Alongside releasing a fix for the recent bugs in Edge and implementing control panel features inside Settings, Microsoft has officially acknowledged and accepted responsibility for its recent server crash issues and informed that the reason was a critical memory leak in the system. The issue was introduced with the March 2024 Windows Server Security Update. It has been causing widespread crashes in Windows domain controllers.
Microsoft confirmed that the issue occurred due to the update released on March 12
The reason behind the recent Microsoft server issues was a memory leak in the LSASS process. It affected servers running Windows Server 2022, 2019, 2016, and 2012 R2. Following widespread reports and complaints from system administrators,
Microsoft confirmed that the issue was caused by the update released on March 12. It was the OS Build 20348.2340 or KB5035857. Affected servers experience unexpected freezes and restarts, with LSASS memory usage continuously increasing until system failure occurs.
Microsoft has assured users that they are actively working on developing a fix for the issue. And they will release it in the coming days. The company acknowledges the severity of the problem and emphasizes its commitment to resolving it promptly.
While Microsoft has made progress in identifying the root cause, they stated that uninstalling the problematic update appears to be the only temporary solution at this time. It is worth noting that this issue specifically impacts environments within organizations that utilize certain Windows Server platforms, with home devices remaining unaffected by the update.
This isn’t the first time Microsoft has faced issues related to LSASS
The recent memory leak problem is not the first time Microsoft has encountered issues related to LSASS. Similar incidents occurred in December 2022 and March 2022, where memory leaks in LSASS resulted in unexpected domain controller reboots after installing Windows Server updates. Microsoft has previously addressed such issues with patches and updates.
While Microsoft works to develop and deploy a fix for the memory leak problem, affected organizations are advised to monitor official communications from Microsoft for updates and instructions on how to proceed. In the meantime, system administrators can take necessary precautions to mitigate the impact of the issue on their environments. Additionally, administrators may consider implementing backup and recovery strategies to safeguard critical data and minimize disruptions caused by this kind of incident.
Plex has dropped support for its virtual reality (VR) apps on older VR platforms. Plex announced that it will no longer support the apps on Google Daydream, Samsung Gear VR, and Oculus Go. While these VR platforms were groundbreaking when they were first released, they have since been outdated by newer VR headsets.
Google released Daydream in 2016, but support ended in 2019 as Google changed its focus. Samsung’s Gear VR was first released in 2014, but development ceased in 2019 as well. Oculus released its Go headset in 2018, but it was replaced by the Oculus Quest after two years.
“As part of our efforts to make sure we’re focusing our resources in ways that best serve our Plex community, we’ve decided to officially end support for our Google Daydream, Gear VR, and Oculus Go apps,” Plex wrote in an email to users.
Plex waves goodbye to VR platforms as a whole
If you’re not familiar with Plex, it’s a media streaming platform for organizing and watching personal collections of movies, TV shows, and music. You can also rent TV shows and movies through the app.
Plex said that low usage of the apps on these legacy VR platforms as a major factor for the decision. With better VR headsets now available, the user base for the older Daydream, Gear VR, and Oculus Go decreased over time. Additionally, as the manufacturers move on to newer products, continuing support for the aging platforms is no longer feasible long term.
The apps will continue to work for now. However, Plex warns they may stop working eventually without ongoing support and updates. Any future changes to the Plex media server could potentially cause compatibility issues or prevent the apps from launching altogether on outdated VR systems.
The move suggests that Plex does not consider legacy VR a development priority going forward. The company has also yet to create apps for the Quest and Quest 2 headsets.
In February 2024 the Canadian government announced plans to ban the sale of the Flipper Zero, mainly because of its reported use to steal cars.
The Flipper Zero is a portable device that can be used in penetration testing with a focus on wireless devices and access control systems.
If that doesn’t help you understand what it can do, a few examples from the news might help.
Flipper Zero made headlines in October because versions running third-party firmware could be used to crash iPhones running iOS 17 (since resolved in iOS 17.2).
Later, reporters found information that car thieves could use the Flipper Zero to intercept, record, and sometimes mimic the signal of a vehicle’s key fob, and if the car was in a garage, the signal of the garage door opener too.
Importantly, this only works on older car models that use fixed numeric codes for their fobs. Not on cars that use rolling codes, which change the numeric code transmitted from a key fob with each use. As a result, car thieves continued to ignore the Flipper Zero in favour of key fob signal boosters and keyless repeaters which are a lot more powerful.
