The Court of Arbitration for Sport (CAS) on Tuesday overturned a ban that had barred Russian and Belarusian skiers from qualifying for the 2026 Winter Olympics, opening the way for them to compete as neutral athletes.
A fourth Russia-connected tanker in under a week was attacked on Tuesday, a sharp uptick in strikes on Moscow-associated shipping as the war in Ukraine nears a fifth year.
Vladimir Putin warned that Russia may consider striking the ships of countries supporting Ukraine if a surge in attacks on Moscow’s tanker fleet doesn’t halt.
“What the Ukrainian armed forces are doing now is piracy,” Putin said.
The negotiations lasting almost five hours were “constructive and very informative,” though “a compromise hasn’t been reached yet” on the critical issue of territorial control, Kremlin foreign policy aide Yuri Ushakov told reporters in Moscow.
The European Union has reached a deal to phase out Russian natural gas by 2027, the latest move to ratchet up pressure on Moscow over its invasion of Ukraine.
President Vladimir Putin warned European powers on Tuesday that if they started a war with Russia then Moscow was ready to fight and that the defeat of European powers would be so absolute that there would be no one left to even negotiate a peace deal.
The European Commission plans to make a legal proposal this week to use frozen Russian assets to fund Ukraine while also leaving open the possibility of borrowing on financial markets or mixing the two options, four sources told Reuters on Tuesday.
'We're not further from peace': Kushner and Witkoff step into putin's war game
by Eva Hartog and Sascha Roslyakov
Who's to blame for russia's war on #Ukraine dragging on for years? According to putin, it's Europe.
putin used a blend of charm, calculated stalling and pointed threats to show U.S. envoys Steve Witkoff and Jared Kushner exactly where russia stands on peace with Ukraine
There's no sign of a breakthrough in Ukraine peace talks after a lengthy meeting between Vladimir Putin and a delegation sent by Donald Trump. And there are two major reasons why the Russian president won't budge.
During its entire existence, slightly over 400 thousand people were registered at Auschwitz as prisoners - including 131 thousand women. The two largest grou...
President #Zelenskyy met with Ireland’s UCD team, who trained 600+ Ukrainian medics in emergency bleeding care via the UCD #Ukraine Trauma Project. He awarded them the Golden Heart for saving lives and strengthening ties, calling their work vital in Ukraine’s fight. Grateful for their expertise and solidarity
He added that Moscow has received four more documents in addition to Trump’s original 28-point Ukraine peace plan. Both sides signaled readiness to keep working toward a long-term settlement. Trump also sent his regards and best wishes to Putin via his envoys.
No compromises have been reached so far on territorial issues, and a meeting between the Russian and U.S. presidents is not currently planned, said Putin aide Ushakov. “Some points were acceptable, others drew criticism, but the discussion was useful,” he added.
President #Zelenskyy honoured Irish soldiers Graham Dale, Robert Deegan, and Alexander Ryzhuk - posthumously awarded Ukraine’s Order of Courage III - thanking their families for their sacrifice in Ukraine’s fight for freedom, calling them true heroes.
Witkoff has returned to the U.S. Embassy in Moscow, while Putin’s envoy Dmitriev called the meeting “productive.” No official details have been released yet on the outcome. We are waiting for Ushakov to speak to the Russian media.
#Ukraine Needs a Just Peace with Security Guarantees – President #Zelenskyy in His Address to the Oireachtas of #Ireland
Extract “Today, Ukraine is closer to peace than ever before. And there is a real chance. But we must seize this chance fully – the whole world, not just one or another powerful country,” the Head of State stated.
The First Lady of #Ukraine, Olena Zelenska, and the wife of the Taoiseach of Ireland, Mary Martin, took part in the opening of a Ukrainian bookshelf at the #Library of Trinity College – the largest university library in #Ireland.
Турецкая компания Besiktas Shipping, владеющая нефтяным танкером Mersin, который на прошлой неделе получил повреждения у побережья Сенегала в результате атаки дронов, объявила о прекращении всех опера... mostra di più
Турецкая компания Besiktas Shipping, владеющая нефтяным танкером Mersin, который на прошлой неделе получил повреждения у побережья Сенегала в результате атаки дронов, объявила о прекращении всех операций, связанных с Россией. В официальном заявлении компания подчеркнула, что больше не будет выполнять рейсы, связанные с российскими интересами, сославшись на резко возросшие риски для судов и экипажей.
