The most interesting security related news from the week of February 20 to 26.
Last week on Malwarebytes Labs:
Stay safe!
Have a burning question or want to learn more about our cyberprotection? Get a free business trial below.
[ad_2]
Source link
The most interesting security related news from the week of February 20 to 26.
Last week on Malwarebytes Labs:
Stay safe!
Have a burning question or want to learn more about our cyberprotection? Get a free business trial below.
OnePlus has confirmed recently that it will launch its first-ever foldable smartphone in the second half of this year. Many people assumed that it will be identical to the OPPO Find N2, but we’ve received conflicting reports regarding that. According to some fresh info from a trusted source, however, the OnePlus Fold will have a similar form factor to the OPPO Find N2, but it won’t be identical.
This information comes from Max Jambor, who is almost never wrong about OnePlus tips. Do note that the phone may not be called the OnePlus Fold, that’s just a guess and a placeholder name.
What does he mean by “similar form factor”? Well, it means that it will lean towards the landscape orientation when unfolded, not vertical like the Galaxy Z Fold 4. That means you won’t have to rotate it when watching video on the main display, for example, to take full advantage of screen real estate.
We’re just not sure how different will it be. There is limited width that OnePlus can use, as the phone cannot be too wide when folded. It may be wider than the OPPO Find N2, though, and thus have a larger form factor, and a larger cover display as a result.
We’ll have to wait and see what exactly is OnePlus planning. It’s nice to see a different approach, though, as OPPO is the only one who decided to try out such a form factor. Also, do note that the OnePlus Fold will be a “flagship phone”, as OnePlus said.
Do note that the Google Pixel Fold is also rumored to utilize this form factor. Google’s first foldable is rumored to be considerably larger than the OPPO Find N2, though, so it will likely be quite a bit wider when unfolded.
In an effort to reduce its reliance on Taiwan and outcompete China in chip manufacturing, the Biden administration has launched the CHIPS for America funding program worth $39 billion. The program’s objective is to establish the US as the primary choice for leading chip manufacturers, with numerous cutting-edge logic fabrications and DRAM manufacturing facilities set up by the decade’s end.
Authorized under the CHIPS and Science act, the Biden administration has divided the program into several rounds of funding opportunities. The first opportunity, which opens for applications on March 31, 2023, will focus on constructing, expanding, or modernizing commercial facilities for the production of current-generation, leading-edge, and mature-node semiconductors.
To ensure that the companies use the funding efficiently and for the right purposes, the government has put guardrails in place. Firstly, companies cannot use the funding for stock buybacks or to pay out dividends. Secondly, payments will be tied to meeting specific milestones to ensure that funding is used in a way that aligns with the program’s vision for success. Finally, companies requesting more than $150 million in funding will need to provide childcare for their construction and factory workers and share part of their profits with the government if they make more than projected.
While the first round funding opportunity focuses on commercial facility construction, the program will introduce additional funding rounds in the spring and fall to increase investment in chip-making materials and research facilities. With Samsung and TSMC already onboard to establish factories across the US, the CHIPS for America funding opportunity is a vital step in boosting the US semiconductor industry and contributing to economic recovery and national security.
“Today’s Notice of Funding Opportunity is a crucial step to unleashing the promise of the CHIPS and Science Act to create good-paying jobs right here at home and end our dangerous dependence on semiconductors manufactured abroad,” said Rep. Frank Pallone Jr. (D-NJ).
In today’s digital age, software development is constantly evolving to meet the demands of an increasingly interconnected world. However, this progress also means that cyber threats are becoming more sophisticated and frequent. As a result, cyber security has become a top priority for software developers across all industries. In this article, we will discuss the top cybersecurity trends in software development.
Traditionally, security has been an afterthought in software development. However, the shift left security approach aims to change this by integrating security practices and tools earlier in the software development process. This helps to identify and address security vulnerabilities before they become costly problems. Shift left security involves implementing security testing, analysis, and feedback loops throughout the development process.