Oddly enough, the car thieving option was mentioned as the main reason for putting a ban on the Flipper Zero in Canada. Although Canada’s Minister of Innovation, Science, and Industry, François-Philippe Champagne said:
“We are banning the importation, sale and use of consumer hacking devices, like flippers, used to commit these crimes.”
Very recently, a group of security researchers presented a series of vulnerabilities in the widely used Dormakaba Saflok electronic RFID locks. This vulnerability impacts over 3 million doors on over 13,000 properties in 131 countries, mostly in hotels.
Reportedly, an attacker only needs to read one keycard from the property to perform the attack against any of its doors. This keycard can be from their own room, or even an expired keycard taken from the express checkout collection box.
Any device capable of reading and writing or emulating MIFARE Classic cards is suitable for this attack. MIFARE is a contactless card technology introduced in 1994. It’s primarly used for transport passes, but its technological capabilities quickly made it one of the most popular smart cards for storing data and providing access control.
One device that can be used for this attack is the Flipper Zero, but an attacker could just as easily use a Proxmark 3 or any NFC capable Android phone.
After an appeal by the security community, Canada now looks like it’s going to move forward with measures to restrict the use of devices like Flipper Zero to legitimate actors only. The specifics will be revealed after deliberation with Canadian companies, online retailers, and the automotive industry.
Conclusions
None of the technology housed within the Flipper Zero is very new, all it does is combine multiple functions into one handheld device. We have never seen any officially confirmed cases of theft using a Flipper Zero. If you want to ban something that helps against car theft, look at keyless repeaters, on the market for a host of car brands and which have no other purpose.
For all the vulnerabilities we described, updates came out that fixed the issues and made the world a safer place, although the patches haven’t been applied everywhere—it’s a lot of work to update all the locks in a hotel, and it’s not feasible to update the fob systems of older cars. Nevertheless, the research by pen testers has led to security improvements, so why would we want to take away their tools?
If we have peaked your interest to buy a Flipper Zero, we urge you to be careful. Due to limited availability there are scammers active that will take your money and send nothing in return.
You can learn more about Flipper Zero by listening to our Lock and Code podcast below. In December 2023, host David Ruiz had a long conversation in with Cooper Quintin, senior public interest technologist with the Electronic Frontier Foundation—and Flipper Zero owner—about what the Flipper Zero can do, what it can’t do, and whether governments should get involved in the regulation of the device.
Google has been working on what was formerly called “Android Automotive” for quite a few years. It’s essentially an operating system that powers the entire infotainment system in your vehicle. However, in 2023, Google decided to rename it “Google Built-in” or “Cars with Google Built-in”. This was a good change since we already had Android Auto, and that was very different from Android Automotive.
In this article, we’re going to go over everything there is to know about Cars with Google Built-In, including vehicles that have the software.
What is Google Built-In?
Google Built-In is essentially the operating system that will run your car’s infotainment system. It runs directly on the in-vehicle hardware. It is a full-stack, open-source, and highly customizable platform that powers the infotainment system. And it supports apps built for Android, and those built for Android Auto.
Google is allowing car makers to customize the skin of Google Built-In that runs on their cars as well, as we’ve seen with GM and Ford recently.
Which means we could see some heavy skins with Google Built-In like we have seen on Android. It’s a way for car makers to differentiate their vehicles from the competitors and also make it blend in better with the car’s interior.
Android Auto vs Android Automotive
Android Auto has been around since 2015. This makes Android Automotive even more confusing; thankfully, it has been renamed to Google Built-In. Here’s a quick explainer between the two.
Android Auto is a platform running on the user’s phone, projecting the Android Auto user experience to a compatible in-vehicle infotainment system over a USB connection. Android Auto supports apps designed for in-vehicle use.
Android Automotive is an operating system and platform running directly on the in-vehicle hardware. It is a full-stack, open-source, highly customizable platform powering the infotainment experience. Android Automotive supports apps built for Android as well as those built for Android Auto.
Essentially, Android Auto is an experience that is powered by your smartphone, while Android Automotive runs natively on the hardware within your car – no smartphone required.
Android Automotive gives users a better experience. As they can just get in the car and start using their streaming service of choice, Google Maps, and even make phone calls, without having to plug in their phone. That might sound like a minor thing, but it can make a big difference. Of course, you can do this with Wireless Android Auto, but Android Automotive will not use up your phone’s battery life, which is really nice.
