Gboard on Android is now rolling out the ability to set a default skin tone for your favorite emoji. We have been able to change skin tone for emoji in the past, but now changing it applies to all supported emoji at once.
As announced by Google, the ability to choose a default skin tone and gender is rolling out to Gboard today on Android. This can be set by long-pressing on one of the many emoji that support skin tone customization, which you can discern by noting the small arrow on the bottom right of each emoji, and then selecting the desired skin tone.
This has always been the process in the past, however, now when you make the change to one emoji, all the emoji in that same category change with it. For example, making the change to the “Flexed Biceps” emoji, changes all the emoji that contain a hand or fingers. Same thing goes for emoji under the “People” category, where you can not only change the skin tone, but also the gender.
In the past, doing this only changed that one emoji and only for that one use, while now it persists within the application until you change it again. It really is shocking that this hasn’t been a feature until now. Emojis have become part of day to day communication, even in most business settings.
Imagine how difficult typing would be if you had to long-press each letter to change it to a capital letter, then do it again to get a lowercase letter. This would be painful, slow and frustrating. And yet, when we want to modify the appearance of our emoji’s color or gender presentation, that’s exactly what we have to suffer through. – Google
Google stated that in most emoji keyboards, it would take over 300 taps to set the tone and gender for every single emoji. Multiply that by the times you would have to do this for every text or chat application you use. This is a great deal of taps when you consider emoji to be such a casual way of expressing oneself. Hopefully, this feature will be a huge time-saver for those that love to use emoji in their texts.
Cybercriminals are known to exploit malicious advertising techniques for targeting the widely-used Notepad++ text editor for Windows. This could lead to the dissemination of ransomware and malware.
In these malvertising efforts, threat actors take advantage of Google advertisements.
According to Malwarebytes, it appears to have completely evaded detection for at least a few months. It is unique in its ability to fingerprint users and distribute time-sensitive payloads.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
Malvertising Campaigns Targeting Notepad++
Researchers discovered malicious advertising distributed by the same threat actor but from different compromised ad accounts.
The first screening step occurs when a user clicks on one of these ads. This is probably an IP check that ignores VPNs and other fraudulent IP addresses and displays a decoy site.
The decoy site
Nevertheless, targeted users will see a copy of the genuine Notepad++ website, which is hosted at notepadxtreme[.]com.
When a user clicks on the download link, JavaScript code runs a system fingerprint as a second step of filtration.
Although the malware being utilized is different and more advanced here, it has been observed that certain malicious advertising campaigns check for the existence of emulators or virtual computers.
The user is sent to the official Notepad++ website if any of the tests don’t match. A distinctive ID is given to each prospective victim, enabling them to download the payload.
In addition to making each download distinct and restricted in duration, the unique ID is probably used for tracking reasons.
The payload of this malicious advertising campaign is a.hta script. If trying to download the file from the same URL, it encounters a 404 error.
“We believe this is part of the malicious infrastructure used by threat actors to gain access to victims’ machines using tools such as Cobalt Strike,” researchers said.
Recommendation
As a result, during the past few months, a rise in both the scope and sophistication of malvertising efforts has been noticed. Tracking harmful advertisements enables us to recognize and promptly stop the infrastructure threat actors utilize swiftly.
Following the malware distribution chain enables us to discover new methods that may be used to bypass existing security measures and update our detections accordingly.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
A few days ago, the latest Motorola Razr Plus security update rolled out to users in the US. This update is coming before two updates that some users are looking out for with eagerness. The first update users of this device are expecting is Android 14 and the second is the Moto Unplugged feature that is already available on some Razr devices.
While the new security update is small and doesn’t bring major changes, it helps apply new security patches to the device. The update is just 95.81 MB in size, and it brings Android security patches through 1 September 2023. Users of the Motorola Razr Plus will get a prompt on their device to install this update as soon as possible.
