Apple is set to announce iOS 17 at WWDC in June, like they generally do. So far, the leaks about iOS 17 have been pretty underwhelming. Stating that it was more of a bug fixing and stability update – which is sorely needed on iOS right now.
But recently, we’ve been seeing more rumors about features coming to iOS 17. And today, there’s a new post over on Weibo detailing some of these changes. Now this poster was accurate about Apple revealing the iPhone 14 in yellow, so there is a track record here, though not a long one.
So what’s new in iOS 17?
So what is actually coming in iOS 17? Well according to this post, here’s what to expect:
Lock Screen font size options
A button to share custom Lock Screen designs with other iPhone users
Apple Music lyrics can be viewed on the Lock Screen
Apple Music design changes with simplified interface
App Library folders can be manually renamed
Control Center design changes
Flashlight brightness slider can be freely adjusted, like the volume slider
Again, nothing really ground-breaking here, and honestly a lot of these could be in a point update. But these are some nice changes to see coming in iOS 17. Particularly the ability to rename folders in the App Library. Since Apple’s sorting is not all that great right now.
This is likely not everything that is going to be new in iOS 17, and we’ll likely see some more leaks ahead of WWDC in June. Since we’re still a little over a month away at this point.
Apple will release the first developer beta for iOS 17 following the WWDC keynote on June 5. With the first public beta coming a month later, normally. And of course, the full rollout will come in September. Generally a few days before the new iPhone actually goes on sale. It’s normally between the iPhone announcement and launch.
A fresh set of Git releases was made available to fix several security flaws. It gives attackers the ability to execute arbitrary code upon successful exploitation. Upgrades are advised for all users.
View of the Most Recent Batch of Releases On GitHub
To resolve two security flaws that affected versions 2.40.0 and earlier, CVE-2023-25652 and CVE-2023-29007, the Git project issued new versions.
Reports say new versions of the Git for Windows project were released with fixes for these five vulnerabilities.
“To protect against CVE-2023-25652 and CVE-2023-29007, users are encouraged to upgrade immediately”, GitHub reports.
With git apply –reject, the former may carry out controlled content writes at arbitrary paths.
The latter might be used to insert arbitrary configuration settings, which could execute arbitrary code.
The Windows-specific vulnerabilities affect users on multi-user computers, users working in Git CMD, and users using the SOCKS5 proxy connect.exe included in the Git for Windows distribution. Additionally, those who fit these categories are urged to upgrade immediately.
Upgrade To the Most Recent Git Release
GitHub suggests that the best defense against these vulnerabilities is an upgrade to Git 2.40.1. GitHub has taken severe measures to defend users from these attacks. Particularly,
It has scheduled a GitHub Desktop update that stops the exploitation of this vulnerability for release on April 26th, 2023.
Scheduled updates to upgrade the versions of Git used by GitHub Codespaces and GitHub Actions.
If you are unable to update right away, minimize your risk by doing the following:
Avoid using git apply –reject when working with patches from untrusted sources. Use git apply –stat to inspect a patch before applying it.
Avoid running git submodule deinit, git config –rename-section, and git config –remove-section on untrusted repositories or without prior inspection of your $GIT_DIR/config.
You can lower your risk on Windows by carrying out the following actions:
Avoid using Git for Windows on machines with shared accounts. Otherwise, create empty C:\mingw64 and C:\etc folders, and remove any write permission on them.
Avoid using Git CMD; if doing so is impossible, ensure it is started from a trusted directory.
“GitHub itself is not affected by these vulnerabilities. We do not use git apply –reject, nor Git’s configuration mechanism. GitHub does not use Git for Windows, and is thus not affected by those vulnerabilities, either”, GitHub said.
When you hear about malware, there’s a good chance you think of sketchy executables or files with extensions like .DOCX or .PDF that, once opened, execute malicious code. These are examples of file-based attacks—and while they can be bad, they’re nothing compared to their fileless cousins.
As the name suggests, fileless attacks don’t rely on traditional executable files to get the job done but rather in-memory execution, which helps them evade detection by conventional security solutions.
In this post, we’ll explore topics like how fileless attacks work, why they’re effective, and what you can do to find and block fileless threats.
Fileless attacks explained
In contrast to file-based attacks that execute the payload in the hard drive, fileless attacks execute the payload in Random Access Memory (RAM). Executing malicious code directly into memory instead of the hard drive has several benefits, such as:
Evasion of traditional security measures: Fileless attacks bypass antivirus software and file signature detection, making them difficult to identify using conventional security tools.