President #Zelenskyy and First Lady Olena Zelenska met with Ukraine’s community in Ireland, marking Ukraine’s first presidential visit since independence. The meeting highlighted strong bilateral ties and the global Ukrainian community’s vital role in amplifying Ukraine’s voice for national strength
The crematorium, located on the ground level, was designed by the Topf und Söhne company from Erfurt and was equipped with five 3-muffle ovens connected to o...
NATO is reportedly preparing a “Plan B” if U.S.-led peace efforts on Ukraine fail, Radio Svoboda reports. Eight alliance diplomats say Europe doubts any deal is possible while Putin insists on Ukraine’s full capitulation. If talks collapse, the fallback is clear: more weapons for Ukraine, stronger economic support, and tougher sanctions against Russia.
Footage shows the Midvolga 2 tanker in distress in the Black Sea. The strike reportedly hit the captain’s bridge area, with no visible hull breaches on either port or starboard side. The crew had earlier requested assistance following the incident.
Breaking: Kremlin pool journalists warn: stay tuned, news from the Kremlin coming soon. Meetings between Putin, Witkoff and Kushner have already lasted more than four hours. According to media, Putin’s aide Ushakov will make a statement following the talks between Putin, Trump’s special envoy and son‑in‑law.
On the Pokrovsk front, Ukraine’s 3rd SOF Regiment carried out a clearing operation at an industrial site where Russian forces attempted infiltration. After drone reconnaissance spotted Russian forces, the team waited for optimal weather before moving in.
Bingo: Turkish firm Besiktas Shipping is halting all operations with Russia after one of its tankers was damaged off Senegal’s coast. The company said it had complied with international sanctions and the G7/EU price cap, but growing security risks have made continued shipping “unacceptable” for vessels and crews.
Ukraine will not receive Czech T-72M4 CZ tanks due to unresolved technical issues with their fire-control systems. The modernization project was canceled after testing revealed accuracy problems linked to faulty electronic components. Instead, Czechia will focus on supplying modern Leopard tanks and continue other forms of military support.
Zelensky says the U.S. delegation wants to report directly to Ukraine following recent talks. “Their signals will shape our next steps.” He stressed Ukraine supports ending the bloodshed, but warns that unless the war ends on firm terms, Russia may return with a third invasion. “We need protection and long-term certainty, that’s what Ukrainians deserve.”
Italy’s government is delaying a decree to extend military aid to Ukraine into 2026 due to internal disputes within PM Meloni’s coalition. While Meloni vows to support Kyiv “to the end,” her deputy Matteo Salvini has questioned the need to continue such assistance, Reuters reports.
NBC reports that Russia finds three parts of Trump’s peace proposal unacceptable: Ukraine’s control over Donbas, limits on its armed forces, and Western countries not recognizing territories occupied by Russia. Moscow is prepared to be flexible on certain secondary issues.
Russia has launched nearly 1,800 missiles at Ukraine over the past year, with 215 launches recorded in November 2025 alone. Ukrainian air defenses intercepted around 55% of them.
Trump claimed he ended eight wars and now aims to end the Russia-Ukraine war too, adding that Witkoff and Kushner are in Moscow trying to assess the situation. He repeated his criticism of U.S. allies for "robbing" America, namedropped countries while pretending not to, and called Biden’s $350B aid to Ukraine “like handing out candy.”
President #Zelenskyy met Irish businesses, highlighting strong interest in cooperation. He hopes for deeper partnerships, investments for resilience, and Ukraine’s reconstruction. Grateful for support, he sees this first forum as a step toward stronger future ties.
While European leaders are in trance with secondary issues, officials from the US, Russia and China sit together regarding issues concerning Europe.
Power politics is a trait virtually all European leaders have lost. I have laid out that if Europe and especially the largest nations like Germany, France or UK are not military intervening, they all will be eventually sidelined and still be a military target.
"What matters is that everything is fair and transparent. That there are no games played behind Ukraine's back. That nothing is decided without Ukraine – about us, about our future."
🇷🇺📉 #Russia has seen a sharp rise in aviation incidents in the fourth year of Western sanctions that cut off access to spare parts for foreign-made aircraft, an investigation by the exiled news outlet Novaya Gazeta Europe has found.
Russia has seen a sharp rise in aviation incidents in the fourth year of Western sanctions that cut off access to spare parts for foreign-made aircraft, an investigation by the exiled news outlet Novaya Gazeta Europe has found.
European Parliament warns that Hungary’s rule‑of‑law crisis is deepening, branding the country a “hybrid electoral autocracy.” It cites judicial interference, systemic corruption, misuse of EU funds, AI‑generated political deepfakes, and calls for direct Article 7 action.
