Google reportedly working on satellite SOS feature for Pixels

0
[ad_1]

Pixel phones may soon get an emergency SOS feature that lets users send emergency messages via satellite. The feature is reportedly part of the Adaptive Connectivity Services app and will be enabled in a future update. A satellite SOS feature for Pixel devices is not something that is entirely a surprise. Google initially announced plans to bring it to Pixel phones back in 2022. It was rumored again in 2023 that Google would be working with Garmin on it. But hasn’t made any public announcements about its arrival in quite some time. Leading some to speculate that Google may have decided to pull the plug on it.

But that doesn’t seem to be the case. Google is still seemingly working on the feature and it could be ready in the near future. While not active yet, references to the feature were found within the Adaptive Connectivity Services app’s latest version by the Google News Telegram channel. The app version in question is p.2024.08, and talks about how the feature would work. Once enabled, users will be able to find the feature inside the Safety and Emergency section of the settings menu on their Pixel device.

From there, users would tap on the Satellite SOS menu. As of right now though nothing happens when you tap that section. Nor would it if you weren’t on the version mentioned above.

The satellite SOS feature on Pixel phones doesn’t have a release date

There’s no set release date for the feature but it’s likely to be soon if references to the feature are already being found. You can get to the SOS menu from Safety and Emergency settings. However, you can’t get inside of the menu yet. The Google News Telegram channel was able to enable this menu though and discover some details which you can see in the screenshots below. You’ll be able to use the satellite SOS to call or text emergency services. With the intention of this being active should you be out of range of mobile or Wi-Fi coverage.

The menu inside Safety and Emergency settings also provides a three-step guide on how the feature works. After you contact emergency services, you’ll be asked to answer a few questions about the emergency to get the right help. At this point, you can share your location or send it in Google Maps. Additionally, the satellite SOS menu also has a demo that users will be able to try to get a feel for how things work. You can also use this menu to set sharing preferences for emergency contacts.


[ad_2]
Source link

Motorola teases the Moto X50 Ultra, its first AI phone

0
[ad_1]

We are at the dawn of the AI phone era, and the first rays of sunlight are peeping through the window. Samsung made a big splash with Galaxy AI, but another notable tech brand wants to challenge it. Motorola just posted a teaser for the Moto X50 Ultra, its first AI phone. We’ve been following rumors about a Snapdragon 8 Gen 3-powered phone from Motorola, so this might be it.

At this point, we may as well admit that the AI phone is the phone of the future. Samsung unveiled Galaxy AI; however, other companies are also adding AI to their phones. Oppo is working on its AndesAI model, and Tecno recently announced that it’s working on adding powerful AI to its future phones. So, it’s evident that the AI phone will dominate the market.

Motorola teases the Moto X50 Ultra, its first AI phone

Motorola is really big in the mid-range market, but it does have a few bombastic flagship phones. The Motorola Edge+ (2023) is a shining example of an amazing premium device. However, the company is looking forward

On the Chinese social media site Weibo, Motorola posted a teaser of the upcoming Moto x50 Ultra. We see a video of a Formula 1 racing car interlaced with flashing clips of the Motorola phone. The Formula 1 car is a reference to the Formula 1 season starting tomorrow.

In the video, we see a teaser of the actual device. Being a teaser, we are only presented with a silhouette of it. However, based on what we can see, it appears that the phone will have a rounded rectangular camera package situated on the top left of the backside. It looks like it’ll be pretty large. Also, it appears that this phone will have a leather or faux leather back panel.

Moto X50 Teaser

One important thing about this teaser is the fact that Motorola displays the text AI pretty prominently. This lets us know that Motorola plans to center its upcoming flagship phone around artificial intelligence. Right now, the potential for artificial intelligence on phones is still being tapped. However, what we’ve seen so far typically includes text translation, text generation, text summarization, and photo editing.

So, if the Moto x50 Ultra does have similar AI technology to what we’re seeing today, then we should expect those features and a few more. As for the AI model this phone will use, we are pretty certain that it will use Gemini Nano. However, that’s just speculation.