Users will be able to install the update from the System update page in the settings app. Some users are still expecting more updates to come in the coming weeks, one of which is already available on the more affordable Motorola Razr 2023 entry. This expected update will bring the Moto Unplugged feature to the Razr Plus, and here is what you need to know about this feature.
Users will need to wait for the Moto Unplugged feature on the Razr Plus
Android 14 is already rolling out to Pixel devices around the world, and other brands are planning the rollout timeline. Motorola, on their part, are yet to come out with an Android 14 rollout plan for their devices. This doesn’t mean that the brand is neglecting its rollout of updates to users, as the September security update is now available for users.
While users wait on the news for the Android 14 rollout, there is one feature that the Motorola Razr Plus is yet to get. This feature is already available for usage on the Motorola Razr, which is the base model for the 2023 line-up. Users of this more affordable device are getting the feature known as Moto Unplugged on their clamshell folding devices by default.
The Moto Unplugged feature is similar to Focus Mode on Android devices. It permits users to block off access to certain apps during a set period so that the user can focus. Well in Motorola’s case, this feature will help users to unplug from any distractions the set app might bring.
Of course, Motorola executes this productivity-oriented feature differently from that on Android’s Digital Wellbeing app. Users of the more affordable 2023 clamshell folding device from Motorola already have access to this feature. Motorola isn’t clear on when the Razr Plus will get this feature via an upgrade.
Users of this device just have to be patient as they expect a coming update to bring this feature. In the meantime, users will have to make do with the security update that the Razr Plus just got while waiting on other features. In the coming days, more information on the Motorola Android 14 rollout will become available.
Microsoft hasn’t really been open about the adoption rate of Windows 11, but we’ve been able to glean that it’s been pretty slow. Many people flat out don’t want the operating system on their computers. However, according to a new leak, it seems that the operating system is picking up some momentum. Windows 11 is currently on more than 400 million devices.
The adoption rate of new software is always slow at the start. Many people opt to wait a bit before installing, as to avoid the growing pains. Also, as newer operating systems fall into our laps, older and less powerful devices fall out of compatibility. So, a ton of potential adopters can’t get the update because their computers can’t handle it.
So, it shouldn’t be much of a surprise that Windows 11 had trouble gaining traction among Windows users. What made things worse was that Windows 11 had some pretty high spec requirements. So, it was moving along at a snail’s pace.
However, Windows 11 is on more than 400 million devices
Until now, we’ve been in the dark about how well Windows 11 was doing. But, nothing stays a secret forever. According to a leak from Windows Central, Windows 11 is doing better than we thought. The new operating system launched back in October of 2021, which makes this a convenient time for this leak to come out. It’s been able to reach north of 400 million monthly users in the span of about two years.
That’s still sluggish compared to Windows 10 which hit the 400 million mark just a year after its unveiling. However, 400 million is still nothing to scoff at. We can attribute some of the growth to the new Windows 11 computers hitting the market.
Windows 11 is on track to reach 500 million users by early 2024. As more computers become available with Windows 11, we will see this number continue to rise.
But, there could be something else down the pipeline
However, the future of Windows 11 is pretty uncertain, as there are rumors that Microsoft is planning on launching Windows 12 next year. If this is true, then it could be quite a shake-up. The rumors say that Microsoft is working on a major refresh for next year, and it was pretty much confirmed by Intel. This, in tandem with previous rumors that Windows 12 is coming in 2024 definitely makes us confident that this is happening.
The reason for this change isn’t completely known, but most believe that it has something to do with AI. Microsoft has been going bananas with its AI effort after the introduction of ChatGPT. It’s gone so far as to integrate generative AI into Windows 11. However, it could be possible that Microsoft wants to bring a new operating system that’s built from the ground up for AI. This new operating system could be Windows 12. There’s still a bunch of time to wait before we get any official information, so you’ll want to take this with a grain of salt.
However, when this feature launched, not all U.S. states were on board with the program. At the time, Maryland became the first state to support it, with the state ID literally becoming the poster child for the rollout, as can be seen in the marketing materials.
