According to the National Association of Realtors, in 2023 there were 4,090,000 million homes sold. And real estate agents are a key part of those transactions. "The home buying process is a partnership between buyer and agent," says Lauren Cangiano, Real Estate Agent at Brown Harris Stevens. "When you are completely aligned with your agent, you can be assured success without misunderstandings and potential missed opportunities."And, as with choosing a life partner, choosing the right real estate agent makes everything that comes after either easier or harder. Especially because purchasing a home is an overwhelming process that requires knowledge most buyers dont havebut real estate agents should."Between interest rates, national practice changes with regards to how buyers are required to work with a real agent to represent them, interpreting market data and understanding the complexities in the market, it is important to have a trusted confidant by your side," says Cara Ameer, Real Estate Broker/Salesperson at Coldwell Banker Realty Vanguard.But how do you find the right personand make sure they're giving you the best advice for house-hunting and buying? By asking the right questions. We interviewed experts to come up with a cheat sheet of what you need to be asking your potential real estate agent at each step in your home-buying process. Read on for the info, and then all you have to do is find potential agents and pop the right questions. Related StoriesQuestions to Ask When Hiring a Real Estate AgentBefore you commit, get to know your prospective agent and make sure they're the real deal. And don't forget to ask for client testimonials and references, and check up on those, too! "When a home buyer is shopping for an agent, the best place to garner information is from their past clients," says Jo Ann Bauer, Associate Broker / Realtor at Coldwell Banker. "Ask the agent if you can call some of their past clients." And, while you're at it, ask them the following queries, too:What is your level of experience in the industry and this particular area?You know what you're looking for: A single-family home in a good school district? A luxury apartment with concierge services? A cottage on a golf course? Whatever it is, your agent should be an expert in that arena. "It is important that the agent has a deep understanding of the product itself and the sales data for the area," says Cangiano. "As agents, we have access to data that the buyer does not have. We must be able to show the value that the consumer is getting whether it is in the price or the quality and finishes of the home."Choosing a real estate agent who is highly knowledgeable about the type of property you are looking to buy is a major benefit that can offer unique insights into the buying process, potential challenges, and market nuances. "For example, purchasing a waterfront home may involve understanding flood zones, while a luxury condo may have specific HOA requirements or amenities that an experienced agent can guide you through," says Donna J. Soda, Real Estate Agent at Schemmel Soda Group. The agent doesn't just need to be good at gathering intel; they need to be able to use that info to negotiate on your behalf. To that end, she adds, it's also important to ask: What is your listing price discount obtained for buyers? This will show their negotiation experience, Cangiano says.Can you walk me through your standard buyer representation agreement?Ameer suggests that you ask the agents you are talking to about buyer representation agreements in the market where you are located, and what options are available for buyer representation."Because of practice changes that went into effect August 17th, 2024, buyers are now required to sign a buyer representation agreement with their agent before they can start working together to see properties," she explains. You'll want to know what yours stipulates. It's an important piece of the conversation between an agent and a prospective buyer because such an agreement outlines both your and the agent's responsibilities and sets forth the buyer's agent's compensation for their services provided.Why should I hire you?As a buyer, you should consider communicating with a potential realtor like a job interview process. This question is direct and can offer you insight into their confidence. "The agent is basically applying for the job of being their real estate agent and should be able to clearly and concisely outline to the buyer what skill sets or areas of expertise they are bringing to the table and how and why they are the best candidate for the job," says Bauer. How many buyers/sellers are you working with at the moment?You should be a priority to your real estate agent in your search, which is why you should check in about their current client load. "It is important to understand how much time your agent is prepared to dedicate to your home buying journey," says Cangiano. "If your agent has a full line up of both buyers and sellers, can they give you the time and energy that you need?" According to the National Association of Realtors, real estate agents complete an average of 12 transactions a yearconsidered the ideal benchmark for realtors, and a good number to keep in mind when choosing your realtor.Who are you representing in this transaction?This question is important to protect your interests if your real estate agent is associated with the seller. When an agent represents both the buyer and seller, this is called dual agency, and it can result in the agent being pulled into directions, wanting to get the best price for the seller and the best deal for the buyer, which can often be counterproductive, if not impossible. If it turns out the agent you found the house with is also representing the seller, "you may want to consider hiring a different agent to represent your interest and negotiate on your behalf," says Cangiano. What's your availability for showings, and how quickly can you schedule them?Prompt showings are crucial in competitive markets where homes can go under contract quickly. "Knowing your agents availability helps you coordinate viewings efficiently and ensures they're responsive enough to secure opportunities for you," says Soda.Whats your preferred method of communicationphone, email, or text?Clear communication is the foundation of a successful agent-client relationship. "By understanding the agent's preferred method, you can ensure timely and effective exchanges, whether it's to