Backdoor in Notepad++

Feb. 5th, 2026 12:00 pm
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

Hackers associated with the Chinese government used a Trojaned version of Notepad++ to deliver malware to selected users.

Notepad++ said that officials with the unnamed provider hosting the update infrastructure consulted with incident responders and found that it remained compromised until September 2. Even then, the attackers maintained credentials to the internal services until December 2, a capability that allowed them to continue redirecting selected update traffic to malicious servers. The threat actor “specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.” Event logs indicate that the hackers tried to re-exploit one of the weaknesses after it was fixed but that the attempt failed.

Make sure you’re running at least version 8.9.1.

(no subject)

Feb. 4th, 2026 07:41 pm
sorcyress: Drawing of me as a pirate, standing in front of the Boston Citgo sign (Default)
[personal profile] sorcyress
I had a mostly good day at work today! I actually was productive for almost all of it! Now I would _very much_ like to be done. Unfortunately I have a geometry team meeting and then an equity meeting.

But I am actually finished with prep for tomorrow, including slides which is something that hasn't been true in months.

***

Okay, wrote the above at about 1:30. I have since done both of those meetings (both of which were good --I was actually trying to write some of these words during the geometry team meeting, but it was too engaging and useful so I focused instead. Huzzah.)

I fucked around in my classroom for about an hour afterwards, despite being totally done with everything, then set Forest going and walked home. This meant I got home and still had just heaps of time on Power Hour mode which was extremely rude of me. But between good work day and that, here are the things I have done today:

*Made many copies of many things, but critically, all the papers for tomorrow's classes, except for the midterm review packets which weren't finished until the geometry team meeting. I'll try and get to work tomorrowmorn in time to do those.

*Prepped my classes the rest of the way, by like making slides and everything.

*Graded the do nows for the one class that did them (I am back to my old way and it's so much better, note to self, change is bad)

*Put together an answer key for the performance task the ninth graders are doing

*Also ran the performance task for both classes of ninth graders, including doing interference and answering questions and sometimes very pointedly not answering questions because like, y'all. This is technically an assessment. I need to assess if you know anything.

*My reward is that one of my groups opted for a horror movie poster when they got to the part that was "make a movie poster" and it's _great_. To be clear, the theme of the first part of the task is a football player on a field being illuminated by floodlights and it's all about shadow length and stuff. You need to make a poster for "Floodlights: The Movie", so mostly like, we get football themed stuff. Last year, it was a group that made a carnivorous football out for blood. This year, the subtitle is "the last QB" and they asked if they could cut off the head of the little clipart football player they're required to incorporate and I said yes as long as it still made it onto the poster somewhere, so he's just carrying it as the ball. I love my children so much. This bullet point isn't an accomplishment or anything, but it is just like, good.

*Had aforementioned good geometry team meeting (where we sorta slightly overwhelmed my new mentee with a little bit of "it's awesome that you want to help the students study for the midterm, do it with WAY less work") and good equity team meeting (where we got to be very slightly snarky about our secret agenda of helping promote academic equity).

*Walked home, am in the middle of some wild ass-daydreams, but that's fine, it's novel at least

*Put away all the hang-up laundry, which has badly needed it (since before Arisia)

*Began loads one (and subsequently two) of running laundry. I suspect there's four loads alltogether but there might be five because...

*Stripped the bed, remade the bed, brought the old sheets down to the washer

*Did a little bit of knitting while listening to music (listening to music is acceptable during a power hour as long as there is an absolute minimum of fucking around with what music. In this case, it was "search Seeming, hit play". I'm obsessed but you know what, it's better than listening to silence.)

*Put all the clean dishes away and reloaded the dishwasher

*Ate dinner! Which brings us to now, and theoretically writing my words and I could get into a loop, but I shant.

***

I'm trying to use Habitica again, after many ages, to track all my dailies and stuff. It's going pretty well! Today I only have four things left to do, and I actually might get them all done, which would be Very Impressive. We'll see how it goes.

My world is absolutely falling apart, especially on the macro level, but the good news is that everyone else around me is also living in 2026 in the united states, so they mostly get it. May we all make it through.

