Allarme sabotaggio informatico: Volt Typhoon si prepara ad attività distruttive

L’Australian Security Intelligence Organisation (ASIO) ha lanciato l’allarme sulla prontezza degli stati autoritari ad andare oltre lo spionaggio informatico per arrivare al sabotaggio diretto delle infrastrutture critiche.

Mike Burgess, a capo dell’Australian Security Intelligence Organisation (ASIO), ha dichiarato che i governi stranieri stanno sempre più prendendo in considerazione l’idea di colpire sistemi energetici, telecomunicazioni e reti finanziarie utilizzando la tecnologia per attacchi informatici distruttivi.

Secondo il capo dell’agenzia, negli ultimi anni le agenzie di intelligence hanno osservato un crescente interesse da parte di diversi stati per scenari “ad alto impatto”, dall’interruzione delle comunicazioni allo spoofing o all’avvelenamento delle riserve idriche.

Tali azioni, ha sottolineato Burgess, non sono più solo teoriche. Secondo l’ASIO, diversi paesi hanno creato squadre speciali che studiano come paralizzare le infrastrutture di altri stati in caso di conflitto. Mentre in precedenza l’obiettivo di tali strutture era quello di ottenere segretamente dati e interferire con i processi interni, ora si stanno preparando al sabotaggio.

La situazione, secondo lui, è aggravata da una combinazione di fattori: lo sviluppo dell’intelligenza artificiale, l’emergere di strumenti commerciali per attacchi informatici e la possibilità di noleggiare servizi dannosi sul darknet. Queste tendenze rendono l’accesso agli strumenti di sabotaggio significativamente più facile e gli autori più difficili da rintracciare.

L’agenzia prevede che nei prossimi cinque anni la minaccia di sabotaggio, anche attraverso mezzi digitali, aumenterà sia in termini di preparazione tecnica degli aggressori sia in termini di determinazione ad agire.

Burgess ha osservato che le minacce moderne non solo stanno diventando più numerose, ma anche meno distinte. L’ASIO stima che gli stessi attori possano combinare intelligence, attacchi informatici e l’uso di proxy criminali, sfumando il confine tra attività militare e criminale. Tali tendenze, ha affermato, stanno portando a un “ambiente di sicurezza degradato”, in cui gli stati che aderiscono a modelli autoritari agiscono in modo sempre più aggressivo e meno prevedibile.

Ha citato come esempi i gruppi cinesi Salt Typhoon e Volt Typhoon. Il primo è specializzato in cyberspionaggio e ha già condotto ricognizioni sulle reti di telecomunicazioni australiane, mentre il secondo si stava preparando per operazioni distruttive, ottenendo l’accesso a strutture critiche statunitensi con il potenziale di disattivarle.

Tali intrusioni, ha sottolineato il direttore dell’ASIO, forniscono a un avversario la capacità tecnica di disattivare le comunicazioni o l’alimentazione elettrica in qualsiasi momento e, in tali circostanze, ulteriori sviluppi dipendono esclusivamente dalla volontà politica, non dalla disponibilità di strumenti.

Ha prestato particolare attenzione al problema dell’impreparazione delle aziende a tali minacce. A suo avviso, la maggior parte degli incidenti aziendali si verifica a causa di vulnerabilità ben note e della negligenza delle misure di sicurezza di base. Nonostante i rischi siano stati identificati da tempo, il management spesso percepisce gli attacchi informatici come imprevisti. Allo stesso tempo, ha sottolineato, la protezione contro il sabotaggio richiede gli stessi approcci gestionali del monitoraggio di guasti interni, furti o incidenti.

Burgess ha esortato le aziende ad abbandonare un approccio superficiale alla sicurezza e ad andare oltre presentazioni e report. Ha sottolineato che i dirigenti devono comprendere chiaramente quali dati, sistemi e servizi sono critici per l’azienda e i suoi clienti, dove sono archiviati, chi vi ha accesso e quanto sono protetti. Solo allora potranno costruire un sistema di sicurezza coeso che elimini le lacune tra i reparti e le soluzioni isolate.

Secondo il responsabile dell’ASIO, la mancanza di misure globali non può essere giustificata né dalla complessità delle tecnologie né dalla mancanza di risorse. Se i rischi sono prevedibili e le vulnerabilità sono note, l’inazione si trasforma in una violazione deliberata della sicurezza.

Ha sottolineato che ignorare queste minacce nel contesto attuale è inaccettabile, soprattutto considerando che i potenziali avversari dispongono già di tutto il necessario per attaccare le infrastrutture, comprese le capacità di intelligenza artificiale.

