Connect with us
DAPA Banner

Tech

New Rowhammer attacks give complete control of machines running Nvidia GPUs

Published

on

So where do we go now?

The researchers said that both the RTX 3060 and RTX 6000 cards are vulnerable. Changing BIOS defaults to enable IOMMU closes the vulnerability, they said. Short for input-output memory management unit, IOMMU maps device-visible virtual addresses to physical addresses on the host memory. It can be used to make certain parts of memory off-limits.

“In the context of our attack, an IOMMU can simply restrict the GPU from accessing sensitive memory locations on the host,” Kwong explained. “IOMMU is, however, disabled by default in the BIOS to maximize compatibility and because enabling the IOMMU comes with a performance penalty due to the overhead of the address translations.”

A separate mitigation is to enable Error Correcting Codes (ECC) on the GPU, something Nvidia allows to be done using a command line. Like IOMMU, enabling ECC incurs some performance overhead because it reduces the overall amount of available workable memory. Further, some Rowhammer attacks can overcome ECC mitigations.

GPU users should understand that the only cards known to be vulnerable to Rowhammer are the RTX 3060 and RTX 6000 from the Ampere generation, which were introduced in 2020. It wouldn’t be surprising if newer generations of graphics cards from Nvidia and others are susceptible to the same types of attacks, but because the pace of academic research typically lags far behind the faster speed of product rollouts, there’s no way now to know.

Advertisement

Top-tier cloud platforms typically provide security levels that go well beyond those available by default on hobbyist and consumer machines. Another thing to remember: There are no known instances of Rowhammer attacks ever being actively used in the wild.

The true value of the research is to put GPU makers and users alike on notice that Rowhammer attacks on these platforms have the potential to upend security in serious ways. More information about GDDRHammer and GeForge is available here.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

How to make sure your Pixelsnap charger is properly updated

Published

on

Google has confirmed that its Pixelsnap Charger receives firmware updates automatically and silently while charging a Pixel phone, with the latest release sitting at version 1.51.0.

Pixel owners can verify their charger’s firmware status by navigating to Settings, then Connected devices, and selecting the charger from the list of paired accessories, giving users a straightforward way to confirm whether their unit is running the most current software.

The updates maintain Qi compatibility and keep the charger performing at its intended standard, with Google framing the silent background update process as a hands-off approach that requires no input from the user during normal charging use.

The automatic update mechanism sets the Pixelsnap Charger apart from the vast majority of wireless chargers on the market, where firmware is either fixed at the factory or requires proprietary software and a PC connection to update, a process that most consumers never attempt.

Advertisement

For users without a Pixel device, Google has launched a dedicated web portal at pixel.google.com/pixelsnap that enables manual firmware updates through a different method, plugging the USB-C end of the charger into any Android 16 or newer phone and visiting the page through mobile Chrome rather than a desktop browser.

Advertisement

How to update manually

The manual update process involves selecting the Pixelsnap Charger from a list of compatible devices within the web portal, granting Chrome access to the connected accessory, and following the on-screen instructions to check and install any available firmware releases.

Google updated its Pixelsnap support documentation with these details over the past three months, suggesting the manual update pathway has been available quietly for some time before receiving wider attention from users and third-party publications.

Advertisement

The $39.99 Pixelsnap Charger sits within Google’s broader Pixel accessory ecosystem, and the introduction of a firmware update infrastructure reflects a growing expectation that charging hardware should receive software support in the same way smartphones and smartwatches do.

Users can check whether their charger requires an update at any time through either the Settings menu on a paired Pixel phone or by visiting the dedicated support portal on a compatible Android device.

Source link

Advertisement
Continue Reading

Tech

Empire City launches on April 30

Published

on

Everyone’s four favorite anthropomorphic turtles are returning to the world of video games. Teenage Mutant Ninja Turtles: Empire City will be released on April 30 for the Meta Quest, Steam VR and Pico. It is made by VR game company Cortopia Studios and will retail for $25. Empire City is a first-person action game that you’ll be able to play solo or co-op with up to four people. And yes, that means all four of the turtles are playable.

We’ve seen a lot of the quartet flexing their fighting form in games over the years, but this is their first time appearing in a standalone VR title. In addition to the shelled heroes, the first part of the new game’s trailer highlights other familiar figures from the series, such as Karai of the Foot Clan and ripped rhino Rocksteady. And of course April is there providing pizza and intel.

