Friday, June 5, 2026

How a USB-connected speaker can infect a PC without ever being touched


<p>Operating system makers take many steps to prevent their wares from accepting commands from remote devices. The safeguards, designed to thwart malicious attacks, typically require hackers to jump through all kinds of hoops to bypass the measures. But what if remote code execution were as simple as being within Bluetooth range of a speaker connected to the targeted device?</p> <p>It turns out it can, at least when the speaker is a <a href="https://www.amazon.com/Creative-Blaster-Katana-Theater-System/dp/B0BBVM8T1K?th=1">Sound Blaster Katana V2X</a> sold by Singapore-based Creative Technologies. The speaker, which sells for $283, is widely acclaimed with <a href="https://gamingtrend.com/reviews/creative-labs-sound-blaster-katana-v2-review-you-guys-made-me-recommend-a-sound-bar/" target="_blank" rel="noopener noreferrer">numerous</a> reviews <span draggable="true"><a href="https://techjioblog.com/2022/11/10/review-creative-sound-blaster-katana-v2x/" target="_blank" rel="noopener noreferrer">showering</a></span> praise <span draggable="true"><a href="https://www.mmorpg.com/hardware-reviews/creative-sound-blaster-katana-v2x-review-lower-powered-audio-powerhouse-2000126769" target="_blank" rel="noopener noreferrer">on</a></span> the <span draggable="true"><a href="https://www.reddit.com/r/SoundBlasterOfficial/comments/1guxjbr/1_year_ownership_review_of_katana_v2x/" target="_blank" rel="noopener noreferrer">sound</a></span> and <span draggable="true"><a href="https://www.androidcentral.com/accessories/audio/creative-sound-blaster-katana-v2x-review" target="_blank" rel="noopener noreferrer">performance</a></span> of it and its predecessor, the Sound Blaster V2.</p> <h2>A PC-pwning proxy</h2> <p>Researcher Rasmus Moorats stumbled on the hack by accident, after he purchased a Katana V2X, a soundbar that connects to PCs, Macs, and Linux devices over USB or Bluetooth. Moorats was curious if he could create a Linux tool that communicated with his speaker. He discovered he could do so through CTP, a proprietary mechanism he guesses is short for Creative Transport Protocol.</p><p><a href="https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/#comments">Comments</a></p> Reference : https://ift.tt/nTfmoQF

50 Years of The Institute


<img src="https://spectrum.ieee.org/media-library/portrait-of-a-smiling-white-woman-with-curly-hair.jpg?id=66860120&width=1245&height=700&coordinates=0%2C187%2C0%2C188"/><br/><br/><p><a href="https://spectrum.ieee.org/the-institute/" target="_self"><em><em>The Institute</em></em></a> is celebrating its 50th anniversary this year. Launched in 1976, the publication was designed to keep members informed about IEEE and what its constituents were doing, as well as to report on the organization’s initiatives, <a href="https://spectrum.ieee.org/collections/world-standards-day/" target="_self">technical standards</a>, products, and services.</p><p>That directive expanded over the years to include our reporting on key historical technical achievements recognized as <a href="https://spectrum.ieee.org/tag/ieee-history" target="_blank">IEEE Milestones</a> and support for <a href="https://spectrum.ieee.org/collections/celebrating-young-professionals-and-students/" target="_self">young professionals</a> with <a href="https://spectrum.ieee.org/collections/tips-on-how-to-elevate-your-career/" target="_self">career-guidance</a> articles and information about <a href="https://spectrum.ieee.org/ieee-professional-development-suite" target="_self">educational resources</a>.</p><p><em><em>The Institute</em></em> has gone through many iterations in the past 50 years. What began as a monthly four-page insert in the print edition of <em><em><a data-linked-post="2650270368" href="https://spectrum.ieee.org/how-ieee-spectrum-was-born" target="_blank">IEEE Spectrum</a></em></em> became a separate newspaper published six times a year and mailed along with <em>Spectrum</em> in 1977, and then a monthly publication the following year.</p><p>Today we publish all of <em><em>The Institute</em></em>’s articles online, with a curated selection appearing in our 16-page quarterly printed in the March, June, September, and December <em><em>Spectrum</em></em> issues.</p><p>To provide members with a quick summary of the latest online news, in 2003 a bimonthly newsletter, <em><em>The Institute Alert</em></em>, began appearing in your inbox. You also can stay up to date by following our <a href="https://www.facebook.com/IEEETheInstitute" rel="noopener noreferrer" target="_blank">Facebook</a>, <a href="https://www.instagram.com/ieeetheinstitute/" rel="noopener noreferrer" target="_blank">Instagram</a>, and <a href="https://www.linkedin.com/in/ieeetheinstitute/" rel="noopener noreferrer" target="_blank">LinkedIn</a> pages.</p><p>Although much has changed, an original subsection from 1976—“IEEE People”—has been maintained for the past five decades. We continue to celebrate IEEE members from around the world through our profiles, which are among our most popular articles.</p>As the longest-serving editor in chief for <em><em>The Institute</em></em>, it is a privilege for me and my staff to chronicle the stories of remarkable IEEE individuals. They are often-unseen visionaries and problem-solvers who work tirelessly behind the scenes on technologies that are reshaping the world. By highlighting their careers and how IEEE has played a role in their professional growth, we hope to inspire the next generation of engineers and technologists to continue a legacy of innovation and service to humanity. Reference: https://ift.tt/46n9YZh

