Monech

Monochromatic photography means using only a single color with a few variations in shades. In the post-production of these photos, special effects are added to deliver a stunning and captivating appearance. To make things simple, many consider black and white photos as monochrome photos, but it’s not always true. Shooting your subject with monochrome black and white filters makes your snap appear more emotive and dramatic. Photographers appreciate mono photography because these kinds of photographs have a minimum color to distract. They leave the viewer to focus on important elements of the image. The most interesting fact is that you can use tonal contrast to represent your story idea and emotions of the subject. B&W is how photography initially started and surprisingly it is still quite complex to master monochrome art. is not just all about taking black & white photos. In this blog, you can get a better insight into this amazing art. You will also be able to gain a handful of tips to get started with superb monochrome photography. So what are we waiting for? Let’s begin. Monochrome photography Study Your Scene If you want to capture monochrome photos you need to plan in advance for perfect shooting. Decide a golden hour for a perfect shoot. Learn how to illuminate the right part of the subject with the proper amount of light, and observe which part is left in shadow. Thus, you will know how to place your object in the frame. Pre-visualize the picture with monochrome effects apart from the colorful composition. You will observe the strong image created with one color works so well and the clean leading lines can grab viewers’ attention easily as well. Scene Should Fit Your scene should fit in the composition well. Your eyes need a lot of practice to observe which scene would fit better in a monochrome frame than in a colored frame. Natural spots are good for monochrome frames because of sharp leading lines and outstanding contrast combination. Shoot Raw And Experiment Shoot in raw format and add filters to your file in post-production to maintain the superior quality of the image. Also, try to capture the dynamic atmosphere from long distances and add movement to it for better visual impact. Take advantage of things that are moving in your frame by describing them in-depth with a gradient. Focus On Patterns In a colorful image, the color pops out the subject and objects around it. But remember, in the case of a monochrome shot, you need a strong composition of patterns, textures, and leading lines to catch the viewer’s eye. For better effectiveness, try to highlight and darken the clipped parts accordingly. It’s good to apply a lot of contrast to your image to emphasize the subject shapes and lines. So, deepen the black and brighten the white. Focus On Patterns In a colorful image, the color pops out the subject and objects around but in the case of a monochrome shot, you need strong composition of patterns, textures, and leading lines to catch the viewer’s eye. For better effectiveness, try to highlight and darken the clipped parts accordingly. It’s good to apply a lot of contrast to your image to emphasize the subject shapes and lines. So, deepen the black and brighten the white. Lens Filters Lens filters in monochrome photography allow the use of a neutral density filter which can control the light coming into the lens while covering a long dynamic range. You can also use polarizing filters for reducing reflection and adding high contrasting effects. A polarizer is essential while you are covering water surfaces in your snap. Cameras There are available that are specially designed to shoot monochrome scenes only. These cameras are having the potential to offer you cleaner and sharp edge black and white images. These cameras can balance the effects of shadow, tones, contrast, shapes, and texture so well in order to pull real emotion out of the image. professional cameras Conclusion If you are already an expert in taking creative color photos, you just need to reevaluate and change the way you view your subject. To take monochromatic photos you need to pay attention to the shooting scene, tonality, image patterns, leading lines, and composition significantly. To take amazing monochromatic images, you need to gear up your photography techniques with advanced equipment like B&W cameras and lens filters. But be careful; the same techniques will not work for every snap. So, get ready to expose the world to a new height of monochromatic photos beyond the color decorative. Originally published on https://gophotoglife.com/how-to-take-mono-photography/