discuss new listings, schedule showings, or address any concerns," says Soda.Arguably, though, the more important issue is will they communicate in your preferred method? "Some people are all about text messages, others only want to talk on the phone or in person. Some may hardly ever check their email," she says. "It's important that the buyer and agent are on the same page when it comes to communication whether that be the method; text, call, email or the frequency."You should also discuss how much communication you want."If a buyer expects to hear from their agent daily and the agent only communicates if there is an immediate issue, then the relationship is not going to work," says Bauer.Questions to Ask Once Youve Hired an Agent and Are Ready to House HuntThis is the fun partbut it also takes preparation, and you want your agent on board to help. Here's what you need to ask to ensure that happens. What do I need to prepare in advance of my home search?Buyers must have their financials in place before the home search beginsand you should utilize your real estate agent to help you. "Your agent will prepare you to seek out the assistance of a mortgage lender to understand what you can afford, how much down payment you need, what are the estimated closing costs to expect," says Cangiano. "They can also help with preparing your current home for sale, if needed."What is key information about the current state of your real estate market, and your perspective on navigating it?A good real estate agent will excel at setting and managing proper expectations with you as a buyer and be honest and straightforward about what will be required to buy a home in the market you are looking at within your desired price range. "It is important to remain flexible and adaptable, as a real estate transaction is a fluid and dynamic process," says Ameer. "Things will change and change often, and priorities may need to adjust according to the market of the moment."Questions to Ask When You're Eyeing a HomeYou've got a home in your sights. Now's the time to get specific insights and details from your real estate agent. What is included in the purchase of the home?Checking in with your real estate agent about what will come with the home (and what wont) is a must. "It is important to know what is included in order to make an informed decision on what to offer for the home," says Cangiano. "Furniture? Lighting? Appliances? Are all fixtures and appliances in working order?" If not, you'll need to plan to set aside funds to upgrade appliances yourself, for example.What are the pros and cons of living in this neighborhood or specific street? Your real estate agent should be familiar with the area you are considering buying in and know extra details about it. Cangiano suggests asking specific things such as: "Is it a walkable area with stores and schools nearby? Pet friendly? Is there a hospital nearby? Is there planned construction coming? Will I lose my view or sunlight? Are there parks nearby? Is it noisy?"Can you provide insights into the neighborhood's future development plans?"This question uncovers information about upcoming infrastructure projects, zoning changes, or community initiatives," says Tim Choate, real estate investor, property manager and CEO of Red Awning. Understanding future developments can influence your property's value and your quality of life. For instance, knowing that a new park or school is planned nearby could enhance your property's appeal.How much are monthly costs?"It's easy to focus on the list price, but there's a lot more to consider, like property taxes, insurance, and potential HOA fees," says Bubba Peek, real estate investor and owner of Bubba Land Company. "A good agent will break down these additional expenses so you can make a realistic budget and avoid surprises later." Find out what the monthly costs will be early, so there aren't any nasty surprises down the road.Can you connect me with experts in your network?Utilizing your real estate agent's contacts can bring major benefits. "Don't hesitate to ask your agent about their network of professionalssuch as inspectors, contractors, and lendersas this can streamline the buying process and provide you with trusted resources," says Choate.Questions to Ask When Youre Ready to Make an OfferNow's the time for you and your agent to talk costs and strategies. Here's how to start the discussion. What have you seen while inspecting the condition of the home?Ameer points out that while you will have an official inspection, your real estate agent should give the home their own inspection and let you know their thoughts. And on your final walk-through of the property, both you and your agent should keep a sharp eye outit is important to closely look for signs of wear and tear, and deferred maintenance. Consider things like how old are the systems such as the heating and air conditioning system, water heater, and roof, what is the condition of the fencing if applicable; and how does the exterior of the home look?Is this home priced correctly for the market?No one wants to pay the highest price for a home in any given area or buildingand your real estate agent should know if you're about to overpay. Buyers should understand and examine comparable home prices (both available and sold comps) in the area.Once you have that information, you can accurately assess the asking price. "If the price is higher than expected, perhaps the quality of finishes will explain this, Cangiano explains. "If the home is in a tall building, the view will have an impact on price."How long has this home been for sale?If the home you are interested in has been on the market for a long time, this will benefit you in the negotiation process. "A knowledgeable agent can provide key data on trends like inventory levels, days on market, and seasonal shifts, empowering you to make informed decisions," says Soda.What is the seller's timeline?Understanding the seller's timeline can help in the negotiating process, and help you know when you can actually move into the home. If they need to relocate by a certain date, the house may be priced to move, or open to negotiation. If they hope to linger, say through the end of the school year, and you can wait, that might give you an advantage over another buyer who needs to be in the house ASAP. "I recently helped clients win a competitive situation by understanding the seller's timing needs rather than just focusing on price," says Kenneth Yim, broker