cases, I purchased an old treadmill for about $200, added either shelving from Home Depot (about $100) or a standing desk from Ikea (about $150), and was good to go. When I first did this about seven years ago, pre-made "treadmill desks" started at around $1,500—though entry-level walking units—now appear to start around $500. Personally, though, I preferred an older, heavy-duty treadmill to an inexpensive, light-weight model.

Enlarge / The graphics here are bright and colorful. (Note that all shots are from the pre-release version of the game.)

Welcome to Ars Cardboard, our weekend look at tabletop games! Check out our complete board gaming coverage at cardboard.arstechnica.com.

Charterstone has been one of the most popular "legacy" board games since that style of game first emerged. (A legacy game alters rules and board state permanently across multiple playthroughs, often based on an overarching storyline.) It's also a standalone legacy game, not an extension of previous brands, like Pandemic (the massive hit), Risk (the original), and Machi Koro (the unnecessary).

Acram Digital just released its digital adaptation of Charterstone (read our review of the tabletop version), and it's a strong one, with outstanding graphics and competitive AI players—but a very crowded screen that, on Steam at least, made it hard to see the entire board.

Enlarge / Truck stops around the US remain busy. (credit: Getty Images)

As cities and states have raced to shut down businesses to prevent the spread of COVID-19, the roads have gone quieter. Normally gridlocked cities like Los Angeles and Chicago have seen much faster traffic speeds during so-called rush hour—53 percent and 70 percent, respectively—as residents hunker down and hope social distancing does its work.

But shelter-in-place orders are harder to carry out when your office is moving 65mph, traveling hundreds of miles a day, and helping to move the emergency supplies that are keeping the country running during an unprecedented public health crisis. “We’re still moving America,” says Steve Fields, a Kansas City-based truck driver with YRC Freight.

“COVID-19 is causing the mother of all supply chain disruptions,” Peggy Dorf, an analyst with the freight marketplace DAT Solutions, wrote this week on the company’s blog. Emergency medical supplies like masks, ventilators, and soap need to be transported from manufacturers to medical centers, and the raw materials that help manufacturers build those things—paper, plastic, alcohol—need to get to the factory. Grocery shelves must be restocked, and quickly, while customers like schools no longer need their regular shipments. Americans everywhere cry out for more toilet paper.

Enlarge (credit: Getty / Aurich Lawson / Atari)

Many people now stuck at home are no doubt lamenting the lack of live sports to watch. This weekend was supposed to be a big one for the motorsports world, with not one but two endurance races at that bumpy WWII airbase in Sebring, Florida, followed by F1 in Bahrain and NASCAR in Miami. Coronavirus canceled all that, but it turns out there's an audience of hungry eyeballs ready to watch racing even if it is of the esports variety.

Across the sport, people are stepping up to put on shows so there's something to take our minds off the outside world for a bit. Much of it will be shown on YouTube and Twitch, but even broadcast TV is getting in on the act as major stars from the world of physical racing series do something a little less dangerous but perhaps no less entertaining than their 200mph day jobs. Here's what's coming up.

Another All-Star Esports Battle

Last weekend's All-Star Esports Battle was well-named because the entry list was packed with legitimate stars of the sport; established names like Max Verstappen, Juan Pablo Montoya, and Simon Pagenaud, as well as up-and-coming racers.