The Ocean Avenue News - oceanavenuenews.com

The FAA says this could be the third-busiest travel weekend of the year so far, while AAA warns we could see more traffic on the roads than in years. Here’s what to know if you’re flying or driving.

(Image credit: Brandon Bell/Getty Images)

Ex-ITV journalist, who lasted less than a year in role, says No 10 is ‘demanding and high-pressure place to work’

Rishi Sunak’s director of communications has quit her role, as Downing Street’s mini-reshuffle took an internal turn.

The former ITV journalist, Amber de Botton, who was brought in to salvage the government’s sinking reputation when Sunak took over from Liz Truss as prime minister, announced on Friday she had “decided it is the right time to move on”.

Continue reading…

Putin, Prigozhin and the shadow of Anastasia  Eurasia Review

Russia-led alliance holds military drills in Belarus  The Washington Post

U.S. colleges often slash thousands of dollars off the “sticker price” to entice students to enroll. The more options a student has, the bigger the discount a college needs to offer. However, the savings have disproportionately gone to white and Asian applicants.

“Put merit in quotation marks,” says one admissions official. “It’s not really about rewarding students for their wonderful performance in high school, as much as it is trying to change that student’s enrollment decision.”

Read more from Jill Barshay in The Hechinger Report. (July 2023)

The classes, “Important Conversations” were introduced after the start of the Kremlin’s assault on Ukraine to boost patriotic sentiment.

Despite a bomb threat on their first day of school, and the now common missile and drone attacks from Russia, children in Kyiv were happy to be back in their classrooms

ReversingLabs researchers linked the VMConnect campaign to the North Korea-linked APT group Labyrinth Chollima.

ReversingLabs researchers believe that the North Korea-linked APT group Labyrinth Chollima is behind the VMConnect campaign. Threat actors uploaded a series of malicious packages to the PyPI (Python Package Index) repository, including a rogue package posing as the VMware vSphere connector module vConnector named VMConnect targeting IT professionals.

The state-sponsored hackers uploaded the malicious packages in early August.

The APT group uploaded two dozen malicious Python packages to the Python Package Index (PyPI) repository. The researchers were not able to obtain samples of the second-stage malware used in this campaign.

“The packages mimicked popular open-source Python tools, including vConnector, a wrapper module for pyVmomi VMware vSphere bindings; eth-tester, a collection of tools for testing Ethereum-based applications; and databases, a tool that gives asynchronous support for a range of databases.” states the report published by ReversingLabs. “an analysis of the malicious packages used and their decrypted payloads reveals links to previous campaigns attributed to Labyrinth Chollima, an offshoot of Lazarus Group, a North Korean state-sponsored threat group”

The researchers also identified three more malicious Python packages that are believed to be a continuation of the VMConnect campaign: tablediter, request-plus, and requestspro.

tablediter was mimicking the legitimate prettytable Python tool that developers use for printing tables in an attractive ASCII format. Prettytable has more than 9 million monthly downloads, for this reason threat actors are targeting its users with a typosquatting attack. 

tablediter is very similar to previously discovered malicious packages in the VMConnect campaign. The most significant difference is that the malicious functionality is not executed when the package is installed, but it is triggered when the package is used in a project. The malicious code is not executed through the __init__.py file during the package installation, instead, it was added to a function called add_row, which is a part of the tablediter class defined in the tablediter.py file. The code will be executed during testing of the application on a developer’s workstation or during execution by a user working with published software that has incorporated the malicious tablediter dependency. 

Upon executing the package, the code calls a method from a file, bounding.py, that is located in the edt subdirectory. Then this method receives a parameter that represents an XOR key used to decrypt the content of a hex-encoded string enclosed in the package.

For the other two packages of the trio, request-plus, and requestspro, threat actors appended the “plus” and “pro” suffixes to the name to make them appear as legitimate packages with additional capabilities.

The packages gather information about the infected machine and send it to the C2 server in the form of a POST HTTP request.

The C2 server responds with a Base64/XOR obfuscated Python module with execution parameters. The module also includes the download URL for the next stage payload, which researchers couldn’t retrieve.

The researchers noticed that the module includes the URL for the next stage payload.

“The team believes the module gets executed after decoding and then downloads the next stage of the malware. As was the case in the earlier iteration of the VMConnect campaign, the C2 server associated with the campaign did not provide additional commands by default, but rather waited for a suitable target, making it difficult to assess the full scope of the campaign.” continues the report.