and Managing Partner at Owncondo.How do you handle multiple offers and bidding wars?In competitive markets, it's crucial that you and your real estate agent have a strategy for situations where multiple offers are on the table. "This question reveals the agent's negotiation skills and their approach to ensuring your offer stands out," says Choate. "It also prepares you for potential scenarios, reducing stress and surprises."Tell me about the contract; what should I expect when an offer is ready?Your real estate agent should be able to clearly explain every step of the offer process so you understand. "Every market is different and the definition of 'effective date' or 'AS IS,'" says Jeff Lichtenstein, broker and CEO of Echo Fine Properties. "Who pays for title insurance on each contract can be wildly different between state counties and the 50 states. You need to know what to expect so you are ready to pounce and get your house."What are the costs associated with the transaction for both you as the buyer and the seller? Closing costs can make or break a sale, and it's crucial to understand what you (the buyer) will be responsible for, and what the seller will be responsible for. While the buyer typically covers most closing costs, sellers often contribute. The average closing costs in the United States is $4,243, or about 1.87 percent of the purchase price."It is important to understand that a seller has closing costs associated with their side of the transaction, and asking a seller to pay for some or all of the concessions on the buyer side is that much less to the seller," says Ameer. She adds that in a higher interest rate market, asking the seller to pay points towards buying your interest rate down may be an effective strategy to discuss with your agent and a trusted lender. "You need to understand what is realistic to expect with respect to costs you can negotiate relative to the price range and availability of properties that you are looking at," she points out. Questions to Ask After Your Offer Is AcceptedYou did it! You found a home, and, with the help of your agent, purchased it! Now is the time to get their advice on how to turn the new house into a home. What's the best way to become connected and familiar with this community?A well-connected agent can offer advice on engaging with local organizations, events, or groups to help you feel at home faster. "They can also provide introductions to resources like contractors or service providers, helping you integrate seamlessly into the community," says Soda. Can I get a recommendation?Ask your realtor's advice on local contractors, landscapers, and anyone else whose services you might need in the future.

From bricklaying robots to zero-carbon cement, startups are shaking up construction in a high-tech bid to build better, greener structures.One of these early-stage ventures is Finland-based Aisti. Founded in 2019, the company has come up with a way to make acoustic tiles that are carbon-negative. Acoustic panels are a common construction material used to reduce noise and improve sound quality in buildings.Aisti has raised 29mn in a mix of VC and debt funding to build its first industrial-scale factory in Kitee, a small town about four hours northeastof Helsinki.The startup plans to bring the tiles to market in the second half of 2026 and has already signed multiple offtake agreements with customers in the construction industry, it said.Watch Back NowBuildings alone are responsible for almost 40% of global emissions, so decarbonising construction is a critical piece of the sustainability puzzle.Most acoustic tiles today are made from fibreglass, mineral wool or polyurethane, a type of plastic. Aistis panels, however, are made from wood fibres, which are sourced from sustainable timber or waste paper.Our production process is very resource-effective, founder and CEO Mikko Paananen told TNW. If every single acoustic tile in the world were manufactured with our technology, the need for wood fibres would be 700,000 tons annually which represents only the production of one medium-sized pulp mill.Aisti mixes the wood fibres with water and foaming chemicals similar to what is used in toothpaste. This forms a foam that is then moulded into squares and dried to make the finished tile.The wood fibres stick together with natural hydrogen bonds, so no additional binders are needed making the material very light, explained Paananen, adding that the company will be able to make the panels at a similar pricepoint to conventional mineral wool tiles.Aistis patented material can also be adapted for use as thermal insulation, packaging materials, and composites.We aim to first serve the Nordic market, meeting the growing demand for more natural building solutions in the region, said Paananen. Were thrilled to have strong support from investors and other partners as we embark on this next growth phase and bring our product to market.Technology for the built environment is set to attract $24bn in VC investment in 2024 as the sector outperforms key tech verticals like climate tech and fintech, according to the State of Built World Tech report released this week.Aistis funding round attracted notable early-stage investors including Voima Ventures, Maki.vc, and Valve Ventures. Part of the funding includes non-equity financing, including a 5mn loan from Norion Bank, a 7mn public grant from the South Savo ELY Centre and a 8.5mn capital loan from the Finnish Climate Fund.We are proud to support Aisti in its mission to revolutionize acoustic solutions with sustainable, high-performance materials, said Pirkka Palomki, partner at Maki.vc, a Helsinki-based deep tech fund. This funding milestone marks not only the start of an exciting growth phase but also a transformative step for the construction industry as a whole. Story by Sin Geschwindt Sin is a climate and energy reporter at TNW. From nuclear fusion to escooters, he covers the length and breadth of Europe's clean tech ecos (show all) Sin is a climate and energy reporter at TNW. From nuclear fusion to escooters, he covers the length and breadth of Europe's clean tech ecosystem. He's happiest sourcing a scoop, investigating the impact of emerging technologies, and even putting them to the test. Sin has five years journalism experience and holds a dual degree in media and environmental science from the University of Cape Town, South Africa. Get the TNW newsletterGet the most important tech news in your inbox each week.

