Thursday, September 01, 2022

From Vice: A Taiwanese Chip Giant Is Caught Between the US and China—and It’s Thriving


O REALLY ? ? ? Well yeah...CAN 2024 GET HERE ANY FASTER? 

And say what about that so-called "Silicon Shield?? ? 

"The U.S., which accounts for nearly 65 percent of TSMC’s sales, has long considered its dependency on TSMC unsafe. To buffer against the uncertainty, Washington has convinced the company to build a new $12 billion manufacturing plant in Arizona, which is expected to churn out 5nm wafers by 2024. 

 

NOTE: Danger ahead That is a scenario no one wants to see. “Frankly, they’re in a pretty good spot,” Schneider said. “So long as we don’t have World War III.”

"The reliance of the world’s No. 1 tech power on TSMC illustrates its unmatched market dominance in making advanced semiconductors, capacities that even China counts on to support its fast-growing digital economy.

“TSMC has clearly been the global leader in a very high-end commodity: advanced chips that the world needs to help all these other industries—aerospace, autos, electronic appliances, military equipment,” Dexter Roberts, a senior fellow at the Atlantic Council, told VICE World News. “Nobody wants to see TSMC hurt.”

✓ 1

www.vice.com

A Taiwanese Chip Giant Is Caught Between the US and China—and It’s Thriving

Rachel Cheung
8 - 11 minutes

When U.S. House Speaker Nancy Pelosi visited Taiwan in early August, she vowed support for the self-ruled democracy at a time when it seemed to need it. An increasingly powerful China, which claims Taiwan as its own territory, had sought to weaken the island’s international standing, and Chinese nationalists’ calls for an invasion had grown louder. By traveling to Taipei in defiance of Beijing’s protest, Pelosi said, she wanted to demonstrate the U.S.’ commitment to help Taiwan defend its freedom.


But it quickly became clear that the unofficial U.S.-Taiwan relationship was more than just the world’s dominant power backing its weaker partner in a choice, as Pelosi herself put it, “between autocracy and democracy.” ...

On Wednesday, Arizona’s governor, Doug Ducey, visited Taiwan in hopes of wooing suppliers for the facilities in his state. Last week, Indiana Gov. Eric Holcomb also went to Taiwan to promote academic and technological ties between the democratic island and the U.S. state.

But most of TSMC’s operations are still concentrated in its sprawling facilities near Taipei, where Pelosi rubbed shoulders with its executives. They discussed the newly passed CHIPS and Science Act, which offers $52 billion in subsidies for new chip manufacturing plants on American soil. TSMC is also expected to get a piece of the pie. . .

“Nobody can control TSMC by force,” TSMC chairman Mark Liu explained in a recent interview with CNN, noting that an invasion would render the sophisticated manufacturing facility “inoperable” as it depends on real-time connection with the rest of the world, including the U.S., Europe and Japan. “From materials, to chemicals, to spare parts, to engineering software diagnoses—it’s everybody’s effort to make this factory operable,” Liu said. 

China would shoot itself in the foot if it invades Taiwan ostensibly for the chips, Schneider said. “Its entire economy would be forced back to 1990s levels of microelectronics because the fallout from such an action would lead you to be cut off from the rest of the global semiconductor ecosystem.” 

TSMC and its chip industry has given Taiwan such political and economic leverage that it has been dubbed by some as a silicon shield. 

. . .

But as Beijing, stressing the historical mission of reunification, bears down on Taiwan, there are growing fears of a day when TSMC’s supremacy would not be sufficient to deter China. That would spell trouble not just for the company and the island but also for the rest of the world, which relies on its chips to function.


“The constant backdrop is the very ugly, scary possibility that there could be military hostilities in the Taiwan Strait,” Roberts said. “Then all bets are off. Economic concerns may temporarily be off the table and it may be about whose side are you on.”

TSMC going dark would deal a critical blow to the global economy, an impact more severe than the COVID-19 pandemic. Imagine Apple unable to launch its latest iPhone and Amazon losing its web services. “Maintaining the daily operation of the business world would become an impossible task,” CLSA’s Chen said.