Thursday, June 4, 2026

Dashlane explains how attackers managed to download encrypted password vaults


<p>Dashlane said that attackers mounted a coordinated hacking campaign against a large base of its users in an attempt to recover as many encrypted password vaults as possible. The password manager provider said fewer than 20 personal user vaults were downloaded before it shut down the operation.</p> <p>In a campaign that started Sunday, the unknown threat actor abused the mechanism that allows Dashlane users to add new devices, such as computers or phones, to their accounts. By abusing Dashlane's programming interfaces for device enrollment, the attackers sent requests to large numbers of existing users’ registered email addresses. In an <a href="https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts#update-jun-4">update</a> published Thursday, Dashlane wrote:</p> <blockquote><p>The threat actor targeted the API endpoints for device registration and used a brute force attack to send a large volume of automated requests to those endpoints.</p> <p>In response, Dashlane’s automated security systems operated as intended, triggering an automatic lockout of the targeted accounts to protect those users. Before the attack was fully mitigated, the threat actor was able to brute force and generate valid tokens for fewer than 20 personal plan customers, allowing them to register a new device on those accounts and download copies of users’ encrypted vaults.</p></blockquote> <h2>The flow and strategy of the attack</h2> <p>When a user installs the Dashlane app on a new device and attempts to enroll it in their existing account, Dashlane first verifies the account holder's identity. This verification is completed by sending a one-time six-digit token to the user’s registered email address (or, for users who have enabled two-factor authentication, by validating a six-digit code generated by their authentication app).</p><p><a href="https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/#comments">Comments</a></p> Reference : https://ift.tt/ReAbX54

