Researchers Uncovered QakBot Malware C2 Infrastructure

andreasc
-
0
Researchers Uncovered QakBot Malware C2 Infrastructure
[ad_1]
researchers Uncovered QakBot Malware

Tam Cymru researchers have recently revealed noteworthy patterns and irregularities from their continuous monitoring of QakBot’s command and control infrastructure. 

The researchers shared high-level insights into the findings, shedding light on emerging trends and unusual activities related to QakBot.

From victim-facing C2 servers, analyzing the outbound connections reveals Tier 2 infrastructure through communication patterns with common peers, often using a specific management port and maintaining prolonged ongoing interactions.

Typically, a specific management port is utilized for communication, and these interactions tend to persist for long durations in the majority of cases. The utilization of a dedicated management port ensures consistent and prolonged communication.

QakBot Malware C2 Infrastructure

By successfully identifying the Tier 2 (T2) management layer, researchers gain the ability to pinpoint the active victim-facing command and control (C2) servers through the analysis of connections established with this T2 layer.

Persistent communication over TCP/443 has been observed for several months between the command and control (C2) servers linked to Qakbot and two affiliate IDs, namely “Obama” and “BB,” with three upstream Russian Tier 2 (T2) servers. 

This ongoing connection suggests a significant relationship between the identified campaigns and the specific T2 servers.

Russian IP addresses are commonly employed in advanced botnet networks because they provide a shield against non-Russian law enforcement agencies and researchers.

While this creates an oppositeness where recurring connections from diverse source IPs to Russian IP space appear suspicious or fascinating.

Experts have analyzed the C2 configuration data of QakBot campaigns in April 2023 and have verified that the Russian T2 servers upstream have not undergone any modifications.

Afterward, a thorough examination of all C2 servers was conducted to pinpoint the specific ones that established connections via TCP/443.

The upstream traffic from C2 servers showed a curious pattern as it was found in configurations associated with both campaigns:-

  • Obama campaigns
  • BB campaigns

This intriguing overlap suggests a potential connection between the two campaigns regarding their utilization of these servers.

During the specified timeframe, the Obama campaigns had five distinct IPs exclusively associated with them, while the BB campaign had only one unique IP.

EHA

Here below we have mentioned those IPs:-

Obama:

  • 59.153.96.4
  • 73.22.121.210
  • 119.82.121.251
  • 189.151.95.176
  • 197.94.95.20

BB:

From 1 March to 8 May 2023, the traffic flows originating from the active C2 servers mentioned earlier were analyzed. These flows were then categorized based on the affiliate configurations in which they were found.

Overall, no clear separation is observed among the affiliates based on the upstream infrastructure used by their C2 servers for communication.

During two days, a particular C2 server associated with BB remained active. It primarily communicated with RU3, but it had one connection to RU2 on the first day.

Throughout the Obama campaigns, the C2 servers predominantly established communication with RU2 and RU3, showcasing their main points of contact. However, in early April, there were limited interactions with RU1.

RU2 and RU3 demonstrate similar patterns in their behavior, suggesting a level of consistency between them. On the other hand, RU1 deviates from this trend and follows a distinct pattern unique to itself.

IP Geolocation

In March, there was a shift in C2 activity with increased Indian and US IPs, a decrease in active C2 servers across different locations, and RU2 and RU3 receiving traffic from US and other North American C2 servers not seen with RU1.

RU1 primarily relied on hosts in India with limited diversity while occasionally connecting to C2 servers from the US and Czech Republic during February and March.

In February, CZ hosts communicated with all three T2s, while recently South African (ZA) hosts have started connecting with all three T2s.

Recommendations

Here below we have mentioned all the recommendations offered by the cybersecurity experts:-

  • Make sure to use the listed IOCs to detect current QakBot infections and prevent future attacks.
  • Identify Russian T2 servers by querying the IOC list and filtering for outbound connections to remote TCP/443 using Pure Signal Recon and Scout.
  • Make sure to spin the inbound connections to Russian T2 servers to reveal evolving QakBot C2 infrastructure.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


[ad_2]
Source link

Google released new changes to its Smart Chips technology

andreasc
-
0
Google released new changes to its Smart Chips technology
[ad_1]

Google is constantly trying to find ways to make its Workspace platform a worthy competitor to Microsoft Office. Not too long ago, Google introduced smart chips, and the company unveiled some additional features for smart chips in Google Sheets.

