A threat actor allegedly published 4.1 million genetic data profiles stolen from the DNA testing company 23andMe in dark web forums.
The British Royal Family, wealthy families that support Zionism, and the wealthiest individuals in the United States and Western Europe are among those whose information was disclosed.
The genetic profiles of 23andMe were published on Tuesday by a hacker going by the name Golem on the well-known cybercrime forum BreachForums.
After learning of the breach, the company contacted its customers and reminded them to take extra precautions to keep their accounts and passwords safe.
Hackers Using Credential Stuffing Attack
On October 6, 23andMe revealed that hackers had gained access to some user data. The company claimed that the hackers had used credential stuffing, a technique where they tried combinations of usernames or emails and corresponding passwords that were already known as a result of other data breaches, to gather the stolen data.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
The company said that when customers reused login information, that is when usernames and passwords used on 23andMe were the same as those used on other websites that had previously been hacked—threat actors were able to access specific accounts.
“Threat actor may have then, in violation of our Terms of Service, accessed 23andMe.com accounts without authorization and obtained information from certain accounts, including information about users’ DNA Relatives profiles, to the extent a user opted into that service”, the company said.
The hacker publishing the stolen information, Golem, seems to have first tried to sell the user details. On Wednesday, he stated: “I would like to remind you that even the data I’m sharing here is extremely valuable.”
On August 11, a hacker posted an advertisement on the Hydra forum for a set of 23andMe user data. According to a TechCrunch study, that collection of user data matched some of the user details exposed two weeks prior.
The hacker stated having 300 gigabytes of 23andMe customer data on Hydra, although the hacker offered no support for this claim.
Hence, the company advised customers to take additional precautions to keep their accounts and passwords safe and stated that they were seeking the help of third-party forensic experts and federal law enforcement officials.
The company requires all customers to change their passwords, and they encourage the usage of multi-factor authentication (MFA).
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
It might seem weird that HomePod owners can’t listen to their favorite tunes via YouTube Music, but Apple’s speakers don’t actually feature support for this specific streaming service.
Thankfully, that’s about to change, so if you’re subscribed or consider subscribing to YouTube Music, you’ll finally be able to use your subscription with the Apple HomePod speakers.
YouTube Music announced over the weekend that it has officially launched support on Apple HomePod to all Premium and Music Premium members globally, so it’s not just in the United States or a select number of countries.
The streaming service didn’t offer a timeline for the rollout, so we can probably assume that support for HomePod speakers is already live. To check if you can listen to music via Google’s streaming service, simply head to Settings / Connected Apps / Connect with HomePod.
As soon as the setup is complete, say “Hey Siri, play music on YouTube Music” to get started. Of course, you’ll also be able to set YouTube Music as your default music provider to avoid saying “… on YouTube Music” every time you want to listen to your favorite music.
In order to do that, you’ll have to go to Home app on your iOS device, then Settings / Username / Default Service and choose YouTube Music as your default music provider.
Keep in mind that you’ll have to update your YouTube Music app to the latest version to get it running on your HomePod speakers.
Microsoft has detected two North Korean nation-state threat actors, Diamond Sleet and Onyx Sleet, exploiting CVE-2023-42793. This vulnerability allows remote code execution on various JetBrains TeamCity server versions widely used for DevOps and software development activities.
Diamond Sleet and other North Korean threat actors executed software supply chain attacks through build environment infiltration, posing a high risk to affected organizations.
JetBrains has issued an update to fix the vulnerability and offers mitigation for users unable to update to the latest version.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
North Korean Hackers Exploiting TeamCity Flaw
Diamond Sleet (ZINC) is a North Korean threat actor focusing on espionage, data theft, and network disruption, often targeting global media, IT, and defense entities.
Diamond Sleet attack chain 1 (Source – Microsoft)
Moreover, Onyx Sleet (PLUTONIUM), also North Korean, primarily targets defense and IT services in South Korea, the U.S., and India, using advanced tools for persistent, stealthy access.
Diamond Sleet and Onyx Sleet exploit the same vulnerability but employ distinct tools and tactics after successful infiltration. Microsoft believes these actors opportunistically target vulnerable servers, deploying malware and techniques for persistent access.