Wednesday, June 3, 2026

What It Takes for Future-Ready Power Distribution


<img src="https://spectrum.ieee.org/media-library/utility-workers-inspect-electrical-equipment-beside-a-service-truck-on-a-grassy-site.jpg?id=66649065&width=1200&height=400&coordinates=0%2C334%2C0%2C334"/><br/><br/><p><em>This sponsored article is brought to you by <a href="https://www.bv.com/en-US/projects/georgia-power-grid-investment-plan?utm_campaign=portfolio_for_power_utilities-pp-grid_solutions-noia-26-100223&utm_id=26-100223&utm_source=publication&utm_medium=qr-code&utm_content=power-generation&utm_tactic=na&utm_term=brand-awareness_26-bolder-vision-spectrum-native-article" rel="noopener noreferrer" target="_blank">Black & Veatch</a>.</em></p><p>The biggest challenge facing utilities today isn’t what it seems. It’s not demand, even as load growth accelerates. It’s not extreme weather, even as “major events” become routine. It’s not cybersecurity, even as connections expand across the grid.</p><h3></h3><br/><img alt="Man in gray blazer and blue shirt posed against a plain white background." class="rm-shortcode" data-rm-shortcode-id="65a417dd727734e41721a8a829df1ac9" data-rm-shortcode-name="rebelmouse-image" id="222cc" loading="lazy" src="https://spectrum.ieee.org/media-library/man-in-gray-blazer-and-blue-shirt-posed-against-a-plain-white-background.jpg?id=66649170&width=980"/><p>The real challenge is this: Distribution systems were designed for a different reality.</p><p>Long gone are the days of predictable demand, one-way power flow and isolated disruptions. At Black & Veatch, we see that leading utilities are no longer debating whether to modernize. They’re deciding how quickly they can do it, and how to do it at scale.</p><p>Across grid modernization programs globally, three truths consistently emerge. They define what it takes to prepare the distribution system for what’s next:</p><h2>1. Outage response is not a resilience strategy</h2><p>Resilience is being redefined in real time. A strategy centered on mobilizing crews and restoring service as quickly as possible is reactive, and increasingly insufficient.</p><p>Resilience has to shift upstream into integrated system design. That starts with hardening. Stronger poles, undergrounding and structural upgrades all have a role, particularly in high-risk corridors. We’re also seeing meaningful gains from how the network is configured and how quickly it can respond without waiting on manual intervention.</p><p>This is where distribution automation programs can change outcomes. Strategically placed reclosers, automated switches and fault indicators help contain disruptions before they spread. When combined with feeder reconfiguration and updated protection strategies, distribution automation investments allow utilities to set more aggressive recovery targets and achieve measurable reductions in outage duration and customer impact.</p><h2>2. Future-readiness depends on DERs at scale</h2><p>Forecasting is less and less reliable. Only 19 percent of utilities report strong confidence in their ability to predict future load growth, according to the <a href="https://www.bv.com/en-US/resources/2025-electric-report" target="_blank">Black & Veatch 2025 Electric Report</a>.<strong> </strong>Distributed Energy Resources (DERs) like solar, storage, EVs and behind-the-meter generation are exciting solutions; but they fundamentally change how the system operates. Power is no longer just delivered. It’s injected, stored and redirected in ways the system was never designed to manage.<strong></strong></p><p>At scale, these challenges show up quickly — particularly on feeders where distributed generation is approaching or exceeding hosting capacity. Protection coordination becomes more difficult when fault current comes from multiple directions. Voltage becomes less predictable as generation fluctuates throughout the day. And planning models must now account for highly variable, location-specific behavior.</p><p class="pull-quote">Distribution modernization is fundamentally changing how the system is designed and operated so it can absorb disruption, manage bi-directional flows and respond in real time.</p><p>Adapting to bi-directional power flow requires more than incremental updates. Leading utilities are responding by building flexibility into the system, moving beyond static assumptions toward dynamic hosting capacity and interconnection studies, planning that incorporates DER, EV adoption and localized load growth, and infrastructure aligned with the communications and control needed to manage it.</p><h2>3. The edge must be intelligent, visible and secure</h2><p>As system stress and complexity increase, utilities need far greater visibility and control over the network. Historically, utilities relied on customer calls, Supervisory Control and Data Acquisition (SCADA) at the substation level and field crews to understand what was happening on the system. That model doesn’t hold up. You can’t effectively manage a system you can’t see. Plus, the most critical events are increasingly happening beyond the substation — on feeders, laterals, and at the edge where DER and customer behavior are interacting with the grid.</p><p>Grid-edge technologies have become essential. Sensors, Advanced Metering Infrastructure (AMI) and automated switching provide the raw data and control needed to move from reactive to proactive operations. In more advanced deployments, utilities are creating centralized control environments that allow operators to see and manage the distribution system in near real time. That capability is enabled by:</p><ul><li>Advanced communications networks to form the backbone of real-time grid visibility</li><li>Distribution Management System (DMS) and Outage Management System (OMS) to enable faster, more coordinated system response</li><li>Analytics, AI and machine learning to improve situational awareness, anticipate system conditions, and support operational decision-making</li></ul><p>The same connectivity enabling this real-time visibility and control also introduces new vulnerabilities, blurring the line between physical and cyber risk, yet many utilities manage them separately. Only 22 percent have unified teams in place, even as threats continue to rise, including a 50 percent increase in substation attacks and growing exposure to malware and ransomware, according to the <a href="https://www.bv.com/en-US/resources/2025-electric-report" target="_blank">Black & Veatch 2025 Electric Report</a>. Cybersecurity and resilient network design must be embedded into the architecture from the outset—not layered on after the fact.</p><h2>See what bolder vision looks like</h2><p>Distribution modernization is fundamentally changing how the system is designed and operated so it can absorb disruption, manage bi-directional flows and respond in real time.</p><p>To learn about a successful program, check out <a href="https://www.bv.com/en-US/projects/georgia-power-grid-investment-plan?utm_campaign=portfolio_for_power_utilities-pp-grid_solutions-noia-26-100223&utm_id=26-100223&utm_source=publication&utm_medium=qr-code&utm_content=power-generation&utm_tactic=na&utm_term=brand-awareness_26-bolder-vision-spectrum-native-article" target="_blank">Georgia Power’s recent grid modernization program</a>. Black & Veatch partnered with the utility on large-scale infrastructure upgrades. The results? Outages are down 76 percent, restoration times have improved by more than 80 percent and communities across Georgia are powered by a grid built to meet the future head-on.</p><p>When the state faced the most destructive storm in the company’s history, Hurricane Helene, Georgia Power deployed a rapid response team that utilized its “smart grid” and restored power to more than 1 million customers within days.</p>A grid built to meet the future head-on—that’s the result of bolder vision. Reference: https://ift.tt/hYMGxfT

