A gauge of global stocks rose on Tuesday while U.S. Treasury yields mostly fell as investors assessed economic data and earnings reports ahead of a run of central bank policy announcements.

On Wall Street, U.S. stocks were higher, reversing declines in equity futures after data showed labor cost growth in the fourth quarter was the smallest in a year, at 1.0%, even in a tight labor market. Other data showed consumer confidence eased in January, as inflation expectations for the next 12 months climbed to 6.8% from 6.6% last month.

The Federal Reserve is widely expected to raise interest rates by 25 basis points (bps) at the conclusion of its two-day policy meeting on Wednesday. Investors will closely monitor comments from Fed Chair Jerome Powell following the announcement for clues on the path of monetary policy.

“The Fed tomorrow will have to strike a delicate balance in signaling slowing in the pace of rate increases, while at the same time emphasizing that they’re not done yet with tightening rates,” Oscar Munoz, U.S. macro strategist at TD Securities, told the Reuters Global Markets Forum.

“It has to acknowledge the recent improvement in the inflation data, but also note that the job’s not done yet despite the recent good news.”

The Dow Jones Industrial Average (.DJI)
rose 228.15 points, or 0.68%,
to
33,945.24
, the S&P 500 (.SPX)
gained 37.97 points, or 0.95%,
to
4,055.74
, and the Nasdaq Composite (.IXIC)
added 137.22 points, or 1.2%,
to
11,531.04
.

The S&P 500, up about 5.2% for the month, is on track for its first January gain since 2019.

Interest rate announcements from the Bank of England and the European Central Bank are scheduled for Thursday, with both seen as likely to hike rates by 50 basis points.

Markets will also grapple with a host of U.S. economic data this week, culminating in Friday’s payrolls report for January. Investors see signs of weakening in the labor market as a key factor in bringing down high inflation. Other data this week include gauges of the manufacturing and services sectors.

In addition, more than 100 S&P 500 companies, including market heavyweights Apple Inc (AAPL.O), Amazon.com Inc (AMZN.O) and Google parent Alphabet (GOOGL.O), are scheduled to report results this week.

Caterpillar(CAT.N) and McDonald’s(MCD.N) both lost ground on Tuesday following their quarterly results. However, Exxon Mobil rose after posting a $56 billion net profit for 2022.

European shares retreated ahead of the central bank meetings to end the month on a down note, but still notched their biggest January percentage gain since 2015. Economic data for the euro zone showed slight growth for the fourth quarter, but further weakness is expected this year.

The pan-European STOXX 600 index (.STOXX) lost 0.26%, and MSCI’s gauge of stocks across the globe (.MIWD00000PUS) gained 0.39%. MSCI’s index was on pace for its biggest January percentage gain since 2019.

Benchmark U.S. 10-year notes were down 2.9 basis points to 3.522% in the wake of the data, after hitting a two-week high of 3.574% on Monday.

In currencies, the U.S. dollar index
, on track for a fourth month of declines, fell 0.196%, with the euro up 0.22% to $1.0868.

Oil prices recovered from earlier lows, as U.S. crude recently rose 0.81% to $78.53 per barrel and Brent was at $84.47, down 0.51% on the day.

Related Galleries:

---

Horizon3 security researchers released proof-of-concept (PoC) code for VMware vRealize Log Insight RCE vulnerability CVE-2022-31706.

Last week, researchers from Horizon3’s Attack Team announced the release of PoC exploit code for remote code execution in VMware vRealize Log tracked as CVE-2022-31706 (CVSS base 9.8/10).

The PoC exploit code will trigger a series of flaws in VMware vRealize Log to achieve remote code execution on vulnerable installs.

VMware Aria Operations for Logs (formerly vRealize Log Insight) is a log collection and analytics virtual appliance that enables administrators to collect, view, manage and analyze syslog data. Log Insight provides real-time monitoring of application logs, network traces, configuration files, messages and performance data.

Recently VMware addressed multiple vulnerabilities, tracked as CVE-2022-31706, CVE-2022-31704, CVE-2022-31710, and CVE-2022-31711, in its vRealize Log Insight appliance.

The most severe flaws impacting the product are a Directory Traversal Vulnerability tracked as CVE-2022-31706 (CVSS score 9.8), and a broken access control vulnerability tracked as CVE-2022-31704 (CVSS score 9.8).

An unauthenticated, attacker can exploit one of the two flaws to inject files into the operating system of an impacted appliance which can result in remote code execution.

“An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.” reads the advisory published by the virtualization giant.

