Backdoor in Notepad++

Feb. 5th, 2026 12:00 pm
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

Hackers associated with the Chinese government used a Trojaned version of Notepad++ to deliver malware to selected users.

Notepad++ said that officials with the unnamed provider hosting the update infrastructure consulted with incident responders and found that it remained compromised until September 2. Even then, the attackers maintained credentials to the internal services until December 2, a capability that allowed them to continue redirecting selected update traffic to malicious servers. The threat actor “specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.” Event logs indicate that the hackers tried to re-exploit one of the weaknesses after it was fixed but that the attempt failed.

Make sure you’re running at least version 8.9.1.

(no subject)

Feb. 4th, 2026 07:41 pm
sorcyress: Drawing of me as a pirate, standing in front of the Boston Citgo sign (Default)
[personal profile] sorcyress
I had a mostly good day at work today! I actually was productive for almost all of it! Now I would _very much_ like to be done. Unfortunately I have a geometry team meeting and then an equity meeting.

But I am actually finished with prep for tomorrow, including slides which is something that hasn't been true in months.

***

Okay, wrote the above at about 1:30. I have since done both of those meetings (both of which were good --I was actually trying to write some of these words during the geometry team meeting, but it was too engaging and useful so I focused instead. Huzzah.)

I fucked around in my classroom for about an hour afterwards, despite being totally done with everything, then set Forest going and walked home. This meant I got home and still had just heaps of time on Power Hour mode which was extremely rude of me. But between good work day and that, here are the things I have done today:

*Made many copies of many things, but critically, all the papers for tomorrow's classes, except for the midterm review packets which weren't finished until the geometry team meeting. I'll try and get to work tomorrowmorn in time to do those.

*Prepped my classes the rest of the way, by like making slides and everything.

*Graded the do nows for the one class that did them (I am back to my old way and it's so much better, note to self, change is bad)

*Put together an answer key for the performance task the ninth graders are doing

*Also ran the performance task for both classes of ninth graders, including doing interference and answering questions and sometimes very pointedly not answering questions because like, y'all. This is technically an assessment. I need to assess if you know anything.

*My reward is that one of my groups opted for a horror movie poster when they got to the part that was "make a movie poster" and it's _great_. To be clear, the theme of the first part of the task is a football player on a field being illuminated by floodlights and it's all about shadow length and stuff. You need to make a poster for "Floodlights: The Movie", so mostly like, we get football themed stuff. Last year, it was a group that made a carnivorous football out for blood. This year, the subtitle is "the last QB" and they asked if they could cut off the head of the little clipart football player they're required to incorporate and I said yes as long as it still made it onto the poster somewhere, so he's just carrying it as the ball. I love my children so much. This bullet point isn't an accomplishment or anything, but it is just like, good.

*Had aforementioned good geometry team meeting (where we sorta slightly overwhelmed my new mentee with a little bit of "it's awesome that you want to help the students study for the midterm, do it with WAY less work") and good equity team meeting (where we got to be very slightly snarky about our secret agenda of helping promote academic equity).

*Walked home, am in the middle of some wild ass-daydreams, but that's fine, it's novel at least

*Put away all the hang-up laundry, which has badly needed it (since before Arisia)

*Began loads one (and subsequently two) of running laundry. I suspect there's four loads alltogether but there might be five because...

*Stripped the bed, remade the bed, brought the old sheets down to the washer

*Did a little bit of knitting while listening to music (listening to music is acceptable during a power hour as long as there is an absolute minimum of fucking around with what music. In this case, it was "search Seeming, hit play". I'm obsessed but you know what, it's better than listening to silence.)

*Put all the clean dishes away and reloaded the dishwasher

*Ate dinner! Which brings us to now, and theoretically writing my words and I could get into a loop, but I shant.

***

I'm trying to use Habitica again, after many ages, to track all my dailies and stuff. It's going pretty well! Today I only have four things left to do, and I actually might get them all done, which would be Very Impressive. We'll see how it goes.

My world is absolutely falling apart, especially on the macro level, but the good news is that everyone else around me is also living in 2026 in the united states, so they mostly get it. May we all make it through.

I love you, and hope you're doing well.

~Sor
MOOP!
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

The US National Reconnaissance Office has declassified information about a fleet of spy satellites operating between 1971 and 2006.

I’m actually impressed to see a declassification only two decades after decommission.

pegkerr: (Alternity)
[personal profile] pegkerr posting in [community profile] alt_fen
This community has been quiescent for a long time because Alternity is over.