Increased potential for damage: Since fileless attacks can operate more stealthily and with greater access to system resources, they may be able to cause more damage to a compromised system than file-based attacks.
Memory-based attacks can be difficult to remediate: Since fileless attacks don’t create files, they can be more challenging to remove from a system once they have been detected. This can make it extra difficult for forensics to trace an attack back to the source and restore the system to a secure state.
Fileless attacks vs Living-off-the-land (LOTL) attacks
LOTL attacks are anytime an attacker leverages legitimate tools to evade detection, steal data, and more, while fileless attacks refer purely to executing code directly into memory. While both types of attacks often overlap, they are not synonymous.
Think of fileless attacks as an occasional subset of LOTL attacks. Fileless attacks can and often do leverage LOTL techniques to execute payload into memory, but they can also do so without leveraging a legitimate system tool or process at all.
PowerShell script extracted from a Microsoft Word document. If macros are enabled, it would execute the code in memory upon being opened. Source.
For example, an attacker can use PowerShell to download and execute a malicious payload directly in memory, without writing it to the disk. In this case, the attack is both LOTL (since PowerShell is a legitimate tool) and fileless (as the payload is executed in memory).
On the other hand, an attacker injecting malicious JavaScript into a website can exploit browser vulnerabilities and execute payloads in memory. This fileless attack executes code without writing to the hard drive, but doesn’t qualify as LOTL as it doesn’t use a legitimate system tool or process.
5 different ways fileless attacks execute code in memory
Once an attacker gains access through phishing or exploiting vulnerabilities, they can execute malicious code in memory using several methods, some of which may overlap with LOTL techniques.
Below are five common techniques used in fileless attacks:
PowerShell: A legitimate scripting that can execute malicious code directly in memory. As mentioned earlier, this technique overlaps with LOTL attacks as it leverages a built-in system tool.
Process hollowing: Process hollowing is a fileless technique where attackers create a new process in a suspended state, replace its memory content with malicious code, and then resume the process. The malicious code executes in memory without writing to the disk.
Reflective DLL injection: In this fileless attack, attackers load a malicious Dynamic Link Library (DLL) into a legitimate process’s memory without writing it to the disk. The DLL is executed directly in memory, evading detection by traditional security software.
JavaScript and VBScript: Fileless attackers can use JavaScript or VBScript to run malicious code directly in memory within a web browser or other applications that support these scripting languages.
Microsoft Office macros: Fileless attackers can use malicious macros embedded in Microsoft Office documents to execute code in memory when the document is opened. This method takes advantage of the legitimate macro functionality, making it an example of an LOTL technique as well.
Note that fileless attacks often rely on exploiting vulnerabilities in system components in each of these instances (such as Office or web-browsers) to execute their code.
Preventing and spotting fileless attacks: Quick tips
Prevention Method
Description
Keep software and systems updated
Regularly update your operating systems, applications, and security software to patch vulnerabilities that could be exploited by fileless attackers.
Regularly review security logs
Examine security logs for unusual activity or patterns that could indicate a fileless attack, such as unexpected PowerShell usage or excessive network connections.
Employ behavioral analytics
Use advanced threat detection tools that employ behavioral analytics to identify and block fileless attacks based on their unique behavior patterns.
Restrict macro usage
Limit the use of Microsoft Office macros by disabling them or allowing only digitally signed and trusted macros.
Malwarebytes EDR and Exploit Protection: Safeguarding against fileless attacks
Malwarebytes Exploit Protection can effectively block many fileless attacks by monitoring and reinforcing application behavior, hardening applications, and ensuring advanced memory protection.
To configure Exploit Protection Advanced settings, follow these steps:
Exploit Protection settings in a policy in Malwarebytes EDR.
Here’s an overview of the protection layers offered by Malwarebytes EDR Exploit Protection:
Application Hardening: By enforcing security measures like DEP and ASLR, and disabling potentially vulnerable components like Internet Explorer VB Scripting, Application Hardening reduces the attack surface and makes it more difficult for fileless malware to exploit weaknesses in applications.
Advanced Memory Protection: This layer prevents fileless malware from executing payload code in memory by detecting and blocking techniques such as DEP bypass, memory patch hijacking, and stack pivoting, thereby stopping the attack before it can cause harm.
