The critical API security flaws in the social sign-in and OAuth (Open Authentication) implementations affected high-profile companies like Vidio, Grammarly, and Bukalapak.
Salt Security’s Salt Labs research team has identified vulnerabilities in the social login implementations of three popular websites.
These vulnerabilities can expose over a billion user accounts to account hijacking and data leakage, given that social login is a standard feature found in almost all major and non-major websites.
Eighty percent of the targets Salt Labs’ investigated contained security flaws concerning social login features.
Researchers have revealed a small set of impacted targets.
This discovery highlights the risks associated with social login functionality.
The leading API security firm, Salt Security’s Salt Labs research team, has identified critical API security flaws in the social sign-in and the OAuth (Open Authentication) implementations of several high-profile online firms, including Vidio, Grammarly, and Bukalapak.
Investigation revealed that through Pass-The-Token Attack, a threat actor could exploit the vulnerabilities, gaining unauthorized access to a user’s accounts on dozens of websites and access their credit cards, bank accounts, and other sensitive data.
This research marks the third and final installment in the team’s OAuth hijacking series. Previously, Salt Labs researchers had identified vulnerabilities in Expoand Booking.com.
For your information, OAuth is a widely used authentication method. Many websites and web services use it to enable the user-friendly one-click login process. Moreover, through OAuth implementation, users can log in to their social media accounts, such as Facebook or Google, to register on a website instead of creating a new login ID and password.
The vulnerabilities were detected in the social sign-in process’ access token verification step. It is a crucial component of the OAuth implementation on websites. The issue occurred due to improper token verification in the process, allowing adversaries to obtain unauthorized access.
In a blog post, Salt Labs Security Researcher Aviad Carmel wrote that their research team could exploit this flaw through the Pass-The-Token Attack, which involves inserting a token from another website to gain access to user accounts.
Vulnerability Impact on Vidio.com
On the Vidio website, researchers discovered the vulnerabilities while logging in through Facebook. The website (Vidio.com) didn’t verify the token or OAuth itself, which is a glaring flaw, allowing manipulation of the API calls to insert an access token created for another application. This alternate token-AppID combination allowed researchers to impersonate a user on the website and get the opportunity to take over thousands of accounts.
Vulnerability Impact on Bukalapak.com
One of Indonesia’s largest eCommerce platforms, Bukalapak’s website, also failed to verify the access token when users registered with a social login. Salt Labs team inserted a token from another website and was able to access a user’s credentials from the website, obtaining full control of the account.
It is worth noting that in May 2020, a hacker was discovered selling user data belonging to 13 million Bukalapak user accounts.
Vulnerability Impact on Grammarly
The researchers observed the AI-powered writing tool Grammarly.com website to learn the site’s code-sending terminology. Afterward, they could manipulate the API exchange to insert code used to verify users on a different website and successfully obtained user account credentials and performed account takeover.
Following the coordinated disclosure practice, Salt Labs researchers notified all three sites, and the issues have now been addressed. They believe the vulnerabilities could have impacted at least a billion accounts associated with the three affected sites.
The flaws although have been addressed but could have exposed sensitive login details and allowed adversaries to launch versatile range of attacks. This is a shocking discovery because thousands of websites use social sign-in functionality and billions of users worldwide could be at risk of threats like identity theft and financial fraud.
Social Login is a very common feature that is implemented on almost every major (and non-major) web service. Around 80% of our targets included some kind of security issue related to social login functionality. The impact is that we were successfully able to take over more than 1 billion accounts across all the targets, which includes the ones identified in this research plus many others.
Yaniv Balmas – VP of Research at Salt Security
Dicussion at SecTor
Aviad Carmel and Yaniv Balmas of Salt Security will be hosting a speaking session titled: Uh-OAuth! – Breaking (and Fixing) OAuth Implementations” – Wednesday, October 25, 4:00-5:00pm, Meeting Room 718A.
For your information, SecTor is a Black Hat conference that focuses on underground threats and corporate defenses. It is held annually in Toronto, Canada. The conference is known for its high-quality speakers and attendees, and it is a must-attend event for anyone interested in the latest information on security threats and defenses. SecTor 2023 will be held October 23-26, 2023 at the Metro Toronto Convention Centre.
Google has added a new feature to Emergency SOS on Android that prevents devices from accidentally dialing 911. The feature aims to reduce unintentional calls made to emergency services after the organization complained about the high number of accidental calls from Android users.
