Next-gen OPPO Find flagships will go global, the company has confirmed. When I say “go global”, I mean come in global variants, and launch at least in Europe. At least that’s the information the company shared.
Next-gen OPPO Find flagships will go global, the company has confirmed
This comes from the company executives who confirmed the news during MWC 2024, GSM Arena reports. This unfortunately means that the OPPO Find X7 Ultra won’t get a global variant, unfortunately.
The OPPO Find X7 Ultra is one of the best smartphones we’ve used to date. It has been highly praised since its launch for a good reason. It’s a real shame it did not launch globally. Now we basically know that it won’t arrive in a global variant at all.
That being said, the exact words that OPPO executives used were “upcoming gen of Find series”. We’re not sure if they meant the OPPO Find X8 series or the OPPO Find N4 series. If we had to guess, I’d say that the OPPO Find X8 series.
Why? Well, the OPPO Find N3 did arrive in a global variant. It launched instead of the OnePlus Open in a number of markets, and we’ve reviewed that model with global software. It arrived to the Phillippines, for example.
The company’s execs were almost certainly talking about the OPPO Find X8 series
So, considering that there is already a global variant of the Find N3, it’s safe to assume that the Find N4 will arrive to global markets too. That’s probably not what the executives meant. I’m pretty sure they were referring to the OPPO Find X8 series.
The bad news is, however, that the OPPO Find X8 series is not expected to launch until January next year. So we’re in for quite a wait. You can still try to import the OPPO Find X7 Ultra, though, as it works perfectly fine once you install the Google Play Store.
There are some limitations that come with the software made for China, but not nearly as much as on some other devices
The Federal Trade Commission (FTC) has slapped antivirus maker Avast with a fine of $16.5 million for selling customer data to third parties without their consent. The Commission has also banned the firm from selling user information for advertising purposes. The cybersecurity software company has already shut down its subsidiary, called Jumpshot, which harvested and sold user data.
Avast fined $16.5 million for selling user data to third parties
The news of Avast selling the browser history of its customers broke out in January 2020. The company harvested the data of its users through Jumpshot and sold it to advertisers. A public and media backlash ensued and the firm responded by promptly shutting down its subsidiary. While Avast claimed all data was “de-identified” before selling to third parties, reports suggest it could be linked back to people’s real identities in some instances.
Investigations revealed that the antivirus company harvested and sold user data from at least 2014 to 2020. Jumpshot reportedly collected data from as many as 100 million devices and sold it to more than 100 third parties operating as digital advertisers, marketing and data analytics companies, and data brokers. Information sold included users’ web searches, the web pages they visited, and every click on the website.
According to the FTC, Jumpshot signed contracts with advertising firms to provide an “All Clicks Feed” for Avast users. It permitted the firms to “associate Avast’s data with data brokers’ sources of data, on an individual user basis.” This enabled advertisers to track users more precisely by combining data from two sources. Effectively, they could show more tailored ads and other products to those users.
It was a massive breach of privacy and trust from a company entrusted to protect people online. “Avast promised users that its products would protect the privacy of their browsing data but delivered the opposite,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, in an official press release from the Commission. “Avast’s bait-and-switch surveillance tactics compromised consumers’ privacy and broke the law.”
Avast must delete user information transferred to Jumpshot
Along with a $16.5 million fine, the FTC has ordered Avast to delete the web browsing information transferred to Jumpshot. It also must delete any products or algorithms its now-defunct subsidiary derived from that data. Additionally, the firm is banned from selling or licensing any browsing data from its products to advertisers. It needs to obtain affirmative express consent from consumers before selling data from non-Avast products.
The FTC has also ordered Avast to inform consumers affected by its practice about the Comission’s actions. Last but not least, it has to implement a privacy program that addresses the misconduct highlighted by the FTC. In an official statement, Avast said it disagrees with the FTC’s “allegations and characterization of the facts.” However, it is “pleased to resolve this matter” and is committed to “protecting and empowering people’s digital lives.”
