Fake Google Chrome Error Screens To Inject Malware

andreasc
-
0
Fake Google Chrome Error Screens To Inject Malware
[ad_1]
Fake Google Chrome Error Screens

Researchers detect a new malware campaign that uses a web page with fake Google Chrome error screens, and the campaign actively distributing malware since Feb 2023.

With the help of social engineering techniques, threat actors trick victims into executing the malware on the system. In this case, several Japanese websites are compromised to distribute the malware.

The Malware eventually drops a Monero miner with the function of the following:

  • Copy itself to C:\Program Files\Google\Chrome under the name updater.exe
  • Launch legitimate conhost.exe and process injection
  • Persisted using task scheduler and registry
  • Windows Defender exclusion settings
  • Stop services related to Windows Update
  • Interfering with communication of security products by rewriting the Hosts file.

Malware Infection Process:

Attackers compromised and defaced several legitimate websites, and the malicious code was injected with the help of the following parameters.

EHA

The link has a mtizndu2 parameter and is supposed to be a lowercase MTIzNDU2 base 64 encoded version of 123456.

In this case, Script tags load and execute JavaScript code of the following and the attackers use some obstruction technique to analyze the code.

The following code has using for this attack:

According to the NTT Data report, “In addition to access control using cookies, the loaded JavaScript code contains a function to narrow down the target and a process to redirect to a URL that displays a fake error screen.”

Attackers also used a Cookie key (c122eba0264bfd7e383f015cecf59fbd) for access control, and the MD5 value is “yagamilight” for the same.

In the Results, victims will see a fake Error screen of the following; JavaScript code downloads a ZIP file.

The Zip file is named as ” chromium-patch-nightly” and pretends to be a patch update for Chrome.

The language of the fake error screen displayed varies depending on the website to be defaced. In addition to Japanese, SOC has confirmed Spanish and Korean and supports multiple languages. Researchers said.

Researchers believe that some of the websites that have been defaced include Japanese websites, and the impact is widespread and serious. It may continue in the future, so be careful.

IoCs

  • 38[.]147.165.60
  • 103[.]150.180.49
  • 156[.]251.189.56
  • 38[.]147.165.50
  • 162[.]19.139.184
  • yhdmb[.]xyz
  • fastjscdn[.]org
  • chromelistcdn[.]cloud
  • chrome-error[.]co
  • xmr.2miners[.]com

Building Your Malware Defense Strategy – Download Free E-Book

Also Read:


[ad_2]
Source link

Sony Xperia 1 V launch timeline revealed; it doesn’t look promising

andreasc
-
0
Sony Xperia 1 V launch timeline revealed; it doesn’t look promising
[ad_1]

The Xperia 1 V is Sony’s upcoming flagship handset, and its launch timeline just surfaced. The thing is, it seems to follow the path the Xperia 1 IV set, and that’s not exactly good. There’s still hope, though. Let me explain.

The Sony Xperia 1 V launch timeline has just been revealed, kind of

This information comes from Zackbuks, a tipster. He shared the info via Weibo. It seems like the Xperia 1 V will launch around the same time as the Xperia 1 IV last year. In other words, it may launch in May, and go on sale in June.

That doesn’t sound too bad, right? In the worst case scenario, it may take over a month for it to get released. Well, the thing is, the Xperia 1 IV launched in June in the UK, but it didn’t arrive in the US until September.

Sony just can’t seem to get itself organized when it comes to smartphone launches. The company has been having such issues for years. Things were even worse with the Xperia 1 III.

The phone got released in China in early June 2021, while it took Sony until mid-August to push it out in the US and the UK. It’s also worth noting that Zackbuks is talking about the Chinese market, and China (and Japan) usually get the company’s phone sooner than others.

Let’s hope Sony learned its lesson

So… what’s the bottom line? Well, we may be in for yet another rather odd release schedule when it comes to Sony’s flagship offering. Sony will hopefully do things differently this time around, but it doesn’t seem like it.

