Forgot your password?
typodupeerror

Submission + - Ledger confirms spy chip implant behind wallet crypto thefts (bleepingcomputer.com)

AmiMoJo writes: Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware.

"Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8pad package just 2×2 mm, next to the MCU, and a shielded LTE module that sends the words out."

Comment Re:Stop hooking standalone things to the internet. (Score 1) 92

The firmware probably isn't designed to be secure, they likely instead have a box that does all the comms with the fridges, and connects to their VPN for remote control. The box only ever talks to the VPN so the only bit that needs securing is their corporate network.

That is how most of these devices work, such as connected cars. VPN to a fixed server, with a certificate to validate that it's the real one, and don't talk to anything else.

Comment Re:They should migrate away from the internet (Score 1) 92

Because it saves them vastly more money than this hack has cost them.

They could use a one-way link for simple monitoring, but by having a two way link they can adjust the set point temperature based on real-time electricity prices. Unlike residential customers, large businesses usually pay a variable rate based on 15 minute demand pricing. The pricing is announced 24 hours in advance based on predictions for demand. They drop the set temperature a degree or two when it is cheap, and raise it a degree or two when it is expensive.

Comment Re:As they say... (Score 1) 117

Fukushima was an inconvenience? Half a trillion Euros to clean up, and rising, and at least 200 billion Euros of consequential economic damage. Multiple full meltdowns, at least 51 deaths, and 164,000 residence displaced.

Modern reactors absolutely can melt down. I don't know where you got that idea from. The new SMR designs can too.

Comment Re:Another candidate for the Google Graveyard. (Score 1) 14

To be fair Google has supported Fitbit products for a long time and has been steadily upgrading Google Health. It does seem that they are in it for the long haul, although some people aren't happy with the new app and prefer the old Google Fit one.

I've had a Versa 4 for a few years and it's good. Battery life is decent, it seems accurate and proper scientific tests confirm that it is. The sleep tracking is the best you can get without spending at least 4x as much, and is accurate enough to be useful.

Comment Re:wtf is JPEG-XL (Score 2) 25

"XL" isn't a good name for it really.

JPEG-XL offers numerous improvements over JPEG, including the ability to do a lossless transcoding of a JPEG file for a ~20% space saving. That alone is very valuable for the web where there is a vast amount of JPEG data that can be reduced now.

It also has proper HDR support, although it remains to be see how well that will work in practice. The issue is going to be the conversion for SDR screens. Also browsers need to be careful with HDR images, or retina burning trolling is going to become a think.

For general use it offers smaller file sizes and better image quality than JPEG. It usually equals or beats most other lossy formats, but not always. It also offers true lossless, and visually lossless modes. The former is competitive with PNG.

The main downside is that performance is much, much worse than JPEG. For decoding, what matters to 99.9% of people, it is both slower and uses more energy (i.e. battery run-time) than JPEG. It may be a net benefit due to smaller downloads, but I'm not convinced.

The other issue is that the reference decoder is written in Rust, so if you want to use it you need to integrate that into your app. There is a C implementation but it's old and seemingly abandoned.

Comment Re:I'm sure AI is great (Score 1) 34

People who are just making little apps and scripts to improve productivity could benefit from AI. I've used it to do a few little PowerShell and Python scripts. I'm not very familiar with either language and don't have time to learn, so some little automation scripts that I otherwise wouldn't have had the inclination to make myself are valuable time savers.

For example I have a PowerShell script that takes unstapled magazines that have been scanned in a sheet feed scanner and splits them into correctly numbered individual pages. It has massively sped up the process of preserving old magazines. Gemini took a few attempts to get it right, but it got there eventually. I'd have probably ended up wasting a fair bit more time writing a little C# app if AI couldn't do it for me.

On the other hand, I'd never let it write embedded code for work. If I can't write it myself, I can't debug it either.

Comment I'm not good at lovely documents (Score 1) 34

And one damn thing I wanted AI to do for me was to make lovely documents for me so I didn't have to try doing it. So far it can't really do it. If I really screw around with it I can get it to do it but then I could have just done it myself.

And that's been my experience with AI so far. If I really screw around with it I can get it to do what I wanted to do but I could have just done it myself in the first place. And since I have to check all the work it's doing it's just not worth the effort.

I've been told if you put a bunch of effort into getting it to work it will work but what the hell is the point of that? Meanwhile eventually it's not going to be cheap and unless I want to spend 3 Grand on video card that can run one of the models I'm stuck paying through the nose...

I'm not sure I get what Torvalds is saying here either. Did I misread it? He said he gave AI The prompt and it did it but it was horrendous. Implying that it was worse than the work he did himself. What's the point then? If it can't solve the part I don't want to do and it's incredibly expensive doing that badly I just don't see the point... I guess it takes people who can't do a thing and makes them feel like they could do the thing. And I guess if you're a business man that's a good thing because you can theoretically expand the number of people you can hire to do a thing or just get rid of them all together plummeting wages.

But again, I don't see how that's a good thing either. Especially in a world where if you don't work you don't eat and people tend to start wars when they can't eat...

Comment Epic are the kings of slop (Score 1) 39

Even before AI they cranked out nothing but slop for fortnite. Skin after skin after skin and they only started making anything else when fortnite skin sales started to drop and like every publicly traded company on Earth they have to grow endlessly and at the exact same or better rates than they did last cycle.

Our entire economic system is built on endless highly rapid growth to keep the Epstein class fed. Basically we're all running from the dragon hoping it eats The Hobbit before it eats us. And it's looking like it's done with all the hobbits and we're next on the menu...

Comment Re:wtf is JPEG-XL (Score 5, Informative) 25

It's this.

And on the compression side, there's a lot of really cool stuff that lets it happen. For example, it dynamically resizes the blocks from 2x2 to 256x256, and they don't even have to be square. It may apply DCT in one, AFAS in another, etc - whatever is most efficient. It uses edge preserving filters to keep the edges of features clean. It can draw in splines and clone regions from one part of an image to another. Where it has to throw away high frequency noise (film grain, noisy textures, etc), it statistically samples the properties of the noise and saves that, and then regenerates equivalent noise. In "busy" areas, like say tree bark or whatnot (where the human eye isn't good at discerning changes), it throws away more precision there, and instead allocates it to details located in fragile flat areas, such as skin and shadows, that the eye is attracted to. It works in default in XYB colour space, based on the actual interactions of the cones in the eye, so it can aggressively quantize things which the brain cannot detect. And in the choice between fast but not-great Huffman coding vs. better but slow and patent-encumbered arithmetic coding, they instead use rANS, which is nearly as fast as Huffman but as efficient as arithmetic coding, and faces no patent challenges. Which is also why you can take a legacy JPEG and rapidly losslessly reincode as JPEG-XL and get a file that's ~20% smaller - you're swapping Huffman for rANS.

(That's the lossy mode - there's also a dedicated lossless mode)

Slashdot Top Deals

Maybe Computer Science should be in the College of Theology. -- R. S. Barton

Working...