SecDevOps is an extension of the DevOps methodology, which emphasizes collaboration, automation, and continuous delivery. SecDevOps integrates security into the DevOps process to create a more secure software development pipeline. This approach involves involving security teams earlier in the development process, automating security testing and validation, and promoting a culture of shared responsibility for security among all stakeholders.
Zero Trust is a security model that assumes that no device, user, or network is trustworthy by default, and that all access requests must be verified and authenticated before being granted. Zero Trust architecture aims to provide better protection against cyber threats by enforcing strict access controls, continuously monitoring activity, and requiring multi-factor authentication.
Containers are becoming increasingly popular for deploying and scaling applications, but they also introduce new security challenges. Container security involves securing the container images, orchestrator, and runtime environment. This includes implementing container-level access controls, using secure image registries, and ensuring that containerized applications are properly configured and updated.
As more organizations move their applications and data to the cloud, cloud security becomes more important. Cloud security involves securing cloud infrastructure, applications, and data. This includes implementing access controls, using encryption to protect data at rest and in transit, and continuously monitoring cloud environments for suspicious activity.
AI and ML are becoming increasingly popular in cyber security due to their ability to quickly analyze large amounts of data and identify patterns. These technologies can be used to detect and respond to cyber threats, as well as to identify potential vulnerabilities in software code. AI and ML can also be used to improve security awareness training by identifying and targeting employees who are most susceptible to phishing attacks.
In conclusion, cyber security is a top concern for software developers in all industries. The top cyber security trends in software development include shift left security, SecDevOps, zero trust architecture, container security, cloud security, and AI and ML in security. By staying up to date with these trends and implementing appropriate security measures, software developers can help to protect their organizations from cyber threats.
Canadian privacy protection authorities have announced they will start an investigation into TikTok’s privacy practices, especially in relation to its younger users.
The privacy protection authorities for Canada, Québec, British Columbia, and Alberta have announced they will start an investigation into TikTok’s privacy practices, especially in relation to its younger users.
The investigation will include whether the company obtained valid and meaningful consent from its users for the collection, use, and disclosure of their personal information.
The investigation was initiated in the wake of now settled, class action lawsuits in the United States and Canada, as well as numerous media reports related to TikTok’s collection, use, and disclosure of personal information.
TikTok claims to have 1 billion users, and when you look at the age distribution it’s no surprise to see that younger people take up the largest share of users.

Source: App Ape
So, it is understandable that the Canadian regulators put extra emphasis on protecting the privacy of younger users.
Since it is near impossible to determine with whom information is shared, the focus of the Canadian investigation will be to determine if the company is meeting its transparency obligations, particularly when collecting personal information from its users. It will also assess whether the organization’s practices are in compliance with Canadian privacy legislation.
The Chinese-owned platform is under growing Western scrutiny. The FCC has called the app a “unacceptable security risk” and asked it to be removed from app stores.
Because of the suspected ties to the Chinese government, TikTok has been banned from the devices of state employees in several US states. The US Congress passed a ban on downloading TikTok for most government devices, which President Joe Biden signed in late December, and momentum is building among lawmakers to broaden it even further.
Recently, public authorities in the Netherlands were told to steer clear of TikTok. Staff working at the European Commission have been ordered to remove the TikTok app from their phones and corporate devices. In the UK, there is a call for the UK government to follow the European Commission, the EU executive, and the EU Council, and order staff to delete the app.
Last year the state of Indiana filed a lawsuit against TikTok because it found that TikTok’s 12+ rating on the Apple App Store and the “T” for “Teen” rating in the Google Play Store and the Microsoft Store are misleading, since minors are repeatedly exposed to inappropriate content generated by the app’s algorithm.
There have also been concerns that TikTok does not limit its tracking to users of the app.
TikTok said privacy is a top priority. TikTok’s main defense consists of the fact that most of its senior staff are outside of China. In defense of the earliest accusations, TikTok clarified on its blog where its data are stored, saying the data are not subject to Chinese law.
