from the willy-nilly dept

We’ve talked for many years about Nintendo’s shotgun approach to IP enforcement, as well as its heavy-handed ToS enforcement policies that can include bricking customer consoles and/or banning their accounts if they do something Nintendo doesn’t like, even if it’s not strictly illegal. This has all set up an ecosystem where being a Nintendo fan and customer can feel like a dangerous prospect, where navigating a capricious company is supposed to be half the fun.

But when that same ecosystem is setup in a way that is wide open to abuse, the fun really begins. That appears to be what is happening right now as Nintendo is removing hundreds of Mario Maker 2 levels made by fans.

The common denominator for these level deletions appears to be the inclusion of a hashtag for “TeamShell,” which is a Discord server dedicated to sharing codes for levels made within the game. Notices about the removal from Nintendo indicate that they were deleted for including “advertising”, which is against Nintendo’s terms of service.

There is no indication that any money is changing hands here. Calling a hashtag to denote that a level was made with a specific Discord server in mind “advertising” is stretching the definition to the point of absurdity. On top of all of this, many of these levels are years old, causing the community to wonder why in the world this was suddenly happening now.

Then someone found this on another Discord server dedicated to the Mario Maker games.

So, who is LMT?

Turns out, the YouTube account linked to LMT’s Discord profile bears the pseudonym of someone called MT94. As explained in a post on AtWiki, MT94 was, at one point, the second-highest-rated Super Mario Maker player in the world.

Turns out that MT94 cheated their way to that ranking, and they achieved this by using three separate Nintendo Switch consoles. By consistently challenging their own accounts to co-op battles in the game, they managed to boost themselves up the rankings. After the community found out and reported them, MT94’s accounts were banned.

Now, I’ve seen some content out there indicating it was TeamShell that had a hand in exposing MT94’s alleged cheating, but nothing solid enough that I consider firm ground. But it’s clear that there is some kind of vendetta at work here. And, while most of you probably view the deletion of some Mario Maker levels as a tame story at most, it is having very real consequences due to how Nintendo conducts it business.

The truly sad thing is that Super Mario Maker users are also reporting that their Nintendo Switch accounts are being suspended as well, as there seems to be a sort of automatic system in place that suspends a Nintendo Switch account if it’s been associated with a certain number of reports.

Nintendo has a choice. It can remain heavy-handed in this manner when it comes to account suspensions for takedowns, but then it needs to actually investigate claims like this to ensure they aren’t falling for abusive takedown requests. Or it can ease up on the severity of its actions and allow for a counternotice system, or another manner for those falsely accused to avoid consequences.

What it should not be allowed to do is continue to let its own customers suffer severe consequences merely because the system it set up is so wide open for this kind of gleeful abuse.

Filed Under: fans, mario maker, takedowns, teamshell

Companies: nintendo

If you like getting your daily cup of coffee from Starbucks, you’ll now be able to consult with ChatGPT for your next beverage. Starbucks said on Wednesday that a new Starbucks app in ChatGPT, now in beta, will help you figure out your next order based on your mood or craving in the moment. 

Enlarge Image

Advertisement

OpenAI has added a host of other apps you can interact with in ChatGPT since announcing the functionality last year. You can do everything from browsing home listings to designing playlists without leaving the chatbot interface. 

You’ll be able to use prompts like, “@Starbucks, I want something bright to start my morning,” or upload an image to describe your mood and location. Once the menu suggestion appears in ChatGPT, you can start the order through the chatbot and then complete it in the Starbucks app or online. 

Paul Riedel, senior vice president of digital and loyalty at Starbucks, said in a statement that Starbucks noticed customers weren’t always starting off by looking at the menu. “They’re starting with a feeling,” he said. “We wanted to meet customers right in that moment of inspiration and make it easier than ever to find a drink that fits.”  

Enlarge Image

A new malware family named ‘AgingFly’ has been identified in attacks against local governments and hospitals that steal authentication data from Chromium-based browsers and WhatsApp messenger.

The attacks were spotted in Ukraine by the country’s CERT team last month. Based on the forensic evidence, targets may also include representatives of the Defense Forces.

CERT-UA has attributed the attacks to a cyber threat cluster it tracks as UAC-0247.

Attack chain

According to the Ukrainian agency, the attack begins with the target receiving an email purporting to be a humanitarian aid offer, which encourages them to click an embedded link.

The link redirects to a legitimate site that had been compromised via a cross-site scripting (XSS) vulnerability, or to a fake site generated using an AI tool.

CERT-UA says that the target receives an archive with a shortcut file (LNK) that launches a built-in HTA handler, which in turn connects to a remote resource to retrieve and execute the HTA file.

