0 Yorumlar
0 hisse senetleri
Rehber
Rehber
-
Please log in to like, share and comment!
-
THEHACKERNEWS.COM10 Critical Network Pentest Findings IT Teams OverlookAfter conducting over 10,000 automated internal network penetration tests last year, vPenTest has uncovered a troubling reality that many businesses still have critical security gaps that attackers can easily exploit.Organizations often assume that firewalls, endpoint protection, and SIEMs are enough to keep them secure. But how effective are these defenses when put to the test? That's where vPenTest, Vonahi Security's automated network pentesting platform, comes in. Designed to simulate real-world attack scenarios, vPenTest helps organizations find exploitable vulnerabilities before cybercriminals can.These aren't complex, zero-day exploits. They're misconfigurations, weak passwords, and unpatched vulnerabilities that attackers routinely exploit to gain access, move laterally, and escalate privileges within networks. Here's how these risks break down:50% stem from misconfigurations Default settings, weak access controls, and overlooked security policies.30% are due to missing patches Unpatched systems that leave the door open for known exploits.20% involve weak passwords Services running without proper authentication, making it easy for attackers to get in.In this article, we'll cover the ten most critical internal network security risks, breaking down what they are, why they're dangerous, and how to fix them before they turn into real problems. We'll start with the least common and work our way up to the number one issue we've seen across thousands of assessments with vPenTest. If these weaknesses exist in your environment, attackers will find themit's just a matter of time.10. Password Deficiencies - Redis ServiceCVSS3: 9.9% of occurrence: 1.3%What is it: Redis is an in-memory key-value data store commonly used for caching, message brokering, and real-time analytics. By default, Redis does not enforce authentication, allowing clients to connect without credentials.Security Impact: If an adversary gains access to the Redis service, they may obtain sensitive data stored within the databases hosted on the server and possibly escalate privileges to gain system-level access, depending on the capabilities of the Redis service and the permissions associated with the compromised user account. This could lead to unauthorized data manipulation, data exfiltration, or further exploitation of the system.Recommendation:It is imperative to configure the Redis service to require a strong password that meets the organization's password policy. A robust password should encompass the following criteria:Minimum of 12 characters Not easily guessable, e.g., not found in a dictionary Combination of upper-case letters, lower case letters, numerical digits, and/or special characters Verifiable against known compromised password databases (e.g., www.haveibeenpwned.com)Additionally, utilizing a password manager can enhance security by generating complex passwords that are difficult to retrieve, even in the event that the password hash is obtained through a breach.9. Firebird Servers Accept Default CredentialsCVSS3: 9.0% of occurrence: 1.4%What is it: Default credentials are often hard-coded usernames and passwords intended for initial setup and should be changed promptly to maintain security. This issue arises when systems are deployed without reconfiguration or when default settings are overlooked during the setup process.Security Impact: The reliance on default credentials for Firebird servers can lead to unauthorized access, allowing attackers to authenticate and conduct reconnaissance on the affected systems. They could enumerate files or alter system configurations, thereby opening pathways to further exploitation. If the attacker identifies the location of Firebird database files, they may gain the ability to read or modify sensitive database information. Furthermore, certain versions of Firebird can be manipulated to execute system commands, thereby extending an attacker's control over the remote host.Recommendation:To mitigate this vulnerability, it is essential to utilize the GSEC tool to change the default credentials associated with Firebird servers. Additionally, implementing a policy for regular credential audits and ensuring that all default settings are modified before deployment can further enhance security. Continuously monitoring server access logs for unauthorized attempts and enabling alerts for suspicious activities will aid in detecting potential exploitations early.8. Microsoft Windows RCE (BlueKeep)CVSS3: 9.8% of occurrence: 4.4%What is it: BlueKeep is a remote code execution vulnerability in Microsoft's Remote Desktop Protocol (RDP), identified as CVE-2019-0708. Security Impact: Exploitation of the BlueKeep vulnerability allows an attacker to assume complete control over the affected system(s). This level of access may facilitate further attacks within the organization's infrastructure, including the potential extraction of sensitive data such as passwords and password hashes. Additionally, the attacker could navigate laterally within the network, compromising additional systems and services. The exploit's nature means that no special privileges or authenticated access are required to execute the attack, thus simplifying the process for the attacker and amplifying the potential impact on the organization.Recommendation:It is critical to promptly apply all relevant security updates to the affected system(s) to mitigate the BlueKeep vulnerability. Organizations should conduct a thorough review of their patch management processes to identify factors contributing to the absence of timely updates. Given the exploitability of this vulnerability and its ability to severely compromise systems, an immediate response is essential to safeguarding the organization's digital environment.7. Microsoft Windows RCE (EternalBlue)CVSS3: 9.8% of occurrence: 4.5%What is it: EternalBlue is a remote code execution vulnerability in the Microsoft Server Message Block (SMBv1) protocol. It allows an attacker to send specially crafted packets to a vulnerable system, enabling unauthorized access and execution of arbitrary code with system-level privileges.Security Impact: Exploitation of the EternalBlue vulnerability allows an attacker to gain full administrative access to the affected system(s). This access can facilitate further malicious actions within the organization's network, including the extraction of cleartext passwords and password hashes, as well as lateral movement to other systems. Importantly, this vulnerability does not require the attacker to escalate privileges on the compromised system, meaning they can initiate reconnaissance and further attacks without any additional effort.Recommendation:To mitigate the risk associated with the EternalBlue vulnerability, it is imperative to promptly apply the relevant security patches to all affected system(s). Additionally, a thorough review of the organization's patch management program should be conducted to identify any deficiencies that led to the unpatched status of these systems. Given the high risk and prevalence of exploitation of this vulnerability, immediate remediation efforts are crucial.6. IPMI Authentication BypassCVSS3: 10.0% of occurrence: 15.7%What is it: The Intelligent Platform Management Interface (IPMI) is a critical hardware solution utilized by network administrators for centralized management of server(s). During the configuration of server(s) equipped with IPMI, certain vulnerabilities may exist that allow attackers to bypass the authentication mechanism remotely. This results in the extraction of password hashes, and in instances where default or weak hashing algorithms are employed, attackers could potentially recover