Home - h4ckers-news

Ultimate Member Plugin Zero-Day Risks 200K+ WordPress Sites

Hacking

andreasc

-

July 3, 2023

Ultimate Member Plugin Zero-Day Risks 200K+ WordPress Sites

[ad_1]

Heads up, WordPress admins! Researchers have caught a zero-day vulnerability in the Ultimate Member WordPress plugin, which hackers are exploiting to gain elevated privileges on target websites. Until the patch arrives, uninstalling the plugin is the only viable option to protect your websites.

Ultimate Member Plugin Zero-Day Actively Exploited

According to a recent post from Wordfence, a severe security issue affects the Ultimate Member plugin that criminal hackers have started exploiting to target websites.

Ultimate Member is a dedicated WordPress plugin offering user profile and membership features for websites. The plugin facilitates the creation of catchy profiles and online communities with swift membership registrations.

Currently, the plugin’s official WordPress page boasts over 200,000 active installations. While this indicates the usefulness of the plugin and its subsequent popularity, it also suggests how any vulnerabilities in this plugin can directly impact thousands of websites globally.

One such critical severity vulnerability recently caught the attention of the Wordfence team. As observed, they noticed a privilege escalation vulnerability (CVE-2023-3460; CVSS 9.8) that allowed rogue admin registrations.

Specifically, the flaw existed because the plugin used a predefined list of banned user meta keys that an adversary may bypass by adding slashes to the user meta key. An unauthenticated attacker may set the wp_capabilities user meta value to ‘administrator’ to gain admin access to the website.

Wordfence team observed numerous instances of active exploitation of this vulnerability, where the attackers created rogue accounts with usernames ‘wpenginer,’ ‘wpadmins,’ ‘wpengine_backup,’ ‘se_brutal,’ and ‘segs_brutal.’ The researchers have also shared the indicators of compromise in their post.

Patch Still Pending To Arrive Despite Efforts

Following the bug discovery and exploitation detection, the plugin developers started working on patching the flaw. However, their efforts were seemingly unsuccessful, as the vulnerability affects even the latest version 2.6.6.

According to the developers, the team has been working on fixing the vulnerability since Ultimate Member version 2.6.3. The following versions (2.6.4, 2.6.5, and 2.6.6) also aimed at ‘partially closing’ the flaw. However, they are still working on addressing the issue completely, which means the vulnerability still risks all websites.

Hence, until a patch arrives, the only workaround to protect websites from potential attacks is to disable/uninstall the plugin. Besides, the plugin developers urge the users to keep checking for updates.

Let us know your thoughts in the comments.

[ad_2]
Source link

The Tweet rate is breaking other Twitter apps

Android

andreasc

-

July 3, 2023

0

[ad_1]

Not too long ago, Elon Musk made a change to Twitter that limited the number of tweets that a person is allowed to see in a day. This tweet limit caused an uproar among users, and it’s breaking third-party Twitter apps.

That’s right. When it comes to making bad decisions regarding Twitter, Elon Musk is batting 1,000. Ever since the billionaire took the helm, Twitter has been spiraling out of control. Twitter Blue is more expensive, the verification badge doesn’t mean anything, and much more. But hey, at least your tweets can be up to 25,000 characters long.

Now, his next home run limits the number of tweets that a user can view on the platform. If you’re a verified user, then you’re limited to viewing 8,000 tweets in a day. If you’re an unverified user, then the number drops significantly. Unverified users can only view 800 tweets a day. If you’re a new unverified user, then don’t expect to see more than 300 tweets per day.

In a tweet, Musk mentioned that this is due to data scraping. He also said that this is going to be temporary. That’s good news, but he didn’t give us any insight as to when it’s going to end.

The tweet limit is breaking Twitter apps

This limit doesn’t only affect the first-party Twitter platform. There are third-party apps and services that you can use to view your tweets. Well, they’re subject to the limit as well.

Services like Tweetdeck are experiencing issues loading tweets. When trying to load different columns, you’d only get the spinning “loading” wheel. A report from Waxy (via Engadget) states that the Twitter web app is sending requests in an infinite loop. This could be because of a bug in the Twitter web app, but that hasn’t been confirmed.

