Google tests a more compact search bar in its native Contacts app

andreasc
-
0
Google tests a more compact search bar in its native Contacts app
[ad_1]
Google is once again experimenting with the UI for its native Contacts app. Following a prior leak where the app’s single-contact page looked to be getting a more decluttered view, a new tweak has been uncovered…only this time it tackles the top search bar.

In keeping with the spirit of spring-cleaning and decluttering, Google has a minor redesign in the works for the top search bar of the Contacts app, where the account switcher and the “add contact” button are getting bumped off to the side. It’s a small change, but the whole change feels very Play Store-esque.

Image Credit: TheSPAndroid

This isn’t a change that is available to the public yet, as it is neatly tucked behind hidden flags, the kind you need a rooted Android to enable. The scoop comes courtesy of AssembleDebug over on TheSpAndroid, who has found several of these UI tweaks over the past few weeks.

It’s a work in progress that could be dead in the water by next week, as Google seems to experiment with various designs at once and could at any moment nix one in favor of the other. However, the question remains whether this is just part of a larger redesign or perhaps a complete overhaul of the Contacts app. Contacts is not exactly an app that one frequently opens as a standalone app, but is mostly just where your contacts live that you access through other apps.

Given this, one tends to wonder if Google spending time on this redesign signals a bigger change. Perhaps there’s a new feature in the works that warrants elements of the UI being switched around? It wouldn’t be completely off-brand when you consider that Google I/O is just around the corner, and this is when Google typically announces upcoming features for the forthcoming version of Android. It’s fun to speculate, and we only have a few more weeks before we hopefully find out what Google has in store for the Contacts app.

[ad_2]
Source link

Wireshark 4.2.4 Released: What’s New!

andreasc
-
0
Wireshark 4.2.4 Released: What’s New!
[ad_1]

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education.

The latest update, Wireshark 4.2.4, includes a host of fixes and updates to further cement its position as the go-to tool for network professionals and enthusiasts alike.

This release underscores the Wireshark Foundation’s commitment to advancing protocol analysis education, a mission supported by contributions from the global community.

Addressing Vulnerabilities and Enhancements

Fixed Vulnerabilities

The Wireshark team has diligently addressed several vulnerabilities in this release, notably:

  • wnpa-sec-2024-06 T.38 Dissector Crash (CVE-2024-2955): A critical fix that prevents crashes related to the T.38 protocol dissection, enhancing the stability and security of the application.

Contested CVEs

Wireshark has also been the subject of CVEs assigned without coordination with the project, specifically CVE-2024-24478, CVE-2024-24479, and CVE-2024-24476.

The Wireshark team has contested these, stating they are based on invalid assumptions, and has requested their rejection, showcasing the team’s proactive stance on security matters.

Bug Fixes

The 4.2.4 update addresses a variety of bugs, improving user experience and software reliability:

  • Issues with Extcap configuration not starting and TLS secrets injection causing crashes on Windows have been resolved.
  • To ensure smoother operation and analysis, fixes have been made for packet dissection CSV export, HTTP dissector port addition, and various fuzz job issues.
  • An error related to adding new rows to tables has been corrected alongside the ‘–export-objects’ functionality in shark versions later than 3.2.10.

Protocol and Feature Updates

While this release does not introduce new features or protocols, it significantly updates support for many existing protocols, including but not limited to 5GLI, BGP, DHCPv6, and ZigBee ZCL.

This comprehensive update ensures that Wireshark remains at the forefront of protocol analysis, capable of handling the latest network communication standards.

Installation and Support

Wireshark 4.2.4 can be downloaded from the official Wireshark website, and detailed instructions for installation across various platforms are available.

Manual installation of this update is required for users upgrading from versions 4.2.0 or 4.2.1 on Windows.

Most Linux and Unix distributions provide Wireshark packages through their native package management systems, making installation or upgrade seamless.

For specific file locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries, users can refer to the Help section within Wireshark or use the tshark -G folders command.

Wireshark 4.2.4 exemplifies the ongoing dedication of the Wireshark Foundation and its global community to enhance the utility and security of the world’s premier network protocol analyzer.

This release ensures that Wireshark remains an indispensable tool for network professionals and enthusiasts by addressing critical vulnerabilities, fixing bugs, and updating protocol support.