Rumored specs

Details about this phone are scarce. So far, rumors point to this phone having a 4,500mAh battery with a whopping 125W wired charging and 50W wireless charging.


[ad_2]
Source link

Rumor suggests NVIDIA has a PC gaming handheld in the works

0
[ad_1]

The handheld PC gaming race continues to heat up as more and more companies look to enter the space, and it looks like NVIDIA may be the next company to do so. This wouldn’t be the first time that NVIDIA has come out with a handheld. Years ago it offered something that many may have forgotten about called the SHIELD Portable. It was a clamshell-style handheld that had a flip-down screen that covered the top of the controller. It wasn’t really a PC handheld like the Steam Deck or ROG Ally, or any of the options from GPD or Ayaneo.

Instead, it ran on Android and would allow you access to Android games. As well as the (at the time) very early version of GeForce NOW. Since then NVIDIA hasn’t dabbled at all in the handheld space. Focusing mostly on other ventures like its long-standing GPU business, and the growing AI market. Which has helped it become a $2 trillion company recently.

However, it seems NVIDIA may be interested in creating a handheld gaming PC that rivals the Steam Deck and other similar options. One thing to note is that all of those options run on AMD hardware designed specifically for handhelds. Obviously, that would change with NVIDIA.

An NVIDIA PC gaming handheld would run on its own GPU tech

More companies jumping into the PC gaming handheld space is going to be exciting for enthusiasts and the market in general. Regardless of what company that happens to be. But NVIDIA being one of those companies is extra exciting. Because it means there would finally be a handheld based on NVIDIA’s GPU technology.

According to a recent video from Morre’s Law is Dead on YouTube, (via TechRadar), NVIDIA isn’t happy that AMD more or less has the market cornered on handheld gaming PCs. And feels like it could be “missing the boat” in a segment of the market that is ripe with opportunity.

NVIDIA would not be making this handheld all by itself

Unlike the SHIELD, which was released by NVIDIA, the upcoming handheld would not solely be an NVIDIA product. Moore’s Law is Dead says they’ve been told directly that NVIDIA is looking to “work with someone” to create it. This would be similar to what AMD has done with manufacturers. It worked with companies like Valve to create the handheld using custom AMD hardware. NVIDIA reportedly wants to do the same thing.

This handheld is also said to be a “premium” handheld. Which suggests it would be a powerful device with potentially better specs than other devices. Maybe even a more premium design and build. The other thing to note is that this handheld would be “years from now” if it does end up being made. Still, it would certainly be interesting to end up with a handheld gaming PC that is capable of accessing features like NVIDIA’s DLSS technology. Assuming NVIDIA would develop that in.


[ad_2]
Source link

Russia Clamps Down on VPNs, Furthering Restrictions on Internet Access

0
[ad_1]

The ban is likely due to people using VPN technology to access banned content and bypass government surveillance measures.

Russian media regulator Roskomnadzor plans to ban VPN services in Russia and Ukraine, potentially affecting free speech and information access, according to a new report by vpnMentor.

The report, authored by Jeremiah Fowler, a cybersecurity researcher known for identifying misconfigured databases on the Internet, sheds light on Russia’s recent efforts to further restrict internet freedom within its borders. It highlights the country’s new ban on popular VPN (Virtual Private Network) services, a move experts believe will significantly undermine online privacy and increase online censorship in the country. The ban will come into effect on 1st March 2024. 

It is worth noting that restricting VPNs may limit Russian citizens’ access to the outside world and form broader perspectives. In 2022, 23% of the Russian population used VPN services, up from 9% in 2021.

This surge is linked to Russia’s invasion of Ukraine and the blockage of 138,000 websites. Russia’s Freedom on the Net ranking of 21 out of 100 in 2023 indicates a preference for anonymity and privacy, prompting the government to ban VPNs.

