Eliana Willis

More stories

  • 163 Shares129 Views

    in Information Technology

    Patch now: Linux file system security hole, dubbed Sequoia, can take over systems

    Some days, it doesn’t rain, it pours. That’s the case with Linux today. Not one, but two serious security holes have recently been exposed. First, there was a systemd bug which could easily knock out systems. Now there’s this security hole in the Linux kernel’s file system, which any user could use to take over a computer. Like I said, some days it just pours.

    The Qualys Research Team, which uncovered the file system bug, also discovered a size_t-to-int type conversion vulnerability in the Linux kernel’s filesystem. This Linux security hole has been named Sequoia and it’s been designated CVE-2021-33909.Doesn’t sound like much, does it? Au contraire! It can be used against most Linux distributions in their default configurations. And, worse still, any — I repeat, any — unprivileged user can abuse it to gain root privileges.Here’s how it works. We all use filesystems every day, but you probably don’t think about how it works. Who, except for developers, does? In Linux’s case, the file system interface is implemented in a three-layered architecture. There’s the user interface layer; the file system implementation; and the storage device drivers. Within the Linux kernel’s seq_file interface produces virtual files containing sequences of records. Each record must fit into a seq_file buffer. When it runs out of space, it’s just enlarged by doubling its size. That’s not a problem. You’ll run out of memory long before you can hack the system with this. The problem shows up because this size_t variable is also passed to functions whose size argument is a signed 32-bit integer, not a size_t. And that, my friend, while a very large number, can be overrun. Then, as Bharat Jogi, Qualys’ Senior Manager of Vulnerabilities and Signatures, explains, “If an unprivileged local attacker creates, mounts, and deletes a deep directory structure whose total path length exceeds 1GB, and if the attacker open()s and read()s /proc/self/mountinfo, then” through a series of other maneuvers you can write to out of bounds memory. And, with that, you can corrupt data, crash the system, or, worst of all, execute unauthorized code. Alas, there are numerous known hacks that use memory overruns to become the root user and grab control of a computer. 

    In fact, that’s exactly what Qualys security team did. They developed an exploit, which they then used to obtain full root privileges on default installations of Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11, and Fedora 34. OK, let’s just admit it. Pretty much any Linux distro is vulnerable to this trick.Is this a great day to be a Linus sysadmin or what?The good news is that while this problem is alive and nasty in any system running the Linux kernel 3.16 through 5.13.x before 5.13.4, patches are available. In fact, I patched my Linux Mint desktop for it, before I even started to write this story. Yes, it’s that bad. Eric Sandeen, Red Hat’s top file system developer, came up with a fix for the problem. Greg Kroah-Hartman, the Linux kernel maintainer for the Linux stable branch, subsequently released the kernel patch for Sequoia on July 20th in the Linux kernel 5.13.4 release.If you can’t upgrade your kernel, you can still mitigate the problem by setting /proc/sys/kernel/unprivileged_userns_clone to 0. This prevents an attacker from mounting a long directory in a user namespace. However, the attacker may still be able to mount a poisonously long directory via Filesystem in Userspace (FUSE). You should also set /proc/sys/kernel/unprivileged_bpf_disabled to 1. This prevents an attacker from loading an eBPF program into the kernel. However, there may be other ways to attack. The only sure way to stop this security hole in its track is to update your kernel. This fix is also available in most Linux distributions now. So, if you’ve been sitting on your hands and not updating your Linux computers, it’s time to get off them and start typing in patching commands.Related Stories: More

  • 175 Shares159 Views

    in Information Technology

    US House terminates deal with iConstituent after company waited days to raise ransomware alarm