As the project continues to evolve, the support and contributions from the community remain vital to its success.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

Blockchain Networks Using API Security Data to Mitigate Web3 Threats

andreasc
-
0
Blockchain Networks Using API Security Data to Mitigate Web3 Threats
[ad_1]

Singapore, 28 March 2024 – GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report that highlights the growing, widespread use and potential of Web3 user security data to aid in risk management.

The findings of the report reveal a clear and growing demand for more advanced security tools that can effectively safeguard digital assets, verify the authenticity of nonfungible tokens (NFTs) and monitor decentralized applications for threats. 

The report, “Uncharted Consensus: The Widespread Use and Potential of User Security Data in Web3”, showcases the rapid adoption of GoPlus’s API suite, which provides Web3 industry stakeholders with unparalleled insights into the health and vulnerability of various cryptocurrencies, NFTs and decentralized applications. At the same time, it also underscores the unique role GoPlus plays in addressing Web3’s most pressing security challenges.

GoPlus is the developer of an API suite that’s designed to address the multifaceted challenges of Web3 user security, enabling targeted data analysis across key aspects of the industry. Its modules include a Token RIsk API and NFT Risk API that evaluate the risk associated with different cryptocurrencies and non-fungible tokens; a Malicious address API for monitoring and reporting malicious addresses; a dApp Security API for real-time monitoring and threat detection in decentralized applications; and an Approval API for checking malicious approval of an address.

The report shows there is rising demand for better Web3 security solutions, with GoPlus revealing that its Token Risk API saw a rapid increase in utilization from November 2023, with some months witnessing peaks of over 20 million calls per day.  This suggests that the crypto industry is collectively shifting towards pre-emptive risk identification and mitigation, driven by the evolving and intensifying landscape of security threats. 

These increases were mirrored by similar usage spikes in GoPlus’s other API modules. For instance, usage of its NFT API spiked between Dec. 2022 and Feb. 2023, and then several times again between March and May 2023, before stabilizing, followed by a sustained period of much steadier growth. These usage trends mirror the growing adoption of NFTs and the corresponding need for tools that can accurately assess the risks associated with these digital assets.

Evolving Threat Landscape

A closer analysis of the API usage data illustrated a significant fluctuation in the presence of “high-risk” tokens, reflecting a threat landscape that’s just as volatile as the crypto industry itself. The majority of these high-risk tokens were identified as being either “blacklisted” or “honeypots”, although many other kinds of threats were identified, illustrating the evolving tactics used by hackers and scammers in the industry. The report also found an exponential increase in threats associated with NFTs, such as privileged operations (burn and minting), restricted approvals, self-destruct mechanisms and unauthorized transfers.

The threat-related insights demonstrate the need for Web3 projects to employ more dynamic, robust and adaptable security strategies and countermeasures to deal with the evolving threat landscape, as well as the need for education and collaboration to increase awareness of these threats and find better ways to mitigate them.

Top Ecosystems & Threats

The comprehensive study also highlighted the differing levels of user engagement and security concerns across blockchains, providing perspective on the unique challenges and risks faced by each ecosystem. 

BNB Chain emerged as the most prominent user of GoPlus’s APIs, being queried more than 92.7 million times during the research period. This reflects Binance’s laudable achievement in fostering a large community that’s united in its determination to identify and proactively mitigate security risks such as token vulnerabilities and scams.

Ethereum was the second-most popular chain to leverage GoPlus, with users querying its APIs 84 million times, highlighting both the extent of its user base and its vigilance against vulnerabilities and scams. Meanwhile, Polygon also stood out with almost 9.8 million queries during the period. This high level of adoption in the much smaller Polygon community illustrates the strong emphasis it places on scaling security solutions for the Web3 industry. 

Other insights from the report include the top ten token risks faced by the crypto industry today, with further analysis uncovering ten tokens with characteristics that mark them out as being “particularly malicious”, and also the top ten NFT collections that could be perceived as risky, due to their close association with phishing scams.  

The Importance Of User Security Insights

The GoPlus report provides valuable insights into aspects such as user engagement, preferences and the nature of the evolving threats in Web3, which can be essential for stakeholders to make more informed decisions and mitigate the risks they face. 

Perhaps the most significant finding is that the report underlines the critical importance Web3 security data can play in helping the industry address the evolving risk landscape. As the Web3 ecosystem grows and evolves, the need for comprehensive security data will become all the more vital, helping dApp developers protect their users, while educating users on how to protect themselves.  

About GoPlus Labs

GoPlus Labs is revolutionizing Web3 security by offering a transparent, User Security Network with permissionless security data. It provides a User Security Module as a Service to any blockchain, utilizing advanced AI for comprehensive threat detection.