A new beta version of Tweetdeck seems to fix that issue, but that victory was short-lived. Tweetdeck is still subject to the same tweet limit. So, after it loads the limited number of tweets, it won’t function. With a service like Tweetdeck, one that displays a ton of tweets at a time, it’s not hard to cap out your tweets.

Right now, we’re all just waiting to see how the company plans on making this situation better. Undoubtedly, people are upset about this limit. Even paying for Twitter Blue doesn’t get rid of the limit.

[ad_2]
Source link

Motorola Defy Satellite Link is now available for purchase in the US

Tech

andreasc

-

July 3, 2023

0

Motorola Defy Satellite Link is now available for purchase in the US

[ad_1]

With satellite connectivity being a big deal, the Motorola Defy Satellite Link is here to save the day. Motorola put this device in the spotlight a few months ago after its launch, and it is now available for purchase. The idea behind the development of this device is that it can help users access the internet even in areas with little or no internet coverage.

To access the internet, users would only need the Motorola Defy Satellite Link, which would find a nearby satellite to connect with. Once this connection between the Defy device and the satellite is secure, the user would be able to access certain services on their smartphone. This piece of technology is great for those whose jobs entail that they move into areas with low network coverage.

Well, anybody can own this device as it can come in handy in the event of a network outage. Some devices already have satellite connectivity features built in just for rainy days. If your device doesn’t have this feature, and you see it as being important, then you can opt to get the Motorola Defy Satellite Link.

Details, pricing, and where to buy the Motorola Defy Satellite Link

A few months ago, details on the Motorola Defy rugged device to launch in collaboration with Bullitt Group hit the internet. This device, although not yet available, would come with built-in satellite connectivity features. But while fans anticipate the launch of this rugged smartphone with satellite connectivity, Motorola is offering satellite connectivity for less.

The Motorola Defy Satellite Link is a compact device that can give your device access to satellite connectivity. Staying true to the Motorola Defy brand, this is a rugged device that comes with Ingress Protection (IP68). It is drop and water-resistant, it also features MIL SPEC 810H certification and is resistant to thermal shock.

In certain parts of Europe, this device has been available for usage over the past few months. However, the company is finally extending availability and support to the US now. Other regions such as South America, Africa, and Australia will get support for satellite connectivity with this device in the coming months.

So if you are living in the US and need a device that can help you to access the internet via satellites, you can get one. The Motorola Defy Satellite Link is priced at $149. This device will connect to your smartphone via Bluetooth and offer satellite internet connectivity.

With satellite internet, users can send and receive text messages as well as send out SOS alerts. But to access these features, users would need to pay for either the Essential, Everyday, Premium, or Freedom plans. All except the Freedom plan are monthly subscriptions, the more a user pays, the more features they get access to.

Some specifications of this device include a 600mAh battery that can last 4 days on a single charge. It uses a USB-C charger to power up the battery once there is a need to. For processing power, it makes use of the MediaTek MT6825 NTN chipset. Lastly, it has a Lanyard, so it can be attached to the user without getting lost.

[ad_2]
Source link

Mockingjay Process Injection Technique Permits EDR Bypass

Hacking

andreasc

-

July 3, 2023

0

Mockingjay Process Injection Technique Permits EDR Bypass

[ad_1]

The newly devised Mockingjay process injection technique can evade most existing security mechanisms, allowing EDR bypass. It’s a trivial process to carry out, requires minimal steps, and delivers maximum results merely by exploiting legit DLLs.

Researcher Devised Mockingjay Process Injection Technique

According to a recent post from Security Joes, Mockingjay is an advanced process injection strategy that successfully bypasses most detection measures.

Process injection is a known attack strategy where an adversary may inject codes directly into a trusted running process. Some process injection types include Dynamic-link Library Injection and Process Doppelgänging. The aim is to escape detection while gaining access to the process memory and network resources and gain elevate privileges.