the cleartext passwords.Security Impact: The ability to extract cleartext passwords presents a significant security risk, as an attacker could leverage this information to gain unauthorized remote access to sensitive services, including Secure Shell (SSH), Telnet, or web-based interfaces. Such unauthorized access could enable configurations manipulation, negatively impacting the availability and integrity of services provided by the compromised server(s).Recommendation:Given the absence of a patch for this vulnerability, it is essential to implement one or more of the following mitigation strategies:Limit IPMI access strictly to authorized system(s) that require administrative functionalities.Disable IPMI service on server(s) that do not need it for business operations.Change default administrator password(s) to strong, complex alternatives to enhance security.Employ secure communication protocols, such as HTTPS and SSH, to mitigate the risk of man-in-the-middle attacks that could expose sensitive credentials.5. Outdated Microsoft Windows SystemsCVSS3: 9.8% of occurrence: 24.9%What is it: Outdated Microsoft Windows system(s) present significant security risks, as they are no longer receiving critical updates from Microsoft. These system(s) may lack essential security patches addressing known vulnerabilities, effectively rendering them more susceptible to exploitation by attackers. Additionally, the absence of updates can result in compatibility issues with modern security tools and software, further diminishing the system(s)' defenses. Vulnerabilities on outdated systems can often be exploited in attacks, such as malware distribution, data exfiltration, and unauthorized access.Security Impact: If exploited, an outdated Microsoft Windows system could allow an attacker to gain unauthorized access to the affected system(s), exposing sensitive data and resources. Furthermore, due to the potential similarity in configurations among system(s) within the same network, an attacker may utilize the compromised system(s) as a launching point to move laterally, compromising additional system(s) and increasing the overall footprint of the breach.Recommendation:It is strongly recommended to replace outdated versions of Microsoft Windows with current operating system(s) that are still supported by the manufacturer. This should include conducting a thorough inventory of all system(s) to identify and prioritize outdated versions, followed by implementing a phased upgrade strategy. Regularly verify that all system(s) are receiving the latest updates and patches to maintain security integrity.4. IPv6 DNS SpoofingCVSS3: 10.0% of occurrence: 49.9%What is it: The risk of IPv6 DNS spoofing arises from the possible introduction of a rogue DHCPv6 server within the internal network infrastructure. Due to the preference of Microsoft Windows systems for IPv6 over IPv4, IPv6-capable clients are inclined to obtain their IP address configurations from any available DHCPv6 server.Security Impact: The deployment of a rogue DHCPv6 server allows an attacker to manipulate DNS requests by redirecting IPv6-enabled clients to utilize the attacker's system as their DNS server. This capability can lead to serious consequences, such as the unauthorized capture of sensitive data, including user credentials. When all DNS queries resolve to the attacker's server, the victim's system may inadvertently communicate with malicious services operating on the attacker's infrastructure, encompassing platforms such as SMB, HTTP, RDP, and MSSQL.Recommendation:To mitigate the risks associated with IPv6 DNS spoofing, the following strategies are recommended, with emphasis on aligning each approach with organizational operations and thorough testing prior to implementation:Manage Rogue DHCP at the Network Layer: Implement features such as Rogue DHCP detection, DHCP snooping, and DHCP authentication on network switches and firewalls to control unauthorized DHCP servers and lessen the likelihood of DNS spoofing attacks.Prefer IPv4 over IPv6: Utilize Group Policy Objects (GPOs) or Group Policy Preferences (GPPs) to deploy registry modifications that configure Windows systems to favor IPv4 over IPv6. It is important to note that this approach will not prevent attacks from affecting non-Windows devices.Disable IPv6: While not generally advisable for Microsoft Windows systems, disabling IPv6 may be considered as a last resort precaution, provided thorough testing ensures there are no significant disruptions to business operations.3. Link-Local Multicast Name Resolution (LLMNR) SpoofingCVSS3: 9.8% of occurrence: 65.5%What is it: Link-Local Multicast Name Resolution (LLMNR) is a protocol designed for name resolution within internal network environments when traditional Domain Name System (DNS) services are either unavailable or ineffective. LLMNR acts as a fallback mechanism, facilitating the resolution of DNS names through multicast queries. The resolution process unfolds as follows:The system first queries its local host file to find a corresponding IP address for the specified DNS name.If no local entry exists, the system initiates a DNS query directed at its configured DNS server(s) to resolve the name.Should the DNS server(s) fail to provide a resolution, the system broadcasts an LLMNR query across the local network, seeking responses from other hosts.This reliance on multicast broadcasts introduces vulnerabilities, as any active system can respond to the queries, potentially misleading the requesting system.Security Impact: The broadcasting nature of LLMNR queries allows any system on the local network to respond with its own IP address in answer to a resolution request. Malicious actors can exploit this by sending crafted responses containing the attacker's system's address. This capability opens avenues for significant security breaches, particularly if the query is tied to sensitive services such as SMB, MSSQL, or HTTP. Successful redirection can facilitate the capture of sensitive information including plaintext and hashed account credentials. It is pertinent to note that hashed credentials can be subjected to modern brute-force attacks, thereby compromising account security.Recommendation:To mitigate the risks associated with LLMNR spoofing, it is critical to disable LLMNR functionality across affected systems. This can be accomplished through the following methods:Group Policy Configuration: Navigate to Computer Configuration\Administrative Templates\Network\DNS Client and set 'Turn off Multicast Name Resolution' to Enabled. For administering configurations on a Windows Server 2003 domain controller, utilize the Remote Server Administration Tools for Windows 7 available at this link. Registry Modification for Windows Vista/7/10 Home Edition: Access the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient and modify the 'EnableMulticast' key to 0 or remove it to disable the feature.2. NetBIOS Name Service (NBNS) SpoofingCVSS3: 9.8% of occurrence: 73.3%What it is: The NetBIOS Name Service (NBNS) is a protocol utilized by workstations within an internal network to resolve domain names when a DNS server is unavailable or unresponsive. When a system attempts to resolve a DNS name, it follows these steps:The system first checks its local host file for an entry mapping the DNS name to an IP address.If no local mapping exists, the system sends a DNS query to its configured DNS server(s) in an attempt to retrieve the corresponding IP address.If the DNS server(s) cannot resolve the name, the system broadcasts an NBNS query across the local network, soliciting responses from other systems.This dependency on broadcasts makes the NBNS vulnerable to spoofing attacks, wherein an attacker can respond with a false IP address.Security Impact: The broadcasting nature of NBNS queries means that