In a recent turn of events, Ledger, a prominent hardware wallet provider, faced a security breach that sent shockwaves through the cryptocurrency community.
The breach, initiated by a malevolent version of the npm package @ledgerhq/connect-kit, posed a severe risk to users’ digital assets.
Security research firm SlowMist Team sounded the alarm, unveiling a covert threat within the @ledgerhq/connect-kit package on the npm repository.
Ledger
This malicious package harbored a concealed backdoor capable of pilfering users’ private keys—a potential catastrophe for those invested in the volatile world of cryptocurrency.
Ledger’s Confirmation and Swift Action
Acknowledging the breach on its official Twitter account, Ledger promptly confirmed the security lapse.
The company swiftly released a fix for the vulnerability, urging users to update to the latest @ledgerhq/connect-kit package version.
Ledger NPM Repo Hacked
As an additional precaution, Ledger emphasized the paramount importance of safeguarding one’s 24-word recovery phrase.
The Ongoing Investigation
The scope of the breach remains shrouded in uncertainty.
Ledger Team continues its meticulous investigation, aiming to unveil the extent of user impact and quantify potential financial losses.
The aftermath of this breach underscores the inherent risks associated with the burgeoning realm of cryptocurrency.
Renowned for its hardware wallets, Ledger stands as a stalwart in cryptocurrency security.
These hardware devices store private keys in fortified environments, making them a favored choice among users.
The npm repository, a repository of JavaScript code packages, plays a pivotal role in the cryptocurrency ecosystem.
Developers rely on it to discover and install essential code packages.
The compromise of the @ledgerhq/connect-kit package exposes a vulnerability in this otherwise indispensable resource for developers in the cryptocurrency space.
Amid the chaos, the question lingers: How did the attacker infiltrate the npm repository? The possibility of a spear phishing attack emerges—a targeted ploy where the attacker masquerades as a legitimate entity, often leading the victim to divulge sensitive information.
The intricacies of this attack method raise concerns about the broader security landscape.
In the aftermath of the breach, Ledger is taking decisive steps to fortify its security measures.
Collaborating with npm, the company aims to enhance the security infrastructure of the npm repository.
Additionally, users are reminded to exercise caution and adhere to best practices, such as refraining from sharing their 24-word recovery phrases.
The Nubia Z60 Ultra puzzle is slowly coming together. Nubia confirmed that the phone will launch on December 19 quite recently, while we also got various other details about the phone. The latest official piece of info confirms that the Nubia Z60 Ultra will feature a large silicon-carbon battery.
The Nubia Z60 Ultra will include a large silicon-carbon battery pack
The phone will ship with a 6,000mAh unit. Considering that this is a silicon-carbon battery, it has a higher energy density. That basically makes it possible for Nubia to use a high battery capacity in a smaller footprint. This is actually something similar to what HONOR did earlier this year.
This smartphone will be the most powerful one Nubia announced to date. The company already showed us its design, while the company also shared some camera samples with the world.
An under-display camera will also be used here
Unlike most other devices out there, this one will feature an under-display camera. That will provide you with a clear canvas up front, and very thin bezels too. The phone will be boxy, with flat sides.
Its power/lock key will be red-colored, which is something we’re used to seeing from Nubia. Its camera setup on the back will look odd, and different. Each of the three camera sensors will have a different design, as you can see below.
The phone is coming in three colors
The Nubia Z60 Ultra will arrive in Black, Cream, and Starry Night colors, and will be quite powerful. The device will be fueled by the Snapdragon 8 Gen 3 SoC, and it will support 80W wired charging. We’re not sure about wireless charging just yet.
It will also be IP68 certified for water and dust resistance. A 50-megapixel main camera will be included, in addition to a 50-megapixel ultrawide camera, and a 64-megapixel periscope telephoto camera.
Everything will be revealed next week, when the phone is set to launch in its homeland. We’re not sure if this handset will be launched globally or not.
Vivo has brought its Vivo X100 series to global markets. The Vivo X100 and Vivo X100 Pro launched globally, and these are the most powerful smartphones the company launched to date. Both of these phones were originally launched in China, back in November.