What is Google Automotive Services?
Even though Google doesn’t talk about it, you’ve likely heard about Google Mobile Services. This is basically the license that smartphone OEMs can apply for, to be able to run Google services on their phone. You’ve probably heard a lot more about GMS since the whole Huawei fiasco, and it losing access to GMS since President Trump banned them from working with US companies.
Well, Google Automotive Services or GAS, is essentially the same thing. As Google puts it “is a collection of applications and services that automotive OEMs can choose to license and integrate into their in-vehicle infotainment (IVI) systems.
Basically, if a car is using Google Built-In, it is in their best interest to license GAS, which will make their user experience even better. As GAS does include every Google service out there. That includes Google Assistant, YouTube Music, Google Maps, and much more, including the underlying Google Play Services.
Are apps available in the Google Play Store?
As mentioned before, Goole Built-In works with Android and Android Auto apps, which means that apps for Goole Built-In are available within the Google Play Store, including apps to control the temperature of your car. In fact, Polestar’s app for climate control is available in the Play Store (though you’ll only see it if you have a Polestar 2 on your Google account). But, not all Android Auto apps are available for Goole Built-In. Currently, the list of Goole Built-In apps is pretty short.
This opens up a lot of possibilities, as Polestar (and other car makers) could also opt to really change up the interface of the car. Or add additional modes. As all it takes is a simple app update. It’s pretty similar to what Motorola was doing almost a decade ago, where it pushed a lot of its system apps to the Play Store and updated them that way, instead of through a system update.
It’s a pretty interesting way to improve your infotainment experience, but this means that you could choose between different navigation apps like Google Maps or Waze, for example. Of course, this is just the early days of Goole Built-In, so this could change vastly in the coming years.
What apps are available, and what do they look like?
Like with Android Auto, apps on Google Built-In are forced to stick within strict design guidelines. And the point in this is so that you don’t spend a ton of time looking at the screen while you are driving. So the apps look similar to how they would in Android Auto, but perhaps in a different aspect ratio. That means bigger touch targets, which makes it easier to use while driving.
However, with Goole Built-In, app developers do get a bit more leeway in how they can design their apps. Spotify, for example, looks sort of like how it does on the desktop. But with a larger DPI, of course.
There are still design guidelines for Goole Built-In, but they aren’t as strict. As we’ve seen with Polestar and Hummer so far, companies don’t need to stick with material design for Goole Built-In. Though when it comes to media apps, the touch targets will mostly be in the same area, across different apps. So you can use muscle memory to change songs and such without having to look at the display for long.
Then there are sign-ins. That’s still something that Google, developers and car makers need to address. Signing in on the screen in your car isn’t particularly user-friendly. Though, a screen like the Polestar 2 has, is a lot easier. As it is a larger portrait orientation screen.
Car makers are also releasing their own apps to find chargers, particularly for electric and hybrid vehicles, which is going to be a lot easier to use, then to pull out your phone and open the PlugShare app to find where you can charge your Polestar 2. These are apps that are needed for newer cars, which are also electric.
Video apps & Chromecast
Google announced at Google I/O 2022 that it was bringing video apps over to Goole Built-In. This is after it had already announced that YouTube was coming. Some other names it threw out included EPIX NOW and Tubi TV. So you can watch videos while you’re stopped and charging.
Additionally, Chromecast is coming, which will allow you to Cast basically any video to your screen in your vehicle. But only while you are parked, for obvious safety reasons.
Do I need to login to use my car?
Google is going to want you to sign in, and of course that will make it easier to download and use apps. But it is not required. But we would highly suggest you do, as the Goole Built-In software can bring in cloud preferences and user customization from your account.
Notably, offline Goole Built-In should work pretty much the same as it does when you are logged in. All of the vehicle apps will work. Meaning you don’t need to sign into your Google account to change the temperature on your AC.
So why is Google making Goole Built-In usable without an account? China. Countries like China where Google services are not available, need to be able to use these cars too. And in China, it would be pretty much impossible to use. But they can still use apps like WeChat, QQ Music and Baidu Maps. Though it will be interesting to see how the Polestar 2 would look in China.
What vehicles support Goole Built-In?
