Huawei executive gets candid about US sanctions and their effects

andreasc
-
0
Huawei executive gets candid about US sanctions and their effects
[ad_1]

Huawei has faced significant challenges over the past few years due to stringent US sanctions. Its smartphone sales have nosedived while the company also lost business in other tech industries. The beleaguered Chinese firm’s senior executive Richard Yu Chengdong recently got candid about the situation, sharing insights into the “incredibly difficult” days that Huawei endured.

Huawei executive discusses its fall and fight for survival after US sanctions

In May 2019, the US government placed Huawei on its Entity List, effectively blocking its access to all modern technologies originating from the US or developed using US-origin equipment over the next few years. The company could no longer do business with any American firm. It couldn’t use Qualcomm’s most advanced smartphone chipsets and Google Mobile Services (GMS) on its Android phones, among other things.

The sanctions have seen several reforms over the years, with the US government also allowing special export licenses to some companies. These licenses enabled Huawei to remain afloat in the smartphone industry, but only just. With no GMS and powerful 5G chipsets, it couldn’t compete in the global market. From selling over 240 million phones in 2019 to just 28 million in 2022, the Chinese firm experienced an unimaginable fall.

In a live-streamed interview with Chinese influencer Dong Yuhui earlier this week, Richard Yu Chengdong, Huawei’s chairman of the consumer business group, discussed the effects of the US sanctions. “My team wasn’t able to start operations,” the executive said. “As the global leader in 5G technology, we didn’t even have 5G [smartphones] ourselves. Our days were incredibly difficult,” the highly outspoken Yu added.

Known for his off-the-cuff comments that have earned him the nickname”Big Mouth Yu” on Chinese online platforms, Yu was a driving force behind Huawei’s success before the US sanctions started showing their effects. The firm overtook Samsung to become the world’s largest smartphone vendor in the second quarter of 2020. That was its peak moment in the pre-Entity List era. It is starting to grow again, but those heights are now a distant dream.

The US government is tightening its restrictions on the firm

After hitting rock bottom between 2020 and 2022, Huawei started emerging from the ashes in 2023. Backed by a robust domestic supply chain, it launched its first 5G phone in over three years. The firm hasn’t looked back since and is now on track to ship over 50 million smartphones in its home country this year. It is expected to emerge as the biggest smartphone vendor in mainland China with a market share of 19%.

Since Huawei is using home-grown technology, Chinese people are increasingly buying its products. “Huawei smartphones use domestically made chips instead of integrating Western chips, so our users are also making a contribution to the rise of China’s electronics supply chain,” Yu said during the interview. The company recently constructed a $15 billion R&D center to work on semiconductors, wireless networks, and IoT (Internet of Things).

In the meantime, the US government is tightening its restrictions on the Chinese firm. The Biden administration recently revoked eight special export licenses. Intel and Qualcomm are among the companies that have lost Huawei’s export licenses. This move may hinder the firm’s progress but if we look back at its path over the past three or four years, US trade restrictions may no longer affect Huawei as much as they did in the past.

Huawei might soon be back on the global scene, riding on a domestic supply chain. As they say, you cannot contain technology. The other company will figure it out sooner or later. Rumors say it will launch the world’s first tri-fold foldable smartphone. Time will tell whether this device will have a global launch.


[ad_2]
Source link

FIN7 Cybercrime Gang Evolves with Ransomware and Hacking Tools

andreasc
-
0
FIN7 Cybercrime Gang Evolves with Ransomware and Hacking Tools
[ad_1]

FIN7, a notorious cybercrime gang, is back with a new bag of tricks! Learn about FIN7’s evolving tactics, including ransomware and custom EDR bypass tools like AvNeutralizer. Discover how to fortify your defences against FIN7 with expert tips from Sentinel Labs’ research.

Russian hackers are shifting their tactics, now opting for paid tools instead of the custom tools they have traditionally been known for. This trend is evident in the activities of the Russian cybercrime gang FIN7, which has been targeting financial institutions and businesses worldwide for over a decade.

Notorious for its initial focus on point-of-sale (POS) system breaches, FIN7 has continuously evolved its tactics to maximize its gains. Sentinel Labs’ latest report analyzes the gang’s shift towards ransomware attacks, highlighting their preferred weapons and modus operandi.