🇷🇴 Romania's coalition govt approved a decree on Tuesday enabling it to take control of the local assets of companies under int'l sanctions, such as #Russia's Lukoil.
Lukoil has 320 petrol stations in #Romania, operates the country's third-largest refinery and holds offshore exploration rights in a section of the Black Sea.
💬 Just before the meeting, #Putin warned #Europe that it would face swift defeat if it went to war with #Russia, and he dismissed European counter-proposals on #Ukraine as being absolutely unacceptable to Russia.
💬 #Putin threatened on Tuesday to sever #Ukraine's access to the sea in response to drone attacks on tankers of #Russia's "shadow fleet" in the Black Sea.
"The most radical solution is to cut Ukraine off from the sea, then piracy will be impossible in principle," Putin said.
🇷🇺🇧🇾 Russian and Belarusian athletes should be allowed to participate in International Ski and Snowboard Federation qualification events if they meet the IOC's criteria for individual neutral athletes, the Court of Arbitration for Sport said on Tuesday.
🇹🇯🇷🇺 Tajikistan is in talks with #Russia and a Moscow-led regional security grouping about the possibility of Russia deploying troops to jointly patrol the volatile border with Afghanistan, Reuters reported on Tuesday.
🇵🇱 Polish prosecutors are charging a Russian in absentia with directing a group of saboteurs and spies as part of a suspected destabilisation campaign due to Warsaw's strong support for #Ukraine
Another IRIS-T SLM/SLS air defense system has been delivered by Germany to Ukraine’s Western Air Command. The unit operating it has already proven its effectiveness, taking down 5 Kh-101 cruise missiles, 2 Iskander-Ks, and 2 Shahed drones.
Putin says Russia is ready if Europe “starts a war,” claiming Moscow doesn’t want conflict but is prepared. He also rejected current European peace proposals on Ukraine as “unacceptable” and threatened broader strikes on Ukrainian ports and vessels in response to recent tanker attacks.
Putin is now meeting in the Kremlin with Trump envoy Witkoff and Jared Kushner. Details of the talks remain undisclosed, but the meeting follows recent U.S.-Ukraine negotiations. Putin's aide Ushakov and head of negotations Dmitriev are also present.
I have added another #PeerTube channel on video.echelon.pl - a mirror of the popular #Telegram channel War Translated, which publishes popular #Russia #Ukraine war videos in English and with English description:
Previously, many of these I have hand picked to post on the @ua_war_videos channel but now these will be mirrored automatically which will save me tons of time.
All War Translated support/sponsoring information is replicated on the channel verbatim, so if you want to support the original author you will see same details as he publishes on Telegram. I wasn’t able to contact him directly but hope this works for him even though Telegram isn’t particularly a community that cares about attribution and copyright.
Secondo un'analisi della Camera dei Rappresentanti olandese, la maggior parte degli adolescenti coinvolti nella criminalità digitale abbandona entro i 20 anni, con solo il 4% che continua.
Huh. Just chatted in person with someone who's been on #mastodon for a while, now, who honestly thought that all the Mastodon domains were run by Mastodon. And having a different domain was, like, just a vanity thing to look cool. It only came up because they were complaining about an issue they were having, and they were on a smaller server (not naming it for anonymity), so I suggested contacting their server admin about the problem. I was surprised when they answered "Dude nobody at big companies reads those reports. It just all goes to AI or whatever." It took some actual convincing to get them to believe that the server they're on does, in fact, have a living breathing human admin who can be talked to.
Anyway, folks, support your #fediverse server admins and moderators. With money, where you can. They're almost certainly getting messages from users who think that reporting things to an admin here is exactly like reporting stuff to Facebook or Google. IE: screaming at a giant faceless entity who's never going to care or do anything about whatever your problem is.
How did the person react when you told them, that the servers are run by several thousand people mostly with their own money? Have you also told that there is more than only Mastodon, but some dozen other systems as well?
Starter Pack di Mastodon è una pagina che raccoglie gli account preferiti su Mastodon, e comprende gli argomenti più diversi, ci si può registrare al sito e inserire il proprio "starter pack": fedidevs.com/starter-packs/
Ho scelto due starter pack come esempi.