any system on the local network can respond. This vulnerability can be exploited by malicious actors who may answer these queries with the IP address of the attacker's system, redirecting traffic intended for legitimate services. For instance, services such as SMB, MSSQL, or HTTP could inadvertently send sensitive data, including cleartext or hashed account credentials, to the attacker's system. Moreover, modern computational capabilities can facilitate the cracking of hashed credentials, potentially allowing unauthorized access to user accounts.Recommendation:To mitigate the risk of NBNS spoofing, it is advisable to disable the NetBIOS service across all hosts within the internal network. This can be accomplished through a variety of methods including configuration of DHCP options, adjustments to network adapter settings, or modifications to the system registry. Implementing these changes will significantly reduce the potential attack surface associated with NBNS.1. Multicast DNS (mDNS) SpoofingCVSS3: 9.8% of occurrence: 78.2%What it is:Multicast DNS (mDNS) serves as a name resolution protocol for local networks, facilitating the resolution of domain names when a dedicated DNS server is unavailable. The resolution process occurs in stages:The system first consults its local host file for any appropriate DNS name/IP address mappings.In the absence of a configured DNS server, the system resorts to mDNS, broadcasting an IP multicast query requesting identification from the host corresponding to the DNS name. This protocol behavior exposes a potential vulnerability that malicious actors can exploit, enabling them to impersonate legitimate systems by responding to these queries.Security Impact: mDNS queries, which are transmitted across the local subnet, can be answered by any device capable of receiving them. This vulnerability allows an attacker to respond with their system's IP address, potentially misleading the querying system. Such exploitation may lead to interception of sensitive information, including unencrypted and hashed credentials, depending on the specific service the victim is trying to access (e.g., SMB, MSSQL, HTTP). It should be noted that hashed credentials can often be compromised within a relatively short timeframe using contemporary computing resources and brute-force attack methodologies.Recommendation: To mitigate the risk of mDNS spoofing, the primary recommendation is to completely disable mDNS if it is not in use. On Windows systems, this can often be done by implementing the 'Disable Multicast Name Resolution' group policy. As many applications have the potential to reintroduce mDNS functionality, an alternative strategy is to block UDP port 5353 via the Windows firewall. For non-Windows systems, disabling services such as Apple Bonjour or avahi-daemon can provide similar protection.It is important to note that disabling mDNS may disrupt functionalities such as screen casting and certain conference room technologies. Should complete disabling not be feasible, consider isolating affected systems within a controlled network segment and mandating the use of strong, complex passwords for any accounts that access these systems.What Pentesting Reveals About Security GapsAfter analyzing tens of thousands of network assessments, one thing is clearmany security gaps aren't the result of advanced hacking techniques but simple, avoidable mistakes. Weak passwords, forgotten misconfigurations, and unpatched systems create easy opportunities for attackers. These aren't once-in-a-lifetime vulnerabilities. They're recurring problems that show up in networks of all sizes, year after year.Pentesting is like stress-testing your security before a real attacker does. It reveals how someone could break in, move around, and escalate privileges using the same tactics real-world attackers rely on. Time and again, assessments prove that even companies with strong defenses often have hidden weaknesses waiting to be exploited.The problem? Most organizations still rely on annual pentests for compliance, leaving months of blind spots in between. That's where vPenTest from Vonahi Security comes in. It delivers automated, on-demand network pentesting, so instead of waiting for an audit to tell you what went wrong, you can find and fix exploitable vulnerabilities year-round.Cyber threats aren't slowing down, so security testing shouldn't either. Whether done manually or through automation, regular network pentesting is the key to staying ahead of attackersnot just checking a box for compliance. Want to explore vPenTest and see the power of automated network pentesting for yourself? Schedule a free demo of vPenTest!Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.0 Yorumlar 0 hisse senetleri
-
WWW.INFORMATIONWEEK.COMWhy Your Business Needs an AI Innovation UnitJohn Edwards, Technology Journalist & AuthorMarch 21, 20256 Min Readtanit boonruen via Alamy Stock PhotoJust about everybody agrees that AI is an essential business tool. This means that it's now time to give the technology the status it deserves by creating a business unit that's completely dedicated to deploying innovative AI applications across the enterprise.An AI innovation unit serves as an organizational hub for designing and deploying AI solutions, as a catalyst for adopting and integrating of AI, and as a focal point for AI business exploration and experimentation, says Paul McDonagh-Smith, a senior lecturer in information technology and executive education at the MIT Sloan School of Management. "By spinning-up an AI innovation unit, your company can accelerate its digital transformation, sustain competitiveness, and create a culture of innovation," he explains in an online interview.McDonagh-Smith believes that an AI innovation unit can help convert the AI's potential into enhanced product offerings and customer experiences, unlocking new revenue streams and creating a competitive advantage. "Your AI innovation unit will also provide a space and a place to combine AI research and responsible application of AI to help you minimize risks while maximizing benefits."Mission GoalsAn AI innovation unit's mission should be to coordinate, plan, and prioritize efforts across the enterprise, says Steven Hall, chief AI officer at technology research and advisory firm ISG. "This can include ensuring the right data assets are used to train models and that proper guardrails are established to manage risks," he recommends in an email interview. Hall adds that unit leaders should also work toward keeping relevant individuals in the loop while prioritizing use cases and experiments.Related:An AI innovation unit should always support sustainable and strategic organizational growth through the ethical and impactful application and integration of AI, McDonagh-Smith says. "Achieving this mission involves identifying and deploying AI technologies to solve complex and simple business problems, improving efficiency, cultivating innovation, and creating measurable new organizational value."A successful unit, McDonagh-Smith states, prioritizes aligning AI initiatives with the enterprise's long-term vision, ensuring transparency, fairness, and accountability in its AI applications. "An effective AI innovation unit also increases the flow of AI-enhanced policies, processes, and products through existing and emerging organizational networks."Carolyn Nash, chief operations officer for open-source software products provider Red Hat, says her firm recently established an AI innovation unit when enterprise leaders recognized that AI had become a top IT strategy priority. "This newly-formed team is now focusing on putting the appropriate infrastructure foundations in place for AI to be developed at scale, and in a cost-efficient manner," she explains in an online interview. Part of that work, Nash