That is a scenario no one wants to see. “Frankly, they’re in a pretty good spot,” Schneider said. “So long as we don’t have World War III.”

READ MORE

✓ 2 Tax Evasion; Don't do that 

www.vice.com

Washington, DC Sues Tech Billionaire For Allegedly Evading $25M in Taxes by Pretending to Live in Florida

6 - 7 minutes

On Wednesday, the District of Columbia’s Attorney General Karl A. Racine announced that his office is suing MicroStrategy executive chairman and Bitcoin-boosting billionaire Michael Saylor for alleged tax fraud. The District is also suing MicroStrategy for allegedly helping Saylor evade taxes on money earned while residing in DC.

Saylor co-founded the Virginia-based software company in 1989, but in recent years has turned his attention to Bitcoin. Saylor is one of the cryptocurrency's biggest boosters and has turned MicroStrategy essentially into a vehicle for investing in the price of Bitcoin. He claims to personally own nearly 18,000 bitcoins while MicroStrategy is sitting on another 129,699, according to an August SEC filing. 

The DC AG alleges that Saylor hasn't paid "any" income taxes to the District since he started living there in 2005, avoiding at least $25 million in taxes. 

The lawsuit is happening because of a recently-passed law called the False Claims Act, which empowers whistleblowers to come forward about alleged fraud against the government, and a whistleblowing realtor that came forward to claim Saylor failed to pay income taxes. Under the law, whistleblowers can be awarded up to 30 percent of the funds collected by the District. 

"Arguably the wealthiest person in the District—Forbes estimates his net worth at $2.3 billion— he has never paid a dime in District income tax," the whistleblower's complaint, filed by realtor Tributum in April but unsealed on Wednesday, states. 

After independently investigating the claims in the whistleblower's lawsuit—for example, that Saylor has in fact long been a resident of DC—the AG's office filed its own suit against Saylor and MicroStrategy, alleging that the company helped him evade taxes. . ."

READ MORE

✓ 3

Words Do Mean Something...Let's leave it at that

 


✓ 



Anti-Trust Scrutiny // DATA CENTER ALLEY HERE IN MESA...Potential for "Harmful Practice"

 WHOA! The European Commission continues its inquiry into Microsoft's business practices. CISPE, a European cloud provider group, which includes Amazon as one of its members, told Bloomberg in a statement this week that Microsoft's new system "not only fails to show any progress in addressing Microsoft's anti-competitivee behavior but may add new dependencies that further lock in customers and arbitrarily exclude cloud infrastructure providers."


arstechnica.com

Microsoft EU cloud revisions just so happen to exclude Google, Amazon

by Kevin Purdy - Aug 31, 2022 11:16am MST
4 - 5 minutes

Move to appease EU partners bars running MS apps on competitors' infrastructure.

Microsoft says its latest cloud licensing terms are meant to give customers more flexibility and cost control—just not on Amazon, Google, or Alibaba servers.

Getty Images

Facing European antitrust scrutiny, Microsoft has made it easier to virtualize its software on non-Microsoft cloud infrastructure—just so long as that infrastructure isn't owned by notable competitors Amazon, Google, or Alibaba.

The conflict, months in the making, is striking for a company that has largely avoided the antitrust scrutiny of its rivals, and eagerly sought to distance itself from the anti-competitive complaints and government actions that beset Microsoft in the late 1990s.

Microsoft outlined the changes that would take effect on October 1 in a blog post. Nicole Dezen, chief partner officer, wrote that Microsoft "believes in the value of the partner ecosystem" and changed outsourcing and hosting terms that "will benefit partners and customers globally."

New licensing terms would make it easier for Microsoft's enterprise customers to bring Microsoft software to non-Microsoft infrastructure and scale the cost and size of theirs or their customer's Microsoft systems on their own hardware, according to Dezen's post.