Currently, there are a number of cars that have Google Built-In available. From brands including Polestar, Volvo, Chevrolet, GMC, Cadillac, Renault, Honda and Nissan. With more coming on board later this year. Google has already announced that Ford Lincoln and Buick will have vehicles with Google Built-in coming soon.
These are the current cars that have Android Automotive built-in:
Acura ZDX (2024+)
Cadillac Celestiq
Cadillac CT5 (2025+)
Cadillac Escalade IQ
Cadillac Lyriq[25]
Cadillac XT4 (2024+)
Chevrolet Colorado (2023+)
Chevrolet Corvette E-Ray
Chevrolet Equinox (2025+)
Chevrolet Equinox EV
Chevrolet Silverado (2022+)
Chevrolet Silverado EV
Chevrolet Suburban (2022+)
Chevrolet Tahoe (2022+)
Chevrolet Traverse (2024+)
Ford Explorer (2025+)
GMC Canyon (2023+)
GMC Hummer EV
GMC Sierra (2022+)
GMC Yukon (2022+)
Honda Accord (2023+)
Honda Prologue (2024+)
Lincoln Aviator (2025+)
Lincoln Nautilus (2024+)
Nissan Interstar (2024+)
Nissan Rogue (2024+)
Polestar 2
Polestar 3
Polestar 4
Polestar 5
Renault 5 E-Tech
Renault Austral
Renault Espace (2024+)
Renault Mégane E-Tech Electric[27]
Renault Master (2024+)
Renault Rafale
Renault Scénic E-Tech (2025+)
Volvo C40
Volvo EX30
Volvo EX90
Volvo S60 (2023+)
Volvo S90 (2022+)
Volvo V60, V60 Cross Country (2023+)
Volvo V90, V90 Cross Country (2022+)
Volvo XC40 (excluding T2 engine model) (2023+)
Volvo XC40 Recharge (only BEV version)
Volvo XC60 (2022+)
Volvo XC90 (2023+)
Why would a car maker use Goole Built-In over their own system?
A big question with Goole Built-In is, why would a car maker like Toyota want to use it over its own system? As you might have noticed, Toyota has not jumped on board yet. However, they were pretty slow in adopting Android Auto too.
And that’s what Google has been trying to talk car makers into doing. Allowing them, a software company, to build the software for their vehicles. Which also means that they will get tighter integration into Google services like Google Maps, Google Assistant, and others. Which is much better than, say, Ford’s built-in navigation and voice commands. Which is why vehicle makers are starting to jump on board with Google pretty quickly.
How does Goole Built-In benefit the user?
The biggest benefit is, this is going to be software you are already familiar with. Mainly if you use Android. Instead of some cumbersome software that the manufacturer threw together, which is typically pretty terrible.
It’s also going to bring all of your favorite apps to your vehicle, without having to plug in your phone to use them like Spotify, Google Maps, Waze, Google Assistant, and much more. Imagine being able to ask the Google Assistant to turn down the AC in your Hummer EV. That will be possible thanks to Goole Built-In, which is huge.
But the biggest benefit is definitely the usable software. We’ve all used the software from companies like Ford, GM, Chrysler, Toyota and others, and know just how bad it really is. And Google will change that with Goole Built-In here.
Will my next vehicle have Goole Built-In?
Most likely. Even though the automotive space does move pretty slowly, your next car will most likely have Goole Built-In unless you are buying a new car this month.
Where Google has Ford, Chrysler, Dodge, Chevy, Cadillac, Buick, GMC, Nissan, Mitsubishi, and Volvo all on-board already for Goole Built-In. It’s very likely that your next vehicle is going to sport it. And as an Android user, that’s going to make for an exciting drive.
MediaTek’s next flagship chip, the Dimensity 9400, is coming in October, it seems. This information has been revealed by Digital Chat Station, one of the best-known tipsters from China.
That’s not all he revealed, however. The tipster also shared some details for that chip, and talked about the Dimensity 9300+ as well. Let’s focus on the Dimensity 9400 first, though, shall we?
The MediaTek Dimensity 9400 is coming in October, here are some details
The tipster says that the chip won’t include any efficiency cores, not at all. It will utilize Cortex-X5, Cortex-X4, and Cortex-A7xx cores. We’re not sure about the setup, though. A single Cortex X5 core could be included, along with three Cortex-X4 cores, and four Cortex-A7xx cores.
