Month: January 2024

Enlarge

Software maker Ivanti is urging users of its end-point security product to patch a critical vulnerability that makes it possible for unauthenticated attackers to execute malicious code inside affected networks.

The vulnerability, in a class known as a SQL injection, resides in all supported versions of the Ivanti Endpoint Manager. Also known as the Ivanti EPM, the software runs on a variety of platforms, including Windows, macOS, Linux, Chrome OS, and Internet of Things devices such as routers. SQL injection vulnerabilities stem from faulty code that interprets user input as database commands or, in more technical terms, from concatenating data with SQL code without quoting the data in accordance with the SQL syntax. CVE-2023-39366, as the Ivanti vulnerability is tracked, carries a severity rating of 9.6 out of a possible 10.

“If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication,” Ivanti officials wrote Friday in a post announcing the patch availability. “This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server.”

Enlarge / The Microsoft Ergonomic Keyboard is making a comeback. (credit: Microsoft)

In April, Microsoft announced that it would stop selling Microsoft-branded computer peripherals. Today, Onward Brands announced that it's giving those discarded Microsoft-stamped gadgets a second life under new branding. Products like the Microsoft Ergonomic Keyboard will become Incase products with "Designed by Microsoft" branding.

Beyond the computer accessories saying "Designed by Microsoft," they should be the same keyboards, mice, webcams, headsets, and speakers, Onward, Incase's parent company, said, per The Verge. Onward said its Incase brand will bring back 23 Microsoft-designed products in 2024 and hopes for availability to start in Q2.

Some of the Microsoft-designed gear that Incase is relaunching. (credit: Incase )

Incase also plans to launch an ergonomic keyboard that Microsoft designed but never released. Onward CEO Charlie Tebele told The Verge that there's "potential" for Incase to release even more designs Microsoft never let us see.

Enlarge (credit: Aurich Lawson | Getty Images)

Hey Android users, are you tired of Google's neglect of Google Assistant? Well, one of Google's biggest rivals, OpenAI's ChatGPT, is apparently coming for the premium phone space occupied by Google's voice assistant. Mishaal Rahman at Android Authority found that the ChatGPT app is working on support for Android's voice assistant APIs and a system-wide overlay UI. If the company rolls out this feature, users could set the ChatGPT app as the system-wide assistant app, allowing it to pop up anywhere in Android and respond to user questions. ChatGPT started as a text-only generative AI but received voice and image input capabilities in September.

Usually, it's the Google Assistant with system-wide availability in Android, but that's not special home cooking from Google—it all happens via public APIs that technically any app can plug into. You can only have one app enabled as the system-wide "Default Assistant App," and beyond the initial setting, the user always has to change it manually. The assistant APIs are designed to be powerful, keeping some parts of the app running 24/7 no matter where you are. Being the default Assistant app enables launching the app via the power button or a gesture, and the assist app can read the current screen text and images for processing.

The Default Assistant App settings. (credit: Ron Amadeo)

If some Android manufacturer signed a deal with ChatGPT and included it as a bundled system application, ChatGPT could even use an always-on voice hotword, where saying something like "Hey, ChatGPT" would launch the app even when the screen is off. System apps get more permissions than normal apps, though, and an always-on hotword is locked behind these system app permissions, so ChatGPT would need to sign a distribution deal with some Android manufacturer. Given the red-hot popularity of ChatGPT, though, I'm sure a few would sign up if it were offered.

Enlarge / The Notre-Dame de Paris has been under restoration since a devastating fire destroyed the main spire and roof in April 2019. (credit: Maxime L'Héritier/CC-BY 4.0)

There's rarely time to write about every cool science-y story that comes our way. So this year, we're once again running a special Twelve Days of Christmas series of posts, highlighting one science story that fell through the cracks in 2023, each day from December 25 through January 5. Today: The Notre Dame cathedral in Paris has been undergoing extensive renovation in the wake of a devastating 2019 fire. Previously hidden portions of its structure have revealed the use of iron reinforcements in the earliest phases of the cathedral's construction, making it the earliest known building of its type to do so.

On April 15, 2019, the world watched in collective horror as the famed Notre Dame cathedral in Paris was engulfed in flames. The magnificent cathedral's roof and its support structure of 800-year-old oak timbers were destroyed when the main spire—750 tons of oak lined with lead—collapsed in flames, landing on the wooden roof. French President Emmanuel Macron vowed to rebuild the cathedral, and that work has continued steadily in the ensuing years; the current planned re-opening will occur on December 8, 2024.

