<?xml version="1.0" encoding="utf-8"?>
<!-- generator="FeedCreator 1.7.2" -->
<rss version="2.0">
    <channel>
        <title>Lowyat.NET: Latest topics by nuvi</title>
        <description></description>
        <link>http://forum.lowyat.net/</link>
        <lastBuildDate>Mon, 01 Jun 2026 01:30:49 +0800</lastBuildDate>
        <generator>FeedCreator 1.7.2</generator>
        <item>
            <title>ㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱㄱ</title>
            <link>http://forum.lowyat.net/topic/5542691</link>
            <description>[YOUTUBE]8-6tr_4UUIY[/YOUTUBE]&lt;br /&gt;&lt;br /&gt;Update&lt;br /&gt;&lt;!--SPOILER BEGIN--&gt;&lt;div class=&quot;spoilertop&quot; onClick=&quot;openClose('1da05a7670589223f31dc3a9e2d43220')&quot; style=&quot;font-weight: bold&quot;&gt;&lt;u&gt;&amp;raquo; Click to show Spoiler - click again to hide... &amp;laquo;&lt;/u&gt;&lt;/div&gt;&lt;div class=&quot;spoilermain&quot; id=&quot;1da05a7670589223f31dc3a9e2d43220&quot; style=&quot;display:none&quot;&gt;&lt;!--SPOILER END--&gt;[YOUTUBE]uIrmU84iYIs[/YOUTUBE]&lt;!--SPOILER DIV--&gt;&lt;/div&gt;&lt;!--SPOILER DIV--&gt;</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Mon, 13 Oct 2025 14:09:49 +0800</pubDate>
        </item>
        <item>
            <title>Why did our friends stop posting</title>
            <link>http://forum.lowyat.net/topic/5534700</link>
            <description>[YOUTUBE]bN4MNdCAnWA[/YOUTUBE]&lt;br /&gt;&lt;br /&gt;Is social media dying? Feels like been seeing lesser user own experience/thought contents but increasing of paid contents, advertising disguising as experience, influencers content. Myself also more often choose to create distance instead of engaging in socmed. Feels like socmed now full of bots trying to influence instead of genuine engagement of people.</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Tue, 05 Aug 2025 08:54:47 +0800</pubDate>
        </item>
        <item>
            <title>Louis Rossmann talk about Malaysia tries to ban</title>
            <link>http://forum.lowyat.net/topic/5482128</link>
            <description>[YOUTUBE]itj3Z43QAf8[/YOUTUBE]</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Thu, 12 Sep 2024 08:46:24 +0800</pubDate>
        </item>
        <item>
            <title>PSA: Scam sms 03-29350068</title>
            <link>http://forum.lowyat.net/topic/5321028</link>
            <description>Received scam sms, say a bank name card transaction at online shopping platform is successful and ask to call 03-29350068 for enquiry. I checked and the bank doesn&amp;#39;t use this number.&lt;br /&gt;&lt;br /&gt;I searched LYN, this number never appear before. New number registered by scammer.</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Tue, 25 Oct 2022 15:59:18 +0800</pubDate>
        </item>
        <item>
            <title>Kherson now</title>
            <link>http://forum.lowyat.net/topic/5304805</link>
            <description>[twt]https://twitter.com/MarkRid89403375/status/1564222179000074241[/twt]&lt;br /&gt;&lt;br /&gt;[twt]https://twitter.com/MarkRid89403375/status/1564223164489646083[/twt]</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Mon, 29 Aug 2022 20:18:13 +0800</pubDate>
        </item>
        <item>
            <title>Al-Qaeda leader Ayman al-Zawahiri has been</title>
            <link>http://forum.lowyat.net/topic/5296268</link>
            <description>[twt]https://twitter.com/IAPonomarenko/status/1554223009111719937[/twt]&lt;br /&gt;&lt;br /&gt;[twt]https://twitter.com/IAPonomarenko/status/1554235848027144194[/twt]&lt;br /&gt;&lt;br /&gt;[twt]https://twitter.com/Troy_IRL/status/1289612374479998977[/twt]</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Tue, 02 Aug 2022 07:27:37 +0800</pubDate>
        </item>
        <item>
            <title>Predictive Policing</title>
            <link>http://forum.lowyat.net/topic/5287053</link>
            <description>This is something straight like out of movie plot. Many countries already using it, no matter west or east or democracy or communist. And countries that are more authoritarian likely are abusing it for some groups or political interests. When combined with camera and facial recognition, everyone is almost always under surveillance and being predicted what you will do next.&lt;br /&gt;&lt;br /&gt;[YOUTUBE]WXnElg9alF8[/YOUTUBE]&lt;br /&gt;&lt;br /&gt;&lt;a href='https://web.archive.org/web/20220626114324/https://www.nytimes.com/2022/06/25/technology/china-surveillance-police.html' target='_blank'&gt;‘An Invisible Cage’: How China Is Policing the Future&lt;/a&gt;&lt;br /&gt;&lt;!--QuoteBegin--&gt;&lt;div class='quotetop'&gt;QUOTE&lt;/div&gt;&lt;div class='quotemain'&gt;&lt;!--QuoteEBegin--&gt;The more than 1.4 billion people living in China are constantly watched. They are recorded by police cameras that are everywhere, on street corners and subway ceilings, in hotel lobbies and apartment buildings. Their phones are tracked, their purchases are monitored, and their online chats are censored.&lt;br /&gt;&lt;br /&gt;Now, even their future is under surveillance.&lt;br /&gt;&lt;br /&gt;The latest generation of technology digs through the vast amounts of data collected on their daily activities to find patterns and aberrations, promising to predict crimes or protests before they happen. They target potential troublemakers in the eyes of the Chinese government — not only those with a criminal past but also vulnerable groups, including ethnic minorities, migrant workers and those with a history of mental illness.&lt;br /&gt;&lt;br /&gt;In many cases the software goes further than simply targeting a population, allowing the authorities to set up digital tripwires that indicate a possible threat. In one Megvii presentation detailing a rival product by Yitu, the system’s interface allowed the police to devise their own early warnings.&lt;br /&gt;&lt;br /&gt;With a simple fill-in-the-blank menu, the police can base alarms on specific parameters, including where a blacklisted person appears, when the person moves around, whether he or she meets with other blacklisted people and the frequency of certain activities. The police could set the system to send a warning each time two people with a history of drug use check into the same hotel or when four people with a history of protest enter the same park.&lt;!--QuoteEnd--&gt;&lt;/div&gt;&lt;!--QuoteEEnd--&gt;&lt;br /&gt;&lt;br /&gt;&lt;a href='https://www.vice.com/en/article/akew98/facial-recognition-is-out-of-control-in-india' target='_blank'&gt;Facial Recognition Is Out of Control in India&lt;/a&gt;&lt;br /&gt;&lt;!--QuoteBegin--&gt;&lt;div class='quotetop'&gt;QUOTE&lt;/div&gt;&lt;div class='quotemain'&gt;&lt;!--QuoteEBegin--&gt;The country’s use of biometric data against activists and “hooligans” paints a grim picture of how the technology is threatening human rights.&lt;br /&gt;&lt;br /&gt;While driving through the busy lanes of Shahran, a Muslim-dominated neighborhood, they were pulled over by two police officers.&lt;br /&gt;&lt;br /&gt;Masood wasn’t concerned at first because he assumed that he would be asked to show his driver’s license or the vehicle registration card. But instead, they were asked to remove their masks so the police constables could take mugshots of their faces on a handheld tablet.&lt;br /&gt;&lt;br /&gt;Privacy advocates have sounded the alarm about police use of facial recognition (FRT) in Telangana, with Amnesty International warning that the capital city of Hyderabad is “on the brink of becoming a total surveillance city.”&lt;br /&gt;&lt;br /&gt;The Hyderabad city police department is known for employing facial recognition for a variety of objectives, including questionable cordon and search operations, profiling people for narcotics, and unlawful phone-searching activities. They claim that facial recognition technology has worked as a &amp;quot;deterrent&amp;quot; and helped them apprehend criminals.&lt;br /&gt;&lt;br /&gt;In Telangana, there are numerous facial recognition datasets that are being integrated into a “smart governance program,” called Samagram, which gives the state government a full picture of every resident&amp;#39;s life, including their employment status and other personal information. The goal isn&amp;#39;t only to track down criminals, but to build up a ‘360 degree view’ of every single person.&lt;br /&gt;&lt;br /&gt;This project, formerly known as the Integrated People Information Hub, would use data from police records as well as &amp;quot;phone/water/electricity connections, tax payments, passports, voter IDs, RTA license and registration data, e-challans and even terrorist records,&amp;quot; as stated by then Police Commissioner Mahendar Reddy in a now-deleted article in Telangana Today (regarded as a mouthpiece for the TRS government). A complete profile is created by combining this data with other identifying characteristics such as name, address, and phone number.&lt;br /&gt;&lt;br /&gt;Telangana&amp;#39;s IT Secretary stated this in 2019 on the usage of digital footprints: “We have created a best algorithm through which this machine learning capabilities has become so robust that today we have reached a level of almost 96-97 percent accuracy. So if you tell me one person&amp;#39;s name I can give his entire digital footprint at about 96 percent accuracy to them... this tool throws up the results in a matter of seconds and the tool also is very useful in doing what is called family tree analysis or relationship analysis.”&lt;!--QuoteEnd--&gt;&lt;/div&gt;&lt;!--QuoteEEnd--&gt;</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Sat, 02 Jul 2022 19:40:53 +0800</pubDate>
        </item>
        <item>
            <title>Simulating An Epidemic</title>
            <link>http://forum.lowyat.net/topic/4932697</link>