notes, includes identifying and creating productivity use cases.Related:Leadership RequirementsAn AI innovation unit leader is foremost a business leader and visionary, responsible for helping the enterprise embrace and effectively use AI in an ethical and responsible manner, Hall says. "The leader needs to understand the risk and concerns, but also AI governance and frameworks." He adds that the leader should also be realistic and inspiring, with an understanding of the hype curve and the technology's potential.The unit should be led by a chief AI officer (CAIO), or an equivalent senior executive with expertise in both AI technology and strategic business management, McDonagh-Smith advises. "While this leader possesses a strong understanding of data science, machine learning, and innovation strategy. alongside finely-tuned leadership skills, this individual also needs to be adept at bridging technical and non-technical teams to ensure AI that initiatives are practical, scalable, and personalized to business goals."Related:Team BuildingMcDonagh-Smith recommends staffing the AI unit with a multidisciplinary team that combines the capabilities of data scientists, machine learning engineers, and software engineers, as well as AI ethicists, HR experts, UX /UI designers, and change management specialists. "This will provide the diversity of perspective and expertise necessary to fuel and drive your AI innovation unit forward."Nash observes that there will also be times when it becomes necessary to seek advice and support from other enterprise stakeholders, particularly when collaborating on projects with elements that lie beyond the main team's skills and knowledge. She adds that the unit should focus on addressing existing business issues, not seeking new problems to solve. "Proactively capturing requirements from strategic leaders across the business -- HR, marketing, finance, products, legal, sales -- is critical to ensuring the AI unit is correctly focused."ReportingMcDonagh-Smith recommends that the AI innovation unit's leader should report directly to the enterprise C-suite, ideally to the CEO or chief digital officer (CDO). "This reporting structure ensures that AI initiatives remain a visible strategic priority and are seamlessly integrated with broader business goals," he says. "It also allows for clear communication between the unit and top-level leadership, helping to secure the necessary support for scaling successful AI-forward projects across the organization."A Collaborative CultureAn AI innovation unit requires a collaborative culture that bridges silos within the organization and commits to continuous reflection and learning, McDonagh-Smith says. "The unit needs to establish practical partnerships with academic institutions, tech startups, and AI thought leadership groups to create flows of innovation, intelligence, and business insights."McDonagh-Smith believes that the unit should be complemented by a strong governance framework that will allow it to manage AI risks, uphold ethical standards, and ensure AI deployments that align with enterprise values and societal responsibilities. "By introducing regular impact assessments and transparent reporting on AI initiatives, you'll build trust both internally and externally ... and establish your team as a leader in evolving business practices."About the AuthorJohn EdwardsTechnology Journalist & AuthorJohn Edwards is a veteran business technology journalist. His work has appeared in The New York Times, The Washington Post, and numerous business and technology publications, including Computerworld, CFO Magazine, IBM Data Management Magazine, RFID Journal, and Electronic Design. He has also written columns for The Economist's Business Intelligence Unit and PricewaterhouseCoopers' Communications Direct. John has authored several books on business technology topics. His work began appearing online as early as 1983. Throughout the 1980s and 90s, he wrote daily news and feature articles for both the CompuServe and Prodigy online services. His "Behind the Screens" commentaries made him the world's first known professional blogger.See more from John EdwardsReportsMore ReportsNever Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.SIGN-UPYou May Also Like0 Yorumlar 0 hisse senetleri
-
WWW.INFORMATIONWEEK.COMWhats New in Augmented Reality and Virtual Reality?The boom in AI has virtually eclipsed technologies like augmented reality (AR) and virtual reality (VR). Nevertheless, there are still good reasons to keep AR and VR on the IT strategic roadmap.AR is so named because it can embellish the physical world with digital artifacts. VR goes one step further by immersing participants in an alternate world of virtual experience.There are a number of AR/VR use cases that are working in business.The retail and real estate industries use AR and VR technologies to give customers a preview of how a household item would look in their home. It also can give would-be buyers a virtual walkthrough of a vacation home that they are considering purchasing that is thousands of miles away.Building engineers and inspectors use AR with the help of special glasses that display blueprints of electrical wiring that they can superimpose upon a finished wall in a structure; the military uses VR to simulate battlefield scenes for trainees; and baseball players use AR/VR to improve the mechanics of their swings.The CIOs Position on AR/VR TodayFor CIOs, AR/VR is taking a backseat to artificial intelligence, which Statista sees as exceeding $1.8 trillion in business investment by 2030. Consequently, there is little left in most IT budgets for anything else.Related:CIOs also know that most AR/VR investments cant be done on the cheap. AR/ VR implementations often require significant customization to achieve the right fit for specific business cases, and they can require expensive investments in headgear, workstations and other hardware.Finally, its not always easy to justify an AR/VR investment. While an AR/VR investment might be close to mandatory when the military is training personnel to disarm bombs on a battlefield, its not that easy to justify AR/VR simulations for more mundane use cases.Collectively, these circumstances have put AR/VR on the IT back burner, but it doesnt mean that they dont deserve a spot on IT's strategic roadmap.Where AR and VR Could Play in a BusinessAdecco, a corporate recruiter, reported in 2023 that 92% of executives think that American workers aren't as skilled as they need to be. And the World Economic Forum expects that 39% of skills will be outdated by 2030. At the same time, younger employees entering the workforce are less likely to learn by reading manuals, and more likely to further their learning through AR, VR and other visual technologies.This makes workforce education a prime area for AR/VR utilization. In addition, many of the skills that must be learned by employees across a wide swath of industries are somewhat generic (for example, the basics of lending for a financial institution, or the fundamentals of waste management and collection for sanitation workers). So, it is possible that more generic and cost-effective AR/VR offerings can be used without much need for company-specific customization.Related:Schools are already integrating AR/VRinto their curricula, and there is no reason that companies cant do the same to help address their employee skills shortages.Another AR/VR use case that has been used successfully is in retail sales where AR/VR can simulate product experiences in a virtual environment. With AR/VR, a prospect can experience what a trip to Belize would be like or do a visual walkthrough of a beach home in Miami. A customer can try on a sweater virtually, or they can see how a new dining room table looks like in their home.All these examples are already