    The Office of the Chief Administrative Officer (CAO) — which provides support services to US House members of both parties — sent a letter to members of Congress announcing that it has terminated all contracts with iConstituent and will no longer be authorizing the platform’s use because of multiple cybersecurity incidents. iConstituent is currently used by about 60 House members and was designed to facilitate communication between politicians and local residents. But in May the platform was hit with a ransomware attack and Chief Administrative Officer of the House Catherine Szpindor told Punchbowl News that the attack targeted iConstituent’s e-newsletter system, which House members buy access to.Szpindor added at the time that no data from the House had been taken or accessed and the network used by the House was not affected.But in a letter to House members first obtained by CNN’s Melanie Zanona, the CAO ripped into iConstituent for multiple security incidents — some that had not been reported before — and for their lackluster response to questions from government officials. On Tuesday, iConstituent was notified that its contracts have been terminated and that the platform will no longer “be authorized to provide CMS, Maintenance, Systems Administration, or Web services to House offices,” according to the letter.House members will have until December 31 to move off of the iConstituent platform. “The CAO is taking this action because of multiple cybersecurity incidents involving iConstituent over the past several years. The CAO recognizes this will significantly impact your Office’s operations. The CAO did not come to this decision lightly,” the letter said, adding that they would provide members of Congress with help in finding replacement systems. 

    iConstituent will still be providing its services to Congress while members transition to other approved vendors. The letter explains that part of what caused the cancellation was iConstituent’s response to the ransomware attack in May. According to the CAO, iConstituent waited nearly a week before informing government officials of the ransomware attack on their e-Newsletter service. “This delay in notification was a serious violation of iConstituent’s contractual requirements designed to protect Member and constituent information,” the CAO said. “The CAO’s efforts to obtain additional details from iConstituent since then have been met with conflicting and inconsistent information, further delays, and an overall lack of transparency. While iConstituent has represented that no House information was impacted as a result of the ransomware attack — and the CAO has no evidence to contest that conclusion — the circumstances of the attack and iConstituent’s response raise irreparable doubts about their ability to securely deliver technology services to the House.”The letter goes on to detail multiple iConstituent cybersecurity incidents, including ones in July 2013 and November 2018 where the platform either “failed to secure House web data” or experienced compromise of their eNewsletter platform.The platform compromise happened because iConstituent did not apply “critical” patches to their system, according to the CAO. In the 2018 incident, the root passwords of multiple websites were exposed to the public-facing internet.The CAO said it previously punished iConstituent by withholding payments and banning the company from taking on any more members of Congress as clients. “Based on this latest incident, the vendor still does not appear to have meaningfully improved their security practices,” the CAO said. A list of resources and options were provided to House members at the end of the email and administrators pledged to contact each office to help with the transition process.  Despite the actions taken by the House, iConstituent is still used widely across state governments in Nevada, Georgia, Hawaii and cities like Los Angeles. The New York State Assembly also has a contract with the company for services. More

  • 88 Shares159 Views

    in Networking

    Best encrypted messaging app 2021: Chat privately

    While there are a number of messaging apps from which to choose, only a dozen or so have marketplace gravitas. The best-known and most-utilized are usually the ones that come with your smartphone: the Google, Samsung, and Apple Messages apps, the Facebook Messengers, and the Whatsapps of the world. Most people don’t even think about their messaging app — they take it for granted and simply check notifications regularly.But there are differences between them, and the most important ones involve security, because all messaging is speedy and virtually instantaneous. Is it possible for hackers to break into your connected device through a vulnerability in the messaging app? You bet it’s possible, and break-ins there are more common than you might think.For example, we’ve probably all received phony messages purportedly from a friend containing a link to a video (“I think you’re seen in this video … check this out!”). Woe to those who fall for this ruse. So security and encryption of messages is a serious consideration when it comes to messaging, which is far and away the favored method of communicating among Millennials, Gen Z folks, and younger.Below, we discuss only messaging apps that use (or can optionally use) end-to-end encryption (E2EE), a method of encrypting data that only allows the sender and receiver of the message to decrypt and read messages passed between them. More importantly, encryption prevents apps from storing copies of your messages on their servers.Please know that end-to-end encryption is not a security panacea that will protect you from surveillance. Even if you use a secure messaging app, an unsecured device can enable anyone to access your messages. The best way to protect your messaging apps is with a separate password or use of biometrics (face, fingerprint, iris) on your device.We’ve identified 10 of the most secure (and most utilized) messaging applications available. 

