The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.

Gambling regulators in New York on Friday formally proposed two rules that they say will help curb gambling addiction in the state.

The move adds the country’s largest sports betting market to a growing list of places that are seeking online gambling reforms as states that have legalized wagering on sports in recent years deal with the harmful side effects, including rising addiction diagnoses there.

While the drafts have been months in the making, their official introduction follows mounting media scrutiny, including a ProPublica investigation last month that showed weaknesses in the guardrails that companies like DraftKings have erected to address problem gamblers on their platforms. That system is called “responsible gaming.”

The commission’s chair, Brian O’Dwyer, said that the proposed rules “provide an opportunity for the industry to illustrate its commitment” to protecting its customers. 

“The industry is on notice by me and this commission that they need to solve this problem,” O’Dwyer said. “If the industry does not address it, then we will address it and they may not like the solution that we come up with.”

One of the new rules would effectively adopt guidelines that New Jersey already uses, requiring sportsbooks to follow specific thresholds to identify at-risk bettors. The company would then be mandated to check in with those users. Another rule would bar companies from using artificial intelligence to customize bonuses or wagers.

DraftKings, one of the country’s largest sports betting companies, has said it already follows the New Jersey trigger thresholds. Among them: depositing more than $10,000 in a 24-hour period or wagering more than $1 million in a 90-day period.

But as ProPublica recently reported, problem gambling can manifest in much smaller amounts. With the advice of recovering addicts, addiction specialists and professional sports bettors, a reporter deposited $21,600 into his DraftKings account in less than eight weeks and purposefully bet compulsively, exhibiting the hallmark signs of problem gambling throughout that time. The behavior didn’t qualify for a company review or interventions beyond responsible gaming notices, including in-app pop-ups.

Some advocates for gambling reforms said that’s one big reason why the proposed rules don’t go far enough.

New York and New Jersey “are clearly complacent in the status quo by endorsing and prescribing regulations that are nothing more than giving the appearance of reform and not effectuating actual change,” said Brianne Doura-Schawohl, a gambling reform advocate who lobbies for consumer and public health protections.

After the commission advanced the rules unanimously on Friday, O’Dwyer said he recognized “the limitations of this proposal” and urged the state’s nine licensed mobile sports betting companies to share data so that problem gamblers can’t elude intervention by bouncing between them. 

The introduction of the rules is a key step toward formal adoption. There will be a 60-day comment period for the public to weigh in on them. Barring major changes, the rules will then go back before the commission.

Though the plans were first published in March and received dozens of public comments, their official introduction at the gaming commission comes on the heels of reporting by The New York Times, which found that DraftKings used artificial intelligence and data scientists to target its promotions to losing bettors, and ProPublica, which found that promotions far outweighed the responsible gaming notices sent to a reporter exhibiting problematic behavior.

DraftKings made that journalist a VIP after he displayed red flags of problem gambling.

Since those articles were published last month, regulators in Maine and Michigan have also said that they are reviewing some of the issues raised in the stories.

A spokesperson for Maine’s Public Safety Department said the Gambling Control Unit is “monitoring the use of AI locally and nationally” but has no rules or laws addressing the issue and declined to provide any additional information “regarding the scope of that monitoring or specific operations.” A spokesperson for Michigan regulators hasn’t responded to requests for comment.

Massachusetts regulators, who have been looking into the use of AI by gambling companies, said they were also taking a look. The governor of Maryland has separately said he’d like to limit gambling companies’ use of AI to “identify and target users showing problem-gambling patterns.”

Asked for comment on the New York regulations, a FanDuel spokesperson said the company “welcomes the opportunity to engage with regulators and work collaboratively to establish best practices for the industry.”

A spokesperson for DraftKings referred ProPublica to its prior comments.

In statements and interviews, the company has defended its responsible gaming program and disputed any characterization that it targets addicts or those prone to addiction with inducements.

In an interview with ProPublica, Lori Kalani, DraftKings’ chief responsible gaming officer, said that, overall, “the system worked the way it was supposed to” during our gambling investigation, citing the more than 30 messages it sent our reporter. She added that “as a business, as an industry, we’re doing a good job of educating people, of raising awareness, of making tools and resources available, of monitoring accounts.”

DraftKings told the Times it “rejects any implication that its marketing practices are unfair or improperly targets customers” and said its perks were delivered to “customers who demonstrated sustained, engaged use on our platform, not toward customers based on their losses.”

The rules presented on Friday were made in response to a call by Gov. Kathy Hochul this year to address problem gambling. The Democrat, who is running for reelection, has announced a 10-year survey of residents’ gambling behavior to help “guide smart, targeted investments that protect New Yorkers and strengthen access to care.”

But the commission’s proposed rules are a relatively moderate step in that direction.

The measures would require a sports betting company to do more due diligence into a user’s “financial vulnerability” under certain conditions. Those triggers include a range of behaviors, including, for example, if a user’s time on the app jumps by 50% or more in a week compared with the immediately preceding two-week period.

In a comment letter this May, the Responsible Online Gaming Association, a trade group that includes DraftKings, FanDuel and three other major sportsbook operators, said the rules “establish a strong framework for responsible gaming” but offered some “targeted recommendations.”

Those included ensuring the triggers “avoid displacing or disrupting the mature, data-driven behavioral risk assessment systems already in use” and don’t confuse the company’s “responsible gaming role and the role of qualified clinicians.” It said any interventions should be “proportionate, operationally scalable, and effective.”

The post New York Plans Stronger Sports Betting Regulation to Curb Gambling Addiction appeared first on ProPublica.

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity

The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name

Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with  Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court. TP-Link Systems is based in

Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security

Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI). "It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow

As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a

A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.

Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero

Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions. "CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said. The vulnerability

The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical infrastructure. The list of seized

Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms.

In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operative to the compromise of a Pentagon-run data center.

Among a cadre of Wall Street executives brought into the Pentagon during President Donald Trump’s second term, George K. Kollitides II has emerged as a powerbroker with a broad mandate to improve procurement of weapons and critical minerals.

The longtime partner at the private equity firm Alvarez & Marsal Capital has framed his tour of duty in government as a service to the country. But the work he’s leading has also been a boon to his old friends in the private sector, government procurement records show.

In April, months after Kollitides had started work at the Pentagon, he was listed on a securities filing as continuing to work for his old company as a senior adviser. Two months later, the Defense Department finalized a $281 million no-bid consulting contract with an affiliate firm, Alvarez & Marsal Federal, to advise Kollitides’ new Pentagon office, the records show.

