Aembit Selected as Finalist for RSA Conference 2024 Innovation Sandbox Contest

andreasc
-
0
Aembit Selected as Finalist for RSA Conference 2024 Innovation Sandbox Contest
[ad_1]

Silver Spring, United States / Maryland, April 3rd, 2024, CyberNewsWire

The Leading Company for Securing Access Between Workloads Recognized for the Aembit Workload IAM Platform

Aembit, the Workload Identity and Access Management (IAM) Company, has been named one of the Top 10 Finalists for the RSA Conference™ 2024 Innovation Sandbox contest for its platform that manages and secures access between critical software resources, like applications and services. Aembit will present its technology to a panel of renowned industry judges and a live in-person audience on May 6 at RSA Conference 2024 at the Moscone Center in San Francisco.

Since 2005, the RSAC Innovation Sandbox contest has served as a platform for the most promising young cybersecurity companies to showcase their groundbreaking technologies and compete for the title of “Most Innovative Startup.” The competition is widely recognized as a catapult for success as the Top 10 Finalists have collectively celebrated more than 80 acquisitions and received $13.5 billion in investments over the last 18 years. Aembit will have three minutes to pitch the panel of judges before a question-and-answer round.

“The submissions for this year’s RSA Conference Innovation Sandbox contest were both dynamic and inspiring. Along with the rest of our entrepreneurial audience, I am excited to see these ideas come to life on stage,” said Linda Gray Martin, senior vice president of RSA Conference. “The evolution of global cyber threats is constant and there’s no better place to look for solutions and to help solve these challenges than in our own community.”

With the rapid expansion of automated software, cloud services, and APIs, enterprises are being met with an exploding number of workloads across their IT environments. Reflect on the now-outdated practice of jotting down user credentials on sticky notes. Similarly, the current method of securing interactions between workloads typically involves the use of static, long-lived credentials, which are prone to theft and often embedded directly within code.

This approach not only introduces security vulnerabilities but also complicates management and impedes prompt response during security incidents and compliance audits. Aembit shifts the model so enterprises can focus on managing access, instead of managing secrets.

“Aembit automates and secures the entire workload-to-workload access workflow, from discovery, to enforcement, to audit – at scale,” said David Goldschlag, co-founder and CEO of Aembit. “Instead of building another dashboard showing you problems due to secrets and keys, we proactively fix the root cause of these challenges by systematically improving the way workloads are authorized access to your most sensitive resources, without code changes. You can think of us as Okta (or Azure AD), but between workloads instead of between users and services. The RSA Conference presents the ideal platform for us to demonstrate the significance and impact of our solution to the global security community.”

The RSAC Innovation Sandbox contest kicks off at 10:50 a.m. PT on May 6, and winners will be announced at approximately 1:30 p.m. the same day. The panel of renowned expert judges includes Asheem Chandna, partner at Greylock; Dorit Dor, chief technology officer at Check Point Software Technologies; Niloofar Howe, senior operating partner at Energy Impact Partners; Paul Kocher, independent researcher; and Nasrin Rezai, SVP & CISO at Verizon. Hugh Thompson, RSAC executive chairman and program committee chair of RSA Conference, will return to host the contest.

For more information regarding RSA Conference 2024, taking place at the Moscone Center in San Francisco from May 6 to 9, users can visit https://www.rsaconference.com/usa.

To learn more about the Aembit Workload IAM Platform, watch this demo video.

About Aembit

Aembit is the Workload Identity and Access Management platform that secures access between workloads across clouds, SaaS, and data centers. With Aembit’s identity control plane, DevSecOps can fully automate secretless, policy-based, and Zero Trust workload access. For more information, visit www.aembit.io and follow us on LinkedIn.