Source link

Continue Reading

Tech

Mount Everest Climbers ‘Poisoned’ By Guides In Insurance Fraud Scheme

Published

on

schwit1 shares a report from the Kathmandu Post: In Nepal, helicopter rescue on high altitude is, by any measure, a genuine lifesaving operation. At high altitude, where oxygen thins and weather changes without warning, the ability to airlift a stricken trekker to Kathmandu within hours has saved countless lives. But threaded through that legitimate system, exploiting its urgency, its opacity, and its distance from oversight, is one of the most sophisticated insurance fraud networks in the world. Nepal’s fake rescue scam is not new. The Kathmandu Post first exposed it in 2018. Months later, the government convened a fact-finding committee, produced a 700-page report, and announced reforms. In February 2019, The Kathmandu Post published a long investigative report. Last year, Nepal Police’s Central Investigation Bureau reopened the file, and what they found is that the fraud did not stop — instead it was growing.

The mechanics of the fake rescue racket are straightforward: stage a medical emergency, call in a helicopter, check a tourist into a hospital, and file an insurance claim that bears little resemblance to what actually happened. But the sophistication lies in how each link in the chain is compensated, and how difficult it is for a foreign insurer — operating from Australia and the United Kingdom — to verify events that occurred at 3,000 metres in a remote Himalayan valley. The CIB investigation identifies two primary methods for manufacturing an “emergency.” The first involves tourists who simply don’t want to walk back. After completing a demanding trek — an Everest Base Camp trek, for instance, can take up to two weeks on foot — guides offer an alternative: pretend to be sick, and a helicopter will come. The guide handles the rest. The second method is more troubling. At altitudes above 3,000 meters, mild symptoms of altitude sickness are common. Blood oxygen saturation can drop, hands and feet tingle, headaches develop. In most cases, rest, hydration or a gradual descent is all that is needed. But guides and hotel staff, according to the CIB investigation, have been trained to terrify trekkers at precisely this moment. They tell them they are at risk of dying, that only immediate evacuation will save them. In some cases, investigators found that Diamox (Acetazolamide) tablets, used to prevent altitude sickness, were administered alongside excessive water intake to induce the very symptoms that would justify a rescue call.

In at least one case cited in the investigation, baking powder was mixed into food to make tourists physically unwell. Once a “rescue” is called, the financial choreography begins. A single helicopter carries multiple passengers. But separate, full-price invoices are submitted to each passenger’s insurance company, as if each had their own dedicated flight. A $4,000 charter becomes a $12,000 claim. Fake flight manifests and load sheets are fabricated. At the hospital, medical officers prepare discharge summaries using the digital signatures of senior doctors who were never involved in the case. In some cases, these are done without those doctors’ knowledge. Fake admission records are created for tourists who were, in some documented instances, drinking beer in the hospital cafeteria at the time they were supposedly receiving treatment. In one case, an office assistant at Shreedhi Hospital admitted that he had provided his own X-ray report taken about a year ago at a different hospital, to be used as a case for treatment of foreign trekkers to claim insurance. The commission structure that holds the network together was described in detail during police interrogations. Hospitals pay 20 to 25 percent of the insurance payment to trekking companies and a further 20 to 25 percent to helicopter rescue operators in exchange for patient referrals. Trekking guides and their companies benefit from inflated invoices. In some cases, tourists themselves are offered cash incentives to participate.

Source link

Advertisement
Continue Reading

Tech

Today’s NYT Strands Hints, Answer and Help for April 3 #761

Published

on

Looking for the most recent Strands answer? Click here for our daily Strands hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections and Connections: Sports Edition puzzles.


Today’s NYT Strands puzzle relies on you having a good knowledge of a certain category of food. Some of the answers are difficult to unscramble, so if you need hints and answers, read on.

I go into depth about the rules for Strands in this story

Advertisement

If you’re looking for today’s Wordle, Connections and Mini Crossword answers, you can visit CNET’s NYT puzzle hints page.

Read more: NYT Connections Turns 1: These Are the 5 Toughest Puzzles So Far

Hint for today’s Strands puzzle

Today’s Strands theme is: Smooth(ie) operator

Advertisement

If that doesn’t help you, here’s a clue: Not vegetables.

Clue words to unlock in-game hints

Your goal is to find hidden words that fit the puzzle’s theme. If you’re stuck, find any words you can. Every time you find three words of four letters or more, Strands will reveal one of the theme words. These are the words I used to get those hints but any words of four or more letters that you find will work:

  • CLAP, LACE, HEEL, ROLE, PIMP, CALF, TAPE, GAVE, TRAY, AMONG, PINE, REIN

Answers for today’s Strands puzzle

These are the answers that tie into the theme. The goal of the puzzle is to find them all, including the spangram, a theme word that reaches from one side of the puzzle to the other. When you have all of them (I originally thought there were always eight but learned that the number can vary), every letter on the board will be used. Here are the nonspangram answers:

  • ACAI, GUAVA, MANGO, PINEAPPLE, LYCHEE, PAPAYA

Today’s Strands spangram

completed NYT Strands puzzle for April 3, 2026

The completed NYT Strands puzzle for April 3, 2026.