If there is a silver lining to the destruction, it's that the damage has revealed parts of the cathedral's structure that were previously inaccessible, telling archaeologists and conservationists more about the materials originally used to construct Notre Dame in the mid-12th century. According to a March 2023 paper published in the journal PLoS ONE, the original builders used iron reinforcements during the initial phases, making Notre Dame the earliest building of its type to do so.

Enlarge (credit: ALAIN JOCARD / Contributor | AFP)

There's currently a surge in cryptocurrency and phishing scams proliferating on X (formerly Twitter)—hiding under the guise of gold and gray checkmarks intended to mark "Verified Organizations," reports have warned this week.

These scams seem to mostly commandeer dormant X accounts purchased online through dark web marketplaces, according to a whitepaper released by the digital threat monitoring platform CloudSEK. But the scams have also targeted high-profile X users who claim that they had enhanced security measures in place to protect against these hacks.

This suggests that X scammers are growing more sophisticated at a time when X has launched an effort to sell even more gold checks at lower prices through a basic tier announced this week.

Enlarge / An Analogue Pocket running Super Mario World on an openFPGA core with the scanline filter enabled. (credit: Andrew Cunningham)

We've got a soft spot for the Analogue Pocket, the premium portable game console that melds 2020s technology with the design of the original Game Boy. Since its release, Analogue has added some new capabilities via firmware updates, most notably when it added support for emulating more consoles via its OpenFPGA platform in the summer of 2022. This allows the FPGA chip inside of the pocket to emulate the hardware of other systems, in addition to the portable systems the Pocket supports natively.

But aside from finalizing and releasing that 1.1 firmware, 2023 was mostly quiet for Pocket firmware updates. That changed in December when the company released not one but two major firmware upgrades for the Pocket that slipped under our radar during the holidays. These updates delivered a combination of fixes and long-promised features to the handheld, which Analogue has been re-releasing in different color palettes now that the original versions are more consistently in stock.

The most significant update for OpenFPGA fans is the ability to use display filters with third-party FPGA cores. Part of the appeal of the Pocket is its 1,600×1,440 screen, which is sharp enough to perfectly re-create the huge chunky pixels of the original Game Boy screens. By default, most FPGA cores now get access to a similarly high-quality CRT screen filter named after the Sony Trinitron TV, adding a touch of retro-blurriness to the sharp edges of 8- and 16-bit games. I've seen lots of bad, unconvincing scanline filters in retro game re-releases, and this isn't one of them.

Enlarge / There aren't many online game stores where you can spend $48,000 on a single "Add to Cart." (credit: RSI)

At this point, over 11 years after we first wrote about Star Citizen, the still-in-alpha game is interesting less as something that might eventually be "finished" and more as a fascinating tale of feature creep and fundraising success. To that last point, we were suitably boggled at the recent news that Roberts Space Industries is now offering a  $48,000 "Legatus Pack" as a "perfect collection" of "all ships released and concepted through [in-universe year] 2953."

The collection of 187 ships (and hundreds of accessories like paint colors, skins, armor, and in-game posters) is now roughly two-thirds of the median annual household income in the US (circa 2022). But that price isn't even available to lookie-loos like you and me; to add the package to an online shopping cart, you must first spend at least $1,000 to become a member of the game's Chairman's Club.

What a bargain!

While the newest Legatus Pack launched in late December, the offering isn't a new concept for developer Roberts Space Industries. The first Legatus Pack launched in May 2018 for a relatively reasonable $27,000. Before that, similar "Completionist" packs of all in-game content released up to that point would run players up to $15,000.

Enlarge / Starbucks' Rewards programs are a key part of their revenue. How the company deals with unspent amounts in that app could change under new Washington state proposals. (credit: Getty Images)

When you get a Starbucks gift card, or keep reloading one on your phone, you often end up with awkward amounts that can be difficult to spend.

For most people, the remainders are a few bucks of wasted potential caffeine and sugar. For Starbucks, they are worth hundreds of millions of dollars each year, according to a consumer advocacy group in Washington state that wants to end the "Gift Card Loophole." Changes in the coffee giant's home state could affect gift and loyalty cards nationwide.

The Washington Consumer Protection Coalition is pushing state legislators to remove a provision dating back to 2004. While that 2004 legislation was relatively consumer-friendly for its time by barring gift cards from fully expiring and eliminating maintenance fees, it allowed funds left on cards, or now on mobile apps, to be claimed as revenue by companies.