The Ultimate Guide to Monochromatic Photography

It’s been a few weeks since 18,000 people gathered at the Grace Hopper Celebration of Women in Computing. I attended with a focus on learning more about what technologists are doing in the areas of Artificial Intelligence (A.I.) and the Internet of Things (IoT). Personally, I’m interested in A.I. and how it applies to my work as an Information Architect and how chatbots and content recommendation engines can help my users more easily and naturally find what they are looking for. I’m interested in IoT as it applies to my newbie-level work on e-textiles. With so many impressions and ideas tucked into my head, I left the conference inspired and yet tongue-tied. I knew that something profound needed to be teased out, but what? As I prepared for and traveled to the conference, I monitored Twitter #ghc17 to get a preview of the scene at the conference. The top tweet was a supportive rallying cry from a tireless male ally and I was inspired. As the day went on, this tweet remained as the top tweet, and it made me wonder. As I prepared to write this post, I checked Medium itself to see impressions from Grace Hopper. The top result was a thoughtful post from a male attendee of Grace Hopper 2016. This also made me wonder. How can it be that representative voices of this conference about women in computing — one rising to the top for the first 24 hours and one rising to the top a year later — are not the voices of women? As a woman of color, I’m not shocked, as I see an endlesss queue of folks who don’t know my experience, put into positions of being the dominant voices speaking about and around my experience, whether they like it or not. And, I’m not asking in outrage. Here’s a :-) to prove it. I’m asking because it’s an interesting question. I see three factors at work that produced these results: Content User behavior Algorithms The emitted an information scent and evoked that made identify it as highly relevant to users looking for information about Grace Hopper. content user behavior algorithms This is a loaded potion. One could make guesses about why a man’s tweet supporting women would rise to the top of Twitter, besting tweets from women supporting women. One could make guesses about why more womens’ voices speaking on Grace Hopper are not surfaced in Medium’s top search results, instead making the top story a man’s experience at the conference a year ago. But I want to talk about the algorithm. al·go·rithm a process or set of rules to be followed in calculations or other problem-solving operations, especially by a computer. Why the algorithm? The algorithm is the god from the machine powering them all, for good or ill. (from ) How Algorithms Rule the World These Medium and Twitter examples illustrate symptoms of the issue that rose to the top of everything I took away from Grace Hopper: monochromatic algorithms. The lack of diversity in technology we see today is kindling a humanitarian crisis in which ubiquitous monochromatic algorithms will marginalize any people who were not represented in their design and creation. At this point in the flow, we’re hearing the issue surfaced at this level: Women are paid less than men doing the same job. Discrimination in the hiring process keeps women and minorities out of the tech workforce. We don’t have enough women and minorities in the tech workforce candidate pipeline. But to be clear, what I’m talking about is the long-tail problem that will manifest as a result of these initial factors. If we don’t course-correct, our lives in the future will be shaped by algorithms produced by a monochromatic tech workforce that does not understand, reflect, or empathize with its user population. Here are just a couple of examples of these monochromatic algorithms at work: Machine Bias: There’s software used across the country to predict future criminals. And it’s biased against blacks. _On a spring afternoon in 2014, Brisha Borden was running late to pick up her god-sister from school when she spotted an…_www.propublica.org Machine Bias - ProPublica As you hear the following buzzwords in your daily life — A.I., machine learning, neural networks, big data, data science, IoT, and “smart” anything — consider how each of these technologies involves algorithms that dictate rules for how decisions are made. Consider how these algorithms and decision trees are currently being designed and coded by a workforce that may not be able to account for even a tiny sliver of the wide range of human experiences in this world. And that in effect, this tunnel-visioned workforce is determining outcomes in our healthcare, education, housing, environment, communication, and entertainment. Remember that it was not until 1992 that wheelchair access became legally required for public spaces. Also, remember that corporations are people and that some of these corporations are essentially algorithms and how given these rights, these algorithms may be given much leeway over how they control and shape our lives. If the predictive-policing algorithm cited in the Pro Publica story above were designed by a team that included even a single person of color, would its scoring system use race as a factor? Yet something odd happened when Borden and Prater were booked into jail: A computer program spat out a score predicting the likelihood of each committing a future crime. Borden — who is black — was rated a high risk. Prater — who is white — was rated a low risk. Two years later, we know the computer algorithm got it exactly backward. Borden has not been charged with any new crimes. Prater is serving an eight-year prison term for subsequently breaking into a warehouse and stealing thousands of dollars’ worth of electronics. Sure, we’ve been using flawed data for centuries, but the difference now is that these buzzwords are mesmerizing in their promise of a better world, when in reality, they could just be a false veneer over the bad data, convincing us that these algorithms know better. How can something called Big Data be wrong? How can an Internet of Things be bad — it’s the internet (love the internet), but with things (love things). I’m going to overgeneralize by using my mom and dad as examples. My mom believes that A.I. will destroy humanity by becoming smarter than us and making us its bitch. My dad believes that A.I. will be benevolent and can’t possibly do harm because it will be like Data on Star Trek and just to how to do the right thing. know As A.I. moves closer and closer to the heart of our lives, we must consider the words of Dr. Fei-Fei Li ( ) at Grace Hopper 2017: @drfeifei “There is nothing artificial about A.I.” A.I. does not spring to life on its own as pure, objective, god-like technology. Human beings with biases, conscious and otherwise, are the ones putting the “intelligence” into A.I. by designing and coding algorithms and by contributing data to models that are crowdsourced, as with the Google Translate example above. In other words, A.I. can only be as intelligent, or dumb, as we are. My technologist hero Jaron Lanier speaks of the myth of A.I. and how a dangerous echo chamber created when the following factors exist: The root data is bad. We blindly trust A.I. to do the right thing. The user interfaces surfacing the data don’t allow us to question or point out flaws in the data. _To go yet another rung deeper, I'll revive an argument I've made previously, which is that it turns into an economic…_www.edge.org The Myth Of AI | Edge.org The lack of diversity in tech is not just about fair and equal treatment in the workplace, it is also about a much larger crisis: fair and equal treatment in the digital and virtual worlds being built all around us. As the analog world continues to fade and the virtual world comes more and more to the forefront of our lives, are we going to correct the errors and biases built into the analog world or are we going to bake these travesties in all over again? I was blown away by the work Chieko Asakawa shared at Grace Hopper around her use of technology of help blind people be more independent and navigate the world. And at the same time, it highlighted how sight-centric our world is and what an uphill battle it is when you need to retrofit the world to meet your needs when your experience was not considered in its design. We must evolve our tech workforce to reflect the diversity of the real world we live in and include diverse voices in positions that can influence the technology that will shape our lives. If we allow these algorithms and the virtual worlds we inhabit to be built by only a narrow range of people, these systems will inevitably perpetrate biases against those not represented. We will miss out on one of the biggest opportunities in the history of the civilization to fix the most fundamental and profound wrongs in how we inhabit this world. Imagine the end of gender- and race-based profiling and discrimination and where humanity can go without these limitations perpetrated by flawed stereotypes and data. Imagine a world in which we are truly seen and valued for who are are and are treated according to our actual behaviors, not on what we are artificially predicted to do or want. Imagine a world in which technology promises to make the world a better place and actually succeeds in doing so, not just for a narrow demographic, but for everyone. _These principles were developed in conjunction with the 2017 Asilomar conference ( videos here), through the process…_futureoflife.org AI Principles - Future of Life Institute

The Long-Tail Danger of the Lack of Diversity in Tech: Monochromatic Algorithms

Do you remember colors? So I’m sitting here, doing some writing at the coffee shop like I do every day. I’ve got my Macbook. My portable headphone amp. My headphones. And I look down and realize they’re silver, black, and white. all Like, that photo would look nearly the same if I drained all of the color information out of it. Let’s try it. The warm hue of the nearby sunlight is gone, and the colors on the youtube page I was looking at are gone, of course. But my technology stuff looks exactly the same. In a world full of RGB lights, D-brand skins, and style headphones available in you can think of…how did I get here? Why have I personally rebelled against colors? And why have so many other people? every color HyperX Cloud Headphones: Black, white, and silver edition. (Actually the CloudX, but these colors were once again unchanged by the removal of the color info from the photo) Caring about the appearance of your gear is a weird slippery slope. Once you buy thing you like the look of, it’s easier to continue to get stuff that then matches that thing. one I the way the 12-inch Macbook looks. It’s probably my favorite-looking computer of all time. Because I’m not cool enough to pull off the Rose Gold or Gold colors, I got the Silver one. really like that way, more accessories from companies would actually my computer. Plus, non-Apple match It seems like Black has become the default base color for everything tech. While that’s better than the classic computer-beige of the nineties, it’s a little bit weird in a world where anything can one of 16.8 million different colors. easily be I should probably have a whole rainbow of computer products, but I almost always gravitate towards the black or silver option. I’m already too far down this road to escape it, I guess? The one recent exception was the blue camo version of the Logitech G433…but only because it came with an extra free accessory bag. How crazy is that? I only bought something with a fun color because it came with a free bag. And I’m not even using those headphones to write right now. I can see three other people with laptops here at the cafe. Two of them have black Windows laptops, and one has a silver Macbook air inside a matching grey portable folio case thing. Wouldn’t it be if we all had vibrant, neon-colored laptops instead? Or laptops with slick glossy car paint finishes? Or something? so much cooler In this technological world that centers more and more every day around self-expression and online creativity, most of the devices we use to all that creating are clad in relatively lifeless tones. do I’m not saying it’s to like these colors. I’m actually how my monochrome setup looks. It has a film noir quality to it. bad way into So I acknowledge that is a factor. steely coolness It’s just that, even in the mainstream tech market, these shades became the norm. People got about the Jet Black iPhone, and black is consistently the best-selling color of numerous different tech products. interesting so excited Heck, I excitedly bought the limited edition triple-black Bose QC25 headphones when those came out. My home computer case is gray and black. Do we not actually to stand out? Are we all too far down the road for this to ever change? Or is the general allure of the perceived coolness of these metallic tones just too powerful to overcome? want I don’t have the answers to any of this. But I know that it’s worked for me, over and over again, for whatever reason. Please click the heart if you liked this rambling thing! Thanks for spending a little of your time with my thoughts.