    Supports RCS by default

    Compatible operating systems: Android, WindowsPrice: Free (Google Messages currently comes with Android devices not made by Samsung)Security: Knox Security (Samsung); standard device security (Google)It’s easy to get Samsung Messages and Google Messages confused, because they populate Android phones used the world over. Samsung Messages, included only on Samsung phones, has an interface that might be a little easier to use. However, the main advantage of Google Messages is the availability of RCS (rich communication services) by default, no matter where you live or which carrier you use. You can have RCS with Samsung messages, but only if your carrier supports it. All Verizon plans, for example, will adopt Google Messages and support RCS by 2022.RCS is a next-generation SMS (short messaging service) protocol that upgrades standard text messaging. Features include payments, high-res photo/file sharing, location sharing, video calls, and others that are delivered to a device’s default messaging app. Knox’s E2EE security protocol, with its military-grade encryption, is a major advantage for users of Samsung Messages.Key features/attributesBy default, both Messages provide end-to-end encryption for all voice calls, video calls, and instant messages.Both Messages are built from open source code, which means security is vetted regularly by cybersecurity experts. This technology has been adopted by other messaging services, including WhatsApp and Skype.Google Messages shows one line of text preview, while Samsung Messages shows two lines.

    View Now at Google

    Best all-around bet

    Compatible operating systems: Windows, MacOS, Linux, Android, iOSPrice: FreeSignal is probably the best all-around bet when it comes to reach, security, and privacy-enabled features. However, it lacks the usership of the Messages and Messenger apps because it is not a pre-loaded default app inside phones. Formerly called RedPhone, Signal has become a favorite of the infosec community since its release seven years ago, but it also has grown in popularity among ordinary users. It still has nowhere near the same number of active users as those noted above, however.Key features/attributesBy default, Signal provides E2EE for all voice calls, video calls, and instant messages; it uses its own protocol.This technology is 100% open source, which means its security is vetted by cybersecurity experts and its technology has been adopted by other messaging services like WhatsApp and Skype.To verify that your conversation with another person is private, each Signal conversation has a unique device safety number to verify the security of your messages and calls with specific contacts. This is especially useful for preventing man-in-the-middle attacks — if a safety number changes more frequently than you’d expect for someone switching devices or reinstalling Signal, for instance, it may indicate that something is awry.Signal also allows you to secure the app with a password so you can protect your messages if they fall into the wrong hands. There is also an option to send self-destructing messages.

    View Now at Signal

    Used only on Apple devices

    Compatible operating systems: MacOS, iOSPrice: Free (on Apple devices)Apple Messages is used only on Apple devices, but it is exemplary when it comes to security features. In addition to offering end-to-end encryption between users, Apple Messages allows users to control how long the message stays up and how many times the recipient can view the message (although this feature is only available to those who have iOS 10 and above).Regardless of which Apple device you’re using, whether it’s iOS, watchOS, or iPadOS, your messages are end-to-end encrypted and cannot be accessed without a passcode. Users of Apple’s FaceTime can also rest easy knowing that their video calls are also E2EE-empowered.Key features/attributesMessages is only available on Apple devices, meaning any message you send via Messages to a non-Apple device will not be encrypted. One major security loophole is the option to back up your messages to iCloud. On the cloud, messages are encrypted by keys controlled by Apple, meaning that if your iCloud were ever hacked or subpoenaed, those messages could be revealed.Apple CEO Tim Cook has said that Apple “believe(s) that privacy is a fundamental human right,” and at least in its Messages and Facetime apps it appears to take this commitment seriously. Just avoid storing your messages on web-based platforms such as iCloud — toggle off messages in settings so they’re not stored on the cloud.

