Month: January 2024

Enlarge (credit: Getty Images)

Roughly 11 million Internet-exposed servers remain susceptible to a recently discovered vulnerability that allows attackers with a foothold inside affected networks. Once they're in, attackers compromise the integrity of SSH sessions that form the lynchpin for admins to securely connect to computers inside the cloud and other sensitive environments.

Terrapin, as the vulnerability has been named, came to light two weeks ago in a research paper published by academic researchers. Tracked as CVE-2023-48795, the attack the researchers devised works when attackers have an adversary-in-the-middle attack (also abbreviated as AitM and known as man-in-the-middle or MitM), such as when they’re positioned on the same local network and can secretly intercept communications and assume the identity of both the recipient and the sender.

In those instances, Terrapin allows attackers to alter or corrupt information transmitted in the SSH data stream during the handshake—the earliest connection stage, when the two parties negotiate the encryption parameters they will use to establish a secure connection. As such, Terrapin represents the first practical cryptographic attack targeting the integrity of the SSH protocol itself. It works by targeting BPP (Binary Packet Protocol), which is designed to ensure AitMs can’t add or drop messages exchanged during the handshake. This prefix truncation attack works when implementations support either the "ChaCha20-Poly1305" or "CBC with Encrypt-then-MAC," cipher modes, which, at the time the paper was published, was found in 77 percent of SSH servers.

Enlarge (credit: Getty Images)

Roughly 11 million Internet-exposed servers remain susceptible to a recently discovered vulnerability that allows attackers with a foothold inside affected networks. Once they're in, attackers compromise the integrity of SSH sessions that form the lynchpin for admins to securely connect to computers inside the cloud and other sensitive environments.

Terrapin, as the vulnerability has been named, came to light two weeks ago in a research paper published by academic researchers. Tracked as CVE-2023-48795, the attack the researchers devised works when attackers have an adversary-in-the-middle attack (also abbreviated as AitM and known as man-in-the-middle or MitM), such as when they’re positioned on the same local network and can secretly intercept communications and assume the identity of both the recipient and the sender.

In those instances, Terrapin allows attackers to alter or corrupt information transmitted in the SSH data stream during the handshake—the earliest connection stage, when the two parties negotiate the encryption parameters they will use to establish a secure connection. As such, Terrapin represents the first practical cryptographic attack targeting the integrity of the SSH protocol itself. It works by targeting BPP (Binary Packet Protocol), which is designed to ensure AitMs can’t add or drop messages exchanged during the handshake. This prefix truncation attack works when implementations support either the "ChaCha20-Poly1305" or "CBC with Encrypt-then-MAC," cipher modes, which, at the time the paper was published, was found in 77 percent of SSH servers.

Enlarge / A still from a HyperVerse video featuring CEO Steven Reece Lewis. (credit: @cryptotech607 | YouTube)

For years, rumors spread on social media that Steven Reece Lewis, the chief executive officer of a now-shuttered cryptocurrency hedge fund called HyperVerse, was a "fake person" who "doesn't exist." After its investigation, The Guardian has confirmed that no organization cited on his resume "can find any record of him."

According to The Guardian, Reece Lewis's qualifications all appear to be falsified in an effort to woo investors to sink money into HyperVerse. After HyperVerse collapsed, accused of operating as a pyramid scheme, the company suspended withdrawals. According to blockchain analysts, Chainalysis consumer losses in 2022 were estimated to exceed $1.3 billion. Thousands of consumers lost millions, The Guardian reported.

In a December 2021 video, Reece Lewis was introduced as CEO and touted for making big moves before joining HyperVerse. He supposedly went from working at Goldman Sachs to selling a web development company to Adobe before launching his own IT startup.

Enlarge / At left, one of the fossils, with stacks of thylakoids highlighted using yellow bars; at right, a higher magnification of the end of the cell. (credit: Demoulin, et. al.)

It's not an exaggeration to suggest that the most significant event on Earth was the evolution of photosynthesis. The ability to harvest energy from light freed life from the need to scavenge energy from its environment. With this new capability, life grew in complexity and invaded new environments, ultimately reshaping the Earth.

For such a pivotal event, we know remarkably little about it. Tracing the presence of oxygen in the atmosphere suggests photosynthesis evolved at least 2.4 billion years ago, although the rise in oxygen levels turns out to be impressively complicated. Tracing the variations of present-day genes places photosynthesis' origin at about 3 billion years ago. That timing is similar to the origin of the photosynthetic cyanobacteria, which both continue to live independently and have been incorporated into plant cells as chloroplasts.

What we don't have is clear evidence of photosynthetic cells of similar age. A few microfossils with similarities to cyanobacteria have been identified, but it's impossible to determine whether they were making the proteins that power photosynthesis. Now, new fossils described by a team at the University of Liège push unambiguous evidence of photosynthesis back over a billion years to 1.7 billion years ago.

Enlarge / The Ford F-150 Lightning Pro gets a plainer front treatment than the more expensive trims. (credit: Jonathan Gitlin)

Was Ars premature in calling the electric Ford F-150 Lightning pickup truck the most important electric vehicle of the decade? At launch, it seemed like a no-brainer—an all-electric version of the nation's most popular four-wheel vehicle that rode better than any other F-150 and a starting price of just $40,000 sure sounded compelling. In practice, things haven't worked out quite that well. Today, we learned that F-150 Lighting prices are increasing for some trims, and others are being retired altogether.

When Ford first announced Lightning pricing in 2021, the range started at $39,974 for a Lightning Pro—the trim aimed at commercial customers—with the standard range battery, or $49,974 for the Lightning Pro with a larger battery capable of 300 miles of range. The F-150 Lightning XLT was the entry-level model for private customers, which originally cost $52,974, with more expensive Lariat and Platinum trims that topped out at $90,874.

But Ford raised those prices before too long, then raised them again. Coupled with a post-pandemic trend of outrageous additional dealer markups, this spelled bad news for F-150 Lightning sales—the entry-level F-150 Lightning Pro cost $59,974 by the middle of 2023, $20,000 more than the 2021 pricing. In July 2023, the automaker cut F-150 Lightning prices heavily, but prices remained significantly higher than at launch.

Enlarge (credit: Dmitry Mayer | iStock / Getty Images Plus)

To kick off the new year, Montana and North Carolina joined a growing number of states enforcing laws requiring age verification to access adult content online.

In the days before the laws took effect on January 1, Aylo—the owner of adult sites like Pornhub, Youporn, Brazzers, and Redtube—blocked access for users in both states, continuing to argue that requiring ID for every login makes adult sites less safe for everyone.

“As you may know, your elected officials in your state are requiring us to verify your age before allowing you access to our website," adult entertainer Cherie DeVille said in a public service announcement displayed to users attempting to access sites in Montana and North Carolina. "While safety and compliance are at the forefront of our mission, giving your ID card every time you want to visit an adult platform is not the most effective solution for protecting our users, and in fact, will put children and your privacy at risk.”