About RSA Conference

RSA Conference™ is the premier series of global events and year-round learning for the cybersecurity community. RSAC is where the security industry converges to discuss current and future concerns and have access to the experts, unbiased content, and ideas that help enable individuals and companies advance their cybersecurity posture and build stronger and smarter teams. Both in-person and online, RSAC brings the cybersecurity industry together and empowers the collective “we” to stand against cyberthreats around the world. RSAC is the ultimate marketplace for the latest technologies and hands-on educational opportunities that help industry professionals discover how to make their companies more secure while showcasing the most enterprising, influential, and thought-provoking thinkers and leaders in cybersecurity today. For the most up-to-date news pertaining to the cybersecurity industry visit www.rsaconference.com. Where the world talks security.

Contact

CMO
Apurva Dave
Aembit
[email protected]


[ad_2]
Source link

Everything you need to know

andreasc
-
0
Everything you need to know
[ad_1]

When you think of Google’s core services, there are quite a few that come to mind. Many of you will think of Google Translate quite fast, though, that’s for sure. Google has plenty of software offerings that stand out, but Google Translate is easily one of the best-known ones. This translation service has been around since April 28, 2006. That makes it almost 18 years old at the time of writing this article. Back then it was categorized as a ‘statistical machine translation’ service, while it switched to a ‘neural machine translation’ service in 2016. In this article, we’ll talk more about Google Translate, to give you a better idea of what it is, and what it can do.

What is Google Translate?

Google Translate is basically a language translation service from Google. Or if you’d like a more scientific term, it’s a “multilingual neural machine translation service”, as indicated on Wikipedia. It’s actually one of the best-known language translation tools out there, if not the best-known one. Basically everyone I personally know uses Google Translate for translation needs, I don’t think I’ve ever heard anyone mention anything else in day-to-day life. There are other offerings out there, which we’ll talk about later on, but Google Translate is very popular.

AH Google Translate 2024 image 1

What platforms is Google Translate available on?

You can access Google Translate in an app form, and also via your web browser. When it comes to apps, Google Translate is available on both Android and iOS, to of the largest mobile operating systems out there. You can also access it via basically any desktop operating system, simply navigate to https://translate.google.com/, and you’ll have access to its services. Using it is also very simple.

Do note that you may not be able to use the Google Translate app on just any Android smartphone. The device needs to have Google services. So it either needs to come with Google Play Store pre-installed, or in case if you’re importing a device from China, it needs to have support for Google services. The app likely won’t work on devices from Huawei, unless you’re using an emulator like GSpace. Why? Well, due to the US ban. Huawei is blocked from using Google services on its devices.

What are Google Translate’s competitors/alternatives?

Are there any competitors to Google Translate out there? Well, yes, and you may have even heard of some of them. The Microsoft Translator is a good example of competition for Google Translate. It can translate well over 100 languages, and it has a nice app you can use. It also has some benefits if you plan on using it on your website, over Google Translate. Its API lets you translate more characters than Google Translate (for free), for example.

Another good example of a competitor is Amazon Translate. It’s a part of Amazon Web Services, though it’s mostly focused on API usage, so it’s not exactly the same. Amazon Translate also has a higher monthly limit than Google Translate when it comes to API usage, the same as the Microsoft Translator. Looking at it as a personal translation tool, however, it’s not exactly a competitor to Google Translate or Microsoft Translate.

Yandex Translate is another great choice. It doesn’t translate nearly as many languages as Google Translate or Microsoft Translator, but its pricing is the advantage here if you plan on using it on your website or something like that. API usage is paid only, though, it’s no longer free, as is for Google Translate and Microsoft Translator (with limits).

Can I use Google Translate if I’m not connected to the Internet?

Is it possible to use the tool without an Internet connection? Well, yes, but only if you use an app, it’s not possible on the web. Why? Well, because you need to download the languages you’re interested in first. If you want to translate a language you didn’t download for offline use, you’ll need an Internet connection. You can easily download them via the Google Translate app, though. Simply open the app, and tap the section with languages at the bottom (either left or right). Once you do that, you’ll see a drop-down menu and a download icon next to various languages. Tap that icon and download the language you need. That way you’ll be ready to go if you’re traveling abroad or something like that.