Notably, its security data infrastructure has seen a massive usage increase, the user security data usage has grown 5000x from 2022 to now, with daily data API calls 21M.

SecwareX, launched in March 2024, quickly gained significant traction, showcasing high user trust. Within its first two weeks, it attracted over 400,000 users, including more than 30,000 premium (paid) users, highlighting its immediate impact and user trust.

GoPlus enhances Web3 user security through broad support for over 20 chains, collaboration with RaaS and Layer2 partners like Altlayer, zkSync, and Manta, and the introduction of innovative products like the “Secscan” security engine and Secware Middleware. These advancements facilitate a more open data and computing layer, moving towards gradual decentralization.

Goplus enhances Web3 user security and promotes decentralization by motivating user participation with its token system. The Goplus Token will act as a “gas fee,” necessary to reinforce the user security network and expand its utility. Moreover, it encourages users to become SecWare Service Providers, Data Providers, and Computing Node Providers. By contributing to the network, these participants can earn Goplus Tokens.


[ad_2]
Source link

Google’s Pixel 8 will get Gemini Nano in the next Pixel Feature Drop

andreasc
-
0
Google’s Pixel 8 will get Gemini Nano in the next Pixel Feature Drop
[ad_1]

After Google said the Pixel 8 would not get Gemini Nano due to “hardware limitations”, it left a bad taste in a lot of people’s mouths. Google touts that the Pixel 8 and Pixel 8 Pro are both getting seven years of updates – OS, feature drops and security updates. But less than six months into the life cycle, the Pixel 8 loses out on a bit AI upgrade that the Pixel 8 Pro gets with virtually the same hardware?

Well, Google heard all of that backlash, and today, it is announcing that Gemini Nano will be available as a developer preview on Pixel 8 in the next Feature Drop. Google also says that Gemini Nano will power two expanded features on Pixel 8, which will include Summarize in Recorder and Smart Reply in Gboard.

Google began testing Gemini Nano on Pixel 8 after seeing LLMs running on phones with different memory specs

So, what was behind Google’s change of heart here? Well, Google is not going to say that they heard the complaints and have decided to try and get it working. Instead, Google is saying that they’ve “seen a lot of excitement from users and developers since Pixel 8 Pro became the first smartphone to get Gemini Nano last year.” Continuing on by saying that they’ve seen “large language models on phones with different memory specs can deliver different user experiences, so we have been testing and validating this on Pixel 8.”

Based on that, it sounds like the Gemini Nano features won’t be as robust on the Pixel 8 as they are on Pixel 8 Pro. Keep in mind that while both phones do run the same processor, they do also have different amounts of RAM. The Pixel 8 has 8GB of RAM while Pixel 8 Pro has 12GB of RAM. And running LLMs do require a good amount of memory.

The Made by Google podcast will explain this more in depth, and Seang Chau, Google’s VP of Engineering, will discuss Google’s approach to software updates in further detail.


[ad_2]
Source link

Samsung reveals complete details of Galaxy A55’s Exynos 1480 chipset

andreasc
-
0
Samsung reveals complete details of Galaxy A55’s Exynos 1480 chipset
[ad_1]

Samsung has revealed the complete details of the Exynos 1480 chipset, which is the successor to last year’s Exynos 1380 SoC. The Samsung Galaxy A55 is the first smartphone to be powered by the Exynos 1480 chipset. The phone was introduced earlier this month. However, the brand didn’t reveal the specs of the Exynos 1480 SoC at that time.

The Exynos 1480 SoC has the new Xclipse 530 GPU based on AMD’s RDNA 2 architecture

Samsung’s latest Exynos 1480 chipset offers four powerful ARM Cortex-A78 cores with a clock speed of 2.75GHz for power-hungry tasks. There are also four Cortex A-55 cores spinning at 2.0GHz, which provide better power efficiency by handling normal tasks. The real star of the show, however, is the company’s new Xclipse 530 GPU that’s based on AMD’s mobile RDNA 2 architecture. Until now, the brand only offered the AMD RDNA architecture on the flagship Exynos chipsets.

The Xclipse 530 GPU offers a 53% boost in performance as compared to the Mali-G68 MP5 GPU in the Exynos 1380. The new 4nm tech-based chipset supports LPDDR4x, LPDDR5, and UFS v3.1 type memory modules. The phones with the new Exynos chipset can support FHD+ resolution and a max screen refresh rate of 144Hz.