My Portable Computing Setup is Strangely Monochrome

Building a User-Friendly Interface for Central Bank Digital Currency Applications: A Case Study 

My team recently discovered , the widely popular graphics library – (with a high NVD severity ). These vulnerabilities cause a denial-of-service and remote code execution. X11’s latest versions contain fixes for these vulnerabilities. two security vulnerabilities in X.Org libX11 CVE-2023-43786 and CVE-2023-43787 CVSS 7.8 The team constantly monitors open-source projects to find new vulnerabilities and malicious packages and shares them with the wider community to help improve their overall security posture. This 2-part blog series provides details of the inner workings of the vulnerable Xpm file format and deep-dives into exploiting these vulnerabilities. What is libX11? Xorg X11, often referred to as X Window System, is an graphical server protocol that enables the creation and management of graphical user interfaces in Unix-like operating systems. It provides a framework for running graphical applications, managing Windows, and handling user input in a networked environment. open-source The libx11 package offers the essential shared libraries that client applications require to render and present data on your desktop. What is libXpm? libXpm provides functions to read, write, and display images in the (XPM) format. X Pixmap XPM primarily aims to generate icon pixmaps with support for transparent pixels. It is based on the XBM syntax, and it can be either a plain text file in the XPM2 format or utilize a C programming language syntax, making it suitable for inclusion within a C program file. XPM image format – versions Predecessor – XBM Before XPM (X PixMap) came to be in 1989, there was the XBM format (X BitMap). A plain-text binary image format, used for storing icon and cursor bitmaps that were used in the X GUI. XBM files are structured as C source files. This is their main distinction from most image formats around today. That way, they can be incorporated into applications directly. However, due to this and the fact no compression can be employed (1 character to 1-byte mapping), they are also far larger than their raw pixel data. X BitMap (XBM) data comprises a sequence of static unsigned char arrays that store the raw monochrome pixel information. For example, the following C code is the XBM file for in the image: hello #define hello_width 35
#define hello_height 25
static char hello_bits[] = {
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 
  0x00, 0x88, 0x00, 0x00, 0x10, 0x00, 0x88, 0x00, 0x00, 0x10, 0x00, 0x88, 
  0x00, 0x00, 0xD0, 0xE1, 0x88, 0x78, 0x00, 0x30, 0x13, 0x89, 0xC4, 0x00, 
  0x10, 0x12, 0x89, 0x84, 0x00, 0x10, 0xF2, 0x89, 0x84, 0x00, 0x10, 0x12, 
  0x88, 0x84, 0x00, 0x10, 0x12, 0x88, 0x44, 0x00, 0x10, 0xE2, 0x89, 0x38, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00
}; Instead of the usual image file-format headers, XBM files have statements. The first pair of values defines the pixel dimensions of the bitmap, indicating its height and width. #define X BitMap (XBM) image data is structured as a continuous sequence of pixel values, which are stored within a static array. Given that each pixel is symbolized by a single bit (with 0 indicating white and 1 representing black), each byte in the array encompasses the data for eight individual pixels. Notably, the first byte’s least significant bit serves as the anchor for the upper-left pixel within the bitmap. XPM1 Meet XPM version 1. First released in 1989, it shares a lot of similarities with the XBM format outlined above. While XBM was monochrome, XPM1 introduced colors to the images. It uses additional macros and variables for colors and replaces bytes with characters for pixel data. For example, here is the same black-and-white picture in the XPM1 format: hello /* XPM */
static char *_hello[] = {
/* columns rows colors chars-per-pixel */
"35 25 2 1 ",
"  c white",
"b c black",
/* pixels */
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"    b              b   b           ",
"    b              b   b           ",
"    b              b   b           ",
"    b bbb    bbb   b   b   bbbb    ",
"    bb  bb  b   b  b   b  b   bb   ",
"    b    b  b   b  b   b  b    b   ",
"    b    b  bbbbb  b   b  b    b   ",
"    b    b  b      b   b  b    b   ",
"    b    b  b      b   b  b   b    ",
"    b    b   bbbb  b   b   bbb     ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   "
}; here denotes the number of colors in the image, and denotes the number of characters per pixel. XFACE_ncolors XFACE_chars_per_pixel Each will be replaced by the white color “#ffffff”, and each will be replaced by the black color “#000000”. a b XPM2 A year later, in 1990, the second version of the format was set to improve things. It simplified things and removed all C code from the image format. The simplified structure: ! XPM2
<Header>
<Colors>
<Pixels> The header line denotes the image dimensions similar to XPM1’s #define statements. The colors section defines the character values. A new type concept was introduced: – is for color pixel c – is for monochrome m – is for grayscale g – is for symbolic s The symbolic feature is used to assign colors by context, and to create variable names for them for easier reading. Example of an XPM2 image, with the same as shown in the previous examples: hello ! XPM2
35 25 2 1
a c #000000
b c #ffffff
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaabaaaaaaaaaaaaaabaaabaaaaaaaaaaa
aaaabaaaaaaaaaaaaaabaaabaaaaaaaaaaa
aaaabaaaaaaaaaaaaaabaaabaaaaaaaaaaa
aaaababbbaaaabbbaaabaaabaaabbbbaaaa
aaaabbaabbaabaaabaabaaabaabaaabbaaa
aaaabaaaabaabaaabaabaaabaabaaaabaaa
aaaabaaaabaabbbbbaabaaabaabaaaabaaa
aaaabaaaabaabaaaaaabaaabaabaaaabaaa
aaaabaaaabaabaaaaaabaaabaabaaabaaaa
aaaabaaaabaaabbbbaabaaabaaabbbaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Apart from hexadecimal color codes, the colors can also be specified using any of the X11 color names (e.g. ), with indicating transparency. red None XPM3 This is the current version of the XPM format. The version, released in 1991, brought back the C code, but instead of using a pure C code style, the values inside are essentially the same as in the XPM2 format. Example: /* XPM */
static char *_hello[] = {
/* columns rows colors chars-per-pixel */
"35 25 2 1 ",
"  c white",
"b c black",
/* pixels */
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"    b              b   b           ",
"    b              b   b           ",
"    b              b   b           ",
"    b bbb    bbb   b   b   bbbb    ",
"    bb  bb  b   b  b   b  b   bb   ",
"    b    b  b   b  b   b  b    b   ",
"    b    b  bbbbb  b   b  b    b   ",
"    b    b  b      b   b  b    b   ",
"    b    b  b      b   b  b   b    ",
"    b    b   bbbb  b   b   bbb     ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   ",
"                                   "
}; As discussed, the XPM format can also represent more sophisticated images, like the JFrog logo: DoS vulnerability – CVE-2023-43786 The CVE-2023-43786 vulnerability is essentially an endless loop resulting from an incorrect recursion stop condition calculation. Fix commit: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/204c3393c4c90a29ed6bef64e43849536e863a86 is a function in libX11 that lets you place images onto an X Drawable, usually an X Window. With this function, one can transfer pixel information from an XImage structure to a designated drawable, like a window or a pixmap, and position it as needed. XPutImage xpmCreatePixmapFromImage The libXpm function calls for this function: xpmCreatePixmapFromImage XPutImage void
xpmCreatePixmapFromImage(
    Display	*display,
    Drawable	 d,
    XImage	*ximage,
    Pixmap	*pixmap_return)
{
    GC gc;
    XGCValues values;

    *pixmap_return = XCreatePixmap(display, d, ximage->width,
				   ximage->height, ximage->depth);
    /* set fg and bg in case we have an XYBitmap */
    values.foreground = 1;
    values.background = 0;
    gc = XCreateGC(display, *pixmap_return,
		   GCForeground | GCBackground, &values);

    XPutImage(display, *pixmap_return, gc, ximage, 0, 0, 0, 0,
	      ximage->width, ximage->height);