AH Google Translate offline download

What is the first thing you should do in Google Translate before you start using it?

This actually ties into the previous section, downloading languages. There’s really only one thing you should do before you start using the app, download the languages you need. This only applies if you expect to be out of the Internet connection at some point while needing the Google Translate app. Many people only download Google Translate when they’re traveling somewhere, so its usage in offline mode is presumably quite high. If that’s the case for you, make sure you download the languages you’ll need. That’s basically the only thing you should do in order to prepare the app for usage.

Is the Google Translate app free to use?

The answer to this is both yes and no. How come? Well, the app is completely free to use for personal use. If that’s what you’re looking for, you’re good. If you plan on using it on your website and need API usage, then it’s free to use up to a certain degree. Google Translate API free tier lets you translate up to 500,000 characters per month. If you expect that the limit will go over that, you’ll need to pay up for Google Translate API usage. The vast majority of you reading this will probably use it as a personal translation tool. If that’s the case, you have nothing to worry about.

What are the best features of Google Translate?

Needless to say, Google Translate is all about translation. All of its features are related to various translations, so that’s what we’ll talk about here. Google Translate does offer plenty of choices in that regard, text is only one of them. So, let’s see what’s on offer.

Offline access

The first feature worth noting is the offline access for your translating needs. As mentioned in an earlier chapter, you can download specific languages offline, so that you always have access to them. Many times when you travel you don’t have access to the Internet at all times, which is where such an option is welcomed. This is basically a must-have feature for an application that handles language translations.

Basic text translation

Google Translate does support basic text translations. That’s the basic feature of this app and the first one that was made available. You can simply type in what you need translate, or paste text from a different app, website, or wherever you want. Make sure to select the language that the text comes from and the language you want the app to translate it to. You can also let the app figure out what language it is, in case you don’t know.

Voice translation / conversation

Voice translation allows you to speak to someone who speaks a different language. All you need to do is fire up an app and tap the ‘Conversation’ option in the bottom-left corner. That will enter the conversation mode where you’ll be able to set the parameters and start talking to a person who speaks a different language. Do note that there’s also an option for you to speak into the microphone, and for the app to translate what you said (or someone else). That option is highlighted with a large microphone icon, it’s located next to the ‘Conversation’ option.

AH Google Translate 2024 image 3

Camera translation

The third option at the bottom of the screen within Google’ translation app is ‘Camera’. It’s located in the bottom-right corner, and it’s the last one of the magic trio down there. If you tap this option, a camera UI will appear, and you’ll be able to point it to the text you need to translate. Google Translate will do the heavy lifting for you even without you snapping a photo, it’ll translate text in real-time.

AH Google Translate 2024 image 5

Handwriting translation

Google Translate also supports handwriting translation. You can simply use your handwriting in order to write something that needs translating, and that’s it. This is also very convenient if you need something to be translated and there’s no letter on your keyboard. If we’re talking about a different alphabet or something like that.

Website translation

What if you need Google Translate to translate an entire website for you? Well, that’s not a problem either. It’s very simple, copy and paste the URL of a website you need translated into Google Translate, and the app will handle things for you. This is also a rather common use case for this tool, and it improved a lot over time.

Translations of text inside files

Google’s translation service also allows you to translate files. For example, if you have a PDF document that you don’t really understand, and need to read it in a different language, that’s not a problem. You can simply upload that document to Google Translate, after which the tool will analyze it, and offer you the translated version.


[ad_2]
Source link

Amazon’s ditching its Just Walk Out tech in stores

andreasc
-
0
Amazon’s ditching its Just Walk Out tech in stores
[ad_1]

A while back, Amazon launched something pretty ambitious. This is a store where you can simply grab the items you want, walk out, and be charged accordingly. This forgoes using a traditional cashier. Well, it appears that Amazon is going to ditch its Just Walk Out technology.