L'articolo Allarme sabotaggio informatico: Volt Typhoon si prepara ad attività distruttive proviene da Red Hot Cyber.

Italia e i Siti Porno: il Paese del vietato entrare… ma con un click va bene

Dal 12 novembre 2025, l’AGCOM ha riportato che in linea con l’art. 13-bis del decreto Caivano (dl123/2023), 47 siti per adulti raggiungibili dall’Italia avrebbero dovuto introdurre un sistema di verifica dell’identità per impedire l’accesso ai minori.

Age Verification sui siti per adulti dal 12 di novembre in Italia

Una misura attesa da mesi, annunciata come un passo deciso verso la tutela dei più giovani online. Tuttavia, a distanza di un giorno dalla scadenza fissata, i principali portali per adulti sono ancora liberamente accessibili, senza alcun tipo di verifica aggiuntiva.
Schermata di PornHub accessibile al solo click “Ho 18 anni o più – entra”.
Visitando oggi il più grande hub mondiale di contenuti per adulti, Pornhub, il sito si presenta esattamente come prima: una schermata iniziale in cui l’utente deve semplicemente dichiarare di avere almeno 18 anni per entrare. Una finestra standard, identica a quella visibile in altri Paesi dove, tuttavia, esistono veri controlli di accesso. Basta cliccare “Ho 18 anni o più – Entra” per poter accedere liberamente a tutti i contenuti.

Questa situazione solleva più di una domanda. L’Italia aveva promesso un intervento deciso, dopo mesi di discussioni e pressioni da parte di associazioni e politici. Ma oggi la realtà è che nulla è cambiato: i siti restano aperti e la verifica dell’identità rimane solo sulla carta. Una vicenda che richiama alla mente altri casi in cui annunci e provvedimenti si sono rivelati inefficaci o incompleti.
Age verification sul portale dell’Autorità per le garanzie nelle comunicazioni che riporta l’attivazione dal 12 di novembre.

Un paese che ne esce fuori indebolito

Premesso che noi di Red Hot Cyber riteniamo che il provvedimento, anche se attuato, sarebbe stato comunque un pagliativo, è evidente che il problema non è solo tecnico ma anche politico e culturale. L’uso di strumenti come VPN, Tor Browser o proxy consente di aggirare facilmente qualsiasi blocco o restrizione geografica, rendendo la misura una barriera solo apparente. Inoltre, in un contesto così destrutturato, a gonfiarsi il portafogli sarebbero i criminali informatici che spaccerebbero VPN infostealer con VPN Gratuite e incetta di dati personali.

Ma c’è un aspetto ancora più preoccupante: l’immagine che l’Italia trasmette alla comunità internazionale. Quando un Paese annuncia una misura di controllo e poi non la applica, ne esce indebolito. E questo non riguarda soltanto la gestione dei contenuti per adulti, ma più in generale la credibilità nel far rispettare le proprie leggi digitali.
Schermata di YouPorn accessibile al solo click “Ho 18 anni o più – entra”.
Un precedente simile si era già verificato con il caso DeepSeek, l’intelligenza artificiale cinese che era stata “vietata” in Italia ma di fatto mai realmente bloccata. Una storia che si ripete, dimostrando come spesso gli annunci non si traducano in risultati concreti.

E ora?

Ci si chiede allora cosa pensino oggi i gestori dei 47 siti per adulti che erano stati messi sotto osservazione: forse si domandano quanto seriamente l’Italia voglia davvero affrontare il tema. Una domanda che, purtroppo, ci facciamo anche noi.

Al momento, non si parla di sanzioni né di provvedimenti concreti contro i siti che non hanno rispettato l’obbligo di introdurre un sistema di verifica dell’età. Nessuna multa, nessuna azione da parte delle autorità competenti sembra essere stata avviata.

Un silenzio che stride con quanto avvenuto, ad esempio, in Francia, dove dopo il lancio ufficiale del sistema di Age Verification, solo pochi portali erano rimasti operativi senza adeguarsi alle nuove regole, e furono rapidamente bloccati o costretti a conformarsi. In Italia, invece, l’impressione è che tutto sia rimasto fermo al livello delle dichiarazioni di principio, senza alcun seguito concreto.

E così, mentre la tecnologia e la rete corrono a una velocità sempre maggiore, l’Italia sembra rimanere ferma nel limbo delle buone intenzioni e delle grandi promesse.

Ci viene in mente una frase molto lontana, ma ancora attuale del grande Adriano Olivetti, che descrive perfettamente la situazione di oggi:

“L’Italia procede ancora nel compromesso, nei vecchi sistemi del trasformismo politico, del potere burocratico, delle grandi promesse, dei grandi piani e delle modeste realizzazioni.”