Application Behavior Protection: This layer also detects and blocks exploits that do not rely on memory corruption, such as Java sandbox escapes or application design abuse exploits. Options include Malicious LoadLibrary Protection, Protection for Internet Explorer VB Scripting, Protection for MessageBox Payload, and protection against various Microsoft Office macro exploits.
Java Protection: These settings protect against exploits commonly used in Java programs. By guarding against Java-specific exploits, such as web-based Java command execution and Java Meterpreter payloads, Java Protection can effectively prevent fileless attacks that leverage Java vulnerabilities to infiltrate systems and execute malicious code.
Fighting fileless threats with Malwarebytes EDR: Configuring Suspicious Activity Monitoring in Nebula
Malwarebytes Endpoint Detection and Response (EDR) offers an effective solution to detect and mitigate fileless malware threats by monitoring potentially malicious behavior on endpoints. The Suspicious Activity Monitoring feature in Nebula uses machine learning models and cloud-based analysis to detect questionable activities. In this section, we will outline how to configure Suspicious Activity Monitoring in Nebula.
To enable Suspicious Activity Monitoring in your policy:
Log in to your Nebula console.
Navigate to Configure > Policies.
Click “New” or select an existing policy.
Choose the “Endpoint Detection and Response” tab.
Locate “Suspicious Activity Monitoring” and enable it for the desired operating systems.
Suspicious Activity monitoring detections in Nebula showing a possible fileless attack. On the right, we see the command line context for this process in our organization.
Advanced Settings offer additional options for activity monitoring. To configure these settings:
In the same “Endpoint Detection and Response” tab, find the “Advanced Settings” section.
Enable “Server operating system monitoring for suspicious activity” to extend monitoring to server operating systems.
Enable “Very aggressive detection mode” to apply a tighter threshold for flagging processes as suspicious.
Toggle “Collect networking events to include in searching” to ON (default) or OFF, depending on your preference. Turning it OFF decreases traffic sent to the cloud.
Flight Recorder Search
Flight Recorder Search collects all endpoint events within its search functionality. By configuring Suspicious Activity Monitoring in Malwarebytes EDR through the Nebula platform, you can effectively counter fileless malware threats by monitoring processes, registry, file system, and network activity on the endpoint.
Respond to fileless attacks quickly and effectively
Managed Detection and Response (MDR) services provide an attractive option for organizations without the expertise to manage EDR solutions. MDR services offer access to experienced security analysts who can monitor and respond to threats 24/7, detect and respond to fileless attacks quickly and effectively, and provide ongoing tuning and optimization of EDR solutions to ensure maximum protection.
Samsung has made it a habit of releasing the latest monthly security patches way ahead of schedule. It often starts pushing a new security update several days before we hit the new month. The Korean behemoth has done it again. It has begun seeding the May 2023 Android security patch to its Galaxy devices. But unlike most past instances, the company is starting with an entry-level model this time around. The Galaxy A10e is picking up the May SMR (Security Maintenance Release) ahead of flagship models.
The May update for the Galaxy A10e is currently available for users in Samsung’s home country South Korea. The rollout began earlier this week with the firmware build number A102NKOS3CWD1, SamMobile reports. Since May is still a few days away, we don’t have details of the patch. It’s unclear which vulnerabilities have been fixed with the latest monthly security release for Android devices. As usual, there should be several dozen fixes here, including a few Galaxy-specific ones coming directly from Samsung.
Don’t expect anything apart from the latest security fixes, though. Samsung launched the Galaxy A10e in July 2019. The entry-level smartphone is now in its last legs (fourth year in the market). It stopped receiving major Android updates since Android 11 and will soon stop getting security patches too. The May SMR could be the penultimate update for it. The 2019 handset isn’t covered under the Korean firm’s extended update policy that promises five years of security updates for Galaxy devices.
Nonetheless, if you’re using the Galaxy A10e, you may receive the May update sooner or later. It’s not guaranteed, though. Samsung may not push the May SMR to this phone outside of South Korea. The US version recently received the April update (firmware version A102USQSFCWC3 for carrier-locked units and A102U1UESFCWD1 for unlocked units), which never reached the company’s homeland. It may now skip the May release in other markets. As usual, you can check for new updates from the Settings app on your phone.