Amazon has been developing this technology for quite some time, and it has distributed it throughout about half of the Amazon Fresh stores present in the States. There are also other Amazon Fresh stores with this technology including those in the UK. This means that the technology has not been able to make it to other entities despite the company’s efforts to distribute it.

Amazon is ditching its Just Walk Out tech

As cool as this technology sounds, there was a lot of drama going on behind the curtain that basically spelled this technology’s demise.

Data concerns

For starters, technology like this does not come without its price. We’re not just talking about money; we’re talking about data. If oil is “black gold,” then data is “digital gold.” The Amazon Just Walk Out technology employs a bevy of sensors and cameras to identify the people taking products off of shelves. This will help the company identify what products are being taken off of shelves.

These sensors would have to collect biometric information such as faces and the shapes of people’s bodies. This is something that the city of New York did not like, and it filed a class action lawsuit against Amazon.

Not really cashier-less

Another thing about this tech is the fact that, while it was “cashier-less”, the technology was not devoid of human intervention. A ton of data was gathered through the cameras, and there was actually a team of over 1,000 workers in India scanning the camera footage. So, while there were no cashiers, there had to be an army of people looking over the footage. That, ostensibly, costs much more than a handful of cashiers.

The cost of running this technology was pretty high in general. Since it was only supported in a handful of stores, it appeared that more money was going out than was coming in for the technology. So, Amazon had to ditch this technology. It earns much more money from people doing online shopping than people doing real-world shopping. Buying a fruit salad at an Amazon Fresh store doesn’t quite push people to shop for a dress online, so the company isn’t prioritizing its in-store experience as much. The outflow of money isn’t quite justified.

Amazon walks out

Because of these factors, Amazon is walking back this technology in its stores in the US. While that’s the case, it was still operating in the stores in the UK.


[ad_2]
Source link

OnePlus says bye-bye to photobombs with new AI Eraser tool: Which devices are getting it?

andreasc
-
0
OnePlus says bye-bye to photobombs with new AI Eraser tool: Which devices are getting it?
[ad_1]
AI has been a buzzword lately, especially with smartphone brands jumping on the generative AI bandwagon. Now, OnePlus is joining the fray with its new feature called “AI Eraser,” which will be available on select OnePlus devices starting this month.

OnePlus has introduced a new feature called AI Eraser (via 9to5Google). This feature uses GenAI (generative AI), and it’s all about letting you tweak or erase stuff in your photos that you are not digging. This new AI tool is set to roll out on the following OnePlus devices across the globe:


The AI Eraser taps into GenAI to remove unwanted elements from photos, much like Google’s Magic Eraser does. Samsung’s Galaxy AI suite in the latest Galaxy S24 series also offers a similar editing capability.

The AI Eraser feature will be integrated into the OnePlus Photos gallery app. Once users pinpoint specific objects in a photo, the AI kicks in, analyzing the chosen area and crafting a replacement background that seamlessly meshes with the surroundings, all while complementing the overall style of the image.

The company stated that the new feature will roll out gradually to the mentioned devices throughout April, although it hasn’t provided a specific date. It’s still uncertain whether the feature will be delivered through an Oxygen OS update or a dedicated update for the OnePlus Photo Gallery app.

OnePlus plans to introduce more AI features sometime this year. However, there’s no word yet on what those features might be. This move may mark the start of OnePlus diving deeper into the world of AI, but it is not the first time OnePlus has used AI.

Recently, it introduced the AI Summariser, a handy tool for generating call summaries, though it’s currently only available on the OnePlus 11 and 12. Additionally, last year, the company launched an online AI Music Studio where users can generate songs.