            <description>This video show simulation of the epidemic if nothing being done, something being done, something being done but not fully, additional factors. Just watch the video to understand the tiny little dots representing human scrambling around.&lt;br /&gt;&lt;br /&gt;[YOUTUBE]gxAaO2rsdIs[/YOUTUBE]</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Sat, 28 Mar 2020 16:31:54 +0800</pubDate>
        </item>
        <item>
            <title>Covid-19: Different Stage of Severity</title>
            <link>http://forum.lowyat.net/topic/4927948</link>
            <description>&lt;a href='https://pictr.com/image/5yDGdY' target='_blank'&gt;&lt;img src='https://pictr.com/images/2020/03/21/5yDGdY.md.jpg' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;Don&amp;#39;t know if slowpoke or not&lt;br /&gt;&lt;br /&gt;What Coronavirus symptoms looks like day after day&lt;br /&gt;[YOUTUBE]OOJqHPfG7pA[/YOUTUBE]&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;Also, how easily germs spread from our hands&lt;br /&gt;[YOUTUBE]I5-dI74zxPg[/YOUTUBE]</description>
            <author>nuvi</author>
            <category>Kopitiam</category>
            <pubDate>Sat, 21 Mar 2020 17:52:31 +0800</pubDate>
        </item>
        <item>
            <title>Hate speech: Authorities slammed for sparing</title>
            <link>http://forum.lowyat.net/topic/4833794</link>
            <description>&lt;a href='https://pictr.com/image/56xWKA' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/09/06/56xWKA.md.jpg' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;Mohamad Yazid Kong Abdullah, Chow Mun Fai and Wai Foo Sing, among those charged with provocative online postings. A critic says only ordinary Malaysians appear to be hauled into court over hate speech.&lt;br /&gt;&lt;br /&gt;PETALING JAYA: Recent alleged threats to racial harmony have prompted a renewed call for tough laws against hate speech.&lt;br /&gt;&lt;br /&gt;Akhbar Satar, a former president of Transparency International Malaysia, told FMT he would like to see laws so strict that even politicians and religious leaders would think twice before making racially charged statements.&lt;br /&gt;&lt;br /&gt;He said there was no need to enact a new law against hate speech because relevant sections of the Penal Code, the Sedition Act and the Communications and Multimedia Act could be strengthened.&lt;br /&gt;&lt;br /&gt;The enforcement of those laws must be equally strict, he said, noting that the authorities’ action against racist statements seemed lately to be directed only against ordinary members of the public.&lt;br /&gt;&lt;br /&gt;A lorry driver was charged on Wednesday at the Port Dickson magistrate’s court with posting racially offensive remarks on social media. Several other nondescript social media users have been charged with similar offences this year.&lt;br /&gt;&lt;br /&gt;“Most of the time the government’s action is not consistent and is likely seen as insincere or politically motivated,” Akhbar said.&lt;br /&gt;&lt;br /&gt;He said the apparent reluctance to go after political and religious figures gave the impression that Pakatan Harapan was not keeping its election promise to respect the rule of law, that it was selective in investigating offences and taking court action.&lt;br /&gt;&lt;br /&gt;He spoke of the coalition’s election victory last year as heralding a new Malaysia ruled with justice and transparency.&lt;br /&gt;&lt;br /&gt;He said the public thought the country would be governed by statesmen who would have the interest of future generations in mind.&lt;br /&gt;&lt;br /&gt;“But what we are getting are politicians concerned about their positions” he said, alleging that leaders in Putrajaya were not speaking up for fear of offending other politicians and some sections of the public.&lt;br /&gt;&lt;br /&gt;Akhbar said he believed race relations in the country were “still under control” but added that he feared for the worst if no action was taken against rogue politicians.&lt;br /&gt;&lt;br /&gt;Klang MP Charles Santiago also called for the just application of the law, saying this would go towards making people feel assured that no community has an advantage over another.&lt;br /&gt;&lt;br /&gt;He urged the government to take the lead in changing the direction of current political discourse by focusing on creating jobs, raising wage levels and improving the quality of life and education.&lt;br /&gt;&lt;br /&gt;He said there was a link between racial unease and wages. “When people feel they are not able to put food on the table, tension rises.”&lt;br /&gt;&lt;br /&gt; &lt;a href='https://www.freemalaysiatoday.com/category/nation/2019/09/06/hate-speech-authorities-slammed-for-sparing-politicians-religious-leaders/' target='_blank'&gt;https://www.freemalaysiatoday.com/category/...igious-leaders/&lt;/a&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Fri, 06 Sep 2019 15:13:34 +0800</pubDate>
        </item>
        <item>
            <title>Honest Trailers | MCU</title>
            <link>http://forum.lowyat.net/topic/4798018</link>
            <description>MCU is about daddy issue&amp;#33;&lt;br /&gt;[YOUTUBE]QZ6KIK7taGc[/YOUTUBE]&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;They spend a lot of time and research to do this trailer &lt;!--emo&amp;:thumbs:--&gt;&lt;img src='http://static.lowyat.net/style_emoticons/default/thumbup.gif' border='0' style='vertical-align:middle' alt='thumbup.gif' /&gt;&lt;!--endemo--&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Mon, 24 Jun 2019 22:07:13 +0800</pubDate>
        </item>
        <item>
            <title>Car DP Higher better? v2</title>
            <link>http://forum.lowyat.net/topic/4761887</link>
            <description>So I was interested with this thread whether should we pay high or low DP and use the remaining money to get interest from FD to offset the loan interest.&lt;br /&gt;&lt;a href='https://forum.lowyat.net/index.php?showtopic=4761519&amp;hl=' target='_blank'&gt;https://forum.lowyat.net/index.php?showtopic=4761519&amp;hl=&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;Unfortunately that ts go lock the thread so I open this thread to continue discussion on it. My excel skill a bit rusty so pls bear with me. Let me know if there&amp;#39;s error in my calculation.&lt;br /&gt;&lt;br /&gt;Based on his formula I feel there&amp;#39;s some error on it, firstly I don&amp;#39;t understand why he need to add back &lt;b&gt;C&lt;/b&gt;, when total interest+cost is RM250K you couldn&amp;#39;t be paying RM254,120. That&amp;#39;s just not possible. Secondly FD also have 3 months period, which I think is better suited for such scenario as you need to constantly withdraw money from the saving.&lt;br /&gt;&lt;br /&gt;So here I redo back the formula and see which is better with plenty of scenarios.&lt;br /&gt;&lt;br /&gt;First if follow that thread value&lt;br /&gt;&lt;a href='https://pictr.com/image/0klisU' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0klisU.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;Can see that actually the difference is very small no matter high or low DP. It&amp;#39;s because the FD interest able to cover back the loan interest. There&amp;#39;s actually one flaw with such scenario, later I&amp;#39;ll explain. Now what if we loan for 9 years instead?&lt;br /&gt;&lt;br /&gt;&lt;a href='https://pictr.com/image/0klhEv' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0klhEv.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;Lower DP actually pay less than higher DP &lt;!--emo&amp;:lol:--&gt;&lt;img src='http://static.lowyat.net/style_emoticons/default/laugh.gif' border='0' style='vertical-align:middle' alt='laugh.gif' /&gt;&lt;!--endemo--&gt;&lt;br /&gt;&lt;br /&gt;The flaw with such scenario is I don&amp;#39;t think you can get 2.2 vs 2.5 interest rate, that seems too far fetched. If 2.45 vs 2.5 is more likely.&lt;br /&gt;&lt;br /&gt;5 years&lt;br /&gt;&lt;a href='https://pictr.com/image/0klnVV' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0klnVV.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;9 years&lt;br /&gt;&lt;a href='https://pictr.com/image/0kl4T5' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0kl4T5.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;2k difference for 5 years and 3k difference for 9 years. It&amp;#39;s not that big gap. Overall it doesn&amp;#39;t matter if you do high DP or low DP as long as you have full amount for the car. But this scenario I don&amp;#39;t think it&amp;#39;s possible for most people so next is normal average people scenario when buying car.&lt;br /&gt;&lt;br /&gt;So let&amp;#39;s say you have 30k cash and want to buy god car, you wonder do you put all as DP so that you can save on interest or you put 10k as DP and rest put in FD? In these scenarios I put up I assume you can afford the high monthly repayment for low DP. For high DP, the monthly saving you got from lower repayment will be invested into FD every quarter so that it can help to reduce your loan interest. Due to bank usually don&amp;#39;t give higher FD rate if you have less than 10K so I put that as 3%. The final amount is total you pay for the car minus FD. Let&amp;#39;s see the result&lt;br /&gt;&lt;br /&gt;&lt;a href='https://pictr.com/image/0klAxr' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0klAxr.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;Again, small difference. Putting more DP doesn&amp;#39;t help to save interest when got FD to cover it. But what if loan 9 years?&lt;br /&gt;&lt;br /&gt;&lt;a href='https://pictr.com/image/0kljTY' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/04/05/0kljTY.md.png' border='0' alt='user posted image' /&gt;&lt;/a&gt;&lt;br /&gt;Now we can see bigger difference between the 2. Longer tenure can feel the impact of low DP interest rate. &lt;br /&gt;&lt;br /&gt;So is it better to put high DP or low DP? Personally I think putting low DP is better if you can afford the monthly repayment as the on hand money you just put in FD and be done with it whereas high DP you need to vigilantly save money every month to cover the loan interest rate. &lt;br /&gt;&lt;br /&gt;5 years or 9 years? Now this is a bit tricky as seeing almost 4k increase is significant. But the counter is your monthly repayment dropped by 40%, that&amp;#39;s RM600 monthly. If you were to save that RM600 every month for 9 years your FD will have over 70K&amp;#33; Even if you can only save half of the time the accumulated interest can easily offset the 4K increase. Do 9 years if you going to keep the car for that long (or act as deterrent from changing car)&lt;br /&gt;&lt;br /&gt;Having your money in FD also help when you need emergency cash. if you have other saving, the 20K also might help to make your total saving higher thus get better FD rate. If you invest in trust/share/asb that can have higher interest then sure win.&lt;br /&gt;&lt;br /&gt;So what do you think? high DP low tenure to save interest or low DP long tenure to keep money in FD?</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Fri, 05 Apr 2019 03:25:29 +0800</pubDate>
