BlackLotus UEFI bootkit: Myth confirmed

WeLiveSecurity: 

As already mentioned, the bootkit has been sold on underground forums since at least October 6th, 2022. At this point, we have not been able to identify, from our telemetry, the exact distribution channel used to deploy the bootkit to victims. The low number of BlackLotus samples we have been able to obtain, both from public sources and our telemetry, leads us to believe that not many threat actors have started using it yet.

The goal of the installer is clear – it’s responsible for disabling Windows security features such as BitLocker disk encryption and HVCI, and for deployment of multiple files, including the malicious bootkit, to the ESP. Once finished, it reboots the compromised machine to let the dropped files do their job – to make sure the self-signed UEFI bootkit will be silently executed on every system start, regardless of UEFI Secure Boot protection status.

ArsTechnica:

Researchers on Wednesday announced a major cybersecurity find—the world’s first-known instance of real-world malware that can hijack a computer’s boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows.

Because the UEFI is the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. These traits make the UEFI the perfect place to launch malware. When successful, UEFI bootkits disable OS security mechanisms and ensure that a computer remains infected with stealthy malware that runs at the kernel mode or user mode, even after the operating system is reinstalled or a hard drive is replaced.

The ultimate takeaway is that UEFI bootkit BlackLotus is able to install itself on up-to-date systems using the latest Windows version with secure boot enabled.  

TheRegister:

Once BlackLotus exploits CVE-2022-21894 and turns off the system's security tools, it deploys a kernel driver and an HTTP downloader. The kernel driver, among other things, protects the bootkit files from removal, while the HTTP downloader communicates with the command-and-control server and executes payloads.

And while the researchers don't attribute the malware to a particular gang or nation-state group, they do note that the BlackLotus installers they analyzed won't proceed if the compromised computer is located in Armenia, Belarus, Kazakhstan, Moldova, Romania, Russia, and Ukraine.

This is a really tough sort of attack to protect against. If Microsoft deployed the trivial solution (simply flagging the vulnerable boot files as untrustworthy), it may brick every machine with an outdated UEFI. The exploit also uses BatonDrop, discovered by Wack0 back in August.

GitHub:

Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. 

The attacker needs to ensure the serialised Secure Boot Policy is allocated above a known physical address.

This issue can be used to dump BitLocker keys (where Secure Boot is used for integrity validation). 

No known vulnerable boot application has been revoked yet. Revocation would cause all existing Windows installation/recovery media, and old backups, to fail to boot.

James Webb captures an extremely distant triple-lensed supernova

ESA/Webb:

This observation from the NASA/ESA/CSA James Webb Space Telescope contains three different images of the same supernova-hosting galaxy, all of which were created by a colossal gravitational lens. In this case, the lens is the galaxy cluster RX J2129, located around 3.2 billion light-years from Earth in the constellation Aquarius. 

Astronomers discovered the supernova in the triply-lensed background galaxy using observations from the NASA/ESA Hubble Space Telescope, and they suspected that they had found a very distant Type Ia supernova.

SNe Type Ia function as standard candles, so if it really is Type Ia it could be used to determine a cosmic distance to RX J2129. However, I'm curious as to how they made this determination, as I didn't see any conclusive lightcurve or spectra associated with this find. No one has classified the supernova on TNS either. Update: apparently spectroscopy was obtained by NIRSpec but it's not clear if classification was possible.

Digital Trends:

The image features a huge galaxy cluster called RX J2129, located 3.2 billion light-years away, which is acting as a magnifying glass and bending light coming from more distant galaxies behind it. That’s what is causing the stretched-out shape of some of the galaxies toward the top right of the image.

CNET:

Not only does the galaxy appear three times, but it appears at different points in time. A supernova -- a bright exploding star -- is visible in the earliest version of the galaxy. The second and third images, from about 320 days and 1,000 days later, show that the supernova has faded away. An annotated version of the image points out these cool features: 

Mashable:

Astronomers are now adept at spotting the telltale effects of gravitational lensing, but that wasn't always the case. Four decades ago, the concentric arcs of light and stretched celestial objects could be downright confusing. In 1987, an enormous blue arc thought to be hundreds of trillions of miles long was first considered one of the largest objects ever detected in space. The arc was found near the galaxy cluster Abell 370, with another similar object near galaxy cluster 2242-02.

Hyperauthorship: the publishing challenges for ‘big team’ science

Nature:

Then the COVID-19 pandemic broke that record, with 15,025 co-authors on a research paper examining the effect of SARS-CoV-2 vaccination on post-surgical COVID-19 infections and mortality.

The term ‘hyperauthorship’ is credited to information scientist Blaise Cronin7 at Indiana University in Bloomington, who used it in a 2001 publication to describe papers with 100 or more authors. But with the rise of large international and multi-institutional scientific collaborations — such as the ATLAS consortium behind the discovery of the Higgs boson — papers with hundreds, even thousands, of authors are becoming more common. There are many legitimate reasons for this shift, but it is raising questions — and concerns — about the nature of authorship and the impact that hyperauthorship has on the metrics of scientific achievement.