Smart chips are a way for you to bridge the gap between Google Workspace products. They let you link to different bits of data present in other platforms.

For example, if you’re using Google Sheets, and you want to add the contact details from a person in your contacts, you can add them as a smart chip. When you hover over this smart chip, you’ll be able to access information like their email address, address, phone number, Etc.

You can add contacts, YouTube videos, Slides presentations, Doc files, and other bits of data as smart chips. This is perfect if you need to link back to another document or give additional information on another person without having to manually type it all the information.

Google added additional functions to smart chips for Google Sheets

Google is steadily improving smart chips. There was just a notable update they landed in February that gave additional functionality to them. Now, according to Techradar, Google added yet another update to smart chips.

This new feature will let you extract data from smart chips and paste them into their own cell. When you tap on a chip, you will see a data extraction panel pop up on the right side of the screen. It will list the types of data that you can pull from the smart chip.

Sheets extracted data

You’re able to pull data like the file owner, MIME type, creation time, who last modified it, when it was last modified, and the file name. It’s a checklist, so you can simply check what data you want to be extracted. Then, Google will do the rest. This is a great way to keep track of important documents.

Google is currently rolling this feature out, so most users should see it in the coming weeks. If not, Google will start a much wider rollout starting on June 14th.


[ad_2]
Source link

Apple releases iOS 16.5 and iPadOS 16.5

andreasc
-
0
Apple releases iOS 16.5 and iPadOS 16.5
[ad_1]

Apple has just released iOS 16.5, as well as iPadOS 16.5, in a surprising move. I say surprising because point updates like this one don’t typically roll out on a Thursday. Generally on a Monday or Tuesday. Especially after we got a second release candidate earlier this week. But it’s here. So what’s new this time around?

This is the fifth point release for iOS 16, so there’s not a whole lot of major features coming here, but there are some nice changes coming to different apps. Here’s the changelog from Apple.

This update includes the following enhancements and bug fixes:

– A new Pride Celebration wallpaper for the Lock Screen to honor the LGBTQ+ community and culture
– Sports tab in Apple News gives easy access to stories, scores, standings, and more, for the teams and leagues you follow
– My Sports score and schedule cards in Apple News take you directly to game pages where you can find additional details about specific games
– Fixes an issue where Spotlight may become unresponsive
– Addresses an issue where Podcasts in CarPlay may not load content
– Fixes an issue where Screen Time settings may reset or not sync across all devices

Some features may not be available for all regions or on all Apple devices. For information on the security content of Apple software updates, please visit this website: https://support.apple.com/kb/HT201222

This is likely the final update for iOS 16

With WWDC happening next month, and iOS 17 being announced at WWDC, this is likely the last major update we’ll see for iOS 16. As the iOS team moves more attention over to iOS 17. With iOS 17 being announced next month, and rolling out in September, we’ll still likely see some updates to iOS 16.5, but don’t expect a 16.6 update. We will likely see just bug fixes from Apple, in the form of a 16.5.1 release.


[ad_2]
Source link

Google Introduces Dark Web Monitoring For Gmail Users

andreasc
-
0
Google Introduces Dark Web Monitoring For Gmail Users
[ad_1]

Google has announced a major security upgrade alongside other features updates for its users. Specifically, the service enables US Gmail users to activate dark web monitoring for their email addresses.

Gmail Dark Web Monitoring Currently Offered To US Users Only

According to a recent post from Jen Fitzpatrick, Senior Vice President of Core Systems & Experiences at Google, the tech giant is rolling out dark web monitoring for its US Gmail users.

As explained, Google already offered dark web monitoring to its Google One subscribers. But the firm has now decided to expand this feature’s availability to Gmail users.