The HTA displays a decoy form to divert attention and creates a scheduled task that downloads and runs an EXE payload that injects shellcode into a legitimate process.

Next, the attackers deploy a two-stage loader in which the second stage uses a custom executable format, and the final payload is compressed and encrypted.

“A typical TCP reverse shell or an analogue classified as RAVENSHELL can be used as stagers, which provides for establishing a TCP connection with the management server,” CERT-UA says in a report today.

A TCP connection encrypted using the XOR cipher is established to the C2 server for executing commands via the Command Prompt in Windows.

In the next stage, the AgingFly malware is delivered and deployed. At the same time, a PowerShell script (SILENTLOOP) is used to execute commands, update the configuration, and retrieve the C2 server address from a Telegram channel or fallback mechanisms.

After investigating a dozen such incidents, the researchers determined that the attacker is stealing browser data using the open-source security tool ChromElevator that can decrypt and extract sensitive information, like cookies and saved passwords, from Chromium-based browsers (e.g., Google Chrome, Edge, Brave) without needing administrator privileges.

The threat actor also tries to extract sensitive data from the WhatsApp application for Windows by decrypting databases using the ZAPiDESK open-source forensic tool.

According to the researchers, the actor engages in reconnaissance activity and tries to move laterally on the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools. 

Compiling source code on the host

AgingFly is a C# malware that provides its operators with remote control, command execution, file exfiltration, screenshot capture, keylogging, and arbitrary code execution.

It communicates with its C2 server via WebSockets and encrypts the traffic using AES-CBC with a static key.

The researchers note that a particularity of the AgingFly malware is that it does not include pre-built command handlers; instead, it compiles them on the host from source code received from the C2 server.

“A distinguishing feature of AGINGFLY compared to similar malware is the absence of built-in command handlers in its code. Instead, they are retrieved from the C2 server as source code and dynamically compiled at runtime,” CERT-UA explains.

The benefits of this approach include a smaller initial payload, the ability to change or extend capabilities on demand, and the potential to evade static detection.

However, this unusual approach adds complexity, relies on C2 connectivity, a larger runtime footprint, and ultimately increases detection risk.

CERT-UA recommends that users block the launch of LNK, HTA, and JS files to disrupt the attack chain used in this campaign.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Advertisement

Get Your Copy Now

Introduction

SteelSeries has been quietly working to improve its lineup of gaming peripherals for some time now and the Aerox 3 Gen 2 is the latest product to be sent back to the drawing board. And it’s clear that with a new sensor, improved battery life, a higher polling rate, and a refined design, Steelseries isn’t playing around. 

But is it enough to earn a place on our best gaming mouse list? We put the ultralight mouse to the test over the course of two weeks – and I’ve been left pretty impressed.

Design and Performance

• Similar design to the Aerox 3 Wireless
• Flatter design makes it perfect for small hands
• A new gap between the side buttons improves control

SteelSeries hasn’t reinvented the wheel with Gen 2. The mouse still looks and feels similar to the original 2022 version – with a few small differences to address those concerns of creaking and mushy buttons, of course.

The body is still lightweight with a flatter palm rest, which is perfect for smaller hands and different grip styles. I’ve been rocking my trusty Logitech G Pro Wireless mouse for a while and I was surprised by how quickly I took to the Aerox – its shape fitting effortlessly in my hand.

The flatter design means my smaller hands were able to reach the side buttons with relative ease during gaming. These sit proud from the main body and have a smoother texture, allowing you to pick them out during intense gaming sessions. They also have a more noticeable gap from its predecessor, which made it easier to identify what button I was pressing in the heat of battle.

The mouse itself has more of a coarse texture – similar to that of the original version – making it feel grippy despite your grip style. SteelSeries says it comes with an IP54 rating, which protects it against dirt, dust, and water and while it’s certainly better than my Logitech mouse, I have noticed some lingering fingerprints on the mouse buttons after long sessions and small dust particles sitting on the internal parts. It’s nothing a bit of compressed air can’t fix, but if you like things to look clean and pristine, you’re going to need to bear that in mind.

The skates, which are once again made out of 100% virgin-grade PTFE, work well across several surfaces and can be replaced. On the SteelSeries GcK Heavy XL mousemat, I found the mouse was able to glide smoothly and without issues – arguably better than the Logitech. It also worked well on my desk, except the movement did not feel as smooth. Like the chassis, the gaps around the skates also attracted dirt. 

Where the mouse design has changed considerably is with the scroll wheel. The patterned design has now been replaced by a striped design, which feels grippier. It’s easy to find, despite being sunk into the chassis compared to some of the other best gaming mice, and the scrolls feel responsive. 