Rome-based venture capital firm Scientifica has launched a 200mn fund to support startups in quantum computing, artificial intelligence, and other frontier technologies. The fund, set to launch early next year, will provide early-stage companies with both financial backing and access to advanced lab spaces.Scientificas fund isbased on a Zero CapEx model. Startups can use Scientificas 4,000 m of laboratories and a network of 70 certified labs in Italy without incurring upfront costs.The aim is to reduce barriers to innovation by giving early-stage access to cutting-edge tools and facilities. Themodel reflects a growing trend of venture capital firms supporting both funding and infrastructure for startups, particularly in deep tech.Scientifica Fund is the tangible expression of a strategy that integrates research, venture capital, and industry to accelerate technological innovation and create sustainable value, said managing partner Riccardo DAlessandri, pictured above.Scientifica already has three offices in Europe: two in Italy and another in London. It also recently expanded to Silicon Valley. Led by prominent entrepreneur and investor Jon Lunetta, the new hub aims to connect European startups with resources in the American tech ecosystem.The of EU techThe latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!With high-level international collaborations, we are ready to position Italy as a central player in the global innovation ecosystem, said DAlessandri.One of Scientificas key focus areas is in quantum computing startups. These companies are working on technologies that leverage quantum mechanics to process information in ways classical computers cannot. Scientificas recently partnered with Quantum Italia, Italys first VC focused entirely on quantum tech. Beyond quantum, Scientifica looks to back a range of technologies from AI and advanced materials to biotech and 3D printing. Among its current portfolio of 16 startups are Green Independence, a startup developing an artificial solar leaf with a built-in wastewater purification system, and Recornea, which is working on an implant to treat a severe eye condition called keratoconus. Story by Sin Geschwindt Sin is a climate and energy reporter at TNW. From nuclear fusion to escooters, he covers the length and breadth of Europe's clean tech ecos (show all) Sin is a climate and energy reporter at TNW. From nuclear fusion to escooters, he covers the length and breadth of Europe's clean tech ecosystem. He's happiest sourcing a scoop, investigating the impact of emerging technologies, and even putting them to the test. Sin has five years journalism experience and holds a dual degree in media and environmental science from the University of Cape Town, South Africa. Get the TNW newsletterGet the most important tech news in your inbox each week.Also tagged with

Apple CEO Tim Cook is set to visit Mar-a-Lago on Friday night to dine with President-elect Donald Trump, according to a report from The New York Times. Cook joins a string of other tech leaders who have visited Trumps Florida club over the last several weeks. As reported by The New York Times: Mr. Cook and Mr. Trump are scheduled to dine on the patio at Mar-a-Lago later on Friday, according to two people with knowledge of the upcoming meeting. The two men had a warm relationship during Mr. Trumps first term much warmer than Mr. Trumps with other tech executives, like Metas Mark Zuckerberg or Googles Sundar Pichai, both of whom recently had their own meals with Mr. Trump.This marks Cooks first meeting with Trump since he was elected last month. Cookmet withandearned praise from Trump multiple times during his first term, and other tech leaders are reportedly trying to imitate that strategy during Trumps second term. In October, Cook spoke with Trump about Apples ongoing battles in the European Union. Trump promised Cook he would not let the EU take advantage of American companies if he were to get elected. Meta CEO Mark Zuckerberg visited Mar-a-Lago to meet with Trump at the end of November. Google CEO Sundar Pichai met with Trump on Thursday. Trump has confirmed that he will meet with Amazons Jeff Bezos next week. Trump and Elon Musk have been inseparable over the last several months. In addition to private dinners with Trump, tech companies are also donating to Trumps inauguration fund. Both Meta and Amazon are donating $1 million to the fund. OpenAIs Sam Altman is also making a $1 million donation. Follow Chance:Threads,Bluesky,Instagram, andMastodon.Add 9to5Mac to your Google News feed. FTC: We use income earning auto affiliate links. More.Youre reading 9to5Mac experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Dont know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

Christmas is almost here, and although its already a magical time, technology can certainly help make this time of year even more special. With that in mind, an app called Better Call Santa lets you arrange a call with Santa for your children, all with the help of AI.AI now helps your children (and you) talk to SantaBetter Call Santa uses ChatGPTs Advanced Voice Mode to generate a natural conversation with Santa, but the app does even more. Children can tell Santa their wish list during the call. AI then creates a gift list in the app, so that parents can find out what their children want for Christmas.Bring your familys Christmas spirit to life with Better Call Santa. This magical app allows you to create a holiday memory like no other with a personalized call from Santa himself. Children can share their holiday wishes, and parents can safely view their childs wish list detailsall through one easy-to-use app, the app description reads.Ive tried out the app here and its quite fun and Im sure parents will appreciate the wish list feature.OpenAI also added a Santa Claus voice to the ChatGPT app earlier this week. Even so, the company acknowledged that the developer behind the app did a great job (and before the ChatGPT update was released to the public).Better Call Santa is available to download on the App Store. The app requires a $5.99 in-app purchase to work. Its worth noting that although the app has been designed to work in English, you can ask Santa to speak in other languages after all, he and AI can do anything.Add 9to5Mac to your Google News feed. FTC: We use income earning auto affiliate links. More.Youre reading 9to5Mac experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Dont know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