Except that three of the writers who helped conceptualize and write this game are living in Minneapolis and St. Paul, and we need to tell you this:

We are actually living it.

If you ever loved Alternity, we are earnestly asking you, begging you, to read this right now.

Here are Peg's thoughts )

Here are Naomi's thoughts )

Here are Elise's thoughts )

***

If you have made it this far (yes, we know this was long), thanks for listening. We would welcome your comments.
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

Microsoft gives the FBI the ability to decrypt BitLocker in response to court orders: about twenty times per year.

It’s possible for users to store those keys on a device they own, but Microsoft also recommends BitLocker users store their keys on its servers for convenience. While that means someone can access their data if they forget their password, or if repeated failed attempts to login lock the device, it also makes them vulnerable to law enforcement subpoenas and warrants.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

A new species of squid. pretends to be a plant:

Scientists have filmed a never-before-seen species of deep-sea squid burying itself upside down in the seafloor—a behavior never documented in cephalopods. They captured the bizarre scene while studying the depths of the Clarion-Clipperton Zone (CCZ), an abyssal plain in the Pacific Ocean targeted for deep-sea mining.

The team described the encounter in a study published Nov. 25 in the journal Ecology, writing that the animal appears to be an undescribed species of whiplash squid. At a depth of roughly 13,450 feet (4,100 meters), the squid had buried almost its entire body in sediment and was hanging upside down, with its siphon and two long tentacles held rigid above the seafloor.

“The fact that this is a squid and it’s covering itself in mud—it’s novel for squid and the fact that it is upside down,” lead author Alejandra Mejía-Saenz, a deep-sea ecologist at the Scottish Association for Marine Science, told Live Science. “We had never seen anything like that in any cephalopods…. It was very novel and very puzzling.”

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

From an Anthropic blog post:

In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and highlights the importance of security fundamentals like promptly patching known vulnerabilities.

[…]

A notable development during the testing of Claude Sonnet 4.5 is that the model can now succeed on a minority of the networks without the custom cyber toolkit needed by previous generations. In particular, Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high-fidelity simulation of the Equifax data breach—one of the costliest cyber attacks in history­­using only a Bash shell on a widely-available Kali Linux host (standard, open-source tools for penetration testing; not a custom toolkit). Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and writing code to exploit it without needing to look it up or iterate on it. Recalling that the original Equifax breach happened by exploiting a publicized CVE that had not yet been patched, the prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches.

AI models are getting better at this faster than I expected. This will be a major power shift in cybersecurity.

Terminology [curr ev]

Jan. 28th, 2026 03:33 am
siderea: (Default)
[personal profile] siderea
Overheard on Reddit, u/Itsyademonboi:
Sorry, Nazis are from Germany under Adolf Hitler, what we have here is Sparkling Fascists.
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

The US Supreme Court is considering the constitutionality of geofence warrants.

The case centers on the trial of Okello Chatrie, a Virginia man who pleaded guilty to a 2019 robbery outside of Richmond and was sentenced to almost 12 years in prison for stealing $195,000 at gunpoint.

Police probing the crime found security camera footage showing a man on a cell phone near the credit union that was robbed and asked Google to produce anonymized location data near the robbery site so they could determine who committed the crime. They did so, providing police with subscriber data for three people, one of whom was Chatrie. Police then searched Chatrie’s home and allegedly surfaced a gun, almost $100,000 in cash and incriminating notes.

Chatrie’s appeal challenges the constitutionality of geofence warrants, arguing that they violate individuals’ Fourth Amendment rights protecting against unreasonable searches.

(no subject)

Jan. 26th, 2026 10:37 pm
sorcyress: Drawing of me as a pirate, standing in front of the Boston Citgo sign (Default)
[personal profile] sorcyress
It's Monday!

We had a snow day today, which was very good. I managed to mostly not just play Stardew Valley the entire day straight, and actually do some grading. By which I mean, uh, about an hours worth total. Oh well. It's a start.

(I also did some nice things in Stardew).

Honestly the hour of grading I did was maybe the second most important hour of all of it. There's one more really important hour (actually enter comments) but now I'm in a much less dire place than I was. And yeah, there are several hours in between these two hours, but if they don't happen, they don't happen and everyone will live.

It is hard to care as much about Doing Good At My Job when like, fascism. Am I being kind? Am I hopefully teaching my students to be kind? I think that's probably more important than grading everything to the absolute pinnacle of my ability. Or so I'm telling myself. :/

After some grading and Stardew happened, Austin braved the Many Snow to come visit for regular Mondate! This is good! He showed me some of the things he worked on at Mystery Hunt, and we ate ice cream, and watched an episode of Leverage. It's the Grave Danger Job, which is mostly really good but the last five minutes where the team gets revenge on the drug cartel by using Homeland Security against them.......yeahhh that hits different in 2026 than it did in 2006. Blugh.