Dashlane issues opaque advisory warning 20 encrypted vaults were stolen


<p>There’s a lot that doesn’t add up in a security advisory password manager Dashlane published Monday, warning that attackers managed to obtain 20 encrypted user vaults.</p> <p>“Starting on Sunday, May 31, 2026, an external party launched a brute force attack against certain Dashlane user accounts,” the company <a href="https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts">said</a>. “The goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts.”</p> <h2>Hello, Dashlane, anybody home?</h2> <p>A Dashlane user who received such a 2FA request provided this screenshot of the notification, which arrived on Sunday.</p><p><a href="https://arstechnica.com/security/2026/06/dashlane-issues-opaque-advisory-warning-20-encrypted-vaults-were-stolen/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/06/dashlane-issues-opaque-advisory-warning-20-encrypted-vaults-were-stolen/#comments">Comments</a></p> Reference : https://ift.tt/O9fsCnr

Tuesday, June 2, 2026

Direct-to-Cell Technology: Enabling Satellite Connectivity for Legacy Devices


<img src="https://spectrum.ieee.org/media-library/rohde-schwarz-logo-with-slogan-make-ideas-real-and-rs-monogram-in-a-diamond.png?id=66784674&width=980"/><br/><br/><p>Direct-to-cell technology uses LEO satellites as spaceborne cell towers. It delivers LTE services to existing smartphones without hardware changes, bridging global coverage gaps.</p><p>What Attendees will Learn</p><ol><li><span>How DTC works as a spaceborne cell tower — LEO satellites carry LTE eNodeB payloads in regenerative mode. How they serve unmodified phones using quasi-earth-fixed multi-beam antennas. How the satellite compensates for Doppler shift and time delay on thenetwork side.</span></li><li><span>Why Doppler shift and round-trip time are critical challenges — A LEO satellite’s high velocity causes carrier frequency offsets in OFDMA systems. Pre-compensation at a reference point helps, but cell-edge users still face residual Doppler.</span></li><li><span>How spectrum sharing and regulation shape DTC deployment — DTC has no dedicated spectrum allocation. It relies on spectrum sharing between terrestrial and satellite operators or re-farmed MSS bands. How national regulations like the FCC SCS framework govern access.</span></li><li><span>Where DTC fits in the evolution toward 5G NTN and 6G — DTC is an interim technology offering fast time-to-market satellite services. It bridges the gap until 3GPP NR-NTN matures. How NR-NTN will bring purpose-built NTN features and international spectrum frameworks.</span></li></ol><div><span><a href="https://content.knowledgehub.wiley.com/direct-to-cell-technology-enabling-satellite-connectivity-for-legacy-devices/" target="_blank">Download this free whitepaper now!</a></span></div> Reference: https://ift.tt/vP7tgCO

Monday, June 1, 2026

Dozens of Red Hat packages backdoored through its offical NPM channel


<p>Official Red Hat NPM accounts have been compromised and used to push a malicious worm that spreads from machine to machine, where it pilfers sensitive credentials in hopes of stealing yet more confidential data, researchers said.</p> <p>The supply-chain attack <a href="https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm">began Monday</a> and remained active at the time this post went live, according to researchers at security firm Aikido. It’s the result of the threat actor responsible for the hack taking control of @redhat-cloud-services, a legitimate channel in the npm repository that’s reserved for official Red Hat packages. As such, the channel is widely trusted by developers who rely on Red Hat cloud services.</p> <h2>The vicious cycle of today’s supply-chain attacks</h2> <p>It’s unclear precisely how the threat actor took control of the namespace, but it almost certainly involved the compromise of credentials required to access it, possibly through a previous supply-chain attack. More than 30 packages seem to be affected.</p><p><a href="https://arstechnica.com/security/2026/06/dozens-of-red-hat-packages-backdoored-through-its-offical-npm-channel/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/06/dozens-of-red-hat-packages-backdoored-through-its-offical-npm-channel/#comments">Comments</a></p> Reference : https://ift.tt/igsWTYV

How a USB-connected speaker can infect a PC without ever being touched

<p>Operating system makers take many steps to prevent their wares from accepting commands from remote dev...