It’s a big change from the 1980s and is driven largely by an increase in international collaboration in science, says Jonathan Adams, chief scientist at the ISI and co-author of the report. 

These changes reflect the growing need for large research groups, spread across different types of institution and geographies, to answer complex questions. They also reflect a desire for more-inclusive authorship that recognizes researchers from backgrounds that might have been overlooked in the past.

But hyperauthorship creates challenges for researchers and for the journals that publish their work. Coordinating so many individual contributions across a multitude of institutions and nations is an enormous logistical feat. And hyperauthorship is raising philosophical questions about what it means to be an author of a research paper, and who has the right to — and need for — acknowledgement.

Overall a very interesting read into the phenomenon of high-authorship, high-impact papers.

Adams suggests that the number of authors on publications should be considered when looking at citation counts for institutions or nations, just as citation counts are normalized for year of publication and field. “We should be normalizing for the authorship, so you get a more representative citation indicator.” He says there’s even a case for leaving the largest of hyperauthored papers out of the citation process entirely. “If it’s CERN or one of the big telescopes, it’s like you’re either in the club or you’re not,” Adams says. “And then, what are we comparing you with?” [emphasis added]

I disagree with a lot of the conclusions of the article, but this opinion in particular I think could have a damaging effect. Much of my work is with a large collaboration (the Event Horizon Telescope Collaboration), so I have personal experience with this. Oftentimes, high-author papers are the only product researchers in the collaboration will have; anything they are working will get subsumed into these monster result papers. To torpedo these types of papers in a citation count will completely nullify years and years of research for many scientists working full time on these projects, dedicating their lives and careers to these results, with collaboration papers being their only scientific product. 

Another critical oversight this article makes is regarding collaborations (like the EHT) which have policies mandating full authorship. I spent the better part of 2 years working solely on a single paper which, when published, was determined to require full Collaboration authorship. This was a fair assessment, as the paper relied on the previous and ongoing work of large portion of the Collaboration and presented results that impacted and supported other major Collaboration work. I fully supported and advocated for this classification. However, the idea that the paper could simply be tossed in future citation counts purely because it has a giant author list is frankly terrible, given how important citation counts are becoming as a measure of productivity and impact. 

I know I am not alone in this situation--there are many, many early career scientists facing this exact problem. We work in large collaborations because many problems today are intractable without huge groups of people and data--something this article understands. However, the requirement of working in such a large collaborations is that most of your work goes into collaboration papers with everyone else's, and short-author-list papers are simply not as common--and certainly almost never as impactful. Especially for early-career scientists (particularly students), they may not be allowed to lead projects in these collaborations, meaning their only contributions will be recorded in the collaboration papers, if at all.

While altering citation counts to exclude high-authorship papers may weed out people who haven't contributed directly to the writing of a paper, it will be a harsh foot in the back of early-career scientists who rely on these projects and infrastructures to get their start in a world of large collaborations. 

Potential comet for 2024: C/2023 A3

MPEC:

Q.-Z. Ye reports cometary activity of an asteroidal NEOCP candidate (initially reported by ATLAS South Africa - M22 on Feb. 22 UT) in prediscovery images obtained by Palomar Mountain-ZTF (I41) on Dec 12, 2022 UT, noting a very condensed 2" coma and a straight 10" tail at position angle 230-250 deg. The object was independently discovered on Jan. 9 UT at Purple Mountain Observatory, XuYi Station (D29).

EarthSky:

At discovery, the comet was still 7.3 astronomical units (AU) from the sun, and shining at a dim magnitude 18.

Preliminary analysis of its trajectory suggests comet “A3” completes an orbit around the sun every 80,660 years. As of March 2023, the celestial visitor is currently between the orbits of Saturn and Jupiter. Although some specific facts and dates might be updated, currently it appears that closest approach to Earth should occur on October 13, 2024 at 05:38 UTC.

LiveScience:

As viewed from Earth, the comet may be as luminous as the brightest stars in the sky during its upcoming flyby, according to EarthSky. This is brighter than the green comet C/2022 E3 that just passed by Earth in January. That comet had a brightness of around magnitude +4.6, just visible to the naked eye. The new comet may have a brightness of magnitude 0.7, potentially peaking at magnitude -5, similar to Venus at its brightest(opens in new tab). (Lower numbers mean greater brightness on the stellar magnitude scale.) 

Much is yet unknown about C/2023 A3, including its size. Without more data, astronomers are still debating the comet's chances of survival. In a message chain for astronomers(opens in new tab), University of Pennsylvania postdoctoral researcher Qicheng Zhang(opens in new tab) summed up the situation, calling C/2023 A3 the most promising comet in years to provide naked-eye views but cautioning that these hopes could be dashed. "C/2023 A3's survival, while promising, is not guaranteed at this point," Zhang wrote.