        </item>
        <item>
            <title>Kleenex might want to rethink their box design</title>
            <link>http://forum.lowyat.net/topic/4747587</link>
            <description>&lt;a href='https://pictr.com/image/0KhL0Y' target='_blank'&gt;&lt;img src='https://pictr.com/images/2019/03/05/0KhL0Y.jpg' border='0' alt='user posted image' /&gt;&lt;/a&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Tue, 05 Mar 2019 12:48:36 +0800</pubDate>
        </item>
        <item>
            <title>African Swine Fever Virus</title>
            <link>http://forum.lowyat.net/topic/4714607</link>
            <description>PETALING JAYA: Malaysia is stepping up its enforcement to prevent the African swine fever (ASF) virus from spreading to the nation following its outbreak in other countries with the Year of the Pig approaching.&lt;br /&gt;&lt;br /&gt;There will be a temporary ban expansion on pork products from six countries including China following the virus outbreak instead of only live pigs and frozen pork.&lt;br /&gt;&lt;br /&gt;The Chinese community, however, do not have to worry about the shortage of pork delicacies as they usher in the Chinese New Year.&lt;br /&gt;&lt;br /&gt;For starters, Malaysia does not import live pigs and frozen pork from China, where the major outbreak is.&lt;br /&gt;&lt;br /&gt;There should also be no effect on the must-have lap mei fun (Cantonese for rice with preserved and waxed meat) as restaurants usually purchase lap cheong (Chinese sausage), yun cheong (liver sausage) and waxed pork from local producers and sources.&lt;br /&gt;&lt;br /&gt;The Department of Veterinary Services (DVS) has widened the temporary ban on products such as canned pork, sausage casings, sliced pork, smoked ham and pork en­zymes from China, Poland, Rus­sia, Hungary, Moldova and Ukraine.&lt;br /&gt;&lt;br /&gt;Deputy Agriculture and Agro-based Industry Minister Sim Tze Tzin said the expansion came after South Korea and another country discovered processed pork products that contained the ASF virus on Tuesday.&lt;br /&gt;&lt;br /&gt;“With the new discovery and new development, the ministry will enlarge the ban on pork products. The DVS will be studying the risk and impact closely.&lt;br /&gt;&lt;br /&gt;“This is to further protect our country from ASF and we are monitoring the situation very closely. Processed products are not supposed to have these viruses but somehow, they were detected, so we have to do more,” he said, adding that it was considered an immediate ban as the virus was only discovered by other countries on Christmas day.&lt;br /&gt;&lt;br /&gt;Usually, processed pork would have been sterilised after going through the processes of steaming, cooking, boiling or being smoked.&lt;br /&gt;&lt;br /&gt;There should also be no shortage of roasted suckling pig – a popular dish among the Chinese during celebrations and festive seasons.&lt;br /&gt;&lt;br /&gt;Suckling pigs are usually obtained from Vietnam, which borders China. Its capital, Hanoi, is about 1,000km away from Guangdong province where some 2,000 pigs have been culled.&lt;br /&gt;&lt;br /&gt;Sim said Vietnam was not an infected area but DVS and the ministry are monitoring it closely.&lt;br /&gt;&lt;br /&gt;The DVS will issue a statement about the ban expansion today. It issued a statement yesterday that Malaysia did not import pork blood protein flour from China that was used to process animal feed.&lt;br /&gt;&lt;br /&gt;This was in response to a report claiming that authorities in China discovered ASF virus in the powder in Huizhou, Guangdong.&lt;br /&gt;&lt;br /&gt;Sim had announced the ban on importation of live pigs and frozen pork from the six countries affected with the ASF virus on Sept 7 after a meeting with stakeholders and pig farmers following the virus outbreak in early August.&lt;br /&gt;&lt;br /&gt;“While the virus does not affect humans, authorities here are taking proactive measures to prevent the risk of ASF, which could affect pig farms here,” said Sim, adding that there were no evidence of ASF in Malaysia yet.&lt;br /&gt;&lt;br /&gt;He said in September that Malaysia was ASF-free.&lt;br /&gt;&lt;br /&gt;Malaysians returning to the country after visiting China and other countries are also advised not to bring home any pork products.&lt;br /&gt;&lt;br /&gt;“We are afraid the virus may infect the pigs here one way or another. Don’t bring pork products back to Malaysia,” he said.&lt;br /&gt;&lt;br /&gt;Deputy Health Minister Dr Lee Boon Chye also gave the same warning, saying that air travellers should not bring in such products.&lt;br /&gt;&lt;br /&gt;“We have to be extra vigilant. We will be monitoring. Airlines should also make sure that they have to sterilise their aircraft properly after each transit, which is the standard procedure anyway.&lt;br /&gt;&lt;br /&gt;“The virus has spread in several parts of China and the risk is that it will somehow reach our soil so it is important that we guard against it,” Dr Lee said, adding that he had called for stricter measures by enforcement agencies at international airports and entry points to prevent pork products from the affected countries from being brought in.&lt;br /&gt;&lt;br /&gt;He also said that the ASF virus could survive for up to three years.&lt;br /&gt;&lt;br /&gt;&lt;a href='https://www.thestar.com.my/news/nation/2018/12/28/msia-widens-ban-on-pork-products-six-countries-on-noimport-list-to-prevent-asf-from-contaminating-lo/' target='_blank'&gt;https://www.thestar.com.my/news/nation/2018...ntaminating-lo/&lt;/a&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Fri, 28 Dec 2018 09:20:03 +0800</pubDate>
        </item>
        <item>
            <title>Mahathir to launch human rights celebration</title>
            <link>http://forum.lowyat.net/topic/4703990</link>
            <description>&lt;a href='https://www.freemalaysiatoday.com/category/nation/2018/12/06/mahathir-to-launch-human-rights-rally-same-day-as-icerd-gathering/' target='_blank'&gt;https://www.freemalaysiatoday.com/category/...cerd-gathering/&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;&lt;!--QuoteBegin--&gt;&lt;div class='quotetop'&gt;QUOTE&lt;/div&gt;&lt;div class='quotemain'&gt;&lt;!--QuoteEBegin--&gt; &lt;br /&gt;&lt;br /&gt;Prime Minister Dr Mahathir Mohamad is expected to launch the celebration organised by Suhakam in conjunction with International Human Rights Day.&lt;br /&gt;PETALING JAYA: Suhakam is holding a pro-human rights celebration on the same day as the ICERD gathering in Kuala Lumpur on Saturday.&lt;br /&gt;&lt;br /&gt;Prime Minister Dr Mahathir Mohamad will be launching the human rights celebration, which will be held in Padang Timur, here. Also scheduled to speak is chief secretary to the government Ismail Bakar.&lt;br /&gt;&lt;br /&gt;The Human Rights Commission event has the theme “Stand Up 4 Human Rights”, in conjunction with International Human Rights Day on Monday.&lt;br /&gt;&lt;br /&gt;The celebration will be held from 9am to 3pm.&lt;br /&gt;&lt;br /&gt;The International Convention on the Elimination of All Forms of Racial Discrimination gathering, meanwhile, is supposed to be from 2pm to 6pm, according to Dewan Bandaraya Kuala Lumpur (DBKL).&lt;br /&gt;&lt;br /&gt;Umno, PAS and Perkasa have given their support for the ICERD rally. News reports said 500,000 people are expected to gather to celebrate the government’s decision not to ratify the United Nations convention.&lt;!--QuoteEnd--&gt;&lt;/div&gt;&lt;!--QuoteEEnd--&gt;&lt;br /&gt;Old man got many tricks up his sleeve &lt;!--emo&amp;:P--&gt;&lt;img src='http://static.lowyat.net/style_emoticons/default/tongue.gif' border='0' style='vertical-align:middle' alt='tongue.gif' /&gt;&lt;!--endemo--&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Thu, 06 Dec 2018 13:31:50 +0800</pubDate>
        </item>
        <item>
            <title>[VPNfilter] UPDATE&amp;#33; Malware infecting 500,000</title>
            <link>http://forum.lowyat.net/topic/4590850</link>