The Vivo X100 series phones make their global debut
There is a big focus on the cameras here, as expected. The Vivo X100 is inferior to its ‘Pro’ sibling, but the two phones do have a lot in common, including their designs. Both devices have a huge camera oreo on the back, with ZEISS optics.
Both smartphones have very thin bezels around the screen, and a centered display camera hole. They both also include curved displays, in case you were wondering.
As already mentioned, the two devices do have a lot in common. Their specs are the same, save for RAM + storage configurations, camera setups, battery capacities, and charging.
Both devices include compelling 120Hz displays with high PWM dimming
Both smartphones feature a 6.78-inch 1.5K curved displays. These are LTPO AMOLED panels with a 120Hz refresh rate, and they can get really bright at 3,000 nits at their peak. A 2,160 PWM dimming is also a part of the package.
The MediaTek Dimensity 9300 SoC fuels both of these smartphones. The Vivo X100 comes with 12GB of RAM and 256GB of storage, and 16GB of RAM and 512GB of storage models. On the other hand, the Vivo X100 Pro is available with 16GB of RAM and 512GB of storage only.
The Vivo X100 Pro has a larger battery, and supports fast wireless charging
The Vivo X100 features a 5,000mAh battery with 120W charging. The ‘Pro’ model, on the flip side, has a 5,400mAh battery, and supports 100W charging. 50W wireless charging is supported on the ‘Pro’ model only, and the same goes for reverse wireless charging.
There is an under-display fingerprint scanner included on both phones, and the same goes for an IR blaster. You’ll find stereo speakers on these phones too. They’re both also IP68 certified for water and dust resistance.
Android 14 comes pre-installed on both devices, with Funtouch OS 14. There are also two SIM card slots included in both smartphones. Bluetooth 5.4 is supported too, as is Wi-Fi 7. Both smartphones include a 32-megapixel selfie camera (f/2.0 aperture).
Both phones have compelling cameras, but the ‘Pro’ model does have the edge in this regard
The Vivo X100 includes a 50-megapixel main camera (Sony’s IMX920 sensor, VCS bionic, f/1.57 aperture, OIS), a 50-megapixel ultrawide camera (150-degree FoV, f/2.0 aperture), and a 64-megapixel telephoto camera (f/2.57 aperture, OIS, up to 100x digital zoom, telephoto macro).
The Vivo X100 Pro, on the flip side, has a 50-megapixel main camera (Sony’s IMX989 sensor, VCS bionic, f/1.75 aperture, OIS), a 50-megapixel ultrawide camera (150-degree FoV, f/2.0 aperture), and a 50-megapixel telephoto camera (f/2.5 aperture, 1/2-inch sensor, OIS, up to 100x digital zoom, telephoto macro). There is also a V3 imaging chip included in both phones, and ZEISS optics.
The Vivo X100 Pro is a bit thicker, while we still don’t know the pricing
They have basically the same dimensions, though the ‘Pro’ model is a bit thicker. The price tags will vary from one market to the next, and we still don’t know the details. Both phones come in Asteroid Black and Startrail Blue color options. Both are pictured below.
Augmented Reality (AR) places computer generated-images over a real-world view. For example, on Apple Maps you can use AR to get walking directions that are placed over a live shot from a rear camera showing you which way to go. This feature is only available in certain cities and is similar to Live View on Google Maps. Supported devices include the iPhone SE 2 and SE 3, the 2018 iPhone XR, iPhone XS, iPhone XS Max and later models.
Apple is asking for your help to improve the accuracy of its AR features in Apple Maps
Since part of this feature requires your iPhone to figure out your current location, Apple does collect certain data from your phone to improve the accuracy of the AR location data on your handset. In a new support document titled “Help improve Augmented Reality Location Accuracy in Maps,” Apple writes, “To help improve the speed and accuracy of augmented reality features in Maps, you can share data with Apple about your surroundings when you use these features. No photos are shared and Apple collects only the data that we need to make these experiences better.”