While it’s a viable technique, process injection involves some specific actions, such as interacting with Windows APIs, that most existing EDR (Endpoint Detection and Response) systems effectively monitor. That’s where Mockingjay becomes important as it allows evading such EDRs. That’s because Mockingjay doesn’t rely on Windows APIs; but instead uses legitimate DLLs RWX (read, write, execute) sections.

Describing Mockingjay, the post reads,

Our unique approach, which involves leveraging a vulnerable DLL and copying code to the appropriate section, allowed us to inject code without memory allocation, permission setting, or even starting a thread in the targeted process.

Briefly, the researchers demonstrated their attack strategy via the vulnerable DLL msys-2.0.dll inside Visual Studio 2022 Community. The team searched for this DLL and found it possessed the default RWX section they could exploit. They then loaded this DLL into the memory space of their custom apps to load and execute the injected code.

The attack happened entirely without Windows API use, demonstrating the efficiency of bypassing EDRs. Moreover, it didn’t require memory allocation, permission settings, or creating threads for code execution.

The researchers have shared the details about Mockingjay in their post, whereas the following video demonstrates the technique.

Suggested Remediation

Since Mockingjay indicates the inefficiency of existing endpoint protection measures, the researchers advise the organizations to implement dynamic analysis for analyzing runtime behaviors, identify anomalous activities, employ signature-based detection for known threats, deploy reputation-based filtering to flag suspicious activities, and ensure robust memory protection.

Let us know your thoughts in the comments.

[ad_2]
Source link

Google Pixel 8 Pro Protoype leaks

Android

andreasc

-

July 3, 2023

0

[ad_1]

Here’s our first look at a prototype of the upcoming Google Pixel 8 Pro. And it comes with very few surprises, actually.

The biggest change we can see here is that Google is going with a two-tone backside again. With the top, above the camera bar, looking darker than the bottom part. Of course, that could also just be due to the lighting in the room where this picture was taken.

The other big change we’re seeing here is the camera bar. It looks like there’s now one cut out for the triple-camera setup. Instead of an oval for the ultrawide and wide sensors, and another cutout for the telephoto lens. It also doesn’t look like it’s quite as curved as the Pixel 7 Pro.

On the front, there’s not a whole lot that this shows us. However, it does show that this is a flat display, instead of a curved one, so that’s good to see.

Pixel 8 Pro codename has been rumored to be “husky”

Many of you might be wondering why we think this is the Pixel 8 Pro? Well, we have seen leaks and rumors that the codename for the Pixel 8 Pro is going to be “Husky”, and that’s what’re seeing on this model. It’s also quite obvious that this is a Pixel device here.

There’s a few other things that these images of “husky” show us, including the fact that it has 12GB of Samsung’s LPDDR5 RAM and 128GB of storage from SKHynix. That’s the same RAM and Storage as the Pixel 7 Pro, so it doesn’t look like there’s any upgrades in that department.

Google is set to announce the Pixel 8 series later this year, typically around the beginning of October. So we still have a couple of months before this device is made official. And that means plenty more leaks coming.

[ad_2]
Source link

Mastodon’s Android App Gets a New Look with Material You

Tech

andreasc

-

July 3, 2023

0

Mastodon’s Android App Gets a New Look with Material You

[ad_1]

Over the weekend, Elon Musk tried yet again to kill Twitter, and sent a lot of people over to Mastodon. And that was shortly after Mastodon had rolled out a new update which brought about a Material You redesign. And we must say, it looks amazing.

Mastodon is a federated social media network, and was actually growing quite significantly in the days following Musk’s takeover of Twitter back in October. It’s since slowed down a bit, but it does have nearly 13 million users right now. So it’s not small like Bluesky, which has just a few hundred thousand people on-board right now. And actually had to halt sign ups over the weekend due to Twitter’s rate limiting. Which is insane, since it’s still invite only.

Material You for everyone

Now with Material You on Mastodon, it’s the best looking social media app on Android. It just looks so great in Material You. Since it’s going to take accents from your wallpaper, just like the rest of the Google apps and Settings already does. So you can really customize how Mastodon looks on your Android device.

You can switch between light and dark mode, and also have it follow the system-wide setting. Making it easier to switch between light and dark mode on your Android device.