That contract, large for consulting work even by Defense Department standards, is the second in a pair of deals that since December have awarded almost $350 million in military spending to the firm — about five times more than Alvarez & Marsal entities had received from all U.S. agencies combined in the two decades before Trump returned to office, according to federal spending data. Both of those contracts have been for work connected to Pentagon offices where Kollitides is the head or has a senior role.

The deals remain shrouded in secrecy, records show, because they were signed under an unusual contracting method the Defense Department uses to fund experimental weapons — work A&M has never claimed to do. They have begun to send unprecedented sums of taxpayer money to a company that boasts helping government agencies create a “customer-centric culture” and that is deeply intertwined with the private equity firm where Kollitides was a partner for almost 10 years. The two partner firms tag-team investment deals and share back-office support, company documents and federal filings show.

Kollitides was still working with A&M Capital when the deals were signed. It’s unclear if he will benefit financially from the windfall of military spending on A&M consulting. His employment at the Pentagon is under a special classification that allows him to keep his financial disclosures confidential.

Ethics experts said it’s generally illegal for executive branch officials to play a role in awarding contracts that would have a direct impact on their own finances, unless they were granted a waiver.

“It looks way too cozy to be legitimate. I think taxpayers should be appalled,” said Virginia Canter, a former federal government ethics lawyer. “There are a million consulting firms in D.C. and New York. Why would you sole source this contract? They’re not sending replacement parts for a ship that is sinking.”

After ProPublica sent questions to the Pentagon, Kollitides and both A&M entities early this  week, A&M Capital said Kollitides had just stopped working there days earlier.

In a statement, A&M Capital said it is a “separately capitalized and separately managed firm from the Alvarez & Marsal consulting business” and its “management and employees have no involvement in the day-to-day operations of the consulting business, and vice versa.” The firm said that none of Kollitides’ work for it related to the “defense industry, the Department of War or Mr. Kollitides’ government service.”

The Alvarez & Marsal consulting business did not answer any of ProPublica’s questions, including how it became aware of the possibility that it could seek the $281 million no-bid contract and what services it is providing to Kollitides’ Pentagon team. The Wall Street Journal on Thursday reported the existence of some of the Alvarez & Marsal contracting.

“We are proud to serve clients across all industries, and all levels of government,” the company said in a statement. “The common denominator is always the same: we help solve difficult problems.”

“It looks way too cozy to be legitimate. I think taxpayers should be appalled.”

Virginia Canter, former federal government ethics lawyer

Kollitides did not respond to questions about whether he played a role in A&M securing contracts to work for his office, but a Pentagon spokesperson replied for the department and on Kollitides’ behalf saying they both followed all applicable rules.

“The Department of War maintains a rigorous, multi-layered ethics framework that includes financial disclosure reviews, divestitures where appropriate, and screening to prevent conflicts of interest,” Deputy Pentagon Press Secretary Jacob Bliss wrote in an email. Kollitides, he added, “is in full compliance with all ethical laws and regulations. Any claims otherwise are false.”

There is widespread bipartisan agreement that the Pentagon’s procurement systems are in need of radical reform and private-sector know-how could help the country better secure supply lines and accelerate the development of new weapons to ensure the military is prepared to fight future wars.

But current and former defense officials say the massive spending for connected consultants is a reflection of a changed Defense Department under Trump. They say a clubby and politicized culture has taken hold in a wing of the Pentagon controlled by Kollitides and other former Wall Street executives recruited by Steve Feinberg, the billionaire private-equity titan who is now the deputy defense secretary. It’s an operation, they say, that favors people and companies that have close ties to the administration.

This year, ProPublica reported that the Office of Strategic Capital, a unit at the Pentagon that Kollitides helps lead, granted a small North Carolina startup linked to Donald Trump Jr. a $620 million loan after a top aide to the president intervened on the company’s behalf. A group of Democratic lawmakers accused the office of “a staggering level of corruption and influence peddling.”

ProPublica also reported that the same Pentagon unit was considering a loan to Unusual Machines, a second company connected to the president’s son. A defense official told ProPublica recently that the unit is now in the late stages of a $220 million loan for the Florida drone parts maker, where Trump Jr. sits on the advisory board and was granted a stake.

The Pentagon did not respond to a question about the advancing loan process for Unusual Machines and if Trump Jr.’s connections were playing a part. After the earlier loan to a Trump-connected company, the Pentagon said “no company receives preferential treatment” and “political connections play absolutely no role in the Department’s funding decisions.” Pentagon Press Secretary Kingsley Wilson pushed back on criticism, saying the Defense Department is conducting extensive due diligence on potential lending.

That Pentagon lending unit was launched during the Biden administration with an open application process for interested companies. Current and former officials and people who have interacted with the office say Kollitides and other leaders now rely more on their own personal networks to choose companies to fund — as well as the consultants to vet those deals.

Multiple Pentagon Hats

That reliance on personal networks is how Kollitides got to the Pentagon.

Feinberg first hired Kollitides more than two decades ago.

Then a rising private-equity star who had graduated from Columbia Business School, Kollitides moved up the ranks at Cerberus, Feinberg’s firm, taking the reins of its aerospace, defense and government groups. In 2012, Kollitides took on an especially sensitive and more public job for the private-equity giant. Kollitides was named chief executive of a Cerberus company combining Remington, the nation’s oldest gun maker, with more than a dozen other firearms and parts companies, eliminating hundreds of jobs from New York to Georgia to Montana.

After three years with the Cerberus-owned gunmaker, Kollitides left and became a partner at Alvarez & Marsal Capital, an offshoot of A&M consulting, whose co-founder also had long-standing business ties to Feinberg.

Some former business associates said they were not surprised that Kollitides jumped at the chance to rejoin Feinberg at the Pentagon. The two share a love for firearms and defense industry investments. They have also both described their work addressing the military’s most vexing supply chain issues as a patriotic calling.

“Americans need us at the Pentagon and our civilians and our contractors to do better,” Feinberg said last year. “We can’t fail, we can’t make excuses, we must succeed.”

On social media, Kollitides has shown the kind of partisanship long taboo in the Pentagon but now fostered in its ranks by Trump and Secretary of Defense Pete Hegseth. Kollitides has decried the “Democrat Party,” warned of the ills of socialism and posted that “the government cannot give to anybody anything that the government does not first take from somebody else.”