According to researchers, FIN7 shifted its focus to ransomware operations in 2020, affiliating with RaaS groups like REvil and Conti and launching its own programs under Darkside and BlackMatter. They created fraudulent infosec firms like Combi Security and Bastion Secure to deceive security researchers. Despite setbacks, FIN7’s activities continue. 

Shedding light on FIN7‘s sophisticated toolbox, Sentinel Labs’ found one particularly concerning tool, AvNeutralizer, an EDR impairment tool designed to neutralize security software, rendering systems vulnerable to further attacks.

In November 2022, SentinelLabs reported a connection between FIN7 and the Black Basta group on using AvNeutralizer (AuKill) in ransomware attacks, which they are selling on underground forums now.

Other tools include Powertrash, a heavily obfuscated PowerShell script used by FIN7 to stealthily execute backdoor payloads in their malicious campaigns. Diceloader, aka Lizar or IceBot, is a backdoor that allows attackers to establish a C2 channel, controlling the system by sending position-independent code modules. Diceloader is typically deployed through Powertrash loaders in FIN7 operations.

A helper UI client, the “Remote System Client,” is used to interact with Diceloader C2 servers and control its victims whereas an SSH-based backdoor was found on a server attributed to FIN7, which exposed an open directory web server used as a staging server to serve payloads.

FIN7 uses multiple pseudonyms to hide its identity and sustain its underground criminal operations. Users “goodsoft”, “lefroggy”, and “killerAV” advertised their “PentestSoftware” for $6,500 monthly on the exploitin forum, “Stupor” advertised an AV killer targeting security solutions for $10,000 on the xssis forum. Based on evidence researchers claim that all these users belong to the FIN7 cluster, likely using multiple pseudonyms to maintain their illicit operations.

FIN7 Cybercrime Gang Evolves with Ransomware and Hacking Tools
FIN7 on Exploit Forum (Credit: Sentinel Labs)

Fin7 uses automated SQL injection attacks to exploit public-facing applications. They employ a multi-layered approach, including obfuscating their malware code, leveraging legitimate tools for malicious purposes, and exploiting vulnerabilities in popular software. This constant innovation makes it challenging for cybersecurity researchers to track FIN7’s activities and develop effective defences.

To protect against such threats, businesses should regularly update systems and software, implement a layered security approach, educate employees on cybersecurity best practices, and have a data backup and recovery plan.

  1. TeamViewer Confirms Security Breach by Russian Midnight Blizzard
  2. Russian Midnight Blizzard Hackers Breached Microsoft Source Code
  3. Russian APT28 Exploiting Windows Vulnerability with GooseEgg Tool
  4. Russian Hackers Hit Mail Servers in Europe for Political and Military Intel
  5. Russian Ministry Software Backdoored with North Korean KONNI Malware

[ad_2]
Source link

MacOS Users Beware Of Weaponized Meeting App From North Korean Hackers

andreasc
-
0
MacOS Users Beware Of Weaponized Meeting App From North Korean Hackers
[ad_1]

Meeting apps are often targeted and turned into weapons by hackers as they are largely employed for communication and collaboration, frequently carrying sensitive data and user groups that are wide. 

Such platforms gain trust among their users as of their pervasiveness as well as high level of acceptance, enabling the hackers to take advantage of such factors and spread malware, steal information, tap conversations, or even break into various organizations. 

Cybersecurity analysts (Patrick Wardle) at Objective-See discovered that North Korean hackers had been actively weaponizing a meeting app, Miro Talk, to target macOS users.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Besides this, the malwarehunterteam also tweeted about this new Mac malware.

Weaponized Meeting App

A malicious disk image (MiroTalk.dmg), undetected by VirusTotal’s AV engines, was analyzed to reveal its capabilities and North Korean (DPRK) attribution. 

The malware, likely part of a job-related phishing campaign, was hosted on a clone of the legitimate Miro Talk site. This tactic aligns with known DPRK hacker methods of targeting victims by posing as job hunters.

The analysis demonstrates how open-source tools like BlockBlock and LuLu can help counter such threats. 