Samsung will soon release the May update for other Galaxy devices
The Galaxy A10e may not get the May update everywhere but Samsung will soon release the latest SMR for other Galaxy devices. Despite beginning with a budget handset, flagship models should still get the priority once it starts a wider rollout. The Galaxy S23 series should sit high on this priority list, though not necessarily at the top. We will let you know as and when these updates come.
It’s no secret that over the past few years, threat actors have become more sophisticated in their efforts to scam people of their hard-earned money and steal personal information. One of the methods which the threat actors have recently been using to infiltrate systems is the CryptBot malware. This malicious software steals sensitive information such as passwords, cookies, and credit card information and sells it to other malware makers and distributors. However, Google has finally taken action and disrupted the malware’s infrastructure and distributors.
In the blog post announcing the decision, Google revealed that the CryptBot malware, which spread through malicious apps such as a fake Google Chrome and Google Earth Pro, infected around 670,000 computers last year, compromising users’ personal information and selling it for data breach campaigns. However, Google’s recent action will help prevent new infections and slow the malware’s growth.
“Lawsuits have the effect of establishing both legal precedents and putting those profiting, and others who are in the same criminal ecosystem, under scrutiny. This litigation is another step forward in holding cybercriminals accountable, by not just targeting those that operate botnets, but also those that profit from malware distribution,” reads the company’s blog post.
How did Google take down the malware?
Google’s actions against the malware came after the company identified the malware’s Pakistan-based distributors with the help of its Threat Analysis Group (TAG) and took legal action against them. Google filed a legal complaint against many major CryptBot distributors and secured a temporary court order to hamper the developers’ ability to spread the malware. With the order, Google was able to take down the current and future domains linked to the distribution of the malware.
While Google’s action against the malware distributors is commendable, considering its brand identity was at stake, the incident highlights the need for users to take necessary precautions while browsing the web. These include downloading apps and software from credible sources, keeping operating systems up to date, and installing antivirus software.
It’s hard to put individuals at fault when the malicious copy is better than the original. This credit card skimmer was built to fool just about anyone.
To ensnare new victims, criminals will often devise schemes that attempt to look as realistic as possible. Having said that, it is not every day that we see the fraudulent copy exceed the original piece.
While following up on an ongoing Magecart credit card skimmer campaign, we were almost fooled by a payment form that looked so well done we thought it was real. The threat actor used original logos from the compromised store and customized a web element known as a modal to perfectly hijack the checkout page.
While the technique to insert frames or layers is not new, the remarkable thing here is that the skimmer looks more authentic than the original payment page. We were able to observe several more compromised sites with the same pattern of using a custom-made and fraudulent modal.
This skimmer and associated campaigns represent one of the most active Magecart attacks we have been tracking in recent months.
Smooth checkout
We identified a compromised online website for a Parisian travel accessory store running on the PrestaShop CMS. A skimmer we previously identified as Kritec, was injected and loading malicious JavaScript that altered the checkout process. In the following section, we will compare the checkout process when the skimmer is active and when it is not.
Fraudulent payment form
What we see here is the use of a ‘modal‘ which is a web page element displayed in front of the current active page. The modal disables and grays out the background so that the user can focus on the presented element instead. This is an elegant way for website owners to keep their customers on the same web site and have them interact with another form.
Figure 1: Compromised store loads fake payment modal
The problem is that this modal is entirely fake and designed to steal credit card data. It may sound hard to believe given everything matches to the original brand and feel of the site. Before digging further into why it is fraudulent, we will take a look at the same online store when the skimmer has been disabled.
Actual (real) payment form
In order to view this legitimate sequence, we first had to block the skimmer when requesting the e-commerce page. In our case, we simply blocked the connection to the malicious domain where the skimmer is hosted. As a result, the website will display what the original payment form should be (prior to the compromise).
Figure 2: Legitimate payment form when same store is not compromised
The actual payment flow for this merchant is to redirect users to a third-party processor hosted by Dalenys, now part of Payplug, a French payment solutions company. So rather than display a modal, it loads the webpage for the payment processor to allow the user to enter their banking information. Once that is validated, it will take them back to the merchant page.
Malicious modal
The malicious modal is built very cleanly and contains an animation that displays the store’s logo in the middle and then moves it back up. We have to give credit where credit is due: this is a very well done skimmer that is actually a smoother user experience than the store’s default. We should also note that the malware author is not only well versed in web design, they also use proper language (French) for each form field.