    View Now at Apple Messages

    Ownership by Facebook is worrisome

    Compatible operating systems: Windows, MacOS, Android, iOS, KaiOSPrice: FreeWhatsApp may be used by more people than many of the above apps, but its ownership by Facebook is worrisome. The founders of WhatsApp in 2009 originally intended it for people to publish status updates, similar to Facebook’s statuses. It was the messaging feature, however, that sold the app to Facebook, which bought it in 2014. WhatsApp is encrypted end-to-end, but its ownership continues to raise concerns about how it could be used in the future. Key features/attributesSecurity-wise, WhatsApp’s default E2EE enhances its privacy and security from malicious actors. Security issues have cropped up in the past, but if cybercriminals breached WhatsApp today, they couldn’t decrypt your conversations.It also has what may now be considered standard features, such as video calling, voice messaging, and file sharing.

    View Now at WhatsApp

    Similar in functionality to Whatsapp

    Compatible operating systems: Windows, MacOS, Android, iOS, KaiOSPrice: FreeFacebook Messenger is similar in functionality to Whatsapp, but again, with Facebook as the owner, users need to be aware of potential privacy issues. Facebook Messenger only connects with other Facebook Messenger users. Users of Facebook Messenger need to intentionally opt-in to its E2EE encryption if they want to better secure the app. Because it is automatically attached to every Facebook account, that means there are at least 2.3 billion apps out there — whether or not they’re being utilized.Key features/attributesSecurity-wise, Facebook Messenger’s default E2EE guards message privacy from malicious actors.If cybercriminals try to infiltrate Facebook Messenger today, they couldn’t decrypt your conversations. It also has standard features such as video calling, voice messaging, and file sharing.

    View Now at Facebook Messenger

    Useful for corresponding with people in other countries

    Compatible operating systems: Windows, MacOS, Android, iOS, HarmonyOSPrice: Free Viber is especially useful for corresponding with people in other countries, since it uses the internet for calls and messages. It’s a great tool for when you’re traveling abroad, or if you make a lot of international calls. Viber is also an excellent forum for simple chatting. While it has some limitations, it is user-friendly. Viber claims to have about 260 million monthly active users and is primarily positioned as a competitor to the less-secure Skype on mobile. It has enabled end-to-end encryption since 2016, so it’s been ahead of the pack for a while.Key features/attributesViber is very user-friendly.The app has E2EE on all its available platforms (Mac, Windows, iOS, and Android) and also color codes chats based on how secure they are: Gray indicates encrypted communication, green denotes an encrypted communication with a trusted contact, and red means the authentication key has an issue.Viber also supports self-destructing messages in its secret-chats feature.Viber only supports E2EE for one-on-one chats — group chats are not offered the same level of security as individual conversations.

    View Now at Viber

    Free version of the Wickr app allows up to 10 users

    Compatible operating systems: Windows, MacOS, Linux, Android, iOSPrice: Free (optional: $25/month for an enterprise account)Started up by Silicon Valley-based privacy and security advocates in 2012, Wickr was one of the first messaging apps to adopt end-to-end encryption (E2EE). Messages are automatically encrypted, and the company undergoes regular security audits. Starting in 2017, Wickr went open source, which enables the worldwide open source community to help improve security.The free version of the Wickr app allows up to 10 users, and there are three paid tiers that charge up to $25 per month and have no user limit. Among its security attributes are screenshot detection, blocking third-party keyboards on iOS, and ensuring that any deleted files are unrecoverable.Key features/attributesWickr’s free and paid versions have excellent security features, such as self-destructing messages, content shredding, and an inability to take screenshots (on Android only).Wickr doesn’t have nearly as many users as Messenger and Messages, WhatsApp, and Signal, so you can be picky with whom you converse.The messages are also bound to both your account and your device, and the app won’t sync your messages across devices. That could amount to multiple separate conversations with your contacts — which makes it seems like they’ve made the app secure to a fault.

