Google will use AI to help you find that perfect Christmas gift

andreasc
-
0
Google will use AI to help you find that perfect Christmas gift
[ad_1]

It’s the holiday season, so the pressure is on to buy the perfect gift for your loved one. While the tradition of gift-giving goes back millennia, Google is here to reinvent the wheel and use AI to help you with your Christmas shopping. According to a new report, Google’s SGE will also help you find the perfect gifts for your loved ones.

If you don’t know what Google’s SGE is, it stands for Search Generative Experience. This feature has been in testing for a while, and you may have seen it before. When you search for something on Google, you’ll see a section above the search results with an AI-generated summary of what you searched for. Say, if you search “What is malware?” in Google, above the pages that would otherwise inform you of this, Google SGE will give you a quick and concise answer to that question.

As you can guess, this is a bit of a controversial tool, as it limits the traffic to thousands of websites. That’s a topic that’s continuing to develop at this time.

Google will use AI to help you with your Christmas shopping

One thing about generative AI is its ability to provide you with advice on pretty much any subject. Just type in the question, and you will get a useful answer delivered to you. Well, what’s to stop it from suggesting great Christmas presents for you to buy? With Google SGE, that’s exactly what will happen.

When you go on to Google, do a search for ideas for Christmas presents. You can use queries like “gift ideas for a 7-year-old who wants to be an inventor” or something like “a gift idea for my cousin who loves kites.” Google will use generative AI to ascertain what you’re wanting, and provide suggestions of what to buy.

You’ll see a bunch of results categorized into different sections. Each section will have a collection of items that you can buy. Google won’t simply tell you what to buy, it will surface links to different shopping sites to buy those products. That’s good news, as it directs more traffic to these websites.

If you have Google SGE, you can start searching for your ideal Christmas presents now. It’s live for the web version, and the mobile version on Android and iOS.


[ad_2]
Source link

Hackers Can Now Exploit a Security Flaw in Zoom Client

andreasc
-
0
Hackers Can Now Exploit a Security Flaw in Zoom Client
[ad_1]

The popular video messaging platform Zoom has discovered multiple vulnerabilities affecting Zoom Clients. These vulnerabilities might allow an unauthorized user to carry out denial-of-service, privilege escalation, and information disclosure attacks.

To receive the most recent security updates and bug fixes, Zoom advises users to update to the most recent version of the Zoom software.

High Severity Vulnerabilities Impacting Zoom Clients

Improper Authentication – CVE-2023-39215

With a CVSS Base Score of 7.1 and a High severity vulnerability listed as CVE-2023-39215, improper authentication in Zoom clients may enable an authenticated user to utilize network access to perform a denial of service attack.

Affected Products:

  • Zoom Desktop Client for Windows before version 5.15.5
  • Zoom Desktop Client for macOS before version 5.15.5
  • Zoom Desktop Client for Linux before version 5.15.5
  • Zoom VDI Client before version 5.14.12
  • Zoom VDI Client before version 5.15.4
  • Zoom Mobile App for Android before version 5.15.5
  • Zoom Mobile App for iOS before version 5.15.5
  • Zoom Meeting SDK’s before version 5.15.5

Exposure of Sensitive Information – CVE-2023-39214

A high-severity vulnerability with a CVSS Base Score of 7.6 is identified as CVE-2023-39214. It involves the exposure of sensitive data in Zoom Client versions before 5.15.5, which could enable a denial of service via network access for an authenticated user.

Affected Products:

  • Zoom Desktop Client for Windows before version 5.15.5
  • Zoom Desktop Client for macOS before version 5.15.5
  • Zoom Desktop Client for Linux before version 5.15.5
  • Zoom Mobile App for Android before version 5.15.5
  • Zoom Mobile App for iOS before version 5.15.5
  • Zoom Rooms for iPad before version 5.15.5
  • Zoom Rooms for Android before version 5.15.5
  • Zoom Rooms for Windows before version 5.15.5
  • Zoom Rooms for macOS before version 5.15.5

Client-Side Enforcement of Server-Side Security – CVE-2023-36535

Before version 5.14.10, client-side enforcement of server-side security in Zoom clients may have allowed an authenticated user to enable information exposure via network access.

