Aggregator

error code: 521

#系统资讯 微软调整 KMS 激活功能导致 KMS38 激活方式失效，但看起来微软并不是打击非法激活，而是和之前一样调整某些东西时造成的无意影响。MAS 团队称从 Build 2610

HackerNews 编译，转载请注明出处： 谷歌周二发布了一项名为“隐私AI计算”的全新隐私增强技术，旨在云端安全平台中处理人工智能查询。 公司表示，打造隐私AI计算是为了“在确保您的个人数据仅本人可见的同时，充分释放Gemini云端模型在AI体验中的全部速度与效能”。这项技术被描述为一个“安全加固空间”，以类似设备端处理的方式处理敏感用户数据，同时扩展了AI能力。其核心动力来自Trillium张量处理单元与泰坦智能安全飞地，使得公司能在不牺牲安全隐私的前提下使用前沿模型。 换言之，该隐私基础设施既利用了云端的计算速度与性能，又保留了设备端处理的安全隐私保障。 谷歌的CPU与TPU工作负载（即可信节点）基于AMD硬件可信执行环境，可对内存进行加密并与主机隔离。谷歌强调，只有经过认证的工作负载才能在可信节点运行，且管理员权限已被切断。此外，节点还具备物理防数据窃取攻击的能力。 该架构还支持可信节点间的点对点认证与加密，确保用户数据仅限在安全环境内解密处理，并隔绝于谷歌其他基础设施。“每个工作负载都会请求并加密验证对方的工作负载凭证，从而在受保护的执行环境中建立双向信任，”谷歌解释称，“工作负载凭证仅在节点认证通过内部参考值验证后才会发放。验证失败将阻止连接建立，从而保护用户数据免受不可信组件侵害。” 整体流程如下：用户客户端通过Noise协议与前端服务器建立加密连接，完成双向认证。客户端还通过Oak端到端加密认证会话验证服务器身份，确认其真实未经篡改。随后，服务器通过应用层传输安全协议与可扩展推理流水线中的其他服务建立加密通道，最终与运行在强化TPU平台上的模型服务器通信。整个系统采用“临时性设计”，即使用户会话结束后输入数据、模型推理及计算结果立即清除，即使攻击者获得系统特权也无法获取历史数据。 谷歌隐私AI计算架构 谷歌同时强调了内置的多重防护机制以保障系统安全性与完整性，防止未授权篡改，包括： 最大限度减少数据保密所需的可信组件与实体数量 采用机密联邦计算收集分析数据与聚合洞察 客户端与服务器通信全程加密 实施二进制授权，确保软件供应链中仅运行经签名授权代码与验证配置 在虚拟机中隔离用户数据以控制泄露影响 通过内存加密与输入输出内存管理单元防护抵御物理窃取 TPU平台实现零命令行访问权限 使用第三方运营的IP隐匿中继传输所有入站流量以隐藏请求真实来源 采用匿名令牌将系统认证授权与推理过程隔离 安全评估与改进 网络安全公司NCC集团在2025年4月至9月期间的外部评估中发现，IP隐匿中继组件存在基于时间的侧信道漏洞，特定条件下可能“去匿名化”用户。但谷歌认定该风险较低，因为系统多用户特性会产生“显著噪声”，使攻击者难以将查询关联到特定用户。评估还发现认证机制实施中的三处缺陷，可能导致拒绝服务状态及多种协议攻击，谷歌正全力修复所有问题。 评估报告指出：“尽管整套系统依赖专有硬件且集中部署于Borg Prime平台……但谷歌已严格限制用户数据遭异常处理或外泄的风险，除非谷歌整个组织蓄意而为。用户将获得针对恶意内部人员的高度防护。” 行业趋势与展望 此举与苹果和Meta的战略相呼应，这两家公司已分别推出私有云计算与隐私处理服务，以隐私保护方式将移动设备AI查询任务转移至云端。谷歌AI创新与研究副总裁杰·亚格尼克表示：“远程认证与加密技术将您的设备连接至硬件加密的密封云环境，使得Gemini模型能在专用受保护空间内安全处理数据。这确保了隐私AI计算处理的敏感数据仅限您本人访问，其他任何方（包括谷歌）均无法获取。”     消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

error code: 521

#系统资讯 为平息用户怒火谷歌将允许开发者和专业玩机用户侧载安装未经认证的 APK，而不是基于反诈考虑只有经过认证的 APK 才能侧载安装。谷歌将从明年开始在部分地区执行新政策，即哪怕

#游戏设备 蒸汽机！专为游戏而生的 Steam Machine 发布，搭载 SteamOS 系统可以专门拿来连接 PC 显示器或电视玩游戏。新款蒸汽机对标索尼 PS 系列和微软 Xbo

Singapore, Singapore, 13th November 2025, CyberNewsWire

Singapore, Singapore, November 13th, 2025, CyberNewsWireRecognition we believe undersco

Singapore, Singapore, 13th November 2025, CyberNewsWire

The post ThreatBook Peer-Recognized as a Strong Performer in the 2025 Gartner® Peer Insights™ Voice of the Customer for Network Detection and Response — for the Third Consecutive Year appeared first on Security Boulevard.

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.23/6.13.11/6.14.2. This affects the function io_admin_reset_sync of the component scsi. The manipulation results in allocation of resources. This vulnerability was named CVE-2025-37861. The attack needs to be approached within the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability has been found in Linux Kernel up to 6.6.88/6.12.25/6.14.4/6.15-rc3 and classified as critical. Affected by this vulnerability is the function apple_soc_cpufreq_get_rate of the component cpufreq. Performing manipulation results in null pointer dereference. This vulnerability is cataloged as CVE-2025-37831. The attack must originate from the local network. There is no exploit available. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.12.23/6.13.11/6.14.2 and classified as critical. Affected is the function list_del of the component btrfs. Such manipulation leads to improper update of reference count. This vulnerability is documented as CVE-2025-37856. The attack requires being on the local network. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.15-rc3. This impacts the function scmi_cpufreq_get_rate of the component cpufreq. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-37830. Access to the local network is required for this attack to succeed. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.14.2. Affected by this issue is the function dbExtendFS of the component JFS File Parser. This manipulation causes integer overflow. This vulnerability is registered as CVE-2025-37858. The attack requires access to the local network. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.14.2. This affects the function page_pool_release_retry. Such manipulation leads to infinite loop. This vulnerability is documented as CVE-2025-37859. The attack requires being on the local network. There is not any exploit available. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.14.2. This issue affects the function st_setup of the component scsi. This manipulation causes integer overflow. This vulnerability is handled as CVE-2025-37857. The attack can only be done within the local network. There is not any exploit available. You should upgrade the affected component.

针对某集团的红队钓鱼样本分析

连续三年