    View Now at Wickr

    Two layers of secure encryption

    Compatible operating systems: Windows, MacOS, Linux, Android, iOSPrice: FreeA key feature of Telegram is that it provides its users with two layers of secure encryption. Both private and group cloud chats support server-to-client encryption, while secret chats benefit from client-to-client encryption. In both instances, messages are encrypted. Telegram has recently gained popularity for organizing protests largely because it allows large chat groups of up to 10,000 members. This has in turn drawn the attention of state actors.Key features/attributesThe app gives you the option to encrypt messages, which you can enable as Secret Chats to encrypt them. When enabled, you can set messages to self-destruct across all your devices automatically or at a set time.If you don’t encrypt your chat, then your data is stored on Telegram’s servers, which puts the security of your messages at risk.Telegram also does not have E2EE by default — you’ll need to use its Secret Chats feature to enable it.

    View Now at Telegram

    Open-source and collaborative messaging app

    Compatible OSes: Windows, MacOS, Linux, Android, iOSPrice: Free (optional: $9.50/month for an enterprise account)Wire Personal is a secure open-source and collaborative messaging app that has both a free version and plenty of useful features: Fully encrypted video calls, secure file sharing, synced messages between devices, and others. Wire also offers a paid corporate subscription plan.Key features/attributesWire uses embedded E2EE, and it offers the same level of encryption for video calls. It is open source-based, and if you want the convenience, you can transfer your messages across any device into which you’re signed. It also has self-destructing messages, session verification to make sure you’re talking to the right person, and a password lock.

    View Now at Wire

    What are some messaging apps that do not embed E2EE security by default?

    TwitterSnapchat (has E2EE for photos and videos)InstagramGoogle HangoutsWeChatLine (opt-in E2EE)Skype (opt-in E2EE)Telegram (opt-in E2EE)

    Does IM content qualify as a federal record?

    The statutory definition of records (44 U.S.C. 3301) includes all machine-readable materials made or received by an agency of the US Government under federal law or in connection with the transaction of public business. Agencies that allow IM traffic on their networks must recognize that such content may be a federal record under that definition and must manage the records accordingly. The ephemeral nature of IM heightens the need for users to be aware that they may be creating records using this application, and to properly manage and preserve record content. Agency records management staff determine the record status of the IM content based on the overall records management policies and practices of their agency.

    What are the current best practices for capturing IM content?

    Nearly all IM client software has the ability to capture the content as either a plain text file or in a format native to that client. Generally, the location and maximum size of that file are determined by a configuration setting in the client. DoD 5015.2 certified applications have the ability to capture and manage records in any electronic format. Such formats include those files produced by the various IM clients.In addition, various IM management products have the ability to address the monitoring and management of IM content, either from those clients that are part of the agency’s enterprise or the various public clients. Generally, these products operate at the server level and should be able to capture IM sessions regardless of the configuration of the individual client.Determining which solution is appropriate for your agency involves collaboration among the program staff, the information technology (IT) staff, the records management staff, and NARA.

    ZDNet Recommends More

  • 100 Shares129 Views

    in Information Technology

    Microsoft acquires privileged access management vendor CloudKnox Security

    Credit: Microsoft
    Microsoft is acquiring CloudKnox Security to help build out its cloud security and Zero Trust strategy for an undisclosed amount, officials announced on July 21. Officials said they will provide more information on what they’ll be doing with CloudKnox’s technology as they integrate it with Microsoft’s existing identity, security, and compliance services, including Microsoft 365 Defender, Azure Defender, and Azure Sentinel. CloudKnox Security is based in Sunnyvale, CA. Its security platform supports the monitoring and management of identities, actions, and resources in hybrid and multi-cloud environments, according to its web site. CloudKnow has been a big AWS partner. In a blog post announcing the CloudKnox acquisition, Microsoft officials said the CloudKnox technology will further enable Azure Active Directory customers with “granular visibility, continuous monitoring, and automated remediation for hybrid and multi-cloud permissions.” CloudKnox will help bring automated and simplified access policy enforcement in a multi-cloud platform and help with machine-learning-based anomaly detections, officials said. Microsoft has continued snapping up a number of security companies for the past few years, including RiskIQ and ReFirm Labs, both of which the company purchased earlier this year. More

  • 138 Shares109 Views

    in Information Technology

    This password-stealing Windows malware is distributed via ads in search results

    A newly discovered form of malware delivered to victims via adverts in search results is being used as a gateway to stealing passwords, installing cryptocurrency miners and delivering additional trojan malware.Detailed by cybersecurity company Bitdefender, the malware – which targets Windows – has been dubbed MosaicLoader and has infected victims around the world as those behind it attempt to compromise as many systems as possible.