    XFreeGC(display, gc);
} In this function, is the source image pixel data to be displayed and is copied to the object (in this case ). ximage X Drawable pixmap_return XPutImage Here is the libX11 function: XPutImage int
XPutImage (
register Display *dpy,
Drawable d,
GC gc,
register XImage *image,
int req_xoffset,
int req_yoffset,
int x,
int y,
unsigned int req_width,
unsigned int req_height){
.....
PutSubImage(dpy, d, gc, &img, 0, 0, x, y,
(unsigned int) width, (unsigned int) height,
dest_bits_per_pixel, dest_scanline_pad);
UnlockDisplay(dpy);
SyncHandle();
Xfree(img.data);
return 0;
}
} LockDisplay(dpy);
FlushGC(dpy, gc);

PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
	(unsigned int) width, (unsigned int) height,
	dest_bits_per_pixel, dest_scanline_pad);.........
} It calls to the function: PutSubImage static void
PutSubImage (
    register Display *dpy,
    Drawable d,
    GC gc,
    register XImage *image,
    int req_xoffset,
    int req_yoffset,
    int x, int y,
    unsigned int req_width,
    unsigned int req_height,
    int dest_bits_per_pixel,
    int dest_scanline_pad)
{
    int left_pad, BytesPerRow, Available;

    if ((req_width == 0) || (req_height == 0))
	return;

    Available = ((65536 < dpy->max_request_size) ? (65536 << 2)
                        : (dpy->max_request_size << 2)) - SIZEOF(xPutImageReq);
    if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) {               [1]
        left_pad = (image->xoffset + req_xoffset) & (dpy->bitmap_unit - 1);
        BytesPerRow = (ROUNDUP((long)req_width + left_pad,
                                dpy->bitmap_pad) >> 3) * image->depth;
    } else {                                                                        [2]
        left_pad = 0;
        BytesPerRow = ROUNDUP((long)req_width * dest_bits_per_pixel,                [3]
                                dest_scanline_pad) >> 3;
    }

    if ((BytesPerRow * req_height) <= Available) {                                  [4]
        PutImageRequest(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
                        req_width, req_height,
                        dest_bits_per_pixel, dest_scanline_pad);
    } else if (req_height > 1) {
        int SubImageHeight = Available / BytesPerRow;

        if (SubImageHeight == 0)
            SubImageHeight = 1;

        PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
                    req_width, (unsigned int) SubImageHeight,
                    dest_bits_per_pixel, dest_scanline_pad);

        PutSubImage(dpy, d, gc, image, req_xoffset,
                    req_yoffset + SubImageHeight, x, y + SubImageHeight,
                    req_width, req_height - SubImageHeight,
                    dest_bits_per_pixel, dest_scanline_pad);
    } else {                                                                        [5]
        int SubImageWidth = (((Available << 3) / dest_scanline_pad)                 [6]
                                * dest_scanline_pad) - left_pad;

        PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
                    (unsigned int) SubImageWidth, 1,
                    dest_bits_per_pixel, dest_scanline_pad);

        PutSubImage(dpy, d, gc, image, req_xoffset + SubImageWidth,
                    req_yoffset, x + SubImageWidth, y,
                    req_width - SubImageWidth, 1,
                    dest_bits_per_pixel, dest_scanline_pad);
    }
} Technical Vulnerability Details Let’s take the following example image: Available [the requested size] = (65,536 * 4) - 28 = 262,116
bits_per_pixel = 32
width = 90,000 pixels
height = 1 pixel Since the image is 32, the conditional statement at [1] will not pass, leading us to enter the alternative code block defined in [2]. bits_per_pixel It then calculates the on [3] then divides it by 8. In our example: BytesPerRow  = 90000 * 32 / 8 = 360,000 BytesPerRow In the example, the check on [4] would not pass, as 360000 is not less than the requested size 262116, and is not able to fit a single line of the requested width into a single request – this initiates the on [5]. else This determines the number of pixels that can be included in a single request. It then initiates a recursive call to the function to pass just that subset, followed by a subsequent recursive call to manage the remaining portion of the line. If needed, this remaining part may also be divided further through additional recursive calls. PutSubImage However, the calculation on [6] fails to take into account the bits per pixel, and the recursive call makes requests sending 2096928 pixels instead of 2096928 bits – which is larger than can be fit in a single request. This leads to , consistently resulting in a number too large to fit and trying again the process to retry with the same values. This recursion persists until the call stack is exhausted. an endless loop of attempting to split the line of pixels The changed the calculation on [6] and took into account the . In the example, it would result in a recursive call requesting to send just 65529 pixels, resulting in a BytesPerRow of 262116 that perfectly fits inside the available space, thus allowing the recursion to make forward progress and finish in just 2 calls. bug fix bits_per_pixel Example proof-of-concept image to trigger the bug: https://github.com/jfrog/jfrog-CVE-2023-43786-libX11_DoS/blob/main/cve-2023-43786.xpm How the bug can be triggered An example of an app that calls the vulnerable libXpm library function is the CLI utility , which is used to display Xpm images on the screen. sxpm It calls the vulnerable Xpm function, which then calls the vulnerable libX11 functions then . xpmCreatePixmapFromImage XPutImage PutSubImage Also published here. Read the second part of this article here: Uncovering and Exploiting a 35-Year-Old Vulnerability, *nix libX11: Part 2

