news.buyenne.com

Enlarge / One of two publicly available exploits for a critical Apache Struts vulnerability. (credit: Kevin Beaumont)

In a string of attacks that have escalated over the past 48 hours, hackers are actively exploiting a critical vulnerability that allows them to take almost complete control of Web servers used by banks, government agencies, and large Internet companies.

The code-execution bug resides in the Apache Struts 2 Web application framework and is trivial to exploit. Although maintainers of the open source project patched the vulnerability on Monday, it remains under attack by hackers who are exploiting it to inject commands of their choice into Struts servers that have yet to install the update, researchers are warning. Making matters worse, at least two working exploits are publicly available.

"If you run it against a vulnerable application, the result will be the remote execution of commands with the user running the server," Vicente Motos wrote of one of the exploits in a post published late Wednesday afternoon on the Hack Players website. "We have dedicated hours to reporting to companies, governments, manufacturers, and even individuals to patch and correct the vulnerability as soon as possible, but the exploit has already jumped to the big pages of 'advisories,' and massive attempts to exploit the Internet have already been observed."

(credit: Nest)

Alphabet's Nest smart home company hasn't made much news since CEO and founder Tony Fadell left the company. We know the company hasn't delivered on the promised expansion plans under Alphabet, and the group isn't for sale, but what about products?

According to a report from Bloomberg, the company is looking downmarket and is planning to debut a cheaper version of its flagship product, the smart thermostat. While the current Nest thermostat is beautifully designed, many people balk at the $250 asking price. The report claims this new model would sell for "under $200," and "at least one internal prototype" wasn't made of metal. The report also says Nest is working on remote temperature sensors so the thermostat can monitor the temperatures in different rooms, a favorite feature of the rival EcoBee 3.

Bloomberg also seconded the reports that Nest is still working on a home security system. The report says the current prototype has "a central hub with a keypad, a pack of alarm sensors to be placed on windows and doors, and a fob for key rings for arming and disarming the alarm system." Last we heard about the system was from The Information, which claimed the project—codenamed "Flintstone"—had been "killed or changed so many times that one former employee jokingly called it 'Tombstone.'" It should be hitting around four years of development time now, and while the report said Alphabet was "pressuring" Nest to release the device in 2016, that obviously never happened. Also in the works is a "digital doorbell," and Nest previously posted a job listing for a "Nest Audio" product.

Enlarge / The logo of the CIA's Engineering Development Group (EDG), the home of the spy agency's malware and espionage tool developers.

There are thousands of files in WikiLeaks' dump of data from the Central Intelligence Agency's Engineering Development Group (EDG). This organization within the CIA's Center for Cyber Intelligence is responsible for creating the tools used to hack into digital devices around the world in support of the CIA's mission. The leaked documents come from an Atlassian Confluence server used by the EDG's developers to track and document their projects.

Many of the documents in the dump are unclassified—manuals provided by Lockheed Martin and other vendors, for example. Most are classified at the Secret level, including things as innocuous as a guide to getting started with Microsoft Visual Studio, apparently the preferred development tool of the EDG's Applied Engineering Department (AED). There's also a smattering of meme construction components and animated GIFs of the anime series Trigun.

But a tiny fraction of the data is highly classified, according to document marks. This cache sits at the Top Secret level, and it's marked as "Special Intelligence" (SI) and "NOFORN" (no foreign distribution). Out of the first batch of just over 1000 documents, there are two paragraphs marked at that level. And those pieces describe minutiae of how CIA's Network Operations Division wants the cryptographic features of its tools to work and how CIA obtains and prepares phones for use in its exploit lab.

Qualcomm Centriq 2400 server for Project Olympus. (credit: Microsoft)

At the Open Compute Summit in Santa Clara, California, today, Microsoft showed off the latest iterations of Project Olympus, its open source data center server design. Until now, the servers in Microsoft's data centers have all used Intel x86 processors, but now both of those elements—"Intel" and "x86"—have new competition.

In news that's both surprising and unsurprising, Microsoft demonstrated Windows Server running on ARM processors. Qualcomm and Cavium have both designed motherboards for the Project Olympus form factor that use ARM chips: Qualcomm's Centriq 2400 processor, a 10nm 48 core part, and Cavium's ThunderX2 ARMv8-A, with up to 54 cores. In addition to offering lots of cores, both are highly integrated systems-on-chips with PCIe, SATA, and tens of gigabits of Ethernet all integrated.

Microsoft isn't yet letting third parties use these systems. The Windows Server build is an internal build, and Microsoft is using the systems in those applications where it says they make the most sense, with the company listing search and indexing, storage, databases, big data, and machine learning as workloads that benefit from the high throughput the ARM systems offer.