PIKABOT is a polymorphic malware that constantly modifies its code, making it hard to recognize and easily bypasses the Endpoint Detection and Response (EDR) systems.
Obfuscation, encryption, and anti-analysis techniques help the object avoid these traditional security measures.
PIKABOT is able to avoid signature-based detection by dynamically changing its structure, which makes it harder for EDR solutions to keep up with their ever-changing behaviors.
Cybersecurity researchers at Elastic Security Labs recently discovered new and upgraded PIKABOT campaigns on February 8th.
A popular loader used by malicious actors to disseminate extra payloads is called PIKABOT.
You can analyze a malware file, network, module, and registry activity with the ANY.RUN malware sandbox, and the Threat Intelligence Lookup that will let you interact with the OS directly from the browser.
PIKABOT Evades EDR Protection
Elastic Security Labs detected a fresh instance of PIKABOT with the updated loader, new unpacking method, and heavy obfuscation for strings decryption as well as other obfuscation changes.
The update is an indication that a new code base has been laid down for future improvements.
However, these changes are expected to break signatures and previous tools like the previous versions.
PIKABOT execution flow (Source – Elastic)
PIKABOT has been quiet during the New Year but resurfaced in February, with a campaign launched on Feb 8.
ZIP archives in emails contained hyperlinks to download obfuscated Javascript.
The attacker altered grepWinNP3.exe, which is a legitimate tool, to appear real.
The call stack analysis traced back malicious code entering their Detonate sandbox and Elastic Defend’s call stack.
Executions begin before offset 0x81aa7 and jump towards memory allocation at offset 0x25d84 as indicated by this last part of the previous sentence.
There were no normal calls for process creation; instead, there were unbacked memory syscalls via shellcode evading EDR products and bypassing user-mode hooks on WOW64 modules.
In a hard-coded address for PIKABOT loader execution at offset 0x81aa7, researchers found. JMP instructions are used after each assembly line in the code to make analysis difficult because of heavy obfuscation.
This loader uses custom decryption by means of bitwise operations to recover its payload from the .text section.
However, this can lead to any PE file not being written into a disk and executed in memory.
By doing this, on the host system, the stealth is improved by reducing the digital footprint.
The PIKABOT core is initialized by the stage 2 loader using code and string obfuscation, NTDLL Zw APIs, and advanced anti-debugging.
Moreover, the PIKABOT core makes direct system calls, allowing it to bypass EDR user-land hooking and debugging.
Besides, malware utilizes ZwQuerySystemInformation, ZwQueryInformationProcess, PEB inspection, GetThreadContext methods, and many others as techniques that are undetected by forensic and debugging tools.
The current version of PIKABOT core functions similarly with its previous releases.
However, there are some differences, such as a new obfuscation style, different string decryption processes, use of plain text configuration, and network communication changes (RC4 instead of AES).
This binary is relatively less obfuscated but still remains familiar. The remaining in-line RC4 functions utilize legitimate strings as keys.
Obfuscation is done through junk code insertion to confuse an analyst. While the command execution, discovery, and process injection form part of core functionality.
The Twitter user reecDeep, who specializes in malware analysis, noticed that Pikabot malware is being distributed by TA577 through HTML files.
Surprisingly, these files have not been detected by any of the antivirus programs on VirusTotal.
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
For the most popular operating system in the world—which is Android and it isn’t even a contest—there’s a sneaky cyberthreat that can empty out a person’s bank accounts to fill the illicit coffers of cybercriminals.
These are “Android banking trojans,” and, according to our 2024 ThreatDown State of Malware report, Malwarebytes detected an astonishing 88,500 of them last year alone.
While the 2024 ThreatDown State of Malware report focuses heavily on the corporate security landscape today, make no mistake: Android banking trojans pose a serious threat to everyday users. They are well-disguised, hard to detect in regular use, and are a favorite hacking tool for cybercriminals who want to automate the theft of online funds for themselves.
What are Android banking trojans?