Uncovering and Exploiting a 35-Year-Old Vulnerability, *nix libX11: Part 1

nix libX11-এ একটি 35-বছর-পুরোনো দুর্বলতা উন্মোচন করা: পার্ট 1

Enthüllung einer 35 Jahre alten Sicherheitslücke in nix libX11: Teil 1

Revelando una vulnerabilidad de 35 años en nix libX11: Parte 1

Dévoilement d'une vulnérabilité vieille de 35 ans dans nix libX11 : partie 1

निक्स लिबएक्स11 में 35 साल पुरानी भेद्यता का अनावरण: भाग 1

nix libX11 の 35 年前の脆弱性を明らかにする: パート 1

nix libX11의 35년 된 취약점 공개: 1부

Revelando uma vulnerabilidade de 35 anos no nix libX11: Parte 1

Раскрытие 35-летней уязвимости в nix libX11: часть 1

Nix libX11'de 35 Yıllık Bir Güvenlik Açığı Ortaya Çıkarılıyor: Bölüm 1

Hé lộ lỗ hổng 35 năm tuổi trong nix libX11: Phần 1

揭露 nix libX11 中已有 35 年历史的漏洞：第 1 部分

This is the 13-year journey that resulted in , a different approach to password management. Here goes articles[0] of articles.length == 2. Neulock Part I It was back in 2011. was still movie material; people communicated using monochromatic doodle faces instead of Pepe the Frog and Shiba Inu doges, and Daenerys Targaryen was the little girl who made the barbaric Khal Drogo find love. Contagion It was then that Google Chrome first made that offer. Do you want Google Chrome to save your password for this site? Save this password? Is that a thing browsers do now? Wow, thanks, Chrome, that’s so convenient! Come to think of it, I type most passwords on a web browser, so this looks like a great place to save them. Besides, what’s the worst that can happen? Chrome is a program installed on my computer. computer! I’m a seasoned Debian Linux power user, and nowhere in the universe is there a safer place than my hard drive! MY Sure, Chrome, go ahead. Save this password, and the next one, and every password I type in your input fields. Deception Until I bought another computer. After ditching the pre-installed Windows for whatever Linux distro I fancied at the time, the next thing to do was install Chrome. Firefox Quantum was still six years away, so there wasn’t much choice. Sign in with your Google account? Sure, why not? Let’s go check Facebook or whatever, and… hey, do you remember my username, Chrome? All right, let’s sign in to Facebook. Wait, why is the password field already filled in with asterisks? No, dear Chrome, this must be a bug, I’ve just bought this computer, your local database is pristine. You’ll realize your mistake once I click the login button. And… I’m in? I went to check Chrome settings immediately. What I saw only increased my horror. All the websites and usernames I had been saving were there, on a list. Plaintext passwords were only a click away. Two expectations had been broken. The first and most important thing is that I never expected Chrome to upload my passwords to Google’s servers without asking for consent. They asked me to my passwords, not to share them! save The second expectation was wishful thinking on my part. Shame on me. Google is one of the coolest tech companies in the world, and its engineers are supposed to be geniuses doing the impossible between ping-pong matches at the Googleplex. I thought Chrome was storing my passwords in some super-secure fashion and only retrieving each password at the right time to inject it like a ninja in the precise input field where it belonged. I didn’t expect to see them all in plaintext. And I wasn’t the only one who was shocked. ”. In a further discussion, Justin Schuh, Chrome’s chief of security, in a rather arrogant manner. Sir Tim Berners-Lee took Kember’s side, calling Chrome’s password manager “ .” Elliott Kember called Chrome’s password security “insane just shrugged it off a way to get your big sister’s passwords After this experience, I never got myself to trust any password manager, even though I knew it was better than confabulating weird passwords in my stupid human head. But, as we say in Brazil, a dog who’s been bitten by a snake fears even sausages. It doesn’t make more sense in Portuguese. A better password manager I spent the next ten years wandering in the desert of password insecurity. I was longing for a better password manager, but all of them seemed to follow the same principle: bundle up all your passwords in a “vault,” encrypt it with your master key and upload this vault to their cloud servers. I could never trust this model. Are they implementing end-to-end encryption, right? Is there a “key recovery” backdoor waiting to be exploited? Or maybe Justin Schuh was right after all: your passwords are “trivially recovered” from any application that stores them, and attempts to make passwords harder to leak are “all just theater.” In this sense, trying to safeguard your passwords any further than trusting a password manager was a novice fool’s errand. In 2019, I landed in the IT Department at the Ministry of Foreign Affairs of Brazil. There, I shadowed the CTO and . I learned a great deal from him and took over after he left. Cybersecurity was always on the agenda since that Ministry produced about 80% of all classified information in the Brazilian Federal government, and its operations were spread over 240 locations in all habitable continents. We were constantly targeted by the world’s scariest acronyms, so we needed to keep our guard up at all times. Over those years, through constant exposure to problems in different domains of cybersecurity, I started to put together principles for a better password manager. tech guru Fabio Cereda Principle #0: all cryptography is broken or eventually will get broken There was a museum of diplomatic communications where I worked. It was full of code books, cast-iron cipher machines, suitcase-portable dish antennas, TELEX adapters, and a few specimens of . It was a showcase of one and a half-century of secret communications between the headquarters and Brazilian embassies and diplomatic missions abroad. All of them relied on some sort of crypto to hold the secrets. All of that crypto is now broken. the infamous Crypto AG C-52 machine If you think about a password manager, the fact that all crypto will eventually get broken isn’t scary. Let’s say it takes, on average, 15 years to break a cryptographic protocol. Just change your passwords every couple of years, and you’ll be fine. A decent password manager should upgrade its crypto every now and then so you’ll always stay ahead of the curve. The scary part is that it’s impossible to know if a protocol has been broken already. Or worse, if it was designed with an intentional, hidden vulnerability, as was the case with the Crypto AG machine. Intelligence agencies and cybercriminal organizations keep their zero-days under the radar for as long as they can. The more I saw last-gen, corporate-grade security systems leaking secret information, sometimes in catastrophically spectacular manners, the less I trusted the vault model employed by all cloud-based password managers. Until very recently, these concerns were merely theoretical. As , fellow hackernooner @hossam26644 wrote There is nothing wrong with using Google’s password manager, Microsoft, Apple, 1password, Bitwarden, or whatever. People have been using them for long, with zero problems till now. He was right on July 25th, 2022. He didn’t trust any of them, though, and he was right again. One year later, there was compelling evidence that and people losing money. Over 150 people, over $35 million in money. the notorious LastPass leaks were resulting in some high-value vaults getting cracked A common misconception is that for an encrypted vault to be cracked, the itself would need to be compromised. LastPass has reminded us how much easier it is to break encryption. AES stands strong, but LastPass made poor implementation decisions: too short master key requirements, too few iterations, and some users were left with vaults that were easily crackable by brute force. AES algorithm Principle #1: logistics are often the weakest security link Government cryptanalysts knew Principle #0 all too well. They are some of the most intelligent people I’ve ever met, and few of them would put money on something protected by cryptography alone. The most wary of them insisted on the use of a for critically secure communications. In fact, they put this requirement in the regulations for the transmission and storage of top-secret documents. One-Time Pad (OTP) In principle, an OTP cypher cannot be broken. It is a simple XOR operation of the plaintext (the data) and a buffer of random values of the same length as the data (the OTP key). By XOR’ing the cipher against the same key again, the plaintext is recovered. Although unbreakable from a cryptanalysis standpoint, the OTP has several inconveniences: Each OTP key can never be reused; An OTP key must be at least as long as the plaintext; The key is symmetrical and must be pre-shared between the sending and the receiving parties. For a worldwide organization, supplying every office with OTP keys is a large ongoing logistical operation. Even worse, it’s the Achilles’ heel of the whole security model! Because, for all of OTP’s crypto-awesomeness to hold true, you need logistics, both in-transit and at-rest. perfect Should Eve intercept your OTP keys while on the road to the destination? All your communications from that point on are compromised. Should Eve physically crack your safe room and steal your OTP key media? All your comms from that point on are compromised, and maybe even your previous ones, if used portions of the key had not been properly erased from the media. If you implement OTP keys as 1 GB chunks of random bytes that get consumed as you send information, it clearly lacks both and backward secrecy. forward In the end, the perfect crypto is a way to shift responsibility from the cybersecurity team to the physical security team. And a similar problem affects offline password managers: they trade-off availability for confidentiality, leaving you with a logistical mess to sort out. As anyone running a local copy of knows, you need to backup your vault. This backup had better be external in case your computer storage dies. You need to keep your backup up-to-date. And make sure nobody has access to it. And don’t keep them all in your house, lest they fall prey to flood and fire. And don’t upload them to Google Drive; otherwise, you’re not using an offline password manager anymore. And… KeePass Principle #2: when a user device is compromised, it’s game over One day, my boss called me. She wanted to share a PDF with ten people from the upper echelon. This information should remain in their eyes only for three days. She knew that they had incentives to share this document with their respective teams to get a head start. This sort of information should be presented in person, but covid. So, she asked me to make this PDF impossible to copy and share. — Can’t be done, I replied. My boss was an Ambassador. This is the diplomatic equivalent of a General. Ambassadors aren’t used to hearing “no” as an answer. I patiently explained that, in computer science, when you give someone read permission to a resource, you implicitly give them permission to copy and distribute. Information access rights don’t obey legal rights. Even if we somehow made it inconvenient to share the file, they could just take pictures of their screens with their phones and share them over WhatsApp. If they can see the document on the screen, so can their cameras. Justin Schuh was right. If someone gains full access to your computer (or phone), they have full access to the information that you, the user, can access through that device. He’s right, but that doesn’t excuse him for implementing such a lousy password manager on Chrome. For a password manager, it means that protecting the user's device is always critical. If the server leaks, the attackers still need to go through the challenge of cracking the vaults. But if a hacker gains complete ownership over the computer running the password manager client, there’s nothing stopping them from stealing all passwords. This happens quite often in the crypto community. User Alice has a few dozen BTC, which makes her a millionaire. She has been doxxed or never hid her identity in the first place. She keeps a copy of her seed phrase in a local password manager on her desktop. “This is not a cloud password manager; I’m safe from leaks,” she thinks. Hackers find a way to make her install a backdoor to her computer. If they’re really good, they can do this without user interaction. The next morning, she wakes up to an empty wallet. For all the doom and gloom about user device compromise, there’s a silver lining: protecting our own devices, as users, is something that’s within our control. A server leak is not. The 150+ people who lost millions to the LastPass server leak bore no responsibility for the leaks or for LastPass implementing inadequate encryption standards. If user device compromise is a catastrophic attack vector no matter the password manager security model, and if we, as users, must protect our devices anyway, wouldn’t it be nice if this were attack vector? If we could build an password manager where no secrets ever leave the user devices so that users don’t need to worry about things out of their control, like server security and AES implementation details? the only online The ingredients are on the table Fellow author @hossam26644 continued, : “maybe I am a security freak, but I don’t want to trust my passwords to an entity, regardless of their promises &/reputation”. He’s right again. Cybersecurity is supposed to be proven and auditable, not based on trust and reputation. on his article The three principles outlined above guided my development of . It took me three years of ideation and iterations to arrive at its current form: an auditable cloud-based password manager that achieves zero knowledge by design and not through encryption. Passwords are synced across user devices using the cloud, but no secrets ever leave these devices. Cloud server compromises cannot leak any secrets because secrets never reach the cloud. Neulock Password Manager The three years of the making of Neulock will be documented in Part II.