The malware’s connection to a previously documented DPRK campaign by Palo Alto Network’s Unit42 suggests an evolving strategy in North Korean cyber operations.

The analysis result of MiroTalk.dmg file is an unsigned 64-bit Intel Mach-O executable named Jami, which was not detected by VirusTotal. 

The malicious disk image is currently undetected by any of the AV engines on VirusTotal (Source – Objective-See)
The application is not signed (Source – Objective-See)

Symbols and strings embedded inside suggest that it could be used for exfiltration, download, and execution with a possible C2 server at 95.164.17.24:1224. 

The malware may also target crypto-wallet browser extensions, browser data, and the macOS keychain.

It’s likely to be cross-platform (Qt/QMake), written in Python, and contains malicious Python scripts.

Methods of the executable like setBaseBrowserUrl directly reference sensitive browser paths that indicate complex data collection and exfiltration capabilities.

The Jami executable is malware that tries to access the user’s keychain and steal sensitive browser data to a C2 server (95.164.17.24:1224).

Application displays an UI (Source – Objective-See)

Although the initial attempts to exfiltrate failed, the malware API endpoints are similar to those of BeaverTail, which was previously linked with North Korean hackers.

This implies a shift from JavaScript-based threats to native QT variations that have similar targets like cryptocurrency wallets.

The DPRK-linked C2 server also hosts other payloads including client/5346 which is a Python downloader and InvisibleFerret, a cross-platform backdoor.

These findings link this new malware variant with the earlier campaign of BeaverTail indicating the continued maturity of DPRK cyber capabilities.

The analyzed malware, masquerading as MiroTalk, is a new native variant of BeaverTail.

This new variant is capable of stealing information and executing additional Python-based payloads like InvisibleFerret. 

This is evidence of DPRK cyber capability development, as shown by key IoCs like the MiroTalk.dmg file (SHA-256: 0F5F0A3AC843DF675168F82021C24180EA22F764F87F82F9F77FE8F0BA0B7132) C2 server (95.164.17.24).

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Samsung plans slimmer foldables, as thin as Galaxy S models

andreasc
-
0
Samsung plans slimmer foldables, as thin as Galaxy S models
[ad_1]

Samsung plans to make its foldables as thin as its Galaxy S flagship smartphones. TM Roh, the company’s head of mobile division, has reportedly tasked engineers with developing an ultra-thin foldable with a similar thickness as the Galaxy S24 series. It is already readying a 10mm Galaxy Z Fold 6 Ultra/Slim for later this year.

Samsung aims to make foldables as thin as other smartphones

At 12.1mm, Samsung’s new Galaxy Z Fold 6 is substantially thinner than the Fold 5 (13.4mm). It also weighs 14 grams less, down from 253 grams to 239 grams. However, it is still too thick in front of the competition. HONOR recently launched the Magic V3 with a thickness of just 9.2mm, making it the world’s slimmest foldable phone yet. When unfolded, the HONOR foldable is just 4.35mm thick, against Fold 6’s 5.6mm.

Other Chinese companies have also launched slimmer foldables than Samsung. The Korean firm plans to combat those with its Galaxy Z Fold 6 Slim/Ultra. As stated above, it’s expected to measure around 10mm when folded. The company might launch it only in China and its home country South Korea. For the rest of the world, the Fold 6 is its only big foldable this year. Those who prefer a clamshell foldable have the Galaxy Z Flip 6.

Samsung made the Galaxy Z Fold 6 Ultra/Slim slimmer by removing the S Pen digitizer from the display assembly. In other words, it dropped S Pen support. It also made the device wider to fit sizeable batteries and bigger displays. Rumors say the new foldable will feature better cameras too. However, its main USP is its slim profile. The lack of S Pen support is a bummer but Samsung had to make a compromise somewhere.

However, in the future, Samsung’s regular foldables might be as thin as the Chinese versions. According to the Korean media, the company is in talks with component suppliers to slim down everything, from the batteries and cameras to displays and the hinge. The ultimate goal is to reduce the thickness to Galaxy S levels. This year’s Galaxy S24 Ultra is 8.4mm thin, while the Galaxy S24 is 7.6mm and the Galaxy S24+ is 7.7mm thin.