in play and generating revenue in e-commerce markets, where it is important for customers to experience what it would be like to own or experience something that they cant physically see or touch. The value proposition for using AR/VR in retail is further sweetened because companies dont have to invest in special hardware. Instead, customers can use the AR/VR on regular home computers and mobile devices.Related:New product development is one more area where companies are adopting AR/VR. Constructing physical prototypes of new products that may not work is expensive and time-consuming. If new product designs and simulations can be generated with 3D modeling and AR/VR, the technology investment may be worth it.AR/VR TrendsLooking forward, it is reasonable to expect that AR/VR use will expand in the areas where it is already gaining a footing: education/training, retail sales and product development.Also, there are three AR/VR trends that CIOs should note:Cloud-based AR/VR. A user can put on a wireless headset and use AR/VR from the cloud if the computing requirements for the app arent overly intensive. Education and training AR/VR in most cases would work in this scenario, although there might be a need to invest in more bandwidth.Better ergonomic experiences for users. AR/VR headgear is clunky and uncomfortable. Vendors know this and are at work at creating more wearable and tetherless headsets that deliver a better ergonomic experience to users. That lighter, more agile hardware could also lead to lower costs.A focus on security and governance. AR/VR vendors havent paid much attention to security and governance in the past, but they will in the future because enterprise customers will demand it, and the enterprise market is too big to ignore.Wrap-UpWhile AR/VR technology isnt front-and-center in technology discussions today, it could emerge in the future as a way for companies to streamline education and training, improve new product development and times to market, grow retail revenues, and even simulate scenarios. For example, it could be used for a disaster recovery operational failover in a simulated scenario.AR/VR are not todays hot technologies, but they should nonetheless be listed in IT strategic plans, because they are logical extensions of more corporate virtualization. Plus, they can address several of the persistent pain points that companies continue to grapple with.0 Yorumlar 0 hisse senetleri
-
WEWORKREMOTELY.COMLightup Network Solutions GmbH & Co. KG: Part-Time Project Lead Creative Web-Based Telecom Projects (100% Remote)Were a small, fully remote team of 7 building creative, web-based projects in the telecommunications space. We have two talented developers ready to buildbut we need you to lead the way.Were looking for a part-time Project Lead (4 hours/day, MondayFriday) to take charge of defining, reviewing, and shaping our software projects.What Youll Do:Define and lead development of creative telecom web servicesTranslate ideas into clear specs for our 2 programmersReview progress daily and give feedbackTest features, spot bugs, and adjust prioritiesCollaborate directly with the company foundersWhat You Bring:Experience managing digital/software projectsStrong understanding of web development workflowsExcellent communication and organizational skillsDetail-oriented when testing and reviewing softwareBonus: experience with telecom, Linux, Asterisk, kamailio, VoIP, SIP, DIDs, call termination & origination, Origin-Based Rating (OBR)Details: Part-time: 4 hours/day (MondayFriday) 1,000/month 100% remote High ownership, lots of creative freedomHow to Apply:Send us a short intro about yourself, what youve worked on, and why this role excites you. Portfolios, product stories, or anything that shows your style are welcome.Please note the fixed salary of 1000 EUR / month.-> [emailprotected]0 Yorumlar 0 hisse senetleri
-
WWW.ARCHITECTSJOURNAL.CO.UKCouple sue developer of PLP-designed office block over right to lightThe allegedly offending structure is the 19-storey Arbor Tower, a 34.9 million office block built for developer Native Land, which opened in 2023.Stephen and Jennifer Powell, who live in th CZWG-designed Bankside Lofts (1999), a neighbouring building by the River Thames, are seeking a court order to demolish Arbor Tower on the grounds that it blocks out their light, The Times reports.The couple claim that the height of the building blocks out so much natural light that it stops them reading in bed, according to the newspaper.AdvertisementThe 28,000m next generation workspace forms part of a wider PLP-designed development between Blackfriars Bridge and Tate Modern.When complete, the 1 billion Bankside Yards will consist of eight towers, including Opus, a 50-storey residential skyscraper set to open in spring 2025. Source:PLP Architecture / WireCollectiveBankside YardsBut the Powells, along with their upstairs neighbour, Kevin Cooper, are seeking legal action on the grounds that Arbor Tower obstructs their right to light.The claimants are asking High Court judge Mr Justice Fancourt to order that Native Land alters plans for the unbuilt sections of Bankside Yards to make up for the loss of light cause by Arbor Tower and have told the court that, as a last resort, they will ask for the tower itself to be demolished.If their bid is successful, a court injunction could force the developer to remove the offending obstruction to the view of the sky in other words, to demolish Arbor Tower.AdvertisementIf the injunction bid fails, the trio has claimed damages which could run to millions of pounds, according to The Times. Compensation can be paid to an injured party in right to light cases as an alternative to an injunction for the loss they have suffered as a result of the obstruction. Source:Google Earth Tim Calland, a barrister acting on behalf of the residents, told the judge that his three claimants maintain that the exceptional natural light in Arbor Tower will have been achieved wrongfully at the expense of their light.But lawyers for the developers have insisted that demolishing Arbor Tower would constitute a gross waste of money and resources and suggested to the High Court that neighbouring residents could use an electric light to read in bed.John McGhee KC, representing the developers, insisted that the loss of light caused by Arbor does not substantially interfere with the use or enjoyment of the [Bankside Lofts] flats and as such is not an actionable nuisance.McGhee told the court that the developers had engaged extensively with all other neighbouring property-owners whose light might be impacted, and that almost all of them had agreed to drop any claims in exchange for modest sums of compensation.The AJ has approached Native Land for comment. PLP declined to comment.0 Yorumlar 0 hisse senetleri
-
0 Yorumlar 0 hisse senetleri
-
WWW.CNET.COMBetter Video Games Are Possible With Better Lives for Developers, New Industry Union SaysGamers will get better games, while developers enjoy a higher quality of life, the United Videogame Workers says.0 Yorumlar 0 hisse senetleri
-