Figure 3: A closer look at the fake modal
However, we noticed a small mistake in the hyperlink for Politique de confidentialité (terms of use). That link redirects to the terms of use for Mercardo Pago, a payment processor used in South America. It is likely the threat actor copied the data from a previous template and did not notice their mistake. This is just a detail, and does not affect the functionality of the skimmer at all.
We can try to look for this erroneous hyperlink within the skimmer source code in order to confirm that the modal was created by the threat actor. The skimmer is rather complex and heavily obfuscated but we can see that HTML content is generated dynamically and goes through a decodeURIComponent routine.
Figure 4: Extracting code from the skimmer to reveal connection with the modal
If we step through the code until the modal is loaded, we can grabbing the Base64 value corresponding to the HTML content. One we have it, we can convert it to plain text and finally see the reference to mercadopago, that is proof that the skimmer is the one rendering this beautiful modal. In fact, we can see the whole thing is an iframe called v.ECPay:
Figure 5: The iframe created by the skimmer to display the modal
Full payment flow
We recreated the payment flow from the perspective of a customer shopping via that compromised store. We can see that upon selecting the credit card payment option, the malicious modal is loaded and will harvest their payment card details.
A fake error is then displayed briefly “votre paiment a été annulé” (your payment was cancelled) before the user is redirected to the real payment URL:
Figure 6: Payment process flow with the skimmer active
On the second attempt, the payment will go through and victims will be unaware of what just happened.
The skimmer will drop a cookie which will serve as an indication that the current session is now marked as completed. If the user was to go back and attempt the payment again, the malicious modal would no longer be displayed (instead the real payment method by the external processor Dalenys will be used).
Figure 7: Cookie dropped by skimmer once data has been stolen
Ongoing, covert campaigns
We now believe this Kritec skimmer is part of the same compromises with injections into vulnerable websites where malicious code is placed within the Google Tag Manager script. It is possible multiple threat actors are involved in those campaigns and customizing skimmers accordingly.
While many hacked stores had a generic skimmer, it appears the custom modals were developed fairly recently, maybe a month or two ago. The threat actor is using different domains to host the skimmer but names them in a similar way: [name of store]-loader.js.
We crawled several thousand e-commerce sites and found more fraudulent modals, in different languages.
Figure 8: A Dutch e-commerce site with the fake modal
Figure 9: A Finnish e-commerce site with the fake modal
Discerning whether an online store is trustworthy has become very difficult and this case is a good example of a skimmer that would not raise any suspicion.
If you are a Malwarebytes customer, you will get a notification and block when attempting to make a purchase from a store that has been compromised by this skimmer.
Whether you are visiting an online store from home or while at work, web protection is a critical layer in your overall defense. Malwarebytes Premium for consumers and Endpoint Protection for businesses provide real-time protection against threats like Magecart.
The Xiaomi 13 Ultra is one of the hottest new phones on the market. In this article, we’ll compare it with the best Apple has to offer. We’ll compare the Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra. These two smartphones are both great, but in entirely different ways, as they’re quite different. That not only applies to their designs, but everything in between, pretty much. So, there’s a lot to talk about here.
We’ll kick things off by listing their specifications, and will then move to a number of other categories. You’ll get to see their designs compared, and the same goes for their displays, performance, battery life, cameras, and audio performance. Having said that, let’s get this party on the road, shall we?
Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra: Design
These two devices do look considerably different no matter what side you’re looking at them. They also feel entirely different in the hand. The iPhone 14 Pro Max is made out of metal and glass. The Xiaomi 13 Ultra, on the other hand, is made out of metal, with a layer of vegan leather on the back. That vegan leather does not cover the entirety of the backplate, even though it does cover most of it. It does not curve into the frame on the sides, though, that frame extends to the back, to a degree. It’s kind of difficult to explain. The upper portion of the phone’s back side is also higher than the bottom one. The backplate gradually increases in thickness to make the camera bump less pronounced.
The Xiaomi 13 Ultra is slightly taller than the iPhone 14 Pro Max, while it’s noticeably narrower. It’s also thicker than iPhone’s offering. The iPhone 14 Pro Max is 13 grams heavier, though both of these phones are quite hefty in the hand. They do have flat sides too. The flat surface on the iPhone 14 Pro Max definitely does take more space than on the Xiaomi 13 Ultra, as far as their sides are concerned. The Xiaomi 13 Ultra is a lot less slippery in comparison, and it also cuts into your hand less when you hold it. That’s a combination of the design and the fact it’s lighter than the iPhone 14 Pro Max.