    MosaicLoader can be used to download a variety of threats onto compromised machines, including Glupteba, a type of malware that creates a backdoor onto infected systems, which can then be used to steal sensitive information, including usernames and passwords, as well as financial information. SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)Unlike many forms of malware, which get distributed via phishing attacks or unpatched software vulnerabilities, MosaicLoader is delivered to victims via advertising.  Links to the malware appear at the top of search results when people search for cracked versions of popular software. Automated systems used to buy and serve advertising space likely means that nobody in the chain – aside from the attackers – know the adverts are malicious at all. The security company said that employees working from home are at higher risk of downloading cracked software.

    “Most likely, attackers are purchasing adverts with downstream ad networks – small ad networks that funnel ad traffic to larger and larger providers. They usually do this over the weekend when manual ad vetting is impacted by the limited staff on call,” Bogdan Botezatu, director of threat research and reporting at Bitdefender, told ZDNet. It’s possible that the malware would be detected by antivirus software, but many users downloading illegally cracked software have likely turned their protections off in order to access and install the download. In order to make the download seem as legitimate as possible to the user, the cracked software mimics the file information of the real software, even down to names and descriptions within file folders.  However, all that’s downloaded is MosaicLoader, which provides the attackers with access to the machine. Researchers note that attackers try to steal usernames and passwords for online accounts, as well as operate cryptocurrency miners and drop trojan malware, which provide backdoor access to machines. It’s suspected that the aim of this campaign is to eventually sell access to compromised Windows machines – although the fact that additional malware is already being installed suggests the attackers are stealing data for themselves. 

    ZDNet Recommends

    The best cyber insurance

    The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

    Read More

    “From what we can tell, this new MosaicLoader attempts to infect as many devices as possible, likely to build up market share and then sell access to infected computers to other threat actors,” said Botezatu. SEE: Ransomware: Now gangs are using virtual machines to disguise their attacksAccording to Bitdefender the cyber-criminal group behind MosaicLoader is likely a new operation, without ties to any previously known groups. They’re trying to spread the malware as much as possible – but the current form of distribution means that, so long as users aren’t attempting to download cracked software, they’ll remain safe. Users should also be wary of following instructions to turn off antivirus software, as that can lead to malicious software being allowed to infiltrate the system. “We advise users to never turn off their security solution when it blocks the installation of software downloaded from the internet, as attackers have become adept at bundling legitimate apps with malware,” said Botezatu.  MORE ON CYBERSECURITY More

  • 88 Shares189 Views

    in Networking

    Verizon Q2 strong amid 5G wireless gains

    Verizon reported better-than-expected second quarter earnings as it added 528,000 retail postpaid subscribers and saw gains from 5G adoption. The wireless giant reported non-GAAP second quarter earnings of $1.40 a share and $1.37 excluding extra items. Revenue for the second quarter checked in at $33.8 billion due to wireless sales gains. Wall Street was looking for second quarter revenue of $32.74 billion and non-GAAP earnings of $1.30 a share. Verizon also raised its outlook for the year and now projects adjusted earnings per share to be in the range of $5.25 to $5.35 with wireless service revenue growth of 3.5% to 4%. CEO Hans Vestberg said the company is expanding its 5G Home and 5G Ultra-Wideband deployments. ×vz-consumer-q2-2021.pngBy the numbers:Verizon saw consumer second quarter revenue grow 11.2% from a year ago and 6.7% from the second quarter of 2019.20% of Verizon customers now have 5G capable devices. In the second quarter, Verizon added 350,000 wireless retail postpaid net additions including 197,000 phone net additions. Verizon added 92,000 FioS Internet net additions in the second quarter. Verizon lost 62,000 video customers in the second quarter.Verizon’s SMB sales and enterprise businesses showed traction. Verizon Business added 178,000 wireless retail postpaid net additions with 78,000 phone net additions. The company added that Verizon Media revenue was $2.1 billion, up 50% from a year ago. Verizon is selling its media division.
    Verizon More

