These rechargeable batteries are more sustainable and safer than lithium—and half the cost


source:  |  image:

The battery is water-based and uses other cheap, readily available materials like manganese and metal oxide.


Since lithium-ion batteries were first sold 30 years ago, they’ve dropped in cost by 97%. But they’re still too expensive for making electric cars that can compete in cost with fossil-fueled cars without subsidies, or to economically store wind and solar power on the grid. That’s why one Boston-area startup is developing a different type of rechargeable battery that it says can cut costs in half—while avoiding some of the other flaws of current batteries, from the environmental impact of mining to the fact that lithium-ion batteries can catch on fire.

“Our motivation was to make it affordable, so that it could be widely deployed as opposed to niche,” says Mukesh Chatter, CEO and cofounder of the startup, Alsym Energy, which emerged from stealth today and has raised $32 million from investors, including Helios Climate Ventures. Right now, many automakers are following Tesla’s lead and making luxury EVs. But Alsym wants to enable manufacturers to make lower-cost vehicles, including its first partner, an automaker in India. Tackling climate change “requires everybody’s contribution,” Chatter says. “It cannot be 1% of the people buying expensive luxury EVs.” The batteries are also affordable enough that they could be used in developing countries to store off-grid solar power for people who don’t have electricity access now.

Continue reading “These rechargeable batteries are more sustainable and safer than lithium—and half the cost”

MIT Researchers Discover New Flaw in Apple M1 CPUs That Can’t Be Patched

source:  |  image:

A novel hardware attack dubbed PACMAN has been demonstrated against Apple’s M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems.

It leverages “speculative execution attacks to bypass an important memory protection mechanism, ARM Pointer Authentication, a security feature that is used to enforce pointer integrity,” MIT researchers Joseph Ravichandran, Weon Taek Na, Jay Lang, and Mengjia Yan said in a new paper.

What’s more concerning is that “while the hardware mechanisms used by PACMAN cannot be patched with software features, memory corruption bugs can be,” the researchers added.

The vulnerability is rooted in pointer authentication codes (PACs), a line of defense introduced in arm64e architecture that aims to detect and secure against unexpected changes to pointers — objects that reference an address location in memory.

PACs aim to solve a common problem in software security, such as memory corruption vulnerabilities, which are often exploited by overwriting control data in memory (i.e., pointers) to redirect code execution to an arbitrary location controlled by the attacker.

Continue reading “MIT Researchers Discover New Flaw in Apple M1 CPUs That Can’t Be Patched”

China says it may have detected signals

from alien civilisations

source:  |  image:

China’s Sky Eye is extremely sensitive in the low-frequency radio band and plays a critical role in the search for alien civilisations.


China said its giant Sky Eye telescope may have picked up signs of alien civilizations, according to a report by the state-backed Science and Technology Daily, which then appeared to have deleted the report and posts about the discovery.

The narrow-band electromagnetic signals detected by Sky Eye — the world’s largest radio telescope — differ from previous ones captured and the team is further investigating them, the report said, citing Zhang Tonjie, chief scientist of an extraterrestrial civilization search team co-founded by Beijing Normal University, the National Astronomical Observatory of the Chinese Academy of Sciences and the University of California, Berkeley.

It isn’t clear why the report was apparently removed from the website of the Science and Technology Daily, the official newspaper of China’s science and technology ministry, though the news had already started trending on social network Weibo and was picked up by other media outlets, including state-run ones.

In September 2020, Sky Eye, which is located in China’s southwestern Guizhou province and has a diameter of 500 meters (1,640 feet), officially launched a search for extraterrestrial life. The team detected two sets of suspicious signals in 2020 while processing data collected in 2019, and found another suspicious signal in 2022 from observation data of exoplanet targets, Zhang said, according to the report.

China’s Sky Eye is extremely sensitive in the low-frequency radio band and plays a critical role in the search for alien civilizations, Zhang is reported to have said.

The suspicious signals could, however, also be some kind of radio interference and requires further investigation, he added.


Authorities Shut Down Russian RSOCKS Botnet That Hacked Millions of Devices

source:  |  image:

The U.S. Department of Justice (DoJ) on Thursday disclosed that it took down the infrastructure associated with a Russian botnet known as RSOCKS in collaboration with law enforcement partners in Germany, the Netherlands, and the U.K.

The botnet, operated by a sophisticated cybercrime organization, is believed to have ensnared millions of internet-connected devices, including Internet of Things (IoT) devices, Android phones, and computers for use as a proxy service.

Botnets, a constantly evolving threat, are networks of hijacked computer devices that are under the control of a single attacking party and are used to facilitate a variety of large-scale cyber intrusions such as distributed denial-of-service (DDoS) attacks, email spam, and cryptojacking.

Continue reading “Authorities Shut Down Russian RSOCKS Botnet That Hacked Millions of Devices”

New ‘GoodWill’ Ransomware Forces Victims to Donate Money and Clothes to the Poor

source:  |  image:

Cybersecurity researchers have disclosed a new ransomware strain called GoodWill that compels victims into donating for social causes and provide financial assistance to people in need.

“The ransomware group propagates very unusual demands in exchange for the decryption key,” researchers from CloudSEK said in a report published last week. “The Robin Hood-like group claims to be interested in helping the less fortunate, rather than extorting victims for financial motivations.”