L'articolo Italia e i Siti Porno: il Paese del vietato entrare… ma con un click va bene proviene da Red Hot Cyber.

EN: The dynamics of #ruscist losses in the war against Ukraine since February 24, 2022
index.minfin.com.ua/en/russian…

UA: Динаміка втрат рашистів у війні проти України з 24 лютого 2022 року
index.minfin.com.ua/ua/russian…

RU: Динамика потерь рашистов в войне против Украины с 24 февраля 2022 года
index.minfin.com.ua/russian-in…

There’s no Rust on this Ironclad Kernel

Rust is the new hotness in programming languages because of how solid its memory protections are. Race conditions and memory leaks are hardly new issues however, and as greybeards are wont to point out, they were kind of a solved problem already: we have Ada. So if you want a memory-protected kernel but aren’t interested in the new kids’ rusty code, you might be interested in the Ironclad OS kernel, written entirely in Ada.

OK, not entirely in classic Ada– they claim to use SPARK, too, but since SPARK and Ada converged syntax-wise over a decade ago, we’re just going to call it Ada. The SPARK toolchain means they can get this kernel “formally-verified” however, which is a big selling point. If you’re not into CS, that just means the compiler can confirm the code is going to do what we want under all possible conditions — which is a nice thing to be able to say about the heart of your operating system, I think we can all agree. It’s a nice thing to be able to say about any code, which is one reason why you might want to be programming in Ada.

It’s also not something we can say without qualifications about Ironclad OS, as the verification process is still ongoing. Still, that lofty goal certainly sets Ironclad apart from other POSIX kernel projects.

Yes, the Ironclad OS kernel is POSIX compliant, like its Rust-based equivalent Redox OS. While it would be nice to see some innovation outside the POSIX box (outside of whatever Redmond’s doing these days), making the kernel POSIX-compliant certainly makes it a lot more useful. The Ironclad OS kernel is fully open source under GPLv3, with no binary blobs built in. The OSF will like that, and the rest of us should be able to tack on the binary blobs needed to run our hardware as usual, so it’s win-win.

They’re currently targeting RISC-V and x86, with test platforms being MilkV and LattePanda SBCs. If someone was willing to take on the project single-handedly, they could probably strongarm the project into supporting other architectures, if there’s are any other SBCs popular these days. PowerPC, perhaps?

For the supported architectures, there is already a usable (for some values of the word) distribution in the form of Gloire, which is appropriately named after the first ocean-going Ironclad vessel. The header image is a screenshot from an X-server on running on that distribution.

hackaday.com/2025/11/12/theres…

Cheap Multimeter Gets Webified

[Mellow Labs] wanted to grab a multimeter that could do Bluetooth. Those are cheap and plentiful, but the Bluetooth software was, unsurprisingly, somewhat lacking. A teardown shows a stock Bluetooth module. A quick search found a GitHub with software. But then he had a fiendish idea: could you replace the Bluetooth module with an ESP32 and use WiFi instead of Bluetooth?

This was as good an excuse as any to buy a cheap logic analyzer. Armed with some logic captures, it was easy to figure out how to fake the meter into thinking a Bluetooth client was connected.

Oddly enough, the data is “encrypted” with XOR, and an AI website was able to identify the raw data versus the encrypted data and deduce the key. The rest, as they say, was software. Well, except for one hardware problem: The ESP32 needed more power, but that was a fairly simple fix.

The entire thing fit the case beautifully. Now the meter streams a web page instead of requiring Bluetooth. Great job!

If your meter isn’t handheld, you can still play a similar trick. Just don’t forget that when it comes to meters, you often get what you pay for. Not that you can’t do a similar hack on an expensive meter, either.

youtube.com/embed/IDr2Icdue40?…

hackaday.com/2025/11/12/cheap-…

2025 Component Abuse Challenge: Light an LED With Nothing

Should you spend some time around the less scientifically informed parts of the internet, it’s easy to find “Free power” stories. Usually they’re some form of perpetual motion machine flying in the face of the laws of conservation of energy, but that’s not to say that there is no free power.

The power just has to come from somewhere, and if you’re not paying for it there’s the bonus. [joekutz] has just such a project, lighting up LEDs with no power source or other active electronics.

Of course, he’s not discovered perpetual motion. Rather, while an LED normally requires a bit of current to light up properly, it seems many will produce a tiny amount of light on almost nothing. Ambient electromagnetic fields are enough, and it’s this effect that’s under investigation. Using a phone camera and a magnifier as a light detector he’s able to observe the feeble glow as the device is exposed to ambient fields.