Emergency SOS came to Android devices from Android 12 and later. Since then, the feature has been found on most Android devices by default and helped save countless people’s lives worldwide. Emergency SOS can be activated through five consecutive taps of the power button. This triggers a countdown timer that lets users cancel the call if it is made accidentally.
On Pixel phones and other devices that use Google’s “Personal Safety” app, the feature can also start recording video besides calling the emergency services and notifying emergency contacts.
However, Emergency SOS has come under fire earlier for accidental calls to 911, especially in Scotland earlier this year. Google first promised to change how Emergency SOS works on Android devices but didn’t explain what change it would implement. Now, the company is spotted testing a barrier for calls to 911.
Android Emergency SOS adds a three-second barrier for calling 911
According to Mishaal Rahman on X (Twitter), Google now asks Android users to touch and hold the screen for 3 seconds before calling 911 emergency services. Previously, you needed to wait five seconds to connect to the 911. The new feature could significantly reduce pocket dials, but downsides can’t be ignored.
For someone in a critical emergency, it may be difficult (if not impossible) to press the screen for 3 seconds. For example, In case of a heart attack or lack of enough light, the person may not be able to hold the screen. Of course, Google still allows you to return to the old 5-second countdown in the settings menu. You can also totally turn off Emergency SOS.
Different companies have different approaches to activating Emergency SOS. For example, Samsung offers a 10-second countdown instead of 5 seconds and replaces touch and hold with a swipe gesture.
NVIDIA reportedly plans to build and sell its own in-house CPUs to take on Intel and AMD. While NVIDIA itself is a household name in the computing market, the company is known far and wide for GPUs. Not CPUs. NVIDIA currently dominates the GPU segment for personal computing. And it’s gained a strong foothold in AI chips. But now the company aims to make a push for CPUs. Meaning one day your desktop PC could be powered by both a CPU and a GPU coming from NVIDIA.
According to “people familiar with NVIDIA’s plans” the company will be using technology from Arm Holdings to build these chips. It’s also been said that NVIDIA has been designing these chips in-house for a while now. Albeit doing so without making any noise about it so as to not tip people off. It’s unclear exactly how long NVIDIA has been designing its own central processing units. But it doesn’t appear the company plans to launch them anytime soon.
NVIDIA might launch in-house CPUs by 2025
Even though NVIDIA may have been working on these chips for some time, a release doesn’t seem to be just around the corner. According to the report from Reuters, NVIDIA may look to launch its in-house CPUs by sometime in 2025. Which puts them at least another year and a half out. NVIDIA will potentially be joined by AMD in using Arm-based tech to create CPUs for PCs. And both companies will be joining Qualcomm in a market that it’s been working in for the last 6-7 years.
NVIDIA entering into this market is said to be part of Microsoft’s initiative to compete with Apple. Apple already uses Arm-based tech to design and use in-house CPUs for its Mac laptops and desktops. Which have gained increased battery life and power efficiency with each iteration. Microsoft is working towards a similar goal but plans to put its own spin on things by encouraging chip makers to weave AI into the hardware so it’s offered at a core level. This should make NVIDIA a prime candidate for building CPUs as it already develops tons of AI-based computing solutions.
And Qualcomm is set to reveal its new Snapdragon X Elite CPUs for PCs at its upcoming Snapdragon Summit 2023. A platform that has deep integration with AI.
This week on the Lock and Code podcast, we speak with James Fair about the reluctance of some businesses to take cybersecurity seriously, even in the face of major attacks.
This week on the Lock and Code podcast…
In September, the Las Vegas casino and hotel operator MGM Resorts became a trending topic on social media… but for all the wrong reasons. A TikTok user posted a video taken from inside the casino floor of the MGM Grand—the company’s flagship hotel complex near the southern end of the Las Vegas strip—that didn’t involve the whirring of slot machines or the sirens and buzzers of sweepstake earnings, but, instead, row after row of digital gambling machines with blank, non-functional screens. That same TikTok user commented on their own post that it wasn’t just errored-out gambling machines that were causing problems—hotel guests were also having trouble getting into their own rooms.
As the user said online about their own experience: “Digital keys weren’t working. Had to get physical keys printed. They doubled booked our room so we walked in on someone.”
The trouble didn’t stop there.