I love you, and hope you're doing well.

~Sor
MOOP!
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

The US National Reconnaissance Office has declassified information about a fleet of spy satellites operating between 1971 and 2006.

I’m actually impressed to see a declassification only two decades after decommission.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

Microsoft gives the FBI the ability to decrypt BitLocker in response to court orders: about twenty times per year.

It’s possible for users to store those keys on a device they own, but Microsoft also recommends BitLocker users store their keys on its servers for convenience. While that means someone can access their data if they forget their password, or if repeated failed attempts to login lock the device, it also makes them vulnerable to law enforcement subpoenas and warrants.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

A new species of squid. pretends to be a plant:

Scientists have filmed a never-before-seen species of deep-sea squid burying itself upside down in the seafloor—a behavior never documented in cephalopods. They captured the bizarre scene while studying the depths of the Clarion-Clipperton Zone (CCZ), an abyssal plain in the Pacific Ocean targeted for deep-sea mining.

The team described the encounter in a study published Nov. 25 in the journal Ecology, writing that the animal appears to be an undescribed species of whiplash squid. At a depth of roughly 13,450 feet (4,100 meters), the squid had buried almost its entire body in sediment and was hanging upside down, with its siphon and two long tentacles held rigid above the seafloor.

“The fact that this is a squid and it’s covering itself in mud—it’s novel for squid and the fact that it is upside down,” lead author Alejandra Mejía-Saenz, a deep-sea ecologist at the Scottish Association for Marine Science, told Live Science. “We had never seen anything like that in any cephalopods…. It was very novel and very puzzling.”

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

From an Anthropic blog post:

In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and highlights the importance of security fundamentals like promptly patching known vulnerabilities.

[…]

A notable development during the testing of Claude Sonnet 4.5 is that the model can now succeed on a minority of the networks without the custom cyber toolkit needed by previous generations. In particular, Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high-fidelity simulation of the Equifax data breach—one of the costliest cyber attacks in history­­using only a Bash shell on a widely-available Kali Linux host (standard, open-source tools for penetration testing; not a custom toolkit). Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and writing code to exploit it without needing to look it up or iterate on it. Recalling that the original Equifax breach happened by exploiting a publicized CVE that had not yet been patched, the prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches.

AI models are getting better at this faster than I expected. This will be a major power shift in cybersecurity.

[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

The US Supreme Court is considering the constitutionality of geofence warrants.

The case centers on the trial of Okello Chatrie, a Virginia man who pleaded guilty to a 2019 robbery outside of Richmond and was sentenced to almost 12 years in prison for stealing $195,000 at gunpoint.

Police probing the crime found security camera footage showing a man on a cell phone near the credit union that was robbed and asked Google to produce anonymized location data near the robbery site so they could determine who committed the crime. They did so, providing police with subscriber data for three people, one of whom was Chatrie. Police then searched Chatrie’s home and allegedly surfaced a gun, almost $100,000 in cash and incriminating notes.

Chatrie’s appeal challenges the constitutionality of geofence warrants, arguing that they violate individuals’ Fourth Amendment rights protecting against unreasonable searches.

(no subject)

Jan. 26th, 2026 10:37 pm
sorcyress: Drawing of me as a pirate, standing in front of the Boston Citgo sign (Default)
[personal profile] sorcyress
It's Monday!

We had a snow day today, which was very good. I managed to mostly not just play Stardew Valley the entire day straight, and actually do some grading. By which I mean, uh, about an hours worth total. Oh well. It's a start.

(I also did some nice things in Stardew).

Honestly the hour of grading I did was maybe the second most important hour of all of it. There's one more really important hour (actually enter comments) but now I'm in a much less dire place than I was. And yeah, there are several hours in between these two hours, but if they don't happen, they don't happen and everyone will live.

It is hard to care as much about Doing Good At My Job when like, fascism. Am I being kind? Am I hopefully teaching my students to be kind? I think that's probably more important than grading everything to the absolute pinnacle of my ability. Or so I'm telling myself. :/

After some grading and Stardew happened, Austin braved the Many Snow to come visit for regular Mondate! This is good! He showed me some of the things he worked on at Mystery Hunt, and we ate ice cream, and watched an episode of Leverage. It's the Grave Danger Job, which is mostly really good but the last five minutes where the team gets revenge on the drug cartel by using Homeland Security against them.......yeahhh that hits different in 2026 than it did in 2006. Blugh.