The idea behind Android banking trojans—and all cyber trojans—is simple: Much like the fabled “Trojan Horse” which, the story goes, carried a violent surprise for the city of Troy, Android banking trojans can be found on the internet disguised as benign, legitimate mobile apps that, once installed on a device, reveal more sinister intentions.
By masquerading as everyday mobile apps for things like QR code readers, fitness trackers, and productivity or photography tools, Android banking trojans intercept a person’s online interest in one app, and instead deliver a malicious tool that cybercriminals can abuse later on.
But modern devices aren’t so faulty that an errant mobile app download can lead to full device control or the complete revelation of all your private details, like your email, social media, and banking logins. Instead, what makes Android banking trojans so tricky is that, once installed, they present legitimate-looking permissions screens that ask users to grant the new app all sorts of access to their device, under the guise of improving functionality.
Take the SharkBot banking trojan, which Malwarebytes detects and stops. Last year, Malwarebytes found this Android banking trojan hiding itself as a file recovery tool called “RecoverFiles.” Once installed on a device, “RecoverFiles” asked for access to “photos, videos, music, and audio on this device,” along with extra permissions to access files, map and talk to other apps, and even send payments via Google Play.
These are just the sorts of permissions that any piece of malware needs to dig into your personally identifiable information and your separate apps to steal your usernames, passwords, and other important information that should be kept private and secure.
The introduction screen when opening “RecoverFiles” and the follow-on permissions it asks from users. Once installed, it is invisible on the device home screen.
Still, the tricks behind “RecoverFiles” aren’t yet over.
Not only is the app a clever wrapper for an Android banking trojan, it could also be considered a hidden wrapper. Once installed on a device, the “RecoverFiles” app icon itself does not show up on a device’s home screen. This stealth maneuver is similar to the features of stalkerware-type apps, which can be used to non-consensually spy on another person’s physical and digital activity.
But in the world of Android banking trojan development, cybercrminals have devised far more devious schemes than simple camouflage.
Slipping under the radar
The problem with the Ancient Greeks’ Trojan Horse strategy is that it could only work once—if you don’t sack Troy the first time, you better believe Troy is going to implement some strict security controls on all future big horse gifts.
The makers of Android banking trojans have to overcome similar (and far more advanced) security measures from Google. As the Google Play store has become the go-to marketplace for Android apps, cybercriminals try to place their malicious apps on Google Play to catch the highest number of victims. But Google Play’s security measures frequently detect malware and prevent it from being listed.
What was most concerning in this attack was that the malicious apps that made it onto the Google Play store reportedly worked for their intended purposes—the PDF reader read PDFs, the file manager managed files. But hidden within the apps’ coding, users were actually downloading a set of instructions that directed their devices to install malware.
These malicious packages are sometimes called “malware droppers” as the apps “drop” malware onto a device at a later time.
What does it all mean for me?
There’s a lot of technical machinery at work inside any Android banking trojan that is put in place to accomplish a rather simple end goal, which is stealing your money.
All the camouflage, subterfuge, and hidden code execution is part of a longer attack chain in which Android banking trojans steal your passwords and personally identifiable information, and then use that information to take your money.
As we wrote in the 2024 ThreatDown State of Malware report:
“Once it has accessibility permissions, the malware initializes its Automated TransferSystem (ATS) framework, a complex set of scripts and commands designed to perform automated banking transactions without user intervention. The ATS framework uses the harvested credentials to initiate unauthorized money transfers to accounts held by the attacker. This mimics real user behavior to bypass fraud detection systems.”
Staying safe from Android banking trojans
Protecting yourself from Android banking trojans is not as simple as, say, spotting grammatical mistakes in a phishing email or refusing to click any links sent in text messages from unknown numbers. But just because Android banking trojans are harder to detect by eye does not mean that they’re impossible to stop.