A separate photo shared online allegedly showed what looked like a Walkie-Talkie affixed to an elevator’s handrail. Above the device was a piece of paper and a message written by hand: “For any elevator issues, please use the radio for support.”
As the public would soon learn, MGM Resorts was the victim of a cyberattack, reportedly carried out by a group of criminals called Scattered Spider, which used the ALPHV ransomware.
It was one of the most publicly-exposed cyberattacks in recent history. But just a few days before the public saw the end result, the same cybercriminal group received a reported $15 million ransom payment from a separate victim situated just one and a half miles away.
On September 14, Caesar’s Entertainment reported in a filing with the US Securities and Exchange Commission that it, too, had suffered a cyber breach, and according to reporting from CNBC, it received a $30 million ransom demand, which it then negotiated down by about 50 percent.
The social media flurry, the TikTok videos, the comments and confusion from customers, the ghost-town casino floors captured in photographs—it all added up to something strange and new: Vegas was breached.
But how?
Though follow-on reporting suggests a particularly effective social engineering scam, the attacks themselves revealed a more troubling, potential vulnerability for businesses everywhere, which is that a company’s budget—and its relative ability to devote resources to cybersecurity—doesn’t necessarily insulate it from attacks.
Today on the Lock and Code podcast with host David Ruiz, we speak with James Fair, senior vice president of IT Services at the managed IT services company Executech, about whether businesses are taking cybersecurity seriously enough, which industries he’s seen pushback from for initial cybersecurity recommendations (and why), and the frustration of seeing some companies only take cybersecurity seriously after a major attack.
“How many do we have to see? MGM got hit, you guys. Some of the biggest targets out there—people who have more cybersecurity budget than people can imagine—got hit. So, what are you waiting for?”
Meta has started to promote Threads posts on Facebook feeds. The move comes after Threads’ daily active users plummeted and users lost interest in the platform. Meta hopes to boost Threads engagement by enabling users to share their posts from Threads to Facebook feed.
According to the company’s announcement, a new feature, dubbed “For you on Threads,” now appears on the Facebook feed that contains popular Threads posts. Yet, Meta automatically recommends the posts that appear in this box, and users can’t share their Threads directly to the feed.
Meta still needs to clarify how it recommends Threads posts. On the other hand, privacy experts have expressed worries about how the feature may affect user privacy. Allowing users to cross-post their content to Facebook might expose it to a broader audience, as Threads is built for sharing stuff with a limited circle of friends.
Meta promotes Threads posts on Facebook to increase their visibility
In response to a user asking how to keep Threads posts off of Facebook, Meta said, “We’ve launched an update to make it easier for people to see the latest content from Threads directly on Facebook and Instagram.” The platform later added they’re “listening to feedback” and continue adjusting the feature.
It’s not surprising to see Meta is using its other platforms like Facebook and Instagram to promote Threads. Meta used this growth-hacking tactic when it first launched Instagram Reels by promoting them on Facebook’s feed.
The company also started promoting Threads posts on Instagram in August. But the difference is cross-posting Threads posts to Facebook feeds isn’t optional, and users can’t opt out. The platform might add an opt-out feature in the future. Some users now complain they don’t want their Threads posts to be shown on Facebook feed.
Threads currently has over 130 million users. After months of stagnation, the reports show its downloads in app stores are again stacking up. However, the app is generally dealing with a massive usage decline. A report by SimilarWeb revealed September Threads usage on Android was down 40% from where it was in July.
There’s been rumors about what Apple might announce before the end of the year, and over the weekend we heard that they were planning to have a virtual event next Monday or Tuesday. Well, the invites just came out, and it’s happening on October 30, 2023.
But this one is a bit strange. Apple is having an event at 5PM PT on October 30, 2023. Apple never does that. Events are always at 10AM PT. So this is going to make for a rather late event for those on the East Coast.
Apple is also using the tagline “Scary Fast” here, which is likely having to do with Halloween the next day, and the fact that we’re expecting new Macs here. But the interesting thing here is, what Macs could Apple be announcing? There’s really only one Mac that isn’t on the M2 lineup yet, and that’s iMac. So could this be the start of M3? Possibly, but with this being a virtual event and not in-person that seems less likely.
Mac rumors have been confusing recently, with the move from M2 to M3
When you look at the rumors for the Mac as of late, it’s been quite confusing. Seeing as most of the Mac lineup is ready to move to M3, while the iMac is still on M1. Over the weekend, Gurman did note that he was not expecting a MacBook Air refresh this year. This makes sense, since the 15-inch was just announced in June. But the 13-inch, 14-inch and 16-inch MacBook Pro’s might get new chips.