“TikTok is led by an American CEO, with hundreds of employees and key leaders across safety, security, product, and public policy here in the US. We have never provided user data to the Chinese government, nor would we do so if asked.”
A representative for TikTok stated as a response to the announced Canadian investigation that it has tried to set the record straight regarding how the company protects Canadians’ privacy.
We’ll keep you posted on how this develops.
Have a burning question or want to learn more about our cyberprotection? Get a free business trial below.
It’s official, the Nothing Phone (2) will use a Snapdragon 8 series SoC. The company has confirmed that during the Mobile World Congress (MWC) in Barcelona.
The company did it in an interesting way. Its CEO, Carl Pei, posed for a picture with Qualcomm’s CEO, Cristiano R. Amon. They posed with a jersey that had the name of the phone on it, and the number 8 under it.

Nothing’s official Twitter account retweeted that, and flat-out confirmed that the Snapdragon 8 series will be used. That basically means the Nothing Phone (2) will use either the Snapdragon 8+ Gen 1 or the Snapdragon 8 Gen 2 chip.
Your guess is as good as ours, but let’s try to guess. The Snapdragon 8+ Gen 1 is still an immensely powerful chip with excellent power consumption. It could enable Nothing to keep the price lower. The Snapdragon 8 Gen 2 would cost considerably more.
On the flip side, Nothing may be going for the “flagship killer”-esque phone with the Nothing Phone (2), and stuff the Snapdragon 8 Gen 2 on the inside. We do wonder what its price will be in that case.
The Nothing Phone (1) features the Snapdragon 778G+ SoC, so the Snapdragon 8 series chip will be a considerable improvement. The phone is quite affordable at the moment, at €469, but we do expect its successor to cost significantly more
If we had to guess, we’d say that Nothing will go for the Snapdragon 8+ Gen 1 for pricing reasons. There’s also a good chance it may have different plans, so we’ll see.
The Nothing Phone (2)’s design is still a mystery, but Nothing will likely keep to its style. LED lights on the back are expected once again, along with a see-through glass backplate.
In 2022, the number of new mobile banking Trojan installers found by Kaspersky Lab’s cybersecurity researchers surged to 196,476, which is more than twice the number reported in 2021.
This alarming statistic underscores the increasing sophistication and frequency of cyberattacks on mobile devices. The proliferation of mobile banking Trojans has reached an unprecedented level, marking the highest surge observed in the past six years.
The fact that cybercriminals are actively targeting mobile users and prioritizing the theft of financial data is becoming increasingly apparent. This trend is further reinforced by the significant investments being made in the creation of new malware designed to exploit vulnerabilities in mobile devices.
The growing sophistication of these attacks poses a major threat to the financial well-being of their targets, with the potential for significant financial losses.
In 2022, cybersecurity experts uncovered the presence of multiple mobile Trojan subscribers on the Google Play Store. A number of banking Trojan families are still available on Google Play that is disguised as utilities, including:-
Cybersecurity researchers have identified a new mobile Trojan family, known as Harly, that has been active since 2020. This new threat has been added to the list of known mobile Trojan families, which includes Jocker and MobOk.
In 2022, a staggering 2.6 million downloads of Harly malware programs were recorded from Google Play, the official app store for Android devices. In the previous year, cybercriminals took advantage of the Google Play Store to disseminate a range of fraudulent apps that promised enticing incentives, such as:-
The Sharkbot Trojan has been found to be actively distributing downloaders that imitate file manager apps. These downloaders are designed to request permission to install additional packages required for the Trojan to function effectively on the user’s device.
However, granting such permissions could expose the user’s device to potential security breaches, thereby putting their sensitive information at risk.
According to a recent analysis, mobile attacks experienced a gradual decline in the latter half of 2021 and throughout 2022 plateaued at approximately the same level.
In 2022, a significant decline of 1,803,013 malware or unwanted software installers was detected by experts, as compared to the previous year. A total of 1,661,743 malware or unwanted software installers were identified by experts in the past year.