Chrome Password Manager Betrayed My Trust 13 Years Ago. I Never Forgot

13 বছর আগে Chrome পাসওয়ার্ড ম্যানেজার আমার বিশ্বাসের সাথে বিশ্বাসঘাতকতা করেছে। আমি কখনই ভুলিনি।

Der Chrome Password Manager hat mein Vertrauen vor 13 Jahren missbraucht. Ich habe es nie vergessen.

Chrome Password Manager traicionó mi confianza hace 13 años. Nunca olvidé.

Le gestionnaire de mots de passe Chrome a trahi ma confiance il y a 13 ans. Je n'ai jamais oublié.

क्रोम पासवर्ड मैनेजर ने 13 साल पहले मेरे भरोसे को धोखा दिया। मैं कभी नहीं भूला.

Chrome パスワード マネージャーは 13 年前に私の信頼を裏切りました。私は決して忘れませんでした。

Chrome 비밀번호 관리자가 13년 전에 내 신뢰를 배신했습니다. 나는 결코 잊지 않았다.

O gerenciador de senhas do Chrome traiu minha confiança há 13 anos. Eu nunca esqueci.

Менеджер паролей Chrome предал мое доверие 13 лет назад. Я никогда не забывал.

Chrome Şifre Yöneticisi 13 Yıl Önce Güvenime İhanet Etti. Hiç unutmadım.

Trình quản lý mật khẩu Chrome đã phản bội lòng tin của tôi 13 năm trước Tôi không bao giờ quên.

Chrome 密码管理器 13 年前背叛了我的信任。我从未忘记。

Taylor Swift's recently dove into the " " aesthetic. tortured poets Complete with a ; this sent the internet—and particularly, her fandom, the Swifties—into a frenzy. Swifties worldwide mirrored her, changing their profile pictures and flooding social media with content about it. monochrome profile picture change This seemingly simple act underscores a profound lesson in community management: the power of personal connection, exclusivity, narrative, adaptability, and loyalty. How can SaaS companies harness this "Swiftie" strategy to cultivate their communities? Personal Connection Taylor Swift sets the gold standard for personal engagement. Her surprise fan visits and heartfelt responses on social media make every fan feel seen and valued. Imagine if SaaS brands adopted this approach. Moving beyond automated customer service responses to genuine, personalized interaction could transform user perceptions from mere service users to valued community members. What SaaS Companies Can Do: Personalize your responses on social media to reflect the user's tone and context. Like you can use your to interact with prospects & customers’ posts regularly. B2B SaaS LinkedIn page Celebrate user milestones through shout-outs or personalized messages. Host virtual meet-and-greets with product teams to deepen connections. For instance, Zendesk's approach to customer service, where they not only solve tickets but also engage in meaningful conversations with users, showcases a level of personal connection. They share these stories in their annual reports, highlighting how they've impacted businesses and individuals alike. Besides, offers a unique blend of education and exclusivity, providing users with badges and certifications that are highly valued within the Salesforce community. This not only educates but also creates an elite group of knowledgeable users. Salesforce’s Trailhead This level of interaction can transform user perception from seeing a service to seeing a partner in their journey. Exclusive Content Swift knows how to make her fans feel special with content that's just for them. This sense of exclusivity builds a community that's eager to engage and share. SaaS companies can mirror this by granting exclusive access to webinars, insider information, beta testing opportunities, or sneak peeks into upcoming features, turning ordinary users into brand ambassadors. This not only creates a sense of belonging but also turns users into advocates, eagerly sharing their insider status and spreading the word. Narrative Building Swift's storytelling turns her music into an anthem for many. Her ability to share her journey in a relatable manner has cemented her place in the hearts of millions. I mean, just look at, “ ”. And you call me up again just to break me like a promise. So casually cruel in the name of being honest Similarly, SaaS companies should craft and share their own narratives. This might involve telling the story of your startup's journey, sharing customer success stories, or explaining the 'why' behind new features. A compelling narrative can deeply resonate with your audience, aligning your brand values with their personal or professional aspirations. Make your customer’s story a part of your . B2B SaaS content marketing strategy For instance, " campaign effectively shares its narrative of simplifying communication across teams and platforms. Through customer stories and use cases, Slack demonstrates its impact on productivity and team collaboration. Slack’s "Work, Simplified Listening and Adapting Just as Swift's music and persona evolve in response to fan feedback and societal shifts, so too should SaaS companies be adept at listening and adapting. This is where tools like Slack’s community channels come into play, serving as a real-time feedback loop that can guide product updates, content creation, and customer service improvements. The key is not just to listen but to act on that feedback, showing your community that their voices matter. And HubSpot’s adaptation of its platform to include more robust CRM features came as a direct response to community feedback. By listening to its users’ needs for a more integrated sales and marketing tool, HubSpot was able to significantly enhance its product offering. So, here’s what you can do: Implement regular community feedback loops through surveys, AMAs (Ask Me Anything), and feedback forms. Feature a "roadmap" page where users can suggest and vote on new features or improvements. Actively monitor social media and forums for unsolicited feedback and trends. Rewarding Loyalty Swift doesn't just acknowledge her fans; she rewards their loyalty. SaaS companies, take note. Implementing loyalty programs, acknowledging milestones, or even featuring users in your content can make your community feel valued. HubSpot, again, is an excellent example of this, rewarding its community with resources, certification programs, and recognition, thereby fostering a strong sense of belonging and loyalty. Similarly, Adobe’s Creative Cloud offers exclusive tutorials, early access to new features, and discounts for long-term subscribers, effectively rewarding their loyalty and encouraging continued use of their software suite. Here, the challenge is designing a loyalty program that motivates continued engagement without inflating costs. So, the solution could be to offer non-monetary rewards such as exclusive access, recognition, or professional growth opportunities that align with your community's values. Case in Point When Swift changes her profile picture, it's not just a change—it's a signal, a call to action that mobilizes her community. When a SaaS company introduces a new feature, shares a milestone, or changes its interface, it should be with the same intentionality. To communicate, connect, and galvanize its community. In essence, building a community in the SaaS world, much like Swift's approach to her fandom, is about creating shared experiences, values, and goals. So, as we navigate the , let's ask ourselves: How can we make our users feel like they're part of something bigger? How can we be the Taylor Swift of the SaaS world? complex dance of community management In doing so, you might just find that building a community is less about the strategies you employ and more about the connections you make. After all, in the end, it's not just about growing a following—it's about nurturing a fandom.