This high-severity vulnerability was identified as CVE-2023-36535 and has a CVSS Base Score of 7.1.

Affected Products:

  • Zoom Clients for Windows before version 5.14.10
  • Zoom Desktop Client for macOS before version 5.14.10
  • Zoom Desktop Client for Linux before version 5.14.10
  • Zoom VDI Host and Plugin before version 5.14.10
  • Zoom Mobile App for Android before version 5.14.10
  • Zoom Mobile App for iOS before version 5.14.10
  • Zoom Rooms for iPad before version 5.14.10
  • Zoom Rooms for Android before version 5.14.10
  • Zoom Rooms for Windows before version 5.14.10
  • Zoom Rooms for macOS before version 5.14.10

Medium and Low-Severity Vulnerabilities Impacting Zoom Clients

Improper Authorization (CVE-2023-43582), Insufficient Control Flow Management (CVE-2023-43588), Cryptographic Issues (CVE-2023-39199), Buffer Overflow (CVE-2023-39206, CVE-2023-39204, CVE-2023-36532), Improper Conditions Check (CVE-2023-39205), 

Client-Side Enforcement of Server-Side Security (CVE-2023-39218), Improper Input Validation (CVE-2023-39217).

Update Now!

Users are advised to stay safe by installing the most recent updates or getting the most recent Zoom software which includes all security updates.

Patch Manager Plus, the one-stop solution for automated updates of over 850 third-party applications: Try Free Trial.


[ad_2]
Source link

Hackers Steal Data of UK Customers

andreasc
-
0
Hackers Steal Data of UK Customers
[ad_1]

As per Samsung, the data breach was a result of a vulnerability in a third-party business application.

Samsung has notified its customers in the United Kingdom that a data breach has exposed the personal information of thousands of individuals. The breach impacted customers who made purchases on the company’s UK online store between July 1, 2019, and June 30, 2020.

The company discovered the breach on November 13, 2023, and determined that an unauthorized individual exploited a vulnerability in a third-party business application to access customer data. Samsung has not disclosed the identity of the hacker.

The affected personal information may include names, addresses, phone numbers, and email addresses. Samsung has assured its customers that financial information and passwords were not accessed in this breach.

The email from Samsung to the impacted user said, “On 13 November 2023, it was determined that an unauthorized individual exploited a vulnerability in a third-party business application we use and that some personal information of certain customers who made purchases on SEUK’s eCommerce site between July 1, 2019, and June 20, 2020, was affected.”

Email sent by Samsung to UK customers – Screenshot: Michael Valentine @KwyjiboUK – via X (Twitter).

It’s worth noting that Samsung confirmed to Hackread.com that only its UK customer base was affected by the data breach. Users in the United States, Canada, South Korea, and elsewhere have no cause for concern.

Samsung has reported the incident to authorities, including the UK’s Information Commissioner’s Office, responsible for enforcing the UK General Data Protection Regulation (UK GDPR).

This data breach is separate from the one that Samsung announced in September 2022, impacting only the company’s US customers. The incident resulted in the breach of private user data, including names, dates of birth, product registration data, demographic information, and contact numbers.

The latest announcement is not an isolated incident. Samsung has a history of being targeted by hackers due to its large-scale customer base, with over 992.4 million active Samsung smartphone owners in 2020. Previously, the South Korean technology giant was hacked by Lapsus$ hackers, who leaked the company’s source code online in March 2022.

Nevertheless, the latest Samsung data breach announcement is a reminder of the importance of protecting personal information. Consumers should take steps to protect themselves from identity theft and fraud, such as using strong passwords, avoiding phishing scams, and regularly reviewing their financial statements.

  1. Research claims Samsung Galaxy Store apps spread malware
  2. Hackers can hijack Samsung phones by knowing phone number
  3. Hackers used Samsung website to access Sprint’s customer data

[ad_2]
Source link

The Android 14 update is breaking some Android Auto music apps

andreasc
-
0
The Android 14 update is breaking some Android Auto music apps
[ad_1]

Driving is more fun when you have good music playing, but recently some Android Auto users can’t fully relate to this. Following the Android 14 update, some users of the Android Auto service on their vehicles have had a hard time accessing their music streaming apps. Aside from navigation, music streaming is one feature that users of the app benefit from during their daily commute.