[ad_2]
Source link

Key Rotation Flaw Triggers Breach

andreasc
-
0
Key Rotation Flaw Triggers Breach
[ad_1]

Storm-0558, a cyberespionage group affiliated with the People’s Republic of China, has reportedly compromised Microsoft Exchange mailboxes of 22 organizations and over 500 individuals between May and June 2023.

This was done by using authentication tokens of accounts that were signed by a Key held by Microsoft in 2016. 

This key was used for secure authentication into remote systems. However, this key was possessed by the threat actor, which provided several permissions to access any information or systems within that key’s domain.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Additionally, a single key can have enormous power, which, combined with a flaw in Microsoft’s authentication system, resulted in the threat actor gaining full access to any Exchange online account anywhere in the world.

Moreover, Microsoft is still investigating how Storm-0558 got its hands on this key.

The accounts compromised using this attack included 

  • Senior United States government representatives working on national security matters
  • Email accounts of Commerce Secretary Gina Raimondo, 
  • United States Ambassador to the People’s Republic of China R. Nicholas Burns and
  • Congressman Don Bacon.

Microsoft’s Exchange Server Hack

According to the CSRB reports, during the time the threat actor had access to these sensitive email accounts, they downloaded over 60,000 emails from the State Department. 

Attack vector of Storm-0558 (Source: CISA)

Moreover, the first victim of this intrusion was the State Department, which was on June 15, 2023, when the SOC team detected anomalies in access to their mail systems.

Following this, the next day, there were several security alerts for which they contacted Microsoft.

10-Day Investigations From Microsoft

Microsoft initiated an investigation for the next 10 days and confirmed that the threat actor Storm-0558 had gotten their hands on certain emails through their Outlook Web Access (OWA).

Further, Microsoft also identified 21 different organizations and 500+ users that were impacted by the attack. The impact was further noted by the U.S. government agencies.

In addition to this, Microsoft also found that the threat actor used the OWA for accessing emails directly using tokens which authenticated Storm-0558 as a valid user.

This also specified that these kinds of tokens must be associated with Microsoft’s identity systems only, but unfortunately, they were not. 

Furthermore, the tokens used by the threat actor had digital signatures with a Microsoft Services Account (MSA) cryptographic key that dated back to 2016.

This key was originally intended to be retired by March 2021, providing more insights on the attack.

The Revealing Point

Microsoft initially concluded that the threat actor had forged tokens for accessing these Microsoft Exchange online accounts from affected individuals.

However, after developing some hypotheses they found a flaw in the token validation login used by Microsoft Exchange which could allow any consumer key to access enterprise Exchange accounts if the accounts did not have a code to reject consumer key.

However, it was still not evident enough to prove that the threat actor had obtained and used the 2016 MSA key to compromise the accounts.

By that time, Microsoft recalled an attack performed by the same threat actor in 2021 in which they accessed several documents that were stored in SharePoint as they were looking for information on Azure service management and Identity-related management.

The final stages of investigations revealed some major things: Microsoft had been using manual key rotation mechanisms on enterprise systems and had completely stopped the rotation mechanism after they faced a major outage on one of these activities in 2021. 

This allowed the threat actor to use these consumer keys to forge authentication tokens to access consumer email systems.

However, another previously unknown flaw was combined with this issue, potentially compromising sensitive email accounts and organizations.


[ad_2]
Source link

IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc.

andreasc
-
0
IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc.
[ad_1]
IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc.

IntelBroker hacker leaks data linked to US contractor Acuity Inc., exposing potentially sensitive intelligence agencies-related data – US government previously denied Acuity Inc. breach, but experts warn of national security risks.

The notorious IntelBroker hacker and their affiliates have leaked a trove of sensitive records, which they claim jeopardize the United States national security. The data, leaked on Breach Forums, is linked to US Federal contractor Acuity Inc., in a data breach allegedly carried out in March 2024. The data was previously being sold for just $3,000 in Monero (XMR) cryptocurrency.