WWW.SCIENTIFICAMERICAN.COMWhats the Definition of a Moon?March 20, 20255 min readWhat Makes a Moon?Defining the word moon is harder than you might thinkBy Phil Plait edited by Lee BillingsA quintet of Saturns moons come together in this image from NASAs Cassini spacecraft. NASA/JPL-Caltech/Space Science InstituteHeres a simple question: Whats a moon?As with so many questions in science, it may seem straightforward but truly isnt. Why, a moon is a celestial body that orbits a planet, youre probably thinking. Well, sureif you squint your eyes and dont look too closely, thats a pretty decent description.But rigidly defining the term moon isnt so easy.On supporting science journalismIf you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.The canonical example is of course our own moon, a decently big chunk of rock that orbits Earth. But centuries ago the first telescopic observations of other planets revealed that many have moons as well; Jupiter has four giant, easily seen satellites, and Saturn has several that are visible by modest means as well. So at that point in time, our definition of moon seemed safe enough.Then, of course, things got complicatedbecause they always do. As telescopes got bigger and better, more moons were found. Mars has two, and poor Mercury and Venus have none, but in contrast, moons seemingly kept sprouting on Jupiter like mushrooms after a rainstorm. For the first half of the 20th century, Jupiter was known to have an even dozen. A handful more were found telescopically in the 1970s, and the numbers jumped a bit when we started sending spacecraft to the outer planets. Then, in the 2000s, the numbers leaped upward as more exacting techniques were used to scrutinize Jupiters environs.As of this writing Jupiter has 95 confirmed moons. They range in size from mighty Ganymede, the largest in the solar system at more than 5,200 kilometers acrosswider than the planet Mercury!to the tiniest that were able to see from Earth, at roughly 1 km in diameter. Saturn is more distant from us than Jupiter, so its moons are harder to see, yet we now know it boasts at least 274 moons, a staggering number! Of these, 128 were just announced this month by scientists who had used an advanced searching technique that allows extremely faint satellites to be spotted in telescopic observations. Most of these new additions are only a few kilometers across.Its clear that with ever more powerful equipment, well find that many planets have orbital companions of arbitrarily small dimensions. Is something the size of a football stadium a moon? Sure! But what about something the size of a car, a basketball or a grape? What about a grain of dust?Saturns rings are composed of trillions of small icy particles. Is each of these a moon?At some lower limit, that term just doesnt seem to fit.The problem is further complicated by the fact that many asteroids have moons. More than 430 asteroids are known or suspected to be orbited by smaller asteroids. Its possible that those satellites were formed from low-speed collisions that either ejected material that subsequently coalesced as moons or slowed two asteroids enough to put them in orbit around each other. In some cases an asteroid and its moons may have even formed together.Out past Neptune are countless small icy and rocky bodies called Trans-Neptunian Objects (TNOs), and many of these have moons as well. While some TNOs could be called dwarf planets because of their size, many more are tiny and dont even come close to falling into that category.And, although I hate to complicate things even more, I should note that if we broaden our moon definition to any object that orbits something bigger, then planets are moons. Even small stars that orbit big stars would be moons!Clearly were running into trouble trying to hang the word moon on these objects.Theres also the problem that the arguments for what makes a moon can change when viewed differently. For example, the suns gravity tugs harder on the moon than Earths does! So does the moon orbit the sun or our planet? Well, the trick here is that both Earth and the moon orbit the sun together. The suns effect on both is equal, so in a sense it cancels out, and therefore the moon orbits our own planet more than it orbits the sun.Theres actually mathematical support for this. Its possible to balance out the equations of gravity for a planet and star, including the centrifugal force created by the orbiting body, to see how far a planets sphere of influence stretches. This area, where the planets gravity locally dominates over the star, is also called the Hill sphere, after American astronomer George Hill, who first derived it. The Hill sphere for Earth, given its distance from the sun, is about 1.5 million km. The moon is only about 385,000 km from Earth, so its well inside our Hill sphere and therefore more under Earths influence than the suns.This region of space grows larger the farther a planet is from its star. Jupiter is more massive than Saturn, but Saturn is farther from the sun, so its Hill sphere is nearly twice the volume of Jupiters. That may be why weve found so many more moons orbiting Saturn even though its more distant from Earth and thus harder to search for companions.Neptune is so far from the sun that its Hill sphere is the largest of all the planets. Its possible that Neptune has far more moons than Jupiter or Saturn, and we just havent found them yet because theyre too faint to easily see from Earth.This still leaves us with some interesting edge cases. Pluto has five known moons. The largest, Charon, was discovered in 1978. Its roughly half the diameter of Pluto and has about one eighth its mass. Because of this, Charon doesnt so much orbit Pluto as they both orbit their barycenter, a mutual center of mass. This is like two people on a seesaw; the balance point is closer the person who weighs more. The Pluto-Charon barycenter is actually outside the body of Pluto itself! So is Charon a moon? Or is it more that they both comprise a binary planet?Even trickier, its possible for moons to have moons! Similar to the Hill sphere argument for planets, some moons can have a large enough sphere of influence to potentially possess moons of their own. What do we call these? Some people argue for the term moonmoon, which is delightful but somewhat imprecise. I prefer submoon.Dont even get me started on quasi-moons.In the end, the problem lies in our preference for straightforward simplicity rather than complex nuance; rigidly defining the term moon is hopeless because its not definable. Its a concept more than a definition, much like the term planet. Perhaps thats why the International Astronomical Union, the official keeper of celestial names and definitions, doesnt have a definition for what makes a moon.Humans like to put things in distinctive bins, but nature is not so prejudiced. Whenever objects fall into a range, a spectrum of characteristics, the transition along that spectrum tends to be smooth, and trying to wedge them into defined borders winds up generating more exceptions than rule-followers.Sometimes its best to accept something for what it is and not how it falls into our narrow classifications. You can understand it better that way, and isnt that the point?0 Yorumlar 0 hisse senetleri
-
WWW.SCIENTIFICAMERICAN.COMHow Real Is Severance? The Shows Neurosurgery Consultant Breaks Down Its ScienceMarch 20, 2025The Neurosurgeon Who Advised Severance Breaks Down Its ScienceA neurosurgeon who has acted as a consultant for Severance explains the science behind the shows brain-altering procedureand whether it could ever become reality. Anaissa Ruiz Tejada/Scientific AmericanSUBSCRIBE TO Science QuicklyRachel Feltman: For Scientific Americans Science Quickly, Im Rachel Feltman. Today were talking about the science of Severance.What if instead of struggling to find work-life balance, you could completely separate your professional identity from your personal one? That question kicks off the Apple TV+ show Severance, which just wrapped up its second season.In the world of the show, a company called Lumon Industries requires certain employees to undergo its severance procedure, which its spokespeople say means youll never have to take work home with you again. It also means you have to get a microchip implanted into your brain.On supporting science journalismIf you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.To help make the procedure and its effects as realistic as possible, the folks behind Severance brought on a real-life neurosurgeon to consult on the show. Vijay