Users of the app that are facing this issue report that it all started after they updated to Android 14. After the update, linking their smartphone to their vehicle’s infotainment system didn’t pull up music streaming. They explain that their music streaming apps accessible on their vehicle via Android Auto have randomly gone silent.

Now this isn’t an issue that is affecting just one music streaming app but a host of apps. Most of the apps that users report that are facing this issue are commonly used among drivers. Various car models are also facing this issue, so it isn’t something that just one car model is facing.

A fix might be in the works for the Android Auto music app issue Android 14 users are experiencing

From the reports, it is clear that Pixel users are the majority that are facing this issue. Google has long started to roll out the Android 14 update to Pixel smartphones. This update seems to make music apps on Android Auto not function properly, and some users are experiencing this.

Some people facing this issue have come out to speak about their experiences. Each one of them is finding it hard to play music from the music apps they have on Android Auto. This leads them to embark on rides without any music, and this isn’t ideal for some rides.

Those facing this issue are quite frustrated and have come online to air their thoughts. Google is now gathering the reports they are giving to identify and solve the problem. At the moment, there is a fix for this bug that is affecting some Android Auto users.

However, there seems to be some effort on Google’s part to solve the problem as effectively as possible. It’s also good to note that not all Android Auto users are facing this issue. Additionally, not all Pixel users are facing this same issue, but there are some quick temporary fixes for those facing this issue.

These temporary fixes include restarting the song or reconnecting the device to the car’s infotainment. At the moment, the issue fluctuates as it doesn’t always mute the audio from various music apps. In the coming week, Android Auto users might see a lasting fix to this issue from Google.


[ad_2]
Source link

Bally Sports likely to Shut Down Next Year

andreasc
-
0
Bally Sports likely to Shut Down Next Year
[ad_1]

Bally Sports has been a hot topic this year, as their owner Diamond Sports Group goes through bankruptcy court. And now the latest out of the hearing that happened just yesterday, says that Sinclair expects Bally Sports to shut down next year, at the end of the 2024 MLB season.

But here’s where things get interesting, Diamond Sports Group doesn’t agree, and objected to that idea. Diamond Sports Group is the division within Sinclair that owns Bally Sports. Sinclair’s outside counsel, David Selign said during the hearing that “Sinclair folks who original acquired Diamond, they’re kind of bummed, they’re bummed that this business that they put in a billion and a half of equity value in, is now going to shut down. There’s going to be people losing their jobs….Diamond’s business is going away.”

What makes things interesting is that the new contract Bally Sports negotiated with the NBA may come to an end early. If Bally Sports is unable to reach a deal with Spectrum in February, the NBA could walk away from the TV contract entirely.

Bally Sports has not announced plans to shut down

It’s important to note that Bally Sports has not announced any plans to shut down, and people familiar with the matter have stated they see a path forward to exit bankruptcy without shutting down. Obviously, a lot can change between now and the end of the 2024 MLB Season next October.

However, Bally Sports has already given up the rights to a number of teams, because they couldn’t afford to pay their fees. Currently, Bally Sports has rights to 15 NBA teams, 12 NHL teams, and 11 MLB teams.

Scripps Sports has also shown that it has interest in getting the rights to local teams if Bally Sports does indeed shut down. Back in October, Scripps stated that they do have deals to step in if Bally Sports does drop local teams. Scripps Sports President, Brian Lawlor stated that they are “talking to the leagues every week. I don’t think any of them are hoping it’s all going to blow up, people would like to see existing conracts get to the end of those contracts and have time to thoughtfully figure out what’s the right next step.”

This division of Scripps is actually fairly new, having only been formed in January of this year. However, it has already signed broadcast deals for the Las Vegas Golden Knights and the Arizona Coyotes of the NHL. It has also made a deal to put WNBA games on Friday Nights on its Ion Network. A problem that Scripps Sports is running into is the resistance by distributors to carry independent and digital channels that are now carrying the games of teams that are popular locally. Scripps does see opportunity with the sports business, hence why they launched Scripps Sports in January.


[ad_2]
Source link

Wireshark 4.2.0 Released: What’s New!

andreasc
-
0
Wireshark 4.2.0 Released: What’s New!
[ad_1]

Wireshark, a leading network packet analyzer, has released version 4.2.0, which brings bug fixes, protocol updates, major API changes, codec support, and several new features. It is still a widely used and popular tool for network protocol analysis.

