Like many classic board games, Ludo offers its players numerous opportunities to inflict frustration on other players. Despite this, [Viktor Takacs] apparently enjoys it, which motivated him to build a thoroughly modernized, LED-based, WiFi-enabled game board for it (GitHub repository).

The new game board is built inside a stylish 3D-printed enclosure with a thin white front face, under which the 115 LEDs sit. Seven LEDs in the center represent a die, and the rest mark out the track around the board and each user’s home row. Up to six people can play on the board, and different colors of the LEDs along the track represent their tokens’ positions. To prevent light leaks, a black plastic barrier surrounds each LED. Each player has one button to control their pieces, with a combination of long and short presses serving to select one of the possible actions.

The electronics themselves are mounted on seven circuit boards, which were divided into sections to reduce their size and therefore their manufacturing cost. For component placement reasons, [Viktor] used a barrel connector instead of USB, but for more general compatibility also created an adapter from USB-C to a barrel plug. The board is controlled by an ESP32-S3, which hosts a server that can be used to set game rules, configure player colors, save and load games, and view statistics for the game (who rolled the most sixes, who sent other players home most often, etc.).

If you prefer your games a bit more complex, we’ve also seen electronics added to Settlers of Catan. On a rather larger scale, there is also this LED-based board game which invites humans onto the board itself.

Thanks to [Victoria Bei] for the tip!

OPINION — “The need for accurate and uninterrupted PNT (Positioning, Navigation and Timing) has never been more essential to our warfighters who operate in GPS (Global Positioning System)-denied environments. The successful launch of the NTS-3 (Navigation Technology Satellite-3) system is the first step in updating 20th century technology to help address current threats to our national security.”

That was Ed Zoiss, President of the Space & Airborne Systems segment for L3Harris Technologies, speaking August 13, about the successful launch and arrival in orbit of NTS-3, the most advanced U.S. experimental navigation satellite in nearly 50 years, that was designed and led by the Air Force Research Laboratory (AFRL) with L3Harris Technologies as prime contractor.

NTS-3 is managed by the AFRL Transformational Capabilities Office in partnership with the U.S. Space Force and U.S. Air Force.

Space Force’s GPS provides critical positioning capabilities to military, civilian, and commercial users around the world. The United States government created GPS for the military in 1973, launched the first satellite in 1978, made the system available to civilians in 1988, and has operated the full system of 24 satellites since 1993.

Today it is freely accessible to anyone with a GPS receiver, which means more than six billion users worldwide, according to GPS World, with an estimated 170 million in the U.S. Every day, GPS satellites aid in air traffic control, banking, farming, cellular networks, and countless other industries, and it is perhaps the space system that most people around the world depend on each day.

However, according to the Air Force, “The rapidly increasing pace of new threats to GPS, such as jamming and spoofing, indicate that agile and resilient approaches to augment the GPS system are needed to maintain users’ access to its critical service.”

The GPS system’s 24 operational satellites are strategically placed in six medium earth orbits (MEOs), at an altitude of approximately 12,550 miles, with three to four satellites in each plane making two orbits a day. This configuration ensures that at least six satellites are visible from any point on Earth at any given time.

NTS-3, is expected to change the architecture for satellite navigation and to deliver more robust PNT capabilities to warfighters.

NTS-3 will carry out some 100 tests over the coming year from near-geosynchronous orbit (GEO), where the satellite orbits directly above the equator at about 22,236 miles above the earth. The satellite's orbital period is close to 24 hours and appears stationary from the ground,

thus giving NTS-3 a clear, unobstructed and distinct vantage point without the interruption of weather or atmospheric distortion.

The NTS-3 program integrates a space-based payload, a reconfigurable ground control segment, and agile user receivers -- all linked by reprogrammable software. This architecture allows for rapid updates across all segments, enabling operators to counter jamming, deploy new signals, and adapt to evolving mission requirements without replacing hardware.