➡️ Il primo con il tag #Unplugtrump raccoglie (al momento) 74 account di organizzazioni e progetti opensource che si oppongono a Trump e alle oligarchie big tech che lo sostengono per promuovere la società civile e la democrazia: fedidevs.com/s/NDU5/
➡️ Il secondo è una mappa che raccoglie 40 account di "Illustratorə e fumettistə italianə ": fedidevs.com/s/Njc3/
I started a game of Pathfinder Kingmaker, and I have a question for people familiar with the Pathfinder table-top role-playing game: is a party of 4 level 2 characters equipped with 6 Alchemist's Fire supposed to run at the sight of a couple spider swarms also in the pen and paper game?
In the video game, alchemist's fires are more miss than hit, and they will tear my party apart if I don't roll high on the fire damage in the first place. Feels OP?
As far as I know, the crpg is built on an engine that self-consciously follows the trrpg mechanics. That being said, I used the settings to dial down the threat level a couple of times when it seemed too punishing.
@matsuzine Thank you for the reply! I'm playing on Normal difficulty, which means enemies are slightly easier (the game's words, not sure what it means). There are times where a bad outcome is logical. 4 wolves aggro 1 character, they all hit, he died. That makes sense to me. But a single swarm of spiders doing consistent AoE damage while being immune to almost anything my characters have, it feels slightly lopsided.
I this case, using spells like burning hands should work well, or just not fighting the swarms
The Pathfinder1e rule system can be opaque, and there is a massive difference between just using the characters and optimizing them, neoseeker.com has very good guides about that. Applying heightened stinking cloud kind of auto-wins all later encounters.
Congressman August Pfluger, R-Texas, introduced a bill this week named the Cyber Deterrence and Response Act that creates a unified federal process to identify, attribute, and sanction state-sponsored cyber actors
All statistics in this report come from Kaspersky Security Network (KSN), a global cloud service that receives information from components in our security solutions voluntarily provided by Kaspersky users. Millions of Kaspersky users around the globe assist us in collecting information about malicious activity. The statistics in this report cover the period from November 2024 through October 2025. The report doesn’t cover mobile statistics, which we will share in our annual mobile malware report.
During the reporting period:
48% of Windows users and 29% of macOS users encountered cyberthreats
27% of all Kaspersky users encountered web threats, and 33% users were affected by on-device threats
The highest share of users affected by web threats was in CIS (34%), and local threats were most often detected in Africa (41%)
Kaspersky solutions prevented
... mostra di più
Kaspersky Security Bulletin 2025. Statistics
All statistics in this report come from Kaspersky Security Network (KSN), a global cloud service that receives information from components in our security solutions voluntarily provided by Kaspersky users. Millions of Kaspersky users around the globe assist us in collecting information about malicious activity. The statistics in this report cover the period from November 2024 through October 2025. The report doesn’t cover mobile statistics, which we will share in our annual mobile malware report.
During the reporting period:
48% of Windows users and 29% of macOS users encountered cyberthreats
27% of all Kaspersky users encountered web threats, and 33% users were affected by on-device threats
The highest share of users affected by web threats was in CIS (34%), and local threats were most often detected in Africa (41%)
Kaspersky solutions prevented nearly 1,6 times more password stealer attacks than in the previous year
In APAC password stealer detections saw a 132% surge compared to the previous year
Kaspersky solutions detected 1,5 times more spyware attacks than in the previous year
To find more yearly statistics on cyberthreats view the full report.
I proprietari di Porsche in Russia riscontrano problemi con gli allarmi di fabbrica, che bloccano le loro auto. La causa non è ancora nota, ma potrebbe essere intenzionale.
ANY.RUN says activity from the Salty2FA phishing service collapsed in October and payloads now seem to overlap with the IOCs of another service named Tycoon2FA.
Phishing kits usually have distinct signatures in their delivery methods, infrastructure, and client-side code, which makes attribution fairly predictable.
I proprietari di Porsche in Russia riscontrano problemi con gli allarmi di fabbrica, che bloccano le loro auto. La causa non è ancora nota, ma potrebbe essere intenzionale.
Under the new rule, the DoT requires messaging apps, including WhatsApp, Telegram, and Signal, to implement "SIM binding", i.e., linking of services to the SIM card used for registration via its IMSI identifier.
Little Lie Detector is Probably No Worse Than The Big Ones
Want to know if somebody is lying? It’s always so hard to tell. [dbmaking] has whipped up a fun little polygraph, otherwise known as a lie detector. It’s nowhere near as complex as the ones you’ve seen on TV, but it might be just as good when it comes to finding the truth.