Over the last year, Feinberg has continued to heap responsibility on Kollitides: naming him his co-chief of staff and senior adviser; vice chairman of the Office of Strategic Capital’s investment committee; and director of two other new offices, the Economic Defense Unit and the Business Operators for National Defense, or BOND — the office with the $281 million no-bid contract.

His employment status allowing him to hold any of those roles at the Pentagon is somewhat of a mystery.

Unlike Feinberg, who was confirmed to his post by the Senate, Kollitides was reportedly first brought onto the federal government last year as a special government employee, or SGE, a designation that allows someone to work in government for no more than 130 days a year. Kollitides seemingly exceeded that cap several months ago.

But in the Pentagon’s email system, Kollitides’ name now carries an abbreviation signifying he has been designated an HQE, or highly qualified expert. His employment classification, which the Pentagon confirmed, is designed to hire people who bring “enlightened thinking and innovation” to Defense Department roles that can last up to six years.

That distinction brings a unique benefit for Kollitides. Financial disclosures filed by HQEs are generally confidential, while those of high-ranking SGEs are often subject to release once a person fills a government role for more than 60 days. It’s unclear if Pentagon ethics officials granted Kollitides a waiver to keep any disclosures confidential.

(ProPublica requested Kollitides’ financial disclosure forms in August, but the Pentagon has not yet responded.)

Kollitides’ continued tie to Alvarez & Marsal Capital surfaced in April in a securities filing by a second company with which the defense official was taking a leadership post.

Days after Feinberg named him the head of BOND, granting Kollitides deep visibility into weapons production rates of U.S. military contractors, Kollitides took a seat on the board of D. Boral Acquisition I, an offshore shell company whose affiliate D. Boral Capital has partnered with defense-related businesses. The Guardian and Bloomberg Government previously reported on the filing, and Bloomberg reported that Kollitides stepped down from the position at the end of September.

Kollitides’ biography in the filing described his current roles at the Pentagon, then added that “he is also a Senior Advisor” to Alvarez & Marsal Capital and that he previously was a partner and co-head of one the firm’s funds.

The A&M entity that Kollitides is described as still advising in the filing is essentially the private-equity partner of the sprawling Alvarez & Marsal firm that includes A&M Federal, which is now providing consulting services for his offices at the Pentagon.

Though the private-equity and consulting businesses are distinct, they work together, share back-office staff for human resources  and tech support, and have overlapping ownership, according to company documents. The private-equity arm describes itself as having a “strategic relationship” with the consulting side of A&M. The firm boosts its investment decision-making by working with the consulting firm’s thousands of employees around the globe to assess particular companies. And after the fund takes a stake in a company, it deploys the consulting arm’s employees to improve that firm’s operations and make the company more valuable.

In other words, the fund’s success hinges on the consulting firm’s.

Whether Kollitides violated government ethics rules hinges on details that he and the Pentagon have declined to provide.

A Defense Department official told ProPublica that Kollitides “does not and has never had” any investments or financial relations with A&M consulting. The official said Kollitides is also “recused on any conflicted matters related to A&M Capital,” which could be referring to Defense Department decisions related to companies A&M Capital has a financial stake in.

Ethics experts said that without a written waiver, executive branch officials are generally barred from participating in decisions, such as the awarding of a contract, that would have a direct impact on their financial interests. That law, the experts said, could apply even if the official doesn’t have a stake in a company but just draws a salary — the rationale being that they’ve improved the odds that the company will be able to continue paying them.

The Pentagon official did not answer specific questions about whether Kollitides was being compensated by A&M Capital when the contracts were signed, if he played any role in the contract decision-making process or if he sought or received an exemption to do so.

A “Blank Sheet of Paper” Contract

A&M’s first contract with the Pentagon was signed in December, months after Kollitides joined the government. That $67.6 million deal was awarded to Alvarez & Marsal Federal through a Defense Department entity focused on efforts to strengthen the nation’s industrial base.

The full scope of work that A&M provided is unclear. But documents reviewed by ProPublica show that by late last year, the firm had begun helping to vet possible loan deals for the Office of Strategic Capital, the lending unit then run in part by Kollitides.

Like that first contract, the larger, $281 million deal that followed to advise Kollitides’ BOND office came in the form of what is called an OTA, or other transaction agreement, which allows agencies to bypass regular federal contracting rules on public disclosure and oversight.

Congress first authorized the Defense Department to use the contracting method in the 1980s to fund breakthrough technologies without publicly disclosing much about the work. The Pentagon has increasingly turned to OTA contracts over the last decade to quickly fund a broader range of one-time costs, including prototype weapons and urgent production needs, even as government auditors have lamented OTAs as a “blank sheet of paper” arrangement with little oversight or accountability.

Still, experts said an OTA contract for consulting work was extraordinary. That’s because consulting is one of the simplest services the military can buy, and it has a long history of doing so through competitive bidding. Firms often publish the hourly costs for their associates, managers and other work before solicitations are posted.

But like black-box OTA contracts for secret weapons systems, the funding mechanism has hidden from public view details of what taxpayers are getting for the money.

The sheer size of the A&M contract stunned experts.

At $281,089,206.65, the consulting contract is among the largest OTAs funded through the Defense Department’s main support division in the last decade, including for top secret semiconductor projects and underwater drones, records show.

The Pentagon has said little about the impact of BOND since Hegseth claimed in February that the new entity would revolutionize military purchasing.

The defense secretary said that under the program, the military would embed former corporate executives, or, as he put it, “elite, private-sector patriots” to help optimize and accelerate the manufacturing of critical munitions. Hegseth said he thought the exercise would help the Pentagon increase resiliency in supply chains. The “era of managed decline is over,” he said.

In private recruitment materials for those executives, as well as for candidates to fill posts in other Kollitides-run units, the stakes and the mission for BOND were described in even starker terms: Neoliberalism and trade deals have left the U.S. as a country that “can no longer manufacture ships, munitions or planes in a timely manner.”

The recruiting materials cast the job of fixing that systemic problem as part-time work: “Recently retired Fortune 100 executives spend five days per month solving public- and private-sector operational challenges,” read pages viewed by ProPublica.

Two people familiar with A&M’s work for BOND said the firm’s consultants have accompanied former executives on trips to review work at major defense contractors such as Lockheed, Boeing, RTX and BAE Systems. BAE acknowledged a visit by BOND representatives but declined to comment further. Lockheed, Boeing, RTX and other companies contacted by ProPublica did not respond to requests for comment.