Microsoft notifies affected customers directly to help secure their environments. Diamond Sleet, after breaching TeamCity servers, employs PowerShell to fetch two payloads from previously compromised legitimate infrastructure stored in C:\ProgramData:-
Forest64.exe
4800-84DC-063A6A41C5C
Diamond Sleet attack chain 2 (Source – Microsoft)
Forest64.exe creates a scheduled task for persistence, and Diamond Sleet uses the ForestTiger backdoor to extract LSASS memory credentials, detected by Microsoft Defender Antivirus as ForestTiger.
Diamond Sleet uses PowerShell to fetch a malicious DLL on compromised servers. The DLL is placed in C:\ProgramData, where it engages in DLL search-order hijacking alongside a legitimate .exe file, specifically DSROLE.dll and Version.dll, as seen by Microsoft.
Onyx Sleet creates a new user account, ‘krtbgt,’ on compromised systems, impersonating ‘KRBTGT.’
Onyx Sleet attack chain (Source – Microsoft)
They add it to the Local Administrators Group, perform system discovery, and deploy a unique payload using PowerShell, establishing a persistent connection with attacker-controlled infrastructure.
Recommendations
However, here below, we have mentioned all the recommendations that the security researchers are recommending:-
Implement JetBrains’ update or mitigations for CVE-2023-42793.
Check for the provided indicators of compromise in your environment to detect potential intrusions.
Block incoming traffic from IPs listed in the IOC table.
Defend against this threat with Microsoft Defender Antivirus.
Act swiftly to counter malicious activity on the affected device. If malicious code is active, the attacker may have full control.
Examine the device timeline for signs of lateral movement via one of the compromised accounts.
Verify that ‘Safe DLL Search Mode’ is enabled.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
Technical support fraud, also called tech and customer support fraud, is when someone pretends to be technical or customer support to trick people into giving them money.
Criminals may offer help to fix problems like updating the computer Antivirus or the need to update a software license.
Microsoft and Amazon supported CBI (Central Bureau of Investigation) and Federal enforcement agencies to raid multiple sectors in India on 19th October.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
Tech support fraud is a costly and significant issue. Every year, criminals operating illegal call centers prey on the vulnerable and scam thousands of victims.
Tech Support Fraud resulted in more than 30 raids on call centers and more than 100 charges so far. By the Investigation, there are more than $1 billion in losses to victims.
The scammers targeted over 2,000 customers across Amazon and Microsoft, primarily based in the U.S., but also in Canada, Germany, Australia, Spain, and the UK.
The partnerships also support the importance of improving the internet and protecting more people.
However, criminals will try to rebuild their businesses and open up new illegal call centers.
The CBI, Amazon, and other international law enforcement agencies are committed to staying alert, sharing important information, and working closely with Indian law enforcement agencies and authorities from the countries attacked to help them with their investigations.
The CBI Tweeted that “CBI LAUNCHES OPERATION CHAKRA-II TO COMBAT AND DISMANTLE ORGANIZED CYBER ENABLED FINANCIAL CRIMES; DURING NATIONWIDE CRACKDOWN, SEARCHES CONDUCTED AT AROUND 76 LOCATIONS; LARGE NUMBER OF DIGITAL GADGETS INCLUDING LAPTOPs, HARD DISC ETC RECOVERED.”
The government requests to be aware of these scammers to protect our money and personal information.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
Installing Microsoft Exchange Updates can be a challenging task, as it may lead to various issues in the process, such as compatibility problems, data loss, service disruptions, security vulnerabilities, update failures, dependency conflicts, or backup and recovery challenges.
There are several things that can go wrong when installing Cumulative Updates (CU) or Security Updates on your Exchange Server. You may encounter issues during and after installation or even the installation of updates may fail or stop.
The installation of updates could be hindered due to underlying issues with the operating system, damaged hardware, incorrect network configuration, conflict with third-party applications, corrupted updates, or human errors. In this article, we will be going through the things that you can do to prevent issues when installing updates and how to resolve issues (if occur) as fast as possible and with no data loss.
Prerequisites before Installation
To avoid any issues during updates installation, you need to first identify the currently installed version of the Cumulative Updates on your server. For this, you can use the Get-ExchangeServer command as given below.
This will give information about the version of the Exchange Server installed, along with the build number. On the Exchange Server updates download page, you can check the version you are downloading and confirm the installation matrix compatibility. Sometimes, you need to hop to a specific version before installing the latest one.
Before downloading the updates, it’s important to double-check with your Exchange Server consultant or supplier that you are installing the right update.