The Taylor Swift Approach to Community Management: Building Fandoms, Not Just Followings

কমিউনিটি ম্যানেজমেন্টে টেলর সুইফট অ্যাপ্রোচ: ফ্যান্ডম তৈরি করা, শুধু অনুসরণ নয়

Der Taylor-Swift-Ansatz zum Community-Management: Fandoms aufbauen, nicht nur Follower

El enfoque de Taylor Swift para la gestión comunitaria: crear fandoms, no solo seguidores

L'approche Taylor Swift de la gestion de communauté : créer des fandoms, pas seulement des suivis

सामुदायिक प्रबंधन के लिए टेलर स्विफ्ट दृष्टिकोण: प्रशंसकों का निर्माण करना, न कि केवल अनुसरण करना

テイラー・スウィフトのコミュニティ管理へのアプローチ: フォローするだけでなくファンダムを構築する

커뮤니티 관리에 대한 Taylor Swift 접근 방식: 단순한 추종자가 아닌 팬덤 구축

A abordagem Taylor Swift para gerenciamento de comunidade: construindo fandoms, não apenas seguidores

Подход Тейлор Свифт к управлению сообществом: создание фандомов, а не просто подписчиков

Topluluk Yönetimine Taylor Swift Yaklaşımı: Sadece Takip Etmek Değil, Hayranlık Oluşturmak

Cách tiếp cận của Taylor Swift để quản lý cộng đồng: Xây dựng cộng đồng người hâm mộ, không chỉ theo dõi

