Google confirms Fitbit Labs is coming to Premium subscribers later this year

0
[ad_1]

Google completely embraced AI (artificial intelligence) and is now trying to implement it in just about every aspect of our lives. If you’re using a Google-made device or software, chances are that you’re already benefiting from many of the perks all these AI-focused tools have to offer.

Moreso if you’re a Fitbit Premium subscriber as Google has just announced it will roll out some experimental AI features later this year. Dubbed Fitbit Labs, the AI-oriented program is very close to reaching maturity, which is why Google has decided to make it available to select Fitbit Premium subscribers for further testing.

Fibit Labs has been specifically designed to help users get a deeper understanding of their health data and make conscious decisions based on these health insights. Those who will get access to Fitbit Labs will be able to ask questions “in a natural way,” as well as make charts to help them understand their own data better.

The AI program is the result of the collaboration between Fitbit, Google Research and wealth and wellness experts, doctors, as well as certified coaches. Fitbit Labs will use a new Personal Health LLM (Large Language Model), which will power all AI features across Google’s portfolio.

According to Google, some Fitbit Labs features will be made available later this year to a limited number of Android users who are enrolled in the Fitbit Labs program in the Fitbit mobile app.

[ad_2]
Source link

Microsoft Notifies of Major Domain Change With Teams is Coming

0
[ad_1]

In April 2023, Microsoft announced that it would be undertaking a multi-year effort to reduce domain fragmentation among authenticated, user-facing Microsoft 365 apps and services by bringing them onto a single, consistent and cohesive domain: cloud.microsoft.

This consolidation will help improve security, administration, and user experience across the board, and will ultimately lay a foundation for better and tighter integration across the Microsoft 365 ecosystem.

As we prepare to migrate the Teams, Outlook, and Microsoft 365 web apps to the cloud.microsoft domain, developers of Teams apps – including those that run on Outlook and Microsoft 365 – need to take the actions described below to ensure that those apps continue to function on the new domain.

If no action is taken, your app may not render in the new domain (teams.cloud.microsoft) when it goes live in June 2024.

If you are unable to update your app before that time, any tenant running your app will remain on teams.microsoft.com while we work with you to make the necessary changes.

This change impacts embedded applications where an external web app is rendered inside Teams, Outlook, or Microsoft 365. If your app falls into this category, it will be affected.

How To Prepare Your App For cloud.Microsoft

Today, apps that embed their web content in a Microsoft 365 host application such as Teams, Outlook, or Microsoft365.com run on a set of inherently trusted domains that are hardcoded in the TeamsJS client library.

To support the rollout of applications under cloud.microsoft domain and make future cross domain app integration more seamless, Microsoft will migrate this list of trusted domains to a new CDN endpoint to be called on app initialization.

This change was released in early January 2024 as part of Teams JS version 2.19 release. This new list will be dynamic, which will limit the impact of any future domain changes on your app.

To avoid any breaking changes to your app in the new domain, you will need to perform the following actions:

  1. Upgrade Teams JS library to version 2.19 or higher.
  2. Update your x-frame-options/CSP headers to allow for the new domains. To ensure the app keeps working across existing and future Microsoft 365 hosts, please ensure to allow “*.cloud.microsoft”.

Timeline And Impact:

To prepare your app for the transition to teams.cloud.microsoft, please complete the changes above as soon as you are able.

The teams.cloud.microsoft domain is now available for testing, with full operation alongside teams.microsoft.com expected in June. At that time, the expected user experience will be as follows:

App opened in teams.microsoft.com:

  • Everything will work as expected.

App opened in teams.cloud.microsoft:

  • CTAs complete: Everything will work as expected.
  • CTAs not complete: Error message given with guidance for the user to navigate to teams.microsoft.com to use the app.

The transition to cloud.microsoft will benefit users and developers across the Microsoft 365 ecosystem.

We are excited to take the next steps toward bringing Teams, Outlook, and Microsoft 365 onto the unified domain, and extending those benefits to app developers as well.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

Predictive Back is finally rolling out to Gmail

0
[ad_1]

This is a feature that we’ve been hearing about for quite some time. We first heard about the Predictive Back feature coming to Android since the lead-up to Android 13. Now, we’re finally getting to see this feature actually making it to devices. Predictive Back is starting to roll out to people using Gmail on Android 14.