Sony has been making some really compelling phones over the years, and yet… thanks to its release cycle, and odd marketing choices, not many people got them. That’s a bit odd for such a huge company that provides almost every major smartphone out there with camera sensors.

Let’s hope Sony learned its lesson from past years. Let’s hope the Xperia 1 V release timeline will be much different.


[ad_2]
Source link

Exynos 2400 to feature more advanced packaging tech

andreasc
-
0
Exynos 2400 to feature more advanced packaging tech
[ad_1]

After skipping the Exynos 2300, Samsung seems all set to launch the Exynos 2400 later this year. The next-gen flagship Exynos processor will reportedly debut in the fourth quarter of 2023. The Exynos 2200 that powered the Galaxy S22 series in some markets was launched in early 2022.

Samsung skipped the Exynos 2300 likely because its mobile division decided to not use an Exynos processor in the Galaxy S23 series. The 2023 Galaxy flagships are powered by an overclocked version of Qualcomm’s Snapdragon 8 Gen 2 globally. However, the company seems to have found new customers for its flagship chipsets and is now pursuing the Exynos 2400.

According to tipster @Tech_Reve on Twitter, the Exynos 2400 will use FoWLP (fan-out wafer-level packaging) packaging technology. It eliminates the need for a printed circuit board (PCB) in a chip setup. The chips are mounted directly on silicon wafers. The benefit is thinner, higher-performance semiconductors that consume less power. This helps extend the battery life of the device while simultaneously delivering better performance.

The Exynos 2400 could be a deca-core chipset

This isn’t the first time we are hearing about Samsung’s Exynos 2400 plans. Rumors are that it will be a deca-core (ten CPU cores) chipset featuring one ARM Cortex-X4 prime core, two Cortex-A720 high-frequency mid-cores, three Cortex-A720 low-frequency mid-cores, and four Cortex-A520 efficiency cores. That’s all we know as yet about the Exynos 2400. There’s no information on the CPU speeds and the rest of the setup, such as the GPU. Samsung recently extended its partnership with AMD. This hints at an AMD-powered GPU in the Exynos 2400, but there’s no confirmation about it.

However, all rumors have so far hinted at a late 2023 launch for the new Exynos processor. That’s just ahead of next year’s Galaxy S24 launch. While a few reports claimed that Samsung will use the Exynos 2400 in its next-gen flagships, there’s little chance of that happening. The Korean firm is likely to ship the devices with a Snapdragon chip globally. It should once again obtain an overclocked version of the latest Qualcomm processor (Snapdragon 8 Gen 3). The two firms have already signed a multi-year agreement.

Having said all this, it’s still too early for Galaxy S24 and Exynos 2400 rumors. These products are likely in the development stage currently, meaning that Samsung could make changes where it deems them appropriate. We advise you to take this information, including the CPU configuration of the new chipset, with some caution. Stay tuned for more reports confirming or denying these early rumors.


[ad_2]
Source link

The Opera browser on iOS now features a free VPN service

andreasc
-
0
The Opera browser on iOS now features a free VPN service
[ad_1]

VPNs are extremely useful if you don’t want someone to be able to track your internet activity. They create a virtual network on top of the one you’re already using, hiding your real IP address and making you nearly untraceable. However, most VPN services are paid. Many VPN companies let you test their services for free, but at the end of the day, you need to pay real money in order to be untraceable on the web.But today, we have good news for you if you are an iPhone user who wants to use a VPN but doesn’t want to spend cash on one. The iOS version of the Opera browser now features a free VPN service (via 9to5Mac). You only need to download the Opera browser on an iPhone or an iPad running iOS or iPadOS 12.0 or later and enable the new feature. Opera’s VPN service is subscription-free and doesn’t require logging into an account or installing additional extensions.Furthermore, Opera claims that its free VPN feature is a no-log service, meaning it does not collect any personal data or browsing history, ensuring user privacy and security. Opera’s free VPN also comes with a built-in adblocker, which means you will browse the web without any pesky ads popping out on your screen.