NYT/Screenshot by CNET

Today’s Strands spangram is TROPICALFRUIT. To find it, look for the T that’s five letters down on the far-left vertical row, and wind across, down, over and up.

Advertisement

Source link

Continue Reading

Tech

Sony’s gaming division just bought an AI startup that turns photos into 3D volumes

Published

on

Sony Interactive Entertainment, owner of the PlayStation brand, has acquired Cinemersive Labs, a UK startup developing tools to convert 2D photos and videos into 3D volumes. The startup team will join Sony’s Visual Computing Group, a research engineering team focused on graphical technology, including game rendering, video coding and generative AI models.

Cinemersive’s most recent product is a virtual reality app called Parallax that works as a viewer for parallax photos — three-dimensional images that you can peer around with natural head movements — captured using traditional smartphones and professional cameras with stereo lenses. The startup developed custom AI tools to convert 2D images into 3D volumes to make Parallax possible, and Sony apparently wants to apply that expertise to its own projects.

“Following the acquisition, the Cinemersive Labs team will join SIE’s Visual Computing Group (VCG) and contribute to our broader efforts in advancing state of the art visual computing within games,” Sony says. “This includes applying machine learning to enhance gameplay visuals, improve rendering techniques, and unlock new levels of visual fidelity for players.”

Machine learning has been a major focus of Sony’s efforts to improve graphical performance on the PlayStation 5 and future hardware. The PlayStation 5 Pro was designed around a new GPU, faster storage and PlayStation Spectral Super Resolution (PSSR), custom AI upscaling tech that let the console run games at a lower resolution and then upscale them to 4K. The company recently squeezed even more performance out of the Pro with an updated version of PSSR it released in March. And with AMD, Sony is working on Project Amethyst, a multi-pronged collaboration to improve ray tracing and upscaling on the future consoles.

Advertisement

Source link

Continue Reading

Tech

Pan And Tilt The Weatherproof Way, With Bowden Cables

Published

on

Over the years there have been many designs for pan-and-tilt camera mounts suitable for single board computer cameras. Often they mount small servos for the movement, but those in turn present problems when the device finds its way outdoors. [GOAT Industries] is here with a novel solution to this problem, instead of trying to cover up the servos on the mount itself, the whole thing is remotely controlled by linear actuators through Bowden cables.

Testing was performed using Mole-Grips instead of actuators, and revealed a few design quirks. There are hefty springs to provide tension, and since they work against 3D printed assemblies those in turn have to be reinforced. The layout of the Bowden cable run is also important, as it has a bearing on the amount of springinesss in the system. But it provides a versatile pan-and-tilt mount for a Pi camera mounted in an IP-rated box, which is the object of the exercise.

For anyone wishing to build one the files can be found in a GitHub repository, and there’s a video below showing the device in action. Meanwhile it’s by no means the first pan-and-tilt head we’ve seen here at Hackaday, however many others are by necessity much more substantial affairs.

Advertisement

Source link

Advertisement
Continue Reading

Tech

The credibility economy. Why AI will redefine how value is measured

Published

on

A growing sense of unease is shaping how professionals engage with artificial intelligence, particularly as its capabilities expand across information creation and execution. Dan Pratl, founder of Quadron, believes this anxiety reflects a deeper structural issue that extends beyond automation and into how value itself is recognized.

We’ve reached a point at which the maturation of AI has meant that almost everyone feels insecure,” Pratl says, pointing to a broader disconnect between technological advancement and the systems designed to reward human contribution. In his view, existing frameworks for recognition and financial return have either failed to evolve or have devolved into what he frames as speculative or game-like environments, referencing developments in crypto markets and retail-driven trading ecosystems.

Pratl’s central argument is that AI is accelerating a shift that has been underway for years. “AI is very good at commoditizing knowledge and the execution of that knowledge,” he explains. “The scarce resource becomes the last mile, expertise, judgment, deployability of judgment.” As knowledge becomes increasingly abundant and execution more automated, he argues that distinguishing high-quality work from low-quality output becomes significantly more difficult, particularly for non-experts evaluating it.