Contracting experts said that A&M is likely not guaranteed the full amount, and that contracts like these typically span several years, but records show A&M has already been paid about $31 million.

Not everyone, however, is welcome to participate.

One former military officer who worked in the defense industry told ProPublica he was contacted by an outside recruiter for Kollitides’ new BOND office. The recruiter, he said, told him that all applicants would be asked who they voted for.

The former military officer, who spoke on the condition of anonymity because he feared retribution, said he expressed discomfort with that line of questioning. He received an email shortly after from the recruiter telling him he was no longer under consideration. The Pentagon did not respond to a question about the officer’s account.

“Getting more effective and efficient is not a political question,” the former officer said.

The post The Pentagon Gave $350 Million in Contracts to a Firm Closely Tied to a Senior Defense Department Official appeared first on ProPublica.

Those closest to executives must match their security postures because the weakest link in a family can become the entry point for attacks.

Salut,

Je cherche, pour un usage personnel, une solution pour enregistrer des données au fur et à mesure.

Je sais qu’il existe des applications pour enregistrer et suivre ses données de santé (poids, rythme cardiaque,…) et d’autres pour sa consommation de boissons (eau, alcool, café…), etc.

Mais je ne trouve pas d’application qui permette d’enregistrer et suivre toute forme de donnée de son choix.

La solution que j’imagine pourrait, par exemple, remplir ce « cahier des charges »:

1. Configuration: définir soi-même les champs que l’on souhaite renseigner (par exemple: humidité de l’air, température ambiante, pression des pneus, compteur d’eau,…) et définir quel type de variable correspond à tel ou tel champ (binaire, entier, décimal, texte,…) et, éventuellement, son unité (%, m³, €, L,…)
2. Utilisation normale: saisir à tout instant une valeur pour un champ choisi, avec horodatation (par défaut: jour et heure actuels avec possibilité de changer), ces informations étant enregistrées dans une base de données (localement, dans l’idéal), avec conditions de validité (pour limiter les erreurs de saisie, par exemple: une valeur comprise entre -20 et +100)
3. Exploitation des résultats: extraire les informations vers une feuille de calcul (LibreOffice Calc ou équivalent) pour faire des analyses et, dans l’idéal absolu: pouvoir importer des données dans la base, pouvoir paramétrer des graphiques issus des données collectées, directement depuis l’application…

Dans l’idée, en utilisation normale, depuis mon smartphone, j’ouvre l’application, je sélectionne le nom de la variable que je souhaite saisir, je saisis la valeur (avec fenêtre de validation de la date et de l’heure) puis je valide.

Ensuite, lorsque je veux analyser tout cela, je peux exporter les infos pour faire une analyse sur mon ordinateur.

Cette application pourrait servir à suivre:

• la consommation de carburant de véhicules (volume de carburant, prix, kilométrage, vitesse moyenne…)
• la consommation électrique du logement (kWh en heures pleines, heures creuses,…)
• la température et l’humidité du logement (température en °C/°F, l’humidité en %,…)
• habitudes (heure des repas, temps de sommeil,…)
• données de santé
• etc.

Avez-vous des suggestions ?

A titre de « benchmark », j’ai repéré les applications suivantes, sur le magasin F-Droid:

• OpenOdo
• Blood Pressure Monitor

J’imagine que je peux faire un sondage framaform pour chacune des variables que je souhaite enregistrer mais cela va être lourd à gérer.

Si tout pouvait se trouver au même endroit, ce serait top !

Merci d’avoir lu ma demande et merci d’avance pour vos suggestions ou pistes de recherche !

Pour info, je poste aussi ce message sur le forum F-Droid, au cas où…

3 messages - 2 participant(e)s

Lire le sujet en entier

IBM ha pubblicato aggiornamenti di sicurezza per risolvere 22 vulnerabilità, di cui 5 con gravità "critica" e 5 con gravità "alta", nei prodotti Security Verify Access e Verify Identity Access.

Rilasciati aggiornamenti di sicurezza che sanano molteplici vulnerabilità, di cui 18 con gravità "alta" in Dell Secure Connect Gateway (SCG) Policy Manager, soluzione per la gestione delle autorizzazioni relative agli accessi remoti, all’esecuzione di script e ai trasferimenti di file effettuati tramite Secure Connect Gateway, nonché per la registrazione delle relative attività di audit.

As AI agents gain authority over business systems, attackers can manipulate them like business email compromise (BEC) victims.

In the summer of 2023, after he was impeached on charges of abusing his office for personal gain, Texas Attorney General Ken Paxton was suspended and barred from conducting any official business for more than three months while awaiting trial in the state Senate.

So, he traveled.

Paxton, a Republican who is now running for U.S. Senate, took at least 17 trips over three months, including to resort destinations Park City, Utah, and Vail, Colorado. He visited the Oklahoma town where he owns a vacation lodge and a Utah community with a golf resort, where he later bought four condominiums.

State police joined him each time, costing taxpayers tens of thousands of dollars for trips unrelated to his job as attorney general. The Texas Senate ultimately acquitted him on the impeachment charges.

But Paxton’s use of the taxpayer-funded detail did not begin or end there. In fact, it stands out compared with his predecessor, fellow elected officials in Texas and other state attorneys general, ProPublica and The Texas Tribune found.

Paxton has traveled frequently out of state while listing little on his official calendar, The Associated Press reported last week. ProPublica and the Tribune’s analysis, which included reviewing every publicly available document Paxton’s office says it possesses about his travel, discloses for the first time how few of his trips had a listed business purpose: just 1 in 6.

It also found Paxton’s security has cost taxpayers far more than has previously been reported.

Since assuming office in 2015, Paxton has taken nearly 1,000 trips with a state-funded security detail, costing $3.3 million. The newsrooms’ review of Paxton’s travel records, obtained through the state’s Public Information Act, could only connect 138 of those trips and $553,000 in security costs to state business.

Records detailing the purpose of Paxton’s visits to 36 states and 19 countries do not appear to exist in most cases. These include a trip to a small town in Hawaii months before his family’s blind trust bought land there; 24 trips to Utah, where the trust owns five properties; and 53 trips to Florida, where Paxton and the trust have two houses and a townhome.