Malwarebytes Premium provides real-time protection to detect and stop Android banking trojans that are accidentally installed on your devices. It doesn’t matter if the banking trojan is simply a malicious app in a convenient package, or if the banking trojan is downloaded through a “malware dropper”—Malwarebytes Premium provides 24/7 cybersecurity coverage and stops dangerous attacks before they can be carried out.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
After ditching the waitlist and opening the platform to everyone, the X competitor Bluesky is now federating its network by letting users run their own servers. The company announced the news on Thursday, adding that users can distance their data from the company’s servers and self-host their data.
All social media platforms store users’ data on their servers, and users do not have much control over that data. A server might be vulnerable to cyberattacks and compromise user’s data, which has happened quite often in recent years. This is the traditional method. But the latest social platform, dubbed decentralized platforms, seeks to change this and give users more control over their data.
Bluesky allows users to self-host their data
Founded by former Twitter (X) CEO Jack Dorsey, Bluesky seems to be the first decentralized social platform that’s making this come true. The Bluesky’s federation network is still in the early phases of implementation and will open up to more servers in the future.
As the company explains, user’s data is stored on Bluesky servers by default. However, users can opt out of the company’s servers anytime and host their data on any provider they want. The transition process happens without losing existing posts, likes, or follows.
Since the implementation has just started, the company has put some “guardrails” in place to ensure a smooth transition process. The company says on its developer’s blog that users can only self-host one Bluesky account at a time. However, the limits will extend to 10 accounts with rate limits in the future. Bluesky added it will increase baseline rate limits as “trust and reputation is established.”
Meanwhile, Bluesky demands users to be more cautious with their account transition. Or at least do not self-host their main account for now since the process has just started and could be slow and faulty.
Bluesky uses its own AT Protocol instead of ActivityPub
“On Bluesky, server choice doesn’t affect what content you see. Servers are only one piece of the protocol — when you browse Bluesky, you see posts that are pulled together from many different servers.” The company added. “This is why you can change your server after signing up without losing your username, friends, or posts.”
The number of shares and price are yet to be determined before going public. Reddit has disclosed the number of its active users and revenue in the S-1 documents handed to the SEC. Accordingly, Reddit has 73 million daily users and over 100,000 active communities at the time. The platform’s total posts have also surpassed the 1 billion mark.
Reddit will become a publicly traded company on the New York Stock Exchange
Founded in 2005, the 18-year-old San Francisco-based company reported an $804 million revenue for the 2023 fiscal year, which shows a 20% increase. Meanwhile, the company had a net loss of $90.8 million last year, making it unprofitable.
As NYTimes reports, Reddit seeks a valuation of at least $5 billion. The company was valued at $10 billion in a 2021 private financing round. The final price will be determined after careful evaluations by bankers.
Reddit also considers selling an unspecified number of its shares to “certain users and moderators identified by us who have meaningfully contributed to Reddit community programs.” So, the platform’s loyal customers can buy shares before other investors and hope to make an early profit.
Additionally, users with a karma score of at least 200,000 and users who have performed at least 5,000 moderator actions can buy shares in the Reddit IPO sooner than everyone else. Reddit also announced it had saved 1.3 million shares of its Class A common stock “to fund community-related programs that empower Redditors to bring their ideas to life.”
Reddit uses its data as an advantage to sign AI training deals
CEO Steve Huffman said, “I have never been more excited about Reddit’s future than I am right now.” Huffman added that Reddit now has the chance to grow its platform and business through advertising, monetizing commerce, and licensing data. Reddit CEO also said their data advantage and intellectual property are “key elements” in training future LLMs.
A critical security flaw has been identified in the Ultimate Member plugin for WordPress, which could potentially put over 200,000 websites at risk.
The vulnerability was discovered by Christiaan Swiers and reported through the Wordfence Bug Bounty Program, earning him a bounty of $2,063.00.
The flaw in question is an unauthenticated SQL Injection vulnerability that could allow attackers to extract sensitive data, such as password hashes, from the affected websites’ databases.
You can analyze a malware file, network, module, and registry activity with the ANY.RUN malware sandbox, and the Threat Intelligence Lookup that will let you interact with the OS directly from the browser.