In 2022, the rankings for potentially unwanted software witnessed a shift, with RiskTool-type software taking the lead with 27.39% prevalence. Adware, which was the previous leader, has been replaced and now accounts for 24.05% of the total unwanted software detected.
In comparison to 2021, there has been a significant decrease in the share of RiskTool and adware software in 2022. RiskTool witnessed a decline of 7.89 percentage points, while adware witnessed a more significant decrease of 18.38 percentage points.
Trojan-type malware secured the third position in the rankings, accounting for 15.56% of the total malware detected in 2022. This is a notable increase of 6.7 percentage points from the previous year.
Cybercriminal activity in 2022 did not witness any significant changes, as the attack numbers remained steady after a decrease in the previous year. This indicates that the cybersecurity measures put in place by individuals and organizations are becoming more effective in preventing attacks.
Recommendations
Here below we have mentioned the recommendations offered by the security analysts at Kaspersky:-
Network Security Checklist – Download Free E-Book
When is an iPhone theft not just an iPhone theft? When the user’s Apple ID and more, goes with it.
When is an iPhone theft not just an iPhone theft? When the user’s Apple ID and more, goes with it.
That’s what the Wall Street Journal reports has been happening over recent months. The paper interviewed a handful of people who fell victim to old-school phone theft while out in a bar. But it wasn’t just the phone that was taken.. In minutes, they were also denied access to their Apple accounts and everything attached to them, including photos, videos, contacts, notes, and more.
Some of the victims were robbed of thousands of dollars in the form of drained bank accounts, money taken from Venmo or other money-sending apps, and Apple Pay charges.
Most victims have shared the same story: They are befriended by a small group of two to three people. At some point in the evening, a gang member watches the victim entering their passcode (law enforcement says sometimes members secretly film this process). Then the phone is stolen, usually without the victim noticing.
Some victims say they were physically assaulted and threatened into revealing their passcode. Others believe they were drugged and don’t remember how their phone got swiped.
Once the phone has gone, the thieves log in to the person’s Apple ID and change it to something of their own. None of Apple’s current security features—Face ID and Touch ID—can protect users from thieves who have physical access to a phone and know its passcode. Even the new security key meant to protect Apple IDs doesn’t prevent anyone from making account changes using only a passcode. Surprisingly, a passcode can be used to remove security keys from an account.
Device theft cannot be completely avoided. But, learning from the thieves’ modus operandi, iPhone users can still take steps to minimize the likelihood of them becoming successful targets.
“People forget that what they’re holding in their hand is their entire life,” says Sgt. Robert Illetschko, an investigator on iPhone theft cases in Minneapolis. “If someone has access to it, they can do a lot of damage.”
Thieves use various tactics to get their victim’s passcode. This includes shoulder surfing and surreptitious video recording. When you’re in public, practice keeping your passcode out of prying eyes. One way of doing this is relying on a different lock method, like Face ID and Touch ID. Think of and treat your passcode as an ATM PIN.
Make your passcode one which isn’t easily guessed (so no 1234 here!). Even better if you can use an alphanumeric passcode.
It’s worth taking a look at the security settings in your banking and money transfer apps, and putting the strongest security on them as possible. Venmo, for example, lets users add a passcode—just make sure it isn’t the same as your iPhone.
We’re not referring to Apple’s iCloud Keychain password but a third-party one like 1Password, which offers biometric authentication.
Since thieves can search for “SSN”, “passport”, “license”, and other PII (personally identifiable information), it’s best to not have important files removed from the phone. If you really need to have important documents with you, store them in your third-party password manager.
If you spot your iPhone is missing, sign in to your iCloud using another device and remote wipe your phone as soon as you can. Call your carrier to deactivate your SIM, too, so thieves can’t receive any SMS verification. Finally, change the passwords of any accounts you use on the phone, and revoke all access from devices.
Stay safe!
Have a burning question or want to learn more about our cyberprotection? Get a free business trial below.