The project keeps things simple by focusing on two major biometric readouts — heart rate and skin conductivity. When it comes to the beating heart, [dbmaking] went hardcore and chose an AD8232 ECG device, rather than relying on the crutch that is pulse oximetry. It picks up heart signals via three leads that are just like those they stick on you in the emergency room. Skin conductivity is measured with a pair of electrodes that attach to the fingers with
... mostra di più
Little Lie Detector is Probably No Worse Than The Big Ones
Want to know if somebody is lying? It’s always so hard to tell. [dbmaking] has whipped up a fun little polygraph, otherwise known as a lie detector. It’s nowhere near as complex as the ones you’ve seen on TV, but it might be just as good when it comes to finding the truth.
The project keeps things simple by focusing on two major biometric readouts — heart rate and skin conductivity. When it comes to the beating heart, [dbmaking] went hardcore and chose an AD8232 ECG device, rather than relying on the crutch that is pulse oximetry. It picks up heart signals via three leads that are just like those they stick on you in the emergency room. Skin conductivity is measured with a pair of electrodes that attach to the fingers with Velcro straps. The readings from these inputs are measured and then used to determine truth or a lie if their values cross a certain threshold. Presumably, if you’re sweating a lot and your heart is beating like crazy, you’re telling a lie. After all, we know Olympic sprinters never tell the truth immediately after a run.
Does this work as an actual, viable lie detector? No, not really. But that’s not just because this device isn’t sophisticated enough; commercial polygraph systems have been widely discredited anyway. There simply isn’t an easy way to correlate sweating to lying, as much as TV has told us the opposite. Consider it a fun toy or prop to play with, and a great way to learn about working with microcontrollers and biometric sensors.
I sat for a long while with my complicated feelings about "vibe coding". It is _genuinely_ empowering for many — opening a door to creating with code that otherwise would never exist. Also? It enables a dangerous dependency that could be a path to serfdom for coders. anildash.com/2025/12/02/vibe-c…
Software engineering is often compared to actual engineering. Would it be good if everyone could design buildings, bridges, and elevators without any kind of education? Most software applications involve user data in some way, and some go as far as touching upon actual human safety. The argument about empowerment does not hold, especially considering how easy it is to be autodidact in software engineering in the first place.
@Gargron I think that's a fair argument for the segment of coding that is software engineering. I would argue a *lot* of coding isn't really... software engineering? Like, the front-end code on my blog certainly doesn't count as that for me. If I get an LLM to help me, and it has an error, there's no security or privacy implications, nor any real danger except maybe a rendering error. So it seems like a fair domain to just muddle through. There are a lot of things in that space these days.
@Gargron there is a lot of discussion in the US about a Professional Engineering license for Software. It goes in and out of favor, but I think that it should be required for at least life-critical software.
There is some gatekeeping there, but I think when human lives are at risk it is justified.
@Gargron on a related note, I think comparing software engineering to physical engineering is flawed because software engineering as practiced today is neither rigorous nor as disciplined as physical engineering. Here are some more thoughts rvprasad.medium.com/software-s…
@nico beastie boyce I truly couldn't tell, there aren't any easily available pictures of EsDeeKid's actual face, they're always wearing some kind of face covering.
Apple will refuse to preload state-run “snooping” app on iPhones, report says Apple reportedly will defy India order amid uproar over potential surveillance. arstechnica.com/tech-policy/20…
Se dovessi indicare la vera icona di quest'epoca, a malincuore direi Trump. Ha le caratteristiche che rendono questi tempi così feroci: l'arroganza, la volgarità, il cinismo, la megalomania e soprattutto una concezione messianica di se stesso che lo rende capace di qualsiasi follia. Se esistesse il pulsante dell'Apocalisse, Trump sarebbe capace di schiacciarlo mentre pubblica un selfie autocelebrativo su Instagram.
A pochi mesi dalla partenza, il cosmonauta russo Oleg Artemyev è stato rimosso dall'equipaggio della Crew-12 e sostituito. Secondo alcuni avrebbe fotografato documenti di SpaceX per portarli all'esterno. L'agenzia spaziale russa Roscosmos parla solo di un cambio di incarico theins.ru/news/287330
"Researchers using Google Trends search data in a 2020 study found a link between male insecurity and support for Trump. They identified areas with high levels of web searches for erectile dysfunction, penis size, penis enlargement, hair loss, hair plugs, testosterone, and Viagra."
Anatomia di una Violazione Wi-Fi: Dalla Pre-connessione alla Difesa Attiva
Nel contesto odierno, proteggere una rete richiede molto più che impostare una password complessa. Un attacco informatico contro una rete wireless segue un percorso strutturato che evolve dal monitoraggio passivo fino alla manipolazione attiva del traffico.