According to an AFRL release, “The [NTS-3] satellite will broadcast navigation signals from its phased-array antenna, which can electronically steer signals to a desired region [on earth] without physically moving the satellite. These signals are created through a digital, on-orbit reprogrammable PNT signal generator, which not only supports legacy signals and advanced signals not currently broadcast on GPS, but also allows new signal updates after launch.”

Sign up for the Cyber Initiatives Group Sunday newsletter, delivering expert-level insights on the cyber and tech stories of the day – directly to your inbox. Sign up for the CIG newsletter today.

NTS-3 will test a new digital signal generator, AFRL said, “that can be reprogrammed on-orbit, enabling it to broadcast new signals, improve performance by avoiding and defeating interference, and adding signatures to counter spoofing.” A goal is to make possible the uploading of a signal to the satellite and start transmitting it without having to relaunch the entire satellite.

AFRL also said NTS-3 will also test “the CHIMERA (Chips-Message Robust Authentication) signal authentication protocol, which is designed to jointly authenticate satellite orbit data and measurements of the range between the satellite and user.” CHIMERA provides “an extremely robust protection against GPS spoofing for civil users. Future versions of CHIMERA, or different kinds of signals, can be uploaded to the satellite at any point after launch, based on new knowledge or threat developments on the ground.”

Over the next year, AFRL will conduct a series of demonstrations to assess these technologies in realistic operational scenarios, from countering electronic interference to rapidly deploying new signal configurations in response to emerging threats.

“Because SATNAV (satellite navigation) is critically dependent on precise timekeeping,” AFRL said, “NTS-3 will have multiple atomic clocks and timing sources onboard the satellite that will be used both independently and as an optimized ensemble to allow for automatic clock error detection and correction.”

The NTS-3 Ground Control Segment (GCS), AFRL said, is compatible with the Enterprise Ground Services, an architecture that the Space Forces’ Space and Missile Systems Center is developing, to provide a common system for satellite command and control. “The goal is to move from a portfolio of stove-piped ground systems to a single system that will connect with all Air Force and Space Force satellites, saving millions of dollars by streamlining user training and operations,” AFRL said.

NTS-3 ground control is also planning to leverage commercially-available services such as ground antennas and monitoring receivers to increase opportunities for contact time with the satellite while reducing dependence on already strained government antenna resources.

AFRL is also working with the non-profit MITRE Corp., to develop a reprogrammable software-defined receiver called the Global Navigation Satellite System Test Architecture (GNSSTA). That new receiver will allow users to receive both legacy GPS and advanced signals generated by NTS-3 -- and is of course critical.

Warfighters will be the ultimate beneficiaries of the impact of new navigation technologies and integrated SATNAV capabilities, and any changes to the signal being broadcast from space must be communicated to and coordinated with that user segment. NTS-3 tests will be used to demonstrate new features for warfighters carrying so-called Software-Defined Radios (SDRs), capable of receiving and processing reprogrammable SATNAV signals.

Testing will show whether warfighter SDRs “will be able to access accurate PNT data and enhanced flexible anti-jam and anti-spoof protections,” according to AFRL. “Lessons from the GNSSTA software architecture developed through NTS-3 will pave the way for future DoD major defense programs to successfully connect service men and women to a flexible and resilient SATNAV architecture of the future.”

Much like downloading a new smartphone app, think of what future NTS-3 software updates can bring routinely to future users without the recapitalization effort typically required to upgrade.

This is the future for users of GPS. Hopes are high that NTS-3 will guide us down the right path.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

EXECUTIVE SUMMARY:

Organizations leverage cloud computing to reduce compute costs and to rapidly provision new computing resources for the purpose of supporting evolving business needs. Cloud-based technologies provide opportunities to go-to-market quickly, allowing enterprises to reach stakeholders and customers faster than ever before.

Across the past 10 years, cloud computing has transformed from into a cornerstone of the IT industry, boosting power of virtualization, storage, hosting and other networking services. Nonetheless, the cloud environment is vulnerable to cyber attacks. In 2021, forty percent of organizations reported cloud security breaches.

Below are five cloud security breach examples and lessons that all organizations can benefit from.