Agarwal is chief of the Skull-Base Tumor Center at Montefiore Einstein [at the Einstein College of Medicine]. We sat down with him to get the inside scoop on the science of severance.Before we get into that chat, just a brief spoiler warning: we did our best to avoid any super-specific spoilers for recent episodes, but wed recommend waiting until youve watched at least episode seven of season two before listening.Thanks so much for coming on to chat with us today.Vijay Agarwal: Yeah, my pleasure.Feltman: So tell me how you got involved with the show Severance and what thats entailed.Agarwal: You know, its sort of hard for people to believe, but it really was just a call out of the blue. Just one day at work I got a call that they were looking for someone for a concept for a show that hadnt come out yet. That was pre-COVID, in a very different world ...Feltman: Right.Agarwal: Than we live in now. And it was just as simple as that. It was just a thought at that stageyou know, We wanna develop a procedure that implants a chip that separates your work life from your social life, from your everyday life. And we were off to the races.Feltman: Yeah. What were your initial thoughts and reactions when you first heard that premise?Agarwal: I thought it was a very cool concept, and I think I just directly went into how that could be a reality. You know, one of the things that Ben Stiller was really strict on was that he wanted this to be as believable as possible ...Feltman: Mm.Agarwal: As real as possible. There are some sort of creative allowances that happen as part of this process, but he really wanted the science to be real and to be believable, and I think thats part of the reason that people have really bonded with the show and in particular the science.Feltman: Yeah, well, thats a great segue to my next question, which is: What are some of the, the real science concepts and, you know, factual medical procedures that youve baked into the concept of the severance procedure?Agarwal: I made a statement a while ago that I dont think were far off from things like this happening, and I really firmly believe that. And were actually much closer than when I made that statement.Feltman: Mm.Agarwal: So if we had told somebody a few years ago that we would be implanting electrodes in the brain to stimulate the brain to treat people who are paralyzed and allow them to be able to walk again or treat their obsessive-compulsive disorder, their addiction, their severe suicidal depression, obesity, things like that, we would think people are crazy, but those things are actually happening currently in science. And almost every major academic center around the world is doing these sorts of procedures every day, in particular to help people with diseases like Parkinsons disease. And so it seems like a very science fiction-type concept, but its part of our everyday life as neurosurgeons and neuroscientists.Feltman: Well, and can you walk me through, you know, in creating the concept for the severance procedure, where did you sort of pepper in factual details, you know, for example, the placement of the chip?Agarwal: I actually think that that scene is very, very realistic.Feltman: Mm.Agarwal: And so weI borrowed from the science and the surgeries that we do today, even. So some of the navigation equipment that we use, I had that equipment shipped in. And so when I started, it really was just a concept: How do we develop the severance procedure? How do we sever people? Then we sort of developed the science, and I remember veryin the early days of the show sitting at a, you know, a big conference table with Ben and Dan [Erickson] and a lot of the producers, and we just had a whiteboard in it, and we would just spitball concepts ...Feltman: Mm.Agarwal: Until we found one that was, you know, really believable and the one that people liked and the one that Ben thought would fit with his vision.And so we really implant in an area that is able to process memories but, interestingly, associates those memories with emotion. Its the amygdala and hippocampus, so those sort of middle part of the structures, on the left side of the brain, which is the dominant side of the brain for most people. So what a great area to stimulate to really facilitate this ability to separate our innies from our outies: number one, the ability to process memories, but then, number two, the ability to, to associate those memories with emotion. So that was a perfect place to do it. And then, actually, the procedure was very realistic. So how we put the hole in the skull, the needle with which we use to implant the chip, those are things that we use every day in neurosurgery and neuroscience currently.Feltman: And you actually appear on camera to do the procedure, is that right?Agarwal: Season one, episode twoso when we implant the chip in Helly. So we really designed that set. So, you know, Ben had a very specific vision in mind, and then our goal was really to try to make that vision become a reality. And so everything was important on that set, from the scientific accuracy to the lighting to the cinematography. And so it was all specifically laid out to capture a purpose. And so thats the episode that I appeared in and very proud with the, the way it came out.Feltman: Yeah. So just to really spell out the actual neuroscience here, which I think is so cool, in your mindpardon the punwhat is that chip doing in there, in that part of the brain?Agarwal: As I mentioned before there are semultiple companies trying to do something on a different scale, which is trying to stimulate the brain to alter the way that it functions: so Elon Musks Neuralink; a lot of my friends are working on this technology at different centers around the country; Synchron is another company based out of New York thats trying to do something similar in terms of being able to modify the function of the brain by inputting electrical stimulation.And Elon, he gave a talk at one of our recent neurosurgery meetings, and hes compared the brain to a big circuit board. And then he likened the work that theyre doing with Neuralink is really adjusting the electricity thats going into the circuit board to modify the way that it fires, to change the way that it fires and really dictate how that circuit board functions to make your computer run a certain way, your TV run a certain way. And I think thats really the best way to look at what were doing in the severance procedure.If you look at the brain as, as one big computer, if you change the way that you, instruct the computer to function by really changing the way youre putting electricity in, by firing all of these neurons across the brain, you can really affect the way that your brain processes or pulls memories from its memory bankand then also to potentially modify what emotions are associated with those memories as well.And thats what the amygdala and hippocampus does: so the amygdala is very famous for fear responses and things like that, very profound emotion. And if you followed season two, I think this concept of fear and these really dark emotions are really prevalent in this season. And so whenone of the recent episodes, where we follow Cobel going to where she grew up, its a very kind of dark, fearful episode. And so thats exactly the type of brain and the emotions that were trying to conjure, is the stimulation of this amygdala and hippocampus.Feltman: Yeah, speaking of season twoI mean, back in season one, we were introduced to this concept of reintegration, where the severed consciousnesses kind of come back together, and weve seen a lot more of the messiness of that process in season two. Did you weigh in at all on what that might look like from a neuroscience perspective?Agarwal: Yeah, so I was actually on set for a lot of that work in terms of the