Written in .NET, the ransomware was first identified by the India-based cybersecurity firm in March 2022, with the infections blocking access to sensitive files by making use of the AES encryption algorithm. The malware is also notable for sleeping for 722.45 seconds to interfere with dynamic analysis.

The encryption process is followed by displaying a multiple-paged ransom note that requires the victims to carry out three socially-driven activities to be able to obtain the decryption kit.

This includes donating new clothes and blankets to the homeless, taking any five underprivileged children to Domino’s Pizza, Pizza Hut, or KFC for a treat, and offering financial support to patients who need urgent medical attention but don’t have the financial means to do so.

Additionally, the victims are asked to record the activities in the form of screenshots and selfies and post them as evidence on their social media accounts.

“Once all three activities are completed, the victims should also write a note on social media (Facebook or Instagram) on ‘How you transformed yourself into a kind human being by becoming a victim of a ransomware called GoodWill,'” the researchers said.

There are no known victims of GoodWill and their exact tactics, techniques, and procedures (TTPs) used to facilitate the attacks are unclear as yet.

Also unrecognized is the identity of the threat actor, although an analysis of the email address and network artifacts suggests that the operators are from India and that they speak Hindi.

Further investigation into the ransomware sample has also revealed significant overlaps with another Windows-based strain called HiddenTear, the first ransomware to have been open-sourced as a proof-of-concept (PoC) back in 2015 by a Turkish programmer.

“GoodWill operators may have gained access to this allowing them to create a new ransomware with necessary modifications,” the researchers said.


view an example of the ransomware letter here

What is a cyber attack?

source:  |  Image:

In this guest article, written exclusively as part of Business Leader’s Cyber Security Month, Bleddyn-Aled Wyke, Cyber Operations Executive at PureCyber, outlines what is a cyber attack.

A cyber-attack can take many forms, though one common thread throughout these is the threat actor. Whether the attack is untargeted, such as a phishing campaign against thousands of users hoping a careless one takes the bait, or more targeted, such as a Denial of Service (DoS) style attack against a company site denying normal users access to its services, there is a human presence behind this somewhere who has pushed the marble.

The National Cyber Security Centre (NCSC) presents a four-stage model mapping out the typical steps and processes carried out by threat actors in the process of an attack: Survey, Delivery, Breach, and Affect.

Firstly, the threat actor would look to survey an organisation’s infrastructure, in a bid to obtain as much information as possible. This could be through more technical means, scanning target networks to gain information about IT systems in place, or more physical methods such as social engineering to gain more private information such as internal processes or procedures.

With the knowledge gained here, the threat actor would look to move onto the delivery stage of the attack, where they attempt to put themselves into a position on a network where they can exploit a vulnerability they believe to exist within a target. An example of this would be gaining the format of a company’s e-mail address (e.g. first initial and using this to send phishing e-mails containing a malicious file or link to employees, using this to either spread malware or steal credentials. It only takes one user to follow through with the file or link to compromise an organisation’s system.

Upon successful delivery of an exploit, the attacker would attempt to further breach the system. Whether this is via stolen credentials allowing them to achieve access to sensitive user or company information, or via the implementation of malware letting them take control of computers or networks, the attacker can either go straight for their target or can look to gain a more established presence.

They can move to have more of an effect, using their established control to gain access to more privileged systems, allowing them to gain more sensitive information, make changes to their benefit, or disrupt businesses. From here the threat actor will look to either leave, attempting to remove any indications of their presence, or set up a more persistent style threat, leaving a back door for them to come and go as they please.


Actively Exploited Microsoft Office Security Flaw Has No Patch But Here’s A Workaround

source:  |  image:


Malware and virus threats are practically commonplace, even a daily occurrence for some users these days. Unfortunately for many users in the Microsoft ecosystem, leveraging popular Office applications is a common security attack vector for many of the ne’er-do-wells of the Internet.

In that regard, Microsoft‘s Security Response Center has issued guidance to help add preventative layers to a newly discovered critical vulnerability or error (CVE). Specifically labeled CVE-2022-30190 by Microsoft, the vulnerability does not use the previous vulnerable attack vector of macros. In fact, macros as an attack vector for malware has been mostly patched out in many recent versions of Office applications anyway.
Continue reading “Actively Exploited Microsoft Office Security Flaw Has No Patch But Here’s A Workaround”

Security News This Week: The NSA Swears It Has ‘No Backdoors’ in Next-Gen Encryption

source:  |  image:



The US is readying new encryption standards that will be so ironclad that even the nation’s top code-cracking agency says it won’t be able to bypass them.

The National Security Agency has been involved in parts of the process but insists it has no way of bypassing the new standards. 

“There are no backdoors,” said Rob Joyce, the NSA’s director of cybersecurity at the National Security Agency, in an interview. A backdoor enables someone to exploit a deliberate, hidden flaw to break encryption. An encryption algorithm developed by the NSA was dropped as a federal standard in 2014 amid concerns that it contained a backdoor.

The new standards are intended to withstand quantum computing, a developing technology that is expected to be able to solve math problems that today’s computers can’t. But it’s also one that the White House fears could allow the encrypted data that girds the U.S. economy – and national security secrets – to be hacked. 

Continue reading “Security News This Week: The NSA Swears It Has ‘No Backdoors’ in Next-Gen Encryption”