The service will roll out in the following few weeks but will only be available to US users. However, Google has pledged to expand the facility’s radius to include other (select) international markets in the future.

Dark web monitoring has become necessary for anyone with an email address. Due to frequent data breaches, email addresses are frequently sold (or exposed) on the dark web, allowing adversaries to exploit them for malicious purposes. That includes everything from account takeovers to financial frauds and identity thefts.

Sending prompt alerts to users regarding possible exposures of their email accounts on the dark web can help them take remedial measures immediately. Google’s step in this regard will also significantly help Gmail users.

Other Major Feature Upgrades

Alongside this update, Google has also announced introducing other significant feature upgrades, such as better control over Android apps’ data collection and usage, easy deletion of Google Maps history, separate rollout of its Safe Browsing API, and the recently announced Passkey integration.

Moreover, Google has also announced the launch of the “About this Image” feature that will provide details about online visual content. That includes details about where the image first appeared, the context when it was first indexed, and its subsequent appearance across the internet.

Let us know your thoughts in the comments.


[ad_2]
Source link

YouTube is bringing the Community tab to more users

andreasc
-
0
YouTube is bringing the Community tab to more users
[ad_1]

We’re at a stage where companies are starting to blend video sharing with social media. This is something that YouTube has been working on with its Community tab. It’s been exclusive to certain users for a while, but according to Android Police, that’s going to change. YouTube is going to make it available to more users.

What is the YouTube Community tab?

YouTube started off as a video-sharing platform, and it’s still one today. However, the company is looking to increase how creators can interact with their communities. Sure, this comment section and videos, but the company wanted to push that further.

This is where the community tab comes in. This is a unified location where creators can post text-based updates, pictures, polls, and quizzes. It’s basically like Twitter for YouTube, and it allows people to further communicate and interact with their favorite creators.

It’s coming to more people

The community tab is great, but there’s a slight issue if you’re a smaller Creator. You need to have at least 500 subscribers on your account in order to enable the tab. While that’s not the highest bar to clear, it’s still a bit annoying having to work your way up to that point.

However, YouTube is now removing that restriction. It doesn’t matter if you have 500 subscribers or 5. You are able to sign up for the feature using the YouTube Studio app. You will have to opt into the advanced features in order for it to work.

This is a good move on YouTube, as it’s actually better for smaller creators to have this feature. Larger creators can’t quite interact with their communities as much. They get hundreds of thousands of comments on their posts, and it’s hard to keep up with that.

However, when it comes to smaller creators, it’s a lot easier to keep up with their communities. Engaging with the community is extremely important for smaller creators, so the community tab will make the process so much better.


[ad_2]
Source link

Samsung to manufacture some Snapdragon 8 Gen 4 chips

andreasc
-
0
Samsung to manufacture some Snapdragon 8 Gen 4 chips
[ad_1]

Samsung may manufacture some of Qualcomm’s 2024 flagship smartphone processors. More precisely, the word from the rumor mill is that the Korean firm will manufacture the Snapdragon 8 Gen 4 “for Galaxy”. TSMC will get orders for the standard Snapdragon 8 Gen 4. It will be Qualcomm’s first 3nm chip.

Qualcomm may go back to Samsung for the Snapdragon 8 Gen 4 “for Galaxy”

Qualcomm has been switching back and forth between Samsung and TSMC for manufacturing its smartphone processors over the past several years. It used Samsung’s foundry for the Snapdragon 888+ (5nm) and Snapdragon 8 Gen 1 (4nm) in 2021. But, in 2022, it switched to TSMC, with the Taiwanese firm manufacturing both the Snapdragon 8+ Gen 1 and Snapdragon 8 Gen 2 last year using its 4nm process node. The Samsung-exclusive “for Galaxy” version of the latter was also manufactured using the same process.