Network administrators and security experts use packet analyzers like Wireshark to examine network packets and find solutions, which makes it a useful tool for businesses in a wide range of sectors.

What’s new in Wireshark 4.2.0?

Wireshark 4.2.0 has several new features and updates, such as:

  • Wireshark supports dark mode on Windows.
  • A Windows installer for Arm64 has been added.
  • Packet list sorting has been improved.
  • Wireshark and TShark are now better at generating valid UTF-8 output.
  • A new display filter feature for filtering raw bytes has been added.
  • Display filter autocomplete is smarter about not suggesting invalid syntax.
  • Tools › MAC Address Blocks can look up a MAC address in the IEEE OUI registry.
  • The enterprises, manuf, and services configuration files have been compiled for improved start-up times.
  • The installation target no longer installs development headers by default.
  • The Wireshark installation is relocatable on Linux (and other ELF platforms with support for relative RPATHs).
  • Wireshark can be compiled on Windows using MSYS2. 
  • Wireshark can be cross-compiled for Windows using Linux.
  • Tools › Browser (SSL Keylog) can launch your web browser with the SSLKEYLOGFILE environment variable set to the appropriate value.
  • Windows installer file names now have the format Wireshark-<version>-<architecture>.exe.
  • Wireshark now supports the Korean language.
  • RTPDump is the new file format decoding.

Bug Fixes

The following issues have been addressed:

  • RTP players do not play audio frequently on Windows builds with Qt6 (Issue 18413)
  • The playback marker does not move after resuming with Qt6 (Issue 18510)

Removed Features and Support

  • The prior support in the TShark -e option for showing column text via the column title has been removed generally with the addition of universal and consistent filtering support for column text.
  • The bundled script “dtd_gen.lua” that was disabled by default has been removed from the installation. It can be found in the Wireshark Wiki under “Contrib”.
  • The Wi-Fi NAN dissector filter name has been changed from ‘nan’ to ‘wifi_nan’.

New Protocol Support

Aruba UBT, ASAM Capture Module Protocol (CMP), ATSC Link-Layer Protocol (ALP), DECT DLC protocol layer (DECT-DLC), DECT NWK protocol layer (DECT-NWK), DECT proprietary Mitel OMM/RFP Protocol (also named AaMiDe), Digital Object Identifier Resolution Protocol (DO-IRP), Discard Protocol.

FiRa UWB Controller Interface (UCI), FiveCo’s Register Access Protocol (5CoRAP), Fortinet FortiGate Cluster Protocol (FGCP), GPS L1 C/A LNAV navigation messages, GSM Radio Link Protocol (RLP), H.224, High Speed Fahrzeugzugang (HSFZ), Hypertext Transfer Protocol version 3 (HTTP/3), ID3v2.

IEEE 802.1CB (R-TAG), Iperf3, JSON 3GPP, Low-Level Signalling (ATSC3 LLS), Management Component Transport Protocol (MCTP), Management Component Transport Protocol – Control Protocol (MCTP CP), Matter home automation protocol, Microsoft Delivery Optimization, Multi-Drop Bus (MDB).

Non-volatile Memory Express – Management Interface (NVMe-MI) over MCTP, RDP audio output virtual channel Protocol (rdpsnd), RDP clipboard redirection channel Protocol (cliprdr), RDP Program virtual channel Protocol (RAIL), SAP Enqueue Server (SAPEnqueue), SAP GUI (SAPDiag), SAP HANA SQL Command Network Protocol (SAPHDB), SAP Internet Graphic Server (SAP IGS), SAP Message Server (SAPMS).

SAP Network Interface (SAPNI), SAP Router (SAPROUTER), SAP Secure Network Connection (SNC), SBAS L1 Navigation Messages (SBAS L1), SINEC AP1 Protocol (SINEC AP), SMPTE ST2110-20 (Uncompressed Active Video), Train Real-Time Data Protocol (TRDP).

UBX protocol of u-blox GNSS receivers (UBX), UDP Tracker Protocol for BitTorrent (BT-Tracker), UWB UCI Protocol, Video Protocol 9 (VP9), VMware HeartBeat, Windows Delivery Optimization (MS-DO), Z21 LAN Protocol (Z21), Zabbix, ZigBee Direct (ZBD), Zigbee TLV.