Needless to say, this will be one of the most powerful processors in the market once it arrives. Let’s just hope that MediaTek has thermals in mind and that the chip will keep that under control. The MediaTek Dimensity 9400 will be a 3nm chip, by the way, made by TSMC.
The MediaTek Dimensity 9300+, on the other hand, is said to arrive at some point in May. That chip will have a Cortex-X4 core clocked at 3.4GHz, and the Immortalis-G720 MC12 GPU that will run at 1,300MHz.
The Snapdragon 8 Gen 4 will launch in October too
As many of you know by now, the Snapdragon 8 Gen 4 will launch in October as well. So both Qualcomm and MediaTek will show off their flagship chipsets in the same month. Those will be some of the most powerful mobile chips on the market, alongside Apple’s next offering.
It will be interesting to see how will they compare, as the Snapdragon 8 Gen 4 is also rumored to ship without efficiency cores. Qualcomm does intend to use its custom Oryon cores for the first time, though. The competition will be fiercer than ever this time around, that’s for sure.
Malware loaders (also known as droppers or downloaders) are a popular commodity in the criminal underground. Their primary function is to successfully compromise a machine and deploy one or multiple additional payloads.
A good loader avoids detection and identifies victims as legitimate (i.e. not sandboxes) before pushing other malware. This part is quite critical as the value of a loader is directly tied to the satisfaction of its “customers”.
In this blog post, we describe a malvertising campaign with a loader that was new to us. The program is written in the Go language and uses an interesting technique to deploy its follow-up payload, the Rhadamanthys stealer.
Malicious ad targets system administrators
PuTTY is a very popular SSH and Telnet client for Windows that has been used by IT admins for years. The threat actor bought an ad that claims to be the PuTTY homepage and appeared at the top of the Google search results page, right before the official website.
In this example, the ad looks suspicious simply because ad snippet shows a domain name (arnaudpairoto[.]com) that is completely unrelated. This is not always the case, and we continue to see many malicious ads that exactly match the impersonated brand.
Fake PuTTY site
The ad URL points to the attacker controlled domain where they can easily defeat security checks by showing a “legitimate” page to visitors that are not real victims. For example, a crawler, sandbox or scanner, will see this half finished blog:
Real victims coming from the US will be redirected to a fake site instead that looks and feels exactly like putty.org. One of the big differences though is the download link.
The malicious payload is downloaded via a 2 step redirection chain which is something we don’t always see.
puttyconnect[.]info/1.php HTTP/1.1 302 Found Location: astrosphere[.]world/onserver3.php
astrosphere[.]world/onserver3.php HTTP/1.1 200 OK Server: nginx/1.24.0 Content-Type: application/octet-stream Content-Length: 13198274 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename="PuTTy.exe"
We believe the astrosphere[.]world server is performing some checks for proxies while also logging the victim’s IP address. This IP address will later be checked before downloading the secondary payload.
That PuTTy.exe is malware, a dropper written in the Go language (version 1.21.0).
Its author may have given it the name “Dropper 1.3“:
Follow-up payload
Upon executing the dropper, there is an IP check for the victim’s public IP address. This is likely done to only continue with users that have gone through the malicious ad and downloaded the malware from the fake site.
If a match is found, the dropper proceeds to retrieve a follow-up payload from another server (192.121.16[.]228:22) as seen in the image below:
To get this data, we see it uses the SSHv2 (Secure Shell 2.0) protocol implemented via OpenSSH on a Ubuntu server. We can only think of using this protocol to make the malware download more covert.
That payload is Rhadamanthys which is executed by the parent process PuTTy.exe:
Malvertising / loader combo
We have seen different types of loaders via malvertising campaigns, including FakeBat which we profiled recently. Given how closely the loader is tied to the malvertising infrastructure it is quite likely that the same threat actor is controlling both. The service they offer to other criminals is one of malware delivery where they take care of the entire deployment process, from ad to loader to final payload.
We reported this campaign to Google. Malwarebytes and ThreatDown users are protected as we detect the fake PuTTY installer as Trojan.Script.GO.
ThreatDown users that have DNS Filtering can enable ad blocking in their console to prevent attacks that originate from malicious ads.
We previously reported a new feature in WhatsApp, where users can protect their IP address in calls. Now WhatsApp is enhancing user privacy further with a new feature in development that gives users more control over their messages.