This ban will not just affect internet users but also those fighting for freedom of expression, limiting access to independent news sources and anonymity, and increasing risk to activists, dissidents, and whistleblowers who rely on VPNs for secure communication. That’s because VPNs act as secure tunnels, encrypting internet connections to protect online privacy. They are used for data protection, accessing geo-restricted content, and private internet browsing without tracking.

According to vpnMentor’s blog post, Russian authorities have even banned advertisements and websites offering methods to bypass blocked resources in Russia and Ukraine. Russian authorities have pressured social media companies to restrict content, establish local businesses, store data locally, and allow security services unrestricted access to user data. Western companies have refused to comply, even if it means leaving the Russian market.

This move is part of a larger campaign from Russia to regulate and curb internet access, isolate internet users, and increase surveillance. In 2018, Russia requested Telegram to provide encryption keys for government access to users’ messages, audio, and pictures.

Last year Russian government banned various Western messaging apps, including Snapchat, WhatsApp, Discord, Skype for Business, Microsoft Teams, and Telegram, as well as European encrypted apps Viber and Threema, and Chinese communication app WeChat.

  1. Mullvad VPN’s Office Raided By Police for User Data
  2. Russia Bans WhatsApp, Discord, Telegram, and Others
  3. Top 10 worst countries for Internet freedom, censorship
  4. Researchers develop AI tool to evade Internet censorship
  5. Russia blocks 50 VPNs, Anonymizers in Telegram crackdown
  6. Geneva tool lets you bypass censorship by merely doing nothing
  7. ExpressVPN Removes Servers in India Against Data Collection Law

[ad_2]
Source link

Spotify’s new audiobook plan is kind of… pointless

0
[ad_1]

Spotify is one of the largest streaming services in the entire world, and it has several paid subscription tiers to suit different people with different needs. We are all familiar with the two subscription plans that are available. Well, Spotify just unveiled its new audiobook subscription called the AudioBook Access Tier, and it’s pretty pointless.

As we know, Spotify has been doubling down on its selection of audiobooks. This was a move to compete with Amazon, as Audible pretty much owns the industry. Right now, Spotify offers over 200,000 books for people to listen to. Also, authors can also publish their books directly to Spotify and earn revenue from it. However, Spotify’s monetization for writers leaves much to be desired.

 Spotify has a new audiobook plan, but it’s pretty pointless

If you are an avid audiobook listener, then this plan might sound tempting to you at first. The Spotify Audiobook Access Tier grants you 15 hours of listening every month. Depending on how much you listen to audiobooks, that may or may not be worth the subscription price. Speaking of the price, this plan costs $9.99/month. So, it costs as much as the basic plan used to cost.

Why is the plan pointless? Well, the Spotify audiobook plan has a long list of parts… actually, it barely has none. You get 15 hours of listening, and that’s it. You don’t get anything other than that.

With the other two plans, you get access to ad-free music and podcasts, the ability to play whatever track you want to play on the mobile app, and the ability to download music to your device, to name a few. The $19.99/month plan provides additional perks. With the Spotify audiobook plan, you still have to listen to ads when listening to music, and you’re still missing out on all of the other perks. Not only that, but the $10.99/month premium plan also gives you 15 hours of audiobook listening.

This begs the question of why this plan exists. There’s not much point in buying a $10/month plan that has only 10% of the perks of a plan that cost $11/month. This, we’re not sure that this plan will be popular. However, it seems possible that, with the introduction of the Audiobook Access Tier, Spotify might take away the 15 hours of audiobook listening from the Premium plans. However, that remains to be seen.


[ad_2]
Source link

A mysterious Chromecast With Google TV device was spotted

0
[ad_1]

So far, Google has a handful of Chromecast devices that are available for purchase now. While devices cover a nice range of quality and affordability, it appears that Google may be planning on adding another sibling to the line. According to a new report, a mysterious Chromecast with Google TV device was spotted in the Google Home app.

It’s important to note that this comes to us from an APK deep dive. As such, you’re going to want to take this news cautiously. There was code discovered within the Google Home app which hints at this device. However, this device has not been officially announced. So, at any point, Google could change or cancel this device.