Make sure the toggle found in the red box is turned on if you want to improve the accuracy of AR features in Apple Maps
When raising your iPhone while using AR in Apple Maps for immersive walking directions or to refine your current location, your handset scans your surroundings and detects “feature points” from buildings. These “feature points” use the physical appearance and shapes of buildings and other stationary objects to create data that a person cannot read. Instead, using on-device machine learning, this data is compared to Apple Maps reference data sent to your phone to enable the AR features in Apple Maps.
When you raise your iPhone in the air to perform the scan, things that move like people and vehicles are filtered out leaving feature points for stationary objects. If these feature points move in a way that doesn’t coincide with the movement of your camera, the iPhone assumes that whatever data it collected is not for a stationary object and discards that information.
When you raise your iPhone and it is collecting the “feature points” of stationary items, it compares this information to Apple Maps’ reference data to find your exact location on a map to help you obtain AR walking directions and also refines your location. For this to work, the reference data in Apple Maps that images from your rear camera are compared with need to be updated consistently and this is where you come in.
As Apple explains, “When you agree to share the feature points that your iPhone camera detects with Apple, you help refresh this reference data to improve the speed and accuracy of these augmented reality features.” Apple collects this data by encrypting it while you are on the move, and stores it encrypted when you stop. This data is not associated with you or your Apple ID. As your iPhone scans, it shares only feature points. No photos are sent to Apple.
Apple claims that “Only an extremely sophisticated attacker with access to Apple’s encoding system” would be a problem
Now read this part carefully. Apple claims that “Only an extremely sophisticated attacker with access to Apple’s encoding system would be able to attempt to recreate an image from the feature points. Since the feature point data that you share is encrypted when it leaves your device and only Apple has access to the data collections, such an attack and recreation are extremely unlikely. The additional noise further prevents any attempt to use the feature point data to recreate an image in which people or vehicles may be identified.”
Immersive AR walking directions on Apple Maps
If this doesn’t resolve your worries about the security of this process, you can make sure that you are not sharing data to improve the AR location accuracy of Apple Maps by going to Settings > Privacy & Security > Analytics & Improvements; make sure that Improve AR Location Accuracy feature remains toggled off.
On the other hand, while the setting is off by default, if you feel that the data you are providing Apple with is secure and not connected to you at all, you can improve the accuracy of immersive AR walking directions and the refine location features by turning the toggle on. It is up to you.
As previously noted, if you enable the collection of the physical characteristics of the buildings and other stationary items around you, your Apple ID is not attached to the data and no photos are used. The bottom line is that if you use AR walking or refine your location using AR on Apple Maps, you might be helping yourself by helping Apple.
We already know that the ASUS ROG Phone 8 series will launch in China on January 16. The global launch is not far away either, almost certainly. That being said, a major ASUS ROG Phone 8 series leak just shared a ton of info.
The ASUS ROG Phone 8 series images, specs & accessories shown in a major leak
Not only do we get to see the design of both devices, thanks to a bunch of images, but their specs also got shared. On top of that, some accessories that will be at your disposal are also shown here. Let’s kick things off with the design of these two devices.
It seems like ASUS is changing things up this year. Instead of truly flashy design choices, the company decided to tone things down. The ASUS ROG Phone 8 and ROG Phone 8 Pro look much more like regular smartphones.
ASUS is changing things up design-wise
If you check out the images provided in the gallery below, you’ll see that the company is using a squarish design. The corners are rounded a bit, but the sides are flat, for the most part. A very noticeable ROG logo is placed on the back of both phones. That logo also doubles as RGB lighting.
The two devices do look basically the same, as you can see. The camera island is placed in the top-left corner of the back, which goes for both devices. Three cameras sit inside it, and the camera island itself is not particularly large. It does have an interesting shape, though.
A centered display camera hole is used on the displays of both devices. The bezels seem to be thinner than on current-gen models, and the displays are… of course, flat.
Windows Report also shared a bunch of specs for us to check out. Both smartphones will be fueled by the Snapdragon 8 Gen 3 SoC, as expected. Android 14 will come pre-installed, with ROG UI on top of it.