Reports indicate that WhatsApp is working on an update that will allow users to disable link previews within chats. This new feature named “Disable link previews” is currently being tested in the WhatsApp beta for Android 2.24.7.12 and is expected to roll out to users in the beta program with a future update soon. It will likely roll out to all users once the testing is complete.
Link previews fetch a preview of webpages shared in chats
Link previews are a convenient feature in WhatsApp, automatically fetching a preview of webpages shared in chats. WhatsApp typically relies on its servers to generate these previews. However, they can sometimes expose information before recipients click on the link, potentially leading to clickbait. To address this, WhatsApp is developing the option to disable link previews, giving users the choice to generate previews or not when sharing links. This empowers users to exercise greater caution and protect sensitive information contained within previews.
Previously, the platform introduced features like disappearing messages and call encryption to safeguard user communication. By offering this new option, WhatsApp aims to provide users with more control over their online interactions and the information they share.
Credit: WABetaInfo
However, users will still be able to click the link and access whatever there is
While disabling link previews can mitigate the risk of misleading links, it’s important to note that users can still see the actual URL when a link is shared. Additionally, malicious actors might use deceptive link shorteners to bypass this control. Nevertheless, this added layer of control enables users to be more cautious and make informed decisions about the links they click within WhatsApp chats.
The upcoming update is currently in the development stage in the WhatsApp beta, with no announced release date yet. Once implemented, users can expect to find the option to disable link previews in their WhatsApp settings. This feature is part of WhatsApp’s ongoing efforts to prioritize user privacy and security. Nonetheless, even with the link previews disabled, users will still continue to see link previews from their contacts unless they disable it on their end.
Aside from the privacy features, WhatsApp is also working on improving the functionality of the app. You will soon be able to share a 1-minute video on your status.
Samsung has reportedly significantly improved its 3nm yield rate in recent times. The yield rate initially hovered around 10-20% but has now increased by over threefold. The information came from noted X tipster @Tech_Reve. The source didn’t share a precise figure but said that Samsung’s 3nm yield is still lower than TSMC’s.
Samsung sees big improvement in 3nm yield
Yield rate is a measure of the usable chips manufactured at a facility. It is calculated as the percentage of the total number of chips produced to the maximum chip count on one wafer. If the yield rate is high, the number of defective chips is low. In other words, a high yield rate translates to a greater manufacturing capacity.
Samsung started making 3nm chips in 2022 but has been struggling with the yield rate. It switched from the FinFET transistor architecture to the more advanced GAA architecture and is seemingly unable to get things right. TSMC, the Korean firm’s arch-rival in the semiconductor foundry industry, is still using the FinFET architecture and is enjoying a better 3nm yield.
This has helped the Taiwanese company win big manufacturing contracts. Despite a headstart in 3nm mass production, Samsung is lagging behind its rival. There are some positive signs though, if the latest report is accurate. While TSMC still has a better 3nm yield, the technological gap between the two firm’s 3nm processes is narrowing.
According to the tipster, Samsung’s second-gen 3nm technology is now on par with TSMC’s N3P process node in terms of PPA (Power, Performance, and Area) metrics. Compared to 4nm chips, which employ the FinFET architecture, the power efficiency and logic area have increased by 20-30%. This should help Samsung gain some foothold in the 3nm semiconductor market.
Samsung’s 2nd-gen 3nm process is undergoing a confusing rebranding
The report about improved 3nm yield comes just weeks after Samsung informed its customers about a rebranding of its 2nd-gen 3nm process. The company will call the process 2nm instead of 2nd-gen 3nm. Yes, it is technically a 3 nanometer process but the Korean firm is renaming it to 2nm. Its “real” 2 nanometer chips are expected to arrive in the second half of 2025.
Samsung has already rewritten the manufacturing contracts it signed earlier for its 2nd-gen 3nm process. Japanese AI startup PFN (Preferred Networks) is its first customer of the rebranded 2nm chips. Qualcomm has also requested 2nm samples from Samsung, though it likely wants samples of the real 2nm chip and not the misleadingly rebranded one.
Sign1 malware targets WordPress websites, injecting malicious code that redirects visitors to scams or bombards them with ads – Sucuri researchers discovered this evasive malware, urging website owners to update software and implement security measures to protect their sites.