Reports suggested that Samsung’s poor yield rates and issues with process nodes made Qualcomm switch to TSMC last year. Chips made by the Korean firm have been having power and performance issues in recent years. Qualcomm is sticking with the Taiwanese firm for this year’s Snapdragon 8 Gen 3 (4nm) due to the same reason. But, Samsung has recently improved its yield rates and fabrication process. According to industry insiders, it’s now almost on par with TSMC in 4nm yields.

Moreover, Samsung has also improved its 3nm yields. The company is using the more efficient Gate-All-Around (GAA) transistor architecture in its 3nm chips. It has been sending 3nm samples to chipmakers around the world in a desperate bid to win back some customers it lost to TSMC in recent years.

The latter is sticking with the existing FinFET architecture for one more generation. It appears the plan is working out for the Korean firm. Twitter tipster @Tech_Reve appears certain that Samsung will get orders for Qualcomm’s Snapdragon 8 Gen 4 “for Galaxy” next year.

Google may stick with Samsung for its Tensor G4 next year

Samsung’s foundry struggles have been so huge in recent years that several companies switched to TSMC for manufacturing their chips. Google, which has been taking help from Samsung in designing its custom Tensor processors for the Pixel lineup, is also mulling switching to the Taiwanese firm for next year’s Tensor G4.

However, recent improvements from the Korean behemoth may make Google stick with it. TSMC’s high prices have also been proving to be a stumbling block for the Pixel maker.

Meanwhile, if Samsung does manage to steal some chip customers from TSMC, it may finally close the massive gap with its Taiwanese rival in the foundry market. There are reports that the Korean firm wants to make custom processors for its Galaxy flagships.

If true, it may soon stop using Qualcomm chips, which would mean a loss of potential business opportunities for its foundry division. Plenty could change by the time the Snapdragon 8 Gen 4 enters the production stage. So nothing may be set in stone just yet.


[ad_2]
Source link

Famous comedian takes over Waze for a new driving experience

andreasc
-
0
Famous comedian takes over Waze for a new driving experience
[ad_1]

Waze is adding yet another driving experience for drivers who decide to use its navigation app. This time around the company has partnered with famous comedian, actor, writer and producer Hasan Minhaj. The new driving experience is certainly the most entertaining of them all thanks to Hasan’s commentary.

I’m excited to be partnering with Waze as your personal navigator in my new driving experience. The car is where I come up with some of my best content – from jokes about traffic stalls to my experiences with the dreaded ‘Check Engine’ light. I think everyone can relate to the absurdities of driving and I love the opportunity to bring some humor to everyone on the roads.

But that’s not all you get if you’re using Waze. The Hasan Minhaj driving experience includes a custom Minivan vehicle and a Hasan-inspired Mood (how drivers appear on the map), Hilarious. These new features are now available from the “Customize your drive” menu.

Just make sure to select the new Hasan Minhaj driving experience and turn on voice directions, car icon, and mood. Also, don’t forget to save your settings, at least until the next driving experience hits the app. The new driving experience is available globally with a voice in English, just like many other similar experiences released by Waze in the past.

[ad_2]
Source link

Apple Blocked Over $2 Billion in Fraudulent Transactions

andreasc
-
0
Apple Blocked Over $2 Billion in Fraudulent Transactions
[ad_1]
Apple Blocked

Apple published a report claiming that they prevented around $2 billion of potentially fraudulent transactions in 2022 and rejected around 1.7 million app submissions as they failed to meet the App Store’s High Standard of Privacy.

Apple has been giving more preference to the users’ privacy by creating many rules for applications and giving more data control for its users.

App Store, the application downloading platform for Apple users, was launched in 2008. Over the years, around 1.6 million apps have been in the App Store. The platform has also attracted several developers to create applications for the benefit of the users.

Account Fraud

As per Apple’s report, they have terminated around 802,000 developer accounts that were involved in fraudulent activities in 2021. However, the numbers dropped in half in 2022, with 428,000 suspended accounts.

They have also rejected around 105,000 Apple Developer Program for suspicious account activities preventing the submission of fraudulent apps.