The ‘Pro’ model will offer up to 24GB of RAM
Both devices will also be IP68 certified for water and dust resistance. The ASUS ROG Phone 8 will offer 12GB of RAM, and 256GB of storage. The ‘Pro’ model will be on offer in 16GB and 24GB RAM options, with 512GB and 1TB of storage. Do note that LPDDR5X RAM and UFS 4.0 storage will be used in all models.
You’ll find a 6.78-inch Flexible AMOLED display from Samsung on both phones. Those displays will be protected by the Gorilla Glass Victus 2. The source notes that the ‘Pro’ model will utilize a 120Hz LTPO panel, with refresh rates up to 165Hz. The regular variant will probably peak at 120Hz, and chances are that is an LTPS display.
A 5-magnet speaker system will be utilized by both phones, and the same goes for an audio jack. Dirac Virtuo for Headphone is also mentioned, as is Hi-Res Audio. Bluetooth 5.3 will be on offer, as will a 5,500mAh battery. Quick Charge 5.0 will be supported, and so will PD charging.
The source also shared the camera setup of the ‘Pro’ model
The camera setup of the ‘Pro’ model is mentioned, but the same cannot be said for the vanilla phone. The ASUS ROG Phone 8 Pro will feature a 50-megapixel main camera (Sony’s IMX890 sensor). A 13-megapixel ultrawide camera will also be on offer, as will a 32-megapixel telephoto camera (3x optical zoom). You’ll also find a 32-megapixel selfie camera here.
A ‘Rebel Gray’ color is mentioned, while the ASUS ROG Phone 8 Pro will measure 163.8 x 76.8 x 8.9mm, and weigh 225 grams. Such info is not available for the regular model, but chances are the numbers will be similar.
Some interesting accessories are also coming
Last, but not least, Windows Report mentioned and showed three accessories. One of them is the DEVILCASE Guardian, a phone case with the AeroActive Cooler X. The other is the AeroActive Cooler X itself, and the third one is a classic TPU case with an antibacterial screen protector. You can check out all three of them in the gallery below.
When you’re using the DEVILCASE Guardian case, you can attach a transparent backplate to see the RGB lighting. The AeroActive Cooler X is very similar to last year’s model. You can attach it via the side USB-C port, when not attached to the case. It also serves as a stand for the device.
“Oh, no, not AI-related news again!” Well, it is what it is, as the wise man once said.
Spotify is in the testing stage of a brand new feature that would allow users to build new playlists with the help of short, ChatGPT-like prompts. For example: “Fill the silence with background cafe music”, or “Get pumped up with fun, upbeat, positive songs”, or you could command Spotify to scramble a new playlist that’s more specific with “Explore a niche genre like Witch House”.
The AI feature is not yet rolled out to all to try; TechCrunch reports on it and while Spotify did confirm that they’re testing it, they didn’t share any further information about the technology and how it works, nor did it commit to a launch time frame.
There’s a TikTok video (by @robdad_) and albeit a short one – all in all, 11 seconds – it gives us a peek at what Spotify + AI could look like if this feature becomes available in the near future. On a side note: this could very well be limited to paid users, so don’t act surprised if you don’t get it on a free account.
What does it look like and what can it do?
“I just randomly discovered Spotify’s ChatGPT?”, says the video caption of the aforementioned TikTok. There’s a short preview in there, too – for the moment, the AI playlists feature is accessed from the “Your Library” tab in Spotify’s app by tapping on the plus (+) button at the top right of the screen. Here, a pop-up menu appears and the AI playlist feature is a new option underneath the existing “Playlist” and “Blend” options.The feature’s description reads “Turn your ideas into playlists using AI” and notes that it’s currently only available in English.
What happens next will be very familiar to those who have used ChatGPT: a new chat-like window opens, waiting for your prompts and commands. There’s a list of suggested prompts, but users could ignore the menu and just type what they want to be mixed especially for them.
Next, there’s a “Processing your request…” message from Spotify’s AI and then the playlist itself is ready and you’re taken to a new screen where you can swipe left to remove any songs you don’t want to refine the playlist further.
YouTube Music also went AI, just not music-related
At the end of October 2023, YouTube Music rolled out a new AI playlist art generator feature. This experimental feature (for English language US users on YouTube Music) creates customized playlist art using generative AI.