Cybersecurity researchers at Sucuri have uncovered a concerning new malware campaign targeting WordPress websites. Dubbed “Sign1,” the malware injects malicious code into vulnerable websites, ultimately redirecting visitors to scam sites or bombarding them with unwanted pop-up ads.
The new malware discovery emerged shortly after Check Point Software Technologies Ltd. disclosed a malicious campaign named FakeUpdates, which specifically targeted WordPress websites with malware.
Sign1 malware’s stealthy tactics make it a significant threat. The malware leverages time-based randomization to generate dynamic URLs, making it difficult for security software to identify and block them. Additionally, the code itself is obfuscated, further hindering detection.
Perhaps most concerning is Sign1’s ability to target visitors from specific websites, such as popular search engines and social media platforms. This suggests a level of sophistication, potentially allowing attackers to focus on users they deem more susceptible to scams.
Sucuri’s reportestimates that over 39,000 WordPress websites have been infected with Sign1 thus far. Website owners are urged to take immediate action to protect their sites and visitors.
How to Protect Your WordPress Website from Sign1
If you are using WordPress as your website’s content management system (CMS), here are some simple yet vital steps to protect the website from Sign1 and other similar malware:
Update WordPress core, themes, and plugins regularly. Outdated software often contains vulnerabilities that attackers exploit.
Implement strong security practices. This includes using secure passwords, enabling two-factor authentication, and keeping backups of your website data.
Use a reputable website security scanner. Regularly scan your website for malware and vulnerabilities.
Be cautious when installing plugins. Only install plugins from trusted sources and with good reviews.
Website owners who suspect their site may be infected with Sign1 malware should:
Contact a security professional or your WordPress hosting company. They can help identify and remove the malware.
Change all website passwords. This includes the WordPress admin password, FTP password, and database password.
Nevertheless, the discovery of Sign1 malware goes on to show the vulnerable state of websites. With more than 835 million sites using WordPress even a small threat could end up compromising a staggering number of sites.
It’s crucial to stay informed about the latest security vulnerabilities and take proactive steps to protect your website. Security researchers like Sucuri play a vital role in identifying and mitigating these threats.
Earlier this month, Samsung launched the Galaxy A55 as its premium mid-range offering for 2024. The company is now readying an M-series equivalent of the device. Leaked renders have revealed that the Galaxy M55 will sport a slightly different design than the A-series model. A fresh leak has just revealed its detailed specs and those differ too.
The Galaxy M55 has its specs leaked ahead of launch
According to an MSPowerUser report, Samsung will equip the Galaxy M55 with a 6.7-inch Super AMOLED+ display with a Full HD+ resolution, a 120Hz refresh rate, and 1,000 nits of peak brightness. It is a slightly larger panel than the Galaxy A55 (6.6 inches), though the rest of the display specs are unchanged. Both phones have a punch-hole display design, so they look identical from the front.
However, Galaxy M55’s back panel appears slightly curved on the edges. It is also likely a plastic back instead of glass. The frame is also expected to be made of plastic rather than aluminum. Speaking of the frame, Samsung isn’t employing its Key Island frame design here. It’s a standard flat frame with power and volume buttons on the right side. The power button isn’t recessed, hinting at an under-display fingerprint scanner.
The camera design is similar to other Galaxy smartphones launched lately. Samsung will reportedly offer a 50MP main camera, an 8MP ultrawide lens, and a 2MP macro camera on the back. The Galaxy M55 has a 50MP selfie camera on the front. You should get some premium camera features such as OIS (Optical Image Stabilization), dual recording, 4K video recording, and Nightography.
45W charging and 12GB RAM may be on the cards
The Galaxy M55 will reportedly pack a 5,000mAh battery with 45W Super Fast Charging 2.0, a first for non-flagship Samsung phones. Qualcomm’s Snapdragon 7 Gen 1 chipset will power the phone, supported by 8GB and 12GB RAM options. Storage options will include 128GB and 256GB, with Samsung also offering microSD card support up to 1TB. The phone boasts Dolby Atmos sound, Bluetooth v5.2, NFC, and Samsung Knox Vault.
Samsung will ship the Galaxy M55 with Android 14-based One UI 6.1. The device should get four major Android OS updates (up to Android 18) and five years of security patches. The handset will be available in Black and Sky Blue colors and will be relatively lightweight at just 180 grams. A launch date and pricing details are missing but should be available soon. The Galaxy M54 arrived on the market in April 2023.