泰勒·斯威夫特的社区管理方法：建立粉丝圈，而不仅仅是追随者

A new year has come, and new hacks and scams are brewing in the cryptocurrency world. Besides the classic old ransomware, phishing emails, and fake investment platforms, some other tactics to steal are getting quite popular among cybercriminals. These attacks have evolved in tandem with the maturation of the crypto space, emphasizing the pressing need for enhanced security measures. That’s an important decrease compared with 2022 and previous years, but it’s, by no means, an insignificant figure. Frauds, scams, darknet markets, malware, sanctioned entities, and other stolen funds in stablecoins, Bitcoin, Ether, and more altcoins are included in their report. According to estimates by over $24 billion were received by illicit addresses in 2023. Chainalysis, The message seems clear: we have to take good care of our coins. To do this, besides applying some basic measures, we also need to know about potential threats. Let’s discover what the scammers are up to lately. Smishing Maybe you’ve already received a text message (SMS) of this style: “Coinbase informs you of an approved transaction for $570 in BTC on 01/30/24. If you don’t recognize this operation, cancel here [Link].” Or perhaps a or friend could ask you for some coins after losing their wallet overseas, or a dubious crypto exchange is showing you an enticing offer to join their website. stranded relative The “smishing” pattern is similar in all cases: it this way: you receive an SMS, often from an unknown number, asking you for private information or urging you to click a link after using diverse excuses and fake identities. IBM defines “Smishing is a social engineering attack that uses fake mobile text messages to trick people into downloading malware, sharing sensitive information, or sending money to cybercriminals. The term “smishing” is a combination of “SMS”—or “short message service,” the technology behind text messages—and “phishing.” Coinbase this in their quarters, indeed. Some “smishers” tricked their employees via SMS into sharing institutional credentials. Luckily, the incident was quickly spotted, and the scammer was blocked. To avoid being a victim yourself, always check the phone number sending the text (even this number can be faked though), and don’t click on links sent via SMS unless you fully know and trust the source and recognize the domain the link leads to. experienced Romance Scams (Pig-butchering) This scheme isn’t new, but it’s growing exponentially. Losses of at least $1 billion in the US were reported for 2022, while the cybersecurity firm Verafin that Scammers are hunting especially non-tech savvy worldwide, but it could happen to anyone, everywhere. Whole criminal networks are working on it, and experts a higher severity for 2024. estimated $3.8 billion were stolen with these scams in 2023, taking up to $1 million per victim. elder people are predicting Social media, chats, apps, and forums have let us connect with all kinds of people globally, and they’re not always to trust. Scammers could start pretending to like the same things as their victims, visiting the same websites or online events to start a fake friendship. In other cases, they directly write via Facebook, Discord, Twitter (X), or dating apps like Tinder. They’re patient, as they can talk daily with their victims for months. They can include sobbing stories about a financial crisis, shipping fees, kids back home, a medical emergency, or you name it. Payments are often asked in cryptocurrency. Just when they have a certain level of trust, or even after declaring their undying love for the victim, they start asking for money or expensive favors. On the other hand, instead of asking directly for money or things, they can recommend a crypto investment platform, talking about how they got juicy earnings with it. Of course, this is all fake, and they’re either owners or part of the staff of such a fraudulent scheme. As the US Federal Trade Commission : “If an online love interest asks you for money [or to invest money] — that’s a scam.” advised Fake QR Codes / Quishing These days, it’s quite common to find Quick Response (QR) codes everywhere. They’re just small squares with a monochrome pattern inside, easy to scan with any smartphone to discover a wide array of digital stuff: restaurant menus, payment systems, websites, emails, app installers, crypto addresses, and… malware. Or fraudulent sites. Or not the crypto address you intended to send funds to. As the Aura cybersecurity team , QR codes aren’t always safe to scan. , and quickly share it digitally (via social media, chats, mail, fraudulent websites, etc.) or physically (by printing it). In this last case, it’s even common to paste a fraudulent QR code over a legitimate one —for instance, in parking lots. explained It’s pretty easy for anyone, everywhere, to create their own QR image with a customized link or data This type of scam is often called “Quishing,” from the fusion between QR and phishing. It can affect all kinds of QR users, including the ones with a crypto wallet. They could find an enticing offer or airdrop via social media, scan a QR code, and be sent to a malicious website that either asks for their private keys or installs malware. Fraudulent QR Generators Another way to scam crypto users using QR codes is by building a fraudulent QR Generator platform. In this vein, found out that in 2019. In these platforms, when the user tried to generate a QR code for their BTC address, the system would automatically generate a code for the scammer’s BTC address instead. ZenGo “4 out of the first 5 results presented when querying Google [Bitcoin QR Generator] were leading to scammer sites” That doesn’t seem to be the case anymore, as we’ve checked by ourselves. However, this type of scam isn’t over but has apparently moved to private coins like Monero (XMR), as pointed out. That’s why it’s always important to visually check every crypto address and URL before sending funds or typing credentials. recent reports AI Threats We’re likely in the Artificial Intelligence (AI) boom in every industry. And that also includes the crime sector. AI tools are growing in sophistication, availability, and user-friendliness, something that had to be noticed by cyber-criminals. , thanks to a myriad of free tools online. Today, it’s possible to , copy exact faces on video (deepfakes), and generate quite convincing written content clone voices Therefore, a scenario in which a loved one calls you asking for some urgent financial help, and you recognize their voice (even if it’s not them), it could happen. Several experts are already advising to create a family password to prevent this kind of scam. The AI videos may be more difficult to spot since cyber-criminals can modify any original video to make its participants look like someone else (like a celebrity) and/or talk about something else entirely —like an “incredible” crypto investment platform. That’s what happened to Ottawa News in January 2024. a story of an elderly couple that suffered a common crypto scam, and, two weeks later, a fake video of them appeared on social media, based entirely on the original story. They published However, in the fraudulent version, they were recommending the use of a dubious crypto investment platform. https://www.youtube.com/watch?v=e5y3qSB3PLo&embedable=true How to know what’s real, then? In the case of video deepfakes, to check facial expressions, blinking, lip movements, and the angles of light. If any of these traits look weird in some sense, it’s likely a deepfake. Besides, common sense could help a lot: is this famous person or news portal really recommending a get-rich-quick scheme? Probably not. If it sounds too good to be true, it’s likely not true. it’s advisable Fake Trading Bots Some other times, scammers don’t even need to use real AI technology, but just pretend they’re using it. Numerous crypto investment websites claim that they use the help of bots, automated trading algorithms, and AI, in general, to invest or trade with the funds given by their customers, promising impossibly huge returns. This is all false, of course. Only when the user tries to withdraw their supposed earnings is that they realize there are no funds there, crypto or otherwise. The US Commodity Futures Trading Commission (CFTC) : Commonly, they create fake dashboards for the victims to check on the “growth” of their investment, while in reality, they took everything from the start. warned about this “Fraudsters are exploiting public interest in artificial intelligence (AI) to tout automated trading algorithms, trade signal strategies, and crypto-asset trading schemes that promise unreasonably high or guaranteed returns. Don’t believe the scammers. AI technology can’t predict the future or sudden market changes.” Discord Hacks Discord is a useful communication platform, used by millions worldwide. That also includes most of the cryptocurrency world: it’s weird for a crypto project, coin, or brand not to have its own Discord server to share with its community. A fact that’s widely known by cybercriminals, who happily mingle inside that community, waiting for a chance to scam someone. This could be not that different from common phishing, but the major problem here is that Trusting the leaders and moderators, the users would click on those links and potentially lose their crypto funds and Non-Fungible Tokens (NFTs). hackers are targeting crypto servers on Discord and somehow snatching the accounts of the admins to publish fake announcements and malicious links. have suffered this attack, including popular NFT brands like the Bored Ape Yacht Club (BAYC), Mars Cats Voyage, Known Origin, and Homeless Friends. Other crypto servers like , , , , , , , and even have briefly passed through this hack as well, with different results. Numerous crypto projects Orbiter Finance Metakey Arbitrum Sei Network Polemos Valheim Sui Network Obyte It’s important to remember that, unlike cryptocurrencies, Discord and other chat platforms weren’t designed for security since the beginning. Always remember to check the announcements first in other sources (especially official websites/blogs) before sending any funds or typing credentials on external websites. Apply security measures! Now that you know some potential threats, you surely can apply some measures to protect your crypto funds and personal data. You can also install additional security tools, like a browser extension for (of course, be skeptical about anything that promises “security”). They can help you to identify and block phishing or fraudulent websites. Keep your devices and antivirus software updated. web3 security If you don’t know the sender (phone number, email, or URL), don’t open them. Never click on links of questionable origins, whether they arrive by SMS, email, or social media. , especially in cryptocurrency. Be cautious of emotional manipulation and maintain a healthy level of skepticism. Don’t blindly trust when asked for money or given investment recommendations or replace them with textcoins, usernames, or emails . This feature is available through the wallet (Send and Receive Tabs). Always double-check your crypto addresses and QR codes, in Obyte In Obyte, it’s possible to delete your backup words (after saving them elsewhere), , and connect via the private browser Tor. Be sure to activate every security feature available on social media (like 2FA) and in your personal crypto wallet. require a password for sending funds and opening the wallet Featured Vector Image by Freepik

Top 5: Crypto Crimes and Scammers to Avoid This Year

শীর্ষ 5: এই বছর এড়াতে ক্রিপ্টো ক্রাইমস এবং স্ক্যামাররা

Top 5: Krypto-Verbrechen und Betrüger, die Sie dieses Jahr vermeiden sollten

Top 5: Criptodelitos y estafadores que se deben evitar este año

Top 5 : Crimes cryptographiques et escrocs à éviter cette année

शीर्ष 5: इस वर्ष क्रिप्टो अपराध और घोटालेबाजों से बचना चाहिए

トップ 5: 今年避けるべき仮想通貨犯罪と詐欺師

상위 5개: 올해 피해야 할 암호화폐 범죄 및 사기꾼

Top 5: crimes criptográficos e golpistas a serem evitados este ano

Топ-5: криптопреступления и мошенники, которых следует избегать в этом году

İlk 5: Bu Yıl Kaçınılması Gereken Kripto Suçları ve Dolandırıcılar

Top 5: Tội phạm tiền điện tử và những kẻ lừa đảo cần tránh trong năm nay

前五名：今年要避免的加密货币犯罪和诈骗者

MONECH

monech.com

-- employees

Since n.d.

COMPANY RANKING

MONECH

EVERGREEN INDEX #7164

Representing this company? Click here to claim and customize this page!

Monech WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

MONECH

monech.com

-- employees

Since n.d.

COMPANY RANKING

MONECH

EVERGREEN INDEX #7164

RELATED COMPANIESRANK

STORIES ABOUT MONECH

Representing this company? Click here to claim and customize this page!

Monech WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!