“If you’ve got all these extra trips, it becomes ethically and morally problematic,” said Chris Toth, former executive director of the National Association of Attorneys General, who has also criticized Paxton’s conduct on other issues. “The ethical question is whether a legitimate security function has effectively become a taxpayer-funded subsidy.”

Texas law allows the Department of Public Safety to provide security for key state leaders, including the attorney general, but does not require officials to use it. In fact, Paxton himself hasn’t used it in at least two dozen cases while traveling on official business.

Paxton has dismissed opponents’ attacks that he has used the perks of office to benefit himself and has not answered questions about how he vastly increased his wealth as a public servant.

He also did not answer detailed questions for this story. ProPublica and the Tribune sent Paxton a spreadsheet detailing travel for which there was no record that he was on state business and asked him to provide additional information if the trips were not personal. Neither Paxton nor his office provided such records. Instead, his office provided a general statement.

“Throughout his career, Ken Paxton has faced numerous security threats stemming from his courageous work as Attorney General fighting on behalf of the people of Texas,” his office said in the statement. “Those threats are a direct result of him taking on the cartels terrorizing Texans and some of the nation’s most dangerous violent criminals.”

Paxton’s office directed additional questions to DPS.

A DPS spokesperson declined to answer the newsrooms’ questions, saying the agency does not comment on its security arrangements.

An Outlier Among Peers

To analyze Paxton’s travel, ProPublica and the Tribune reviewed DPS logs for his security detail and records from the attorney general’s office, including airfare and lodging receipts, per diems and his daily calendars.

The records available for his predecessor, Greg Abbott, show a stark difference: Abbott traveled mostly within the state as attorney general, and his security cost $203,000 during his last three years in the office. Adjusted for inflation, Abbott’s security detail cost $7,400 per month. Paxton’s has averaged $24,300.

Because the state keeps records only for a limited time, Abbott’s travel expenses and his daily calendars as attorney general no longer exist, so the news organizations could not determine how many of his trips were for business.

Records are available, however, for Abbott’s security costs as governor and for Lt. Gov. Dan Patrick. Both are also offered state police security and have been in their current roles as long as Paxton.

When compared, the records show Paxton has taken 82 more out-of-state trips with a security detail than Abbott and nearly as many as the governor and lieutenant governor combined.

Though DPS security detail records are available for state leaders’ full tenure, Abbott’s office only provided calendars that document business-related activity for his first six years in office. More than two-thirds of the governor’s international trips during those years had a listed business purpose, compared with just two of 25 for Paxton during his full tenure. The governor’s office said it planned to release the remaining five years on Tuesday but only provided five months, saying it needed more time.

The attorney general’s records do not show a business purpose for travel to Albania, Aruba, Australia, Costa Rica, the Czech Republic, the Dominican Republic, England, Estonia, Finland, Greece, Hungary, Italy, Malta, Mexico, Poland, South Africa or Taiwan.

The share of Paxton’s travel with a documented business purpose peaked early in his tenure, in 2018 and 2019, at 30%, the newsrooms’ analysis found. That aligns with the governor’s share of business travel during that period.

Since then, Paxton has taken fewer trips that are documented as state business while increasingly traveling out of state. Last year, just five of Paxton’s 91 trips with the security detail had a listed business purpose. Forty-one were outside Texas.

In some cases, Paxton has taken business trips without a DPS detail, an analysis of records from the department and the attorney general’s office shows. They include a 2019 meeting in Nashville, Tennessee, with that state’s attorney general to discuss opioid litigation and a 2021 visit with unnamed U.S. senators in North Carolina. There is also no record of Paxton taking the detail on political fundraising trips to Florida and the Bahamas.

But Paxton has traveled with security to other campaign-related activities, including one that came just two days after he was acquitted in the impeachment trial. Paxton boarded a Maine-bound private plane owned by a North Texas businessman to tape an episode of Tucker Carlson’s show, according to campaign finance records. During the interview, he hinted that he’d challenge U.S. Sen. John Cornyn in the 2026 Republican primary.

“Everything is on the table for me,” Paxton said when Carlson suggested he should run.

In his interview with Carlson, Paxton said it was unfair that he was automatically suspended before he could clear his name. He said he was eager to get back to work and that he was “reenergized to do the things the voters sent me to do.”

Paxton should pay for his own security on trips where there is no benefit for Texans, like vacations and campaign events, said Richard Briffault, a professor at Columbia Law School who has written about government ethics.

“There’s no reason for the taxpayers to be paying for things that they would not be paying for if he had stayed home,” Briffault said. “That’s a misuse of public funds.”

State officials said there are no records of Paxton or his campaign reimbursing Texas for security costs.

Of the 10 most populous states, Texas and New York confirmed that they provide security for their attorneys general, while Florida law allows its top lawyer to receive a detail upon request. North Carolina does not. Attorneys general offices for the remaining six states did not respond to requests for comment.

Former Oregon Attorney General Ellen Rosenblum said she never used a security detail during her 12 years in office, which ended in 2024. The Democrat said that Paxton’s higher profile might create a greater need for protection, but his extensive out-of-state travel without a documented business purpose raises questions about his workload.

“Was he minding the store? There’s a lot of work to be done at the office,” Rosenblum said.

Travel and Real Estate

Some of Paxton’s travel to four states with a security detail has overlapped with locations where he or his family’s trust has purchased 10 properties since 2021. A recent ProPublica and Tribune analysis found he owns or co-owns 15 properties with a market value of about $11 million.

In June 2021, Paxton attended an attorneys general conference in Maui. The security detail listed the destination as Lahaina, a small community on the Hawaiian island’s west coast. Four months later, Paxton’s family trust purchased an oceanview lot in a residential neighborhood there for $410,000, land records show.

The 7,000-square-foot lot remains vacant but has proved to be a savvy investment, now assessed at $1.2 million by Maui County.

Paxton set up the trust with his estranged wife, State Sen. Angela Paxton, who declined to be interviewed but said through a spokesperson that she has not been involved in her husband’s business dealings since 2024, when she filed for divorce. The Paxtons’ friend, Chip Loper, runs the trust. He did not respond to requests for comment.

Paxton has also gone to the Salt Lake City area 19 times, twice for listed business purposes. He visited three times — once on business — in the months leading up to his family trust’s July 2021 purchase of a plot in the ski town of Eden. The trust bought a mountainside lot on about two-thirds of an acre for $315,000 in cash, the seller told the newsrooms. It also remains undeveloped.