"It is clear that the organization is not in a hurry to spend its money."Mr. MiserThe holidays may be approaching, but it appears that SpaceX and Tesla CEO Elon Musk is remaining a total scrooge.The New York Times reports that the centibillionaire's charity, the Musk Foundation, failed to give away the minimum amount of money it was supposed to last year by a stupendous margin of $421 million.This continues Musk's pattern of shadily managing his ostensibly philanthropic efforts, such as when he made it seem like he was donating billions of dollars to the United Nations to combat world hunger but instead funneled that money to his own charity.Now, if Musk doesn't give away that sum by the end of 2024, he will be forced to pay a "sizable penalty" to the Internal Revenue Service, according to NYT's reporting.Pocket ChangeAccording to the NYT, Musk's charity hasincreasingly fallen behind on payments despite possessing some $9 billion in assets today. It was $41 million short in 2021, $234 million in 2022, and is now approaching half a billion this year.He's made up for those shortfalls so far by paying late, but only barely. "The distributions made by the foundation are meeting the bare minimum to avoid penalties," Brian Mittendorf, an accounting professor at the Ohio State University, told the NYT. "It is clear that the organization is not in a hurry to spend its money."The newspaper notes that other charitable foundations have fallen short of the IRS's minimum by millions of dollars, but that Musk's is an anomaly even among those because of the staggering sum it has to pay and the rate at which that shortfall is increasing.And there are other shady facets of the organization, the NYT found. It's never hired employees, and its three directors Musk is one of them have spent just two hours per week at the foundation over the past three years.In the cases where it has actually given away money, it has often gone to organizations with close ties to Musk. In 2023, he made a $137 million donation to a nonprofit called The Foundation run by several of Musk's close associates, which operates a private school in Texas close to where several of Musk's businesses are based and where he plans to build a large subdivision for his employees.Tax AttackUltra-wealthy figures have long used philanthropic organizations as a refuge from the treasury department, taking advantage of their generous tax breaks. That's nothing new.But this dodgy charity management is especially hypocritical behavior from Musk, who has championed increased scrutiny into how government funds are spent and has proposed slashing trillions of dollars in federal expenditures through his so-called Department of Government Efficiency, which will be formed as part of the incoming Trump administration.One of his chief targets, unsurprisingly,has been the IRS. Musk recently suggested "deleting" the federal agency, while consistently calling for the hollowing out of others. Even before his DOGE crusade and overt rightward turn, Musk has groused publicly about government tax men and spread obvious falsities about the IRS.For someone so concerned about scrupulous spending, then, it seems that Musk can be quite underhanded with how he spends his fortune.Share This Article

"Couldn't we make even more money if we had AI do it?"Cold ProductEmbattled media company BuzzFeed is selling off First We Feast, the company behind the extremely popular interview show called "Hot Ones," for $82.5 million to save itself from a mountain of debt.The deal will bring down the media empire's debt load from almost $124 million by $88.8 million, the New York Times reports.Perhaps unsurprisingly, BuzzFeed is using the opportunity to double down on its "pivot to AI" strategy, arguing that the tech will allow the company to pull itself out of a years-long struggle."The sale of First We Feast and continued reduction of our convertible debt marks an important step in BuzzFeed, Inc.s strategic transformation into a media company positioned to fully benefit from the ongoing AI revolution," BuzzFeed CEO Jonah Peretti said in a statement. "In the coming years, we will continue to invest in our most scalable and tech-enabled services, launching new AI-powered interactive experiences, and delivering for our loyal audience and business partners."Artificial InternetBut whether unloading a beloved property built on human personalities in favor of automated content will pay off remains to be seen.After a disastrous 2023, BuzzFeed's stock has been recovering at a steady pace throughout this year. Its latest announcement that it would sell off First We Feast and its highly visible "Hot Ones," however, has sent the stock plunging by over 36 percent over the last five days.Its efforts to pivot toward AI haven't instilled much confidence, either.In March 2023, Futurism found that the media company was using AI to quietly churn out repetitive, dull, and poorly-written travel guides. A recipe-generating AI, dubbed Botatouille, also turned out to be a complete disaster.In April 2023, the company shut downthe