Predictive back isn’t a major lifestyle change, but it could definitely make life a little more convenient. Since the adaptation of back gestures, it’s become really easy to accidentally go back when you’re just trying to swipe across the screen. It is a feature that will show you a little preview of what will happen if you perform the back gesture.

For example, if using the back gesture would cause you to go back to your home screen, then you will see a little preview of your home screen appear before you perform the back gesture. It’s a way of showing you that, if you activate the back gesture at that point, you will go to the home screen. It can give people a bit of a warning if they happen to activate the back gesture by mistake.

Predictive Back is landing on Gmail for some users

So far, the development and rollout of Predictive Back has been a little slow. Again, we’ve seen reports about this feature back in 2022. However, it appears that Google is finally ready to start rolling it out. Some users are reporting being able to use this feature in Gmail if they’re running the latest version of the app.

This was spotted for people using Gmail version 2024.03.03.x. When closing out of an email by using the back gesture, users will see that email subtly shrink into a small window before actually closing the email. This way, people will be able to see that they are activating the back gesture so they don’t accidentally close it without wanting to.

At this point, we don’t know exactly how widespread this test is, so there’s a chance that you won’t see it. However, if you want to see if your device has it, you can update Gmail to the most recent version. You can either go to the Google Play Store and search for the Gmail application or go to the Gmail app icon on your home screen, hold your finger down, and tap on the App Info button. Once you’re on the app info screen, scroll all the way down to the bottom and tap on the app details button. This should take you to the Google Play Store page.

On the page, look for the Update button. If you don’t see the update button, then you’ll just want to wait for this feature to make it to you.


[ad_2]
Source link

Androxgh0st Exploits SMTP Services To Extract Critical Data

0
[ad_1]

AndroxGh0st is a malware that specifically targets Laravel applications. The malware scans and extracts login credentials linked to AWS and Twilio from .env files.

AndroxGh0st was previously classified as an SMTP cracker since it exploits SMTP using various strategies such as credential exploitation, web shell deployment and vulnerability scanning.

However, the main goal of the malware is to compromise the hosts and extract critical data from Laravel applications. Malware has an adaptive nature and many other capabilities.

Androxgh0st Exploits SMTP

According to Juniper’s reports, the malware comes with menu options that highlight all its functionalities and features.

There are several options available on the malware such as awslimitcheck, sengridcheck, twilio_sender, exploit and many others.

These options have different usages and capabilities.

Menu options (Source: Juniper)

The “awslimitcheck” can be used to check AWS account limits and other information on email-sending quotas.

The sendgridcheck option is designed to check and report essential details about a SendGrid API key.

This API key can further be used to gather details such as total email credits, used credits, and the ‘Mail from’ address associated with the SendGrid account”.

The Twilio_sender function can be used to send SMS messages via the Twilio API and also checks the Twilio account status and balance and for sending a test SMS to a predefined number.

The exploit function is used to target PHP unit testing framework for executing an arbitrary PHP code by sending a crafted POST request to a specific URI.

Moreover, the malware also exploits three critical vulnerabilities associated with Laravel web applications.

The CVEs for these vulnerabilities were CVE-2017-9841, CVE-2018-15133, and CVE-2021-41773

Attack Flow (Source: Juniper)

The attack chain starts with entering the vulnerable system using the CVE-2021-41773 which is a weakness in Apache.

Following this, the malware exploits CVE-2017-9841 and CVE-2018-15133 for executing code and establishing persistent control on the targeted system. 

Challenges For An Attacker

Though this malware provides these different functions for different usage, there are still many challenges for a threat actor to perform these actions on the targeted systems.

The awslimitcheck function requires valid AWS credentials, Boto3 library and proper configuration of the AWS SES (Simple Email Service) for successful execution.

The sendgridcheck function requires a valid SendGrid API key. Additionally, the API key must also have necessary permission to retrieve required information.