During his suspension in August 2023, Paxton visited St. George, Utah, a small city in the state’s southwest corner. Nearby is the Black Desert Resort, which hosts an annual PGA Tour golf tournament. Paxton purchased one condo at the resort in 2025 and three more in February. Paxton took out mortgages totaling $1.9 million for them, according to legal documents filed with the local county.

Paxton has visited Florida more than any other state, 53 times. Two of those trips have a documented business purpose. Between 2021 and 2022, Paxton purchased two homes in Ocala, known for its horse breeding industry, and a townhome in Dunedin, on the Gulf of Mexico near Tampa.

Paxton also traveled with the detail twice to Broken Bow, Oklahoma, where he purchased a $1.5 million vacation lodge in 2022. He visited in June 2023, during his suspension. Then again the following December. He traveled to the neighboring town of Idabel in 2023 and 2024. None of the trips had a listed business purpose.

Records that show travel with a security detail do not list the attorney general’s name but rather the position. State officials familiar with the travel records said the two temporary attorneys general appointed during Paxton’s suspension did not take the trips listed on the state police travel logs.

The attorney general’s office has said that Paxton’s work to secure large legal settlements with drugmakers and tech companies requires routine travel. Such travel is noted in calendars reviewed by ProPublica and the Tribune. Even so, more than 800 trips lack a documented business purpose.

Paul Nolette, a Marquette University political science professor who studies attorneys general, said that the role has become more expansive in recent years as states increasingly collaborate on big lawsuits. That could lead to more travel, he said. Nolette added these officials deserve occasional vacations like everyday Americans.

But given repeated accusations from Democrats and Republicans alike about Paxton’s ethics, Nolette said it is difficult to give him the benefit of the doubt that he’s constantly working while leaving the state so frequently.

“It just raises more red flags about how he’s using the office to do things that may not give the best bang for the buck for Texans,” Nolette said.

Paxton has not commented publicly about his use of the taxpayer-funded detail. During a podcast interview in November, Houston lawyer Tony Buzbee, who led his impeachment defense, asked the attorney general where he liked to travel.

“I love Jackson Hole. I like Park City. I like the mountains. I also like beaches,” Paxton responded. “I like places in Florida, places in California, even though I don’t like to admit I go to California. But it’s beautiful to see them.”

The post Ken Paxton’s Security for Travel Cost Taxpayers Millions. Just 1 in 6 of His Trips Had a Stated Business Purpose. appeared first on ProPublica.

A decade ago, nonprofit leaders in Arizona’s most populous county boasted that they had created the Amazon of homeless service systems. Families in crisis would no longer have to contact a dozen agencies in search of shelter or housing. A single system could point them to help.

But for all the hype, this system has become a dead end for many families. A 2023 evaluation found 94% of people who were assessed for housing help by the system didn’t receive it. And that didn’t account for parents who were unable to connect with a worker to see if they qualified for assistance.

Families say it hasn’t improved.

In interviews, 30 families that are homeless told ProPublica that calling the hotline, meeting with outreach workers or showing up at shelters rarely results in offers of help. Some families said they called 211 multiple times without being connected to the homeless response system for families, known as the Family Housing Hub. Others, who said they were sleeping in cars or outdoors, said they couldn’t get a spot on the waitlist for shelter.

The system has returned to what it was a decade ago, with families calling as many shelters as they can, repeating the very situation the hub was intended to fix.

Those who did make it onto the hub’s waitlist said they were left guessing how long it would take to get help. Some said operators told them to sleep in their cars.

Vanessa Lopez said she experienced this frustration after leaving a hostile relationship in the spring. While she and her two children stayed with a friend, Lopez said she repeatedly contacted 211, which functions as a referral service for the hub, hoping it would lead to shelter for her family.

Her friend eventually asked them to leave. Overwhelmed by the stress of not knowing where to take her family, Lopez took a leave from her job. By then, she said, she’d called 211 at least five times.

Yet no matter how dire her situation became, it still took months to get on the waitlist for shelter. During one call she said she broke down in tears, frustrated that others seemed to get help but she could not. She wondered if she needed to be addicted to drugs to receive assistance.

“It’s not me telling you no,” she said the operator told her. “It’s the system.”

Monique Lopez, the CEO of United Methodist Outreach Ministries, known as UMOM, which runs the Family Housing Hub and the shelter waitlist, acknowledged the frustrations of people like Vanessa Lopez (no relation). But before UMOM offers callers shelter or a spot on the waitlist, the organization first tries to help them find other options.

“We don’t start the conversation with, ‘Hey, do you want to get on the shelter waitlist?’” Monique Lopez said. “It really is ‘Let’s try to figure your situation out first.’”

Lopez attributed some frustrations to the number of organizations offering assistance through the hub. Each shelter has its own rules, and some families may not meet the requirements of every program.

To address the confusion, UMOM updated its website to provide more information about the homeless response system for families, she said. The federally funded system, known as Coordinated Entry, mandates that providers use an assessment to prioritize scarce housing.

“It’s not me telling you no. It’s the system.”

211 operator

But families told ProPublica that the process in Maricopa County often leaves them confused and hopeless. Family homelessness in the county has risen to its highest level in more than a decade, while every shelter is full and housing vouchers are scarce. In 2025, there were 630 units of shelter and transitional housing for families in the county, down from 769 the year before, according to the most recent federal data.

Monique Lopez acknowledged that family shelters are full, leaving few good options. “People are living in unsafe and unstable situations while waiting just to get into emergency shelter,” she said.

The process, experts said, shouldn’t leave people wondering if there is help and what it takes to get it.

“You have to have some kind of method for setting priorities when there aren’t enough resources to go around,” said Marybeth Shinn, an expert on family homelessness at Vanderbilt University. “The process should be transparent. People should know if they’re on a waitlist.”

---

UMOM and other Maricopa County nonprofits launched the Family Housing Hub in 2014, after years of planning and strategizing over how to end family homelessness in the county that is home to Phoenix. As they envisioned it, families would meet with a worker at UMOM who could match them with the best solution for their situation.

At the time, there was a national push to create these local systems. The U.S. Department of Housing and Urban Development in 2012 asked communities to establish a Coordinated Entry system. By 2018, the agency required it in order to receive housing and homelessness grants. The mandates coincided with a Barack Obama-era plan to end family homelessness by 2020. (That did not happen.)