Opera has also mentioned that the global rollout of the new free VPN feature on iOS may take a few weeks to reach all users. So, don’t panic if you don’t see the new VPN service on your iPhone’s Opera browser yet.


[ad_2]
Source link

iPhones Hacked Via iOS Zero-Click Exploit To Deploy Spyware

andreasc
-
0
iPhones Hacked Via iOS Zero-Click Exploit To Deploy Spyware
[ad_1]
iOS Zero-Click Exploit

Microsoft Threat Intelligence experts say a threat group is associated with “QuaDream,” an Israeli-based private sector offensive actor (PSOA). 

It employed a zero-click exploit called END OF DAYS to compromise the iPhones of high-risk individuals.

Reports say QuaDream sells a platform called REIGN to governments for use in law enforcement. A collection of malware, exploits, and infrastructure called REIGN is explicitly made to exfiltrate data from mobile devices.

Specifics of the QuaDream’s Spyware

According to Citizen Lab researchers, compromised devices belong to “at least five civil society victims of QuaDream’s spyware and exploits in North America, Central Asia, Southeast Asia, Europe, and the Middle East.

EHA

Bulgaria, Czechia, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates, and Uzbekistan were among the nations where Citizen Lab could identify operators for QuaDream systems.

In a report from Meta from December 2022, QuaDream was referenced. 250 accounts connected to the company were purportedly removed as a result.

The report claims that Meta saw QuaDream testing how to break into iOS and Android mobile devices to ” exfiltrate various types of data, including messages, photos, video and audio files, and geolocation.”

“The captured samples targeted iOS devices, specifically iOS 14, but there were indications that some of the code could also be used on Android devices”, reports Microsoft.

“Victims include journalists, political opposition figures, and an NGO worker. We are not naming the victims at this time.”

Notably, to avoid detection, the surveillance malware used in this campaign, identified by Microsoft as “KingsPawn,” was also built to destroy itself after use and wipe out any traces on the iPhones of victims.

“We found that the spyware also contains a self-destruct feature that cleans up various traces left behind by the spyware itself,” Citizen Lab said.

“Our analysis of the self-destruct feature revealed a process name used by the spyware, which we discovered on victim devices.”

Additionally, spyware has a wide range of functions, such as recording calls and surrounding audio and enabling threat actors to search the victims’ cell phones.

Capabilities of QuaDream’s Spyware

  • Get device information (such as iOS version and battery status)
  • Wi-Fi information (such as SSID and airplane mode status)
  • Cellular information (such as carrier, SIM card data, and phone number)
  • Search for and retrieve files
  • Use the device camera in the background
  • Get device location
  • Monitor phone calls
  • Access the iOS keychain
  • Generate an iCloud time-based one-time password (TOTP)

It’s crucial to practice basic cyber hygiene to avoid mobile device compromise. The latest software updates for the device, enabling automatic software updates if available, installing anti-malware software, and being cautious about not clicking links in any unexpected or suspicious communications are all aspects of specific best practices.

“Lockdown Mode offers enhanced security for iOS devices by reducing the attack surface available to threat actors,” researchers recommend.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus

Related Read:


[ad_2]
Source link

It’s official, the Xiaomi 13 Ultra will launch on April 18

andreasc
-
0
It’s official, the Xiaomi 13 Ultra will launch on April 18
[ad_1]

Xiaomi has officially announced that its new flagship will launch on April 18, we’re talking about the Xiaomi 13 Ultra, of course. That date was mentioned recently by a Chinese retailer, and it turns out that info is true.

The Xiaomi 13 Ultra will launch on April 18, it’s now official

Do note that this is not just a China launch, though. The phone will launch both in China and globally on April 18. Xiaomi’s CEO is sticking to its promise from last year, the Xiaomi 13 Ultra will be available outside of China.

The press event will kick off at 7 PM GMT+8, in other words, at 7 PM China time. That translates to 1 PM CET / noon BST / 7 AM EST / 4 AM PST. Yes, the company will livestream the event, in case you’d like to tune in. We still don’t have the link for it, though, but we’ll share it prior to the event.