The twilio_sender option requires a valid Twilio account, Auth token and a Twilio phone number with sufficient balance for extracting information and sending SMS.

The exploit option requires the presence of the PHPUnit vulnerability in the target system for successful exploitation.

Additionally, the threat actor must also have knowledge about the vulnerable URI and must craft a payload to bypass any security measures that are in place. 

Moreover, the validation of successful exploitation requires access to server logs and other monitoring mechanisms.

If the malware is successful in compromising the systems with CVE-2017-9841, CVE-2018-15133, and CVE-2021-41773, there are possibilities for data breaches and network disruptions.

Logs from .env request (Source: Juniper)

Indicators Of Compromise

File Samples

  • f6f240dc2d32bfd83b49025382dc0a1cf86dba587018de4cd96df16197f05d88 – AndroxGhost python sample
  • 3b04f3ae4796d77e5a458fe702612228b773bbdefbb64f20d52c574790b5c81a – AndroxGhost python sample

Linux Miners

  • 23fc51fde90d98daee27499a7ff94065f7ed4ac09c22867ebd9199e025dee066 – Linux Miner dropped
  • 6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc – Linux Miner dropped
  • bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7 – Linux miner dropped

PHP Webshell

  • ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72 – PHP Webshell
  • 0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef – PHP Webshell

TOP IP – Attack Originated From

  • 103.121.39[.]54
  • 185.16.39[.]37
  • 155.138.245[.]246
  • 149.50.102[.]48
  • 45.143.200[.]14
  • 45.135.232[.]19
  • 45.129.14[.]224
  • 91.92.245[.]67
  • 64.225.6[.]114
  • 122.189.200[.]188
  • 66.135.11[.]147
  • 155.248.212[.]175
  • 118.31.17[.]168
  • 45.135.232[.]28
  • 77.90.185[.]106
  • 194.26.135[.]68
  • 218.107.208[.]71
  • 172.98.33[.]153
  • 5.255.115[.]40
  • 45.134.26[.]85
  • 180.101.88[.]225
  • 180.101.88[.]237
  • 80.66.76[.]80
  • 83.97.73[.]76
  • 91.240.118[.]221
  • 91.240.118[.]228
  • 109.123.229[.]56
  • 213.109.202[.]210
  • 213.109.202[.]145
  • 180.101.88[.]230
  • 180.101.88[.]220
  • 103.96.40[.]38
  • 128.199.237[.]61
  • 173.199.117[.]55
  • 62.20441[.]80
  • 77.83.36[.]40
  • 103.255.191[.]43
  • 213.109[.]202.167
  • 141[.]98.11.107
  • 162.0[.]234.118
  • 91.240.118[.]224
  • 185.248[.]2476
  • 185.161.248[.]148
  • 38.175.192[.]78
  • 176.113.115[.]220
  • 77.90.185[.]102
  • 80.66.66[.]225
  • 200.54.189[.]98
  • 185.234.216[.]125
  • 176.113.115[.]184 

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

Galaxy S24 series to get major camera update in April

0
[ad_1]

Samsung recently revealed that it is readying a new update for the Galaxy S24 series to address camera zoom issues. It appears the said update will bring more camera fixes and enhancements. According to noted tipster Ice Universe, the company will push a major camera update to the new flagships in April.

Galaxy S24 may get its second major camera update next month

Samsung released the Galaxy S24, Galaxy S24+, and Galaxy S24 Ultra at the end of January. The phones picked up a major update in February. The company optimized the camera algorithm to improve the image quality. We have noticed some improvements but there is still plenty of work to be done. Samsung was expected to further optimize the camera performance in March but it only pushed the latest security patch this month.

A few days ago, it acknowledged image quality issues at certain zoom levels on the Galaxy S24 Ultra and promised a fix. The firm didn’t reveal when the update will arrive, but an April release seems logical. Ice Universe has now chipped in saying that the April update for the new Ultra flagship will be a major one. It will improve the white balance and zoom image quality, among other camera fixes and improvements.

While we don’t have more details, we can confirm that Galaxy S24 phones struggle to produce accurate white balance in photos. We have already discussed the image quality issue when zooming. These are common problems across all three models. As such, the entire lineup should get the said “major camera update” next month. The update may also bring other functional and stability improvements to the new Samsung flagships.