But Microsoft wants to be clear about something: Its Services Provider Licensing Agreement (SPLA) was meant for customers that are offering hosting "from their own data centers," not buying Microsoft licenses to "host on others' data centers." To "strengthen the hoster ecosystem," Dezen writes, Microsoft will remove the ability to outsource to Alibaba, Amazon Web Services, Google, Microsoft's Azure cloud,  or anybody using those companies as part of their hosting.

Amazon and Google have weighed in, and they do not believe Microsoft is showing its newer, less anti-competitive side.

"Microsoft is now doubling down on the same harmful practices by implementing even more restrictions in an unfair attempt to limit the competition it faces—rather than listening to its customers and restoring fair software licensing in the cloud for everyone," an Amazon spokesperson told Reuters...

 

Endpoint Detection and Response:

 Hold it - just a few (6-7 minutes) of your valuable time ...


The researchers presented their findings last week at the Hack in the Box security conference in Singapore. Nohl said EDR makers should focus on detecting malicious behavior more generically rather than triggering only on specific behavior of the most popular hacking tools, such as Cobalt Strike. This overfocus on specific behavior makes EDR evasion "too easy for hackers using more bespoke tooling," Nohl wrote.


arstechnica.com

Organizations are spending billions on malware defense that’s easy to bypass

by Dan Goodin - Aug 30, 2022 7:04 pm UTC
6 - 7 minutes 
 
Dan Goodin / Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications.
 
✓ "

Last year, organizations spent $2 billion on products that provide Endpoint Detection and Response, a relatively new type of security protection for detecting and blocking malware targeting network-connected devices. EDRs, as they're commonly called, represent a newer approach to malware detection. Static analysis, one of two more traditional methods, searches for suspicious signs in the DNA of a file itself. Dynamic analysis, the other more established method, runs untrusted code inside a secured "sandbox" to analyze what it does to confirm it's safe before allowing it to have full system access.

EDRs—which are forecasted to generate revenue of $18 billion by 2031 and are sold by dozens of security companies—take an entirely different approach. Rather than analyze the structure or execution of the code ahead of time, EDRs monitor the code's behavior as it runs inside a machine or network. In theory, it can shut down a ransomware attack in progress by detecting that a process executed on hundreds of machines in the past 15 minutes is encrypting files en masse. Unlike static and dynamic analyses, EDR is akin to a security guard that uses machine learning to keep tabs in real time on the activities inside a machine or network.

Nohl and Gimenez

Streamlining EDR evasion

Despite the buzz surrounding EDRs, new research suggests that the protection they provide isn't all that hard for skilled malware developers to circumvent. In fact, the researchers behind the study estimate EDR evasion adds only one additional week of development time to the typical infection of a large organizational network. That's because two fairly basic bypass techniques, particularly when combined, appear to work on most EDRs available in the industry.

"EDR evasion is well-documented, but more as a craft than a science," Karsten Nohl, chief scientist at Berlin-based SRLabs, wrote in an email. "What's new is the insight that combining several well-known techniques yields malware that evades all EDRs that we tested. This allows the hacker to streamline their EDR evasion efforts."

Both malicious and benign apps use code libraries to interact with the OS kernel. To do this, the libraries make a call directly to the kernel. EDRs work by interrupting this normal execution flow. Instead of calling the kernel, the library first calls the EDR, which then collects information about the program and its behavior. To interrupt this execution flow, EDRs partly overwrite the libraries with additional code known as "hooks."

Nohl and fellow SRLabs researcher Jorge Gimenez tested three widely used EDRs sold by Symantec, SentinelOne, and Microsoft, a sampling they believe fairly represents the offerings in the market as a whole. To the researchers' surprise, they found that all three were bypassed by using one or both of two fairly simple evasion techniques.

The techniques take aim at the hooks the EDRs use. The first method goes around the hook function and instead makes direct kernel system calls. While successful against all three EDRs tested, this hook avoidance has the potential to arouse the suspicion of some EDRs, so it's not foolproof.