Now, the Xiaomi 13 Ultra appeared in CAD-based renders yesterday. Those images basically confirmed the device’s design. Xiaomi essentially confirmed those pics are accurate by sharing images of the Xiaomi 13 Ultra camera module, which you can see below.

The device will include four camera on the back, with Leica lenses

The Xiaomi 13 Ultra will feature a curved display, and a curved backplate. It will also have a huge, circular camera island on the back. Four cameras will sit inside it, and all four will have Leica lenses on top.

Xiaomi is tipped to add a periscope telephoto camera on the Xiaomi 13 Ultra, in addition to the three cameras it used on the Xiaomi 13 Pro. Rumors also mentioned that a variable aperture will be added to the main camera.

The Snapdragon 8 Gen 2 will fuel this handset, while the same 6.73-inch panel from the Xiaomi 13 Pro will be used. That is a 120Hz display, which is curved. LPDDR5X RAM and UFS 4.0 flash storage will also be utilized.

A 4,900mAh battery was mentioned, as was 90W wired, and 50W wireless charging. Yes, you’ll get a charging brick in the retail box. This phone will be IP68 certified, and it will ship with Android 13 out of the box. Xiaomi’s MIUI 14 skin will be included on top of it.


[ad_2]
Source link

OpenAI launches bug bounty program to enhance platform security

andreasc
-
0
OpenAI launches bug bounty program to enhance platform security
[ad_1]

Software vulnerabilities and bugs are a significant challenge for companies, as hackers often use them to gain unauthorized access to sensitive data. Now, in an effort to make its systems more resilient towards these bugs and vulnerabilities, OpenAI has announced a bug bounty program that will reward users for finding security vulnerabilities. The bounty program will run on the Bugcrowd platform and will offer cash rewards of up to $20,000 for exceptional discoveries and $200 for low-severity findings.

OpenAI says that the program will focus on vulnerabilities related to privacy and cybersecurity in the company’s web domains and APIs. Additionally, the company is also interested in discovering weaknesses in how ChatGPT processes user data, which will also include third-party access via its API.

Researchers can report bugs in OpenAI’s Application Programming Interface (API) and ChatGPT directly on the Bugcrowd platform. However, OpenAI has requested researchers to report model issues via a separate form unless they have a security impact. This is because model safety issues require significant research and a broader approach, and they are not discrete bugs that OpenAI can directly fix.

Limitations of the program

The bug bounty program has some limitations, as OpenAI will not accept jailbreaks for ChatGPT or text prompts intended to trick the AI program into violating its own rules. Furthermore, the company will also not accept reports of ChatGPT misbehaving or making up facts under the program.

Although OpenAI’s reward amounts may be lower than other tech giants such as Google and Apple, which can pay up to $2 million for the most severe vulnerabilities, the bug bounty program provides users with an opportunity to contribute to the improvement of the platform and protect themselves and others from potential security risks.

“We invite you to report vulnerabilities, bugs, or security flaws you discover in our systems. By sharing your findings, you will play a crucial role in making our technology safer for everyone,” says OpenAI.


[ad_2]
Source link

Spotify announces new integration with Strava

andreasc
-
0
Spotify announces new integration with Strava
[ad_1]

One of the most popular fitness apps for iOS devices, Strava is finally getting Spotify integration. Starting today, mobile users on any platform can play, pause, resume, skip, and browse Spotify content from the record screen on Strava.

The new integration means that Spotify users will no longer need to switch between apps to listen to their favorite songs while working out. The integration doesn’t just stop at music, it includes podcasts and audiobooks too, which can all be listened to while tracking your workout activities on Strava.

“One of our biggest goals at Spotify is to be everywhere our listeners are – whether that’s on a run, in the gym, or anyplace in between. This integration with Strava is another way we’re moving with our listeners and allowing them to seamlessly connect to the music and audio they love,” said Ian Geller, VP of Business Development at Spotify.

Spotify also revealed some of the top-streamed tracks and artists on user-generated playlists with the terms “workout,” “run,” “exercise,” “cardio,” “cycling,” and “gym” in the United States, the United Kingdom, India, France, Spain, Germany, and Japan between March 1 and March 31.