Analizzeremo questo processo in tre fasi distinte: l’ottenimento dell’accesso, le manovre post-connessione e le contromisure difensive necessarie.
1. Fase di Pre-connessione: Sorveglianza e Accesso
Il penetration test di una rete wireless inizia analizzando la sua superficie di attacco: si osservano le identificazioni visibili e si valutano configurazioni deboli o non sicure.
Monitoraggio e Identificazione del Target
Il primo passo consiste nell’utilizzare strumenti in modalità
... mostra di più
Anatomia di una Violazione Wi-Fi: Dalla Pre-connessione alla Difesa Attiva
Nel contesto odierno, proteggere una rete richiede molto più che impostare una password complessa. Un attacco informatico contro una rete wireless segue un percorso strutturato che evolve dal monitoraggio passivo fino alla manipolazione attiva del traffico.
Analizzeremo questo processo in tre fasi distinte: l’ottenimento dell’accesso, le manovre post-connessione e le contromisure difensive necessarie.
1. Fase di Pre-connessione: Sorveglianza e Accesso
Il penetration test di una rete wireless inizia analizzando la sua superficie di attacco: si osservano le identificazioni visibili e si valutano configurazioni deboli o non sicure.
Monitoraggio e Identificazione del Target
Il primo passo consiste nell’utilizzare strumenti in modalità “monitor” per raccogliere informazioni dettagliate sui punti di accesso (AP) e sui client attivi. Abilitando l’interfaccia wireless in questa modalità e lanciando il comando seguente, l’analista scandaglia ciascun canale della rete:
[strong]airodump-ng wlan0mon[/strong] Output di airodump-ng in modalità monitor: identificazione delle reti WPA2 e dei client connessi. Questi dati sono fondamentali per selezionare il bersaglio. Segnali di debolezza includono un SSID facilmente riconoscibile, un basso numero di client o l’assenza del protocollo WPA3. Una volta individuato il target, si esegue una scansione mirata per aumentare la precisione con il comando: airodump-ng -c <canale> --bssid <BSSID> -w <file_output> wlan0mon
Intercettazione dell’Handshake
Per ottenere l’accesso completo su reti WPA/WPA2, è necessario catturare l’handshake, ovvero lo scambio di pacchetti che avviene quando un client si associa al router. Se non si verificano connessioni spontanee, si interviene con un attacco di deautenticazione.
Utilizzando Aireplay-ng, si inviano pacchetti che disconnettono temporaneamente il client vittima: aireplay-ng –deauth 5 -a <BSSID> -c <Client_MAC> wlan0mon Al momento della riconnessione automatica del dispositivo, l’handshake viene registrato da Airodump e salvato su disco in un file .cap. Altro esempio di output di airodump-ng: evidenza di canali e durata pacchetti.
Cracking della Crittografia
Acquisito il file, si passa all’attacco offline. Strumenti come Aircrack-ng esaminano ogni password contenuta in una wordlist (come la comune rockyou.txt), combinandola con il nome dell’AP per generare una Pairwise Master Key (PMK). Questo processo spesso utilizza algoritmi come PBKDF2 per l’hashing.
Il comando tipico è: aircrack-ng -w rockyou.txt -b <BSSID> handshake.cap La PMK generata viene confrontata con i dati crittografati dell’handshake: se coincidono, la password è rivelata. Per password complesse, si ricorre a strumenti come Hashcat o John the Ripper, ottimizzati per l’accelerazione GPU.
2. Fase Post-connessione: Mimetismo e MITM
Una volta superata la barriera iniziale, l’attaccante ha la possibilità di interagire direttamente con i dispositivi nella rete locale. L’obiettivo ora cambia: bisogna mimetizzarsi tra gli altri dispositivi e raccogliere dati senza essere rilevati.
Mappatura della Rete
Il primo passo post-connessione è costruire una mappa della rete. Strumenti come Netdiscover eseguono una scansione ARP attiva sull’intera sottorete per raccogliere IP e MAC address: netdiscover -r 192.168.1.0/24 Screenshot reale da laboratorio: handshake WPA2 catturato all’esecuzione del comando aireplay-ng
Successivamente, Nmap permette un’analisi profonda. Con il comando nmap -A <IP_Target>, si esegue una scansione aggressiva per identificare porte aperte, versioni dei servizi e il sistema operativo del target, rivelando potenziali vulnerabilità come software obsoleti.
Man in the Middle (MITM) e ARP Spoofing
La strategia offensiva più potente in questa fase è l’attacco Man in the Middle, spesso realizzato tramite ARP Spoofing. L’attaccante inganna sia il client che il gateway alterando le loro cache ARP, posizionandosi logicamente tra i due.