Apple’s handset has a pill-shaped cutout on the front, and uniform bezels. The Xiaomi 13 Ultra has extremely thin bezels, and a display camera hole. The iPhone 14 Pro Max has a flat display, while Xiaomi’s flagship offers a curved one. When we flip the two phones around, even more differences are noticeable. Apple’s handset has three cameras on the back, organized in a camera island placed in the top-left corner. The Xiaomi 13 Ultra has a huge camera bump on the back, with four cameras included inside it. That camera bump is centered in the upper portion of the phone’s backplate. Both phones do feel premium in the hand, and both are IP68 certified for water and dust resistance.
Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra: Display
The iPhone 14 Pro Max has a 6.7-inch 2796 x 1290 LTPO Super Retina XDR OLED display. This panel has a 120Hz refresh rate, which is adaptive. It supports HDR10 content, and it also comes with Dolby Vision support. We’re looking at a 19.5:9 aspect ratio here, while this display goes up to 2,000 nits of brightness at its peak. This panel is protected by the Ceramic Shield glass, and it’s flat.
The Xiaomi 13 Ultra, on the flip side, includes a 6.73-inch QHD+ (3200 x 1440) LTPO AMOLED display. This panel is curved, and it can project up to 1 billion colors. It supports HDR10+ content, and also comes with Dolby Vision support. It has a 20:9 display aspect ratio, and it can get immensely bright at 2,600 nits of peak brightness. This panel is protected by the Gorilla Glass Victus.
Let me just say that both of these displays are fantastic, to say the least. These are some of the best panels on the market. They’re bright, vivid, sharp, and offer great viewing angles. The blacks are deep, and the touch response is really good. The Xiaomi 13 Ultra’s panel does look a bit better on paper, but that’s, for the most part, not the difference you’ll notice. Both panels do get extremely bright outdoors, and both will be more than sufficient to use in bright daylight, even under direct sunlight. These panels are outstanding.
Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra: Performance
Apple’s flagship is fueled by the Apple A16 Bionic SoC, while the phone comes with 6GB of RAM and NVMe storage. The Xiaomi 13 Ultra, on the other hand, is fueled by the Snapdragon 8 Gen 2 processor. It includes up to 16GB of LPDDR5X RAM and UFS 4.0 flash storage. These two processors are basically the best two mobile SoCs on the market at the moment. When it comes to RAM and storage, Xiaomi’s handset is more powerful.
What is the performance like, though? Well, outstanding, in both cases. These two phones do come with significantly different software builds, and software experiences, but the general performance, in terms of fluidity, it’s great. Both phones are buttery smooth regardless of how you’re using them. That goes for regular everyday tasks, and even gaming. Even the most demanding games on their respective app stores cannot slow down these two phones, they’re that great in terms of performance. So, that’s not something you have to worry about.
Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra: Battery
The iPhone 14 Pro Max packs in a 4,323mAh battery. The Xiaomi 13 Ultra, on the other hand, has a 5,000mAh battery on the inside. Do note that iPhones need less battery capacity to deliver similar battery life due to different software. In any case, both of these smartphones do offer great battery life. They’ll last until the end of the day for the vast majority of you. Gaming and similar tasks can, of course, affect battery life more.
Reaching the 8-hour screen-on-time mark on the Xiaomi 13 Ultra is not a problem at all. I was able to get there most days, or would have been able to if I used the phone as much. I was even left with some battery life in the tank at that point. The iPhone 14 Pro Max did not do as great at launch, but things improved with updates. It can now also go over that point, and offers every better results at times. They’re mostly on the same playing field in terms of battery life, though.
Charging is another story entirely. The Xiaomi 13 Ultra completely destroys the iPhone 14 Pro Max in that regard. Xiaomi’s flagship not only supports 90W wired, 50W wireless, and 10W reverse wireless charging, but it also packs in a 90W charger in the box. The iPhone 14 Pro Max supports 20W wired, 15W MagSafe wireless, and 7.5W Qi wireless charging, and it does not offer a charger in the box.
