An anonymous reader quotes a report from Ars Technica: Security researchers are tracking what they say is the “mass exploitation” of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open source file-sharing server app. The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said, they began observing “mass exploitation” in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13.

CVE-2023-49103 resides in versions 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, depending on the way they’re configured. A third-party code library used by the app provides a URL that, when accessed, reveals configuration details from the PHP-based environment. In last week’s disclosure, ownCloud officials said that in containerized configurations — such as those using the Docker virtualization tool — the URL can reveal data used to log in to the vulnerable server. The officials went on to warn that simply disabling the app in such cases wasn’t sufficient to lock down a vulnerable server. […]

To fix the ownCloud vulnerability under exploitation, ownCloud advised users to: “Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php. Additionally, we disabled the phpinfo function in our docker-containers. We will apply various hardenings in future core releases to mitigate similar vulnerabilities.

We also advise to change the following secrets:
– ownCloud admin password
– Mail server credentials
– Database credentials
– Object-Store/S3 access-key”

Read more of this story at Slashdot.

Source: Slashdot – ownCloud Vulnerability With Maximum 10 Severity Score Comes Under ‘Mass’ Exploitation

Windows users are reporting that Hewlett Packard’s HP Smart application is appearing on their systems, despite them not having any of the company’s hardware attached. From a report: While Microsoft has remained tight-lipped on what is happening, folks on various social media platforms noted the app’s appearance, which seems to afflict both Windows 10 and Windows 11. The Windows Update mechanism is used to deploy third-party applications and drivers as well as Microsoft’s updates, and we’d bet someone somewhere has accidentally checked the wrong box.

Up to now, the response from affected users has been one of confusion. One noted on Reddit: “I thought that was just me. I didn’t install it, it just appeared on new apps in start menu out of nowhere.” Another said: “I just checked and I had it installed too. Checking the event log for the Microsoft Store shows that it installed earlier today, but I definitely did [not] request or initiate it because I do not have any devices from HP.” And, of course, there was the inevitable: “Would it be that hard for Microsoft to just provide an operating system without needless bloat?” To be clear, not all users are affected.

Read more of this story at Slashdot.

Source: Slashdot – HP Printer Software Turns Up Uninvited on Windows Systems

An anonymous reader shares a report: In late September, an arsonist set fire to a storage shed at Memorial Park used by the Santa Monica Pickleball Club, torching thousands of dollars worth of nets, rackets, balls, and other pickleball equipment. “Unknown suspect(s) caused a fire that damaged city property (Tennis Court Gate),” a police report I obtained using a public records request says. The report adds that there is body camera footage of the incident and police-shot photos, but the city refused to release them to me because there is an ongoing investigation. The arsonist is still at large.

We still don’t know the motive behind the arson, but the news caught my attention because it happened while I was in the midst of trying to understand what I’ve been calling the pickleball wars. For the last few months I’ve been trying to understand what’s been happening behind-the-scenes in cities large and small by filing public records requests aimed at learning how common beefs about pickleball are, and what’s causing them.

If you don’t already know about “the fastest growing sport,” Pickleball is kind of like tennis, but played on a court a quarter of the size using a plastic ball similar to a wiffle ball and a hard racket. The smaller court, hard ball, and hard racket means that pickleball is louder than tennis, a fact that is brought up very often by homeowners and homeowner associations who claim, somewhat dubiously, that the noise from pickleball drives down their home values. My hypothesis going into researching this article was that people who live in cities are mad at the noise created during the act of playing pickleball and they have probably complained to the government about it. What I found was surprisingly more complex: Thousands of pages of documents I’ve reviewed show that pickleball’s surging popularity is overwhelming under-resourced parks departments in city governments all over the country.

Read more of this story at Slashdot.

Source: Slashdot – Local Governments Overwhelmed By Tennis-Pickleball Turf Wars, Documents Show

Traumatic memories had their own neural mechanism, brain scans showed, which may help explain their vivid and intrusive nature. From a report: At the root of post-traumatic stress disorder, or PTSD, is a memory that cannot be controlled. It may intrude on everyday activity, thrusting a person into the middle of a horrifying event, or surface as night terrors or flashbacks. Decades of treatment of military veterans and sexual assault survivors have left little doubt that traumatic memories function differently from other memories. A group of researchers at Yale University and the Icahn School of Medicine at Mount Sinai set out to find empirical evidence of those differences.

The team conducted brain scans of 28 people with PTSD while they listened to recorded narrations of their own memories. Some of the recorded memories were neutral, some were simply “sad,” and some were traumatic. The brain scans found clear differences, the researchers reported in a paper published on Thursday in the journal Nature Neuroscience. The people listening to the sad memories, which often involved the death of a family member, showed consistently high engagement of the hippocampus, part of the brain that organizes and contextualizes memories. When the same people listened to their traumatic memories — of sexual assaults, fires, school shootings and terrorist attacks — the hippocampus was not involved.

[…] Indeed, the authors conclude in the paper, “traumatic memories are not experienced as memories as such,” but as “fragments of prior events, subjugating the present moment.” The traumatic memories appeared to engage a different area of the brain — the posterior cingulate cortex, or P.C.C., which is usually involved in internally directed thought, like introspection or daydreaming. The more severe the person’s PTSD symptoms were, the more activity appeared in the P.C.C. What is striking about this finding is that the P.C.C. is not known as a memory region, but one that is engaged with “processing of internal experience,” Dr. Schiller said.

Read more of this story at Slashdot.

Source: Slashdot – Brain Study Suggests Traumatic Memories Are Processed as Present Experience