reintegration, just to make sure that work was being done well. I worked with Adam Scott, who plays Mark, on some of the things, such as, in one of the recent episodes ...Feltman: Hmm.Agarwal: He had a seizure, and I thought he did an absolutely brilliant job portraying that, and, you know, it really shows sort of the academic stint a lot of the actors and Ben take in the show; I think Adam Scott and Ben Stiller in particular really look at this as almost homework, to try to really understand it. And so I helped Adam, and I was, you know, sendtexting with him after that episode because I was just so proud with how that seizure came out. It was, you know, it was very realistic, and thats a hard thing to capture.So we worked on that, and then the reintegration procedure, I had a lot of input with how that would workyou know, what sort of science would go into something like a reintegration procedureso I remember sending and reviewing ...Feltman: Mm.Agarwal: Articles from the literature about being able to do things that would be likened to reintegration or to really enhance things like electrical stimulation. We were able to use almost like a transmagnetic stimulation-type device. We were able to really use very realistic scientific methods to incorporate into this reintegration.Feltman: Yeah, and for listeners who dont know, could you talk a little bit about what TMS is and how it relates to what we saw in that reintegration episode?Agarwal: Yeah, transmagnetic stimulation, its an amazing technology, and its basically putting these magnetic fields into the brain to alter the way that your brain fires. And theres very good data to show that people who have become paralyzed can regain some functionalityso some ability to movein areas that are either weak or paralyzed.And so theres a lot of different uses for transmagnetic stimulation, and its delivered very similarly to the way that we saw in one of the earlier episodes, where Reghabi is reintegrating Mark in his basement. And so theres actually, today in society, transmagnetic stimulation medical spas ...Feltman: Mm.Agarwal: That you could go to to receive this very intense therapy. And so theres a lot of people who feel that this is really gonna be a major advance for us to use against things like paralysis and depression and things like that.Feltman: Yeah, thats super interesting.Speaking of reintegration weve seen some random acts of basement neurosurgery [laughs] in this season. From a neurological standpoint what kind of risks would someone like Mark be facing in that situation?Agarwal: I think there was a bit of a red herringso in one of the earlier episodes this season, where Reghabi was reintegrating Mark, you could see, as she was delivering this transmagnetic-type stimulation on the left side of the brain, his right hand start to shake ...Feltman: Mm.Agarwal: Really the left side of the brain controlling the right side of the body. And so the same risks that we saw, namely seizure, which we saw him have a very sort of total body seizure, those sorts of things would be a big risk. So bleeding in the brain: the brain didntdoesnt like anything sort of entering into the brain or disturbing the brain; its about a 1 percent risk of what we say is hemorrhage. Infection: so there being a big infection in that area, thats also a possibility. But I think irritating the brain is one of the most common side effects of a procedure like that. And when the brain is irritated, oftentimes itll manifest by seizing ...Feltman: Mm.Agarwal: Which means really firing electrons abnormally in the brain, which is what we saw.Feltman: So weve talked about season two a little bit and about fear and, and emotion in memory. Obviously, in one of the kind of biggest and most impactful episodes of season two, we saw a character who seemed to be severed many times over and have this, like, very compartmentalized consciousness and was experiencing a lot of emotions that were then cut off when they emerged from, you know, that area of the floor they were on. How much more complicated do you think that would be than sort of a standard severance floor chip behavior weve seen so far?Agarwal: You mean in real life?Feltman: Yeah.Agarwal: I think it would actually be less complicated ...Feltman: Oh, yeah?Agarwal: So currently, right now, theres these amazing videospeople who wanna go to YouTube and see this, they canthese very amazing videos of people with Parkinsons disease, which is a neurodegenerative disease, and oftentimes one of the biggest symptoms they have is uncontrollable shaking. So we actually, as part of the standard of care of treating these patients, well put electrodes into very specific parts of the brain and deliver electricity, and when you turn it on theyll almost completely stop shaking. And when you turn it off, which is a flip of a switch externally, they start shaking uncontrollably, to the point that they cant care for themselves, they cant shower, they cant eat, they cant function in societyjust from a flip of a switch externally.So imagine youre able to do that from, like, your phone, anywhere in the world. But then it allyou know, it begs the question: Who is the one flipping that switch? And ethically who should have the right to flip that switch?Feltman: Yeah. Last question: you know, Severance is one of those shows that inspires so many fan theories, more and more with every episode. Im just curious, when friends and patients talk to you, how often do you get people trying to, you know, pull some secret Severance info out of you or get you to weigh in on their theories?Agarwal: Yeah, you know, itsI think people have strayed away from doing that. What Ive noticed is that I actually rarely get asked, and thats good because my response is always, Well, I guess youll just have to see the rest of the season, so Ive been trained well.But I actually have more people, even in the general community, just wanna talk about ...Feltman: Mm.Agarwal: The show, not specifically trying to figure out what happens in the later episodes; theyre just so fascinated with the show and the concept and the way that its written and the work that, you know, Ben, Dan and Mark have doneand the rest of the team as well. And its really amazing to see the response to the show cause people just wanna talk about it.Its like when people read a good book and they wanna talk to other people who have read the book and they just really delve into, you know, What did this mean? What do you think this means? And people just wanna talk about the show. And I absolutely love it cause I think its brilliant, I love the show, I love watching the show, and I, you know, love talking about it. And so I actually dont get people really poking about what happens later on in the show. I get people who really genuinely enjoy it and actually just wanna talk about it, just wanna talk shop, and I enjoy that as well, and I think that really speaks to the response the show has had.Feltman: Absolutely. Well, thank you so much for joining us to chat. As a Severance fan I have really loved this, so we really appreciate it.Agarwal: Yeah, my pleasure, and Im excited for you guys to see the rest of the season.Feltman: Thats all for todays episode. If youre listening to this in our podcast feed, you can check out a version with video over on our YouTube channel. Well be back on Monday with our usual science news roundup.Science Quickly is produced by me, Rachel Feltman, along with Fonda Mwangi, Kelso Harper, Naeem Amarsy and Jeff DelViscio. This episode was edited by Alex Sugiura. Shayna Posses and Aaron Shattuck fact-check our show. Our theme music was composed by Dominic Smith. Subscribe to Scientific American for more up-to-date and in-depth science news.For Scientific American, this is Rachel Feltman. Have a great weekend!0 Yorumlar 0 hisse senetleri