Curated content for foldables, including optimized games

Samsung aims to make foldables mainstream. The foldable category accounted for only 1.6% of the global smartphone market last year, and 16% of the premium segment (priced $600 and higher). The goal is still too far and maybe achievable only with a slimmer design and curated content. Samsung is already working with game publishers to optimize existing games and develop customized games for the Fold and Flip screens. Hopefully, durability improvements are also on its agenda for future foldables.


[ad_2]
Source link

Spotify rolls out beta AI DJ in Spanish for Premium users

andreasc
-
0
Spotify rolls out beta AI DJ in Spanish for Premium users
[ad_1]

Spotify’s AI DJ feature has been available for almost a year in 50 markets across the world, but only in English – that’s set to change! Spotify Premium users around the globe are getting AI DJ in Spanish, the music streaming giant announced.

Launched in 2023, Spotify’s AI DJ is a feature that utilizes artificial intelligence to act like a DJ: it speaks to you between songs, spits out song and favorite artist facts, or evokes a fond memory while listening to a nostalgic track.

The goal is for Spotify users to ditch the habit of replaying the same 12 songs for years; instead, the DJ listeners hear commentary alongside personal music recommendations: thus, they’re more willing to try something new or listen to a song they may have otherwise skipped.

The impact of the Spanish language within music culture is undeniable—from the popularity of Latin artists on our platform to the power of music in breaking down language barriers. We have millions of Spanish-speaking listeners on Spotify, many of whom have been taking to social media to ask about DJ. In fact, over the last few months, we’ve seen an over 215% increase in social conversation around DJ in Spanish. Rolling out DJ in Spanish was a natural next step in the evolution of the product, and we’re excited for the world to meet Livi, the voice of DJ in Spanish.


–Spotify Newsroom, July 17, 2024

Who’s Livi?


To create the voice model for the DJ in Spanish, Spotify enlisted their own Senior Music Editor, Olivia “Livi” Quiroz Roa, a Spotify music editor based in Mexico City who has spent her entire career in the music industry.In her day job, Livi curates popular playlists on the platform.

After an extensive international casting call, Livi’s voice resonated the most with users.

How to get started with DJ in Spanish


The Spanish-speaking voice will be available for Premium listeners in markets where DJ is currently available. It is expanding to Premium users in Spain and across select markets in Latin America, including Argentina, Bolivia, Chile, Colombia, Costa Rica, Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Mexico, Nicaragua, Panama, Paraguay, Peru, Uruguay, and Venezuela. As long as you’re using Spotify Premium in a market where DJ is available, here’s how you can find it:
  • Head to the Search tab on Spotify.
  • Search “DJ.”
  • Press play and let your personalized DJ do the rest.
  • To switch languages, simply tap the three-dot menu within the DJ card and choose between English or Spanish.

The new commenting feature


This isn’t the only new feature from Spotify lately.

Less than two weeks ago, the streaming service rolled out Comments for podcasts and a revamped mobile app for podcasters. The new tools aim to deepen engagement between podcasters and listeners and the interactive features like Q&A and polls have seen significant engagement, with over 9 million users participating.


[ad_2]
Source link

MuddyWater Hackers Deploy Legitimate RMM With BugSleep Malware

andreasc
-
0
MuddyWater Hackers Deploy Legitimate RMM With BugSleep Malware
[ad_1]

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has escalated its phishing campaigns in Middle East countries, specifically Israel.

In their approach, they use already compromised email accounts to spread malicious content across various sectors.

Predawn churning of curd formed overnight using fresh cow milk. Made freshly in small batches.

Recent attacks have featured generic, English-language lures such as webinar invitations, which promote reuse on a wider scale.

Cybersecurity researchers at CheckPoint recently identified that MuddyWater hackers have been deploying legitimate RMM with BugSleep malware.

The BugSleep is a custom backdoor that uses legitimate Remote Management Tools (RMMs).

Their strategies are becoming more sophisticated with customized lures for certain industries and Malicious files hosted on legitimate file-sharing services like Egnyte that show how adaptable they can be while keeping their MuddyWater signatures intact.