  A mysterious Chromecast with Google TV device was spotted

Chromecast dongles are some of the best options for streaming devices. They offer one of the best TV operating systems, a wide range of resolutions, and some affordable prices. Currently, there are two models available. The HD version caps out at 1080p resolution, and that one costs $29.99. There’s a 4K model, and that costs $49.99.

Checkout the Chromecast devices

It appears that Google wants to add even more models to its roster. In an APK deep dive performed by 9To5Google, it appears that Google references another model in the code of the Google Home app. The model is referred to as “YTD.” This model appears right along with both the HD and 4K models of the Chromecast. So, this leads one to believe that this is also going to be another Chromecast With Google TV device. At this point, we are not 100% sure. Nothing in the code refers to it as a Chromecast with Google TV dongle. So, we will just have to wait and see.

Last year, we saw something similar. There was a device referred to as “YTC” within the code. However, that device never came to fruition. So, it’s clear that Google wants to bring more Chromecast devices to the market, and more could be in production. We’re just going to have to wait to see what the company launches.


[ad_2]
Source link

PikaBot malware on the rise: What organizations need to know 

0
[ad_1]

A new type of malware is being used by ransomware gangs in their attacks, and its name is PikaBot.

A relatively new trojan that emerged in early 2023, PikaBot is the apparent successor to the infamous QakBot (QBot) trojan that was shut down in August 2023. QBot was used by many ransomware gangs in the past for its versatile ability to facilitate initial access and deliver secondary payloads.

After QBot got shut down, there was a vacuum in the ransomware gang tool box—but with PikaBot, that’s beginning to change: last month we wrote about the first recorded instance of PikaBot being used by ransomware gangs, specifically Black Basta, in their attacks.

Let’s dig into how PikaBot works, how it’s distributed, how ransomware gangs use it in their attacks, and how to stop it with ThreatDown.

A closer look at PikaBot

To get a better idea of how PikaBot works, we need to first understand what a modular trojan is.

Simply put, a modular trojan is a type of malware designed to be flexible and extensible, allowing attackers to add or update its functionalities easily without needing to replace the whole malware.

The modular nature of trojans like QBot and PikaBot are what makes them so dangerous. Unlike simpler malware, PikaBot can execute arbitrary commands, download additional payloads, and inject malicious shellcode into legitimate processes running on a victim’s computer. Think of it like a backdoor that allows attackers to set up for the next stages of their attacks.

Once it’s installed onto a system, PikaBot has a whole host of ways to stay under the radar, evading detection by most conventional security tools through techniques like indirect system calls and advanced obfuscation methods.

How Pikabot is distributed

The distribution of PikaBot, like many other malicious loaders such as QBot and DarkGate, is heavily reliant on email spam campaigns. Even so, ThreatDown Intelligence researchers have seen PikaBot being delivered via malicious search ads as well (also known as “malvertising”).

PikaBot’s initial access campaigns are meticulously crafted, utilizing geolocalized spam emails that target specific countries. The emails often contain links to external SMB (Server Message Block) shares, which host malicious zip files.

SMB shares are network folders leveraging the SMB protocol—a network file sharing protocol designed for sharing files and printers across devices on a network. Attackers often use SMB shares to distribute malware. In this case, downloading and opening the hosted zip file results in PikaBot infection.

For example, consider the below phishing email containing a link to a zip file containing the PikaBot payload.

Source: ANY.RUN (Translation: I sent you some paperwork the other day. Did you get it?)

Once the recipient interacts with these emails by clicking on the link, they are taken to the SMB share hosting the malicious zip files.

Extracting a zip and double-clicking on the executable within it will install PikaBot.

Source: ANY.RUN

How ransomware gangs use PikaBot

Ransomware gangs commonly use modular trojans like PikaBot for their attacks.

Before it was shut down, for example, Qbot allowed ransomware gangs to seamlessly integrate various attack techniques into their operations, including stealing credentials, moving laterally across networks, and ultimately deploying ransomware or other malicious payloads.