Ultimate Member Plugin Flaw
The vulnerability was found in versions 2.1.3 to 2.8.2 of the Ultimate Member plugin. It was caused by insufficient escaping of the ‘sorting’ parameter and a lack of preparation in the SQL query, which could be exploited through a Time-Based blind SQL injection approach.
This method involves attackers using SQL CASE statements and the SLEEP() command to extract information based on the response time of each request.
However, it’s important to note that the vulnerability critically affects only those users who have enabled the “Enable custom table for user meta” option, as the vulnerable Member_Directory_Meta class is loaded only in this configuration.
The Wordfence firewall rule detects the malicious SQL query and blocks the request.
Disclosure & Prompt Patching
Wordfence received the vulnerability submission on January 30, 2024. The same day, they validated the report, confirmed the exploit, and contacted the Ultimate Member Team.
The team responded promptly and began working on a fix after receiving full disclosure details from Wordfence.
The Ultimate Member Team released a patch on February 19, 2024, addressing the vulnerability with the updated version 2.8.3 plugin.
Wordfence urges all users of the Ultimate Member plugin to update to the latest patched version immediately to safeguard their sites against potential attacks.
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Samsung will soon launch a new premium mid-range smartphone, the Galaxy A55. It will arrive in a few weeks as the company’s best value for money for 2024. We already know a lot of things about the device thanks to leaks and certifications. A major leak has now revealed its entire spec sheet, price, and launch date, leaving little to the imagination.
The biggest Galaxy A55 leak is here to bare it all
According to a WinFuture report, Samsung will equip the Galaxy A55 with a 6.5-inch AMOLED display featuring a 2340 x 1080 pixels resolution, 120Hz refresh rate, and 1,000 nits of peak brightness. The screen is marginally bigger than the Galaxy A54’s 6.4-inch panel. In fact, the device itself is taller and wider than its predecessor. It measures 161.1 x 77.4 x 8.2 mm in dimension and weighs 213 grams. The Galaxy A54 is 158.2 x 76.7 x 8.2 mm and 202 grams.
Despite a bigger profile, the Galaxy A55 packs the same 5,000mAh battery with 25W wired charging. Samsung is also keeping the camera setup unchanged from the 2023 model, including the front camera. We are talking about a 50MP primary shooter with an f/1.8 aperture and OIS (Optical Image Stabilization), a 12MP f/2.2 ultrawide camera, and a 5MP F/2.4 macro camera. On the front, the device has a 32MP selfie camera with an f/2.2 aperture.
The Galaxy A55 can record 4K videos at 1080p resolution with its primary rear camera and selfie camera. Once again, no changes over its predecessor. The device also shares the IP67 dust and water resistance rating with the 2023 model. So what has changed? Well, on the outside, the design and build quality. Samsung has upgraded the phone to an aluminum frame from a plastic frame and introduced the Key Island design.
On the inside, the Galaxy A55 gets a newer Samsung Exynos 1480 chipset with AMD-powered custom GPU. The chipset is paired with 6GB/8GB RAM and 128GB/256GB storage options. The device runs Android 14-based One UI 6.1 out of the box. Other known specs include NFC, Bluetooth 5.3, WiFi 6, under-display fingerprint scanner, microSD card slot, stereo speakers, and USB-C 2.0. The handset comes in Navy, Ice Blue, White, and Purple colors.
The Galaxy A55 launches in early March with a price cut
Samsung reportedly plans to launch the Galaxy A55 and Galaxy A35 on March 11. The 6GB+128GB variant is said to cost €450, notably less than the Galaxy A54’s entry price of €490. For higher RAM and storage, you will have to shell out around €500, which is still a €50 price cut over the 2023 model. If the phone sees a similar drop in prices in the US, it would be an appealing product in the premium mid-range segment.
Last September, there were reports that Microsoft tried to sell its Bing search engine to Apple at one point. The talks between the tech giants reached an exploratory stage in 2020 but didn’t get more advanced due to Bing’s quality issues. Now, a court document related to Google’s antitrust trial with the DOJ, which was unsealed on Friday, suggests a similar claim.