MuddyWater new infection chain (Source – CheckPoint)

MuddyWater, a hacker group, is said to have been using Egnyte subdomains for cyber attacks involving phishing and aimed at various industries in different countries.

They have also introduced new BugSleep malware to replace certain legal uses of remote monitoring and management (RMM) tools.

Notable phishing campaigns (Source – CheckPoint)

BugSleep applies evasion techniques, encrypts communications, and can carry out multiple commands from its C&C server.

The malware has signs of ongoing development including different versions and some coding inconsistencies while using process injection for persistence, scheduled tasks, and attempts to evade EDR solutions.

Due to these implementation lapses, BugSleep poses a significant threat, especially for organizations based in Israel, Turkey, Saudi Arabia, India, and Portugal, which may have connections to operations conducted in Azerbaijan and Jordan.

Map of targeted countries (Source – CheckPoint)

The group’s enhanced phishing campaigns have been encouraged by the introduction of BugSleep.

Besides this, MuddyWater’s increased activity in the Middle East, especially in Israel, demonstrates their persistence and evolving tactics, researchers said.

Targeting diverse sectors like municipalities, airlines, and media, the group has simplified its lures, shifting from highly customized to generic themes in English. 

This alteration will enable broader regional impact rather than specific targeting with more attacks in volume, indicating their strategy adjustment.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Meta halts AI tools in this country because of “imminent risk of damage” to “fundamental rights”

andreasc
-
0
Meta halts AI tools in this country because of “imminent risk of damage” to “fundamental rights”
[ad_1]

Brazil and its 200-million population won’t be subjected to some of Meta’s AI tools, after the company decided to pause the use of such generative AI tools there. That’s in response to a government’s objection to Meta’s privacy policy regarding personal data and AI.

In June, Meta held an event in São Paulo to launch its first AI-driven ad targeting program for businesses on WhatsApp. With a population exceeding 200 million, Brazil is a key market for Meta. For example, the country is the second-largest user base for WhatsApp, Meta’s popular messaging service, after India.

Earlier this month, Brazil’s National Data Protection Authority (ANPD) suspended Meta’s new privacy policy for using personal data to train generative AI systems. ANPD ruled that Meta must amend its privacy policy to exclude the processing of personal data for generative AI training.

This decision follows ANPD’s immediate suspension of Meta’s new privacy policy, announced two weeks prior. The suspension, published in Brazil’s official gazette on Tuesday, halts the processing of personal data across all Meta products, affecting even non-users of Meta’s platforms.

ANPD warned of a daily fine of 50,000 reais (approximately $8,836) for non-compliance, citing “imminent risk of serious and irreparable or difficult-to-repair damage to the fundamental rights of affected holders”.

Meta expressed disappointment in ANPD’s decision, calling it a “setback for innovation” that will delay the benefits of AI for Brazilians. Meta is required to revise its privacy policy and officially confirm the suspension of personal data processing for AI training.

In a statement, Meta said it is suspending its AI tools while negotiating with ANPD to resolve concerns about generative AI.


[ad_2]
Source link

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

andreasc
-
0
New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites
[ad_1]

HTTP Request Smuggling is a flaw in web security that is derived from variations in the way different web servers or intermediaries, such as load balancers and proxies handle HTTP request sequences.

By creating malicious HTTP requests that exploit these inconsistencies, an attacker can control the order in which requests are processed, possibly resulting in unauthorized access, circumvention of security controls, session hijacking, or injection of malicious content into responses meant for other users.

This flaw is based on differences in the interpretation of start and end points for HTTP requests, which helps the server process them incorrectly.

Cybersecurity researchers at BugCrowd recently in a collaborative effort by Paolo Arnolfo (@sw33tLie), a hacking enthusiast passionate about server-side vulnerabilities, Guillermo Gregorio (@bsysop), a dad superhero and skilled hacker, and █████ (@_medusa_1_), a stealthy genius unveiled key insights about HTTP Request Smuggling.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

New TE.0 HTTP Request Smuggling

While cloud hosting offers security benefits, unknown HTTP Request Smuggling vectors can still pose significant threats. 

A recent discovery affected thousands of Google Cloud-hosted websites using their Load Balancer, compromising various services, including Identity-Aware Proxy. 