PikaBot is being used by ransomware attackers in a similar way.

Once PikaBot has established a foothold in a network, it allows attackers to engage in a wide range of follow-up activities.

For example, researchers have noted affiliates of the BlackBasta ransomware gang using PikaBot to use encrypted communications with command and control (C&C) servers. Pikabot can also assist gangs in getting detailed information about infected systems, helping them tailor their ransomware for maximum impact.

How to stop PikaBot with ThreatDown

Besides preventing initial access through things such as a web content filter and phishing training, choosing an Endpoint Detection and Response (EDR) platform that automatically detects and quarantines threats like PikaBot is crucial.

However, given the constant evolution of malware, identifying dynamic threats like Pikabot boils down to two words: threat hunting.

At ThreatDown, we talk a lot about the importance of threat hunting for SMBs—and not for no good reason, either. Just consider the fact that, when an attacker breaches a network, they don’t attack right away. The median amount of time between system compromise and detection is 21 days.

By that time, it’s often too late. Data has been harvested or ransomware has been deployed.

Threat hunting helps find and remediate highly-obfuscated threats like PikaBot that can quietly lurk in the network, siphoning off confidential data and searching for credentials to access the “keys to the kingdom.”

For example, as detailed in one case study, the ThreatDown Managed Detection and Response (MDR) team employed threat hunting techniques to uncover and neutralize a sophisticated QBot attack on a reputable oil and gas company. The team’s approach involved meticulously examining Indicators of Compromise (IoCs), analyzing network traffic, and scrutinizing unusual patterns of behavior within the company’s IT infrastructure, ultimately resulting in Qbot’s discovery on the network and isolation of infected systems.

ThreatDown MDR workflow

Stop threats like PikaBot today

Want to learn more about how ThreatDown stops new threats like PikaBot? Fill out this form to speak with an expert and get a custom quote.


[ad_2]
Source link

Watching videos on Google Drive is going to be much faster

0
[ad_1]

If you are a Google Drive user, then you’ve likely tried to stream some of your saved videos using the platform. Well, using Google Drive to stream videos hasn’t been the best. Fortunately, Google Drive will use the DASH protocol when screaming videos, so the experience will be much better.

When streaming videos on Google Drive, the video player doesn’t take into account how fast or slow your internet connection is. This means that you will experience a lot of buffering if your connection isn’t the greatest. Video streaming platforms like YouTube, on the other hand, will raise or lower the resolution based on your connection speed. This is one thing that helps keep the streaming experience smooth.

  Google Drive will use the DASH protocol for streaming videos

If you are confused about what DASH is, it stands for Dynamic Adaptive Streaming over HTTP. This will automatically adjust the bit rate of the video you’re watching so that it can play better no matter how weak your connection is. Also, videos will start faster when you open them.

The introduction of DASH will make watching videos on Google Drive a much more streamlined experience. Google will enable DASH for new videos going forward. As for videos that already exist on the platform, it’ll be a while before you see DASH make it to them. Google plans to update existing videos on Drive by the end of the year. So, that’s 10 months we will have to wait.

Simplified navigation

Finding different content types on Google Drive is about to change a bit for the mobile app. Normally, when you are searching for files using the search bar, you will see a horizontally scrolling carousel of chips right under the search bar. These chips would all be specific types of files like documents, PDFs, images and videos, Etc.

Well, in a future update, Google will move all of those file types into a drop-down menu. So, when you are in the search section, you will see three drop-down menus where the chips used to be. There will be three drop-down menus. The first one is called “Type,” and it will show you all of the different document types. The second one is called “People,” and it will show you all of the contacts you’ve communicated with on Drive. The last drop-down menu is called “Modified,” and it will show you your most recently modified files.

Google Drive file type drop down

Google is currently rolling these features out to Drive, so you should expect them within the coming weeks.