Apple iPhone 14 Pro Max vs Xiaomi 13 Ultra: Cameras
The iPhone 14 Pro Max has three cameras on the back. A 48-megapixel main camera is backed by a 12-megapixel ultrawide unit (120-degree FoV), and a 12-megapixel telephoto camera (3x optical zoom). The Xiaomi 13 Ultra carries four 50-megapixel cameras on the back. It has a 50-megapixel main camera (1-inch sensor), a 50-megapixel ultrawide camera (122-degree FoV), a 50-megapixel telephoto unit (3.2x optical zoom), and a 50-megapixel periscope telephoto camera (5x optical zoom, 100x digital zoom). Xiaomi’s flagship also comes with Leica lenses, and some software too.
These two devices produce rather different pictures. During the day, they’re both outstanding. The images from the iPhone tend to have a slightly warmer tone, but both results are very sharp, and detailed. The Xiaomi 13 Ultra does handle HDR situations a bit better, but only at times when the iPhone 14 Pro Max decides to mess up the white balance. That’s still an issue from time to time.
In low light, the Xiaomi 13 Ultra takes the cake. That is especially noticeable when you zoom into shots and see how much more detail that phone provides. I’m talking about the main camera, of course. Its sensor allows for way more light to enter the scene, and the software does a good job of balancing that, almost every time. The ultrawide camera performance is also better in low light, and the same goes for the telephoto camera. You’ll see more details across the board.
The iPhone 14 Pro Max still does an amazing job, though, and many people may actually prefer those results. When it comes to video recording, we’d give a slight advantage to Apple, even though the Xiaomi 13 Ultra is almost on par in that regard. It does a better job in low light, that’s for sure, which is especially noticeable when you’re panning around.
Audio
There is a set of stereo speakers on each of these two devices. Those speakers do a good job in both cases, but the Xiaomi 13 Ultra has the edge. The sound sounds a bit more detailed, and there’s also more bass here. These speakers also do get a bit louder.
What you will not find on either phone is an audio jack. You’ll have to use the Lightning port on the iPhone 14 Pro Max, and a Type-C port on the Xiaomi 13 Ultra if you’d like to achieve a wired audio connection. If you’d rather go wireless, Bluetooth 5.3 is available on both phones.
Ever since the start of the AI revolution with the launch of ChatGPT and its subsequent integration into the Edge browser as the Bing AI chatbot, Microsoft has been striving to improve the service and provide a better browsing experience for its users. However, the latest version of Microsoft Edge has come under scrutiny as recent reports suggest the browser may be leaking users’ browsing data to Bing without their knowledge or consent.
The issue was first discovered by Reddit user hackermchackface, who noticed that the Edge browser sent a request to bingapis.com with the full URL of nearly every page they navigated to. Therefore, raising some serious privacy concerns.
The real cause behind the issue?
Although the Edge browser sending a request to Bing and leaking users’ browsing data was a privacy concern, upon further investigation, Rafael Rivera, a software engineer, found that the real culprit behind the issue was Edge’s new “follow” feature. He explained that the feature, which allows users to keep track of their favorite creators, such as their websites, YouTube channels, and other social media accounts, is somehow not functioning correctly and sending nearly every domain that a user visits to Bing.
Speaking on the concerns, Caitlin Roulston, director of communications at Microsoft, stated that they are aware of the reports and are investigating the issue. However, the company is yet to come out with an explanation as to why Edge was sending URLs to bingapis.com.
Disable Edge’s “follow” feature
Until Microsoft comes out with a solution to fix the issue, users should turn off the “follow” feature. To do this, head over to Settings > Privacy, Search, and Services > Services and click on the toggle for “Show suggestions to follow creators in Microsoft Edge.” This will prevent Edge from sending URLs to Bing, thus protecting users’ privacy.
YouTube Music has officially launched a podcast feature for listeners in the United States, offering a new way for users to access their favorite shows and discover new ones. The feature is rolling out on the YouTube Music app, both on iOS and Android, and allows users to access a variety of podcasts across a range of genres. The announcement was made today via a YouTube Community post, making the feature official since it was reported that it was in testing phases back in February and announced to the media later that same month.
With the new podcast feature, YouTube Music is expanding its content offerings beyond music to include spoken-word content. This move is in line with the growing popularity of podcasts in recent years, as listeners seek out new forms of entertainment and information. By offering podcasts, YouTube Music hopes to attract more users to its platform and keep existing users engaged.The launch of podcasts on YouTube Music comes at a time when the podcast market is experiencing significant growth and the main YouTube app serving podcasts in the interim. As a listening experience that complements the podcast video experience on YouTube, this presents a significant opportunity for YouTube Music to tap into the growing demand for podcasts and expand its audience reach.