Samsung claims the Exynos 1480 chipset provides 13% app launch improvements and an 18% multicore performance. Jumping on the AI bandwagon, the new mid-range Exynos chipset has a built-in AI Engine with a 6K MAC Neural Processing Unit. Devices powered by this SoC should be capable of supporting some of the AI-powered features found in the Galaxy S24 series.

The Exynos 1480 supports up to 200MP cameras, Wi-Fi 6E, and faster 5G downlink speeds

Furthermore, Samsung has revealed that devices equipped with the Exynos 1480 SoC can support up to a 200MP single camera. There’s also support for a 64MP single camera at 30 fps. The phones with the chipset also support a dual 32MP + 32MP camera module at 30 fps. The SoC is capable of recording 4K videos at 60 frames per second.

Samsung has also improved the connectivity features of the new chipset. The SoC supports Wi-Fi 6E (an improvement over Wi-Fi 802.11ax), Bluetooth 5.3, sub-6GHz 5G, mmWave 5G, and cat.18 LTE. Lastly, the new chipset offers faster 5G downlink speeds at 5.10Gbps as compared to 3.79Gbps on the Exynos 1380.

Samsung will launch more devices powered by the Exynos 1480 SoC later this year. We will bring you all the details on these products, so stay tuned for regular updates.


[ad_2]
Source link

Trove of UK Student Records Exposed in School Software Server Leak

andreasc
-
0
Trove of UK Student Records Exposed in School Software Server Leak
[ad_1]
UK Student Records Exposed in School Software Server Leak

Cybersecurity researcher Jeremiah Fowler identified a misconfigured cloud server that impacted hundreds of thousands of students in the United Kingdom. Fowler disclosed his findings through WebsitePlanet, outlining how a UK-based school tracking software provider unintentionally exposed individuals to the risk of a data breach.

In the report shared with Hackread.com prior to its publication on Wednesday, March 27, 2024, it was revealed that the server contained almost a million (864,603) records, with approximately 214,000 of them being unique images of children.

In addition to the images, the exposed database contained sensitive information including student names, enrolled subjects, academic achievements, and indications of learning disabilities. Shockingly, these records covered a period from 2017 to 2023.

UK Student Records Exposed in School Software Server Leak
Screenshot from the exposed server (Credit: Website Planet)

According to Fowler, the server was affiliated with OTrack, also known as Optimum Pupil/Sonar Tracker, developed by Juniper Education. OTrack is utilized by over 7,000 primary and secondary schools across the United Kingdom and is an effective platform for tracking pupil performance and managing schools.

It is a fact that schools are one of the most targeted industries however, a data leak related to student software is not new. Earlier in January this year, Fowler reported similar findings impacting students from a Texas-based school when its safety software provider developed by Raptor Technologies exposed around 4,024,001 records to the public.

Upon discovering the misconfiguration, Fowler promptly notified the responsible parties through a responsible disclosure notice, leading to the swift closure of public access to the server.

However, the question remains whether unauthorized individuals had accessed it and to what extent the data may have been misused. The full scope of the data leak can be uncovered only through an internal forensic audit.

Another worth mentioning positive outcome is that, unlike businesses that deny data breaches, the company’s data protection officer, representing Juniper Education, assured that an investigation would be carried out.

Nevertheless, the server misconfiguration goes on to show the critical importance of prioritizing proper cybersecurity measures, especially when dealing with the sensitive data of minors. With educational institutions relying more on digital platforms, it’s critical to take precautions to effectively secure student information.

  1. Database Leaks 153GB of Filipino Student and Family Data
  2. 900 U.S. Schools Hit by MOVEit Hack, Exposing Student Data
  3. Hackers Attack UK’s Nuclear Waste Services Through LinkedIn
  4. Conti ransomware gang demanded $40m from US school district
  5. Tycoon and Storm-1575 Linked to Phishing Attacks on US Schools

[ad_2]
Source link

Galaxy A52 5G & A32 5G get March 2024 security update in the US

andreasc
-
0
Galaxy A52 5G & A32 5G get March 2024 security update in the US
[ad_1]

Samsung has started rolling out the March 2024 security update to the Galaxy A52 5G and Galaxy A32 5G in the US. The update is rolling out to both carrier-locked and unlocked variants of the Galaxy A32 5G. In regards to the Galaxy A52 5G, only carrier-unlocked variants are getting the update as of now.

