На тлі скандалу зі знущанням дітей: Тисячі людей вийшли на мітинг проти уряду Орбана

Тисячі угорців заполонили вулиці Будапешта, обурені шокуючим відео знущань з дітей у виправній колонії. Люди вимагали дій від влади після того, як спливли подробиці про насильство та зґвалтування в державних закладах.

Нам потрібні юридично зобов’язуючі гарантії, а не Будапештський меморандум, - Зеленський

"На сьогодні ми не хочемо повторення війни після припинення вогню. Тому для нас обов’язковими є саме юридично зобов’язуючі гарантії, а не Будапештський меморандум. У випадку зі Сполученими Штатами такі консультації вже проводяться", - сказав президент.

As #Poland is now enacting the EU #DSA into its law, there’s a significant outcry about “censorship” from some political groups… and, of course, the usual #BigTech suspects - #Facebook and #Twitter. Just like the infamous Rubio statement about what these companies were really fined for by EU (for mass-scale scams, not opposition to “censorship”), the censorship argument in DSA is a complete manipulation.

I have many friends who work in incident response, fraud prevention in Poland (and elsewhere) and they seem to be absolutely disgusted by the scale to which these platforms became literally facilitators of the crime, protecting scammers rather than their victims. Here’s what one of them just wrote on LinkedIn:

Why does Facebook, in its business model, consciously profit from scams that are advertised? Why do they accept money from criminals who steal from platform users?

The same Facebook recently banned posts in which CERT Polska and others (including me) warned about the filth pouring into the feed on this portal. They made a silly excuse that ‘it’s the algorithms’…

Here, as a reminder, is a post that quickly disappeared from Facebook for a long time. cert.pl/posts/2024/11/Oszustwa…

So just to reiterate: you can report obvious scams on Facebook as much as you like, but they’re almost never deleted. But then a Polish CERT (computer incident response organisation) posts a warning about scams to Facebook users and Facebook moderation jumps on it in an instant, hiding that post from everyone.

And that’s precisely why not only EU but every country protecting its citizens needs law like DSA.

P.S. on my last visit to Poland I, as usual, had to remove a ton of spyware from my mom’s laptop. She spends plenty of time on Facebook and it’s always “the computer told me I need to install updates”, meaning of course the scam pretending to be Windows messages displayed right in her Faceboook feed.

On LinkedIn, a friend running a company in #POland describe a wave of fraud involving their company’s customer in #Italy receiving a perfectly forged invoice with a changed account number, obviously from a fake email address. The Italians transfer money there and complain that they have been defrauded. Of course, they complain to the company whose invoice has been forged. Conclusion from a lengthy discussion: ‘nothing can be done’.

Well, for about 20 years, something can be done: electronic signatures are available in every PDF creation app and every email app. And that is exactly what they are for.

All you need to do is include in the contract with the customer what I have been doing with my invoices for a long time:

1. that invoices are sent only from the specified domain
2. that invoices are sent in PDF format with a digital signature
3. that email communication, at least with the accounting department, is also electronically signed with S/MIME

The cost of an MV (mailbox validated) certificate is a few euros (!) per year. And that’s for a a WebTrust certificate, which can be verified in any browser and operating system, globally.

Video filmed in almost exactly 12 years ago, on 9 December 2013 - hundreds of thousands of people gathered in #Kyiv on #Euromaidan to protest against arbitrary decision by #Yanukovych to cancel the process of signing the EU Association Agreement, which he promised for the whole year, only to backtrack after a covert meeting with #Putin. In total, over a million of people protested over three winter months in the whole country.

video.echelon.pl/w/dpoGaEBfFpa…

Back then Ukrainians faced two choices: keep quiet and continue living under corrupt government, with stagnating economy and lawlessness ruling their daily lives just like Russians do, or take up the fight.

I think the video is also the best illustration to how nonsensical all these theories about “CIA coup” invented by Russians are - you can’t keep a million of people (out of 30m country) protesting for three months in harsh Eastern European winter on salary. They were really desperate and motivated to fight for their freedom.

For comparison, in 2012 when #Putin decided he’s going for his third presidential term in violation of the Constitution, around 160’000 Russians protested across the 130m country… for three days. Respect to those who did, disgrace to the 99.9% who didn’t.

Just added English subtitles to this truly epic video compilation by journalist Denis Kazansky who collected all quotes summarising the epic failure of #Russia in #Kupyansk

video.echelon.pl/w/jzNSxwRLUNC…

What has happened?

• On 20 November 2025 general Valery Gerasimov publicly announced that “Army Group ‘Zapad’ liberated the town of Kupyansk”.
• General Sergey Kuzovlev reiterated the news in the presence of Putin, wearing a quasi-military uniform, who clarified “so that’s it, completed it all?” to Kuzovlev’s confirmation. For the “liberation of Kupyansk” Kuzovlev was awarded Hero of Russia.
• On 21 November Putin himself declared “the events in Kupyansk will unavoidably repeat on other key front line locations; maybe not as fast as we wished, but this is unavoidable - and in general, it works for us”.
• On 27 November while speaking to journalists, Putin once again referred to Kypyansk, saying that “as we know the enemy formations are fully liquidated there”.

And the story, of course, culminates with now famous video of #Ukraine president Zelensky standing right in the middle of the same Kupyansk on 12 December and recording at video at distinctive town sign:

video.echelon.pl/w/u1sDdipjnjp…

Need For Speed Map IRL

When driving around in video games, whether racing games like Mario Kart or open-world games like GTA, the game often displays a mini map in the corner of the screen that shows where the vehicle is in relation to the rest of the playable area. This idea goes back well before the first in-vehicle GPS systems, and although these real-world mini maps are commonplace now, they don’t have the same feel as the mini maps from retro video games. [Garage Tinkering] set out to solve this problem, and do it on minimal hardware.

