ESO Telescope Sees Star Dance Around Supermassive Black Hole, Proves Einstein’s Theory of Relativity

Observations made with ESO’s Very Large Telescope (VLT) have revealed for the first time that a star orbiting the supermassive black hole at the centre of the Milky Way moves just as predicted by Einstein’s general theory of relativity. Its orbit is shaped like a rosette and not like an ellipse as predicted by Newton’s theory of gravity. This long-sought-after result was made possible by increasingly precise measurements over nearly 30 years, which have enabled scientists to unlock the mysteries of the behemoth lurking at the heart of our galaxy.

Einstein’s General Relativity predicts that bound orbits of one object around another are not closed, as in Newtonian Gravity, but precess forwards in the plane of motion. This famous effect — first seen in the orbit of the planet Mercury around the Sun — was the first evidence in favour of General Relativity. One hundred years later we have now detected the same effect in the motion of a star orbiting the compact radio source Sagittarius A* at the centre of the Milky Way. This observational breakthrough strengthens the evidence that Sagittarius A* must be a supermassive black hole of 4 million times the mass of the Sun,” says Reinhard Genzel, Director at the Max Planck Institute for Extraterrestrial Physics (MPE) in Garching, Germany and the architect of the 30-year-long programme that led to this result.

Located 26 000 light-years from the Sun, Sagittarius A* and the dense cluster of stars around it provide a unique laboratory for testing physics in an otherwise unexplored and extreme regime of gravity. One of these stars, S2, sweeps in towards the supermassive black hole to a closest distance less than 20 billion kilometres (one hundred and twenty times the distance between the Sun and Earth), making it one of the closest stars ever found in orbit around the massive giant. At its closest approach to the black hole, S2 is hurtling through space at almost three percent of the speed of light, completing an orbit once every 16 years. “After following the star in its orbit for over two and a half decades, our exquisite measurements robustly detect S2’s Schwarzschild precession in its path around Sagittarius A*,” says Stefan Gillessen of the MPE, who led the analysis of the measurements published today in the journal Astronomy & Astrophysics.

Most stars and planets have a non-circular orbit and therefore move closer to and further away from the object they are rotating around. S2’s orbit precesses, meaning that the location of its closest point to the supermassive black hole changes with each turn, such that the next orbit is rotated with regard to the previous one, creating a rosette shape. General Relativity provides a precise prediction of how much its orbit changes and the latest measurements from this research exactly match the theory. This effect, known as Schwarzschild precession, had never before been measured for a star around a supermassive black hole.

The study with ESO’s VLT also helps scientists learn more about the vicinity of the supermassive black hole at the centre of our galaxy. “Because the S2 measurements follow General Relativity so well, we can set stringent limits on how much invisible material, such as distributed dark matter or possible smaller black holes, is present around Sagittarius A*. This is of great interest for understanding the formation and evolution of supermassive black holes,” say Guy Perrin and Karine Perraut, the French lead scientists of the project.

Source: ESO Telescope Sees Star Dance Around Supermassive Black Hole, Proves Einstein Right | ESO

India says ‘Zoom is a not a safe platform’ and bans government users

India has effectively banned videoconferencing service Zoom for government users and repeated warnings that consumers need to be careful when using the tool.

The nation’s Cyber Coordination Centre has issued advice (PDF) titled “Advisory on Secure use of Zoom meeting platform by private individuals (not for use by government offices/officials for official purpose)”.

The document refers to past advisories that offered advice on how to use Zoom securely and warned that Zoom has weak authentication methods. Neither of those notifications mentioned policy about government use of the tool, meaning the new document is a significant change in position!

The document is otherwise a comprehensive-if-dull guide to using Zoom securely.

[…]

Source: India says ‘Zoom is a not a safe platform’ and bans government users • The Register

The secret behind “unkillable” Android backdoor called xHelper has been revealed

In February, a researcher detailed a widely circulating Android backdoor that’s so pernicious that it survives factory resets, a trait that makes the malware impossible to remove without taking unusual measures.

The analysis found that the unusual persistence was the result of rogue folders containing a trojan installer, neither of which was removed by a reset. The trojan dropper would then reinstall the backdoor in the event of a reset. Despite those insights, the researcher still didn’t know precisely how that happened. Now, a different researcher has filled in the missing pieces. More about that later. First, a brief summary of xHelper.

[…]

Once installed, xHelper installs a backdoor that remotely installs apps downloaded from an attacker-controlled server. It also executes commands as a superuser, a powerful privilege setting that gives the malware unfettered system rights.

[…]

Last week, Kaspersky Lab researcher Igor Golovin published a post that filled in some of the gaps. The reinfections, he said, were the result of files that were downloaded and installed by a notorious trojan known as Triada, which ran once the xHelper app was installed. Triada roots the devices and then uses its powerful system rights to install a series of malicious files directly into the system partition. It does this by remounting the system partition in write mode. To make the files even more persistent, Triada gives them an immutable attribute, which prevents deleting, even by superusers. (Interestingly, the attribute can be deleted using the chattr command.)