Images of AI-generated pugs and turtles are nice, but maybe it’s time for YouTube Music to step up and catch up with Spotify…
The two foldable handsets we’ll compare here have been on the market for quite some time. They come from Google and Xiaomi, and both of them are book-style foldables. In this article, we’ll compare the Google Pixel Fold vs Xiaomi MIX Fold 3. The Pixel Fold arrived back in May, while the Xiaomi MIX Fold 3 has been on the market since August. Now, this comparison should be quite interesting.
Both of these phones are book-style foldables, but they’re quite different. They have considerably different aspect ratios, and thus offer different experiences, more on that soon. We’ll first list their specifications, and will then move to compare their designs, displays, performance, battery life, cameras, and audio output. Also, do note that that the Xiaomi MIX Fold 3 is exclusive to China. Let’s get to it, shall we?
Specs
Google Pixel Fold & Xiaomi MIX Fold 3, respectively
Both of these phones are made out of metal and glass, though the Xiaomi MIX Fold 3 also comes in an aramid fiber variant. The Google Pixel Fold is short and wide, while the Xiaomi MIX Fold 3 is tall and narrow. As I said, they have different display aspect ratios, and different orientations because of it. The Pixel Fold has more of a landscape format display when unfolded, while the Xiaomi MIX Fold 3’s is more of a vertical panel.
The Google Pixel Fold is considerably shorter, considerably wider, and also noticeably thicker than the Xiaomi MIX Fold 3. That goes for both when it’s folded and unfolded. You’ll also notice the difference in weight between the two phones, the Pixel Fold weighs 283 grams, while the Xiaomi MIX Fold 3 weighs 255 or 259 grams, depending on the model. They also look different, actually.
The Google Pixel Fold has a centered display camera hole on the main display, and a recognizable camera visor on the back. It also has curved corners, while the Xiaomi MIX Fold 3 is rather boxy. The Xiaomi MIX Fold 3 also has a centered display camera on the cover display, and a landscape-oriented camera module on the back. The thickness of this phone’s backplate gradually increases to meet the camera module.
They feel entirely different in the hand, by the way, which is not surprising considering all those differences. The Pixel Fold also comes with an IPX8 rating for water resistance, while the Xiaomi MIX Fold 3 doesn’t offer anything like that.
Google Pixel Fold vs Xiaomi MIX Fold 3: Display
Both of these devices have rather compelling displays included. The Google Pixel Fold has a 7.6-inch main panel with a resolution of 1840 x 2208. That is a foldable OLED panel with a 120Hz refresh rate. It supports HDR10+ content, and has a peak brightness of 1,450 nits. The cover panel measures 5.8 inches, and it’s a 2092 x 1080 OLED display. This display is protected by the Gorilla Glass Victus. It supports HDR content, and has a peak brightness of 1,550 nits.
The Xiaomi MIX Fold 3, on the flip side, includes an 8.03-inch main display. That’s an LTPO OLED+ panel with a resolution of 1916 x 2160. It supports up to 1 billion colors, and has a 120Hz refresh rate. HDR10+ is also supported, as is Dolby Vision. The peak brightness here is 1,300 nits. The cover display measures 6.56 inches, and it has a resolution of 2520 x 1080. This is an AMOLED panel with a 120Hz refresh rate, and it supports HDR10+ content. Dolby Vision is also supported. This panel is protected by the Gorilla Glass Victus 2, and it has a peak brightness of 2,600 nits.
All four displays mentioned here are up to the task. Granted, there are better panels out there on foldables, in some ways, but these are excellent, actually. All of them are vivid, have good viewing angles, and are more than sharp enough. High refresh rates are also where they should be, and so on. The only complaint that you may have is the brightness, even though all four panels are more than bright enough. They’re not as bright as the OnePlus Open displays, for example, but still, chances are you won’t have any complaints. The touch response is also very good on all of them. Just note that the Pixel Fold crease is more noticeable than the one on the Xiaomi MIX Fold 3.