I comandi manuali per realizzare ciò sono:
arpspoof -i wlan0 -t <IP_Client> <IP_Gateway> (Convince il client che l’attaccante è il gateway).
arpspoof -i wlan0 -t <IP_Gateway> <IP_Client> (Convince il gateway che l’attaccante è il client).
Per automatizzare il processo, si utilizzano framework come MITMF, che integrano funzionalità di DNS spoofing, keylogging e iniezione di codice. Un esempio di comando è:
Il successo di un attacco dipende dalla capacità difensiva del bersaglio. Esistono strumenti specifici per individuare comportamenti anomali e bloccare le minacce tempestivamente.
Monitoraggio del Traffico con Wireshark
Wireshark è essenziale per l’analisi profonda. La sua interfaccia permette di identificare pattern sospetti come le “tempeste ARP”. Per configurarlo al rilevamento dello spoofing:
Accedere a Preferenze > Protocolli > ARP.
Abilitare la funzione “Rileva schema richiesta ARP”.
Questa opzione segnala irregolarità, come la variazione frequente del MAC associato a uno stesso IP. Inoltre, il pannello “Informazioni Esperto” evidenzia risposte ARP duplicate e conflitti IP, indici chiari di un attacco in corso. Output di netdiscover in laboratorio: IP e MAC dei dispositivi attivi
Difesa Attiva con XArp
Per una protezione automatizzata, XArp offre due modalità: passiva (osservazione) e attiva (interrogazione). Se XArp rileva che il MAC del gateway cambia improvvisamente, invia un probe diretto per validare l’associazione IP-MAC e generare un alert.
Scenario Pratico di Attacco e Risposta
Per comprendere meglio la dinamica, consideriamo un esempio in una rete LAN aziendale:
L’Attacco: Un attaccante connesso via Wi-Fi lancia arpspoof, impersonando simultaneamente il router (192.168.1.1) e il client vittima (192.168.1.100).
Il Rilevamento: Su una macchina della rete è attivo XArp, che rileva una variazione improvvisa dell’indirizzo MAC del gateway. Il software attiva un probe, confronta la risposta e conferma la discrepanza, generando un alert immediato per l’amministratore.
La Reazione: A questo punto le difese si attivano. Un firewall locale può bloccare il traffico verso il MAC falsificato, oppure l’amministratore può ripristinare la corretta voce ARP forzando l’associazione corretta con i seguenti comandi:
Su Linux:sudo arp -s 192.168.1.1 00:11:22:33:44:55
Su Windows:arp -s 192.168.1.1 00-11-22-33-44-55
Questa operazione impedisce nuove sovrascritture finché la voce statica rimane in memoria.
4. Contromisure Tecniche per la Sicurezza delle Reti
Nel contesto odierno, le contromisure tecniche non devono limitarsi al rilevamento, ma puntare a impedire l’esecuzione dell’attacco a monte. Di seguito analizziamo le strategie principali per proteggere reti LAN e WLAN.
Tabelle ARP Statiche
Una delle tecniche più semplici ma efficaci è la configurazione manuale di voci statiche. Di default, i sistemi operativi usano tabelle ARP dinamiche che possono essere manipolate. Inserendo manualmente le voci (come visto nello scenario precedente), si impedisce ogni modifica non autorizzata. È importante ricordare che queste configurazioni vanno reinserite ad ogni riavvio o automatizzate tramite script.
Modifica dell’SSID e Gestione del Broadcast
I router utilizzano spesso SSID predefiniti (es. “TP-LINK_ABC123”) che rivelano il modello del dispositivo e le relative vulnerabilità note. Cambiare l’SSID in un nome generico (es. “net-home42”) riduce l’esposizione. Inoltre, disabilitare il broadcast dell’SSID rende la rete invisibile ai dispositivi che non la conoscono. Sebbene non sia una misura assoluta (il nome è recuperabile dai beacon frame), aumenta la difficoltà per attaccanti non esperti.
Filtraggio degli Indirizzi MAC
Il MAC filtering consente l’accesso solo ai dispositivi esplicitamente autorizzati nel pannello di amministrazione del router. Qualsiasi altro dispositivo viene rifiutato. Anche questa misura può essere aggirata tramite MAC spoofing, ma resta un’ottima prima barriera in reti con un numero limitato di dispositivi.