Read the release notes
It’s important to read the notes to know about any known issues, restrictions, or other information which is crucial for installing your update. There might be possible solutions to known issues while installing the update in question. Although it might be an administrative burden, you must check the release notes before installing the updates.
Installing the Updates
You should not rush through any installation or confirmation. All things must be documented and audited. This will help in troubleshooting if something goes wrong. Such documents help find out where the problem is. If you would involve your supplier or Microsoft support, then this will help them to resolve the problem easily.
Cumulative Updates take time to install, depending on the performance of the server. Ideally, you should restore a copy of the server in a sandbox environment and install the updates to test it if you have a single Exchange Server. If you have a Database Availability Group (DAG), you should first install the updates on the passive server. After a week of testing and ensuring that nothing was broken, you can go ahead and install them on the live server.
Ensure Redundancy
When installing updates or changing the configuration of your environment, you should always have a failover plan. If you have a single instance of the server, you might consider testing the daily backup and performing a restore test to ensure that you can roll back if something happens.
If you have a Database Availability Group (DAG) with two or more servers, you need to make sure that the failover process is functioning properly and that the replication of databases is healthy.
Although it might not always be possible, it is highly recommended to take a backup before installing the updates or making any changes.
Contingency Plan
There is always a contingency plan before proceeding with the installation. In case the installation fails, there should be a set of instructions that need to be followed to recover from such a situation, such as:
Who to inform
Who to engage
What is to be done
Data loss parameters
What to do if something goes wrong during or after the update installation?
As mentioned, there are a lot of things that could go wrong when installing Cumulative Updates (CU), Security Updates (SU), or making any other changes to your infrastructure. If power is lost during the installation, storage is full, or an antivirus scan is executed, then these things can put the database in a dirty shutdown state and possibly corrupt the database or transaction logs. The Exchange Server will not boot or the Exchange Server services will not start due to corrupt installation files. In such situations, you can do the following:
1. Restore the Server from Backup
You can restore the server from backup. This will easily resolve the problem. However, if there were any changes during the installation, then these will be lost.
2. Rebuild the Server and Recover the Data
The other option is to rebuild the Exchange Server. As all the configuration of the Exchange Server is in the Active Directory Schema, installing the server with the recovery mode and keeping the same IP Address and computer name will help recover the services.
To recover the data from corrupted databases or transaction logs, you can take the help of a specialized Exchange server recovery tool, like Stellar Repair for Exchange. This tool can open any version of an EDB file and in any state. It allows you to granularly export the data from the EDB file directly to a live mailbox database on your rebuilt Exchange Server while ensuring no data loss. The application can also export the EDB data to PST and other file formats.
Conclusion
Ensure a smooth Exchange Server update process involves thorough preparation, documentation, testing, and having contingency plans in place. Adhering to the best practices outlined in this article will significantly help you to avoid issues and minimize the impact of any problems that may arise during or after Cumulative Updates (CU) or Security Updates.
Installing Microsoft Exchange Updates can be a challenging task, as it may lead to various issues in the process, such as compatibility problems, data loss, service disruptions, security vulnerabilities, update failures, dependency conflicts, or backup and recovery challenges.
There are several things that can go wrong when installing Cumulative Updates (CU) or Security Updates on your Exchange Server. You may encounter issues during and after installation or even the installation of updates may fail or stop.
The installation of updates could be hindered due to underlying issues with the operating system, damaged hardware, incorrect network configuration, conflict with third-party applications, corrupted updates, or human errors. In this article, we will be going through the things that you can do to prevent issues when installing updates and how to resolve issues (if occur) as fast as possible and with no data loss.
Prerequisites before Installation
To avoid any issues during updates installation, you need to first identify the currently installed version of the Cumulative Updates on your server. For this, you can use the Get-ExchangeServer command as given below.
This will give information about the version of the Exchange Server installed, along with the build number. On the Exchange Server updates download page, you can check the version you are downloading and confirm the installation matrix compatibility. Sometimes, you need to hop to a specific version before installing the latest one.
Before downloading the updates, it’s important to double-check with your Exchange Server consultant or supplier that you are installing the right update.
Read the release notes
It’s important to read the notes to know about any known issues, restrictions, or other information which is crucial for installing your update. There might be possible solutions to known issues while installing the update in question. Although it might be an administrative burden, you must check the release notes before installing the updates.