Nohl and Gimenez

The second technique, when implemented in a dynamic link library file, also worked against all three EDRs. It involves using only fragments of the hooked functions to keep from triggering the hooks. To do this, the malware makes indirect system calls. (A third technique involving unhooking functions worked against one EDR but was too suspicious to fool the other two test subjects.)

Nohl and Gimenez

In a lab, the researchers packed two commonly used pieces of malware—one called Cobalt Strike and the other Silver—inside both an .exe and .dll file using each bypass technique. One of the EDRS—the researchers aren't identifying which one—failed to detect any of the samples. The other two EDRs failed to detect samples that came from the .dll file when they used either technique. For good measure, the researchers also tested a common antivirus solution.

Nohl and Gimenez

The researchers estimated that the typical baseline time required for the malware compromise of a major corporate or organizational network is about eight weeks by a team of four experts. While EDR evasion is believed to slow the process, the revelation that two relatively simple techniques can reliably bypass this protection means that the malware developers may not require much additional work as some might believe.

"Overall, EDRs are adding about 12 percent or one week of hacking effort when compromising a large corporation—judged from the typical execution time of a red team exercise," Nohl wrote..."

READ MORE

CYBER INSECURITIES: Data Breeches, Active Exploitations, Hacks, Flaws and Hidden Malware

 Let's start somewhere - in a place far far-away...Wow!


www.bleepingcomputer.com

Hackers hide malware in James Webb telescope images

Bill Toulas
7 - 9 minutes

Hackers hide malware in James Webb telescope images

"Threat analysts have spotted a new malware campaign dubbed ‘GO#WEBBFUSCATOR’ that relies on phishing emails, malicious documents, and space images from the James Webb telescope to spread malware.

The malware is written in Golang, a programming language that is gaining popularity among cybercriminals because it is cross-platform (Windows, Linux, Mac) and offers increased resistance to reverse engineering and analysis.

In the recent campaign discovered by researchers at Securonix, the threat actor drops payloads that are currently not marked as malicious by antivirus engines on the VirusTotal scanning platform..


During testing, Securonix observed the threat actors running arbitrary enumeration commands on its test systems, a standard first reconnaissance step.

The researchers note that the domains used for the campaign were registered recently, the oldest one on May 29, 2022.

Securonix has provided a set of indicators of compromise (IoCs) that includes both network and host-based indicators."

READ MORE


  • Google Chrome bug lets sites write to clipboard without asking

    Chrome version 104 accidentally introduced a bug that removes the user requirement to approve clipboard writing events from websites they visit.

  • Ragnar Locker ransomware claims attack on Portugal's flag airline

    The Ragnar Locker ransomware gang has claimed an attack on the flag carrier of Portugal, TAP Air Portugal, disclosed by the airline last Friday. 

  • Microsoft found TikTok Android flaw that let hackers hijack accounts

    Microsoft found and reported a high severity flaw in the TikTok Android app in February that allowed attackers to "quickly and quietly" take over accounts with one click by tricking targets into clicking a specially crafted malicious link.

  • Eliminate distractions while using the web with this $40 tool

    Refocus your attention when surfing the web with a five-year subscription to Control D, on sale for $39.99 or 66 percent off.

    • BleepingComputer Deals
    • August 31, 2022
    • 07:16 AM
    • Comment 0
  • Ukraine takes down cybercrime group hitting crypto fraud victims

    The National Police of Ukraine (NPU) took down a network of call centers used by a cybercrime group focused on financial scams and targeting victims of cryptocurrency scams under the guise of helping them recover their stolen funds.

  • Hackers hide malware in James Webb telescope images

    Threat analysts have spotted a new malware campaign dubbed 'GO#WEBBFUSCATOR' that relies on phishing emails, malicious documents, and space images from the James Webb telescope to spread malware.

  • Russian streaming platform confirms data breach affecting 7.5M users

    Russian media streaming platform 'START' (start.ru) has confirmed rumors of a data breach impacting millions of users.