5 cloud security breaches (and lessons)

1. Accenture. In August of 2021, Accenture fell prey to a LockBit ransomware attack. The culprits claimed to have stolen 6TB worth of data, for which they requested a ransom of $50 million.

The largest exposed server appeared to contain credentials linked to Accenture customer accounts. One backup database contained nearly 40,000 passwords – the majority of which were in plain text.

“This cloud leak shows that even the most advanced and secure enterprises can expose crucial data and risk serious consequences,” wrote security researcher Chris Vickery.

Lesson learned: Ensure that IT departments and/or cyber security personnel check to ensure correct configuration of AWS cloud servers. Attacks on misconfigured servers can cause extreme reputational, client and financial damage.

2. Kaseya. In July of 2021, IT solutions provider Kaseya identified an attack on their unified remote monitoring and network perimeter security tool. The attackers aimed to steal administrative control for Kaseya services; from managed service providers to downstream customers.

The attack itself disrupted the organization’s SaaS servers and affected on premise VSA solutions used by Kaseya customers across nearly a dozen countries. After Kaseya alerted customers about the attack, it then rolled out the Kaseya VSA detection tool, which enabled business users to analyze VSA services and to screen endpoints for indicators of vulnerability.

Lessons learned: From this attack, organizations observed the importance of maintaining updated backups in easily retrievable, air-gapped repositories that remain segregated from organizational networks. Businesses are also reminded to manage patches, implement multi-factor authentication, and follow principles of zero trust.

3. Cognyte. In May of 2021, the cyber analytics firm Cognyte left a database unsecured without authentication protocols. In turn, hackers managed to expose 5 billion records. Information such as names, email addresses, passwords, and vulnerability data points within their system were leaked. Information was even indexed by search engines.

Lessons learned: The company managed to secure the data within four days, but the incident highlighted how persistent cyber attackers can effectively exploit the smallest of flaws. In this instance, the importance of cyber attack prevention cannot be overstated. Prevent as many attacks as possible through a combination of policies, tools, education and vigilance.

4. Facebook. In April of 2021, Facebook reported a breach affecting hundreds of millions of user records, which were publicly exposed on Amazon’s cloud computing service. Although Facebook confirmed that it identified and resolved the issue immediately, the attack managed to impact founder Mark Zuckerberg.

In precipitating the incident, two third-party Facebook app development companies posted the records in plain sight. The database exposed contained private information that social engineers could use in targeted attacks or within hacking attempts.

Lessons learned: In resolving this issue, Facebook reached out to Amazon, which took down the exposed servers. “…If you’re still opening AWS buckets [to the public], you’re not paying attention,” says business advisor Corey Quinn.

5. Raychat. In February of 2021, Raychat, an online chat application, survived a large-scale cyber attack. A cloud database configuration breach gave hackers free access to 267 million usernames, emails, passwords, metadata and encrypted chats. Shortly thereafter, a targeted bot attack erased the entirety of the company’s data.

According to reports, a MongoDB misconfiguration left the data openly available. The attack highlighted how NoSQL databases can function as easy targets for bot threat actors.

Organizations need to ensure that databases are secure. NoSQL databases in particular represent targets for malicious actors who wish to steal or wipe content, unless given a ransom payment. In Raychat’s case, a README ransom note appeared, demanding roughly $700 USD.

Lesson learned: Database security requires a range of tools controls and measures that can protect the database itself, the actual data embedded within, its database management system and the assorted applications that access it. End-to-end compliance technologies and cybersecurity penetration tests can help.

In closing

Cloud computing increases operational efficiency and simplicity, provided that security measures are in place. Is your cloud secure enough?

Be sure to avoid AWS security breaches and other common stumbling points. For more cloud security insights, please see CyberTalk.org’s past coverage. Also, be sure to check out our Cloud Security Buyer’s Guide.

The post Top 5 cloud security breaches (and lessons) appeared first on CyberTalk.

The post 7 biggest security news of 2017 appeared first on Detectify Blog.

The post AWS S3 Misconfiguration Explained – And How To Fix It appeared first on Detectify Blog.