The X post by Ice Universe adds that the March update for the Galaxy S24 Ultra “will add an underage mode and some optimizations.” As we said above, Samsung has already released the March update for the new flagships and it only brought the latest camera fixes. However, the update isn’t yet available in China, which is where the tipster is located. They may be referring to the March update for the Galaxy S24 in their home country.

Samsung’s new flagships are selling well globally

The Galaxy S24 series may have some camera issues but those seemingly haven’t affected this sales. The new Samsung flagships are selling well globally, better than the Galaxy S23. In some regions, sales have reached a new high after several years. The Korean firm plans to sell more than 35 million units of the three models combined this year. Whether it hits the target, only time will tell.


[ad_2]
Source link

Survey shows that 77% of Americans were fooled by AI content

0
[ad_1]

You’ve most likely been fooled by AI-generated contentArtificial intelligence technology is going to be the main topic surrounding tech for years to come. It’s significant in its potential for good and potential for disaster. Well, All About Cookies performed a survey on 1,000 internet users in the US to get their thoughts on AI technology. It appears that most people have been tricked by AI content at some point.

Between AI image generation, AI text generation, AI music generation, and AI video generation, AI voice generation, there’s a lot out there that can fool people into thinking that they’re looking at actual human-created content. What makes things worse is the fact that it’s getting better as time goes on. Nowadays, generators such as DALL-E, Mid-Journey, Stable Diffusion, etc. spit out images that can fool the mass majority of the population. Also, let’s not think about the potential ramifications of Sora, OpenAI’s absolutely insane video generator, hitting the market.

So, surveys like these are important so that we can get a glimpse into what people are thinking. CEOs and executives of large AI companies are all too eager to tell you about the benefits of AI technology. However, we don’t often hear the voice of the little people, the hoi polloi. So, the results of the survey from All About Cookies do a better job of painting an accurate picture.

AI content has fooled most people in, a survey reveals

The point of this survey was to pick Americans’ brains about generative AI technology and content. The survey asked questions such as how many people have been fooled by AI content, should content creators be legally responsible for what they produce, should social media sites be able to use people’s data, and so on.

Based on the findings, it appears that AT content has cooled 77% of the survey people. That’s very unsettling. AI-generated content exists in many forms on the internet, so it’s not uncommon for people to see AI-generated content several times during the day. Some pieces of media are obvious like AI-generated images that show obvious tells. However, as the technology gets better, it’ll get much harder to differentiate between what’s real and what’s not.

 Other results

The other results from the survey reveal more about the story. Of the people surveyed, 93% said that companies should be legally required to disclose when they use generative AI content. 82% said that celebrities and public figures should have protections against having their likenesses used for AI models. 72% believe that content creators should be legally responsible for AI content.

When it comes to the actual data and the use thereof, 97% of the surveyed users said that there should be protections against social media companies using their data. 45%believe that user data should be opt-in only, while 37% believe that user data should be used with exclusions or updated terms of service. Surprisingly, only 25% of people said that social media companies should not be able to use their data to train AI.

Next, when it comes to accountability, a whopping 72% of people said that people who post AI content should take legal responsibility for it. So, if the content they create makes them liable for a lawsuit, they should take the lawsuit. The company that makes the AI tool shouldn’t. A minuscule 16% said that sites that post and create AI content should share legal responsibility.

The people have spoken

It should come as no surprise that many people do not like the idea of AI content. Along with the potential for good, there is a ton of potential for bad. Users are not comfortable with handing over their data to companies, and they’re not comfortable with technology that could potentially spread misinformation. Hopefully, more services like these will come about to show how people are responding to AI technology.


[ad_2]
Source link

NCSC Released an Advisory to Secure Cloud-hosted SCADA – GBHackers on Security

0
[ad_1]

Operational Technology (OT) is a technology that interfaces with the physical world and includes Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), and Distributed Control Systems (DCS). 

OT is different from IT in that OT prioritizes safety, reliability, and availability, while IT focuses on information confidentiality, integrity, and availability. 

The convergence of OT and IT increases system vulnerabilities, which can be addressed by adopting sound risk management principles. 

Document

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

The NCSC published cyber security design principles to help architects and designers produce secure, resilient OT systems.

Cloud-hosted supervisory control and data acquisition (SCADA)

Critical considerations for OT organizations migrating Supervisory Control and Data Acquisition (SCADA) systems to the cloud while acknowledging the growing adoption of cloud-based SCADA solutions for various functionalities, from data processing to full control of physical assets. 

It emphasizes the importance of a risk-based decision-making process, highlighting cybersecurity as a core concern. 

SCADA systems are critical for monitoring and controlling physical infrastructure, making them prime targets for cyberattacks, especially for organizations managing Critical National Infrastructure (CNI).

Legacy SCADA systems were isolated (air-gapped) from external networks. At the same time, current solutions rely on logical separation and controlled access, whereas cloud-based SCADA requires maintaining and monitoring these limitations in the new environment.

It further aids in decision-making: understanding business drivers and cloud opportunities, assessing organizational readiness for cloud migration, and evaluating technology and cloud solution suitability for the specific use case. 

Understanding the business drivers and cloud opportunities

It emphasizes understanding the different deployment models (full migration, hybrid with/without cloud-based control, cold standby) to assess the unique risks associated with each.

By recommending leveraging cloud-native services for a more secure architecture and to gain a centralized view of hosted services, it highlights the importance of using Software Defined Networking (SDN) and monitoring it for unauthorized changes.

The cloud offers features like automated scaling, failover, and disaster recovery for resiliency, which emphasizes the importance of considering break-glass recovery solutions for critical functions.

Centralized remote access and identity/access management are seen as opportunities offered by cloud-hosted SCADA while  integrating a Privileged Access Management (PAM) solution and using cloud-native secrets management. 

It also discourages relying on lower-trust domains for authentication and recommends using the cloud’s Key Management Service (KMS).

Readiness of Organizations

Before migrating OT to the cloud, organizations need to assess their cloud readiness, including having the proper skills, people, and policies in place.

Cloud migration requires a skill set different from that of on-premises OT management, where organizations can build these skills internally or leverage a managed service provider (MSP).

Migrating to the cloud often involves increased connectivity, so OT security policies need to be reviewed to ensure they can handle this new landscape.

Shared services and third-party integrations used with cloud-hosted SCADA systems need careful consideration to maintain data integrity and security.

Using an MSP introduces another attack surface, so organizations must understand the MSP’s security controls and how they will provision the cloud environment (limited services, tenancy, or separate environment).

Cloud environment ownership and root administrator privileges are crucial, and if the MSP owns the underlying cloud accounts, a compromise could impact multiple customers.

The technical considerations for migrating SCADA systems to the cloud emphasize the importance of understanding software suitability and legacy hardware limitations.

Legacy monolithic architectures and protocols may require additional security measures, like containerization and VPNs. 

The cloud migration decision should consider latency requirements and data sensitivity whereas edge computing and zero-trust architecture principles are also potential solutions.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link

Tax scammer goes after small business owners and self-employed people

0
[ad_1]

While most tax payers don’t particularly look forward to tax season, for some scammers it’s like the opening of their hunting season. So it’s no surprise that our researchers have found yet another tax-related scam.

In this most recent scam, we’ve not seen the lure the scammer uses, but it is likely to be an email telling the target to quickly go to this site to apply for your IRS EIN/Federal tax ID number.

EIN is short for Employer Identification Number. The IRS uses this number to identify taxpayers who are required to file various business tax returns. EINs are used by employers, sole proprietors, corporations, partnerships, non-profit associations, trusts, estates of decendents, government agencies, certain individuals, and other business entities.

Given the flow of the scam it’s very likely that the targets are self-employed and/or small business (SMB) owners. It’s possible that the phisher has obtained or bought a collection of email addresses from a data broker that fit a certain profile (for example, self-employed US residents).

To start this operation, the scammer doesn’t need a lot of information about their targets. A valid email address for a self-employed US resident could cost just a few cents on an underground forum on the dark web. However, the scammer might not even need to venture that far, as Senior Director of Technology and Engineering and Consumer Privacy at Malwarebytes, Shahak Shalev told us:

“I don’t think one would have to go to the dark web to get information like this as there are regular companies selling this information. They would probably qualify it as “lead generation”. According to our sources, pricing for one million self-employed US citizens usually goes for $1USD per contact, but for such a large amount it would probably be $0.1 per contact.”

The information the phishers are after is quite extensive and includes a person’s social security number (SSN).

A compromised social security number poses a major problem. A SSN stays with you for a lifetime, and is closely tied to your banking and credit history. Adding a person’s SSN to the scammers’ data could create far more opportunities for identity theft and fraud.

And if that wasn’t serious enough, the scammers here have the audacity to charge you for the tax ID number, even though applying for an Employer Identification Number (EIN) is a free service offered by the Internal Revenue Service (IRS).

Payment options and pricing on the fake site

We also found the scammer made a mistake when setting up their fake website. By looking at the privacy policy of the scammer’s site it became apparent that they forgot a small edit when they copied the privacy policy from someone else, but neglected to edit the original domain in one place.

privacy notice and cookie policy site shows the original domain

If you’ve received a mail or other invitation including a link to the domain irs-ein-gov.us, please let us know in the comments. We would love to have a copy so we can complete this attack profile.

How to avoid falling for a tax scam

Before acting on an email’s request, stop and think about the following:

  • Remember: The IRS doesn’t ask taxpayers for personal or financial information over email, text messages, or social media channels. This includes requests for PINs, passwords or similar access information for credit cards, banks, or other financial accounts.
  • Do not interact with the sender, click any links, or open any attachments.
  • Send the full email headers or forward the email as-is to phishing@irs.gov. Do not forward screenshots or scanned images of emails because this removes valuable information.
  • Delete the email.

If you are unsure if a certain communication is from the IRS, you can go to IRS.gov and search for the letter, notice, or form number. If it is legitimate, you’ll find instructions on how to respond. If there’s a form to fill in the verify that it is identical to the same form on IRS.gov by searching forms and instructions.

Malwarebytes Premium customers are protected against this particular scam if they have Web Protection enabled.

Malwarebytes blocks the site of the tax scammer

IOCs

Domains

ustaxnumber.org

ustaxnumber.com

irs-ein-gov.us

If you want to find out how much of your data has been exposed online, you can try our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you most frequently use) and we’ll send you a free report.


We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using Malwarebytes Identity Theft Protection.


[ad_2]
Source link

The Motorola Edge 50 Pro might have a Snapdragon 7 Gen 3

0
[ad_1]

Motorola is gearing up to launch its next bundle of exciting phones under its Edge line. Last year’s Edge phones were great devices, and we are hoping that the company continues that trajectory.  Well, we kind of have our doubts now, as we learned the possible processor for its next flagship phone. According to a new leak, the Motorola Edge 50 Pro’s processor might be the Snapdragon 7 Gen 3.

If you’re curious about the 2023 line of Edge phones, we at Android Headlines did reviews on both models that came to the US. The Motorola Edge 2023 (Review) was an excellent phone for its price with smooth performance, a gorgeous display, some of the best speakers we ever reviewed on a phone, and an amazing design. Also, the Motorola Edge+ 2023 basically took that entire experience and boosted it with a more powerful processor.

The Motorola Edge 50 Pro’s processor might be the Snapdragon 7 Gen 3

If you’re a person looking to get this phone for its power, then you might be a bit disappointed. Right now, the Qualcomm Snapdragon 8 Gen 3 is powering the most powerful phones on the market including the Galaxy S24 series of phones. However, Qualcomm has a less powerful processor known as the Snapdragon 7 Gen 3. It’s one step behind, but it’s still a very capable player.

According to Geekbench scores, it appears that this is what the Motorola Edge 50 Pro will use. Looking at the chart, this phone got a single-core score of 1,097 and a multi-core score of 3,114. Those scores aren’t great, but we can’t take Geekbench scores as an indicator of a phone’s day-to-day performance.

Motorola Edge 50 Pro Geekbench

In any case, there are people who will be disappointed with this phone because of the processor. The Snapdragon 7 Gen 3 is a very capable processor. However, it’s definitely going to fall behind the top competition on the market this year in terms of raw processing power. So, it’s going to be behind phones like the OnePlus 12 (Review) and the Galaxy S24 series.

Other rumored specs

The Motorola Edge 50 Pro is still an enigma at this point. However, we do have some rumored specs that have been floating around. For starters, and this might not be as much of a rumor, as the Geekbench listing confirmed this, but this phone is set to have 12GB of RAM.

The Motorola  Edge 50 Pro is rumored to come with a 6.7-inch pOLED display with a 1.5K resolution and a 144Hz refresh rate. This display may reach a whopping 2,000 nits of peak brightness and support HDR10+. Also, the company claims that this will be the world’s first Pantone-validated display.

Moving on to the camera, it appears that this phone will use a 50-megapixel primary camera. Lastly, we have word that this phone will have 3 colorways which are black, purple, and white.


[ad_2]
Source link

Hackers Selling GlorySprout Malware in Underground Fourm for $300

0
[ad_1]

GlorySprout stealer, advertised on the XSS forum in early March 2024, is a C++ stealer sold for $300 with lifetime access and temporary payload encryption, that includes a loader, anti-CIS execution, and a non-functional grabber module. 

Taurus Stealer, a C++ stealer with a Golang panel, emerged for sale on XSS in April 2020 and shared similarities with Predator Stealer in encryption, bot ID format, anti-VM features, and code naming conventions. 

There is mention of anti-VM and keylogging functionalities, but their existence has not been confirmed. Additionally, the stealer enables log backup and the ability to ban certain countries or IPs. It has been recognized as a clone of Taurus Stealer.

Taurus Stealer panel

It also reportedly ended development in 2021, but cracked versions and possibly leaked source code have surfaced on Telegram, potentially explaining the continued circulation. 

Document

Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

  • Real-time Detection
  • Interactive Malware Analysis
  • Easy to Learn by New Security Team members
  • Get detailed reports with maximum data
  • Set Up Virtual Machine in Linux & all Windows OS Versions
  • Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

Technical Analysis of the GlorySprout 

According to RussianPanda, a Senior Threat Intelligence researcher, eSentire, GlorySprout dynamically resolves APIs by hashing them using operations like multiplication, addition, and XOR and shifting target system libraries like shell32.dll and wininet.dll. 

GlorySprout panel

It uses specific offsets to access these hashed API values and implements anti-analysis techniques by checking for specific language identifiers and obfuscating strings using XOR and arithmetic operations. 

 hashing process involves operations such as multiplication, addition, XOR, and shifting

GlorySprout creates persistence via a scheduled task named “\WindowsDefender\Updater” that executes a secondary payload dropped in the %TEMP% folder. 

It also uses a function to generate random strings for various purposes, including filenames and RC4 keys, but this function might not be truly random, whereas the C2 address for communication is retrieved from the resource section of the unpacked payload.  

An infected machine communicates with the C2 server on port 80 disguised as a browser and sends a POST request with an encrypted BotID and a predefined user agent. 

The RC4 key for encryption is generated with a constant initial state value, resulting in the same key for every check-in and the server responds with an encrypted configuration detailing data to steal (browser history, wallets, etc.) and further actions (downloading secondary payload, self-deletion). 

The machine harvests data, encrypts it with the received RC4 key and sends it back to the server. Upon receiving a success message, the machine signals completion and potentially downloads another malicious payload. 

Indicators Of Compromise

GlorySprout, a stealer program written in Golang, utilizes SQL databases likely processed through the sqlx library and the analysis of the database reveals mentions of “taurus,”  suggesting GlorySprout is a clone of the Taurus Stealer code. 

Decrypted browser passwords are found in logs stored in General/forms.txt, indicating server-side decryption. 

GlorySprout differs from Taurus Stealer in that it does not download additional DLLs and lacks anti-VM features, which suggests GlorySprout may not achieve the same level of popularity as other stealers. 

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


[ad_2]
Source link