The attribution to the Lazarus subgroup Labyrinth Chollima is based on similarities in the malicious code employed in the campaign. The ‘builder.py’ file in the malicious packages contains the same payload decoding routine that the JPCERT discovered in another file called ‘py_Qrcode’ attributed to the Lazarus subgroup tracked as DangerousPassword.

“Based on those attributions and the described code similarities between the packages discovered in the VMConnect campaign and the campaign described in the research published by JPCERT/CC, the ReversingLabs research team has reached the conclusion that the same threat actor is behind both attacks and, therefore, that the VMConnect malicious campaign activity can be linked to the North Korean state-sponsored Lazarus Group” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)

The post North Korea-linked APT Labyrinth Chollima behind PyPI supply chain attacks appeared first on Security Affairs.

U.S. stock index futures were higher on Friday ahead of a keenly awaited reading that could show job growth likely slowed in August, bolstering expectations of a pause in the Federal Reserve’s interest rate hikes.

The Labor Department’s closely watched report, due at 8:30 a.m. ET is expected to show nonfarm payrolls likely increased by 170,000 jobs last month, following 187,000 additions in July.

The unemployment rate, however, is forecast to stay unchanged at 3.5%.

“There have been indicators that the U.S. jobs market is finally starting to lose some of its tightness, and if the NFP print confirms this trend, it will be one less thing for the FOMC to worry,” said Tim Waterer, chief market analyst at KCM Trade.

The payrolls report will follow recent data showing a fall in job openings and softer-than-expected private employment growth.

An inflation reading has also supported hopes of the Fed hitting a pause on its market-punishing tightening campaign, pushing the tech-heavy Nasdaq (.IXIC) up to a four-week high.

Other data points are also on the radar for the day, with the S&P Global Manufacturing Final PMI due at 9:45 a.m. ET and the ISM Manufacturing PMI due at 10 a.m. ET. Both readings are for August.

Money markets see an 89% chance of a rate-hike pause in the September policy meeting and a 56% chance of a pause in the November meeting, according to the CME FedWatch Tool.

Broadcom (AVGO.O) fell 4.2% premarket as the chipmaker projected current-quarter revenue below expectations on softening enterprise demand.

At 7:09 a.m. ET, Dow e-minis were up 121 points, or 0.35%, S&P 500 e-minis were up 14.75 points, or 0.33%, and Nasdaq 100 e-minis were up 22.25 points, or 0.14%.

Dell Technologies (DELL.N) jumped 10.1% after the personal computer maker raised its annual forecasts for revenue and profit as it benefits from the artificial intelligence boom.

Lululemon Athletica (LULU.O) gained 2.1% after the yogawear maker said on Thursday its third quarter was “off to a solid start” and lifted its annual profit and revenue forecasts for a second time.

Algerian authorities shot dead at least one Moroccan tourist after a group of five strayed into Algerian waters on jet skis, according to one of the survivors.

Only two of the group returned home, said relatives of the victim and the family of a second man who is missing and presumed to be dead.

The incident took place on Tuesday after the five men lost their bearings while exploring the sea on jet skis near the Moroccan coastal resort of Saidia, on the border with Algeria, said Mohamed Kissi, who survived the incident and who says his brother was killed.

The border between Algeria and Morocco has been closed since 1994 and the two have had no diplomatic relations since Algiers cut ties with Rabat in 2021.

Speaking in a video published by Morocco’s le360 news site, Kissi said the group of friends had been approached after dark by an Algerian government vessel.

He said he heard the boat firing on the group and said his brother Bilal, 29, and another man, Abdelali Mechouar, 40, were both shot dead. Another member of their group was detained by the Algerian authorities, Kissi said.

Moroccan authorities said they could not comment on the case, calling it a judicial matter.

Algeria’s navy and foreign ministry did not immediately respond to a Reuters requests for comment.

Mohamed and Bilal Kissi, along with the unidentified man who is presumed to have been arrested, each have dual Moroccan and French nationality, local media said.

France’s Foreign Ministry said it had learned of the death of one of its nationals and the detention of another in Algeria and was in touch with the families and with authorities in Morocco and Algeria.

Bilal Kissi’s body was found by Moroccan fishermen and he was buried near the eastern Moroccan city of Oujda on Wednesday, his brother said.

Mustafa Mechouar, the father of Abdelali Mechouar, told Reuters he believed his son was dead and wanted to bury him.

“I appeal to Moroccan and Algerian authorities to reach an agreement to bring my son back to me to observe a proper funeral and burial for him,” he said.