            <description>TLDR: &lt;br /&gt;1) All your info could have been stolen&lt;br /&gt;2) Malware tied to Russia can attack connected computers and downgrade HTTPS&lt;br /&gt;&lt;br /&gt;VPNFilter also targets a much larger number of devices than previously thought, including those made by &lt;b&gt;ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE.&lt;/b&gt; The malware also works on new models from manufacturers previously known to be targeted, including&lt;b&gt; Linksys, MikroTik, Netgear, and TP-Link.&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;The most notable new capabilities found in VPNFilter, come in a newly discovered module that performs an active man-in-the-middle attack on incoming Web traffic. Attackers can use this &lt;b&gt;ssler module&lt;/b&gt; to inject malicious payloads into traffic as it passes through an infected router. The payloads can be tailored to exploit specific devices connected to the infected network. Pronounced “essler,” the module can also be used to surreptitiously modify content delivered by websites. VPNFilter poses a more potent threat and targets more devices than was reported two weeks ago. But it appears [attackers] have completely evolved past that, and now not only does it allow them to do that, but they can manipulate everything going through the compromised device. They can modify your bank account balance so that it looks normal while at the same time they’re siphoning off money and potentially PGP keys and things like that. They can manipulate everything going in and out of the device.&lt;br /&gt;&lt;br /&gt;The full list of targeted devices is:&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Asus Devices:&lt;/b&gt;&lt;br /&gt;RT-AC66U (new)&lt;br /&gt;RT-N10 (new)&lt;br /&gt;RT-N10E (new)&lt;br /&gt;RT-N10U (new)&lt;br /&gt;RT-N56U (new)&lt;br /&gt;RT-N66U (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;D-Link Devices:&lt;/b&gt;&lt;br /&gt;DES-1210-08P (new)&lt;br /&gt;DIR-300 (new)&lt;br /&gt;DIR-300A (new)&lt;br /&gt;DSR-250N (new)&lt;br /&gt;DSR-500N (new)&lt;br /&gt;DSR-1000 (new)&lt;br /&gt;DSR-1000N (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Huawei Devices:&lt;/b&gt;&lt;br /&gt;HG8245 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Linksys Devices:&lt;/b&gt;&lt;br /&gt;E1200&lt;br /&gt;E2500&lt;br /&gt;E3000 (new)&lt;br /&gt;E3200 (new)&lt;br /&gt;E4200 (new)&lt;br /&gt;RV082 (new)&lt;br /&gt;WRVS4400N&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Mikrotik Devices:&lt;/b&gt;&lt;br /&gt;CCR1009 (new)&lt;br /&gt;CCR1016&lt;br /&gt;CCR1036&lt;br /&gt;CCR1072&lt;br /&gt;CRS109 (new)&lt;br /&gt;CRS112 (new)&lt;br /&gt;CRS125 (new)&lt;br /&gt;RB411 (new)&lt;br /&gt;RB450 (new)&lt;br /&gt;RB750 (new)&lt;br /&gt;RB911 (new)&lt;br /&gt;RB921 (new)&lt;br /&gt;RB941 (new)&lt;br /&gt;RB951 (new)&lt;br /&gt;RB952 (new)&lt;br /&gt;RB960 (new)&lt;br /&gt;RB962 (new)&lt;br /&gt;RB1100 (new)&lt;br /&gt;RB1200 (new)&lt;br /&gt;RB2011 (new)&lt;br /&gt;RB3011 (new)&lt;br /&gt;RB Groove (new)&lt;br /&gt;RB Omnitik (new)&lt;br /&gt;STX5 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Netgear Devices:&lt;/b&gt;&lt;br /&gt;DG834 (new)&lt;br /&gt;DGN1000 (new)&lt;br /&gt;DGN2200&lt;br /&gt;DGN3500 (new)&lt;br /&gt;FVS318N (new)&lt;br /&gt;MBRN3000 (new)&lt;br /&gt;R6400&lt;br /&gt;R7000&lt;br /&gt;R8000&lt;br /&gt;WNR1000&lt;br /&gt;WNR2000&lt;br /&gt;WNR2200 (new)&lt;br /&gt;WNR4000 (new)&lt;br /&gt;WNDR3700 (new)&lt;br /&gt;WNDR4000 (new)&lt;br /&gt;WNDR4300 (new)&lt;br /&gt;WNDR4300-TN (new)&lt;br /&gt;UTM50 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;QNAP Devices:&lt;/b&gt;&lt;br /&gt;TS251&lt;br /&gt;TS439 Pro&lt;br /&gt;Other QNAP NAS devices running QTS software&lt;br /&gt;&lt;br /&gt;&lt;b&gt;TP-Link Devices:&lt;/b&gt;&lt;br /&gt;R600VPN&lt;br /&gt;TL-WR741ND (new)&lt;br /&gt;TL-WR841N (new)&lt;br /&gt;Ubiquiti Devices:&lt;br /&gt;NSM2 (new)&lt;br /&gt;PBE M5 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Upvel Devices:&lt;/b&gt;&lt;br /&gt;Unknown Models* (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;ZTE Devices:&lt;/b&gt;&lt;br /&gt;ZXHN H108N (new)&lt;br /&gt;&lt;br /&gt;&lt;a href='https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/' target='_blank'&gt;https://arstechnica.com/information-technol...han-we-thought/&lt;/a&gt;&lt;br /&gt;&lt;!--SPOILER BEGIN--&gt;&lt;div class=&quot;spoilertop&quot; onClick=&quot;openClose('3ef5dfb3662ab4165ef94f2064b4cf06')&quot; style=&quot;font-weight: bold&quot;&gt;&lt;u&gt;&amp;raquo; Click to show Spoiler - click again to hide... &amp;laquo;&lt;/u&gt;&lt;/div&gt;&lt;div class=&quot;spoilermain&quot; id=&quot;3ef5dfb3662ab4165ef94f2064b4cf06&quot; style=&quot;display:none&quot;&gt;&lt;!--SPOILER END--&gt;&lt;b&gt;VPNFilter malware infecting 500,000 devices is worse than we thought&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.&lt;br /&gt;&lt;br /&gt;The most notable new capabilities found in VPNFilter, as the malware is known, come in a newly discovered module that performs an active man-in-the-middle attack on incoming Web traffic. Attackers can use this ssler module to inject malicious payloads into traffic as it passes through an infected router. The payloads can be tailored to exploit specific devices connected to the infected network. Pronounced “essler,” the module can also be used to surreptitiously modify content delivered by websites.&lt;br /&gt;&lt;br /&gt;Besides covertly manipulating traffic delivered to endpoints inside an infected network, ssler is also designed to steal sensitive data passed between connected end-points and the outside Internet. It actively inspects Web URLs for signs they transmit passwords and other sensitive data so they can be copied and sent to servers that attackers continue to control even now, two weeks after the botnet was publicly disclosed.&lt;br /&gt;&lt;br /&gt;To bypass TLS encryption that’s designed to prevent such attacks, ssler actively tries to downgrade HTTPS connections to plaintext HTTP traffic. It then changes request headers to signal that the end point isn’t capable of using encrypted connections. Ssler makes special accommodations for traffic to Google, Facebook, Twitter, and Youtube, presumably because these sites provide additional security features. Google, for example, has for years automatically redirected HTTP traffic to HTTPS servers. The newly discovered module also strips away data compression provided by the gzip application because plaintext traffic is easier to modify.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;All your network traffic belongs to us&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;The new analysis, which Cisco is expected to detail in a report to be published Wednesday morning, shows that VPNFilter poses a more potent threat and targets more devices than was reported two weeks ago. Previously, Cisco believed the primary goal of VPNFilter was to use home and small-office routers, switches, and network-attached storage devices as a platform for launching obfuscated attacks on primary targets. The discovery of ssler suggests router owners themselves are a key target of VPNFilter.&lt;br /&gt;&lt;br /&gt;“Initially when we saw this we thought it was primarily made for offensive capabilities like routing attacks around the Internet,” Craig Williams, a senior technology leader and global outreach manager at Talos, told Ars. “But it appears [attackers] have completely evolved past that, and now not only does it allow them to do that, but they can manipulate everything going through the compromised device. They can modify your bank account balance so that it looks normal while at the same time they’re siphoning off money and potentially PGP keys and things like that. They can manipulate everything going in and out of the device.”&lt;br /&gt;&lt;br /&gt;While HTTP Strict Transport Security and similar measures designed to prevent unencrypted Web connections may help prevent the HTTP downgrade from succeeding, Williams said those offerings aren’t widely available in Ukraine, where a large number of the VPN-infected devices are located. What’s more, many sites in the US and Western Europe continue to provide HTTP as a fallback for older devices that don’t fully support HTTPS.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;(Much) bigger attack surface&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;Talos said VPNFilter also targets a much larger number of devices than previously thought, including those made by ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE. The malware also works on new models from manufacturers previously known to be targeted, including Linksys, MikroTik, Netgear, and TP-Link. Williams estimated that the additional models put 200,000 additional routers worldwide at risk of being infected.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Incredibly targeted&lt;/b&gt;&lt;br /&gt;Wednesday&amp;#39;s Talos report also provides new insights into a previously found packet sniffer module. It monitors traffic for data specific to industrial control systems that connect over a TP-Link R600 virtual private network. The sniffer module also looks for connections to a pre-specified IP address. It also looks for data packets that are 150 bytes or larger.&lt;br /&gt;&lt;br /&gt;“They’re looking for very specific things,” Williams said. &amp;quot;They’re not trying to gather as much traffic as they can. They’re after certain very small things like credentials and passwords. We don’t have a lot of intel on that other than it seems incredibly targeted and incredibly sophisticated. We’re still trying to figure out who they were using that on.”&lt;br /&gt;&lt;br /&gt;Wednesday’s report also details a self-destroy module that can be delivered to any infected device that currently lacks that capability. When executed it first removes all traces of VPNFilter from the device and then runs the command “rm -rf /*,” which deletes the remainder of the file system. The module then reboots the device.&lt;br /&gt;&lt;br /&gt;Despite the discovery of VPNFilter and the FBI seizure two weeks ago of a key command and control server, the botnet still remains active, Williams said. The reason involves the deliberately piecemeal design of the malware. Stage 1 acts as a backdoor and is one of the few known pieces of router malware that can survive a reboot. Meanwhile, stages 2 and 3, which provide advanced functions for things such as man-in-the-middle attacks and self-destruction capabilities, have to be reinstalled each time an infected device is restarted.&lt;br /&gt;&lt;br /&gt;To accommodate for this limitation, stage 1 relies on a sophisticated mechanism to locate servers where stage 2 and stage 3 payloads were available. The primary method involved downloading images stored on Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field of the image. When Photobucket removed those images, VPNFilter used a backup method that relied on a server located at ToKnowAll.com.