This dynamic creates what Pratl refers to as a “meta problem,” where the volume of available information continues to grow, yet the mechanisms to verify credibility have not kept pace. “If you’re not an expert, all high-quality work looks the same,” he notes, underscoring that current systems offer limited ability to differentiate between accurate insight and confident but unsubstantiated claims.

Advertisement

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Within this environment, Pratl argues that visibility often substitutes for credibility. Social platforms, in his assessment, tend to reward attention instead of prioritizing accuracy, enabling what he frames as “the loudest voices” to outperform more rigorous but less visible expertise. “There’s no system to reward being right,” he says. “No mechanism to verify individuals quickly and enable non-consensus voices to have a seat at the table.

Pratl suggests that as AI-generated content becomes more prevalent, the absence of reliable credibility signals risks undermining decision-making across sectors, from business to healthcare. Research has shown that online misinformation and disinformation are estimated to cost the global economy about $78 billion per year, highlighting the severity of the situation. 

Advertisement

In response, Pratl proposes a credibility economy, which essentially means a system designed to measure, verify, and reward expertise in a more structured and scalable way. Instead of focusing on output alone, this model shifts emphasis toward judgment and trust. In doing so, it helps create mechanisms that attribute value to individuals based on the quality and impact of their decisions.

Quadron, the company he founded, is positioned as an endeavor to build the infrastructure required for such a system. According to Pratl, this involves three core components.

The first is an enterprise layer that introduces a finishing and cohesive layer for work within organizations. “I have several work productivity platforms, but what I often find missing is a finishing layer for the final, comprehensive use,” he says. This layer, Pratl explains, is intended to ensure that individuals are recognized for applying sound judgment and delivering validated outcomes, instead of contributing to ongoing workflows without clear attribution. 

The second component is a verification layer aimed at modernizing how knowledge is structured and shared. Pratl characterizes existing intellectual property systems as outdated and insufficient for the pace and scale of contemporary knowledge exchange. In their place, Quadron is developing mechanisms that allow insights to be exposed and evaluated while maintaining appropriate levels of security. 

Advertisement

The third element consists of what Pratl refers to as credibility markets, which differ from traditional prediction markets by focusing on domain-specific expertise. “It’s not generalized speculation. You’re not betting on external events where you don’t understand the odds,” he explains. Instead, these markets are designed to calibrate credibility in real time, connecting individuals with relevant expertise and allowing their judgment to be assessed within appropriate contexts. He adds, “Organizations need context and structure which requires a different methodological approach. Individuals need incentives and rewards to organize their information in that manner. We are building the systems to provide both.” 

Pratl’s perspective is informed by a career that has spanned law, open-source software, crowdfunding, and crypto, each of which, he argues, revealed limitations in how systems incentivize and sustain meaningful participation. Reflecting on these experiences, he shares, “Many such systems didn’t have the structural integrity at the incentives level to exist beyond their original creators, and they’d often lose alignment once initial motivations weakened.

A more personal catalyst emerged during a medical crisis involving his mother, where access to critical information proved inconsistent despite being technically available. “The information was centralized, but it wasn’t truly accessible,” he says, noting a system where incentives did not align with the need to surface actionable knowledge. 

The eventual outcome, he notes, depended on informal networks instead of structured systems, a reality he believes is untenable given the tools now available.

Advertisement

In the upcoming years, Pratl argues that the continued advancement of AI will only intensify these challenges unless new systems are introduced to address them. Without mechanisms that reward accuracy and surface credible expertise, he suggests that decision-making processes risk becoming increasingly dependent on visibility or chance rather than informed judgment.

We’re all experts,” he says. “Our expertise is valuable if it’s structured and surfaced in the right way.” In his view, the credibility economy represents an opportunity to realign technological progress with human value, ensuring that individuals remain active participants in AI-driven systems while also being recognized and rewarded for the quality of their contributions.

Source link

Advertisement
Continue Reading

Tech

Today’s NYT Connections: Sports Edition Hints, Answers for April 3 #557

Published

on

Looking for the most recent regular Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle and Strands puzzles.


Today’s Connections: Sports Edition has a timely theme, and if your bracket has already been busted (or even if it hasn’t been), you should do well. If you’re struggling with today’s puzzle but still want to solve it, read on for hints and the answers.

Connections: Sports Edition is published by The Athletic, the subscription-based sports journalism site owned by The Times. It doesn’t appear in the NYT Games app, but it does in The Athletic’s own app. Or you can play it for free online.