But does that mean M3? It could. While many are not expecting M3 at a virtual event like this, Apple has announced chips at a virtual event. The initial announcement of moving to Apple Silicon was virtual and so was M1 – obviously that was due to the pandemic. So it’s not out of the ordinary. But since this is an actual virtual event, instead of just a press release, it does seem more likely to be M3.
Amazon’s Echo Show smart displays have come a long way since the first generation models. I still remember unboxing the very first Echo Show and thinking that this was some mini-kiosk that you might find at the mall. Once Amazon decided to offer different sizes (there’s now 5-, 8-, 10- and 15-inch Echo Show smart displays), they changed up the design a bit, and it’s mostly stayed the same ever since. Until this year. Amazon has decided to change up the design once again. It’s not a huge design change, to be quite honest, but it is noticeable.
But is a new design enough to get you to buy a new Echo Show this year? Amazon hopes so. But that’s not all that’s new this time around. Amazon has also upped the audio game, including Spatial Audio, added an improved high-resolution display and much more. So let’s see if it is worth the price, in our full review of the Echo Show 8.
Amazon Echo Show 8 Review: Design
As mentioned, the Echo Show 8 looks identical to the previous model, when you look at it straight on. But when you look around the back, that is where you’ll see a few differences from the older model. One of the differences you’ll notice is that the backside is actually smaller than the display. It’s also rounder, so the display kind of sticks out, especially around the corners. It’s an interesting look for the Echo Show 8, and I still can’t decide if I like it not. Mostly because I don’t really see it.
While I’ve been using the new Echo Show 8, it has sat on my desk, so most of the time that I’ve used it, it’s been looking at the display, and not the backside. But the backside is still wrapped in fabric like most of Amazon’s Echo speakers too. Which provides for a really great audio experience here.
There’s a single port on the back for power, which is the same barrel connector that Amazon has used since the beginning. So no USB-C here, unfortunately. On the top of the display, there’s an array of buttons that you can use to control your Echo Show 8. This includes a microphone button so you can turn on or off the always-listening Alexa. There’s a camera shutter in the center, above the camera. So it is physically covering the camera. And then there’s the volume buttons on the right side. Amazon kept it simple here, that’s really all you need as physical buttons.
This is a stunning display
The Display on the new Echo Show third-generation is absolutely stunning. Amazon doesn’t mention the resolution here other than it being “HD”, but it does look better than HD, perhaps it is full HD at 1080p. Either way, this display looks much better than some of the older Echo Show devices. It’s also brighter with better color accuracy, so watching YouTube and Prime Video on this aren’t as bad as it used to be.
Of course, part of this could be the fact that the Echo Show 8 is now edge-to-edge glass, which was not the case before. Amazon has included a camera in the center, which is a 13-megapixel camera. Great for doing video calls with your loved ones and friends, without having to hold your phone the whole time.
With the display looking so great, I just can’t stop looking at my photos and album art from Spotify on it. It looks incredible, and this would be a great photo frame, if you do use Amazon Photos (remember, it is unlimited, unlike Google Photos now).
Improved performance and faster Alexa
One of the big improvements that Amazon made on the Echo Show 8 (third-generation) is a newer processor, that results in faster results from Alexa, as well as a faster experience throughout the smart display. Amazon is not mentioning what processor this is, nor how many cores it is, other than just “improved”. It’s likely still a MediaTek processor, and the performance here is better, but it can still be a bit on the slow side.
Typically, smart displays are quite slow on the performance side, and that’s still the case with the Echo Show 8. Sometimes, tapping through the operating system, like jumping from audio to the smart home section, can take a few more seconds than it should. But the thing here is that you’ll likely very rarely be actually interacting with the display, and mostly just seeing the display.
It would be good to see performance not be a problem on smart displays – as this is not unique to Echo Show. But a lot of the time with these devices, companies believe we’ll use the assistant that’s included more than actually interacting with the display. And companies are trying to cut costs, and put more money into the actual display. It reminds me of Smart TVs actually. With many Smart TVs running operating systems like Android TV, Google TV, Fire TV and even Roku to an extent. They focus more on the display, sound, etc, but don’t put a powerful enough processor inside, so a lot of time the software built-in runs very slowly. But the difference here is that you can’t just plug in a Fire TV Stick 4K Max into the HDMI port (because there isn’t one). So you have to deal with this slower performance.