Researchers employ differential testing tools like http-garden for local servers and “spray-and-pray” techniques on bug bounty programs for cloud infrastructures to uncover such vulnerabilities. 

Tools like bbscope can generate extensive target lists for vulnerability research, highlighting that HTTP Request Smuggling remains a widespread and under-researched security issue.

TE.0, a new HTTP request smuggling variant, was discovered to be affecting Google Cloud’s Load Balancer.

The technique, which is similar to the CL.0 variant but uses Transfer-Encoding, enabled mass 0-click account takeovers on susceptible systems.

Attack flow (Source – BugCrowd)

It affected thousands of targets, including those protected by Google’s Identity-Aware Proxy (IAP), and it was widespread among Google Cloud-hosted websites that were set to default HTTP/1.1 rather than HTTP/2.

This discovery shows how HTTP Request Smuggling techniques keep evolving and why constant security research is crucial in cloud infrastructures.

TE.0 HTTP Request Smuggling vulnerability affected Google’s Load Balancer and compromised Google Identity-Aware Proxy (IAP), a key feature of Google Cloud’s Zero Trust security.

This flaw made it possible to bypass the strict authentication and authorization measures of IAP consequently violating its principle “never trust, always verify.”

The flaw allowed site-wide redirects as well as malicious use of application-specific widgets which could have led to severe security breaches.

All TE.0 attacks were able to evade IAP protection though not all had serious consequences.

Google admitted this after initial reporting challenges, demonstrating that fixing loopholes in cloud infrastructure is a complex problem.

Here below we have mentioned the disclosure timeline:-

Disclosure timeline (Source – BugCrowd)

Google Cloud’s infrastructure was discovered to have a significant vulnerability due to persistent attempts to hack through the web application by using HTTP request smuggling techniques.

Research motivated by curiosity which resulted in a big check and a lesson that cyber security highlighted the value of creative thinking.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

TikTok’s appeal to not be considered ‘gatekeeper’ by the EU gets dismissed

andreasc
-
0
TikTok’s appeal to not be considered ‘gatekeeper’ by the EU gets dismissed
[ad_1]

In an attempt to make the internet space more competition-friendly, the EU with the DMA (Digital Markets Act) has established a so-called “gatekeepers” list, and TikTok is one of the companies included in it.

Being listed as a gatekeeper requires you to meet a series of requirements to ensure the space is competition-friendly. TikTok’s parent company, ByteDance, has appealed the inclusion of TikTok in the list. But now, this appeal has been dismissed.

Examples of requirements that ‘gatekeeper’ services need to meet under the DMA are, for example, messaging services to support interoperability with other messaging services. Or, OS developers to let users choose which apps to pre-install, and not to favor their own services and apps over those of third parties.

To be considered a ‘gatekeeper’, the service needs to have a specific number of users, market capitalization, and to be influential among people.

TikTok was one of the first services listed as a ‘gatekeeper’, and ByteDance appealed. However, the General Court of the EU has now ruled that the company meets the conditions for a gatekeeper.

TikTok was arguing that appointing gatekeepers was to protect emerging services from dominant companies but TikTok didn’t have a comparable position to others in the gatekeepers list. The list also includes giants such as Amazon, Alphabet, Apple, ByteDance, Meta, and Microsoft.

The rules from the DMA indicate that services with more than 45 million monthly users and a capitalization of more than 75 billion euros in the EU are to be considered gatekeepers. TikTok meets these conditions, and it also has an influence on people.

ByteDance can still try to defend itself despite its appeal being dismissed. To do so, the company needs to take the case to the Court of Justice of the European Union (CJEU). This will be the last chance for the company to evade the gatekeeper list.

Izzy, a tech enthusiast and a key part of the PhoneArena team, specializes in delivering the latest mobile tech news and finding the best tech deals. Her interests extend to cybersecurity, phone design innovations, and camera capabilities. Outside her professional life, Izzy, a literature master’s degree holder, enjoys reading, painting, and learning languages. She’s also a personal growth advocate, believing in the power of experience and gratitude. Whether it’s walking her Chihuahua or singing her heart out, Izzy embraces life with passion and curiosity.


[ad_2]
Source link
1...474849...1,476Page 48 of 1,476