The other flaws fixed by VMware are:

• CVE-2022-31710 – Deserialization Vulnerability (CVSS score 7.5) that can be exploited by a remote attacker to trigger the deserialization of untrusted data which could result in a denial of service.
• CVE-2022-31711 – Information Disclosure Vulnerability (CVSS score 7.5) which can be exploited by a remote attacker to collect sensitive session and application information without authentication.

The post published by Horizon3’s Attack Team last week includes a list of indicators of compromise (IOCs) that can be used to detect exploitation attempts for the above issues.

The experts used the Shodan search engine and discovered only 45 VMware vRealize Log Insight appliances that are exposed online.

Today Horizon3 published the PoC exploit code to achieve an arbitrary file write, along with a technical deep dive.

“This POC abuses the various Thrift RPC endpoints to achieve an arbitrary file write” reads the post published by the experts.

The experts started gathering intelligence on the flaw by analyzing the workaround proposed by the vendor in an attempt to understand how it fixed the issues.

The workaround restricts TCP ports 16520 through 16580, which uses the Thrift RPC protocol. Apache Thrift is a cross-language RPC framework that supports RPC clients and servers using the Thrift interface definition language. This circumstance led the experts into believing that the issue was residing in the a RPC server.

In summary, the researchers created a Thrift client and allowed unauthenticated access to the Log Insight Thrift server. Then they created a crafted tar file containing a directory traversal using a valid Pak file.

Using remotePakDownloadCommand, the experts uploaded the malicious Pak file to /tmp/.pak.

Then they caused the Pak file to be extracted using pakUpgradeCommand, this process allowed to write the malicious file where they want on the filesystem.

The good news is that at this time there are no reports of attacks exploiting this vulnerability in attacks in the wild. However, threat actors can start using their own exploits once obtained a foothold in a target network and fully compromise the VMware installs.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, VMware vRealize Log Insight)

The post Experts released VMware vRealize Log RCE exploit for CVE-2022-31706 appeared first on Security Affairs.

BERLIN — It is one thing to acknowledge the dark parts of your country’s history. It is quite another to reckon with them.

I’ve spent the past six days traveling through Poland and Germany with Doug Emhoff, the second gentleman of the United States, as he’s toured sites of Holocaust atrocities and engaged in a series of conversations about rising antisemitism.

And at each stop, whether walking through the soggy woods in Gorlice, Poland — where Emhoff has family roots — or down the immaculate streets of Berlin, I tried to make sense of what had happened here.

It may sound trite: We know what happened, and it was bad. The Holocaust decimated European Jewry. Six million Jews, and millions of non-Jews, were murdered. The population — and in many ways, the Jewish people — have never recovered.

In Poland and Germany, I witnessed two dramatically different ways of dealing with these facts. Poland was home to some of the deadliest concentration camps during the Holocaust, but its approach to remembrance makes the brutal nature of the Nazi regime feel distant and foreign. In Germany, the horrors of the past are an inescapable part of the present.

Berlin especially makes open acknowledgement of the sins of the past, both collective and individual. There are abundant memorials to victims of the Holocaust and markers of past Nazi sites throughout the city. While there, Emhoff participated in solemn conferences, where leaders from across Europe discussed strategies to combat antisemitism.

German authorities have worked to be painstakingly honest about how their society arrived at a point at which the Holocaust was possible. At the Topography of Terror Museum, which sits on the site of the former SS headquarters, a gripping visual timeline of Nazi rule takes visitors through the dramatic escalation of nationalist frenzy and calculated violence during the 1930s and 1940s.

“Shalekhet” (Fallen Leaves) is an installation in memory of the victims of the Holocaust by artist Menashe Kadishman at the Jewish Museum Berlin. Photo by Laura E. Adkins

What struck me most deeply was the efficient organization of it all: this was no accidental genocide. Everything was planned to get rid of Jews, the Roma people, gay people, and dissidents as quickly as possible. And it was effective. Of the estimated 30,000 to 40,000 Jews that reside in Berlin, an estimated 90% emigrated from the former Soviet Union. Virtually no descendants of the Jews who thrived here before the Nazi reign of terror remain.

In Germany, you feel as if you’re standing in the clearly defined and omnipresent shadow of those who came before you. In Poland, you’re constantly chased by ghosts. There are plenty of markers of the country’s dark past — well-preserved concentration camp sites, Holocaust museums, buildings bearing Hebrew writing yet lacking any Jews.

But Poland’s leaders have consistently avoided acknowledging the antisemitism that still festers there, or that the Polish people were anything but the Nazi’s victims. (It’s true both that Polish citizens suffered intensely under Nazi occupation, and that many Poles were complicit in turning in their Jewish neighbors.) Publish the words “Polish death camps” and you’ll receive a formal letter of reprimand from the government.