I still feel like this performance is not a dealbreaker for most people, however. Because, again, most of the time you’ll be interacting with Alexa. And Alexa is indeed much faster than before. Rather than swiping through pages yourself here.
Amazon Echo Show 8 Review: Audio Experience
Surprisingly, the audio experience on this Echo Show 8 has been pretty incredible. Since it is Techtober, I went from using the Sonos Move 2 on my desk for music, to the Echo Show 8, and honestly, I did not notice a huge difference in terms of audio quality. Which is pretty impressive. Now, I will note that I do not typically have music up very loud while I’m working, it’s mostly here for background noise. So that could contribute to it not being a huge difference.
However, I did turn up the volume here on the Echo Show 8, and the audio still sounded really good. You can turn up to about 70% before the audio really starts to suffer. The mids and highs still sound crystal clear, with plenty of bass, below 70% volume. That’s pretty much on par with most other speakers, that aren’t made specifically for audiophiles. So that is good to see.
Want to know how much bass is in this speaker? Well, play a nice bassy song, and put your hand on the back of the Echo Show 8, you can literally feel the bass. So while a lack of bass was a problem with older Echo Show devices, that is not the case here, thankfully.
Finally, Amazon does give you a nice equalizer in the settings that you can use to adjust the bass, mid and treble for the music playing on the Echo Show 8. I’ve kept it at the default levels for most of this review, as I found them to be pretty decent. But I have turned up the bass a tiny bit, since I listen to a lot of bass-heavy music.
Amazon Echo Show 8 Review: Alexa & Software
So the software on the Echo Show 8 is mostly the same. But the home screen has been improved here. Amazon calls it the “all-new home screen experience with Adaptive Content”. This is a new home screen that uses on-device computer vision technology to adjust the on-screen content based on a customer’s proximity to the device.
What does this mean? Well, here’s a good example. Say you asked Alexa for the weather, and you’re across the room? The Echo Show 8 will show (and read) you the weather, but it will be shown larger, so you can read it from across the room. And once you get closer to the Echo Show 8, the weather will change to a smaller look and be more detailed. Since you are now close enough to read all the details now. This is one of those features that just makes so much sense, and it’s one that you don’t even think about.
The Home screen here is mostly the same as on previous Echo Show devices, but one change that Amazon made here that I really like are the shortcuts in the upper-right hand corner. There are now shortcuts for media, smart home, shopping, connecting to another display (like a TV) and the Widget Gallery (to add widgets to your gallery). The shortcuts I use the most are the media and smart home, as that’s mostly what I use a smart display for. It’s just so much faster than swiping down from the top and then tapping on media or smart home. Again, it’s the little things here that make the Echo Show 8 so much nicer to use.
I (and most reviewers) often say not to buy a product today based on promises of features coming later on. But there is a really cool feature coming to the Echo Show 8 later this Fall. Amazon is calling it the “Echo Show 8 Photos Edition” which will unlock a photo-forward mode on Echo Show 8’s high-resolution screen. This new experience will make customer-selected personal photos the primary rotating content on this ambient screen. Users will be able to have photos rotating every 30-seconds and customers also get 25GB of storage from Amazon Photos. Don’t forget that Prime members do already receive free, unlimited high-resolution photo storage, which can be used for this feature.
It definitely sounds like a cool feature, but again we can’t use it just yet because it’s not out yet. We will be updating this review once it is out, and after we’ve had some time to test it out. But it definitely sounds like it could be a killer feature for the Echo Show 8 (third-generation) especially when compared to the competition.
Alexa got a huge upgrade
With the Echo Show 8, Alexa actually got a really nice upgrade this year. The overall experience of Alexa here isn’t really any different. But Alexa can now respond much faster than on the previous Echo Show 8. Amazon says that Alexa can respond about 40% faster for common requests. Amazon lists these as things like turning on a smart light, smart switch or a smart plug. Now while we don’t really have a way to test that out, in our testing this does seem to be accurate. Alexa is now blazing fast when it comes to flipping on the smart lights in my basement or the smart plug used to charge my EV.
Alexa also seems to be a bit faster with other responses, like asking about the weather. Which is really good to see. Especially for those that use Alexa all of the time.