Google Pixel Fold vs Xiaomi MIX Fold 3: Performance
The Google Tensor G2 SoC fuels Google’s first-ever foldable, the Pixel Fold. That is no longer the latest and greatest chip from the company, but it was at the time. The Xiaomi MIX Fold 3, on the other hand, is fueled by the Snapdragon 8 Gen 2 SoC. Qualcomm has a new flagship chip now, but the Snapdragon 8 Gen 2 is plenty powerful still. It’s worth noting that the Pixel Fold has LPDDR5 RAM and UFS 3.1 flash storage, while the Xiaomi MIX Fold 3 includes LPDDR5X RAM and UFS 4.0 flash storage.
Based on the performance-related specs alone, the Xiaomi MIX Fold 3 does have the edge. And yes, the phone does open apps a bit faster and all that, but both smartphones are plenty fast in general usage. Neither is laggy or anything of the sort. The Xiaomi MIX Fold 3 is more future-proof, though, at least from the spec side of things. As far as gaming is concerned, they both do a good job. High-end games do fit the Xiaomi MIX Fold 3 more, though, and it will perform a bit better in such conditions. The Pixel Fold can hold its own, though, even though the Tensor SoC is not made for gaming. Google’s foldable also gets a bit warmer in such scenarios.
Google Pixel Fold vs Xiaomi MIX Fold 3: Battery
The Google Pixel Fold has a 4,821mAh battery on the inside, while Xiaomi’s handset includes a 4,800mAh battery. Do note that the Pixel Fold has smaller displays, both of them, and yet a bigger battery pack. Does that result in better battery life? Well, no, not really, at least that was the case for us. The Google Tensor G2 inside the Pixel Fold is less power efficient than the Snapdragon 8 Gen 2, and that balances things out, kind of.
Getting to over 7 hours of screen-on-time on both of these phones is possible, without a problem. Of course, if you push them too hard, you will hurt battery life. Also, your mileage may vary, of course. You will use a different set of apps, in a different location, in different ways, and so on. Do note that gaming does affect battery life quite a bit, so if you’re a gamer, these numbers likely won’t be the case for you.
What about charging? Well, that’s a clear win for the Xiaomi MIX Fold 3. That device not only supports 67W wired and 50W wireless charging, but it also comes with a charger included in the box. The Google Pixel Fold, on the other hand, supports 21W wired, and 7.5W wireless charging. It does not include a charger in the box, though. Yes, the Xiaomi MIX Fold 3 will charge considerably faster overall. Even wireless charging on the Xiaomi MIX Fold 3 is faster than wired charging on the Pixel Fold, and it’s not even close.
Google Pixel Fold vs Xiaomi MIX Fold 3: Cameras
The Google Pixel Fold includes a 48-megapixel main camera, a 10.8-megapixel ultrawide unit (121-degree FoV), and a 10.8-megapixel telephoto camera (5x optical zoom). The Xiaomi MIX Fold 3, on the other hand, has a 50-megapixel main camera. In addition to that, a 12-megapixel ultrawide unit (120-degree FoV) is included, and a 10-megapixel telephoto camera (5x optical zoom). It’s also worth noting that the Xiaomi MIX Fold 3 has Leica lenses on the back.
The pictures these two smartphones provide are different, but both devices do a good job. The Pixel Fold prefers that contrasty look we’re used to, while the Xiaomi MIX Fold 3 images do look a bit more realistic, but they’re also quite vivid. Well, if you switch to Leica Authentic mode you’ll get that more muted tone with vignetting on the sides. The details that both main cameras provide are great, and both handle HDR situations really well. They even do a great job in low light. The Pixel Fold does tend to brighten up low light scenes a bit more, though.
Their ultrawide and telephoto cameras are good, and do keep a good balance when it comes to colors with the main cameras. However, the step down in quality is noticeable. Also, we did prefer ultrawide and telephoto shots from the Pixel Fold more often than not. Those are not large sensors on either phone, and Google’s camera processing did come into play quite a bit here.
Audio
Both of these smartphones include stereo speakers. Both sets of speakers are very good, though the Xiaomi MIX Fold 3’s speakers are a bit louder. The speakers on both sides are well-balanced, and the sound coming from them is rich enough.