Updated Protocol Support

JSON: The dissector now has a preference to enable/disable the “unescaping” of string values.

JSON: The dissector now supports “Display JSON in the raw form.

IPv6: The dissector has a new preference to show some semantic details about addresses (default off).

IPv6: The dissector now supports dissecting the Application-aware IPv6 Networking (APN6) option in the Hop-by-Hop Options Header (HBH) and Destination Options Header (DOH), including all three types of APN ID, which are 32-bit, 64-bit and 128-bit in length.

XML: The dissector now supports display characters according to the “encoding” attribute of the XML declaration and has a new preference to set the default character encoding for some XML documents without the “encoding” attribute.

SIP: The dissector now has a new preference to set the default charset for displaying the body of SIP messages in raw text view.

HTTP: The dissector now supports dissecting chunked data in streaming reassembly mode. Subdissectors of HTTP can register themselves in the “streaming_content_type” sub-dissector table to enable streaming reassembly mode while transferring in chunked encoding. 

CFM: The dissector has been overhauled and updated to the level of IEEE std 802.1Q-2022 and ITU-T Rec.

New and Updated Codec support

  • Adaptive Multi-Rate (AMR), if compiled with opencore-amr.

Major API Changes

  • Lua function “package.prepend_path” has been removed.
  • Added reassemble_streaming_data_and_call_subdissector() API for easier reassembly of non-TCP high-level protocol streaming data.
  • Some of the API now uses C99 types instead of GLib types.

Installation packages and the source code for Wireshark can be downloaded from.

Patch Manager Plus, the one-stop solution for automated updates of over 850 third-party applications: Try Free Trial.


[ad_2]
Source link

Alarm system cyberattack leaves those in need struggling to call for help

andreasc
-
0
Alarm system cyberattack leaves those in need struggling to call for help
[ad_1]

An alarm system company that allows those in need to ask for help at the touch of a button has suffered a cyberattack, causing serious disruption.

Tunstall Netherlands says the attack left the control room struggling to receive distress calls from clients on Sunday November 12, 2023.

Tunstall, among others, provides services and systems to allow smart monitoring in various healthcare settings. One of the services provides sick or disabled persons, and the elderly with an alarm button that can be used in case of an emergency.

Under normal circumstances, the control room would relay the distress call to a caregiver so they can check on and provide help.

The alarm button systems are used in situations where people that require care are not constantly surrounded by caregivers, like care homes that provide independent living, elderly who live at home but need the ability to call for help, and people with a heightened risk of falling.

It’s unknown what the exact nature of the cyberattack is. In case of a ransomware attack, it is unlikely that any group will claim responsibility or demand a ransom. These types of services are usually the type that they want to avoid for fear of repercussions.

Estimates say that tens of thousands of people are unable to reach the control room at the press of a button and will have to call an emergency number instead.

Tunstall says it’s worked hard to remediate the situation. It has engaged a specialized cybersecurity company to investigate the situation. Meanwhile it advised clients to keep their mobile phones handy so they can reach out in case of an emergency. At the moment the first services have been brought back online and the hope is that soon everything will be fully functional again.

Some organizations that use Tunstall’s system say they have provided their clients with the direct number they would need to call when they need help. But obviously pressing a button is a lot easier when you are in distress than having to call a phone number.

How you can call without having to unlock your phone first

Having the number pre-programmed and available at the press of a button makes things a bit easier if you do need to call for help via your phone. If you have or are someone who may need immediate help and you don’t have an alarm button or it doesn’t work, there are methods to make it easier to use your phone to raise help.

iPhones provide an “Emergency” option on the lock screen. Tapping it opens an on-screen keyboard, which allows you to dial a number. The restriction with this option however, is that it is designed primarily to call emergency numbers. Another option is to use the smart assistant by saying ‘Hey Siri’, and then ask it to call one of your contacts or a phone number. 

Some Android phones offer the option to add emergency contacts. Activating Emergency SOS requires you to save at least one emergency contact to your phone. This will need to be done first. Please note that Android phones’ menus may differ from vendor to vendor and version to version.