&lt;br /&gt;&lt;br /&gt;Even with the FBI’s seizure of ToKnowAll.com, devices infected by stage 1 can still be put into a listening mode that allows attackers to use specific trigger packets that manually install later VPNFilter stages. That means hundreds of thousands of devices likely remain infected with stage 1, and possibly stages 2 and 3.&lt;br /&gt;&lt;br /&gt;There is no easy way to know if a router is infected. One method involves searching through logs for indicators of compromise listed at the end of Cisco&amp;#39;s report. Another involves reverse engineering the firmware, or at least extracting it from a device, and comparing it with the authorized firmware. Both of those things are out of the abilities of most router owners. That&amp;#39;s why it makes sense for people to simply assume a router may be infected and disinfect it. Researchers still don&amp;#39;t know how routers initially become infected with stage 1, but they presume it&amp;#39;s by exploiting known flaws for which patches are probably available.&lt;br /&gt;&lt;br /&gt;Steps to fully disinfect devices vary from model to model. In some cases, pressing a recessed button on the back to perform a factory reset will wipe stage 1 clean. In other cases, owners must reboot the device and then immediately install the latest available authorized firmware from the manufacturer. Router owners who are unsure how to respond should contact their manufacturer, or, if the device is more than a few years old, buy a new one.&lt;br /&gt;&lt;br /&gt;Router owners should always change default passwords and, whenever feasible, disable remote administration. For extra security, people can always run routers behind a proper security firewall. Williams said he has seen no evidence VPNFilter has infected devices running Tomato, Merlin WRT, and DD-WRT firmware, but that he can&amp;#39;t rule out that possibility.&lt;br /&gt;&lt;br /&gt;Two weeks ago, however, the FBI recommended that all owners of consumer-grade routers, switches, and network-attached storage devices reboot their devices. While the advice likely disrupted VPNFilter’s advance and bought infected users time, it may also have created the mistaken belief that rebooting alone was enough to fully remove VPNFilter from infected devices.&lt;br /&gt;&lt;br /&gt;“I’m concerned that the FBI gave people a false sense of security,” Williams said. “VPNFilter is still operational. It infects even more devices than we initially thought, and its capabilities are far in excess of what we initially thought. People need to get it off their network.”&lt;!--SPOILER DIV--&gt;&lt;/div&gt;&lt;!--SPOILER DIV--&gt;&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;Old post:&lt;br /&gt;Hackers have infected more than 500,000 home and small-office routers around the world with malware that can be used to collect communications, launch attacks on others, and permanently destroy the devices with a single command. VPNFilter—the malware—works on consumer-grade routers made by Linksys, MikroTik, Netgear, TP-Link, and on network-attached storage devices from QNAP. Both Cisco and Symantec are advising users of any of these devices to&lt;b&gt; do a factory reset.&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;&lt;a href='https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/' target='_blank'&gt;https://arstechnica.com/information-technol...d-with-malware/&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;&lt;!--SPOILER BEGIN--&gt;&lt;div class=&quot;spoilertop&quot; onClick=&quot;openClose('72156062dd9f360023d7475677d368aa')&quot; style=&quot;font-weight: bold&quot;&gt;&lt;u&gt;&amp;raquo; Click to show Spoiler - click again to hide... &amp;laquo;&lt;/u&gt;&lt;/div&gt;&lt;div class=&quot;spoilermain&quot; id=&quot;72156062dd9f360023d7475677d368aa&quot; style=&quot;display:none&quot;&gt;&lt;!--SPOILER END--&gt;Hackers possibly working for an advanced nation have infected more than 500,000 home and small-office routers around the world with malware that can be used to collect communications, launch attacks on others, and permanently destroy the devices with a single command, researchers at Cisco warned Wednesday.&lt;br /&gt;&lt;br /&gt;VPNFilter—as the modular, multi-stage malware has been dubbed—works on consumer-grade routers made by Linksys, MikroTik, Netgear, TP-Link, and on network-attached storage devices from QNAP, Cisco researchers said in an advisory. It’s one of the few pieces of Internet-of-things malware that can survive a reboot. Infections in at least 54 countries have been slowly building since at least 2016, and Cisco researchers have been monitoring them for several months. The attacks drastically ramped up during the past three weeks, including two major assaults on devices located in Ukraine. The spike, combined with the advanced capabilities of the malware, prompted Cisco to release Wednesday’s report before the research is completed.&lt;br /&gt;&lt;br /&gt;Expansive platform serving multiple needs&lt;br /&gt;“We assess with high confidence that this malware is used to create an expansive, hard-to-attribute infrastructure that can be used to serve multiple operational needs of the threat actor,” Cisco researcher William Largent wrote. “Since the affected devices are legitimately owned by businesses or individuals, malicious activity conducted from infected devices could be mistakenly attributed to those who were actually victims of the actor. The capabilities built into the various stages and plugins of the malware are extremely versatile and would enable the actor to take advantage of devices in multiple ways.”&lt;br /&gt;&lt;br /&gt;Sniffers included with VPNFilter collect login credentials and possibly supervisory control and data acquisition traffic. The malware also makes it possible for the attackers to obfuscate themselves by using the devices as nondescript points for connecting to final targets. The researchers also said they uncovered evidence that at least some of the malware includes a command to permanently disable the device, a capability that would allow the attackers to disable Internet access for hundreds of thousands of people worldwide or in a focused region, depending on a particular objective.&lt;br /&gt;&lt;br /&gt;“In most cases, this action is unrecoverable by most victims, requiring technical capabilities, know-how, or tools that no consumer should be expected to have,” Cisco’s report stated. “We are deeply concerned about this capability, and it is one of the driving reasons we have been quietly researching this threat over the past few months.”&lt;br /&gt;&lt;br /&gt;Cisco’s report comes five weeks after the US Department of Homeland Security, FBI, and the UK’s National Cyber Security Center jointly warned that hackers working on behalf of the Russian government are compromising large numbers of routers, switches, and other network devices belonging to governments, businesses, and critical-infrastructure providers. Cisco’s report doesn’t explicitly name Russia, but it does say that VPNFilter contains a broken function involving the RC4 encryption cipher that’s identical to one found in malware known as BlackEnergy. BlackEnergy has been used in a variety of attacks tied to the Russian government, including one in December 2016 that caused a power outage in Ukraine.&lt;br /&gt;&lt;br /&gt;BlackEnergy, however, is believed to have been repurposed by other attack groups, so on its own, the code overlap isn’t proof VPNFilter was developed by the Russian government. Wednesday’s report provided no further attribution to the attackers other than to say they used the IP address 46.151.209.33 and the domains toknowall[.]com and api.ipify[.]org.&lt;br /&gt;&lt;br /&gt;Advanced group&lt;br /&gt;There’s little doubt that whoever developed VPNFilter is an advanced group. Stage 1 infects devices running Busybox- and Linux-based firmware and is compiled for several CPU architectures. The primary purpose is to locate an attacker-controlled server on the Internet to receive a more fully featured second stage. Stage 1 locates the server by downloading an image from Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field. In the event the Photobucket download fails, stage 1 will try to download the image from toknowall[.]com.&lt;br /&gt;&lt;br /&gt;If that fails, stage 1 opens a “listener” that waits for a specific trigger packet from the attackers. The listener checks its public IP from api.ipify[.]org and stores it for later use. This is the stage that persists even after the infected device is restarted.&lt;br /&gt;&lt;br /&gt;Cisco researchers described stage 2 as a “workhorse intelligence-collection platform” that performs file collection, command execution, data exfiltration, and device management. Some versions of stage 2 also possess a self-destruct capability that works by overwriting a critical portion of the device firmware and then rebooting, a process that renders the device unusable. Cisco researchers believe that, even without the built-in kill command, the attackers can use stage 2 to manually destroy devices.&lt;br /&gt;&lt;br /&gt;Stage 3 contains at least two plugin modules. One is a packet sniffer for collecting traffic that passes through the device. Intercepted traffic includes website credentials and Modbus SCADA protocols. A second module allows stage 2 to communicate over the Tor privacy service. Wednesday’s report said Cisco researchers believe stage 3 contains other plugins that have yet to be discovered.&lt;br /&gt;&lt;br /&gt;&lt;img src='https://cdn.arstechnica.net/wp-content/uploads/2018/05/vpnfilter-640x468.jpg' border='0' alt='user posted image' /&gt;&lt;br /&gt;&lt;br /&gt;Hard to protect&lt;br /&gt;Wednesday’s report is concerning because routers and NAS devices typically receive no antivirus or firewall protection and are directly connected to the Internet. While the researchers still don’t know precisely how the devices are getting infected, almost all of those targeted have known public exploits or default credentials that make compromise straightforward. Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as:&lt;br /&gt;&lt;br /&gt;Linksys E1200&lt;br /&gt;Linksys E2500&lt;br /&gt;Linksys WRVS4400N&lt;br /&gt;Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072&lt;br /&gt;Netgear DGN2200&lt;br /&gt;Netgear R6400&lt;br /&gt;Netgear R7000&lt;br /&gt;Netgear R8000&lt;br /&gt;Netgear WNR1000&lt;br /&gt;Netgear WNR2000&lt;br /&gt;QNAP TS251&lt;br /&gt;QNAP TS439 Pro&lt;br /&gt;Other QNAP NAS devices running QTS software&lt;br /&gt;TP-Link R600VPN&lt;br /&gt;&lt;br /&gt;Both Cisco and Symantec are advising users of any of these devices to do a factory reset, a process that typically involves holding down a button in the back for five to 10 seconds. Unfortunately, these resets wipe all configuration settings stored in the device, so users will have to reenter the settings once the device restarts. At a minimum, Symantec said, users of these devices should reboot their devices. That will stop stages 2 and 3 from running, at least until stage 1 manages to reinstall them.&lt;br /&gt;&lt;br /&gt;Users should also change all default passwords, be sure their devices are running the latest firmware, and, whenever possible, disable remote administration. (Netgear officials in the past few hours started advising users of &amp;quot;some&amp;quot; router models to turn off remote management. TP-Link officials, meanwhile, said they are investigating the Cisco findings.&lt;br /&gt;&lt;br /&gt;There&amp;#39;s no easy way to determine if a router has been infected. It&amp;#39;s not yet clear if running the latest firmware and changing default passwords prevents infections in all cases. Cisco and Symantec said the attackers are exploiting known vulnerabilities, but given the general quality of IoT firmware, it may be possible the attackers are also exploiting zeroday flaws, which by definition device manufacturers have yet to fix.&lt;br /&gt;&lt;br /&gt;What this means is that out of an abundance of caution, users of the devices listed above should do a factory reset as soon as possible, or at a minimum, they should reboot. People should then check with the manufacturer for advice. For more advanced users, the Cisco report provides detailed indictors of compromise and firewall rules that can detect exploits.&lt;br /&gt;&lt;br /&gt;Cisco researchers urged both consumers and businesses to take the threat of VPNFilter seriously.&lt;br /&gt;&lt;br /&gt;“While the threat to IoT devices is nothing new, the fact that these devices are being used by advanced nation-state actors to conduct cyber operations, which could potentially result in the destruction of the device, has greatly increased the urgency of dealing with this issue,” they wrote. “We call on the entire security community to join us in aggressively countering this threat.”&lt;!--SPOILER DIV--&gt;&lt;/div&gt;&lt;!--SPOILER DIV--&gt;</description>
            <author>nuvi</author>
            <category>Networks and Broadband</category>
            <pubDate>Sat, 26 May 2018 09:22:44 +0800</pubDate>
        </item>
        <item>
            <title>(VPNfilter) UPDATE&amp;#33; Malware infecting 500,000</title>
            <link>http://forum.lowyat.net/topic/4590844</link>
            <description>TLDR: &lt;br /&gt;1) All your info could have been stolen&lt;br /&gt;2) Malware tied to Russia can attack connected computers and downgrade HTTPS&lt;br /&gt;&lt;br /&gt;VPNFilter also targets a much larger number of devices than previously thought, including those made by &lt;b&gt;ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE.&lt;/b&gt; The malware also works on new models from manufacturers previously known to be targeted, including&lt;b&gt; Linksys, MikroTik, Netgear, and TP-Link.&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;The most notable new capabilities found in VPNFilter, come in a newly discovered module that performs an active man-in-the-middle attack on incoming Web traffic. Attackers can use this &lt;b&gt;ssler module&lt;/b&gt; to inject malicious payloads into traffic as it passes through an infected router. The payloads can be tailored to exploit specific devices connected to the infected network. Pronounced “essler,” the module can also be used to surreptitiously modify content delivered by websites. VPNFilter poses a more potent threat and targets more devices than was reported two weeks ago. But it appears [attackers] have completely evolved past that, and now not only does it allow them to do that, but they can manipulate everything going through the compromised device. They can modify your bank account balance so that it looks normal while at the same time they’re siphoning off money and potentially PGP keys and things like that. They can manipulate everything going in and out of the device.&lt;br /&gt;&lt;br /&gt;The full list of targeted devices is:&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Asus Devices:&lt;/b&gt;&lt;br /&gt;RT-AC66U (new)&lt;br /&gt;RT-N10 (new)&lt;br /&gt;RT-N10E (new)&lt;br /&gt;RT-N10U (new)&lt;br /&gt;RT-N56U (new)&lt;br /&gt;RT-N66U (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;D-Link Devices:&lt;/b&gt;&lt;br /&gt;DES-1210-08P (new)&lt;br /&gt;DIR-300 (new)&lt;br /&gt;DIR-300A (new)&lt;br /&gt;DSR-250N (new)&lt;br /&gt;DSR-500N (new)&lt;br /&gt;DSR-1000 (new)&lt;br /&gt;DSR-1000N (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Huawei Devices:&lt;/b&gt;&lt;br /&gt;HG8245 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Linksys Devices:&lt;/b&gt;&lt;br /&gt;E1200&lt;br /&gt;E2500&lt;br /&gt;E3000 (new)&lt;br /&gt;E3200 (new)&lt;br /&gt;E4200 (new)&lt;br /&gt;RV082 (new)&lt;br /&gt;WRVS4400N&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Mikrotik Devices:&lt;/b&gt;&lt;br /&gt;CCR1009 (new)&lt;br /&gt;CCR1016&lt;br /&gt;CCR1036&lt;br /&gt;CCR1072&lt;br /&gt;CRS109 (new)&lt;br /&gt;CRS112 (new)&lt;br /&gt;CRS125 (new)&lt;br /&gt;RB411 (new)&lt;br /&gt;RB450 (new)&lt;br /&gt;RB750 (new)&lt;br /&gt;RB911 (new)&lt;br /&gt;RB921 (new)&lt;br /&gt;RB941 (new)&lt;br /&gt;RB951 (new)&lt;br /&gt;RB952 (new)&lt;br /&gt;RB960 (new)&lt;br /&gt;RB962 (new)&lt;br /&gt;RB1100 (new)&lt;br /&gt;RB1200 (new)&lt;br /&gt;RB2011 (new)&lt;br /&gt;RB3011 (new)&lt;br /&gt;RB Groove (new)&lt;br /&gt;RB Omnitik (new)&lt;br /&gt;STX5 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Netgear Devices:&lt;/b&gt;&lt;br /&gt;DG834 (new)&lt;br /&gt;DGN1000 (new)&lt;br /&gt;DGN2200&lt;br /&gt;DGN3500 (new)&lt;br /&gt;FVS318N (new)&lt;br /&gt;MBRN3000 (new)&lt;br /&gt;R6400&lt;br /&gt;R7000&lt;br /&gt;R8000&lt;br /&gt;WNR1000&lt;br /&gt;WNR2000&lt;br /&gt;WNR2200 (new)&lt;br /&gt;WNR4000 (new)&lt;br /&gt;WNDR3700 (new)&lt;br /&gt;WNDR4000 (new)&lt;br /&gt;WNDR4300 (new)&lt;br /&gt;WNDR4300-TN (new)&lt;br /&gt;UTM50 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;QNAP Devices:&lt;/b&gt;&lt;br /&gt;TS251&lt;br /&gt;TS439 Pro&lt;br /&gt;Other QNAP NAS devices running QTS software&lt;br /&gt;&lt;br /&gt;&lt;b&gt;TP-Link Devices:&lt;/b&gt;&lt;br /&gt;R600VPN&lt;br /&gt;TL-WR741ND (new)&lt;br /&gt;TL-WR841N (new)&lt;br /&gt;Ubiquiti Devices:&lt;br /&gt;NSM2 (new)&lt;br /&gt;PBE M5 (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Upvel Devices:&lt;/b&gt;&lt;br /&gt;Unknown Models* (new)&lt;br /&gt;&lt;br /&gt;&lt;b&gt;ZTE Devices:&lt;/b&gt;&lt;br /&gt;ZXHN H108N (new)&lt;br /&gt;&lt;br /&gt;&lt;a href='https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/' target='_blank'&gt;https://arstechnica.com/information-technol...han-we-thought/&lt;/a&gt;&lt;br /&gt;&lt;!--SPOILER BEGIN--&gt;&lt;div class=&quot;spoilertop&quot; onClick=&quot;openClose('f50bbf4b297c685f57e817aa91208403')&quot; style=&quot;font-weight: bold&quot;&gt;&lt;u&gt;&amp;raquo; Click to show Spoiler - click again to hide... &amp;laquo;&lt;/u&gt;&lt;/div&gt;&lt;div class=&quot;spoilermain&quot; id=&quot;f50bbf4b297c685f57e817aa91208403&quot; style=&quot;display:none&quot;&gt;&lt;!--SPOILER END--&gt;&lt;b&gt;VPNFilter malware infecting 500,000 devices is worse than we thought&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.&lt;br /&gt;&lt;br /&gt;The most notable new capabilities found in VPNFilter, as the malware is known, come in a newly discovered module that performs an active man-in-the-middle attack on incoming Web traffic. Attackers can use this ssler module to inject malicious payloads into traffic as it passes through an infected router. The payloads can be tailored to exploit specific devices connected to the infected network. Pronounced “essler,” the module can also be used to surreptitiously modify content delivered by websites.&lt;br /&gt;&lt;br /&gt;Besides covertly manipulating traffic delivered to endpoints inside an infected network, ssler is also designed to steal sensitive data passed between connected end-points and the outside Internet. It actively inspects Web URLs for signs they transmit passwords and other sensitive data so they can be copied and sent to servers that attackers continue to control even now, two weeks after the botnet was publicly disclosed.&lt;br /&gt;&lt;br /&gt;To bypass TLS encryption that’s designed to prevent such attacks, ssler actively tries to downgrade HTTPS connections to plaintext HTTP traffic. It then changes request headers to signal that the end point isn’t capable of using encrypted connections. Ssler makes special accommodations for traffic to Google, Facebook, Twitter, and Youtube, presumably because these sites provide additional security features. Google, for example, has for years automatically redirected HTTP traffic to HTTPS servers. The newly discovered module also strips away data compression provided by the gzip application because plaintext traffic is easier to modify.