(Both Aldis Hodge and Beth Reisgraf are really good actors and able to put it on full display here. I do really like that part, and I like how good this episode is for the OT3 of all OT3s.)

Tomorrow is also a snow day, which is a very very good thing. I might walk Austin to the work shuttle, if I'm feeling very brave --I technically haven't left the house since arriving here Friday evening and it's probably time. The backyard is excitingly drifty! I don't think we have a sled anymore --I think someone borrowed it somewhere along the way and it never returned-- but fucking around on the bike path while wearing many gear seems like a noble pursuit. Maybe I will even bring a camera?

I hope you are staying safe and being kind to your neighbors and occasionally calling your politicians to yell at them. For what little it's worth, ICE's funding is going to run out unless the senate votes to extend it, so maybe like, call your senators sometime in the next day or two and tell them to fucking not?

<3
~Sor
MOOP!

Abolish ICE

Jan. 26th, 2026 12:32 pm
marthawells: Murderbot with helmet (Default)
[personal profile] marthawells
So yeah, kind of hard to concentrate on work while being consumed by rage. I've been to conventions in the Minneapolis area and I have a lot of friends up there, and one of my goddaughters and her husband live there.

For instance, this is Greg Ketter, from DreamHaven Books, where I've done signings, at the protest and running into tear gas:

https://www.youtube.com/shorts/XHDR1PnqPeg

I've been doing mutual aid and sending donations where I can (https://www.standwithminnesota.com/) which is helping my sanity somewhat.


Other stuff I should link to:

Interview with me on Space.com https://www.space.com/entertainment/space-books/martha-wells-next-murderbot-diaries-book-is-the-family-roadtrip-from-hell-on-ringworld-interview


Weather permitting, I'll be guest of honor this coming weekend at AggieCon in College Station: https://www.aggiecon.net/

That's all I've got right now. Abolish ICE.
[syndicated profile] bruce_schneier_feed

Posted by Bruce Schneier

Really interesting blog post from Anthropic:

In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and highlights the importance of security fundamentals like promptly patching known vulnerabilities.

[…]

A notable development during the testing of Claude Sonnet 4.5 is that the model can now succeed on a minority of the networks without the custom cyber toolkit needed by previous generations. In particular, Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high-fidelity simulation of the Equifax data breach—­one of the costliest cyber attacks in history—­using only a Bash shell on a widely-available Kali Linux host (standard, open-source tools for penetration testing; not a custom toolkit). Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and writing code to exploit it without needing to look it up or iterate on it. Recalling that the original Equifax breach happened by exploiting a publicized CVE that had not yet been patched, the prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches.

Read the whole thing. Automatic exploitation will be a major change in cybersecurity. And things are happening fast. There have been significant developments since I wrote this in October.

(no subject)

Jan. 23rd, 2026 05:55 am
sorcyress: Drawing of me as a pirate, standing in front of the Boston Citgo sign (Default)
[personal profile] sorcyress
I went to the doctor today! Well, yesterday, by the time I'm getting around to posting this. It was my regular yearly checkup, only my usual doc had no availability, so I nabbed an appointment with another doctor in the practice. Neither she nor I actually paid particular attention to the name on the computer screen, which meant it was a charming surprise when she walked into the room, we looked at each other, and we mutually went "......oh!" as we recognized someone who lives in the other half of our duplex.

(She kindly offered to not do the appointment if that would make me feel more comfortable, but honestly, I am very lucky in that I trust most doctors to be competent and trustworthy, and also knowing that my doc is queer is a Good Thing in terms of stuff like talking frankly about various queernesses of my own.)

rambling details, CW medical stuff, short version is that everything is fine and I'm doing quite well bodywise )

So it was a good appointment overall and now I don't have to go to the doctor again until July. Huzzah!

~Sor
MOOP!