award-winningBuzzFeed News,causing its share price to plummet below the one-dollar mark, with the Securities Exchange Commission warning that it could be delisted from the NASDAQ if it couldn't recover (its stock is currently floating around $3.43 per share.)Then in February of this year, BuzzFeed cut even more of its business by selling Complex for a cool $108.6 million to raise some more cash.Peretti has previously promised investors that "generative AI will replace the majority of static content, and audiences will begin to expect all content to be curated and dynamic with embedded intelligence."Its latest decision to sell off an extremely popular and likely cheaply produced show led to plenty of mockery online."That a dude with a couple cameras and a plate of appetizers can make something worth $82.5 million," one BlueSky user wrote, "and a media company looks at that and goes 'couldn't we make even more money if we had AI do it?' tells you exactly how stupid these people are."More on BuzzFeed: What Happened After BuzzFeeds Pivot to AI: Catastrophic Stock CollapseShare This Article

Dec 13, 2024Ravie LakshmananCyber Attack / MalwareA now-removed GitHub repository that advertised a WordPress tool to publish posts to the online content management system (CMS) is estimated to have enabled the exfiltration of over 390,000 credentials.The malicious activity is part of a broader attack campaign undertaken by a threat actor, dubbed MUT-1244 (where MUT refers to "mysterious unattributed threat") by Datadog Security Labs, that involves phishing and several trojanized GitHub repositories hosting proof-of-concept (PoC) code for exploiting known security flaws."Victims are believed to be offensive actors including pentesters and security researchers, as well as malicious threat actors and had sensitive data such as SSH private keys and AWS access keys exfiltrated," researchers Christophe Tafani-Dereeper, Matt Muir, and Adrian Korn said in an analysis shared with The Hacker News.It's no surprise that security researchers have been an attractive target for threat actors, including nation-state groups from North Korea, as compromising their systems could yield information about possible exploits related to undisclosed security flaws they may be working on, which could then be leveraged to stage further attacks.In recent years, there has emerged a trend where attackers attempt to capitalize on vulnerability disclosures to create GitHub repositories using phony profiles that claim to host PoCs for the flaws but actually are engineered to conduct data theft and even demand payment in exchange for the exploit.The campaigns undertaken by MUT-1244 not only involve making use of trojanized GitHub repositories but also phishing emails, both of which act as a conduit to deliver a second-stage payload capable of dropping a cryptocurrency miner, as well as stealing system information, private SSH keys, environment variables, and contents associated with specific folders (e.g., ~/.aws) to File.io.One such repository was "github[.]com/hpc20235/yawpp," which claimed to be "Yet Another WordPress Poster." Prior to its takedown by GitHub, it contained two scripts: One to validate WordPress credentials and another to create posts using the XML-RPC API.But the tool also harbored malicious code in the form of a rogue npm dependency, a package named @0xengine/xmlrpc that deployed the same malware. It was originally published to npm in October 2023 as a JavaScript-based XML-RPC server and client for Node.js. The library is no longer available for download.It's worth noting that cybersecurity firm Checkmarx revealed last month that the npm package remained active for over a year, attracting about 1,790 downloads.The yawpp GitHub project is said to have enabled the exfiltration of over 390,000 credentials, likely for WordPress accounts, to an attacker-controlled Dropbox account by compromising unrelated threat actors who had access to these credentials through illicit means.Another method used to deliver the payload entails sending phishing emails to academics in which they are tricked into visiting links that instruct them to launch the terminal and copy-paste a shell command to perform a supposed kernel upgrade. The discovery marks the first time a ClickFix-style attack has been documented against Linux systems."The second initial access vector that MUT-1244 utilizes is a set of malicious GitHub users publishing fake proof-of-concepts for CVEs," the researchers explained. "Most of them were created in October or November [2024], have no legitimate activity, and have an AI-generated profile picture."Some of these bogus PoC repositories were previously highlighted by Alex Kaganovich, Colgate-Palmolive's global head of offensive security red team, in mid-October 2024. But in an interesting twist, the second-stage malware is through four different ways -Backdoored configure compilation fileMalicious payload embedded in a PDF fileUsing a Python dropperInclusion of a malicious npm package "0xengine/meow""MUT-1244 was able to compromise the system of dozens of victims, mostly red teamers, security researchers, and anyone with an interest in downloading PoC exploit code," the researchers said. "This allowed MUT-1244 to gain access to sensitive information, including private SSH keys, AWS credentials, and command history."Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.SHARE