The only bad thing here is that, there’s no enhancements for larger screens like the Pixel Fold and Pixel Tablet. As I noted on Twitter over the weekend, Mastodon does work better on the Pixel Fold’s main display, since it does use up the whole display, but it’s kind of not usable. And that’s because it’s just stretched out on a 6:5 aspect ratio display.

Hopefully some changes to the large display format will come soon for Mastodon. But as for now, they aren’t here. Instead, we get treated with Material You.

[ad_2]
Source link

Siemens Automation Device Flaw Let Attackers Execute Code

Hacking

andreasc

-

July 3, 2023

0

Siemens Automation Device Flaw Let Attackers Execute Code

[ad_1]

It has been discovered that the Siemens A8000 CP-8050 and CP-8031 PLCs contain a vulnerability that can be exploited for Remote Code Execution (RCE) without the need for authentication.

The Siemens SICAM A8000 is a versatile device that can be used for power distribution, transmission, and microgrids. It can also function as a communication gateway for a variety of networks and protocols.

Vulnerability Details

According to SEC Consult, which discovered the vulnerability, the Siemens A8000 CP-8050 and CP-8031 PLCs are affected.

The CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 is affected by multiple vulnerabilities, such as authenticated remote command injection, exposure of serial UART interface, and hard-coded credentials (for UART login).

CVE-2023-28489 – RCE

An attacker could exploit the flaw by sending a crafted HTTP request to the Siemens Toolbox II port 80/443; arbitrary commands can be executed without authentication.

This attack may lead to the full compromise of the device, and operation will get affected.

CVE-2023-33919 – Authenticated Command Injection

The flaw is due to a lack of input sanitation; any user with access to the SICAM WEB can execute arbitrary commands as a “root” user.

CVE-2023-33920 – Hard-coded Root Password

The “root” password hash remains the same for all the devices, so if the password is known, it could be used to log in via UART and SSH.

CVE-2023-33921 – Console Login via UART

To access the UART interface, physical access to the PCB is required. Once connected, the boot information will be displayed, followed by a login prompt.

Updates

An update to firmware CPCI85 V05 has been released by Siemens; the updates can be found here and here.

Workaround

The possible workaround is to block access to the A8000 CP-8050/CP8031 module or disable the Toolbox II communication on port 80/443 and limit physical access.

A complete report from SEC Consult can be found here.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.

[ad_2]
Source link

HBO shows are finally coming to Netflix

Android

andreasc

-

July 3, 2023

0

[ad_1]

Netflix has been the temporary home of content from many companies. However, there’s one company that’s yet to place its shows on the streaming service, and that’s HBO. However, thanks to a report from Deadline (via Engadget), HBO is finally making some of its content available on Netflix in the US.

The home of most of HBO’s shows and movies can be found on MAX. The company originally showed all of its content on HBO MAX, but the company merged its content with Discovery+. The merged streaming service is MAX, and it gives you access to content from both of the streaming services. However, HBO had to shed a bunch of its HBO MAX content in the process.

If you’re interested in getting a subscription, the plan starts off at $9.99/month ($99.99/year) for the ad-supported tier. Going ad-free will cost you $15.99/month ($149.99/year), and the top-tier plan costs $19.99/month ($199.99/year).

These HBO shows are coming to Netflix in the US

There’s a handful of shows crossing the pond to Netflix, but there’s only one show currently streaming. This is a gradual rollout, so the other shows will show up on Netflix in due time.

The show that’s on Netflix now is Insecure. This show was created by Issa Rae, and it’s highly acclaimed. This comedy-drama “looks at the friendship of two modern-day black women, as well as all of their uncomfortable experiences and racy tribulations.”, as per the description on HBO.com. All five seasons are currently on Netflix, so you can start binging now.

If you manage to burn your way through that show, don’t worry. There are other shows making their way over to Netflix. Band of Brothers, Six Feet Under, Ballers, and The Pacific are also making their way over to Netflix. These shows will arrive as time goes on. Also, remember, this refers to the US market. If you’re outside of the US, you’ll be able to watch True Blood.