Advertisement

Read more: NYT Connections: Sports Edition Puzzle Comes Out of Beta

Hints for today’s Connections: Sports Edition groups

Here are four hints for the groupings in today’s Connections: Sports Edition puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.

Yellow group hint: More points!

Advertisement

Green group hint: Home for hoops.

Blue group hint: March Madness.

Purple group hint: Exceptional hoopsters.

Answers for today’s Connections: Sports Edition groups

Yellow group: Ways to score.

Advertisement

Green group: Areas on the basketball court.

Blue group: Locations of this year’s women’s Final Four teams.

Purple group: Women’s NCAA tournament most outstanding players.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

Advertisement

What are today’s Connections: Sports Edition answers?

completed NYT Connections: Sports Edition puzzle for April 3, 2026

The completed NYT Connections: Sports Edition puzzle for April 3, 2026.

NYT/Screenshot by CNET

The yellow words in today’s Connections

The theme is ways to score. The four answers are 3-pointer, floater, free throw and layup.

The green words in today’s Connections

The theme is areas on the basketball court. The four answers are corner, elbow, paint and wing.

Advertisement

The blue words in today’s Connections

The theme is locations of this year’s women’s Final Four teams. The four answers are Austin, Columbia, Los Angeles and Storrs.

The purple words in today’s Connections

The theme is women’s NCAA tournament most outstanding players. The four answers are Azzi, Boston, Cash and Fudd.

Source link

Advertisement
Continue Reading

Tech

What is the release date for Marshals: A Yellowstone Story episode 6 on CBS and Paramount+?

Published

on

Almost halfway through Marshals: A Yellowstone Story and the spinoff has had its closest brush with the main Yellowstone series yet.

After it was revealed that Kayce’s (Luke Grimes) ex-wife Monica (Kelsey Asbille) had died offscreen in the interim, Yellowstone fans were shocked. Now, four episodes later, Kayce has been channelling her spirit by taking it upon himself to find the area’s missing indigenous girls.

Advertisement

Source link

Continue Reading

Tech

Claude Code leak used to push infostealer malware on GitHub

Published

on

Claude Code leak used to push infostealer malware on GitHub

Threat actors are exploiting the recent Claude Code source code leak by using fake GitHub repositories to deliver Vidar information-stealing malware.

Claude Code is a terminal-based AI agent from Anthropic, designed to execute coding tasks directly in the terminal and act as an autonomous agent, capable of direct system interaction, LLM API call handling, MCP integration, and persistent memory.

On March 31, Anthropic accidentally exposed the full client-side source code of the new tool via a 59.8 MB JavaScript source map included by accident in the published npm package.

The leak contained 513,000 lines of unobfuscated TypeScript across 1,906 files, revealing the agent’s orchestration logic, permissions, and execution systems, hidden features, build details, and security-related internals.

Advertisement

The exposed code was rapidly downloaded by a large number of users and published on GitHub, where it was forked thousands of times.

According to a report from cloud security company Zscaler, the leak created an opportunity for threat actors to deliver the Vidar infostealer to users looking for the  Claude Code leak.

The researchers found that a malicious GitHub repository published by user “idbzoomh” posted a fake leak and advertised it as having “unlocked enterprise features” and no usage restrictions.

GitHub repository spreading malware
GitHub repository spreading malware
Source: Zscaler

To drive as much traffic to the bogus leak, the repository is optimized for search engines and is shown among the first results on Google Search for queries like “leaked Claude Code.”

Search result pulling users to the malicious GitHub repo
Search result for the malicious GitHub repo
Source: Zscaler

According to the researchers, curious users download a 7-Zip archive that contains a Rust-based executable named ClaudeCode_x64.exe. When launched, the dropper deploys Vidar, a commodity information stealer, along with the GhostSocks network traffic proxying tool.

Zscaler discovered that the malicious archive is updated frequently, so other payloads may be added in future iterations.

Advertisement

The researchers also spotted a second GitHub repository with identical code, but it instead shows a ‘Download ZIP’ button that wasn’t functional at the time of analysis. Zscaler estimates it is operated by the same threat actor who likely experiments with delivery strategies.

Second malicious GitHub repository
Second GitHub repository linked to the same threat actor
Source: Zscaler

Despite the platform’s defenses, GitHub has often been used to distribute malicious payloads disguised in various ways.

In campaigns in late 2025, threat actors targeted inexperienced researchers or cybercriminals with repositories claiming to host proof-of-concept (PoC) exploits for recently disclosed vulnerabilities.

Historically, attackers were quick to capitalize on widely publicized events in the hope of opportunistic compromises.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025