Echo Show 8 can still do the basics
While we talked a lot about the new things that the Echo Show 8 can do, it can still do the basics. Like letting you know when someone is at your door if you have a Ring Video Doorbell. Or alerting you to when your Amazon package(s) have been delivered. You can also watch video on the smart display here, which looks incredible on this high-resolution display. Though, unfortunately, YouTube and YouTube TV are still not supported – they are on Fire TV, so it’s still rather odd. When you open YouTube, it will go to the Amazon Silk browser. And the same goes for YouTube TV. But mostly everything else have their own apps on the Echo Show 8.
Should you buy the Amazon Echo Show 8?
Now for the $149 question, should you buy the Echo Show 8? This depends on a number of things. If you have the second-generation model, definitely not. While there are some nice upgrades here, it’s likely not worth the $149 price. Now if you have the first-generation model, which came out in 2019, it’s very much worth upgrading. After four years, that smart display is likely showing its age, both in the looks and the performance.
Of course, if you wait until the holiday season, Amazon will likely be bundling the new Echo Show 8 with different products. This is something Amazon does quite often, bundling their smart displays with things like an Echo smart speaker, or a smart bulb, or even the Ring Alarm kit. So if you can get the Echo Show 8 for lower than its regular price, it’s definitely worth getting. Especially if you are already invested in the Alexa ecosystem and use it for many things around the house.
On October 23, 2023, 1Password’s CTO, Pedro Canahuati, disclosed the incident, stating that threat actors were unable to access or steal user data during the attack.
On October 24, 2023, 1Password disclosed (PDF) a security incident that was linked to the recent breach of Okta’s support system. The incident occurred when a threat actor gained access to an IT employee’s Okta session token by leveraging access to a stolen credential and used it to access 1Password’s Okta administrative portal.
While 1Password says that no user data was accessed during the incident, the incident highlights the importance of strong security practices for both Okta customers and password managers.
The latest security breach at Okta serves as the second cyberattack on the company. In March 2022, LAPSUS$ hackers claimed to have breached Okta and Microsoft after leaking a trove of their data on Telegram.
How the Okta Breach Impacted 1Password
Okta is a popular identity and access management (IAM) platform that helps organizations manage user access to their applications. On October 20, 2023, Okta disclosed that threat actors had gained access to its support systems and stolen authentication data for some of its customers.
1Password is one of the customers that was impacted by the Okta breach. On September 29, 1Password detected suspicious activity on its Okta instance. After a thorough investigation, 1Password concluded that a threat actor had used a stolen session token to access 1Password’s Okta administrative portal
“Based on our initial assessment, we have no evidence that proves the actor accessed any systems outside of Okta. The activity that we saw suggested they conducted initial reconnaissance with the intent to remain undetected for the purpose of gathering information for a more sophisticated attack.”
Pedro Canahuati – CTO 1Password’s
What 1Password Is Doing to Mitigate the Impact of the Incident
1Password has taken a number of steps to mitigate the impact of the incident, including:
Launching an investigation into the incident.
Terminating the threat actor’s session immediately.
Implementing stricter access controls for Okta users.
What 1Password Users Can Do to Protect Their Accounts
1Password users can take the following steps to protect their accounts:
Keep their 1Password app up to date.
Change their 1Password password regularly.
Use a strong, unique password for their 1Password account.
Enable two-factor authentication for their 1Password account.
Be careful about clicking on links in emails or messages from unknown senders.
What This Incident Means for IAM and Password Management Security
The 1Password incident highlights the importance of strong security practices for both IAM and password management platforms. IAM platforms like Okta need to implement robust security controls to protect their customers’ data. All Password managers need to implement multi-factor authentication and other security measures to protect their users’ passwords.
Organizations that use Okta or other IAM platforms should review their security policies and procedures to ensure that they are taking all necessary precautions to protect their data. Organizations that use password managers should also review their security settings and enable multi-factor authentication for all users.
Last week, Samsung released its October security update for the Galaxy Tab S7 and Galaxy Tab S8 series. The initial rollout only covered the tablets in international markets. The company has now expanded its coverage to the US as well.
Galaxy Tab S7 and Tab S8 get Samsung’s October update in the US
Samsung appears to be pushing the October SMR (Security Maintenance Release) to both Wi-Fi and 5G models of the Galaxy Tab S7, Galaxy Tab S7+, Galaxy Tab S8, Galaxy Tab S8+, and Galaxy Tab S8 Ultra in the US. The updated firmware build number for the two 2020 models ends with DWJ2. That for the 2022 models ends with BWJ1.