  • Open the Settings app.
  • Scroll down and tap Safety & emergency. On some types this menu can be found in the Advanced Settings menu.
  • Tap Emergency contacts > Add contact
  • Select one or more emergency contacts from your contact list.
  • Now you can enable Emergency SOS
  • In Safety & emergency, toggle the Use Emergency SOS and set the Use Emergency SOS slider to enabled
  • Confirm the setting and select what information you want to share.
  • You will need to provide the app with the necessary permissions.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.


[ad_2]
Source link

HONOR Magic6 to include 1-inch camera sensor, but not from Sony

andreasc
-
0
HONOR Magic6 to include 1-inch camera sensor, but not from Sony
[ad_1]

The HONOR Magic6 series is coming, and based on the latest rumor, a 1-inch camera sensor could be a part of the package. The thing is, that rumor claims that it won’t come from Sony.

Many companies used the Sony IMX989 1-inch camera sensor, and that sensor has proven to be outstanding. The OPPO Find X6 Pro used it, as did the Xiaomi 13 Pro and Xiaomi 13 Ultra, and more.

The HONOR Magic6 series is tipped to include a 1-inch camera sensor from OmniVision

The thing is, OmniVision is preparing its own 1-inch camera sensor, as we heard earlier this month. That camera sensor is allegedly called ‘OV50K’, and it could actually debut on the HONOR Magic6 series.

This info comes from Digital Chat Station, actually, one of China’s more prolific tipsters. That gives it some credibility, of course. We’re just not sure if the base Magic6 model will use it, or the more expensive one(s).

The OmniVision OV50K will have plenty of competition in the market. Aside from the Sony IMX989, Sony also announced its LYTIA dual-stacked sensors, which are not technically 1-inch sensors, but have other advantages.

More and more companies are starting to use OmniVision sensors for primary cameras, though. They were usually used as secondary cameras in higher-end phones, but a shift could be coming.

It remains to be seen if the OmniVision OV50K will end up being as good as expected

It remains to be seen if the OmniVision OV50K is any good, though, as it hasn’t even launched yet. The HONOR Magic6 series is not coming anytime soon, though. The Magic5 series arrived in February this year, so chances are we’ll have to wait until Q1 2024 to get the Magic6 series.

The Snapdragon 8 Gen 3 will fuel the Magic6, at least one of the models. We’re expecting high-end specs across the board, as was the case with the Magic5. Also, the Magic6 series will have a huge focus on the cameras, based on what we’ve seen in the past models.


[ad_2]
Source link

Google hints at Nest Wifi Pro 2 launch with new iconography

andreasc
-
0
Google hints at Nest Wifi Pro 2 launch with new iconography
[ad_1]

In August, Google was spotted working on a new Nest Wifi model, allegedly codenamed “Breeza” or “Brezza.” It appears the device will arrive as the Nest Wifi Pro 2, the successor to the Wi-Fi 6E-enabled Nest Wifi Pro from October 2022. We still don’t have a launch date for the second-gen model.

Google may have the Nest Wifi Pro 2 in the pipeline

Evidence about the existence of a new Nest Wifi on Google’s pipeline was first spotted inside the Google Home app. The company added strings related to LAN and WAN ports for an unannounced Nest Wifi model with the codename “Breeza,” which may be a misspelling of the Italian word “brezza,” meaning “breeze.” The product in question has the model number GS4VD.

While there hasn’t been a follow-up on that front, Android Police recently received a tip that gives us a new piece of related information. Google’s Material Symbols and Icons page has a new iconography depicting the Nest Wifi Pro 2. We can see that the icon is available across Android, iOS, and the web versions. While there’s no telling when the company added it, the tipster led the publication to a GitHub commit for the same dating back to August 11, 2023.

That’s just a few days after the first evidence popped up inside the Google Home app. We don’t have anything linking Brezza/Breeza to the Nest Wifi Pro 2 but it sure looks like Google has a new Wifi device in the works. Unfortunately, that is all we can tell you at the moment. There is no information on its potential launch date or features. Hopefully, something will come up sooner rather than later.

Google Nest Wifi Pro 2 icon

That said, the addition of new iconography to Google’s Material Symbols repository is no guarantee that the product is already in development. As the new report points out, the company added an icon for the Nest Locator Tag to the repository in May 2023 or earlier but no such product is here yet. Google has since removed the icon, so the plan may have been shelved for now. Time will tell the fate of the Nest Wifi Pro 2.