At a Holocaust Remembrance Day commemoration in Birkenau, I felt that lack of self-awareness acutely. While the ceremony itself was held outside, on the site of demolished barracks, the press and translation room was set up in an outbuilding room equipped with ovens. Seeing a coat rack casually set up next to them filled me with rage.

The building isn’t a crematorium, and they weren’t the ovens used to burn the bodies of those murdered in the camp. But their significance as a symbol is unmistakable — as is the callousness of treating the room that houses them as just another space to store extra stuff. It felt as if the officials in charge wanted the credit and gravitas that accompanies Holocaust remembrance, without grappling with the gravity of what actually happened in this place.

Mourning the past, preserving the present

Tuesday, as Emhoff prepared to fly back to the United States, we visited Berlin’s New Synagogue, which was built in 1866.

Berlin’s New Synagogue, originally built in 1866 was partially destroyed by Allied bombing, and has not been fully rebuilt. Photo by Laura E. Adkins

The once-opulent synagogue was partially destroyed by Allied bombing on Nov. 22-23, 1943, and has not been fully rebuilt. The vast majority of what was formerly the main sanctuary was destroyed: Only rows of columns and an expanse of gravel remain. The space in which today’s 100 or so congregants pray, a plain room up several flights of stairs, takes up just a fraction of the building. The ark is not ornate. It’s a simple wooden box on wheels, covered with a simple white curtain.

The small interior sanctuary of Berlin’s New Synagogue that is currently used by its congregation. Photo by Laura E. Adkins

The synagogue’s dual functions — monument to the past, and home to a small, committed set of contemporary worshippers — make it a particularly emotional memorial to Germany’s once-thriving Jewish community.

When we teach younger generations about the Holocaust, we usually focus on the brutality: the humiliation, the violence, the propaganda and the killing. That’s the focus I saw in Poland: a sense that it’s honorable to remember these terrible things, so long as remembrance doesn’t extend to an admission of culpability.

It’s Germany’s approach, exemplified in the New Synagogue, that better understands what the real point of remembrance is. There are supposed to be so, so many more of us. Seeing the shul, once a seat of vibrant Jewish culture and life, now preserved in a perpetual state of violent incompleteness, made me want to weep.

The post Poland and Germany have long taken opposing approaches to Holocaust remembrance. Touring them with Doug Emhoff, the difference was stark appeared first on The Forward.

Sam Bankman-Fried in the Bahamas on Dec. 21

Marco Bello/Reuters

• Sam Bankman-Fried wanted to stall bankruptcy in FTX’s dying days, the Justice Department said. 
• Prosecutors said the crypto mogul wanted to transfer FTX assets out-of-country to get better treatment from foreign regulators.
• They also claimed Bankman-Fried tampered with FTX assets in the days leading to its bankruptcy.

Sam Bankman-Fried was hoping to regain control of his fallen crypto exchange by moving FTX’s assets to other regulators he hoped would go easy on him, according to the Department of Justice.

In a court filing on Monday, the Justice Department claimed Bankman-Fried tried to postpone FTX’s bankruptcy proceedings in late 2022 in order to move funds from the defunct crypto exchange to the jurisdiction of regulators in other countries. Prosecutors alleged that the disgraced crypto executive was hoping for better treatment from foreign regulators, which could potentially allow him to regain control of FTX, the filing said.

Bankman-Fried has previously said he regretted the decision to have FTX file for bankruptcy in November of last year, shortly after the crypto exchange suffered from “significant” liquidity issues and halted customer withdrawals. The bankruptcy filing ousted Bankman-Fried from company leadership and exposed numerous accounting scandals within the exchange, such as customer deposits being commingled with Alameda Research, Bankman-Fried’s crypto trading arm. 

But the former crypto executive has denied the misuse of customer funds, and has criticized FTX’s new leadership. He’s also maintained that parts of FTX are still solvent, despite the exchange’s lack of record-keeping and chaotic balance sheet. 

Prosecutors also say that although the crypto exchange froze customer withdrawals in late 2022, Bankman-Fried unfroze accounts in the Bahamas and allowed millions in customer withdrawals, to show his gratitude for the island nation where FTX was headquartered.

“We are deeply grateful for what The Bahamas has done for us, and deeply committed to it,” Bankman-Fried wrote in a letter at the time to the Bahamas attorney general. “We are also deeply sorry about this mess.”

Bankman-Fried and FTX co-founder Gary Wang were also said to take control of $546 million of Robinhood stock last year, which prosecutors said was illegally purchased with funds from Alameda. The purchase was an attempt to conceal the misuse of FTX customer funds, the filing added. Over $450 million worth of shares have been seized by the Justice Department.

Emergency personnel at the site of the Tesla crash in Northern California near Devil’s Slide.