  • Get a lifetime subscription to Babbel for just $199 until Sep 18

    If you want to learn a new language or two or three, then Babbel may be your best bet. And particularly right now since, for a very limited time, the cost of a lifetime subscription has dropped significantly to just $199.

    • BleepingComputer Deals
    • August 30, 2022
    • 02:17 PM
    • Comment 0
  • Chinese hackers target Australian govt with ScanBox malware

    China-based threat actors have been targeting Australian government agencies and wind turbine fleets in the South China Sea by directing select individuals to a fake impersonating an Australian news media outlet.

  • Microsoft Azure outage knocks Ubuntu VMs offline after buggy update

    Microsoft Azure customers' virtual machines (VMs) running Ubuntu 18.04 have been taken offline by an ongoing outage caused by a faulty systemd update.

  • Chrome extensions with 1.4 million installs steal browsing data

    Threat analysts at McAfee found five Google Chrome extensions that steal track users' browsing activity. Collectively, the extensions have been downloaded  more then 1.4  million times.

  • Wednesday, August 31, 2022

    CITY ENGAGEMENT CHARADE ------ Get Ready for one more?

     Hey guys! What's this?? 




    ✓ PLEASE NOTE

    Duration: 5:08
    Posted: 3 days ago 





    A possible solution to 'fix' a long,-standing problem put on by the "City of Mesa Community Engagement Team"


    goallevents.com

    Residents Guide to Community and Civic Engagement | Mesa City Council Chambers | Tue December 6, 2022

    2 - 3 minutes





    • Tue Dec 06 2022 at 01:00 pm to 02:00 pm UTC-07:00

    • Location

      Mesa City Council Chambers, 57 East 1st Street, Mesa, United States

    • Organizer

      City of Mesa Community Engagement Team


    Join us in the City's Council Chambers as we learn the ins and outs of City govt. and how to become more involved in decision making.
    About this Event

    In this 60-minute class you will:

    • Learn the ins and outs of City government and how to become more involved in decision making
    • Learn how to take on leadership roles beyond your neighborhood and into the community
    • Learn the impact of serving on City advisory and nonprofit community boards and how to be appointed to one
    • Hear inspiring stories of local leaders and gain support in exploring your next volunteer leadership role
    • Tour Mesa’s Council Chambers and learn how to participate in public meetings 

    WHO REMEMBERS THIS ? 

     

    ... Here’s an archived version of the site, and a video recording of the committee’s final presentation to the Mayor and Council that demonstrates the team’s approach.

    Summary of key metrics

    Imagine Mesa Advisory Committee

    After a four month period of engagement, the advisory committee of community leaders evaluated the feasibility of the public’s ideas. Subcommittees divided into specific areas, including economic development, sustainability, neighborhoods, and parks and recreation. They evaluated opportunities by potential cost, impact, and public support and presented their research to the city council for recommended implementation.

    The most popular idea on Imagine Mesa was to encourage Arizona State University to expand to downtown Mesa. Discussions about bringing ASU to Mesa were active for almost a year before the Imagine Mesa campaign. The campaign brought many new ideas to the attention of city leadership, but in situations like ASU where there was already community awareness, the availability of a public feedback mechanism helped leaders gauge public support at a crucial period in the deliberation process. The Mesa City Council approved a master plan to design and construct a 5 story building and 2–3 acre open plaza with the sale of excise tax bonds.

    The City made the public’s ask for a farmer’s market downtown a reality, offering use of a city park, selecting a market operator and providing marketing assistance. The market is anticipated to open operations in January 2019. Additionally, the City is currently in negotiations with a respondent to an RFP to redevelop the historic Sirrine House into a farm-to-table restaurant and urban agricultural space.

     

    Imperialst Rhetoric, Tom Horn to Defuse Tensions, Gold Tops $5,000 in Demand Frenzy, . . .Japan Bond Crash

             Stephen Maturen/Getty Images Trump, Democrats Hurtle Toward Shutdown After Minnesota Killing A fatal shooting by Border Patrol agen...