(Both Aldis Hodge and Beth Reisgraf are really good actors and able to put it on full display here. I do really like that part, and I like how good this episode is for the OT3 of all OT3s.)

Tomorrow is also a snow day, which is a very very good thing. I might walk Austin to the work shuttle, if I'm feeling very brave --I technically haven't left the house since arriving here Friday evening and it's probably time. The backyard is excitingly drifty! I don't think we have a sled anymore --I think someone borrowed it somewhere along the way and it never returned-- but fucking around on the bike path while wearing many gear seems like a noble pursuit. Maybe I will even bring a camera?

I hope you are staying safe and being kind to your neighbors and occasionally calling your politicians to yell at them. For what little it's worth, ICE's funding is going to run out unless the senate votes to extend it, so maybe like, call your senators sometime in the next day or two and tell them to fucking not?

<3
~Sor
MOOP!

Abolish ICE

Jan. 26th, 2026 12:32 pm
marthawells: Murderbot with helmet (Default)
[personal profile] marthawells
So yeah, kind of hard to concentrate on work while being consumed by rage. I've been to conventions in the Minneapolis area and I have a lot of friends up there, and one of my goddaughters and her husband live there.

For instance, this is Greg Ketter, from DreamHaven Books, where I've done signings, at the protest and running into tear gas:

https://www.youtube.com/shorts/XHDR1PnqPeg

I've been doing mutual aid and sending donations where I can (https://www.standwithminnesota.com/) which is helping my sanity somewhat.


Other stuff I should link to:

Interview with me on Space.com https://www.space.com/entertainment/space-books/martha-wells-next-murderbot-diaries-book-is-the-family-roadtrip-from-hell-on-ringworld-interview


Weather permitting, I'll be guest of honor this coming weekend at AggieCon in College Station: https://www.aggiecon.net/

That's all I've got right now. Abolish ICE.

Ice storm advice [meteo]

Jan. 23rd, 2026 11:11 pm
siderea: (Default)
[personal profile] siderea
For those of you in the parts of the US for whom an ice storm is predicted and who have no idea of what that is except that it means it will be cold:

1) If you have an ice scraper to clean the ice off your car, have it inside with you, not in the car. Because at a sufficient level of ice coating, leaving your ice scraper in the car is like leaving your car keys in the car.

1a) Honestly, at a certain level of ice coating, it's more like having one's car coated in concrete, and you shouldn't waste your energy and body warmth whaling futilely at it. One of the failure modes is you succeed in getting the ice off but take the windshield with it.

2) You probably associate winter storms and coldness with grey-overcast skies and darkness. But once it is done coming down, often the arctic winds that drove the storm will blow the clouds away, the skies clear and the sun will come up. I cannot begin to describe how bright it gets when the sun is shining and the whole world is made of glass. If you packed your sunglasses away for the winter, go get them out. If you store them in your glove compartment of your car, again, maybe go get them and have them inside with you so you can see what you're doing when you are trying to get the ice off the car.

3) All that said, maybe just don't be worrying about leaving home. A fundamental clue is that an ice storm is not done when the storm is done raging. For as long as there's a thick glaze of ice on everything, the crisis is not over. Your life experience has given you an intuition of physics that says ice forms where water pools and is therefore mostly something flat. But in an ice storm, you get ice coating absolutely everything including sloped and vertical surfaces. YouTube is willing to show you endless videos of people attempting and failing to walk up quite gentle slopes covered with ice and cars slowly and majestically sliding down hills. Driving and walking can be unbelievably dangerous after an ice storm. Try to ride it out by sheltering in place and don't try to go out in it if you can at all avoid it. Remember, it's not about how good a driver you are, it's about how good a driver everybody else on the road isn't.

4) Snow and ice falling off buildings can kill you. Yes, I know snow looks fluffy, but it is made of water and can compact to be quite solid and if it attains free fall it can build up quite a bit of momentum. Icicles are basically spears. If you endeavor to try to knock snow or ice off from a roof or other high structure, be real careful how you position yourself relative to it.

5) Now and until this is over is absolutely not the time to do anything that entails any unnecessary risk. Any activity that is at all discretionary that has even a remote likelihood of occasioning an ER trip is to be avoided. Boredom, I know, makes people find their own fun. Resist the urge.