Experts said the systems were set up without evidence they would be effective. When researchers did look at Coordinated Entry — in a 2021 study of single adults — they found issues similar to those now faced by families in Maricopa County, including concerns about fairness and a lack of transparency. People didn’t understand the screening process and generally received vague explanations about how their information would be used to decide if they would get help.

As Maricopa County nonprofit leaders developed their system for families, they also pledged to provide a “rapid response without waiting lists” to immediately meet the needs of any family asking for help.

The county saw a decline in family homelessness from 2015 to 2019. But then the numbers began to rise, even as the stock of emergency shelter increased. During the COVID-19 pandemic, efforts to address the problem began to fray. The group of nonprofit leaders, which called itself “Standing Strong for Families,” stopped meeting regularly. Arizona, along with other Sun Belt states, also saw an increase in housing prices. With one of the lowest supplies of housing for low-income people in the country, eviction filings began to soar.

By 2023, only 6% of families that were assessed by Maricopa County’s homeless response system received help with permanent housing, according to an analysis of three years of enrollment data from the system and interviews with providers and people who had sought housing assistance.

The evaluation, by Homebase, a nonprofit consulting group, was requested and paid for by the Maricopa Association of Governments, which provides staffing for the regional response to homelessness.

Homebase concluded the system for single adults who are homeless was accessible, but the family system was not. Across the system, auditors said, families encountered a “breakdown in communication” and a “lack of transparency.”

Ashley Oakley, UMOM’s chief development officer, said in a statement that the evaluation reflects a gap between the need in the community and the housing that’s available. Oakley called it “one of the biggest challenges” facing those who are working on family homelessness in Maricopa County.

To decide who gets onto the housing list, workers with the Family Housing Hub conduct an assessment of vulnerability, which assigns a score based on how long a person has been homeless and whether they have a disability. That score helps determine eligibility and priority for housing programs, Oakley said.

Nonprofit leaders recently developed a new evaluation. Before it was implemented over the summer, testing had showed it didn’t fully account for the vulnerabilities of families and needed more changes. Now, for example, households with children under 6 receive a higher score, making it more likely they can get help.

Any family sleeping in a place not meant for “habitation” or in a dangerous situation is eligible for shelter, said UMOM’s Oakley. To remain on the shelter waitlist, families must check in weekly and say where they slept the previous night. Staying in a hotel for a night should not “by itself” remove a family from the waitlist, Oakley said.

But families told ProPublica that they had been removed from the waitlist because they stayed in a hotel. (UMOM said it is reviewing its process to make sure check-ins are handled “consistently.”)

Families in dire situations may not get help, said Richard Southee, a regional executive director at Central Arizona Shelter Services, the largest shelter provider in Arizona. Southee also works on a committee that oversees Maricopa County’s response to homelessness.

That’s in part because the federal government has focused funding on more noticeable forms of homelessness, such as people living in encampments. Homeless families are typically less visible and move more frequently. They couch surf, stay in hotels or do other things to avoid drawing the attention of the Arizona Department of Child Safety. Child welfare officials sometimes consider a lack of shelter to be evidence of child neglect, along with other factors.

“We’re deciding who’s going to be at the back of the line, and we as a nation really have said people who are not chronically homeless are going to be at the back of the line,” Southee said. “You have to stay homeless to get to the front, and that’s a design choice.”

Felicia Vela and her two children were kicked out of a guest house they were renting in February, text messages from that time show. She said she searched online for help and was repeatedly directed to 211 for “emergency shelter,” which she called at least twice and explained her situation: She had stashed her belongings in a storage unit, text messages show, and was staying at a hotel that she couldn’t afford for much longer.

There was nothing immediately available, she said operators told her, with one saying the waitlist was closed and the other telling her it could take six months to a year to get shelter. (UMOM said to protect the privacy of clients, it does not comment on individual families. The organization also said that the waitlist does not close.)

When Vela didn’t have anywhere to go, she slept in her car while her children stayed with a friend. She tried to make extra money by donating plasma, but her blood pressure was too high.

Vela, who works a warehouse job, moved into an apartment with the help of a local nonprofit that is not associated with the hub, but she’s now fallen behind on rent and is facing eviction. Her car broke down, and she can’t get to work. She started calling 211 again, seeking rental assistance.

“It’s like I can’t get a break,” she said.

---

Every January, volunteers in cities across the country spend one night trying to count people who are homeless. In Maricopa County, the 2026 count showed the number of people in homeless families, at 2,103, was the highest it had been since 2015. The survey is considered an undercount, especially for families.

Over the summer, the waitlist for shelter ballooned to more than 200 families. It takes about seven weeks for those on the list to get shelter, according to UMOM.

Some families interviewed by ProPublica said they waited longer. And more people are entering the system than leaving it, delaying help for newly homeless families.

In Maricopa County, 139 units of shelter for families closed from 2024 to 2025, after COVID-19 pandemic relief funds expired. The state also cut $867,000 in funding to help families get into housing quickly. It had helped about 40 families.

As families wait, they have searched for other ways to access the homeless service system.

Some go to one of the city of Phoenix’s heat relief centers, inside a 21,000-square-foot former charter school. City officials said the number of families seeking help has doubled from a year ago. Some families said they were able to immediately get shelter through the workers there.

After city officials learned a local advocate, Austin Davis, was sending families to the center to receive shelter, he said they asked him to stop sending families.

Davis runs a local nonprofit that helps families like Vela’s find emergency shelter. He said his interactions with hundreds of families over the past year have shown the official channels to shelter are “too complicated.” Calling weekly to stay on the waitlist is time-consuming. The families are already managing day-to-day responsibilities while trying to resolve an overwhelming personal crisis, he said.

“The system is really designed to run people in circles until they either give up or hit enough roadblocks where they can’t continue,” Davis said.

Davis crowdsources donations to put the families in hotel rooms on and off for days, weeks or sometimes months.

Ebony, a single mother of six who has breast cancer, needed longer-term help. She lost her job as a security guard this year after a chemotherapy treatment caused her to faint as she was about to begin her shift, she said.

In April, she lost her apartment. Ebony, who asked that her last name not be used to protect future job opportunities, said she called every number she could find looking for help, including 211. Eventually she was placed on the waitlist, but that didn’t solve her immediate problem of where to sleep.

She and her children stayed in hotel rooms until she ran out of cash. Then, she said, the family slept in an alley.

If a mother with breast cancer and young children sleeping outside was not vulnerable enough to get help, she wondered, who was?