Installing the Updates
You should not rush through any installation or confirmation. All things must be documented and audited. This will help in troubleshooting if something goes wrong. Such documents help find out where the problem is. If you would involve your supplier or Microsoft support, then this will help them to resolve the problem easily.
Cumulative Updates take time to install, depending on the performance of the server. Ideally, you should restore a copy of the server in a sandbox environment and install the updates to test it if you have a single Exchange Server. If you have a Database Availability Group (DAG), you should first install the updates on the passive server. After a week of testing and ensuring that nothing was broken, you can go ahead and install them on the live server.
Ensure Redundancy
When installing updates or changing the configuration of your environment, you should always have a failover plan. If you have a single instance of the server, you might consider testing the daily backup and performing a restore test to ensure that you can roll back if something happens.
If you have a Database Availability Group (DAG) with two or more servers, you need to make sure that the failover process is functioning properly and that the replication of databases is healthy.
Although it might not always be possible, it is highly recommended to take a backup before installing the updates or making any changes.
Contingency Plan
There is always a contingency plan before proceeding with the installation. In case the installation fails, there should be a set of instructions that need to be followed to recover from such a situation, such as:
Who to inform
Who to engage
What is to be done
Data loss parameters
What to do if something goes wrong during or after the update installation?
As mentioned, there are a lot of things that could go wrong when installing Cumulative Updates (CU), Security Updates (SU), or making any other changes to your infrastructure. If power is lost during the installation, storage is full, or an antivirus scan is executed, then these things can put the database in a dirty shutdown state and possibly corrupt the database or transaction logs. The Exchange Server will not boot or the Exchange Server services will not start due to corrupt installation files. In such situations, you can do the following:
1. Restore the Server from Backup
You can restore the server from backup. This will easily resolve the problem. However, if there were any changes during the installation, then these will be lost.
2. Rebuild the Server and Recover the Data
The other option is to rebuild the Exchange Server. As all the configuration of the Exchange Server is in the Active Directory Schema, installing the server with the recovery mode and keeping the same IP Address and computer name will help recover the services.
To recover the data from corrupted databases or transaction logs, you can take the help of a specialized Exchange server recovery tool, like Stellar Repair for Exchange. This tool can open any version of an EDB file and in any state. It allows you to granularly export the data from the EDB file directly to a live mailbox database on your rebuilt Exchange Server while ensuring no data loss. The application can also export the EDB data to PST and other file formats.
Conclusion
Ensure a smooth Exchange Server update process involves thorough preparation, documentation, testing, and having contingency plans in place. Adhering to the best practices outlined in this article will significantly help you to avoid issues and minimize the impact of any problems that may arise during or after Cumulative Updates (CU) or Security Updates.
The AQI (air quality index) of our area is often overlooked. Naturally, we want to make sure that the air in our area is breathable, so Google is giving us another way to check on that. According to a new report, the Google Discover feed will show you the air quality in your area.
Google already offers other ways for you to view the AQI in your area. For starters, if you own a Pixel phone, then you can access that information via your At a Glance widget. This is the widget on the top left of your home screen. You can set it to show your AQI from the settings.
Also, you can see your AQI on Google Maps. It’s one of the map layers that show you different views of the map. If you want to know the air quality in your area, you should look at those methods.
The Google Discover feed now shows the air quality in your area
You can access the Google Discover feed from the Google app or by swiping to the right on your phone’s home screen (that is if you have the feature enabled). You’ll be greeted with a feed of the latest headlines on news topics you’re interested in. Above those, you’ll see some tiles showing you the current weather in your area, sports, and finances.
Well, Google is now rolling out the AQI as part of an update that’s coming out. The tiles are on a carousel, so you’ll have to swipe to see the AQI. It will show you the number along with a dot. The dot next to the number will correspond to how breathable the air is. A green dot means that the air is safe to breathe and a red one means that it’s unsafe. A yellow dot is right in the middle.
If you don’t want to see the AQI, tap on the edit button on the far right of the carousel. Just uncheck it if you don’t want to see it, and that goes for the weather, sports, and finances.
Google is trickling more tweaks and updates to its apps to make them better on larger screens. The next update comes to the Gmail app, and it will make using it easier if you need to open a link. According to a new report, Gmail on larger-screen devices now opens links in split-screen mode.