In effect this is using the LED as the very simplest form of radio receiver, a crystal set with no headphone and only the leads, some wires, and high value resistors as an antenna. The LED is after all a diode, and it can thus perform as a rectifier. We like the demonstration even if we can’t quite see an application for it.

While we’re no longer taking new entries for the 2025 Component Abuse Challenge, we’ve still got plenty of creative hacks from the competition to show off. We’re currently tabulating the votes, and will announce the winners of this particularly lively challenge soon.

hackaday.com/2025/11/12/2025-c…

FLOSS Weekly Episode 854: The Big Daddy Core

This week Jonathan and Ben chat with Jason Shepherd about Ocre and Atym.io! That’s the lightweight WebAssembly VM that lets you run the same containers on Linux and a host of embedded platforms, on top of the Zephyr embedded OS. What was the spark that led to this project’s creation, what does Atym.io bring to the equation, and what are people actually doing with it? Watch to find out!

• lfedge.org/projects/ocre/
• lfedge.org/from-the-magical-my…
• atym.io/
• linkedin.com/company/atym-inc
• atym.io/discord

youtube.com/embed/MoN2rTCmUKI?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2025/11/12/floss-…

Radio Apocalypse: Survivable Low-Frequency Communication System

In the global game of nuclear brinksmanship, secrets are the coin of the realm. This was especially true during the Cold War, when each side fielded armies of spies to ferret out what the other guy was up to, what their capabilities were, and how they planned to put them into action should the time come. Vast amounts of blood and treasure were expended, and as distasteful as the whole thing may be, at least it kept armageddon at bay.

But secrets sometimes work at cross-purposes to one’s goals, especially when one of those goals is deterrence. The whole idea behind mutually assured destruction, or MAD, was the certain knowledge that swift retaliation would follow any attempt at a nuclear first strike. That meant each side had to have confidence in the deadliness of the other’s capabilities, not only in terms of their warheads and their delivery platforms, but also in the systems that controlled and directed their use. One tiny gap in the systems used to transmit launch orders could spell the difference between atomic annihilation and at least the semblance of peace.

During the height of the Cold War, the aptly named Survivable Low-Frequency Communication System was a key part of the United States’ nuclear deterrence. Along with GWEN, HFGCS, and ERCS, SLFCS was part of the alphabet soup of radio systems designed to make sure the bombs got dropped, one way or another.

Skipping the Skip

Nuking the atmosphere, for science. The Starfish Prime tests showed how easily one could deprive one’s enemy of the use of the ionosphere. Source: USAF 1352nd Photographic group, public domain.
The hams have a saying: “When all else fails, there’s amateur radio.” It’s true, but it comes with a huge caveat, since hams rely on the ionosphere to bounce their high-frequency (HF) signals around the world. Without that layer of charged particles, their signals would just shoot off into space instead of traveling around the world.

For the most part, the ionosphere is a reliable partner in amateur radio’s long-distance communications networks, to the point that Cold War military planners incorporated HF links into their nuclear communications systems. But since at least the Operation Argus and Operation Hardtack tests in 1958, the United States had known about the effect of high-altitude nuclear explosions on the ionosphere. Further exploration of these effects through the Starfish Prime tests in 1962 revealed just how vulnerable the ionosphere is to direct attack, and how easy it would be to disrupt HF communications networks.

The vulnerability of the ionosphere to attack was very much in the minds of U.S. Air Force commanders during the initial design sessions that would eventually lead to SLFCS. They envisioned a system based on the propagation characteristics of the EM spectrum at lower frequencies, in the low-frequency (LF) and very-low-frequency (VLF) bands. While wavelengths in the HF part of the spectrum are usually measured in meters, LF and VLF waves are better measured in kilometers, ranging between 1 and 100 kilometers.

At these wavelengths, radio behaves very differently than they do further up the dial. For LF signals (30 to 300 kHz), the primary mode of propagation is via ground waves, in which signals induce currents in the Earth’s surface. These currents tend to hug the surface, bending with its curvature and propagating long distances. For VLF signals (3 to 30 kHz), Earth-ionosphere waveguide propagation dominates. Thanks to their enormous wavelengths, which are comparable to the typical altitude of the lowest, or D-layer, of the ionosphere, the waves “see” the space between the ground and the ionosphere as a waveguide, which forms a low-loss path that efficiently guides them around the globe.

Critically for the survivability aspect of SLFCS, both of these modes are relatively immune to the ionospheric effects of a nuclear blast. That’s true even for VLF, which would seem to rely on an undisturbed ionosphere to form the “roof” of the necessary waveguide, but the disruption caused by even a large blast is much smaller than their wavelengths, rendering any changes to the ionosphere mostly invisible to them.