The next day, she connected with Davis, who helped her pay for weeks of shelter. Then one morning she texted Davis with some good news.

She had met a pastor who helped her get into a local housing program. But she needed help for a few more days, until she could move into her new apartment.

The post An Arizona County’s “Housing Hub” Is a Dead End for Many Homeless Families appeared first on ProPublica.

Last year, many of America’s largest health insurers vowed to reduce their use of prior authorization — the extra layer of approval insurers require before covering a medical expense. The industry’s pledge came after massive backlash to the process from patients, providers and politicians. ProPublica’s reporting has found it can delay or outright deny patients’ critical medical care.

Data as of last year shows the industry is still relying heavily on the approval process. Now, ProPublica is looking into the ways that insurers’ continued use of prior authorization is impacting patients. We need your help to figure out if prior authorization is still leading to delayed or missed treatments, tests, medical equipment or medication.

If you are covered by a plan through Medicaid, Medicare, Children’s Health Insurance Program, or the Affordable Care Act marketplace — and have had a prior authorization request delayed or denied — we want to hear from you. Your experiences help us better understand the real-life stakes of prior authorization. (For this investigation, we’re not seeking responses from people with insurance through their employer at this time.)

We’re also interested in hearing from people whose jobs provide insight into the inner workings of prior authorization, including medical providers and their staff, along with insurance company employees and regulators.

Our team may not be able to respond to everyone personally, but we will read everything you submit. We appreciate you sharing your story, and we take your privacy seriously. We are gathering these stories for the purposes of our reporting and will contact you if we wish to publish any part of your story. We will not publish anything you send us without asking for additional consent.

The post We’re Investigating Prior Authorization. Help ProPublica Understand Your Health Insurance Denial. appeared first on ProPublica.

L'articolo Chi protegge i nostri pagamenti? proviene da Guerre di Rete.

Il rischio di un malware preinstallato in Android è una minaccia sempre più concreta e purtroppo sottovalutata. Immagina di acquistare uno smartphone nuovo, scartarlo con entusiasmo e scoprire che è già compromesso, ancora prima di installare la tua prima app. Sembra uno scenario da film, ma è esattamente ciò che accade con minacce come il recente "Midnight Mimosa". Si tratta di una scoperta allarmante che mette in discussione la sicurezza dei dispositivi fin dal loro primo avvio.

Ma come è possibile una cosa del genere? E, soprattutto, come puoi proteggerti da un nemico che si nasconde dove non penseresti mai di guardare? Scopriamolo insieme.

Cos'è "Midnight Mimosa" e come funziona?

"Midnight Mimosa" non è una semplice app malevola che scarichi per errore. È molto peggio. Si tratta di un codice dannoso inserito direttamente nel firmware del telefono, ovvero nel software di base che governa il dispositivo. Questo significa che il malware è già presente e in attesa non appena accendi lo smartphone per la prima volta.

Una volta attivo, questo tipo di software può compiere diverse azioni a tua insaputa:

• Installare altre app indesiderate come adware o spyware.
• Mostrare pubblicità invasive e continue.
• Raccogliere i tuoi dati personali per inviarli a server remoti.
• Prendere il controllo di alcune funzioni del dispositivo.

La sua natura preinstallata lo rende estremamente pericoloso, perché aggira tutte le comuni difese, inclusi i controlli di sicurezza del Google Play Store.

Il malware preinstallato in Android: dov'è la falla?

Forse ti stai chiedendo come un malware possa finire su un telefono nuovo. La risposta è tanto semplice quanto preoccupante: la compromissione avviene lungo la catena di produzione.

Per ridurre i costi, i produttori di dispositivi low-cost si affidano talvolta a fornitori terzi per il software. È in questa fase che dei malintenzionati possono inserire il codice dannoso nel firmware. Questo meccanismo rende la minaccia quasi invisibile.

Non è colpa tua: non hai cliccato su link sospetti né scaricato file strani. Il pericolo era già integrato nel dispositivo che hai acquistato in buona fede.

Come riconoscere un malware preinstallato in Android

Identificare un malware che si nasconde così in profondità è difficile, ma non impossibile. Esistono alcuni campanelli d'allarme che dovrebbero farti sospettare.

Presta attenzione se il tuo nuovo dispositivo manifesta questi comportamenti anomali:

• Consumo anomalo della batteria: la batteria si scarica molto più velocemente del previsto senza un motivo apparente.
• Rallentamenti improvvisi: il telefono appare lento e poco reattivo fin dai primi utilizzi.
• App sconosciute: trovi applicazioni installate che sei sicuro di non aver mai scaricato.
• Pubblicità invasiva: annunci pubblicitari compaiono all'improvviso, anche fuori dalle app.
• Traffico dati inspiegabile: il consumo di dati mobili è più alto del normale, segno di comunicazioni in background.

Come difendersi da questa minaccia silenziosa

Proteggersi completamente è complesso, ma puoi adottare alcune strategie per ridurre drasticamente il rischio. La prevenzione, come sempre, è l'arma più efficace.

Scegli marchi affidabili

I grandi produttori come Samsung, Google o Xiaomi hanno controlli di sicurezza molto più rigorosi. Il rischio è più alto su dispositivi ultra-economici o di marche sconosciute, spesso acquistati da canali non ufficiali.

Affidarsi a un brand noto è il primo passo per una maggiore tranquillità.

Aggiorna sempre il sistema operativo

Non appena ricevi una notifica di aggiornamento, installala. Gli aggiornamenti di sicurezza rilasciati da Google e dai produttori contengono spesso patch che neutralizzano queste vulnerabilità. Un dispositivo non aggiornato è un dispositivo molto più esposto ai rischi.

Sicurezza contro il malware preinstallato in Android

Anche se un antivirus non può rimuovere il malware dal firmware, può bloccarne le azioni successive. Una buona app di sicurezza identifica e blocca le app dannose che il malware tenta di installare, fornendo un livello di protezione aggiuntivo che fa la differenza.

Se sospetti un'infezione, il reset di fabbrica potrebbe non bastare. La soluzione più efficace è installare una ROM pulita e ufficiale, una procedura però consigliata solo agli utenti più esperti. Per tutti gli altri, contattare l'assistenza del produttore è la scelta più saggia.

L'articolo Malware preinstallato in Android: il tuo nuovo telefono è già infetto? proviene da sicurezza.net.