As seen by Hackread.com, IntelBroker has classified the breach as a “National Security Documents Leak,” involving documents from the “Five Eyes Intelligence Group.” The leaked records now accessible to the public include highly sensitive information such as full names, email addresses, office numbers, personal cell numbers, email addresses (government, military, and Pentagon), classified information, and communications between the Five Eyes, 14 Eyes, and the US’s allies.

IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc.
Screenshot from Breach Forums (Credit: Hackread.com)

For your information, The Five Eyes Intelligence Group is an intelligence alliance including five English-speaking countries: the United States, the United Kingdom, Canada, Australia, and New Zealand. The alliance aims to share intelligence and collaborate on signals intelligence (SIGINT) gathering, surveillance, and cybersecurity activities.

Background of the alleged Acuity Inc. data breach

On March 4, 2024, Hackread.com published an exclusive report on a data breach allegedly involving Acuity Inc., a federal contractor based in Reston, Virginia. The breach was claimed by IntelBroker.

The hacker claimed the use of a zero-day security vulnerability in GitHub to access Acuity Inc.’s tokens and facilitate their malicious activities, including the theft of data belonging to U.S. Citizenship and Immigration Services (USCIS) and U.S. Immigration and Customs Enforcement (ICE).

Hackread.com reported the breach to GitHub, Acuity Inc., ICE, and USCIS. However, none of the organizations responded to the report. In contrast, Homeland Security, responding to a third-party media site that had not reported on the incident or analyzed the data, denied IntelBroker’s claims and labelled the breach as false, categorizing the leaked information as “test demos for vendors” with fake names and contact information used solely to provide examples of received data.

Now What?

Despite the US Government’s version that the data leak is fake, Hackread.com’s analysis suggests that the publicly leaked information remains highly consequential. Even if the data is fabricated, it exposes the modus operandi of US intelligence agencies and their allies, potentially risking their operational security and strategies.

IntelBroker

The hacker’s origins and affiliates are unknown; however, according to the United States government, IntelBroker is alleged to be the perpetrator behind one of the T-Mobile data breaches.

IntelBroker Hackers Leak Sensitive Records, Raising National Security Concerns

Additionally, IntelBroker is known for targeting high-profile targets in the United States. Some of their previous data breaches include Las Angeles Intl. Airport, US DoD Documents, Staffing Giant Robert Half, Facebook Marketplace Database, DARPA-related accesses in General Electric breach, Weee! Grocery and several others.

  1. US Govt’s secret terrorist watchlist with 2M records exposed online
  2. Chinese Group Storm-0558 Hacked European Govt Emails, Microsoft
  3. Adobe ColdFusion Flaw Used by Hackers to Access US Govt Servers
  4. Traffic sign near ICE headquarters hacked with “Abolish ICE” message
  5. Norweigian researcher exposes how a US firm collected his location data

[ad_2]
Source link

Android 15 could revamp the status bar

andreasc
-
0
Android 15 could revamp the status bar
[ad_1]

Android 15 is getting closer, and we are still discovering new information about this next iteration of Android. As discovered by noted Android engineer Mishaal Rahmen, a part of Android that has been the same for years. Android 15 could revamp the status bar.

The status bar is part of the UI that sits at the top of the screen. It displays your battery level notifications, Wi-Fi/data connection status, Etc. While Android has changed over the years, the icons in the status bar have remained the same. It changed a little over the years, but not much. So, Android 15 could breathe new life into the status bar.

Android 15 could revamp the status bar

Right now, we are dealing with very early information. There is no guarantee that the changes made in the developer preview will be reflected in the final release. So, you will want to take this news with a grain of salt. Anything could change between now and the official release.

What’s probably the biggest change is the battery icon. We are all used to seeing the battery icon standing vertically with the percentage right next to it in stock Android. It has not changed over the years. However, the battery icon will be bigger in Android 15. Also, we see that it’s lying down rather than standing up.