What you will not notice on either of these two phones is a 3.5mm headphone jack. If you’d like to use your wired set of headphones, you’ll need to use a dongle. There is always the option of using the Type-C port, of course. In regards to wireless audio, the Google Pixel Fold offers Bluetooth 5.2, while the Xiaomi MIX Fold 3 supports Bluetooth 5.3.
According to cybersecurity researchers at FortiGuard Labs, the Russian intelligence-linked APT29 group exploited a critical TeamCity vulnerability, which had initially been patched in September 2023.
Polish Military Counterintelligence Service (SKW) has released an advisory revealing that Russian Foreign Intelligence Service (SVR) affiliated threat actors are utilizing JetBrains CVE in global targeting.
Here, it is worth noting that TeamCity and JetBrains are closely linked, with TeamCity being a continuous integration (CI) server developed and maintained by JetBrains.
As reported by Hackread.com, the vulnerability, which scored 9.8 by CVSS, was patched in September 2023. However, authorities particularly identified the notorious advanced persistent threat group called APT29, aka the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard, to be exploiting CVE-2023-42793.
The threat actor used Scheduled Tasks to execute GraphicalProton payloads, using rundll32 proxy execution as a defence evasion method. They also used legitimate third-party binaries vulnerable to search order hijacking.
“If compromised, access to a TeamCity server would provide malicious actors with access to that software developer’s source code, signing certificates, and the ability to subvert software compilation and deployment processes—access a malicious actor could further use to conduct supply chain operations” the advisory read.
SKW’s findings are supported by the FortiGuard Labs team of researchers. In their latest blog post, FortiGuard reports that APT29 has targeted a US-based biomedical manufacturing organization (the name of which has not been shared with the media or public) and revealed the threat actor’s TTPs. The report discusses the intrusion of this vulnerability found in TeamCity, a Windows server, by APT29.
Researchers noted that on 6 September 2023, Sonar’s cybersecurity experts discovered a critical TeamCity On-Premises vulnerability (tracked as CVE-2023-42793). This vulnerability was assigned a CVSS score of 9.8 due to its ability to be deployed without authentication. CISA added it to its ‘Known Exploited Vulnerabilities Catalog’ on October 4, 2023.
The FortiGuard Incident Response team reports that in October 2023, a US-based biomedical manufacturing organization was compromised due to this vulnerability exploited by APT29. The attack was initially exploited using a custom-built Python script, matching the GraphicalProton malware used by APT29.
Analysis of application and system logs revealed evidence of successful exploitation, but some threat actors were unsuccessful at running Linux system commands on the victim Windows Server. APT29 likely employed Nuclei to identify potential victims and began executing additional discovery commands to gather system and privilege information.
The US-based tertiary education organization was targeted by APT29 with a C2 IP address discovered by the FortiGuard IR team. They discovered the organization’s infrastructure was compromised and identified an exploitation of their vulnerable TeamCity server.
The threat actor used the TeamCity exploit to install an SSH certificate, which they used to maintain access to another victim’s environment. The actor downloaded a DLL file, ‘AclNumsInvertHost.dll,’ on the TeamCity host and used the TeamCity RCE vulnerability to create a Windows-scheduled task referencing the DLL file for persistence.
The screenshot shows the attack timeline of TeamCity intrusion (Credit: Fortinet Labs)
Despite a patch, the attacker persisted on the compromised host, leveraging their GraphicalProton implant. FortiGuard believes this attack was part of a new APT29 campaign. Significant OPSEC considerations included compromised infrastructure, search order hijacking with legitimate DLLs added, quality of masquerading, and single-use infrastructure components.
Researchers recommend containment and eradication actions, including blocking IP addresses, removing TeamCity software accounts, removing Windows accounts, removing backdoors, and removing malicious files dropped by threat actors to stay protected against threats like GraphicalProton.
MSI today has announced the latest iteration of the Prestige 16 AI, an AI-driven laptop that promises intelligent computing no matter the task. At the heart of this new AI PC is Intel’s Core Ultra 9 CPU and the chip’s Neural Processing Unit. This single core on the chip is dedicated to enhancing the CPU and GPU experience while also helping to make the laptop more power-efficient.