“I’m Good (Blue)” by Bebe Rehxa and David Guetta, “INDUSTRY BABY (feat. Jack Harlow)” by Lil Nas X and Jack Harlow, and “Unholy (feat. Kim Petras)” by Sam Smith and Kim Petras were some of the top-streamed workout songs from the past month.

“We’re excited to partner with a global leader like Spotify to seamlessly integrate music and movement on the platform. This new feature further solidifies Strava’s position at the center of connected fitness and continues to demonstrate the power of the global community of active people on Strava,” said Mateo Ortega, Strava’s Vice President of Connected Partnerships.

In related news, Spotify has decided to celebrate the important change by allowing Strava to take over its popular Workout playlists starting April 20. This means that Spotify users will be able to listen to Strava-curated sounds next week.


[ad_2]
Source link

KFC owner suffers ransomware-related data breach

andreasc
-
0
KFC owner suffers ransomware-related data breach
[ad_1]

US fast-food corporation Yum! Brands, which owns franchises including KFC, Pizza Hut and Taco Bell, has suffered a data breach following a ransomware attack.

The cyber attack, which took place on January 18, 2023, involved a malicious actor gaining unauthorized access to Yum! Brands’ network. The ransomware attack resulted in approximately 300 restaurants within the UK being temporarily shut down due to the IT systems affected by the attack.

Once discovered, Yum! Brands said the attack “took steps to lockdown impacted systems, notified federal law enforcement authorities, worked with leading digital forensics and restoration teams to investigate and recover from the incident and deployed enhanced 24/7 detection and monitoring technology”.  

After the incident was contained, the fast-food corporation initiated an investigation into the attack to see if any personal data had been stolen. It determined that the files accessed by the malicious actor during the attack contained private customer data.

The data stolen in the breach includes the names and ID card numbers of some customers including driver license numbers. In a notice of the breach sent to those affected, Yum! Brands said there was “no evidence of identity theft or fraud” being committed with the stolen data.

In a report filed with the US Securities and Exchange Commission regarding the attack, Yum! Brands said that it had “incurred, and may continue to incur, certain expenses related to this attack including expenses to respond to, remediate and investigate this matter”. The organization said it “does not expect this event to have a material adverse impact on its business, operations or financial results”. 


[ad_2]
Source link

Unmasking NIS2: Europe’s Secret Weapon Against Cybersecurity Threats – Latest Hacking News

andreasc
-
0
Unmasking NIS2: Europe’s Secret Weapon Against Cybersecurity Threats – Latest Hacking News
[ad_1]

As cyber threats continue to grow, Europe, with its highly digitalized economy, has become a prime target. In fact, the number of cyberattacks on European businesses has soared to unprecedented heights, with a 108% increase in attacks against key sectors since 2020. To combat this alarming trend, the European Parliament has introduced NIS2, a new cybersecurity directive aimed at enhancing the Union’s cyber resilience.

NIS2 brings tighter requirements and a renewed emphasis on risk management and incident response, forever changing the way EU businesses tackle cybersecurity. In this blog post, we’ll delve into the far-reaching consequences of NIS2 for European cybersecurity and provide essential insights to help businesses adapt and thrive in this new regulatory landscape.

Unpacking The NIS2 Directive

NIS2, short for Network and Information Security Directive, is a new EU cybersecurity directive aimed at improving cybersecurity in the European Union. Adopted and entered into force on 16 January 2023, the directive sets out new cybersecurity requirements for organizations categorized as critical infrastructure.

Building on its predecessor NIS1, which was adopted in 2016, NIS2 expands its coverage to include sectors such as energy, transport, healthcare, finance, public administration, water supply, and many more. While the previous directive only focused on so-called essential services and digital service providers, NIS2 eliminates this distinction and instead divides affected entities into two categories: essential entities and important entities, where size, societal function/sector, and annual turnover is the deciding factor for whether NIS2 applies to a given organization.