The mouse also comes in three new colourways: Shadow (black), Ghost (white), and Magenta Haze. These are all personal preference, but the RGB lighting will interact differently with the chassis depending on the colourway you choose. 

Under the hood is where the majority of the changes have been made with a TrueMove 26,000 DPI sensor replacing the 18,000 one found in the original model. SteelSeries has also boosted the wireless polling rate from 1000Hz to 4000Hz, improving response rates across the board. For context, polling rate refers to how frequently the mouse reports its position to your PC – at 4000Hz it’s doing that four times more often than a standard 1000Hz mouse, which translates to smoother, more responsive cursor movement, which is particularly noticeable in fast-paced competitive games. This isn’t enabled by default, though, and has a considerable knock-on effect on battery life – something I’ll talk about later.

The Aerox 3 Gen 2 is a smooth operator. The mouse feels incredibly fast, especially when increasing the DPI settings for games such as Counter-Strike 2, Battlefield 6, and Escape From Tarkov. Tracking accuracy was consistent throughout testing and the sensor held up well during faster flicks without losing tracking. The default DPI is 2400, which I’d recommend for day-to-day tasks, but this can be increased steadily using the on-board DPI button or via SteelSeries software. 

Combine this with the increased polling rate, and the Aerox 3 Gen 2’s performance in competitive shooters is genuinely impressive. The mouse felt quick and responsive, and the buttons have both low pre and post travel, resulting in a satisfying click response – although, the switches are louder and took some time to get used to. Over two weeks of heavy use, those clicks remained consistent – I didn’t feel like there was any mushiness, which is reassuring given creaking and button quality were issues on the original. 

The same could be said for the side buttons, although my small hands struggled to reach the top one unless I shifted to a more claw-like grip. That being said, I prefer them over the Logitech, simply because the shape is smaller and it fits my hand better.

Battery Life

• Major improvements over the original Aerox 3
• Offers 120 hours or 200 hours via Bluetooth (with RGB off and default settings)
• Charges fully in just over an hour

The new version of the Aerox has made considerable improvements to the battery life of the mouse with SteelSeries promising 120 hours or 200 hours via Bluetooth. This is with the mouse kept at default settings and RGB turned off, though.

In reality, though, those numbers drop pretty quickly when you start tinkering with the settings. If you switch to 4000 Hz polling rate, for example, the battery life drops to approximately 35 hours. 

Obviously this is enough to see you through a couple of gaming sessions, but if you want to get the most amount of juice out of your mouse and prevent charging during use, you’re going to want to switch off the RGB lighting and stick to default settings.

I didn’t feel too limited by the battery life – it lasted me most of the week while working and gaming, but I do feel let down by the box fresh numbers considering how feature-rich the mouse is. That being said, charging is easy to do with the long cable provided and the mouse charges fully in just over an hour.

Software and Lighting

• SteelSeries Engine is easy to use and offers lots of customisation
• RGB can be distracting
• Sensitivity Converter could be improved

As with all SteelSeries peripherals these days, you can customise the Aerox 3 Gen 2 using the SteelSeries GG app. This allows you to control the mouse’s RGB lighting and change settings – from polling rate, DPI, smoothing, acceleration, and more. The live preview mode also allows you to understand the changes you’re making as you go – removing the guesswork and making it easier for newcomers to understand.

It’s the same with the RGB settings available in the Prism menu. Here you can choose from five different effects for the lighting and 26 different presets. You also have the option to set lighting effects for when the mouse is idle and active, as well as reactive. These lights fill up the chassis from the bottom and can be seen towards the bottom of the mouse and the sides. 

The default setting is to have RGB lighting when the mouse is active, however, when it’s actively being used, the lights turn off. It’s a great way of saving battery power, but to be honest, I found it to be quite distracting and I ended up turning the lights off altogether.

That being said, I like that the RGB lighting briefly keeps you in the loop with your battery status. It flashes green briefly when it’s charged, yellow when the mouse has only 5-10% battery life left, and red every two minutes when it’s on its last legs. I found the latter quite useful while playing games, as it meant I could plug it in to charge during a quieter moment.

The software also comes with the 3D Aim Trainer and Sensitivity Converter, both of which are helpful if you’re big on shooters. While I’m a big fan of the 3D Aim Trainer, I’m less convinced by the effectiveness of the Sensitivity Converter, simply because it doesn’t really take into account some of the fast twitch movement you need for certain games.

This is disappointing given SteelSeries’ efforts to package this up in the mouse’s software. Nevertheless, the 3D Aim Trainer is a great way to test the mouse and its settings, as well as warm up before moving onto ranked competitive matches.

Should you buy it?