[ad_2]
Source link

Netflix on Google TV and Android TV now supports frame rate matching

Tech

andreasc

-

July 3, 2023

0

Netflix on Google TV and Android TV now supports frame rate matching

[ad_1]

Frame rate matching originally became available on Android TV sometime last year. Google TV devices also got this feature at about the same time its counterpart (Android TV) got it as well. However, up until this point, Netflix has not supported frame rate matching on their streaming platform.

Finally, users of Android and Google TV can now benefit from frame rate matching while streaming. In a recent YouTube video from FlatpanelsHD, this feature can be seen in action on the Netflix app. What this feature does is very simple but essential to ensure a great viewing experience for streamers.

Users of Netflix on Google TV and Android TV might have not had a reason to complain about their streaming experience. But with the Netflix app now supporting the frame rate matching feature, they’ll be a clear improvement to streaming. But what are the benefits of this feature, or what does it bring to the table for Netflix streamers?

Benefits of the frame rate matching feature now available for Netflix on Google TV and Android TV

The frame rate matching feature helps the TV match the content’s frame rate. This helps the TV sync with whatever the user is watching, hence improving the viewing experience. So as the contents frame rate keeps changing, that of the TV will sync with it and change accordingly.

Users can benefit from this feature while streaming movies on Netflix, but it doesn’t stop there. Even when users are just scrolling through the Netflix app, the frame rate matching feature is also active. This makes each animation, screen change, and scroll appear smoother.

From the FlatpanelsHD video on YouTube, it is clear how this feature now available on the Netflix app works. The YouTuber tracked the frame rate of their TV by pulling up the VRR information from the settings page. While navigating across the Netflix interface, it was clear that the frame rate stayed the same.

Also, while streaming movies, the frame rate at which the movie is displayed stays in sync with the TV. Users can now wave goodbye to any choppy viewing experience while they use Netflix on Google TV and Android TV. However, it is good to note that supporting this feature will not bring a mind-blowing change to the Netflix app.

Before Netflix supported it, the viewing experience for most users was pretty good. To get support for this feature on your Google TV or Android TV, you’d need to update the Netflix app. Possibly, other streaming services available on Google TV and Android TV would also support this feature.

[ad_2]
Source link

Proton Pass Password Manager Is More Of An Identity Manager

Hacking

andreasc

-

July 3, 2023

0

Proton Pass Password Manager Is More Of An Identity Manager

[ad_1]

After beta testing Proton Pass for some time, Proton has launched its password manager for all users. Describing its prominent features, the service explains how Proton Pass can even serve as a decent identity manager, offering password as well as email alias protection.

Proton Pass Password Manager Also Protects Users’ Identity

Earlier this year, Proton – the firm behind the popular freemium VPN ProtonVPN – announced launching its own password manager ‘Proton Pass.’ Initially, the tool remained confined to beta testing with an invite-only mode. But now, the firm has announced opening it up for Proton users.

As elaborated in a recent blog post, Proton users can now find Proton Pass available as a browser extension for all major browsers across desktops, Android, and iOS devices.

Proton Pass typically markets itself as a password manager, facilitating users to create strong passwords and safely store their credentials and other sensitive data. However, it has one unique feature that surpasses almost all existing password managers – identity protection.

Specifically, Proton Pass offers users to shield their email addresses when signing up on any website. It allows them to use a “hide-my-email” alias that masks the actual email address. Signing up with this alias saves users’ actual email addresses from possible data breaches a website may face. If such an incident happens, the breach would only expose the Proton Pass-created email alias, leaving the actual email address unaffected.

With this feature, Proton aims to save users from potential identity theft risks that may arise due to email address exposures.

Moreover, Proton Pass encrypts all fields, such as usernames and URLs, instead of other password managers that merely encrypt passwords. Such detailed encryption saves users’ information from intruders if they get access

The tool is currently free to all Proton users with premium subscriptions (Proton Unlimited, Business, Visionary, or Family plan). Whereas other Proton users can purchase a Proton Pass subscription for as low as $1/month until the end of July and $3.99/month afterward.

Let us know your thoughts in the comments.

[ad_2]
Source link