I plan on following this comet closely! Excited to see what mass measurements come out, and it will be fun to try and photograph it.

Blender can now use AI to create images and effects from text descriptions

Stability.ai:

The Stability addon for Blender lets you use Stable Diffusion right inside your favorite 3D software. Generate textures, generate AI video from your renders, and more.

One of the most commonly used features of the addon is the ability to generate images from your existing renders. This is a great way to experiment with different styles or aesthetics in Blender without having to remodel your existing scene!

Engadget:

Stability AI has introduced a Stability for Blender tool that, as the name implies, brings Stable Diffusion's image creation tech to the open-source 3D tool. You can create AI-based textures, effects and animations, whether using source material from your renders or nothing more than a text description. 

Stability for Blender requires an API (programming interface) key and an internet connection, but it's free to use. It doesn't require any software dependencies or a dedicated GPU. 

Update to: Observational Evidence for Cosmological Coupling of Black Holes and its Implications for an Astrophysical Source of Dark Energy

Full post cataloging the reactions to this paper here.

PhysicsWorld:

The new theory hasn’t passed without controversy in physics circles, with many researchers unwilling to accept this cosmological coupling just yet.

“I can spot things that are troubling,” Universidad ECCI cosmologist Luz Ángela García tells Physics World. “Saying that their observation sets evidence for black holes being made out of dark energy seems like a long shot, in particular, because we cannot perform measurements ‘inside’ the black hole.”

García is also troubled by the fact that by linking dark energy to black holes, the team’s theory connects this force to the life cycle of stars, describing it as “very risky”. This is because when scientists consider the energy–matter content of the universe, black holes and thus dark energy in this model have already been accounted for in the 5% “ordinary matter” proportion of the energy–matter content of the universe.

Finally, García notes that the timeline of the universe leaves a gap of two billion years that the team’s theory struggles to fill.

“The peak of the number of black holes and quasars coincides with the peak of the star formation history approximately 10 billion years ago, and after that there’s a rapid decline in the number of these massive objects,” she explains. “On the other hand, the kickstart of the dark-energy domination occurs more or less eight billion years ago.”

This article has a quote from Dr. Farrah regarding the "controversy":

Farrah himself concurs that the mystery of dark energy is far from solved, acknowledging that while the two papers provide evidence of an astrophysical source for dark energy, their argument needs much more scrutiny.

“Dark energy remains a deeply mysterious phenomenon,” Farrah concludes. “I would say our papers raise the possibility of black holes as a source for dark energy and provide an ‘interesting hypothesis’, but at present, no more than that.”

I put "controversy" in quotes because while there is a lot of disagreement in the community about the validity of the theory, "controversy" has a very gross inappropriate drama-esque association with it. Fundamentally, nothing about the paper is inappropriate or "controversial" in this sense. Farrah and his team split the work into two distinct volumes; the first providing a solid report on an exciting data analysis, leaving 100% of the interpretation for the second volume. Do you notice how no one is casting much doubt on the first of the papers? It's because their actual data analysis is excellent; it's the interpretation scientists are disagreeing on. Farrah recognizes this himself in his quotes and interviews. Not only was it a smart thing to do (to avoid any "guilt by association" with the data analysis), it was also (in my opinion) a very responsible thing to do. The data are untainted by the interpretation, and the interpretation is not lent undue credibility by the solid data analysis.

Initial Flash and Spectral Formation of Type Ia Supernovae with An Envelope: Applications to Over-luminous SNe Ia

arXiv:

Over-luminous type Ia supernovae (SNe Ia) show peculiar observational features, for which an explosion of a super-massive white dwarf (WD) beyond the classical Chandrasekhar-limiting mass has been suggested, largely based on their high luminosities and slow light-curve evolution.

In the present work, we suggest a scenario that provides a unified solution to these peculiarities, through hydrodynamic and radiation transfer simulations together with analytical considerations; a C+O-rich envelope (~0.01 - 0.1 Msun) attached to an exploding WD. Strong C II lines are created within the shocked envelope.

The scenario thus can explain some of the key diverse observational properties by a different amount of the envelope, but additional factors are also required; we argue that the envelope is distributed in a disc-like structure, and also the ejecta properties, e.g., the mass of the WD, plays a key role.

Interestingly, the proposed scenario can also be tested for normal (non overluminous) SNe Ia:

Indeed, by combining the expected properties as summarized above, we can comprehensively test this scenario for SNe Ia with intensive observational coverage from the infant to late phases; the present work thus provides one strong motivation for the high-cadence survey and prompt follow-up observation for SNe Ia of various subclasses, especially nearby events that allow longterm monitoring toward the late phase.  

The predicted spectra are shown in Figure 4: