Samsung set to lose top spot in foldable smartphone market

0

[ad_1]

According to a new report by DSCC, Samsung will lose the top spot in the foldable smartphone market. That will happen in this quarter (January-March).

Samsung is set to lose its top spot in the global foldable smartphone market

Based on the report shared by DSCC, Huawei will climb up to the top spot. The source shared a report in which it shows the foldable smartphone market progress in a span of one year. So you can basically see data from Q1 2023 to Q1 2024 below.

DSCC foldable market report Q1 2024

Various companies are included here, ranging from Samsung and Huawei to HONOR and OnePlus. The red line is Samsung’s, and you can clearly see a decline there, from the third quarter of last year. Huawei has been gradually climbing from that point.

DSCC says that foldable smartphone shipments have increased by 33% YoY in the fourth quarter of last year. 4.2 million units have been shipped out. The source also states that the foldable smartphone market could rise by 105% YoY in the first quarter of 2024.

The Huawei Mate X5 & Pocket 2 sales were rather significant, it seems

It seems like the Huawei Mate X5 and Pocket 2 played a huge role for Huawei. Even though both of those smartphones are limited to China, their sales have been off the hook and thus managed to mess up Samsung’s plans.

The report also notes that HONOR gained a significant share of the foldable smartphone market in the last year or so. OPPO and Vivo, on the other hand, could lose their shares due to the unavailability of new products in China, it is stated.

It remains to be seen what will the rest of the year look like. The Galaxy Z Fold 6 is coming later this year, with a wider cover display, and hopefully a less noticeable crease. It may appeal to users and help Samsung get some of its market share back. Samsung really is playing catchup to other companies in terms of foldable phones, at least when it comes to design/build.

[ad_2]

Source link

Magnet-Goblin Hackers Attack Public Services Using 1-Day Exploits

0

[ad_1]

A new threat actor, Magnet Goblin, emerged by rapidly exploiting recently disclosed vulnerabilities (CVE-2023-46805 & CVE-2023-21887) in Ivanti Connect Secure VPN, which allowed them to deploy custom Linux backdoors on vulnerable systems.

Magnet Goblin has a history of targeting platforms like Magento, Qlik Sense, and potentially Apache ActiveMQ, using similar tactics to gain financial advantage.

Their strategy involves quickly adopting newly discovered vulnerabilities to establish backdoors on compromised systems. These backdoors enable them to steal data or gain unauthorized access by exploiting one-day vulnerabilities for potential financial gain.

A financially driven cybercriminal group exploits weaknesses in edge devices and public servers.

  • Magento – CVE-2022-24086
  • Qlik Sense – CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365
  • Ivanti Connect Secure – CVE-2023-46805 and CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893.

Their custom-made Nerbian malware family includes tools like NerbianRAT (cross-platform) for complete remote control and MiniNerbian (Linux-specific) for maintaining backdoor access.

Past Magnet Goblin campaigns.

Rapid Exploitation of Public Servers with Custom Malware

An investigation of recent Ivanti exploits revealed downloads linked to a Linux variant of NerbianRAT malware, which fetched various malicious payloads from an attacker-controlled server, including a WARPWIRE JS stealer and Ligolo tunneling tool.

After finding vulnerabilities, the attackers’ malicious servers allowed them to retrieve a fresh version of the NerbianRAT malware. 

  • http://94.156.71[.]115/lxrt
  • http://91.92.240[.]113/aparche2
  • http://45.9.149[.]215/aparche2

It uses a custom WARPWIRE variant alongside NerbianRAT, which steals VPN credentials and sends them to a compromised Magento server. This highlights the threat actor’s multi-tool approach.

                                                 WARPWIRE variant used by Magnet Goblin.

Analysis of the Infrastructure:

Beyond the Linux tools mentioned above, Magnet Goblin’s arsenal also extends to Windows. They leverage legitimate tools like ScreenConnect (downloaded from their server) and AnyDesk for remote access. 

Interestingly, the IP used for ScreenConnect downloads aligns with the one observed on compromised Qlik Sense servers, suggesting a wider exploitation attempt.

Evidence suggests possible connections to both Cactus ransomware (based on observed tactics) and Apache ActiveMQ vulnerabilities (based on downloaded files). 

Compromised Magento servers were used to deploy BAT scripts that downloaded and executed AnyDesk, further showcasing the diverse tools used by this threat actor.

Batch script deploying AnyDesk, utilizing a hacked Magento server.

NerbianRAT is a Linux backdoor first observed in May 2022. It is poorly obfuscated and lacks anti-analysis techniques. Upon execution, it collects basic information about the infected machine and generates a unique bot ID. 

Then, it decrypts its working directory and searches for a configuration file containing various settings, including the C2 server address, working hours, and a public key for encryption.

It communicates with its C2 server using raw TCP sockets and a custom protocol, and data is encrypted using AES or RSA, depending on the type of data transmitted. 

The backdoor operates in two primary states: during working hours (as defined in the configuration), it sends data to the C2 server and awaits instructions, while outside of working hours, it can still send “ping” messages to the server.

MiniNerbian simplifies NerbianRAT for command execution and sends HTTP POST requests to its C2 server to execute system commands, change its internal time flag, and update configuration.

Code similarity between NerbianRAT and MiniNerbian.

In cybersecurity, distinguishing specific activities amid widespread opportunistic exploitation attacks is challenging due to the technical and attribution complexities.

Defenders often prioritize response and mitigation, sometimes missing the activities of unique actors who exploit these situations.

A recent example is the Ivanti Secure Connect VPN exploitation by various threat actors, including Magnet Goblin, who exploited the vulnerability before appliances were patched.

Motivated by financial gains, Magnet Goblin quickly utilized one-day vulnerabilities to deploy custom Linux malware, such as NerbianRAT and MiniNerbian, primarily targeting unprotected edge devices.

IOCs :

Type Value Description
IP 91.92.240[.]113 Magnet Goblin Infra
IP 45.9.149[.]215 Magnet Goblin Infra
IP 94.156.71[.]115 Magnet Goblin Infra
URL http://91.92.240[.]113/auth.js Magnet Goblin Infra
URL http://91.92.240[.]113/login.cgi Magnet Goblin Infra
URL http://91.92.240[.]113/aparche2 Magnet Goblin Infra
URL http://91.92.240[.]113/agent Magnet Goblin Infra
URL http://45.9.149[.]215/aparche2 Magnet Goblin Infra
URL http://45.9.149[.]215/agent Magnet Goblin Infra
URL http://94.156.71[.]115/lxrt Magnet Goblin Infra
URL http://94.156.71[.]115/agent Magnet Goblin Infra
URL http://94.156.71[.]115/instali.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/ligocert.dat Magnet Goblin Infra
URL http://94.156.71[.]115/angel.dat Magnet Goblin Infra
URL http://94.156.71[.]115/windows.xml Magnet Goblin Infra
URL http://94.156.71[.]115/instal1.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/Maintenance.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/baba.dat Magnet Goblin Infra
URL **http://**oncloud-analytics[.]com/files/mg/elf/RT1.50.png Magnet Goblin Infra
URL http://cloudflareaddons[.]com/assets/img/Image_Slider15.1.png Magnet Goblin Infra
Domain mailchimp-addons[.]com MiniNerbian C2
Domain allsecurehosting[.]com MiniNerbian C2
Domain dev-clientservice[.]com MiniNerbian C2
Domain oncloud-analytics[.]com MiniNerbian C2
Domain cloudflareaddons[.]com MiniNerbian C2
Domain textsmsonline[.]com MiniNerbian C2
Domain proreceive[.]com MiniNerbian C2
IP 172.86.66[.]165 NerbianRAT C2
IP 45.153.240[.]73 NerbianRAT C2
SHA256 027d03679f7279a2c505f0677568972d30bc27daf43033a463fafeee0d7234f6 NerbianRAT
SHA256 9cb6dc863e56316364c7c1e51f74ca991d734dacef9029337ddec5ca684c1106 NerbianRAT
SHA256 9d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50 NerbianRAT
SHA256 d3fbae7eb3d38159913c7e9f4c627149df1882b57998c8acaac5904710be2236 MiniNerbian
SHA256 df91410df516e2bddfd3f6815b3b4039bf67a76f20aecabccffb152e5d6975ef MiniNerbian
SHA256 99fd61ba93497214ac56d8a0e65203647a2bc383a2ca2716015b3014a7e0f84d MiniNerbian
SHA256 9ff0dcce930bb690c897260a0c5aaa928955f4ffba080c580c13a32a48037cf7 MiniNerbian
SHA256 3367a4c8bd2bcd0973f3cb22aa2cb3f90ce2125107f9df2935831419444d5276 MiniNerbian
SHA256 f23307f1c286143b974843da20c257901cf4be372ea21d1bb5dea523a7e2785d MiniNerbian
SHA256 f1e7c1fc06bf0ea40986aa20e774d6b85c526c59046c452d98e48fe1e331ee4c MiniNerbian
SHA256 926aeb3fda8142a6de8bc6c26bc00e32abc603c21acd0f9b572ec0484115bb89 MiniNerbian
SHA256 894ab5d563172787b052f3fea17bf7d51ca8e015b0f873a893af17f47b358efe MiniNerbian
SHA256 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548 WARPWIRE
SHA256 e134e053a80303d1fde769e50c2557ade0852fa827bed9199e52f67bac0d9efc WARPWIRE
URL www.fernandestechnical[.]com/pub/health_check.php Compromised Server
URL biondocenere[.]com/pub/health_check.php Compromised Server
URL ****www.miltonhouse[.]nl/pub/opt/processor.php Compromised Server
URL https://theroots[.]in/pub/media/avatar/223sam.jpg Compromised Server
SHA256 7967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117f Other: Tools and scripts
SHA256 9895286973617a79e2b19f2919190a6ec9afc07a9e87af3557f3d76b252292df Other: Tools and scripts
SHA256 bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058e Other: Tools and scripts
SHA256 b35f11d4f54b8941d4f1c5b49101b67b563511a55351e10ad4ede17403529c16 Other: Tools and scripts
SHA256 7b1d1e639d1994c6235d16a7ac583e583687660d7054a2a245dd18f24d10b675 Other: Tools and scripts
SHA256 8fe1ed1e34e8758a92c8d024d73c434665a03e94e5eb972c68dd661c5e252469 Other: Tools and scripts
SHA256 fa317b071da64e3ee18d82d3a6a216596f2b4bca5f4d3277a091a137d6a21c45 Other: Tools and scripts

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.



[ad_2]

Source link

Galaxy S24’s smooth animations are coming soon to older models

0

[ad_1]

Samsung significantly improved the Galaxy user experience with the Galaxy S24 series. The new flagships arrived with One UI 6.1 which offers smoother system animations. These improvements may soon come to older Galaxy devices courtesy of an update for the company’s One UI Home launcher app. The update may arrive as a part of the One UI 6.1 update or separately.

Your Samsung device may soon get Galaxy S24-like smooth animations

One UI 6.1 brought several new features to the Galaxy S24 lineup. While AI features received more attention from the public and media alike, Samsung also worked on improving the overall user experience. It made some minor UI tweaks and improved system animations. The latter is enabled by version 15.1.01.3 of One UI Home. The new version isn’t available for devices running One UI 6.0. They are on One UI Home version 15.0.09.1.

However, SamMobile recently found that the updated version, officially exclusive to the Galaxy S24, Galaxy S24+, and Galaxy S24 Ultra, also works as effectively on the Galaxy S23 series. The publication downloaded an APK file for version 15.1.01.3 of the app from apkmirror.com and sideloaded it on their Galaxy S23. It worked like a charm, offering improved animations on the home screen, particularly when opening and closing apps.

The new version solved the problem of frame drops in animations, something very common on One UI 6.0. The animation stutter that was previously there on the Galaxy S23 was gone after installing the new version of One UI Home. This suggests Samsung is ready to roll out the update to older Galaxy phones, beyond the Galaxy S23 series. It might hold off the rollout until the One UI 6.1 release, which is expected later this month.

While you can already sideload One UI Home version 15.1.01.3 on your Samsung smartphone or tablet for Galaxy S24-like smooth animations, we recommend waiting for the official update. You should always download apps from official sources. APK files downloaded from third-party stores may contain malware, potentially causing security issues on your phone. The official update may not be too far off now.

One UI 6.1 will bring more changes to your Galaxy device

Along with smoother system animations, One UI 6.1 will add AI features and other changes to your Galaxy device. You get camera improvements, including the ability to use two rear cameras for Dual Recording. Previously, you could only record with one rear camera and the selfie camera. The update also brings AI-powered photo and video editing tools. We will let you know when Samsung rolls out One UI 6.1 to older models.

[ad_2]

Source link

Apple wants AI to power ads in the App Store, it seems

0

[ad_1]

We are entering an AI-powered era, where AI has started hitting almost everything up on the internet. Dozens of AI chatbots are already taking over the internet and now, the Cupertino tech giant Apple is planning to use AI to run their advertisement services. The brand potentially targets more effective ways to include and run ads in its App Store using AI.

Apple will soon introduce AI-powered ads in the App Store

According to the information from Business Insider, Apple has started informing all of their advertisement partners that they will soon test the implementation of AI to run the ads. The tech giant will start rolling out this in the future months. As of now, they have already started testing this on a very small portion of users to check whether the AI can increase the overall performance of advertisements on the App Store.

The basic use of AI in this case would be to find the perfect spot to place and run ads inside the App Store. Not only this, based on the advertiser’s budget and the type of ad, the AI will be now used to test which spot would be the best to run that particular ad. The AI will also analyze the overall use case of the consumer, which will help in providing more relevant ads to them. This will eliminate the need to do manual research to find the perfect place to run the ad and may end up saving some money in the long run.

Why does Apple want to use AI in its services?

The concept is not very new to the market. Google and Meta have been using this kind of advertisement technique for a long time. And now, Apple also seems to be joining the race. Apple generates a healthy amount of revenue using its ad services. And it would be very interesting to see what potential benefit this implementation of AI in ads can give to the brand.

It won’t have much effect on the user’s overall user experience until or unless the AI keeps increasing the tabs or space allotted for the placement of AI for no good reason; which is very unlikely. As mentioned earlier, this is still in the testing phase. A full rollout could happen during the iPhone 16 launch event, or sooner.

[ad_2]

Source link

Google’s Gemini AI Vulnerability Lets Attackers Control Over Users

0

[ad_1]

Researchers at HiddenLayer have unveiled a series of vulnerabilities within Google’s Gemini AI that could allow attackers to manipulate user queries and control the output of the Large Language Models (LLMs).

This revelation has raised concerns over the security and integrity of AI-driven content generation and its implications for misinformation spread and data privacy.

The Gemini suite, Google’s latest foray into the realm of LLMs, comprises three different model sizes: Nano, Pro, and Ultra.

Despite its recent removal from service due to the generation of politically biased content, the vulnerabilities identified by HiddenLayer expose a new dimension of threats that malicious actors could exploit.

Document

Integrate ANY.RUN in your company for Effective Malware Analysis

Malware analysis can be fast and simple. Just let us show you the way to:

  • Interact with malware safely
  • Set up virtual machine in Linux and all Windows OS versions
  • Work in a team
  • Get detailed reports with maximum data
  • If you want to test all these features now with completely free access to the sandbox:

The Vulnerabilities Explained

The research conducted by HiddenLayer highlights several critical issues within the Gemini models, including:

  • LLM Prompt Leakage: This vulnerability could allow attackers to access sensitive data or system prompts, posing a significant risk to data privacy.
LLM Prompt Leakage
LLM Prompt Leakage
  • Jailbreaks: By bypassing the models’ safeguards, attackers can manipulate the AI to generate misinformation, especially concerning sensitive topics like elections.
If we ask Gemini Pro to generate our article conventionally, we unfortunately get this response:
If we ask Gemini Pro to generate our article conventionally, we, unfortunately, get this response
  • Indirect Injections: Attackers can indirectly manipulate the model’s output through delayed payloads injected via platforms like Google Drive, further complicating the detection and mitigation of such threats.
We can input a few different variants of uncommon tokens to get a reset response
We can input a few different variants of uncommon tokens to get a reset response

Implications and Concerns

The vulnerabilities within Google’s Gemini AI have far-reaching implications, affecting a wide range of users:

  • General Public: The potential for generating misinformation directly threatens the public, undermining trust in AI-generated content.
  • Companies: Businesses utilizing the Gemini API for content generation may be at risk of data leakage, compromising sensitive corporate information.
  • Governments: The spread of misinformation about geopolitical events could have serious implications for national security and public policy.

Google’s Response and Future Steps

As of the publication of this article, Google has yet to issue a formal response to the findings.

The tech giant previously removed the Gemini suite from service due to concerns over biased content generation. Still, the new vulnerabilities underscore the need for more robust security measures and ethical guidelines in the development and deployment of AI technologies.

The discovery of vulnerabilities within Google’s Gemini AI is a stark reminder of the potential risks associated with LLMs and AI-driven content generation.

As AI continues to evolve and integrate into various aspects of daily life, ensuring the security and integrity of these technologies becomes paramount.

The findings from HiddenLayer highlight the need for ongoing vigilance and prompt a broader discussion of AI’s ethical implications and the measures needed to safeguard against misuse.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter



[ad_2]

Source link

Samsung posts unboxing and promo videos for Galaxy A55 & A35

0

[ad_1]

After officially unveiling the Galaxy A55 and Galaxy A35 yesterday, Samsung has started promoting the phones. The company recently posted an unboxing video and short introductory films for the devices on the Samsung India YouTube channel. The mid-range duo will gradually go on sale worldwide over the next few weeks.

Samsung released Galaxy A55 and Galaxy A35 promo videos

Starting with the unboxing video, Samsung has posted one only for the Galaxy A55. As expected, the retail box doesn’t include a charger. You get the phone, a USC-C to C cable, a SIM tray ejector pin, and some paperwork. The handset has a flat front and back, with three rear cameras aligned vertically. Samsung gives you a glass back, aluminum frame, and Corning Gorilla Glass Victus+ screen protection.

Samsung’s video highlights the IP67 rating of the phone before going into the camera specs. The Galaxy A55 has a 50MP primary rear camera, 12MP ultrawide lens, 5MP macro camera, and 32MP selfie shooter. The video continues to touch the rest of the specs, including the display, eSIM support, battery, new camera features, enhanced gaming performance, Samsung Knox Vault security, and four major Android OS updates.

Apart from the ultrawide camera (8MP), selfie camera (13MP), and a plastic frame, the Galaxy A35 shares everything else with its sibling. And if it isn’t already clear, the two phones sport an identical design too. The Galaxy A55 has a more powerful processor, though. It also comes in up to 12GB RAM, while the Galaxy A35 tops out at 8GB RAM. Storage variants include 128GB and 256GB for both models.

The two introductory films from Samsung for its latest mid-range smartphones focus on the Knox Security platform. The company says the devices give you an “awesome” screen, “awesome” cameras, and long-lasting battery life, all the while ensuring the safety and security of your data. “Awesome is for everyone,” Samsung adds. The company has been using the term “awesome” to describe its A-series phones for a few years.

Pre-orders are now open

Samsung has already started taking pre-orders for the Galaxy A55 and Galaxy A35 in some European countries. It is offering a pair of Galaxy Buds FE for free in a few markets. The company will ship the phones on March 15. A global release is expected to follow, though the release date may vary according to the market. Samsung has yet to announce a US release for either model.

[ad_2]

Source link

What Is WiFi 6E? Everything You Need To Know

0

[ad_1]

When you look at wireless routers right now, you probably see both WiFi 6 and WiFi 6E. These are very similar generations of WiFi, as you can tell by the name, but there are still some differentiators here that you need to be aware of.

In 2020, the WiFi Alliance announced that WiFi 6 products are now able to use the 6GHz wireless spectrum, which makes WiFi 6E similar to WiFi 6, but with access to higher-spectrum. As a result, you can expect faster internet speeds and lower latency with 6GHz WiFi.

WiFi 6 vs WiFi 6E

When WiFi 6 first became a thing, aka IEEE 802.11ax, it was limited to lower wireless spectrum. At either 2.4GHz or 5GHz. Which is what most routers already support. On 2.4GHz, you’re sharing three channels with yourself, your family, and your neighbors. Which can lead to some severe congestion.

If you’ve ever been knocked off of a call, or experienced very slow internet, that is why. And it’s not just because of what is connected in your home and your neighborhood. As your neighbors that have their networks in range of your home, are also competing for the same bandwidth in the same limited channels.

In April 2020, the FCC voted to open up 6GHz for unlicensed use. That basically means that now WiFi can be used on the 6GHz spectrum, in addition to 5GHz and 2.4GHz. That opens up even more airwaves, so you should have less trouble with bandwidth. This is the biggest spectrum addition to WiFi since 1989.

Obviously, on paper, the jump from 5GHz to 6GHz doesn’t sound like a lot. But it does quadruple the amount of airwaves available for routers and smart devices, which is going to result in less signal interference.

Basically, the difference between WiFi 6 and WiFi 6E is 6GHz. WiFi 6E has all of the same features that WiFi 6 has, but now with 6GHz WiFi, which is going to result in even faster speeds and lower latency.

01hyoZ4VGJ6pR1XOLDkAKD7 2 fit lim size 768x

Which is better?

So, which version of WiFi is better? Well, that’ll be WiFi 6E. While adding 6GHz spectrum to WiFi 6 may not sound like a big deal. It really is. This is going to open up faster speeds. Typically, the higher the spectrum, the faster the speeds but the smaller the coverage. So 2.4GHz is ideal for doorbells, smart lights, and such, as the coverage is more significant. But 5GHz and even 6GHz is better for your laptops and smartphones.

What are some of the benefits of WiFi 6E?

The biggest benefit is the addition of 6GHz for WiFi connectivity. That band is going to allow for speeds over 1Gbps. Along with that, you’re also going to get lower latency. Some WiFi 6E networks are able to provide less than one-millisecond latency, which is very important for gaming, video calls, and even virtual reality. That is going to get rid of the lag that we have all experienced in the past year of working from home.

On top of that, the other big advantage that you will likely notice is the capacity of your network. With homes adding more and more devices to their home network, this is becoming a much bigger deal than in previous years. With these faster speeds and better capacity, homes will be able to have the next-generation computing experiences that we’ve seen at shows like CES and MWC, but inside their home.

For normal people, this means that multiple people can watch 4K Netflix or 4K YouTube without any buffering or being kicked off of the network.

There’s really only one downside to WiFi 6E, and that’s 6GHz WiFi. Because 6GHz is a higher-band, it means that the coverage is not as great. This is why 6GHz is generally better for those devices that need speed over coverage. Like your laptop or your smartphone. Whereas smart home products should stick to 2.4GHz.

How fast is WiFi 6E?

So the theoretical top speed for WiFi 6E is the same as WiFi 6. And that is 9.6Gbps. However, you will likely never, ever see that kind of speed on your WiFi network. Because that is in perfect condition, and that won’t happen at your home.

However, in real-world testing, NETGEAR found that WiFi 6E is about 25% faster than WiFi 6. And that’s where the 6GHz spectrum comes into play. You will likely see up to 2Gbps speeds on WiFi 6E. But again, there are a lot of factors that go into that. For one, your ISP needs to be delivering at least 2Gbps to your home. And currently, many ISPs are not even delivering a single Gigabit, nevermind multi-gigabit connections. That will change in the coming years, though.

Doesn’t 5G use 6GHz too?

So, here is where things get interesting for WiFi 6E.

The FCC didn’t actually open up any new WiFi spectrum for 6E. Instead, it opened up a new “unlicensed” spectrum. This means you don’t need a license to use that spectrum. This also means that other devices could use this same spectrum that WiFi 6E wants to use. And yes, that does include 5G devices.

Carriers like Verizon have been using unlicensed spectrum for its 5G Ultrawide Band network or 5G UWB. The much higher frequencies allow for much faster speeds and lower latency as we’ve explained with 6GHz already. So these mobile networks could use up some of the spectrum that WiFI 6E wants.

But will this really lead to any congestion on WiFi 6E? Probably not. Wireless analyst, Phil Solis has said that “there’s so much spectrum in the 6GHz band that there should be room for both.” He added that “you’re not going to see macrocells using 6GHz”. Basically, while carriers could use this 6GHz spectrum for 5G, they will likely use a much higher spectrum paired with their low-band spectrum for coverage and speeds.

WiFi 6E is basically a “US only” thing

Currently, only the US has approved WiFi 6E to use 6GHz for WiFi. And since that is the main differentiator between WiFi 6 and WiFi 6E, that means that it is only a thing in the US.

For WiFi 6E to take off in other countries, we’ll need to see those countries open up 6GHz as well. In Europe it’ll be very slow going. Each individual country needs to open up 6GHz WiFi, and then the European Commission needs to do it, too. But that could happen very soon.

Because this is really only a thing in the US, it means the adoption of WiFi 6E is going to be slow, too, since gadgets are typically shipped globally.

How to get WiFi 6E?

Like with WiFi 6, you will need new hardware to use WiFi 6E. Even though it is as simple as supporting another spectrum band, routers were not initially designed for WiFi 6E. However, newer routers that were released in late 2020 and later, will support WiFi 6 and WiFi 6E.

Luckily, WiFi 6E devices are also compatible with older versions of WiFi. This is pretty common among technology though, so this isn’t a big surprise. But it does mean that if you connect a device that does not have support for WiFi 6E, you’ll still be able to use it on your network.

Will I need a new router?

The short answer here is yes.

Unless, you have bought a very new router, one that launched within the last six months or so, you will likely need a new one. The number of WiFi 6E-compatible routers is actually pretty small at this point. But that number is going to rise in the near future. As more and more people look to adopt WiFi 6E.

30439 ts1 0 1

WiFi 6E-compatible devices

To take full advantage of WiFi 6E, you’ll need routers that support it, as well as smartphones and laptops too. Here are the latest devices that support WiFi 6E.

Smartphones

Samsung Galaxy S21, S21+, S21 Ultra, S21 FE

Samsung Galaxy S22, S22+, S22 Ultra

Xiaomi Mi 11

OnePlus 9

iPhone 13 series

Google Pixel 6, Pixel 6 Pro

Routers

ASUS ROG Rapture GT-AXE11000

Linksys Hydra Pro 6E

Linksys Velop Atlas Max 6E

ASUS ZenWiFi ET8

Netgear Nighthawk RAXE500

What about WiFi 7?

You may have seen recently that newer smartphones, tablets, and even laptops are launching with support for WiFi 7. It’s an upcoming WiFi standard that isn’t really widely used yet and won’t be for a few years, but it is good to see companies future-proofing our products.

WiFi 7 is going to be able to have extremely high throughput of up to 46Gbps, compared to 9.6Gbps on WiFi 6E and about 6.9Gbps on WiFi 6. It’ll be about 4.8x faster than WiFi 6 and about 13x faster than WiFi 5. Which is going to unlock faster speeds and more scenarios than ever before.

On top of the faster speeds, WiFi 7 will also offer up to 4x lower latency, and up to 5x more network capacity, thanks to 320MHz and MLO.

Should you upgrade to WiFi 6E?

Yes.

If you are looking to replace the router at your home, then yes, it’s a good idea to get a WiFi 6E router. Since it’s not something that you will be replacing all that often, like a smartphone or even a laptop, it’s better to get the best possible router now than to get something that is a bit behind like a regular WiFi 6 router.

Not to mention the fact that the way that technology moves, if you wait for WiFi 6E to get better, you’re going to miss out and WiFi 7 will be nearly here.

So, to future-proof your WiFi network, yes, get a WiFi 6E router now for your home. It’s backward compatible, so you will be able to use older devices that don’t support WiFi 6E with it.

[ad_2]

Source link

ChatGPT-Next-Web SSRF Vulnerability Let Hackers Gain Full Access to HTTP Endpoints

0

[ad_1]

There are advantages to using standalone AI chatbots over cloud-based alternatives such as OpenAI; however, there are also some security risks.

Research shows NextChat, a popular standalone chatbot with over 7500 exposed instances, is vulnerable to a critical SSRF vulnerability (CVE-2023-49785) that allows attackers to access internal systems and data potentially.

User Interface of NextChat

The vulnerability was reported to the vendor in November 2023, but with no patch available after 90 days, technical details are being publicly released.

CVE-2023-49785: A Super SSRF

NextChat, a Javascript application built with Next.js, exposes a critical vulnerability. Its core functionality runs on the client side. A server-side endpoint named “/api/cors” acts as an open proxy that allows anyone to send unauthorized requests to any external server.

Designed to enable saving chat data on WebDAV servers, this endpoint bypasses browser security measures. 

Users can exploit it to access unintended resources by crafting requests that the application blindly forwards, as a user could access Google through this loophole.

A critical Server-Side Request Forgery (SSRF) vulnerability exists, allowing attackers to gain unauthorized access to internal systems and potentially the entire network. This vulnerability grants attackers the ability to:

  • Reach any internal HTTP endpoint, including sensitive ones.
  • Download full responses from the targeted endpoints.
  • Employ various HTTP methods (POST, PUT, etc.) with custom request bodies.
  • Manipulate URL parameters through encoding.
  • Include authorization headers within requests.

If the application is web-accessible, an attacker can potentially compromise the entire internal network connected to the application. While limitations exist in directly injecting specific headers, potential workarounds might exist.

This vulnerability is particularly dangerous due to its extensive access capabilities and potential for sensitive data exfiltration.

Accessing the AWS cloud metadata service to retrieve AWS access keys off an AWS EC2 instance running with IMDSv1 enabled

Reflected XSS:

A specific reflected XSS vulnerability bypasses the need for external resources and the application’s /api/cors endpoint utilizes the fetch method, which allows the data protocol.  

An attacker can inject a malicious payload into the data URL encoded in base64, which includes JavaScript code to display an alert with the website’s domain upon reaching the server. 

Since the server reflects the data back to the client without proper sanitization, the script executes in the victim’s browser, resulting in a successful XSS attack.

Detection and Mitigation:

A critical vulnerability (CVE-2023-49785) exists in ChatGPT-Next-Web (versions 2.11.2 and prior) that allows attackers full read and write access to internal systems through forged requests. 

It can also exploit the application as an open proxy to mask their IP and redirect malicious traffic. 

According to the Horizon3ai timeline for vulnerability disclosure:

  • Nov. 25, 2023: Horizon3 reports security issue to ChatGPT-Next-Web via GitHub vulnerability disclosure process
  • Nov. 26, 2023: Vendor accepts the report
  • Dec. 6, 2023: GitHub CNA reserves CVE-2023-49785
  • Jan. 15, 2024: Horizon3 asks vendors for an update using the GitHub security issue. No response.
  • Mar. 7, 2024: Horizon3 asks vendors for an update using the GitHub security issue. No response.
  • Mar. 11, 2024: Public disclosure

Avoid using this software online. If internet exposure is unavoidable, a secure, isolated network without internal resource access is needed. Even in isolation, attackers might use the software as an open proxy to hide malicious traffic targeting other systems.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.



[ad_2]

Source link

MediaTek Dimensity 9400 gains Vivo as its first customer

0

[ad_1]

MediaTek’s Dimensity 9400 chipset is ready to shake up the high-end Android phone game, building on the success of its predecessor, the Dimensity 9300. The aim of the Dimensity 9400 is to solidify MediaTek in the market with a reported performance increase of about 20% over its predecessor, China Times confirms.

The MediaTek Dimensity 9400 promises a 20% speed jump compared to its predecessor

From its launch in October 2023, the MediaTek Dimensity 9300 has been a key revenue generator for MediaTek, bringing about approximately $1 billion in revenue. To keep this momentum going, MediaTek intends to release the Dimensity 9400 in the second half of 2024, with Vivo rumored to have secured the first batch.

Nevertheless, no figures have gone official on how many chipsets Vivo has ordered and at what price from MediaTek. It represents a major opportunity for both MediaTek and this Chinese phone maker given their partnership. If the Dimensity 9400 turns out to be more economical compared to competitors such as the Snapdragon8 Gen 4 chips, MediaTek may win additional orders from other smartphone manufacturers.

Reports, however, indicate that there is an improvement of around twenty percent in terms of performance for Dimensity 9400. What areas get an upgrade remains unknown. Nevertheless, worries regarding overheating and performance surge issues have become a concern especially because of the Cortex-X5 core mounted into this chipset.

Unlike its predecessors, rumors say that Dimensity 9400 lacks crucial efficiency cores which will likely make it difficult to manage temperatures during stress conditions. So, Vivo will need to implement some software and hardware optimizations to preserve battery life and keep the phone from overheating.

MediaTek’s partnership with Vivo for flagship could be a winning move

Further details about the capabilities and optimization will emerge as MediaTek keeps refining its Dimensity 9400 by working with other partners. Look out for more updates as we get closer to the Dimensity 9400’s debut.

MediaTek intends to challenge established players such as Qualcomm and Samsung by providing high-performance chipsets at competitive prices. Additionally, the inclusion of the Dimensity 9400 into Vivo’s upcoming smartphones may significantly improve the user experience by enabling faster computations, better multitasking capabilities, as well as overall enhanced performance.

As we advance, MediaTek will likely shape the Android smartphone market in the future through innovative moves and partnerships with major manufacturers like Vivo, as consumers demand more from their handheld devices.

[ad_2]

Source link

Amazon Fire TV: Everything You Need To Know

0

[ad_1]

Amazon’s Fire TV platform has sort of quietly become one of the biggest streaming platforms in the world. It’s currently number two behind only Roku, which has a similar strategy of selling its hardware as cheaply as possible.

But the real question is, what is Fire TV? Is it better than Android TV, Apple TV, Roku, and the other platforms out there? How can I get it on my TV? We’re going to answer that and a whole lot more in this edition of “Everything You Need To Know!”

What is Fire TV?

Amazon’s Fire TV is a platform for streaming set-top boxes. It is based on Android and runs on the same software as Amazon’s Fire tablets. Fire TV has most of the popular apps, but some Google apps are missing. Surprisingly, YouTube and YouTube TV are available, but Google TV and Google Play Movies & TV are not.

Fire TV is a simple and user-friendly platform, and it receives frequent updates. Amazon offers Fire TV devices at very affordable prices, and sometimes even for free, which is why it has become the second most popular streaming platform, just behind Roku.

What is Fire OS?

As mentioned, Fire OS is the software that Amazon develops for Fire TV and its Fire Tablets. It’s loosely based on Android, though an ancient version of Android.

  • Fire OS 8: Based on Android 10 and Android 11
  • Fire OS 7: Based on Android 9
  • Fire OS 6: Based on Android 7.1
  • Fire OS 5: Based on Android 5.1

As you can see, the latest version of Fire OS is actually using a version of Android that is about 4 years old at this point, and Amazon doesn’t always use each version of Android. It skipped Android 6.0 Marshmallow and Android 8 Oreo. But that’s fine, because it is just using the backbone of Android, and none of Google’s services – YouTube and YouTube TV are through a carriage agreement with Google, so it’s a bit different.

When you turn on your Fire TV, you won’t really realize that this is running Android. While it does have a similar look and feel to other TV operating systems, it is still very different.

What does the interface look like?

On Fire OS 7, the interface has a pretty significant facelift, which makes it a lot easier to navigate. You’ll start off on the “Home” tab, which will show you different titles that you can watch. Then you can navigate over to Find for searching, and Live for live TV listings.

However, in Fire OS 8, these did change a little bit. Amazon now uses icons for the first few options, for Home, Live, and Saved titles that you can jump to easily. There is also a search icon as well as a list of titles you’ve previously watched. That will be very helpful for those with kids that want to watch the same thing every day.

After those three tabs, you have your apps. Amazon only keeps six apps here, so you’ll want to keep your most used apps there, as it is easier to get to than navigating over to the all apps icon on the far right. Fortunately, these are customizable, so you can change them out whenever you want. I usually keep YouTube TV, YouTube, Hulu, Netflix, MAX, and Peacock in that row.

All the way to the right is the Settings icon, where you’ll find all of the settings of course. At the very top, you’ll see banners for different movies and TV shows you can watch on different apps. Some of these are ads, while others are just titles that are available to you from apps you’ve installed.

It’s a very simple interface actually, and that’s what matters for Fire TV. As it wants to appeal to everyone, and the Android TV interface is a bit busy. Making it tougher for your parents or even grandparents to use. Fire TV is attempting to copy Roku here, and keeping it super simple.

Amazon Fire TV Stick 4K AM AH 9

What apps are available?

It’s a fair question to ask since there are always carriage disputes with different platforms. However, Amazon has played nice with everyone and has most of the popular apps available on its platform. These include:

  • Netflix
  • Hulu
  • Peacock
  • PlutoTV
  • Tubi
  • HBO MAX
  • Paramount+
  • YouTube
  • YouTube TV
  • Amazon Prime Video
  • ESPN
  • TikTok
  • Discovery+
  • STARZ
  • Plex
  • Spotify
  • NBA on Fire TV
  • Facebook
  • and many more

Amazon also has quite a few games on Fire TV, including its own game streaming service Luna. Don’t expect anything crazy here in terms of games on Fire TV, these are mostly easy to play games like Crossy Road and Hill Climb Racing. Nothing really crazy like League of Legends: Wild Rift. Amazon does sell a game controller for Fire TV, but you can also pair your own Bluetooth controller with your Fire TV.

Is there any free content on Fire TV?

While Amazon does not have its own free channel like Roku, there are plenty of apps that offer up free content and are available on Fire TV. Those include Crackle, Pluto TV, and Tubi. Of course, YouTube is also available, and since you’re probably an Amazon Prime subscriber, Prime Video has loads of content to watch too.

What Fire TV devices are available?

Currently, Amazon has two different types of streaming devices for Fire TV. There are four different HDMI sticks and then a set-top box. Fire TV also comes in many different TVs from Toshiba and Insignia, and now Amazon makes its own TVs, too.

Amazon Fire TV Stick

The Amazon Fire TV Stick comes in four flavors:

  • Amazon Fire TV Stick Lite
  • Amazon Fire TV Stick
  • Amazon Fire TV Stick 4K
  • Amazon Fire TV Stick 4K Max

They are essentially the same, except for the fact that the two 4K models are, well, 4K capable. The Fire TV Stick 4K Max also more RAM, as well as offering faster WiFi support. These range in price from $30 to $60, so they are still fairly inexpensive.

Comparing all Fire TV Devices

Amazon Fire TV Cube

The Amazon Fire TV Cube has actually been around for a few years now, and the main thing that it offers is more storage and always-listening Alexa. The Fire TV Sticks do not offer Alexa always-listening. Which some people like, since you have to press the microphone button to actually talk to Alexa.

Amazon Fire TV 4 Series

Amazon also has two lines of its own TVs that have Fire TV built-in. The 4 series is the cheaper line, consisting of 43-, 50-, and 55-inch models. These start at under $300. So they are fantastic to put into a secondary or guest bedroom since they don’t need to be huge.

Screen Shot 2022 05 04 at 8 56 55 AM

Amazon Fire TV Omni Series

Then there is the Omni series. This is the more premium line of Amazon’s own TV sets, offered in 43-, 50-, 55-, 65- and 75-inch models. These start at just over $400. However they are on sale quite often. The Omni series offers up Dolby Vision but only on the 65- and 75-inch models. It does have a better panel than the 4 series, so you’ll get a better looking picture, regardless.

81KwyeeNuL AC SL1500

Can I get Fire TV built into my TV?

Yes, you sure can. As we highlighted above, Amazon actually makes its own TVs with Fire TV built-in now. But they weren’t the first to do it. There are a number of other manufacturers that also have Fire TV built-in, including Toshiba, Insignia, and Pioneer.

There aren’t as many options as you have with Roku being built-in, but it is possible here, which is really lovely to see.

Should I use Fire TV?

The first thing to do is look at the apps and features you use. If all of the apps that you use are available on Fire TV, and you don’t use Google Assistant (or are okay with using Amazon Alexa), then sure, Fire TV is a great alternative. If you do switch, I’d recommend the Fire TV Stick 4K Max. It’s more expensive, but with the extra horsepower and RAM inside, you will thank me later.

Fire TV is quickly becoming one of the most popular streaming TV platforms in the world, and we wouldn’t be surprised to see it take over Roku very soon.

[ad_2]

Source link