The most notable thing about this is the fact that the battery percentage could sit inside of the battery. Also, when your phone is plugged in, we’ll see a little lightning icon appear next to the battery percentage. The picture below shows how this will look in both light mode and dark mode.

Android 15 new status bar (2)Android 15 new status bar (1)

Another thing we noticed is the Wi-Fi icon. We’re used to seeing the downward-facing wedge showing the Wi-Fi signal strength. Historically, it’s been one singular shape. However, with Android 15, it appears that Google is going to go for a segmented icon. So, you will see each signal bar at its own element. We see the same thing for the data signal icon.

It’s unlikely that we will see these new icons in the developer preview. However, it’s possible that we will see it in one of the beta versions of the software. Stay tuned for more news on it.


[ad_2]
Source link

New XZ Utils Backdoor Free Scanner to Detect Malicious

andreasc
-
0
New XZ Utils Backdoor Free Scanner to Detect Malicious
[ad_1]

A critical vulnerability has been discovered in XZ Utils, a widely used data compression tool across Unix-like operating systems, including Linux.

This vulnerability, identified as CVE-2024-3094, involves a backdoor that could potentially allow unauthorized remote access, posing a significant threat to software supply chain security.

zero detection from VirusTotal
Zero detection from VirusTotal

The initial alarm was raised by Andres Freund, who noticed unusual activity in the XZ Utils project. Versions 5.6.0 and 5.6.1 of XZ Utils were found to be compromised.

Shortly after Freund’s warning, the United States government’s Cybersecurity and Infrastructure Security Agency (CISA) and the Open Source Security Foundation (OpenSSF) issued alerts about the critical nature of this backdoor, emphasizing the urgency of addressing this vulnerability due to its potential impact on OpenSSH security.

Document
Run Free ThreatScan on Your Mailbox

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

The revelation of this backdoor is particularly alarming because it represents a nightmare scenario for software supply chain security.

XZ Utils is integral to embedded systems and firmware development across various ecosystems, with the Linux ecosystem being a primary target due to its role in powering modern cloud infrastructure.

The Response and Mitigation Efforts

In response to the discovery of CVE-2024-3094, the community acted swiftly.

Many Linux distributions impacted by the vulnerability have rolled back to a known safe version of XZ Utils, demonstrating the effectiveness of industry-wide, community-driven coordination.

However, the challenge remains in quickly detecting and deactivating deployed backdoored versions in the field.

Traditional detection tools, which often rely on simple version checks, hash-based detection, or YARA rules, have proven inadequate.

These methods can lead to alert fatigue and false positives, overwhelming security teams.

Recognizing the limitations of existing detection methods, the Binary Research Team embarked on a mission to develop a more practical approach to identify the backdoored binaries.

exported by the payload object file

Their investigation revealed the complexity of the XZ Utils backdoor, believed to be part of a sophisticated, state-sponsored operation with multi-year planning.

An essential technique employed by the backdoor involves the GNU Indirect Function (ifunc) attribute, which allows for runtime resolution of indirect function calls.

The backdoor intercepts execution and modifies ifunc calls to insert malicious code.

Binary Intelligence technology in action
Binary Intelligence technology in action.

This static analysis method can generically detect tampering of control flow graph transitions, significantly reducing the false positive rate.

The discovery of the XZ Utils backdoor underscores the critical importance of software supply chain security.

Through the collaborative efforts of the security community and the innovative solutions provided by teams like Binary, the industry is better equipped to defend against these sophisticated threats.

As the landscape of cyber threats continues to evolve, such proactive measures and tools will be indispensable in safeguarding our digital infrastructure.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

New OnePlus Open update brings photo collages, camera improvements & more

andreasc
-
0
New OnePlus Open update brings photo collages, camera improvements & more
[ad_1]

A new update has started rolling out to the OnePlus Open, and it brings photo collages, camera improvements, and more. If that sounds familiar, that’s because a very similar update landed on the OnePlus 12 and OnePlus 11 not long ago.