Concerning privacy violations and security issues, Apple blocked around 57,000 apps in 2022. Along with this, Apple has also disabled over 282 million customer accounts relating to abusive activities.

App Review

Every application that is submitted to the App Store is reviewed by the App Review team. During the application development, Xcode scans the application and checks for the requirements to meet the app store.

Source: Apple

The App review team will check for Apple’s standards of quality and safety of the application and ensure they meet the criteria. 

Apple stated that, “On average, the team reviews over 100,000 app submissions a week, with nearly 90 percent of them receiving a review within 24 hours. Having reviewed more than 6.1 million app submissions in 2022, App Review helped more than 185,000 developers publish their very first app on the App Store, and made over 20,000 phone calls to developers to help them diagnose and resolve issues that led to an app submission rejection.”

Ratings and Reviews

Reviews play a major role in the application installation by the user. Several fraud reviews and bot reviews were used on applications to increase their popularity and legitimacy.

In 2022, Apple blocked over 147 million fraudulent ratings and reviews on the App Store 2022, when nearly 1 billion ratings and reviews were processed.

Payment and Credit Card Fund

Apple supports nearly 195 local payment methods and 44 currencies. They claimed they blocked around 714,000 fraudulent accounts blocking nearly $2B transactions in 2022. Stolen credit cards accounted for nearly 3.9 million.

Apple has invested in secure payment technologies like Apple Pay and StoreKit for securing users’ financial information.

They never share the credit card numbers with the merchants, preventing a risk factor in the payment transaction process. Apple has published a complete report on this.

EHA

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


[ad_2]
Source link

FBI, GCHQ Unite To Foil Russian Malware Hacking Tool

andreasc
-
0
FBI, GCHQ Unite To Foil Russian Malware Hacking Tool
[ad_1]

A joint advisory from the National Cyber Security Centre has detailed how the UK and its allies have cracked Snake, a Russian malware used by the FSB. Operating as Britain’s foremost intelligence agency, GCHQ worked with the FBI and similar agencies in Canada and Australia to foil one of Russia’s most effective espionage assets for the last two decades.

The joint report comes with a rundown of the technical details of Snake, how it works and how networks can fortify themselves against its attacks. NCSC Director of Operations Paul Chichester said: ‘The advisory lifts the lid on a highly sophisticated espionage tool used by Russian cyber actors.’

Snake, BRICs and Fortuitous Timing

The Snake malware was a favourite of Russia’s Centre 16, a component of the FSB, for over twenty years. It is believed to have been designed in-house by the FSB for long-term intelligence gathering.

While it has been a long time coming, the news dropped amidst chatter concerning the BRICs and their rising economic influence. If the BRICs bloc field a viable alternative, it could create a rival for the U.S. dollar and start a chain reaction of de-dollarisation in other emerging economies.

The power of the dollar relative to other currencies is tracked by the DXY chart, specifically the euro, yen and pound sterling. All three currencies have had a volatile relationship with the USD in the past few months.

Exposing the Snake malware is just a small bout in long and large-scale posturing between Russia and Western powers, with no telling the effect it will have. It does solidify the GCHQ’s reputation as one of the most effective cyber security watchdogs in the world, a necessity as the UK remains the largest growing tech economy in Europe.

Snake’s Origins and Turla Group

While the details aren’t certain, the earliest form of Snake appeared in 2003 under the name Uroboros – the word for imagery where a snake eats its own tail. While the malware network would become widely known as Snake, Uroboros is still used for related malware as is Turla, another name used by the espionage groups that used the malware and are suspected to be state actors or at least subsidised by the state. Turla has gone by many names.

Given Turla’s secrecy and their likely FSB connections, discovering their many names was half the battle. In the joint advisory, authorities identified what they called ‘the Turla family’ which included other malware like Carbon/Cobra and Chinch/ComRAT. Both were derived from Snake’s code base and believed to have been developed by the same conspirators – the FSB and Turla.