Dec 13, 2024The Hacker NewsLinux / VulnerabilityA security flaw has been disclosed in OpenWrt's Attended Sysupgrade (ASU) feature that, if successfully exploited, could have been abused to distribute malicious firmware packages.The vulnerability, tracked as CVE-2024-54143, carries a CVSS score of 9.3 out of a maximum of 10, indicating critical severity. Flatt Security researcher RyotaK has been credited with discovering and reporting the flaw on December 4, 2024. The issue has been patched in ASU version 920c8a1."Due to the combination of the command injection in the imagebuilder image and the truncated SHA-256 hash included in the build request hash, an attacker can pollute the legitimate image by providing a package list that causes the hash collision," the project maintainers said in an alert.OpenWrt is a popular open-source Linux-based operating system for routers, residential gateways, and other embedded devices that route network traffic.Successful exploitation of the shortcoming could essentially allow a threat actor to inject arbitrary commands into the build process, thereby leading to the production of malicious firmware images signed with the legitimate build key.Even worse, a 12-character SHA-256 hash collision associated with the build key could be weaponized to serve a previously built malicious image in the place of a legitimate one, posing a severe supply chain risk to downstream users."An attacker needs the ability to submit build requests containing crafted package lists," OpenWrt noted. "No authentication is required to exploit the vulnerabilities. By injecting commands and causing hash collisions, the attacker can force legitimate build requests to receive a previously generated malicious image."RyotaK, who provided a technical breakdown of the bug, said it's not known if the vulnerability was ever exploited in the wild because it has "existed for a while." Users are recommended to update to the latest version as soon as possible to safeguard against potential threats.Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.SHARE

Heading into 2025, healthcare organizations still face workflow shortages, both on the clinical and IT side. Growth in artificial intelligenceand automation will enable tech leaders to address these workflow shortages at health systems. However, as healthcare IT leaders continue experimenting in generative AI (GenAI), it may not be as much of a top priority as you might think, according to IDCs Worldwide C-Suite Tech Survey, which was conducted in September and October 2024.Interestingly, given all the focus on generative AI, only 25% of healthcare respondents reported implementing AI/GenAI as their organizations top priority for the next 12 months, Lynne A. Dunbrack, group vice president for the public sector at IDC, says in an email interview.The IDC report lists the top three health IT priorities in healthcare as investing in security technologies (36.5%), improving customer-focused digital experiences (36.1%), and advancing digital skills across the organization (33%).Here, InformationWeek offers insights from several industry experts on the top priorities for health IT leaders in 2025. Addressing Data Storage NeedsModernizing their infrastructure in the cloud to manage increasing data volumes should be a priority for health IT leaders, according to the IDC FutureScape: Worldwide Healthcare Industry 2025 Predictions report.Related:Cloud solutions and platforms offer more than just expanded technology capacity, scalability, and access to managed services, the report stated. They also act as a catalyst for data exchange and interoperability, enabling seamless integration of third-party applications and other platforms, creating a more open, dynamic, and innovative ecosystem.Scaling Precision Medicine to a Broader PopulationIn 2025, health IT leaders should expand precision medicine to a wider population, says Brigham Hyde, cofounder and CEO of Atropos Health, which offers a cloud-based analytics platform for converting healthcare data into personalized evidence. Precision medicine uses AI and digital tools to make better target treatments possible. The technology could support drug development and personalized therapies for patients. To scale precision medicine, the healthcare industry must keep data specific and personalized, according to Hyde.Precision medicine traditionally focuses on small, highly specific patient cohorts with unique genetic, environmental, or lifestyle factors, Hyde says via email. Scaling it involves extending this level of personalized care to larger and more diverse populations by leveraging technologies like AI and real-world data."Related:AI delivers the ability to drill down on insights for specific conditions at a granular level, Hyde explains. Once these models produce tailored recommendations, they can scale to address broader populations by combining multiple focused models or synthesizing data from different specialties, he says.Implementing Generative AIHealthcare organizations will move on from simply experimenting with GenAI to carrying out enterprise-wide AI strategies, according to the IDC FutureScape report.Although healthcare GenAI investments are expected to triple in healthcare by 2026, 75% of these healthcare Gen AI initiatives will fail to achieve their expected benefits by 2027 due to issues around trustworthiness of data, disconnected workflows, and end-user resistance, IDC reported.In the meantime, in 2025, health IT leaders will need to prioritize quality assurance and physician trust with GenAI and large language models (LLMs), according to Hyde.We will need to scrutinize applications for their clinical accuracy, transparency, and alignment with ethical standards, Hyde says.In the coming year, health IT leaders will prioritize evaluating the accuracy they get from AI algorithms, according toMichael Gao, CEO and cofounder ofSmarterDx, which builds clinical AI applications to allow hospitals to achieve revenue integrity, such as checking for billing coding errors and revenue leakage.Related:As we see more widespread adoption of AI and especially generative AI in healthcare, health IT leaders are going to be prioritizing not just