Regardless of the build number, the latest update for the past two generations of Samsung’s flagship Android tablets has the same changelog. And don’t get excited, there’s nothing major here. The Korean firm is only pushing this month’s security fixes to the devices. “The security of your device has been improved,” the changelog states. You aren’t getting any new features or functional improvements.
Samsung published the content of the October SMR early this month. The latest security release contains fixes for 46 vulnerabilities, at least two of which are critical security flaws. As usual, we are talking about the combined total of Android OS issues and Samsung-specific issues across the entire Galaxy family. The Galaxy Tab S7 and Galaxy Tab S8 lineups certainly aren’t affected by them all.
Nonetheless, installing the latest update will safeguard your tablet from all the security vulnerabilities present in it. You should get a notification when Samsung’s OTA (over-the-air) rollout reaches your Galaxy Tab S7 or Galaxy Tab S8 unit. You can also manually check for updates from the Settings app. Go to the Software update menu and tap on Download and install to check if you have an update pending download.
Only the Galaxy Tab S8 will get Android 14
Samsung is expected to release the stable Android 14 update with One UI 6.0 for Galaxy devices later this month. The Galaxy S23 series will get it first, followed by other models. Unfortunately, the new Android version won’t make it into the Galaxy Tab S7 series.
The 2020 flagship tablets arrive with Android 10 and have already received the promised three major Android OS updates, i.e. Android 11, Android 12, and Android 13. The Galaxy Tab S8 series, on the other hand, came with Android 12 and is eligible for four major Android upgrades. So it will get updates until Android 16. Stay tuned for more information about Samsung’s stable Android 14 rollout.
Over the past few weeks, we have seen Qualcomm’s Snapdragon 8 Gen 3 in several benchmark listings across multiple platforms. It has been putting up a good fight against MediaTek’s Dimensity 9300 and Samsung’s Exynos 2400. Someone has now pitted it against Apple’s A17 Pro, the chip that powers the iPhone 15 Pro and iPhone 15 Pro Max. The new Snapdragon held up strong in this battle too, outperforming the Apple chip in multi-core tests.
Snapdragon 8 Gen 3 gives a tough fight to A17 Pro
In this benchmark face-off, the Snapdragon 8 Gen 3 scored 2,207 points in single-core tests and 7,494 in multi-core tests. The A17 Pro scored 2,846 and 7,024 points in the two tests, respectively. As you can see, the latter won the single-core battle but the Qualcomm solution fought back strongly and came up at the top when all CPU cores were put to use. This bodes well for the next-gen Android flagships, such as the Galaxy S24 Ultra.
That said, Qualcomm has yet to announce the new chip. The firm will unveil it during the Snapdragon Summit 2023, which kicks off later today in Maui, Hawaii. The Xiaomi 14 series is expected to debut the chip later this month. This benchmark test used the unreleased Xiaomi phone as well. Time will tell whether the end product delivers a similar performance as this test device. The A17 Pro’s test run was conducted using the iPhone 15 Pro Max.
The disparity in single-core and multi-core scores of the two chips looks reasonable when we dive deeper into their CPU configuration. The Snapdragon 8 Gen 3 has eight CPU cores in a 1+3+2+2 setup. It features one prime core operating at a maximum frequency of 3.30GHz, three mid-cores running at 3.15GHz, two more mid-cores clocked at 2.96GHz, and two efficiency cores clocked at 2.27GHz.
The Apple A17 Pro, on the other hand, sports six CPU cores in a 2+4 configuration. It has two prime cores running at 3.78GHz and four efficiency cores operating at 2.11GHz. Since its prime cores are faster than the Qualcomm chip, it offers better single-core results. The tide turns in favor of the latter when it comes to multi-core tests thanks to more CPU cores. A face-off between devices powered by the two chips will be interesting to watch.
Samsung’s Galaxy S24 Ultra will use the new Snapdragon globally
The Snapdragon 8 Gen 3 will power the next-gen Android flagships coming later this year and deep into 2024. Samsung‘s Galaxy S24 Ultra is one of the highly-anticipated devices with this chip. The Korean firm will ship the phone with the new Snapdragon processor globally. The other two models will use the Exynos 2400 in some markets. Samsung is expected to launch the Galaxy S24 series in January 2024.