Sgt. Brian Moore/San Mateo County Sheriff’s Office/Associated Press

• The wife of a man accused of driving a Tesla off a cliff said he “intentionally” did it, the DA said.
• The woman shouted to medics that her husband “intentionally drove the car over,” the DA said. 
• Dharmesh Patel was formally charged on Monday with three counts of attempted murder.

The wife of a California doctor who has been accused of purposefully driving his Tesla off a cliff in the state with his family inside screamed to rescuers at the scene that her husband “intentionally drove the car over” the edge, a local district attorney said. 

“She shouted that out” to medics as they rescued her from the vehicle, San Mateo County District Attorney Steve Wagstaffe told Insider on Tuesday of Neha Patel, the wife of Dharmesh Patel. 

“She just said to the paramedics that he intentionally drove the car over the cliff,” Wagstaffe said.

A lawyer for Dharmesh Patel did not immediately return a request for comment by Insider on Tuesday. 

Dharmesh Patel was formally charged on Monday with three counts of attempted murder. He is accused of intentionally driving a Tesla off a notorious 250-foot cliff in Northern California with his wife and two young kids inside on January 2.

The suspect, a radiologist at Providence Holy Cross Medical Center in Los Angeles, and the passengers miraculously survived and were rescued via helicopter after the vehicle plunged off a cliff known as Devil’s Slide. 

“We have concluded that the evidence supports the fact that he intentionally drove his vehicle over that cliff and thereby obviously endangering not just his wife and two children, but his own life,” Wagstaffe told reporters on Monday. 

The district attorney added, “By some miracle that I don’t understand, all of them have survived. I’m glad for that but it doesn’t change what we’ve charged him with.”

A Tesla plunged off a 250-foot cliff on January 2.

Twitter

Wagstaffe told Insider that surveillance footage of the incident showed the Tesla coming out of a tunnel, going up a hill, and “making a sharp right turn and disappearing going up the cliff.”

Witness accounts were “consistent” with what the surveillance footage showed, like how there “does not appear to be any brake lights or anything like that,” according to Wagstaffe. 

The district attorney’s office has not yet spoken to the suspect’s wife, who remains hospitalized, said Wagstaffe.

The couple’s two children, a 7-year-old girl and a 4-year-old boy, have been released from the hospital and are in the care of a family member, according to Wagstaffe.

A pedestrian walks past a mural depicting the logo of the Russian mercenary ‘Group Wagner’ and a slogan in Russian on January 20, 2023 in Belgrade, Serbia.

Srdjan Stevanovic/Getty Images

• An ex-Wagner mercenary said the group’s leaders shot soldiers who did not want to fight in Ukraine. 
• “They brought two prisoners who refused to go fight and they shot them in front of everyone,” he told CNN. 
• He added that soldiers were often sent into battle with little direction and “no real tactics.” 

An ex-Wagner mercenary who recently fled the war in Ukraine shared horror stories alleging the Russian-backed soldiers who didn’t want to fight in Ukraine were brought in front of new recruits and shot. 

“They would round up those who did not want to fight and shoot them in front of newcomers,” Andrei Medvedev told CNN’s Anderson Cooper while discussing the “ruthless” tactics.

“They brought two prisoners who refused to go fight and they shot them in front of everyone and buried them right in the trenches that were dug by the trainees,” Medvedev alleged. 

He added that soldiers were often sent into battle with little direction and “no real tactics.” 

“We just got orders about the position of the adversary…There were no definite orders about how we should behave,” Medvedev explained. “We just planned how we would go about it, step by step. Who would open fire, what kind of shifts we would have…How it would turn out that was our problem.”

Medvedev had previously served in the Russian army before joining Wagner as a volunteer in July 2022. He told CNN he ended up fighting in Ukraine less than 10 days after he signed his contract. 

He told CNN that it took only six days of deployment in Ukraine to know he no longer wanted to fight for the private military group after seeing what they were doing to their own members, but that he didn’t have the opportunity to leave until recently. 

“I was afraid I would be captured and shot as a traitor,” he said. 

Medvedev is now in Oslo, Norway after crossing the border from Russia. He is now seeking asylum.

Medvedev told CNN he evaded arrest “at least ten times” during his defection journey and that he had to dodge bullets from Russian forces. 

The Wagner Group, a notorious Russian paramilitary organization with close links to the Kremlin, has appeared to be the main fighting force in Russia’s war in Ukraine. 

The US issued a sweeping list of sanctions aimed at the group Thursday and designated Wagner a “significant transnational criminal organization.” The sanctions target a handful of individuals — “cronies” of Russian President Vladimir Putin — and entities involved in the mercenary group’s global network.