  • 63 Shares149 Views

    in Information Technology

    'Where's my iPadOS 14.7 update?'

    A lot of you have been asking me where iPadOS 14.7 is, given that iOS 14.7 has been rolling out to iPhones for a while now (long enough for bugs to appear). Doesn’t Apple release iOS and iPadOS updates simultaneously?Also, a whole bunch of tech sites said it was available alongside iOS 14.7.So, where is it?Must read: Don’t make this common, fatal iPhone or Android mistake
    No idea.Apple seeded the release candidate versions of both iOS 14.7 and iPadOS 14.7 to developers on July 13, so it seemed like a simultaneous release was on the cards.

    And then it was a no-show. I’ve seen random claims that it was “temporarily available” or something about it not being “fully available,” but I’m skeptical. I didn’t see it, no one has a copy of it, it’s not on the usual download sites, and I’ve not seen an iPad running it.It wasn’t released.So, why not?In my mind, it’s either a show-stopping bug, or, more likely, Apple pushed iOS 14.7 out to fix an iPhone security vulnerability, and either that bug is not applicable to iPadOS, or the iPadOS fix isn’t ready.I’m thinking the delay might be the reason why Apple hasn’t yet released details of the security fixes in the updates that have been rolled out.Apple has been approached for comment and I will update the post if a comment is received, but I highly doubt that the company will issue a comment regarding this. Apple will release iPadOS 14.7 (or perhaps 14.7.1) when it’s good and ready. More

  • 125 Shares149 Views

    in Robotics

    A lidar dev kit that plugs-and-plays out of the box

    Seoul Robotics
    A foundational technology in autonomous vehicles, lidar is steadily making its way into a broader range of robots thanks to plummeting prices. Case in point, a company called Seoul Robotics just launched a ready-to-go, plug-and-play lidar perception system that can be deployed out of the box. Lidar, which was cost-prohibitive for most applications as little as five years ago, may be the key to unlocking a world in which robots take to the streets en masse. But for that to happen, developers need not only the hardware but the software designed for easy integration.”First and foremost, lidar sensors do not work without sophisticated perception software. The lidar industry is investing billions of dollars on sensors without even considering the software needed to interpret the data into actionable solutions,” says HanBin Lee, CEO of Seoul Robotics. “Voyage combines analytics and sensors to bring tangible solutions to market much faster.”The lidar market is on track to reach more than $3 billion by 2025. But the niche range of applications for lidar — and in particular the autonomous vehicle space — has confined product offerings specialized use cases. It’s been largely left to end users to develop underlying software architecture to deploy lidar sensors. It’s only recently that we’re beginning to see truly use-agnostic sensor and software suites, a development that has big implications for IoT and robotics.Seoul Robotics’ new offering is called Voyage. It provides centimeter-accurate 3D object detection, tracking, and classification in addition to volumetric profiling and motion prediction capabilities, regardless of lighting conditions, and can collect and process data from up to four sensors for seamless insights across the sensor coverage zones. As Voyage does not capture, show or store any biometric and otherwise identifying data, it aims to maximize the protection of people’s privacy when installed as part of various smart cities and security systems, signaling one range of potential uses.The development kit is equipped with the company’s proprietary software SENSR2, lidar sensors, and a computer for applications that range from retail to smart cities to security. The arrival of these cost-effective, use agnostic lidar platforms is important because it suggests capability acceleration for IoT and automation technologies, including autonomous mobile robots designed to operate outside of structured and semi-structured environments. More