A new update brings photo collages to the OnePlus Open, along with camera improvements

This update is marked as OxygenOS v14.0.0.600, and it’s coming to Indian variants of the OnePlus Open at the moment. The update will soon spread to other markets, and it will have the same changelog. The update itself weighs around 770MB, so it is recommended that you be connected to WiFi when you update.

This update brings the March 2024 Android security patch along with it. On top of that, it includes some new features, and also some improvements to the camera and more.

Let’s kick things off with some new features, though. This update brings photo collages to the OnePlus Open. You can now make collages from the phone’s default Photos app. It’s a pretty basic tool now, but it’s here.

‘Partial screenshot’ feature has been added too, and several others

The company also added a ‘Partial screenshot’ option to the Smart Sidebar, if you use it. You can now also hold down the volume down button in order to turn on the flashlight when the screen is off.

Settings app-specific volumes is now possible as well. This is great to have if you prefer the volume to be higher when you want the videos, listen to podcasts, or whatever else.

The volume bar’s design has been altered too, and the system stability in general has been improved. We also got some camera improvements with this update.

OnePlus now enables you to switch between more focal lengths by tapping the zoom buttons. You can now also use the ultrawide and telephoto cameras in XPAN mode. The update also increases shutter response and improves the snapshot experience. You can now also use the zoom wheel to switch between different zoom options when taking videos.


[ad_2]
Source link

Galaxy S23 users report fingerprint issues after One UI 6.1 update

andreasc
-
0
Galaxy S23 users report fingerprint issues after One UI 6.1 update
[ad_1]

Samsung appears to have rushed the One UI 6.1 update for Galaxy devices. Users who have installed the update are encountering various issues. Over the past few days, we have seen reports about slow charging speeds and devices running warmer. Now, some Galaxy S23 users say the fingerprint scanner on their device is not working properly following the update.

One UI 6.1 may have introduced a fingerprint issue to the Galaxy S23

According to user reports on Reddit, the fingerprint icon occasionally does not appear on the Galaxy S23’s screen after the One UI 6.1 update. It doesn’t show up when they wake up the phone by pressing the power button or double-tapping the screen. The bigger problem is that fingerprint recognition does not work when this happens. Placing a registered finger above the scanner does nothing.

To make it work, users have to lift their fingers and wait for the icon to show up. The fingerprint scanner then worked properly. It appears to be a fairly widespread issue. We have seen reports from dozens of Galaxy S23 users on Reddit, including a Galaxy S23 FE user (the FE model has an optical scanner while the flagships have an ultrasonic scanner). SamMobile could replicate the issue on a Galaxy S23.

While this happens occasionally, it can be frustrating to users. Hopefully, Samsung has noted the issue and is working on a fix. The company has also updated the Galaxy Z Fold 5, Galaxy Z Flip 5, and Galaxy Tab S9 series to One UI 6.1 but there aren’t any reports about fingerprint issues from users of these devices. The foldables feature side-mounted capacitive scanners while the tablets have optical under-display scanners.

Reports about slow charging speeds may be misleading

Several Galaxy S23 and Galaxy Z Fold 5 users have claimed that their phones are charging slower than usual after the One UI 6.1 update. They shared screenshots from the Electron app, showing a charging speed of 15W or lower. While it isn’t unusual for major updates to contain a few bugs, it is unclear whether One UI 6.1 is the culprit here. Phones rely on various factors to dynamically adjust the charging speed.

The charging speed is usually fast when the battery level is low and gradually slows down as we reach higher levels. The readings reported by Electron may not be accurate either. SamMobile used a pluggable voltage and amperage meter to check the charging speed and found that their Galaxy S23 charges at 20W when the battery level is 47%. This suggests One UI 6.1 hasn’t slowed down the charging of Galaxy devices. We will let you know when we have more information.


[ad_2]
Source link
1...223224225...1,452Page 224 of 1,452