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;All your network traffic belongs to us&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;The new analysis, which Cisco is expected to detail in a report to be published Wednesday morning, shows that VPNFilter poses a more potent threat and targets more devices than was reported two weeks ago. Previously, Cisco believed the primary goal of VPNFilter was to use home and small-office routers, switches, and network-attached storage devices as a platform for launching obfuscated attacks on primary targets. The discovery of ssler suggests router owners themselves are a key target of VPNFilter.&lt;br /&gt;&lt;br /&gt;“Initially when we saw this we thought it was primarily made for offensive capabilities like routing attacks around the Internet,” Craig Williams, a senior technology leader and global outreach manager at Talos, told Ars. “But it appears [attackers] have completely evolved past that, and now not only does it allow them to do that, but they can manipulate everything going through the compromised device. They can modify your bank account balance so that it looks normal while at the same time they’re siphoning off money and potentially PGP keys and things like that. They can manipulate everything going in and out of the device.”&lt;br /&gt;&lt;br /&gt;While HTTP Strict Transport Security and similar measures designed to prevent unencrypted Web connections may help prevent the HTTP downgrade from succeeding, Williams said those offerings aren’t widely available in Ukraine, where a large number of the VPN-infected devices are located. What’s more, many sites in the US and Western Europe continue to provide HTTP as a fallback for older devices that don’t fully support HTTPS.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;(Much) bigger attack surface&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;Talos said VPNFilter also targets a much larger number of devices than previously thought, including those made by ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE. The malware also works on new models from manufacturers previously known to be targeted, including Linksys, MikroTik, Netgear, and TP-Link. Williams estimated that the additional models put 200,000 additional routers worldwide at risk of being infected.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Incredibly targeted&lt;/b&gt;&lt;br /&gt;Wednesday&amp;#39;s Talos report also provides new insights into a previously found packet sniffer module. It monitors traffic for data specific to industrial control systems that connect over a TP-Link R600 virtual private network. The sniffer module also looks for connections to a pre-specified IP address. It also looks for data packets that are 150 bytes or larger.&lt;br /&gt;&lt;br /&gt;“They’re looking for very specific things,” Williams said. &amp;quot;They’re not trying to gather as much traffic as they can. They’re after certain very small things like credentials and passwords. We don’t have a lot of intel on that other than it seems incredibly targeted and incredibly sophisticated. We’re still trying to figure out who they were using that on.”&lt;br /&gt;&lt;br /&gt;Wednesday’s report also details a self-destroy module that can be delivered to any infected device that currently lacks that capability. When executed it first removes all traces of VPNFilter from the device and then runs the command “rm -rf /*,” which deletes the remainder of the file system. The module then reboots the device.&lt;br /&gt;&lt;br /&gt;Despite the discovery of VPNFilter and the FBI seizure two weeks ago of a key command and control server, the botnet still remains active, Williams said. The reason involves the deliberately piecemeal design of the malware. Stage 1 acts as a backdoor and is one of the few known pieces of router malware that can survive a reboot. Meanwhile, stages 2 and 3, which provide advanced functions for things such as man-in-the-middle attacks and self-destruction capabilities, have to be reinstalled each time an infected device is restarted.&lt;br /&gt;&lt;br /&gt;To accommodate for this limitation, stage 1 relies on a sophisticated mechanism to locate servers where stage 2 and stage 3 payloads were available. The primary method involved downloading images stored on Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field of the image. When Photobucket removed those images, VPNFilter used a backup method that relied on a server located at ToKnowAll.com.&lt;br /&gt;&lt;br /&gt;Even with the FBI’s seizure of ToKnowAll.com, devices infected by stage 1 can still be put into a listening mode that allows attackers to use specific trigger packets that manually install later VPNFilter stages. That means hundreds of thousands of devices likely remain infected with stage 1, and possibly stages 2 and 3.&lt;br /&gt;&lt;br /&gt;There is no easy way to know if a router is infected. One method involves searching through logs for indicators of compromise listed at the end of Cisco&amp;#39;s report. Another involves reverse engineering the firmware, or at least extracting it from a device, and comparing it with the authorized firmware. Both of those things are out of the abilities of most router owners. That&amp;#39;s why it makes sense for people to simply assume a router may be infected and disinfect it. Researchers still don&amp;#39;t know how routers initially become infected with stage 1, but they presume it&amp;#39;s by exploiting known flaws for which patches are probably available.&lt;br /&gt;&lt;br /&gt;Steps to fully disinfect devices vary from model to model. In some cases, pressing a recessed button on the back to perform a factory reset will wipe stage 1 clean. In other cases, owners must reboot the device and then immediately install the latest available authorized firmware from the manufacturer. Router owners who are unsure how to respond should contact their manufacturer, or, if the device is more than a few years old, buy a new one.&lt;br /&gt;&lt;br /&gt;Router owners should always change default passwords and, whenever feasible, disable remote administration. For extra security, people can always run routers behind a proper security firewall. Williams said he has seen no evidence VPNFilter has infected devices running Tomato, Merlin WRT, and DD-WRT firmware, but that he can&amp;#39;t rule out that possibility.&lt;br /&gt;&lt;br /&gt;Two weeks ago, however, the FBI recommended that all owners of consumer-grade routers, switches, and network-attached storage devices reboot their devices. While the advice likely disrupted VPNFilter’s advance and bought infected users time, it may also have created the mistaken belief that rebooting alone was enough to fully remove VPNFilter from infected devices.&lt;br /&gt;&lt;br /&gt;“I’m concerned that the FBI gave people a false sense of security,” Williams said. “VPNFilter is still operational. It infects even more devices than we initially thought, and its capabilities are far in excess of what we initially thought. People need to get it off their network.”&lt;!--SPOILER DIV--&gt;&lt;/div&gt;&lt;!--SPOILER DIV--&gt;&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;Old post:&lt;br /&gt;Hackers have infected more than 500,000 home and small-office routers around the world with malware that can be used to collect communications, launch attacks on others, and permanently destroy the devices with a single command. VPNFilter—the malware—works on consumer-grade routers made by Linksys, MikroTik, Netgear, TP-Link, and on network-attached storage devices from QNAP. Both Cisco and Symantec are advising users of any of these devices to&lt;b&gt; do a factory reset.&lt;/b&gt;&lt;br /&gt;&lt;br /&gt;&lt;a href='https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/' target='_blank'&gt;https://arstechnica.com/information-technol...d-with-malware/&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;&lt;!--SPOILER BEGIN--&gt;&lt;div class=&quot;spoilertop&quot; onClick=&quot;openClose('3ce9ba06ca227f9571aa434b2821f64c')&quot; style=&quot;font-weight: bold&quot;&gt;&lt;u&gt;&amp;raquo; Click to show Spoiler - click again to hide... &amp;laquo;&lt;/u&gt;&lt;/div&gt;&lt;div class=&quot;spoilermain&quot; id=&quot;3ce9ba06ca227f9571aa434b2821f64c&quot; style=&quot;display:none&quot;&gt;&lt;!--SPOILER END--&gt;Hackers possibly working for an advanced nation have infected more than 500,000 home and small-office routers around the world with malware that can be used to collect communications, launch attacks on others, and permanently destroy the devices with a single command, researchers at Cisco warned Wednesday.&lt;br /&gt;&lt;br /&gt;VPNFilter—as the modular, multi-stage malware has been dubbed—works on consumer-grade routers made by Linksys, MikroTik, Netgear, TP-Link, and on network-attached storage devices from QNAP, Cisco researchers said in an advisory. It’s one of the few pieces of Internet-of-things malware that can survive a reboot. Infections in at least 54 countries have been slowly building since at least 2016, and Cisco researchers have been monitoring them for several months. The attacks drastically ramped up during the past three weeks, including two major assaults on devices located in Ukraine. The spike, combined with the advanced capabilities of the malware, prompted Cisco to release Wednesday’s report before the research is completed.&lt;br /&gt;&lt;br /&gt;Expansive platform serving multiple needs&lt;br /&gt;“We assess with high confidence that this malware is used to create an expansive, hard-to-attribute infrastructure that can be used to serve multiple operational needs of the threat actor,” Cisco researcher William Largent wrote. “Since the affected devices are legitimately owned by businesses or individuals, malicious activity conducted from infected devices could be mistakenly attributed to those who were actually victims of the actor. The capabilities built into the various stages and plugins of the malware are extremely versatile and would enable the actor to take advantage of devices in multiple ways.”