SilentAir Actor Intercepted SMS 2FA Codes via Compromised Carrier Equipment in Six Asian Countries

·1 views

A state-level actor known as SilentAir reportedly compromised equipment inside mobile operators in six Asian countries. By sending forged SS7 UpdateLocation messages into the global interconnect, it intercepted calls and texts, including SMS two-factor authentication codes. The intrusion leaves no visible trace on the handset, which shows the same signal and network name, while diverted messages simply fail to arrive. Researchers say about 18.3% of the group's observed activity was interception, a far higher share than typical commercial surveillance firms, and that the flaw stems from operators implicitly trusting signalling messages from one another rather than from a specific vulnerability. Enea says the group has been disrupted for now but could resume activity, and cleanup of the compromised equipment has not been confirmed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Splitting LLM prefill and decode adds a KV cache transfer cost that can erode gains

Separating prefill and decode onto different GPU pools removes compute stalls, but the design also has to move the KV cache between them. For a 32-layer model with 8 KV heads, each token adds about 64 KB of cache, so an 8,000-token prompt produces roughly 512 MB that must cross the network before decoding begins. On a 10 Gb/s link this transfer takes about 410 ms, longer than the 320 ms prefill it was meant to offload, while 25 Gb/s roughly halves the benefit and 100 Gb/s clearly wins. The author argues that cache size and interconnect bandwidth should be calculated before choosing disaggregation, and that grouped-query attention and KV cache compression can substantially reduce the transfer cost.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python Functions Tutorial: Return Values, Redefinition and Why They Matter

This DEV Community installment continues a Python series on functions, focusing on the return statement that passes a result from a function back to the calling code. It gives an example in which a call to an add function with 10 and 20 yields a result. The article notes that several functions can be defined in one file and any defined function can be called. It also explains that a function must be defined before being called during normal execution, and that redefining a name replaces the earlier version. The piece concludes that functions help break large programs into smaller, reusable, and more maintainable tasks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Per-Tenant DNS Records Favored Over Wildcards for Customer Storefront Domains

The article argues that customer-owned storefront domains should get explicit per-tenant DNS records rather than relying on wildcards in the SaaS operator's zone. A wildcard under the operator's domain cannot verify ownership of a customer's domain, while per-tenant records give onboarding services concrete state to read back and reconcile. The author treats domain onboarding as a consistency problem, separating desired state, observed DNS state, and ownership verification, plus delivery evidence for SPF, DKIM and DMARC. The piece lists three design risks: false readiness, reconciliation drift, and ownership boundary mistakes. It also notes that these are design considerations rather than reports of any provider incident.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Unicode Symbols in Usernames and Bios: A Developer's Practical Guide

Decorative symbols like hearts, stars and kaomoji are ordinary Unicode characters, which is why copying them works across apps. Whether they display depends on the font support of each device, so the same symbol can appear as an empty box on another screen. Platforms differ: Discord, Instagram, Roblox and X allow permissive display names but enforce strict usernames. The guide advises developers to count grapheme clusters rather than raw string length, normalize text before comparison, validate with Unicode property escapes, and use utf8mb4 in databases.

0 comments Read more at DEV Community