In addition, NIS2 strengthens requirements for risk management, incident reporting, and cooperation between EU Member States in case of cyber incidents. Overall, NIS2 represents a significant step forward in EU cybersecurity regulations, and organizations that fall under its scope should take note of the new requirements to ensure compliance.

How NIS2 Will Impact EU Cybersecurity

NIS2 is set to have a significant impact on EU cybersecurity by mandating far-reaching security measures to improve risk management and incident response practices, increasing regulatory oversight, and introducing an unprecedented element of management compliance accountability. Some of the ways NIS2 will change EU cybersecurity include:

New cybersecurity requirements for businesses:

  • NIS2 introduces a core set of 10 minimum measures that organization must implement to manage risk, including measures such as access control, incident management, and business continuity management.
  • Businesses are required to conduct due diligence on the security of supply chains to ensure that third-party suppliers also adhere to NIS2 security standards.
  • Early-warning reports must be submitted within 24 hours of an incident.

Increased focus on risk management and incident response:

  • Businesses must develop incident response plans that cover various scenarios and conduct regular security assessments to identify vulnerabilities and weaknesses.
  • Reporting of incidents to competent authorities is required, and must include all relevant information, such as the scope and impact of the incident, the systems and data affected, and the measures taken to contain and mitigate the incident.

Greater regulatory oversight and enforcement:

  • Designated national authorities will be responsible for ensuring compliance with the directive through audits and inspections.
  • The authorities will have the power to request information, conduct investigations, and issue fines or penalties for non-compliance.

Personal liability for management bodies:

  • Management bodies, including directors and senior managers, may face personal liability for cybersecurity incidents resulting from their failure to implement security measures or to respond adequately to a cyber threat.
  • This means that they may be held accountable and face legal or financial consequences for their actions or inactions related to cybersecurity.
  • The personal liability requirement aims to encourage management bodies to take cybersecurity seriously and to prioritize the implementation of appropriate security measures to protect EU citizens’ personal data.

 

NIS2 and EU businesses: Implications and Opportunities

The overall impact of NIS2 on EU businesses is going to be massive.

With an estimated 160.000 affected entities across 15 different sectors, critical infrastructure organizations across all of Europe will have to address this new regulatory reality.

What’s more, all third-party suppliers providing services to these organizations must also meet the new requirements, multiplying the actual number of affected companies. Adding to the seriousness of this major policy change, executive teams will be forced to put cybersecurity on the board agenda because of the unprecedented introduction of management compliance accountability, which makes management bodies personally liable for non-compliance.

These changes will undoubtedly cause a surge in cybersecurity investments, compliance consulting, and relevant cybersecurity training as boards realize the potential business-crippling, legal consequences of negligence and non-compliance.

NIS2 will be a reality check for organizations that have been lacking in their security efforts. The directive will usher in a new security standard that – if widely implemented – will increase European businesses’ ability to withstand the destructiveness of tomorrow’s cyberthreats.

How To Prepare for NIS2

To prepare for compliance with NIS2, European critical infrastructure operators and providers in their supply chain must first conduct comprehensive risk assessments. This will help identify vulnerabilities and weaknesses that needs to be addressed following the new NIS2 standards. It will also provide insights into the effectiveness of existing security measures, which is another crucial element of the new requirements.

Member States have until 17 October 2024 to transpose the directive into national law. This gives affected organizations 16 months to assure that their cyber defense level is on par with the directive’s requirements.

Denmark-based business password management solution, Uniqkey, has published the infosite nis2directive.eu, offering accessible information on NIS2 to the public. The site includes all information relevant to the NIS2 directive, sourced from official, public sources, and curated for easy consumption. They also offer a practical whitepaper on the subject for anyone looking for tangible, tool-specific suggestions for how to achieve NIS2 compliance.

If you’re a European business operating within any of the 15 covered sectors – or providing services to any such organization – getting familiar with the Directive’s requirements will be essential to surviving the upcoming regulatory transition.


[ad_2]
Source link
1...1,3271,3281,329...1,480Page 1,328 of 1,480