Android is becoming a much friendlier platform for tablets as time goes on. First-party apps like Gmail, Docs, Calendar, and more have been changing in order to work better on tablets and foldables. This is great, seeing as Google now has a foldable and a tablet on the market. More changes are on the way, so you should expect to see more stories like this.
Gmail on larger screens will open links in split-screen mode
This is a useful feature to come to the app. The trick to multitasking is being able to access more than one thing at a time. Previously, when you would tap on a link it Gmail, the browser would fill the screen. That’s not a bad thing, but if you’re focused on multitasking, then you probably won’t want that.
Rather than filling the screen, Gmail will open the link in split-screen mode on foldables and tablets. This way, you’ll still have access to the original email. There could still be information on the email that you need access to. It’s better that you have access to both.
When you tap on the link, you’ll see a Chrome tab open on the right side of the screen. Gmail will condense to the left side of the screen. When that happens, you’ll see Gmail change to a more familiar mobile view with the contents of the email filling the left column. If you want to access the inbox, tap on the arrow in the top left corner of the screen.
This is currently rolling out, so you should be able to see it now. If not, then you might want to wait a bit for it to make it to you. Make sure that the Gmail app is fully updated.
“RCS is the modern industry standard for messaging, and it’s already been adopted by most of the industry.” Brian Rakowski said this during last year’s Pixel event, and Google has been echoing this sentiment. The company is not done pushing the benefits of RCS (Rich Communication Services), as you can imagine. In fact, Google wrote a whole article on the Google Play Store touting the benefits of RCS.
The quote above isn’t exaggerating, RCS is the latest industry standard of messaging. It offers benefits such as end-to-end encryption, read receipts, group chats, and much more. It’s a replacement for the older SMS standard, which is decades old. So, it makes sense that Google and many other companies are pushing for this to be the standard.
However, not all companies are keen on hopping to RCS. Apple, the smartphone king, still insists on using the older standard, and it makes things harder for everyone else. Apple, while it’s pretty much stepping on everyone’s toes, has the status and size to remain stubborn. It has a massive user base that supports the stay on SMS, and they all think that it’s because of the Blue Bubble vs. Green Bubble debate.
Google wrote a whole article on the Play Store talking about the benefits of RCS
Google is making the Play Store more than a place to pick up your next mobile app. You can find apps for Chromebooks, manage your payment methods/subscriptions, and more. Well, what if we told you that you can read articles on the platform, as well?
As per the report, Google wrote a whole article explaining why RCS is the way of the future. You’ll only see this if you’re on the web version of the Play Store. When you load up the page and go to the Apps tab, you’ll see a carousel of large tiles on the top of the screen. Click on the arrow to the right of the carousel to scroll through it.
The third tile should read “7 Ways RCS makes Messages by Google even better”. When you click on it, you’ll see a short editorial about how RCS is the best thing since sliced bread. At the bottom of the post, you’ll see the app page for the Google Messages app where you can download it.
The post lists some legitimate reasons as to why RCS is a great technology, so feel free to read it.
The most recent Alpha and Beta versions of the Facebook and Instagram apps on Android now support Android’s themed icons. This supports recent rumors that Meta was working on finally adding this functionality to its apps’ icons, years after it became available throughout the operating system.
Automatic theming, including themed icons, were introduced to Android with version 12 of the operating system. This feature extracted the dominant colors of your wallpaper and applied them throughout the interface, making for a more minimal and cohesive look.
Fortunately, this is now changing as both the Instagram and Facebook icons are now supporting automatic theming on Android in their Beta and Alpha apps, meaning that this will likely be rolled out to their stable versions soon. This was spotted by users currently using these versions and reported by Mishaal Rahman on X.
Image Credit – Omar Tosca on Threads (IG) | White_Eagle_ on Telegram (FB)
This is available right now in versions 307.0.0.0.42 (beta) of Instagram and 439.0.0.0.30 (alpha) of Facebook and signals a turning point to how Meta handles the implementation of new Android features. This was evident more recently by the limited rollout of a new Instagram layout for tablets, which can be tested now using a larger screen device, such as the Google Pixel Fold on Android 14 QPR1 Beta.
For those that enjoy having matching icons on their Android’s home screen, support for a matching themed icon for both of these applications could finally stop the issue of having to hide them inside a folder or pushing them to a secondary stream (if not hide them altogether). Hopefully, this feature makes it to the stable channels sooner rather than later, perhaps just in time for the next Android security update or the December Pixel Feature Drop.