The Galaxy A52 5G & Galaxy A32 5G are getting a security update for March 2024

The Galaxy A32 5G is getting the A326USQSDDXC2 firmware, when it comes to carrier-locked models. The carrier-unlocked variants are getting the A326U1UESDDXC2 firmware.

In regards to the Galaxy A52 5G, we’re looking at the A526U1UESCFXC6 firmware. Once again, we’re talking about a carrier-unlocked variant of the phone here. That is the only one receiving the update now.

This update delivers fixes for 45 security vulnerabilities, in case you were wondering. It’s always nice to see companies boost the security of their smartphones, even though there are no new features to speak of here

Your phone will let you know once the update lands, though you can check for it manually too

Your smartphones will let you know once the update is available. You can, of course, check for it manually too, if you want. Simply navigate to Settings -> Software update -> Download and install.

As per usual, these updates are rolling out as we speak, but they’re rolling out gradually. In other words, some of you may have already received them, while others will have to wait a bit. They’re rolling out in stages.

As many of you know, neither of these two smartphones are particularly new. They both arrived in the first quarter of 2021, which makes them three years old at this point. Still, Samsung is prompt with security updates, which is great to see.

The Galaxy A52 5G is the more powerful of the two devices, as you probably already know. It’s also technically newer, as it arrived in March 2021, while the Galaxy A32 5G launched two months before that.


[ad_2]
Source link

Update Chrome now! Google patches possible drive-by vulnerability

andreasc
-
0
Update Chrome now! Google patches possible drive-by vulnerability
[ad_1]

Google has released an update to Chrome which includes seven security fixes. Version 123.0.6312.86/.87 of Chrome for Windows and Mac and 123.0.6312.86 for Linux will roll out over the coming days/weeks.

The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong—such as an extension stopping you from updating the browser.

So, it doesn’t hurt to check now and then. And now would be a good time, given the severity of the vulnerability in this patch. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.

If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete, and for you to be safe from those vulnerabilities.

Chrome is up to date

After the update, the version should be 123.0.6312.86, or later

Technical details

Google never gives out a lot of information about vulnerabilities, for obvious reasons. Access to bug details and links may be kept restricted until a majority of users are updated with a fix.

There is one critical vulnerability that looks like it might be of interest to cybercriminals.

CVE-2024-2883: Use after free (UAF) vulnerability in Angle in Google Chrome prior to 123.0.6312.86 could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Angle is a browser component that deals with WebGL (short for Web Graphics Library) content. WebGL is a JavaScript API for rendering interactive 2D and 3D graphics within any compatible web browser without the use of plug-ins.

UAF is a type of vulnerability that is the result of the incorrect use of dynamic memory during a program’s operation. If, after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to manipulate the program. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. In this case, when the vulnerability is exploited, it can lead to heap corruption.

Heap corruption occurs when a program modifies the contents of a memory location outside of the memory allocated to the program. The outcome can be relatively benign and cause a memory leak, or it may be fatal and cause a memory fault, usually in the program that causes the corruption.

Chromium vulnerabilities are considered critical if they “allow an attacker to read or write arbitrary resources (including but not limited to the file system, registry, network, etc.) on the underlying platform, with the user’s full privileges.”

So, to sum this up, in this case an attacker could create a specially crafted HTML page–which can be put online as a website–that exploits the vulnerability, potentially leading to a compromised system.

My suggestion: don’t wait for the update, get it now.

We don’t just report on vulnerabilities—we identify them, and prioritize action.

Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using ThreatDown Vulnerability and Patch Management.


[ad_2]
Source link

Tipster says Galaxy S25 Ultra design leaks are false

andreasc
-
0
Tipster says Galaxy S25 Ultra design leaks are false
[ad_1]

One of the best-known tipsters in the business, Ice Universe, reflected on the Galaxy S25 Ultra design leaks, he basically said they’re false. He said that the Galaxy S25 Ultra design is “top secret” at the moment and that the info shared is not real.

Recent Galaxy S25 Ultra design leaks seem to be false

Amongst the rumors he pointed his finger at is a recent one depicting the Galaxy S25 Ultra prototypes. He mentioned some other ones too, and they all come from the same person, PandaFlash X on Twitter.

Ice Universe is no stranger when it comes to calling out inaccurate information. His level of accuracy is extremely high too, so we have no reason to doubt what he’s saying here. It looks like we’ll have to wait a bit longer to get legit Galaxy S25 Ultra info.