Microsoft pitched Apple the idea of making Bing the default search engine on Safari many times
The unsealed document has revealed that Microsoft pitched Apple the idea of making Bing the default search engine on Safari many times. The Redmond-based tech giant tried it as many as six times in 2009, 2013, 2015, 2016, 2018, and 2020. The company even tried to sell Bing to Apple in 2018, apart from offering to establish a Bing-related joint venture. However, every time, Apple declined citing the quality and features of Bing over Google Search, reports CNBC.
In the document, Google mentioned that “In each instance, Apple took a hard look at the relative quality of Bing versus Google and concluded that Google was the superior default choice for its Safari users. That is competition”. The search titan claims that Apple rejected Microsoft’s offer citing the under-par search quality of Bing. The CNBC report also quotes Eddy Cue, Apple’s Senior Vice President of Services, mentioning that Microsoft wasn’t investing enough in search quality and investment.
“Microsoft search quality, their investment in search, everything was not significant at all,” said Eddy Cue, as per the filing. “And so everything was lower. So the search quality itself wasn’t as good. They weren’t investing at any level comparable to Google or to what Microsoft could invest in. And their advertising organization and how they monetize was not very good either.”
Apple is making billions by keeping Google as its default search engine
For the uninitiated, Apple is making billions of dollars by keeping Google as its default search engine. Well, there’s no concrete number, but reports suggest that Google pays nearly upwards of $20 billion yearly to Apple for their deal. Notably, during the antitrust trial, Eddy Cue (Apple’s SVP of Services) testified that if Apple hadn’t received such massive payments from Google, it would have developed its own search engine.
Many industry analysts suggest that the Cupertino tech giant will eventually launch its own search engine. Over the years, many reports have been suggesting that as well. However, given the amount of money the company is already making from Google, we don’t think it will happen any time soon.
Currently, Google is the king of search with a market share of nearly 92 percent as of January 2024, as per StatCounter. As for Bing, it reportedly caters to just around 4 percent of searches across the globe. It’s worth pointing out that StatCounter reports that Bing’s user base is growing gradually. In January 2023, it claimed a market share of 3.03 percent, which has risen to 3.43 percent in January 2024
Google aims to relaunch Gemini AI image tool in a few weeks, a Reuters report reads.
The latest image-generating tool in the AI craze was paused some days ago, after the inaccuracy backlash over the way Gemini’s image tool generated people.
Google’s AI image generator was designed to turbo-perform on topics of diversity and inclusivity, to the point when it refused to generate white people and in historical context. The reports of the tool generating non-white Vikings went under the radar, but once Gemini AI started generating black German soldiers from the 1940s, things got really controversial.
The information for Gemini’s AI tool revival comes from Google DeepMind CEO Demis Hassabis on MWC – Google DeepMind is the unified Google AI lab DeepMind and the Google Brain (its AI research division). Last summer, it was Hassabis who announced that Gemini is coming.
Since the launch of OpenAI’s ChatGPT in November 2022, Google has been racing to produce AI software to rival that of the Microsoft-backed company.
In 2023, when Bard was released (later rebranded to Gemini), it had shared inaccurate information about pictures of a planet outside the Earth’s solar system in a promotional video, causing its shares to drop by as much as 9%.
“We have taken the feature offline while we fix that. We are hoping to have that back online very shortly in the next couple of weeks, few weeks”, Hassabis said in Barcelona, adding that the tool was not “working the way we intended”.
Meanwhile, people claim to know exactly what’s been going on with Google’s Gemini AI image tool: according to an X/Twitter post, Google’s Gemini system seems to add phrases to a user’s image-generation prompt (the instruction, such as “make a painting of the founding fathers”) and inserting terms for racial and gender diversity, such as “South Asian” or “non-binary” into the prompt before it is sent to the image-generator model.
If this is correct, it means that the Gemini AI image tool is working perfectly well on the picture generating front – it’s just that it’s not your exact words it’s been fed. Does this happen with Google’s search engine as well?
.webp)