Google could wait for the final Wi-Fi 7 standard

Google will surely launch a new Nest Wifi device someday. It is just a matter of when and what the device will be called. Maybe it is waiting for the final Wi-Fi 7 standard, which should arrive sometime next year. We will have to wait and see if it will be a completely new product or a refreshed older model. As we look out for more information, you can check out these best Wi-Fi routers for your home internet system.


[ad_2]
Source link

Google Workspace Vulnerabilities Lead to Network-Wide Breaches

andreasc
-
0
Google Workspace Vulnerabilities Lead to Network-Wide Breaches
[ad_1]

Bitdefender informed Google of validated attack methods, but the tech giant won’t address them, citing misalignment with its threat model and confidence in existing security measures.

Bitdefender Labs, a Native XDR platform, has released its findings on novel attack techniques exploiting Google Workspace (formerly G Suite). According to Bitdefender’s technical report authored by Martin Zugec, threat actors can escalate a single compromised machine into a network-wide breach using previously unknown methods, leading to the deployment of ransomware or data exfiltration.

Researchers found the issues when developing their XDR sensor for Google Cloud Platform (GCP) and Google Workspace. The report, published on 15 November 2023 and shared with Hackread.com ahead of publication, highlights different pathways to achieve this escalation.

Researchers noted that from a single compromised machine, attackers could move laterally to multiple cloned machines with Google Credential Provider for Windows (GCPW) installed, evade multi-factor authentication mechanisms, and access the cloud platform with custom permissions. They can even decrypt locally stored credentials used to recover passwords to expand their attack scope beyond the Google platform.

For your information, GCPW enables remote Windows device management features without requiring a VPN connection or domain registration. It allows SSO (single-sign-on) authentication to Windows OS with Google Workspace credentials.

The GCPW uses a local ‘Gaia’ service account to authenticate users with Google Workspace credentials. This account is created when GCPW is getting installed and has escalated privileges.

The feature integrates a Credential Provider into the Local Security Authority Subsystem Service (LSASS) that performs authentication in Windows OS. This Credential Provider verifies user credentials when they unlock or log into their devices.

When a new user authenticates with GCPW, the created ‘Gaia’ account creates a new local user account for them, which is linked with their Workspace account. The user logs in using this local profile, and a refresh token is stored in their profile to prevent multiple authentication prompts.

Let’s examine the attack methods Bitdefender researchers have identified in their blog post.

Method 1: Moving to other cloned machines with GCPW installed

It is worth noting that the ‘Gaia’ account is created with a random password, and therefore, despite existing on all machines, each will have a unique password for ‘Gaia.’ But if a machine is created by cloning another one on which GCPW is already installed, the password would also get cloned. So, if one knows the password of a local account and all local accounts linked with the devices share the same password, one will know passwords to all these devices.

Method 2: Gaining access to the cloud platform with custom permissions

An adversary can exploit a vulnerability in GCPW to access the GCP with custom permissions by using the ‘Gaia’ service account and creating a service account key with custom permissions. They can use the key to authenticate with GCP.

Method 3: Decrypting locally stored passwords

Attackers can use the ‘Gaia’ service account to decrypt locally stored passwords using the account’s access to the Windows Credential Manager. They can use the stored credentials to authenticate with other services or applications.

These attack methods allow escalation of compromise from a single endpoint to an entire network.

Bitdefender notified Google, and the search engine giant confirmed that their discovered attack methods were valid. However, the company does not intend to address them at the moment because they do not fall into its predetermined threat model, and security measures should be enough to counter them.

Bitdefender has included detections for the attacks in GravityZone XDR to help the security community address them.

  1. Google Account Sync Vulnerability Exploited to Steal $15M
  2. Google Indexed Trove of Bard AI User Chats in Search Results
  3. Hive Ransomware is now as Hunters International, Bitdefender
  4. Phishers Exploiting Google Docs to Harvest Crypto Credentials
  5. Fantom Foundation Suffers Wallet Hack Via Google Chrome Flaw

[ad_2]
Source link
1...705706707...1,483Page 706 of 1,483