[ad_2]
Source link

Why European engineering requires unique maintenance techniques

0
[ad_1]

European engineering is known for its precision and innovation, but it also requires specific maintenance routines. In the case of maintaining European cars, generic ways might not work well. In this blog post, we will take a closer look at the special maintenance methods European engineering needs.

Where Germanic auto design meets Italian craftsmanship, every European brand imposes a unique maintenance task. An European auto repair shop that focuses on European vehicles should have in-depth knowledge and equipment to meet these expectations.

Let’s take a tour of the European engineering world and why your auto repair shop must be fully equipped with the right skills to deal with these super machines.

Understanding European Engineering

The engineering in Europe is distinctive for its careful approach to details, consistent adherence to the design principles, and high standards of quality. It can either be the German automotive engineering that is famous for its precision and performance or the Swiss watchmaking that is highly regarded for its craftsmanship and precision. Both of them are identified with quality and reliability.

Unique Maintenance Challenges

Advanced Technology

European products, frequently being high-tech and complicated, require highly specialized knowledge and tools to maintain and repair. In the automotive industry, advanced electronic control units and high precision machinery used in manufacturing require workers to be updated with the latest developments in order to conduct maintenance effectively.

Precision Engineering

European engineering gives more emphasis on the design and manufacturing of parts with high precision, resulting in finely engineered components that need special attention. From high-tolerance engine parts to complexly calibrated sensors, these precision-engineered components might need to be dealt with carefully and even with great skill.

Specialized Materials

In order to ensure the competitiveness of European products on the market, these materials offer excellent performance, durability and low weight. Special maintenance procedures are required to ensure that these materials are used reliably and that they remain in service. Understanding the properties of these materials, whether it is selecting a suitable lubricant for titanium components or providing carbon fiber body panels with an appropriate cleaning solution, are essential to their efficient maintenance.

Optimizing Performance

In Europe, the emphasis is placed on performance oriented design that can range from very high horsepower in sports cars to maximum accuracy of cutting machines. The ideal level of performance shall be continuously maintained by calibration, modification and adjustment in order to ensure that the machine operates as it should.

Effective Maintenance Strategies

Specialized Training

Technicians should be given specialized training in European engineering principles and technologies to guarantee their efficiency. Contents of the training courses should include the following components: advanced diagnostics, usage of special tools, and maintenance procedures that are specific to European-made products.

Access to OEM Resources

Networking with OEMs gives an opportunity to use technical documents, training materials, and specialized tools required for maintenance of products manufactured in Europe. OEM support lets technicians have access to the recent information and resources that are necessary for efficient maintenance and repairs.

Diagnostic Equipment

Investing in diagnostic equipment made for performing detailed diagnoses on European-made products considerably reduces the technician’s time it takes to identify the issues and perform the required diagnostic work. Recently, the utilization of the diagnostic tools like scan tools, oscilloscopes, and diagnostic software has become an essential part of the troubleshooting of the modern electronic systems and revealing of the hidden faults.

Preventive Maintenance Programs

Creating the preventive maintenance programs that are specifically tuned to the European-made product types reduces the likelihood of the unexpected failures and costly downtime. Scheduled inspections, fluid changes, and component replacements based on manufacturers recommendations are to be taken in order to have desirable and reliable performance.

Genuine Parts and Fluids

Using OEM (Original Equipment Manufacturer) parts and liquids as per the manufacturer’s specifications guarantees compatibility and performance consistency. Performance and reliability of European-made products are dependent on the criteria that they are engineered to meet.

Aftermarket components or fluids can alter the specifications, and thus void warranty. Using original components and fluids guarantees the integrity of the equipment and its service life.

Future Trends in European Engineering Maintenance

– The use of AI and machine learning for predictive maintenance.
– Adoption of digital twins and IoT devices for the purpose of real-time monitoring.
– Greater attention to sustainability for energy efficiency and waste minimization.
– Collaboration between engineers, data scientists, and maintenance professionals for new ideas.
– Shifting to reactive, data-driven maintenance strategies for efficiency, sustainability and global competitiveness.