Before getting to the hardware, though, the map itself needed to be created. [Garage Tinkering] is modeling his mini map on Need For Speed: Underground 2, including layers and waypoints. Through a combination of various open information sources he was able to put together an entire map of the UK and code it for main roads, side roads, waterways, and woodlands, as well as adding in waypoints like car parks, gas/petrol stations, and train stations, and coding their colors and gradients to match that of his favorite retro racing game.

To get this huge and detailed map onto small hardware isn’t an easy task, though. He’s using an ESP32 with a built-in circular screen, which means it can’t store the whole map at once. Instead, the map is split into a grid, each associated with a latitude and longitude, and only the grids that are needed are loaded at any one time. The major concession made for the sake of the hardware was to forgo rotating the grid squares to keep the car icon pointed “up”. Rotating the grids took too much processing power and made the map updates jittery, so instead, the map stays pointed north, and the car icon rotates. This isn’t completely faithful to the game, but it looks much better on this hardware.

The last step was to actually wire it all up, get real GPS data from a receiver, and fit it into the car for real-world use. [Garage Tinkering] has a 350Z that this is going into, which is also period-correct to recreate the aesthetics of this video game. Everything works as expected and loads smoothly, which probably shouldn’t be a surprise given how much time he spent working on the programming. If you’d rather take real-world data into a video game instead of video game data into the real world, we have also seen builds that do things like take Open Street Map data into Minecraft.

Thanks to [Keith] for the tip!

youtube.com/embed/sAp7oCB939c?…

hackaday.com/2025/12/14/need-f…

GhostFrame: il primo framework PhaaS interamente basato su iframe

Barracuda ha pubblicato i dettagli di un nuovo kit di phishing-as-a-service (PhaaS) elusivo e stealth che nasconde i contenuti dannosi all’interno di iframe di pagine web per eludere il rilevamento e massimizzare la flessibilità.

È la prima volta che Barracuda rileva un framework di phishing completo costruito attorno alla tecnica degli iframe.

Gli analisti delle minacce monitorano il nuovo PhaaS da settembre 2025 e lo hanno soprannominato GhostFrame. Ad oggi, a questo kit sono stati attribuiti oltre un milione di attacchi.

L’analisi tecnica di Barracuda dimostra che la funzionalità di GhostFrame è apparentemente semplice, ma molto efficace.

A differenza della maggior parte dei kit di phishing, GhostFrame utilizza un semplice file HTML apparentemente innocuo, in cui tutte le attività dannose si svolgono all’interno di un iframe, una piccola finestra all’interno di una pagina web che può visualizzare contenuti provenienti da un’altra fonte. Questo approccio fa apparire la pagina di phishing autentica, nascondendone però la vera origine e il vero scopo.

Le caratteristiche più importanti di GhostFrame includono:

• Un file HTML esterno dall’aspetto innocuo che non contiene alcun contenuto di phishing che potrebbe attivare il rilevamento e utilizza codice dinamico per generare e manipolare i nomi dei sottodomini, in modo che ne venga generato uno nuovo per ogni destinazione.
• Tuttavia, all’interno di questa pagina sono presenti dei puntatori incorporati che indirizzano gli utenti a una pagina di phishing secondaria tramite un iframe.
• La pagina iframe ospita i componenti di phishing veri e propri. Gli aggressori nascondono i moduli di acquisizione delle credenziali all’interno di una funzione di streaming di immagini progettata per file di grandi dimensioni, rendendo difficile per gli scanner statici, che in genere cercano moduli di phishing hardcoded, rilevare l’attacco.
• Il design dell’iframe consente agli aggressori di modificare facilmente il contenuto di phishing, testare nuovi trucchi o prendere di mira regioni specifiche, il tutto senza modificare la pagina web principale che distribuisce il kit. Semplicemente aggiornando la destinazione dell’iframe, il kit può eludere il rilevamento da parte degli strumenti di sicurezza che controllano solo la pagina esterna.
• Come altri kit di phishing di nuova generazione, GhostFrame impedisce e interrompe in modo aggressivo l’ispezione. Tra le altre cose, blocca il clic destro del mouse, blocca il tasto F12 (utilizzato per gli strumenti di sviluppo) e il tasto Invio, e impedisce l’uso di scorciatoie da tastiera comuni come Ctrl/Cmd e Ctrl/Cmd+Shift. Queste scorciatoie sono spesso utilizzate dagli analisti della sicurezza per visualizzare il codice sorgente, salvare pagine o aprire strumenti di sviluppo.

Le email di phishing di GhostFrame alternano temi tradizionali, come falsi accordi commerciali e falsi aggiornamenti delle risorse umane. Come altre email di phishing, sono progettate per indurre i destinatari a cliccare su link pericolosi o a scaricare file dannosi.

“La scoperta di GhostFrame evidenzia la rapidità e l’intelligenza con cui i kit di phishing si stanno evolvendo. GhostFrame è il primo esempio che abbiamo visto di una piattaforma di phishing basata quasi esclusivamente su iframe, e gli aggressori stanno sfruttando appieno questa funzionalità per aumentare la flessibilità ed eludere il rilevamento” , ha affermato Saravanan Mohankumar, direttore dell’analisi delle minacce di Barracuda.

“Per rimanere protette, le organizzazioni devono andare oltre le difese statiche e adottare strategie multilivello: formazione degli utenti, aggiornamenti regolari del browser, strumenti di sicurezza per rilevare iframe sospetti, monitoraggio continuo e condivisione di informazioni sulle minacce”.

L'articolo GhostFrame: il primo framework PhaaS interamente basato su iframe proviene da Red Hot Cyber.