Snake’s Targets and Perseus

The Snake malware was evidently one of the FSB’s most effective tools. All devices infected by Snake formed a peer-to-peer network without the knowledge or consent of the device owners, compatible with all popular OS. The FBI has said that Snake targeted over 50 countries, including US journalists, education sectors and NATO members’ computer hardware.

As part of their retaliation efforts, the joint intelligence agencies created a tool dubbed Perseus. It tricked devices infected by Snake into overwriting itself partially, enough to render the malware inert. They stress that computers can still be re-infected. CISA has issued a joint advisory here, which details how the malware works and how networks can protect themselves.

While state security will certainly use this opportunity to protect themselves against Snake malware reinfections, it’s up to individuals to educate themselves on this cyber security breakthrough and shore up defences. Businesses should especially take note of the advisory report and make sure they are protected.

  1. CISA to Start Issuing Early-Stage Ransomware Alerts
  2. US-Cert warns of North Korean BLINDINGCAN malware
  3. CISA, FBI Warns of Attacks on SATCOM Network Providers
  4. CISA warns of trojanized JavaScript library’s NPM package
  5. FBI warns of drastic implications of outdated medical devices

[ad_2]
Source link

Foldable phones aren’t as popular in the US as in other regions

andreasc
-
0
Foldable phones aren’t as popular in the US as in other regions
[ad_1]

Foldable phones appear to be a lot more popular in Asia and Europe than in the US. According to noted display industry expert Ross Young, Samsung has sold more Flip and Fold phones in its home country South Korea than in America. That’s despite the US having a five times higher population than Korea. It’s a similar story for other vendors as well.

Samsung is still selling more foldable phones than any other company

Ross Young, who is also the CEO of Display Supply Chain Consultants (DSCC), recently shared the market share of foldable smartphone companies for the first quarter of 2023. Samsung, which has long had a stronghold on this niche, is finally starting the feel the heat of competition. The arrival of new models such as the OPPO Find N2 and Find N2 Flip, coupled with an off-season for the Korean firm, means that its share tumbled to 45 percent. That’s Samsung’s lowest market share since Q2 2021 when Xiaomi launched its first foldable, the Mi MIX Fold.

Riding on the back of its latest foldables, OPPO leapfrogged its compatriot Huawei to the second spot with a market share of 21 percent. Huawei, which launched the Pocket S in November last year, managed to keep a market share of about 20 percent in Q1 2023. These three firms captured pretty much the whole global smartphone market this past quarter. Shipments were down year-on-year (YoY) for the second straight quarter, though. A total of 2.1 million foldable smartphones were shipped globally in the first three months of the year.

Foldable phones market share Q1 2023

Model-wise, Samsung’s Galaxy Z Flip 4 was the most popular foldable device in Q1 2023. It accounted for 27 percent of all sales. The Huawei Pocket S (15 percent) was the next favorite, followed by the Galaxy Z Fold 4 (13 percent). The OPPO Find N2 Flip (11 percent) and the Huawei Mate X3 (six percent) make up the top five. With Tecno, Vivo, Google, and others arriving on the scene in recent weeks, this chart may look a lot more diverse in subsequent quarters. The market would probably rebound too. For the record, more than six five million foldables were sold globally in Q3 2022.

The US foldable market is relatively small compared to other regions

Samsung may be the world’s largest foldable smartphone vendor, OPPO and Huawei’s market shares are particularly notable because of their limited presence. The former has just entered Europe and has been selling its foldables mostly in China and a few other Asian countries. The latter, meanwhile, has little to no presence outside China. Samsung is the only company selling foldable phones globally.

Unfortunately for the Korean brand, people in the US don’t seem to be interested in these unconventional devices. Europe is Samsung’s biggest foldable market, followed by South Korea. China and Singapore are among the Asian countries where people have been more quick to adopt folding phones than the rest of the world. It will be interesting to see whether Google’s Pixel Fold drives the US foldable market in the coming months. The company is currently taking pre-orders for its first-gen foldable, with sales beginning in late June.

Foldable phones shipment chart Q1 2023


[ad_2]
Source link
1...1,2501,2511,252...1,480Page 1,251 of 1,480