Big Sticks

Despite the favorable propagation modes of LF and VLF for a communications system designed to survive a nuclear exchange, those long wavelengths pose some challenges. Chief among these is the physical size of the antennas necessary for these wavelengths. In general, antenna size is proportional to wavelength, which makes the antennas for LF and VLF quite large, at least on the transmitting side. For SLFCS, two transmission sites were used, one at Silver Creek, Nebraska, and another in the middle of the Mojave Desert in Hawes, California. Since ground wave propagation requires a vertically polarized signal, each of these sites had a guyed mast radiator antenna 1,226 feet (373 meters) tall.

While the masts and guy wire systems were as reinforced as possible, there’s only so much that can be done to make a structure like that resist a nuke. Still, these structures were rated for a “moderate” nuclear blast within a 10-mile (16-km) radius. That would seem to belie the “survivable” goal of the system, since even at the time SLFCS came online in the late 1960s, Soviet ICBM accuracy was well within that limit. But the paradox is resolved by the fact that SLFCS was intended only as a backup method of getting launch orders through to ICBM launch facilities, to be used to launch a counterattack after an initial exchange that hit other, more valuable targets (such as the missile silos themselves), leaving the ionosphere in tatters.

The other challenge of LF/VLF communications is the inherently low data transfer rates at these frequencies. LF and VLF signals only have perhaps a kilohertz to as few as a few hertz of bandwidth available, meaning that they can only encode data at the rate of a few tens of bits per second. Such low data rates preclude everything but the most basic modulation, such as frequency-shift keying (FSK) or its more spectrally efficient cousin, minimum-shift keying (MSK). SLFCS transmitters were also capable of sending plain old continuous wave (CW) modulation, allowing operators to bang out Morse messages in a pinch. When all else fails, indeed.

No matter which modulation method was used, the idea behind SLFCS was to trade communications speed and information density for absolute reliability under the worst possible conditions. To that end, SLFCS was only intended to transmit Emergency Action Messages (EAMs), brief alphanumeric strings that encoded specific instructions for missile commanders in their underground launch facilities.

Buried Loops

SLFCS receiver equipment giving off Fallout vibes in the Oscar-Zero launch control center at the Ronald Reagan Minuteman Missile State Historic Site.
While the transmitting side of the SLFCS equation was paradoxically vulnerable, the receiving end of the equation was anything but. These missile alert facilities (MAFs), sprinkled across the upper Midwest, consisted of ten launch facilities with a single Minuteman III ICBM in an underground silo, along with one underground launch control center, or LCC. Above ground, the LCC sports a veritable antenna farm representing almost the entire RF spectrum, plus a few buried surprises, such as the very cool HFGCS antenna silos, which can explosively deploy any of six monopole antennas up from below ground to receive EAMs after the LCC has gotten its inevitable nuking.

The other subterranean radio surprise at LCCs is the buried SLFCS antenna. The buried antenna takes advantage of the induced Earth currents in ground wave propagation, and despite the general tendency for LF antennas to be large is actually quite compact. The antennas were a magnetic loop design, with miles of wire wrapped around circular semi-rigid forms about 1.5 meters in diameter. Each antenna consisted of two loops mounted orthogonally, giving the antenna a globe-like appearance. Each loop of the antenna was coated with resin to waterproof and stiffen the somewhat floppy structure a bit before burying it in a pit inside the LCC perimeter fence. Few examples of the antenna exist above ground today, since most were abandoned in place when SLFCS was decommissioned in the mid-1980s. One SLFCS antenna was recently recovered, though, and is currently on display at the Titan Missile Museum in Arizona.

youtube.com/embed/VkNHlF6pEmM?…

Sign of the Times

Like many Cold War projects, the original scope of SLFCS was never fully realized. The earliest plans called for around 20 transmit/receive stations, plus airplanes equipped with trailing wire antennas over a mile long, and more than 300 receive-only sites across the United States and in allied countries. But by the time plans worked their way through the procurement process, technology had advanced enough that military planners were confident that they had the right mix of communications modes for the job. In the end, only the Nebraska and California transmit/receive sites were put into service, and even the airborne transmitters idea was shelved thanks to excessive drag caused by that long trailing wire. Still, the SLFCS towers and the buried loop antennas stayed in service until the mid-1980s, and the concept of LF and VLF as a robust backup for strategic comms lives on with the Air Force’s Minimum Essential Emergency Communications Network.

hackaday.com/2025/11/12/radio-…