how to supervise an algorithm to understand what level of accuracy youre getting, but also determining how to even pick what level of accuracy you want in the first place, Gao says in an email interview. For example, you want extremely high accuracy algorithms for clinical care. There are a lot of learnings around that before we can really use algorithms effectively in healthcare.Adopting Ambient AIHyde advises that health tech leaders prioritize ambient AI, which operates in the background using advanced computing and AI to detect and generate insights without a users involvement. The technology can automate tasks, as well as personalize care delivery, he says.By collecting and analyzing real-world data in the background, ambient AI enables more precise and actionable insights for disease management, treatment optimization, and personalized medicine initiatives, Hyde explains.Ambient AI can reduce clinician burnout and improve physician retention through ambient dictation and transcription of notes from patient visits, according to Hyde.Addressing Health Inequities With AITo address health inequities and avoid the biases in AI models, health IT leaders should prioritize vetting AI use cases, says Ann Bilyew, executive vice president for health and president of the Healthcare Solutions Group at WebMD/Internet Brands.Keeping AI equitable means paying attention to the social determinants of health, which are factors that influence health such as income, job, education level, and ZIP code.Although addressing health inequities is a worthwhile and promising goal for AI, its important to note that AI is only as good as the material its trained on, and that material has inherent biases, Bilyew tells us via email. AI can exacerbate those biases, so it is critical that healthcare organizations thoroughly vet these use cases to ensure they meet the intended goal.AI models should apply to patients across the board to remain trustworthy and equitable, suggests Dan Stevens, healthcare and life sciences solutions architect at Lenovo.To gain trust from care providers and patients to accept AI-generated healthcare recommendations, it will be crucial to ensure the data used for training is representative of the general population, maintains patient data confidentiality, and avoids bias, Stevens says via email.Investing in Cybersecurity ToolsIn IDCs Worldwide C-Suite Tech Survey, 46.9% of healthcare respondents cited security concerns as the top challenge their organizations faced when implementing Gen AI.Security and cybersecurity tools are a business imperative to protect vulnerable healthcare infrastructure against increasing volumes of insidious ransomware attacks that put patient safety at risk, Dunbrack says.Meanwhile, by 2027, increasing cybersecurity risks will drive healthcare organizations to use AI-based threat intelligence solutions to enable continuity of care and protect patients, according to the IDC FutureScape report.To safeguard patient safety and ensure uninterrupted healthcare services, it is imperative to make investments in cybersecurity a top priority, the report stated.MiteshRao, founder and CEO ofOMNY Health, notes the security steps healthcare organizations should take in 2025 following the massive healthcare data breaches that occurred in healthcare in 2024, particularly with Change Healthcare.More companies need to implement checks and balances on their own operations to prevent leaks and cyberattacks, Rao says in an email interview. Beyond that, data providers need to vet their data sharing policies to make sure that patients information doesnt end in the wrong hands.As AI models are used more extensively and health data gets spread across diagnostic and financial information as well as multiple types of platforms -- including local devices, mobile, servers and cloud services -- IT leaders will need to prevent risk of security breaches, Lenovos Stevens suggests.If not managed appropriately, AI workflows risk introducing unanticipated security breaches due to a lack of end-to-end protection keeping data secure across all resources, from an individuals PC to the cloud, Stevens says.Tackling Regulatory ComplianceWith the focus on GenAI, healthcare organizations must ensure they understand regulations around compliance in 2025, IDCs FutureScape report noted.For 2025, Atropos Healths Hyde advises that health IT leaders build frameworks that establish trust while adhering to regulatory standards at the same time. These frameworks will depend on the size of the healthcare organization, he says.Larger health systems and technology companies with robust resources may prioritize building their own frameworks tailored to their specific needs, ensuring alignment with their internal workflows, patient populations, and operational goals, Hyde says. However, the majority are expected to rely on or closely align with emerging regulatory frameworks and standards.Prioritize Cyber ResilienceIn 2025, health IT leaders should keep cyber resilience in mind to stay prepared for cybersecurity incidents before they occur, advises Ty Greenhalgh, industry principal of healthcare at cybersecurity firm Claroty. Greenhalgh is also an ambassador for the US Department of Health and Human Services 405(d) Task Force and a member of the HHS Healthcare Sector Council Cyber Working Group.Health IT leaders should rely on the NIST definition of resilience to anticipate, survive, and recover from cybersecurity threats, according to Greenhalgh.By leveraging the NIST definition of resilience, organizations can anticipate, withstand, adapt, and recover from threats, Greenhalgh tells us via email. This approach emphasizes early detection and mitigation to reduce downtime and financial impact, particularly in the face of persistent threats like ransomware.