Power efficiency is also helped by the Intel Core Ultra 9 CPU’s method of splitting up tasks. Which has mundane processes handled by the E-Cores (efficiency cores) and Low-Power E-Cores. In doing this the P-Cores (performance cores) can focus on handling high-performance tasks like gaming and content creation. MSI takes this a step further by implementing what it calls its MSI AI Engine. Using the power of the CPU, this AI software that MSI has created will adjust the settings of the hardware based on the task.
Tasks can fall into different categories including Intelligent Gaming, Intelligent Work, Intelligent Meeting, and Intelligent Entertainment. Think about when you boot up a game. Typically you’d want to ensure cooling and performance hardware are ramped up and ready to provide an optimal experience. MSI AI Engine will seemingly handle gaming by adjusting hardware settings like ramping up fan speed for better cooling and diverting more computing and graphics processing power to the gaming task. While putting everything else in a low-power standby state.
The MSI Prestige 16 is not a gaming laptop, but it can handle gaming just fine
MSI makes a lot of gaming laptops and other gaming hardware. But it makes plenty of hardware that isn’t geared toward gaming too. Such is the case with the Prestige 16 which is designed more for professionals, workflow, or school. In short, a more general computing/ultrabook style of experience. That being said, the Prestige 16 can handle gaming just fine because MSI is using NVIDIA 40-series GPUs.
Configurations start with an RTX 4050 but you can get models with an RTX 4060 and an RTX 4070 as well. And it can come with up to 32GB of RAM. So while there won’t be options for NVIDIA’s most powerful GPUs, the Prestige 16 will be more than capable of playing games. This is good news for anyone wanting a laptop that’s mainly for school or work but also wants to do a little gaming. Worth noting of course is that MSI will offer two different variants of this laptop. The ‘Studio’ model is what comes with NVIDIA GPU options. But MSI will also offer the ‘Evo’ model which uses Intel Arc graphics instead.
Additionally, the laptop will come with a 16-inch display. Resolution will vary between models as well. Both come with a QHD+ panel option but only the more high-end Studio model will offer a UHD+ option. The Prestige 16 will start at $1,399.99 for the AI Evo model and $1,899.99 for the AI Studio model.
Attackers are exploiting a critical vulnerability in Apache Struts 2 that was patched recently. Struts is a very popular open source platform to develop applications and websites.
On December 7, 2023, Apache announced versions 6.3.0.2 and 2.5.33 of Struts were now available to address a potential security vulnerability listed as CVE-2023-50164.
The vulnerability affects Apache Struts versions:
2.0.0 through 2.5.32
6.0.0 through 6.3.0.1
2.0.0 through 2.3.37 (EOL, no longer supported)
The vulnerability that has a CVSS score of 9.8 out of 10, lies in the frameworks’ file upload functionality and can be exploited to achieve remote code execution (RCE). There is an easy to follow proof-of-concept (PoC) available, which makes it easier for cybercriminals to exploit the vulnerability.
Basically it’s a path traversal flaw that allow attackers to read, and possibly write to, restricted files by inputting path traversal sequences like ../ into file or directory paths. The flaw is caused by parameter confusion, where an attacker can first capitalize a parameter in the request and then submit an additional parameter (in lowercase) that overrides an internal file name variable. That allows an attacker to bypass the built-in check and leave the path traversal payload in the final filename.
This allows a successful attacker to plant a web shell, a malicious script used by an attacker that allows them to escalate and maintain persistent access. In this case, the attacker gets the ability to write a server-side rendered file, such as a JSP (Jakarta Server Pages) file, into a target directory. The JSP payload is executed as soon as the attacker requests the file from the server and the server is compromised. Several international organizations like the Australian Cyber Security Centre (ACSC), the French Computer Emergency Response Team (CERT-FR), and content delivery giant Akamai are warning that they are seeing active exploitation.
Tweet by Akamai
Because of the relative ease-of-use, we can expect to see a lot more of these attacks.
Update now
Users and administrators are encouraged to review the Apache Security Bulletin and upgrade to Struts 2.5.33 or Struts 6.3.0.2 or greater. There are no workarounds.