To access podcasts on YouTube Music, users simply need to search for their favorite shows or browse by category. New podcast recommendations and unfinished episodes will be accessible on the Home tab where you can filter by tapping “Podcasts” at the top of the home screen. The platform offers a range of categories, including: business, comedy, gaming, health & fitness, music, society & culture, and true crime. Users can also discover new shows through personalized recommendations based on their listening history and preferences.
Podcasts that were previously available in the main YouTube app will also be in YouTube Music, where they will be available on-demand, when offline, or while casting. You will also be able to effortlessly transition between the audio and video versions of a podcast, just as you can do now with music and music videos.
The podcast listening experience is different from the music listening experience on YouTube Music in that you do not need to have a Premium or Music Premium subscription in order to access some of the features. For those that are Premium subscribers, do note that the ad-free experience does not extend to host-read endorsements or sponsorship messages in podcasts.
As of right now, Podcasts on YouTube Music are only available in the United States. However, this may change in the future, according to the announcement. The feature is also rolling out gradually, so you may not see it in your YouTube Music app right away.
VMware Workstation, Workstation Pro, and Fusion have been subjected to several privately reported and fixed flaws. VMware has published a security advisory on the critical bugs discovered and their workarounds.
CVE(s):
CVE-2023-20869 – Stack-based buffer-overflow vulnerability in Bluetooth device-sharing functionality
CVE-2023-20870 – Information disclosure vulnerability in Bluetooth device-sharing functionality
CVE-2023-20871 – VMware Fusion Raw Disk local privilege escalation vulnerability
The severity of these CVEs varies from 7.1 to 9.3. However, VMware has released a patch for all the affected versions.
CVE-2023-20869 – Stack-based buffer-overflow vulnerability in Bluetooth device-sharing functionality
CVSS Score: 9.3
To exploit this, a threat actor must have local admin privileges on the virtual machine. Exploitation leads to the execution of code using VMware’s VMX process on the host machine.
Affected Products and Fixed Versions
CVE-2023-20870 – Information disclosure vulnerability in Bluetooth device-sharing functionality
CVSS Score: 7.1
To exploit this, a threat actor must have local admin privileges on the virtual machine. Exploitation leads to the reading of privileged information on VMware’s hypervisor memory used for isolating virtual machines from each other. This memory includes CPU utilization, OS on the virtual machine, memory utilization, and much more.
Affected Products and Fixed Versions
VMware Workstation Pro / Player (Workstation) – Fixed in 17.0.2
VMware Fusion – Fixed in 13.0.2
CVE-2023-20871 – VMware Fusion Raw Disk local privilege escalation vulnerability
CVSS Score: 7.3
To exploit this, a threat actor must have read/write access to the host machine. Exploitation leads to gaining root access to the host operating system.
To exploit this, a threat actor must have a virtual machine with a Physical CD/DVD drive attached and a SCSI controller configured with the host machine. Exploitation leads to the execution of code in VMware’s hypervisor memory from the virtual machine. The threat actor does not need local admin privilege for this vulnerability.
Affected Products and Fixed Versions
VMware Workstation Pro / Player (Workstation) – Fixed in 17.0.1
Furthermore, two of these vulnerabilities (CVE-2023-20869, CVE-2023-20870) were initially discovered and reported by STAR Labs on the Pwn2Own 2023 held at Vancouver in March 2023. The reward provided for these zero days was $80,000.
PowerShell script extracted from a Microsoft Word document. If macros are enabled, it would execute the code in memory upon being opened. 
Exploit Protection settings in a policy in Malwarebytes EDR.
Suspicious Activity monitoring detections in Nebula showing a possible fileless attack. On the right, we see the command line context for this process in our organization.
Figure 1: Compromised store loads fake payment modal
Figure 2: Legitimate payment form when same store is not compromised
Figure 3: A closer look at the fake modal
Figure 5: The iframe created by the skimmer to display the modal
Figure 6: Payment process flow with the skimmer active
Figure 7: Cookie dropped by skimmer once data has been stolen
Figure 8: A Dutch e-commerce site with the fake modal
Figure 9: A Finnish e-commerce site with the fake modal
Figure 10: Skimmer being blocked by Malwarebytes