The thing is, Samsung is expected to change up the design of the Galaxy S25 series. We do expect the Galaxy S25 Ultra to come with a different look too. What PandaFlash X showed us is basically in line with the Galaxy S24 Ultra.

The design of all three Galaxy S25 devices is a mystery at this point

We still don’t know what will either of the company’s upcoming Galaxy S25 flagships look like. That is not all that surprising as we’re currently at the end of March, and almost 10 months away from the expected launch of those devices.

As we get closer to January next year, more info will follow, that much is certain. We’re not even sure Samsung will announce those devices in January 2025. It is expected, but nothing has been confirmed thus far.

Three phones are expected once again, though. The Galaxy S25, Galaxy S25+, and Galaxy S25 Ultra. It remains to be seen if the difference between them will be as considerable as it was with the Galaxy S23 and Galaxy S24 series phones. The ‘Ultra’ always stood out, and not only from the design standpoint.


[ad_2]
Source link

The Moon Malware Hacked 6k ASUS Routers to Use for Proxy

andreasc
-
0
The Moon Malware Hacked 6k ASUS Routers to Use for Proxy
[ad_1]

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and turning them into bots for the Faceless proxy service.

TheMoon bots grew to over 40,000 in early 2024 and enabled Faceless to gain nearly 7,000 new users weekly.

It identified a botnet targeting end-of-life SOHO/IoT devices in late 2023, which is a variant of the previously dormant TheMoon botnet, that infects devices and enrolls them in the Faceless residential proxy service. 

Logical Overview of Faceless Network

Faceless is a successor to the iSocks anonymity service and is popular among cybercriminals for anonymizing their activity, whereas the strong correlation between TheMoon bots and Faceless suggests TheMoon is the main supplier of bots for the Faceless proxy service. 

It mapped the Faceless network and observed a campaign targeting 6,000 ASUS routers within 3 days, while Lumen Technologies blocked traffic to/from Faceless and TheMoon infrastructure and released indicators of compromise to disrupt this operation.

An initial loader exploiting shell availability infects the device and then establishes persistence, sets firewall rules for specific IP ranges, and uses a spoofed NTP request to verify internet connectivity. 

Following a connection attempt to hardcoded IPs and a potential check-in packet, the malware retrieves a secondary payload (worm or proxy) based on instructions from the C2 server. 

Check-in packet from debugger on the left and packet capture on the right
Check-in packet from debugger on the left and packet capture on the right

The Worm Module spreads by exploiting vulnerable web servers and downloading additional modules and the .sox file. Upon execution, it checks for updates, establishes a connection with the Faceless C2 server, and reads Lumen reports.

 The .sox.twn file
 The .sox.twn file

If no update file is found, it uses a hardcoded IP address to connect, and upon receiving the update file, .sox extracts the C2 server address, initiates communication on a random port, and then sends additional scripts to update C2 information or removes traces of the malware, re

The investigation revealed a strong correlation between TheMoon botnet and the Faceless proxy service, where significant overlap between bots communicating with TheMoon and Faceless C2 servers has been observed.

Chart showing the delta between when an infected device communicates with a Moon and Faceless Server
Chart showing the delta between when an infected device communicates with a Moon and Faceless Server

Most new TheMoon bots contacted a Faceless C2 server within 3 days, and both services used the same communication port scheme and founded a Faceless C2 server directly communicating with a TheMoon C2 server, strongly suggesting TheMoon as the primary botnet feeding Faceless.  

Graphic showing the Moon Elf file hosted on a Faceless C2
Graphic showing the Moon Elf file hosted on a Faceless C2

Global Telemetry Analysis – Faceless

The Moon malware infects devices and communicates with its C2 server, as a subset of these devices are enrolled in the Faceless proxy network, where they receive instructions from Faceless C2s and route traffic through an intermediary server before reaching the final destination. 

Longevity of Faceless bots
Longevity of Faceless Bots

The network is particularly useful for bypassing geolocation and IP-based blocking, as analysis shows that while 30,000 bots communicate with TheMoon C2 weekly, only 23,000 connect to Faceless C2s, suggesting some devices interact with TheMoon but not Faceless. 

It has been suspected that the remaining bots might be used for credential stuffing or financial data exfiltration.

Interestingly, some long-lasting connections originate from known threat actor infrastructure, indicating they might be using Faceless for additional anonymity.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter


[ad_2]
Source link
1...263264265...1,470Page 264 of 1,470