Disabilitazione dell’Amministrazione Wireless
Molti router permettono la configurazione remota via Wi-Fi. Questo espone la rete al rischio che un attaccante, una volta connesso, possa accedere al pannello di controllo. È fortemente consigliato disabilitare la gestione wireless, limitando l’accesso amministrativo alle sole porte Ethernet cablate.
Uso di Tunnel Crittografati
Le comunicazioni sensibili devono sempre avvenire su canali cifrati per rendere inutile l’intercettazione dei dati (sniffing). Esempi fondamentali includono:
Inoltre, l’adozione del protocollo WPA3 introduce il sistema SAE (Simultaneous Authentication of Equals), rendendo la rete molto più resistente agli attacchi a dizionario rispetto al WPA2.
Aggiornamento del Firmware
Le vulnerabilità del firmware sono un vettore di attacco spesso trascurato. È essenziale controllare periodicamente il sito del produttore e installare le patch di sicurezza. L’aggiornamento può chiudere backdoor, correggere falle nel protocollo WPS e migliorare la stabilità generale.
Conclusione: Verso una Sicurezza Proattiva
La sicurezza delle reti locali rappresenta oggi una delle sfide più importanti della cybersecurity. Come abbiamo osservato, un attacco può iniziare silenziosamente con una scansione (airodump-ng) per poi evolvere in manipolazioni attive (MITM).
La facilità con cui è possibile violare una rete poco protetta evidenzia quanto siano ancora sottovalutate le tecniche di base. Allo stesso tempo, strumenti potenti e gratuiti come Aircrack-ng, Wireshark e XArp sono disponibili sia per gli attaccanti che per i difensori: la differenza la fa la competenza.
In sintesi, abbiamo visto che:
L’accesso può essere forzato catturando l’handshake e usando wordlist (aircrack-ng -w rockyou.txt).
Una volta dentro, l’attaccante può mappare l’infrastruttura (netdiscover, nmap).
Il traffico può essere manipolato tramite ARP Spoofing (arpspoof, MITMF).
La difesa richiede un approccio multilivello: monitoraggio, alert automatici e hardening della configurazione.
La sicurezza informatica non è una configurazione “una tantum”, ma un processo adattativo. Essere proattivi è l’unico modo per garantire integrità e privacy in un panorama tecnologico in costante mutamento.
look im not in charge of the notre dame de paris restoration fundraising campaign right. BUT IF I WAS. i would let people sponsor the individual gargoyles and send them a welcome pack, regular photo updates, handwritten thankyou notes from the gargoyle in question etc, as if it was a donkey sanctuary
Amazon incassa miliardi spingendo a comprare cose che non vogliamo o la versione più costosa di prodotti disponibili a condizioni più vantaggiose. Leggi
Un paese che vive perennemente al di sopra delle proprie possibilità ed in sfregio alle proprie responsabilità. Un paese che non è moderno. Un paese che ha fondamenta fatte di pressapochismo, malaffare e mancanza di serietà. E' anche il mio paese. Forse non ho fatto abbastanza per lui.
Ciao Mondo. 🎅 Oramai Natale è alle porte e il formichiere vorrebbe essere adottato da qualcuno di gentile, carinœ e affettuosœ come te o come l'amicæ tuœ Che aspetti ad adottarlo?
< A Susques, la promessa di sviluppo si è trasformata in dipendenza. L’acqua che prima sgorgava dagli occhi della terra (ojos de la tierra ) ora arriva in bottiglie di plastica: privatizzazione, proprietà privata e individualismo sono alcune delle conseguenze che l’estrazione mineraria ha portato a Susques. >
A confronto con le comunità del Bacino di Salinas Grandes in Argentina che si scontrano con l’estrazione del litio dalle saline: «La Pachamama ci sta dicendo che siamo ancora in tempo, ma che non ne rimane molto»
🔥 Album available // Schumann: The 4 Symphonies by George Szell🔥 Choose my streaming platform: https://lnk.to/schumansymphoniesszell🎧 Qobuz (Hi-Res/flac) ...
I don't know if we've already discussed this, but he is certainly an outstanding performer. - And a cruel ‘tamer’. You wouldn't want to have a boss like that. I still have the 3rd and 4th with the cast. The 2nd is still missing.
Output di airodump-ng in modalità monitor: identificazione delle reti WPA2 e dei client connessi.
Altro esempio di output di airodump-ng: evidenza di canali e durata pacchetti.
Screenshot reale da laboratorio: handshake WPA2 catturato all’esecuzione del comando aireplay-ng
Output di netdiscover in laboratorio: IP e MAC dei dispositivi attivi
Tendar
in reply to Tendar • • •