&lt;br /&gt;&lt;br /&gt;Sniffers included with VPNFilter collect login credentials and possibly supervisory control and data acquisition traffic. The malware also makes it possible for the attackers to obfuscate themselves by using the devices as nondescript points for connecting to final targets. The researchers also said they uncovered evidence that at least some of the malware includes a command to permanently disable the device, a capability that would allow the attackers to disable Internet access for hundreds of thousands of people worldwide or in a focused region, depending on a particular objective.&lt;br /&gt;&lt;br /&gt;“In most cases, this action is unrecoverable by most victims, requiring technical capabilities, know-how, or tools that no consumer should be expected to have,” Cisco’s report stated. “We are deeply concerned about this capability, and it is one of the driving reasons we have been quietly researching this threat over the past few months.”&lt;br /&gt;&lt;br /&gt;Cisco’s report comes five weeks after the US Department of Homeland Security, FBI, and the UK’s National Cyber Security Center jointly warned that hackers working on behalf of the Russian government are compromising large numbers of routers, switches, and other network devices belonging to governments, businesses, and critical-infrastructure providers. Cisco’s report doesn’t explicitly name Russia, but it does say that VPNFilter contains a broken function involving the RC4 encryption cipher that’s identical to one found in malware known as BlackEnergy. BlackEnergy has been used in a variety of attacks tied to the Russian government, including one in December 2016 that caused a power outage in Ukraine.&lt;br /&gt;&lt;br /&gt;BlackEnergy, however, is believed to have been repurposed by other attack groups, so on its own, the code overlap isn’t proof VPNFilter was developed by the Russian government. Wednesday’s report provided no further attribution to the attackers other than to say they used the IP address 46.151.209.33 and the domains toknowall[.]com and api.ipify[.]org.&lt;br /&gt;&lt;br /&gt;Advanced group&lt;br /&gt;There’s little doubt that whoever developed VPNFilter is an advanced group. Stage 1 infects devices running Busybox- and Linux-based firmware and is compiled for several CPU architectures. The primary purpose is to locate an attacker-controlled server on the Internet to receive a more fully featured second stage. Stage 1 locates the server by downloading an image from Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field. In the event the Photobucket download fails, stage 1 will try to download the image from toknowall[.]com.&lt;br /&gt;&lt;br /&gt;If that fails, stage 1 opens a “listener” that waits for a specific trigger packet from the attackers. The listener checks its public IP from api.ipify[.]org and stores it for later use. This is the stage that persists even after the infected device is restarted.&lt;br /&gt;&lt;br /&gt;Cisco researchers described stage 2 as a “workhorse intelligence-collection platform” that performs file collection, command execution, data exfiltration, and device management. Some versions of stage 2 also possess a self-destruct capability that works by overwriting a critical portion of the device firmware and then rebooting, a process that renders the device unusable. Cisco researchers believe that, even without the built-in kill command, the attackers can use stage 2 to manually destroy devices.&lt;br /&gt;&lt;br /&gt;Stage 3 contains at least two plugin modules. One is a packet sniffer for collecting traffic that passes through the device. Intercepted traffic includes website credentials and Modbus SCADA protocols. A second module allows stage 2 to communicate over the Tor privacy service. Wednesday’s report said Cisco researchers believe stage 3 contains other plugins that have yet to be discovered.&lt;br /&gt;&lt;br /&gt;&lt;img src='https://cdn.arstechnica.net/wp-content/uploads/2018/05/vpnfilter-640x468.jpg' border='0' alt='user posted image' /&gt;&lt;br /&gt;&lt;br /&gt;Hard to protect&lt;br /&gt;Wednesday’s report is concerning because routers and NAS devices typically receive no antivirus or firewall protection and are directly connected to the Internet. While the researchers still don’t know precisely how the devices are getting infected, almost all of those targeted have known public exploits or default credentials that make compromise straightforward. Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as:&lt;br /&gt;&lt;br /&gt;Linksys E1200&lt;br /&gt;Linksys E2500&lt;br /&gt;Linksys WRVS4400N&lt;br /&gt;Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072&lt;br /&gt;Netgear DGN2200&lt;br /&gt;Netgear R6400&lt;br /&gt;Netgear R7000&lt;br /&gt;Netgear R8000&lt;br /&gt;Netgear WNR1000&lt;br /&gt;Netgear WNR2000&lt;br /&gt;QNAP TS251&lt;br /&gt;QNAP TS439 Pro&lt;br /&gt;Other QNAP NAS devices running QTS software&lt;br /&gt;TP-Link R600VPN&lt;br /&gt;&lt;br /&gt;Both Cisco and Symantec are advising users of any of these devices to do a factory reset, a process that typically involves holding down a button in the back for five to 10 seconds. Unfortunately, these resets wipe all configuration settings stored in the device, so users will have to reenter the settings once the device restarts. At a minimum, Symantec said, users of these devices should reboot their devices. That will stop stages 2 and 3 from running, at least until stage 1 manages to reinstall them.&lt;br /&gt;&lt;br /&gt;Users should also change all default passwords, be sure their devices are running the latest firmware, and, whenever possible, disable remote administration. (Netgear officials in the past few hours started advising users of &amp;quot;some&amp;quot; router models to turn off remote management. TP-Link officials, meanwhile, said they are investigating the Cisco findings.&lt;br /&gt;&lt;br /&gt;There&amp;#39;s no easy way to determine if a router has been infected. It&amp;#39;s not yet clear if running the latest firmware and changing default passwords prevents infections in all cases. Cisco and Symantec said the attackers are exploiting known vulnerabilities, but given the general quality of IoT firmware, it may be possible the attackers are also exploiting zeroday flaws, which by definition device manufacturers have yet to fix.&lt;br /&gt;&lt;br /&gt;What this means is that out of an abundance of caution, users of the devices listed above should do a factory reset as soon as possible, or at a minimum, they should reboot. People should then check with the manufacturer for advice. For more advanced users, the Cisco report provides detailed indictors of compromise and firewall rules that can detect exploits.&lt;br /&gt;&lt;br /&gt;Cisco researchers urged both consumers and businesses to take the threat of VPNFilter seriously.&lt;br /&gt;&lt;br /&gt;“While the threat to IoT devices is nothing new, the fact that these devices are being used by advanced nation-state actors to conduct cyber operations, which could potentially result in the destruction of the device, has greatly increased the urgency of dealing with this issue,” they wrote. “We call on the entire security community to join us in aggressively countering this threat.”&lt;!--SPOILER DIV--&gt;&lt;/div&gt;&lt;!--SPOILER DIV--&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Sat, 26 May 2018 08:54:32 +0800</pubDate>
        </item>
        <item>
            <title>Which ktard is this?</title>
            <link>http://forum.lowyat.net/topic/4581090</link>
            <description>&lt;a href='https://streamable.com/3dcls' target='_blank'&gt;https://streamable.com/3dcls&lt;/a&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Fri, 11 May 2018 12:22:28 +0800</pubDate>
        </item>
        <item>
            <title>Dr M: We can get 1MDB money back</title>
            <link>http://forum.lowyat.net/topic/4580998</link>
            <description>KUALA LUMPUR, May 11 — The Pakatan Harapan government will be able to recover most of 1Malaysia Development Berhad money back to Malaysia, Tun Dr Mahathir Mohamad said yesterday.&lt;br /&gt;&lt;br /&gt;The Prime Minister said that this would be one of the means to repay the country’s existing debts which he said could easily reach RM1 trillion.&lt;br /&gt;“Barisan Nasional said the total amount of debts is RM800 billion but this does not include the hidden figures. To say that we owe RM1 trillion is actually not an exaggeration.&lt;br /&gt;&lt;br /&gt;“We believe we will get most of the 1MDB money back from Switzerland to repay this debt. We have a number of people whose expertise can be lent in order for us to reach that goal,” he said at Sheraton Hotel Petaling Jaya.&lt;br /&gt;&lt;br /&gt;&lt;img src='https://media.malaymail.com/uploads/articles/2018/2018-05/RG73_Dr_PJ_presser_2018_05_11.jpg' border='0' alt='user posted image' /&gt;&lt;br /&gt;&lt;br /&gt;&lt;a href='https://www.malaymail.com/s/1629535/dr-m-we-can-get-1mdb-money-back' target='_blank'&gt;https://www.malaymail.com/s/1629535/dr-m-we...1mdb-money-back&lt;/a&gt;&lt;br /&gt;</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Fri, 11 May 2018 11:00:22 +0800</pubDate>
        </item>
        <item>
            <title>Cupid Corner have new icon</title>
            <link>http://forum.lowyat.net/topic/4431270</link>
            <description>I saw the second sub-forum to have own icon is Cupid Corner, the first of course our mighty /k.&lt;br /&gt;&lt;br /&gt;Who&amp;#39;s the mod that doing the job to update all these icons?&lt;br /&gt;Is he foreveralone alone like ktards??</description>
            <author>nuvi</author>
            <category>The Museum Of Kopitiam</category>
            <pubDate>Sun, 15 Oct 2017 03:02:06 +0800</pubDate>
        </item>
    </channel>
</rss>