Conclusion

Innovation, accuracy, and efficiency of European engineering are the highest in a broad spectrum of industries. Therefore, it requires a more detailed approach given the advanced technology, precise engineering, and specialized materials. The innovations aim at optimizing operations and reducing downtime, which in the end benefits an auto repair shop.

Through the knowledge of the specific maintenance problems that are inherent in European engineering businesses are able to effectively implement maintenance strategies and ensure that their European produced products operate optimally for a long time.


[ad_2]
Source link

Malicious meeting invite fix targets Mac users

0
[ad_1]

Cybercriminals are targeting Mac users interested in cryptocurrency opportunities with fake calendar invites. During the attacks the criminals will send a link supposedly to add a meeting to the target’s calendar. In reality the link runs a script to install Mac malware on the target’s machine.

Cybersecurity expert Brian Krebs investigated and flagged the issue.

Scammers, impersonating cryptocurrency investors, are active on Telegram channels to get interested people to attend a meeting about a future partnership.

One of those investors called Signum Capital tweeted a warning on X in January that one of their team members was being impersonated on Telegram and sending out invites by direct message (DM).

The criminals reach out to targets by DM on Telegram and ask if they have an interest in hearing more about the opportunity in a call or meeting. If they show interest they will be sent a fabricated invitation for a meeting. When the times comes to join the meeting the invitation link doesn’t work. The scammers tell the victim it’s a known issue, caused by a regional access restriction, which can be solved by running a script.

We asked Malwarebytes Director of Core Technology and resident Apple expert Thomas Reed to look at this method. This isn’t the first time criminals have used scripts to compromise users, he told us.

“AppleScript has been used against Mac users with moderate frequency by malware creators over the years. It has the advantage of being very easy to write, and if compiled, is also extremely difficult to reverse engineer.”

According to Reed, AppleScripts can be provided in a few different forms. One is a simple .scpt file that opens in Apple’s Script Editor app. This has a few drawbacks for criminals: A victim would need to click something within Script Editor to run the script, and they would able to see the code, which might be a problem because AppleScript tends to be more human readable than most other scripts. However, there are ways to obfuscate what the code is doing, and many users won’t bother to read it anyway.

Another option is an AppleScript applet. This is something that acts like a normal Mac app. It contains a basic AppleScript executable and the script to be run. In this form, the script can be code signed, notarized, given an icon, and otherwise made to appear more trustworthy. The code could be pretty bland, and unlikely to trigger any kind of detection from Apple’s notarization process, but could download and execute something less trustworthy.

Scripts have another advantage for criminals, Reed warned.

“AppleScripts also have the advantage of being able to very easily get administrator permissions.”

A script that attempts to run a command with administrator privileges will ask users to authenticate, triggering a password dialog.

If the user enters their password, the script doesn’t actually get to see it, but everything else the script attempts to do “with administrator privileges” will successfully run as root without further authentication. This makes it very easy for the script to show a standard authentication request dialog and trick the user into giving root permissions.

“So, in summary, AppleScript can be quite effective for writing malware. In fact, some malware has been written exclusively – or almost exclusively – in AppleScript, such as OSX.DubRobber or OSX.OSAMiner.”

In this case, the script was a simple Apple Script that downloaded and executed a macOS-oriented Trojan. The nature of the Trojan is unknown, but it certainly won’t surprise anyone if it turns out it was a banking Trojan that specializes in stealing cryptocurrencies.

Recognizing the scam

To avoid falling victim to these scammers, it’s good to know a few of their tactics.

  • Targets are approached by DM on Telegram.
  • Topics are cryptocurrency investment opportunities.
  • The scammers have a preference for the Calendly scheduling platform.
  • A fake “regional access restriction” creates a sense of last minute urgency.
  • The script had the .scpt (Apple script) extension.
  • The script was hosted on a domain that pretended to be a meeting support site.

The presence of Mac malware is unfortunately still underestimated, but you can find protection by Malwarebytes for Mac and protect Mac endpoints in your environment by ThreatDown solutions.


We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.


[ad_2]
Source link