A file named install-recovery.sh makes calls to files added to the /system/xbin folder. That allows the malware to run each time the device is rebooted. The result is what Golovin described as an “unkillable” infection that has extraordinary control over a device.

[…]

The researcher initially thought that it might be possible to remove xHelper by remounting the system partition in write mode to delete the malicious files stored there. He eventually abandoned that theory.

“Triada’s creators also contemplated this question, and duly applied another protection technique that involved modifying the system library /system/lib/libc.so,” Golovin explained. “This library contains common code used by almost all executable files on the device. Triada substitutes its own code for the mount function (used to mount file systems) in libc, thereby preventing the user from mounting the /system partition in write mode.”

Fortunately, the reinfection method divined in last week’s report works only on devices running older Android versions with known rooting vulnerabilities. Golovin, however, held out the possibility that, in some cases, xHelper may maintain persistence through malicious files that come preinstalled on phones or tablets.

People can disinfect devices by using their recovery mode, when available, to replace the infected libc.so file with the legitimate one included with the original firmware. Users can then either remove all malware from the system partition or, simpler still, reflash the device.

Source: The secret behind “unkillable” Android backdoor called xHelper has been revealed | Ars Technica

ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale

ICANN has been accused by its founding CEO and original chair of abandoning the organization’s core principles and accepting commitments it knows it cannot enforce in order to push through the sale of the .org registry later this week.

In a furious letter [PDF] from Mike Roberts and Esther Dyson to the attorney generals of California and Pennsylvania, the DNS overseer is also accused of circumventing its own decision-making processes and using the coronavirus pandemic to push through the $1.13bn sale.

The two internet veterans ask the state’s top legal representatives to step in and suspend any sale for another six months “to permit your offices, ICANN and the US Congress, to revisit the questions of ICANN’s process and public-interest regulatory duty at a point when the pandemic is no longer the public’s principal concern”.

ICANN is due to decide at a board meeting on Thursday whether to approve or block the sale of the registry from the Internet Society to private equity firm Ethos Capital.

But despite five months of discussions and repeat efforts by Ethos to tackle concerns, many in the internet community remain extremely skeptical of the deal, particularly its financing and the unusual corporate structure of Ethos, which comprises no less than six different companies, all of which were registered on the same day in 2019.

“We write to express our deep dismay at ICANN’s rejection of its defining public-interest regulatory purpose as demonstrated in the totally inappropriate proposed sale of the .ORG delegation,” the letter begins. “ICANN is failing to deliver on the purpose it was created to serve, and is abandoning its core duty to protect the public interest.”

Accountability fail

Roberts was ICANN’s first CEO and was in charge of the organization for its first three years as it attempted to put a structure around the domain name system (DNS).

Dyson was its chair for the first two years. Back then, ICANN was a semi-autonomous body overseen by the US government. That oversight ended in January 2017 after a number of new accountability measures were introduced to ensure ICANN would remain answerable to the internet community rather than itself.

The most important of those new measures is called “Empowered Community” and, in theory, allows the internet community to force the organization to hand over documents and pause decisions. It has failed on its first use, Roberts and Dyson note, referencing a letter from ICANN’s general counsel in February that rejected an effort to use the oversight.

The oversight request [PDF] asked for records covering ICANN’s consideration of the .org sale as well as details on the process it would use to gain the internet community’s approval of its decision. ICANN responded [PDF] by claiming the request “exceeded the permissible scope” of the mechanism and refused to hand over any documents.

Source: ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale • The Register

Linksys forces password reset for Smart Wi-Fi accounts after router DNS hack pointed users at COVID-19 malware

Router biz Linksys has reset all its customers’ Smart Wi-Fi account passwords after cybercrims accessed a bunch and redirected hapless users to COVID-19 themed malware.

The mass reset took place after all user accounts were locked on 2 April, following infosec firm Bitdefender revealing that malicious persons were pwning Linksys devices through cred-stuffing attacks.

Hackers with access to Linksys Smart Wi-Fi accounts were changing home routers’ DNS server settings. Compromised users’ attempts to reach domains ranging from Disney, pornography, and Amazon AWS were redirected to a webpage peddling a coronavirus-themed app “that displays a message purportedly from the World Health Organization, telling users to download and install an application that offers instructions and information about COVID-19.”

The app was hosted on Bitbucket, a Git-style collaboration tool. Instead of health advice it dispensed the Oski info-stealing malware, which helps itself to one’s login credentials for various services, including cryptocurrency wallets.

Linksys customers were told of the password reset by the firm earlier this week, along with cryptic and confusing references to “the COVID-19 malware”. Affected users must now change their passwords the next time they log into the Linksys Smart Wi-Fi app.

Source: Linksys forces password reset for Smart Wi-Fi accounts after router DNS hack pointed users at COVID-19 malware • The Register