Meanwhile, support for additional states was promised for a later date, with Arizona, Colorado and Georgia listed as the next ones slated to join the Digital ID program. Surprisingly, and without much fanfare, that day has arrived sooner than we thought.
As spotted by user @xeno_x19 on X, Google has quietly rolled out support for these three states already, joining Maryland in the Google Wallet app. You can already see these states pop up when attempting to add an ID Card on the app. Considering there hasn’t been a versioned update to the Google Wallet app since October 3rd, we are inclined to think that this is a server-side push.
Digital ID setup via Google Wallet on Android
As reported by 9to5Google, the setup process requires a photo scan of the front and back of your physical ID or Driver’s License, followed by a short video verification process. Once setup has been completed, the digital ID will be themed with artwork that represents the issuing state — such as a peach to represent Georgia.
This update brings Google Wallet’s digital ID compatibility up to par with Apple Wallet, where the ability to have a mobile Driver’s License has been available in some states since last year. Samsung has also announced that this would be coming to Samsung Wallet later this year, and Google previously stated that more functionality will be added to digital IDs in the future, such as the ability to verify online accounts.
Synology DiskStation Manager (DSM) powers Synology NAS systems, offering remote file access and management. The DSM OS includes two default Linux users: ‘admin’ and ‘guest’ (usually disabled).
A Synology NAS system flaw allowed attackers to hijack the admin account due to a security vulnerability remotely.
Exploiting this flaw, malicious actors could gain unauthorized access to the admin account, potentially leading to complete control of the NAS system and access to stored data, highlighting the importance of promptly applying software updates to mitigate such risks.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
A note from the Math.random documentation ( Source – CLAROTY)
Synology NAS System Flaw
Researchers discovered a vulnerability in the admin password generation algorithm, leveraging a weakness in JavaScript Math.Random() function on the browser client side.
Set Up Window ( Source – CLAROTY)
By exposing a few Math.Random() generated values, the seed for the PRNG was reconstructed, enabling brute-force attacks to obtain and utilize the admin password. Leaking specific Math.Random values, such as GUIDs generated during the initial setup, allowed attackers to exploit this weakness.
For instance, these class-name GUIDs are produced during the initial installation using the same Math. Random seed as the admin password in the same ‘session’:
SYNO.SDS.PkgManApp.Instance
SYNO.SDS.AdminCenter.Application
SYNO.SDS.App.FileStation3.Instance
SYNO.SDS.HelpBrowser.Application
Synology DSM Admin Password Key Issue
“The vulnerability stems from the insecure Math.Random() PRNG is used in the algorithm, where knowledge of its seed allows predicting past and future numbers. The experts have exploited this in modern browsers that rely on the deterministic XorShift128 algorithm with a Python script using Z3 for symbolic execution.
Our PoC adapted to browser-specific XorShift128 variations, particularly in state calculation, double conversion, and value management, benefiting from prior research and V8 dev blog insights.”
Get Started With Your Synology NAS Windows (Source – CLAROTY)
The problem lies in using Math.Random() for cryptography, as its insecure PRNG can be exploited to predict numbers. Modern browsers use XorShift128, which we cracked using Z3, exposing past and future values.
Researchers have discovered this vulnerability during Pwn2Own, a fascinating moment but impractical for real-world exploitation. Nevertheless, it emphasizes the need for secure random number generation. Avoid Math.random() for security; opt for the Web Crypto API, specifically window.crypto.getRandomValues().
Researchers have reported CVE-2023-2729 to Synology, leading to a fix for affected devices. DSM 7.2 users should upgrade to version 7.2-64561 or higher.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
Right now, Threads is pretty light on features compared to X (formerly Twitter). However, Zuck and the gang have been working on introducing more useful features to the platform in order to win back its 100 million user base. Well, Instagram’s CEO, Adam Mosseri, just revealed some Threads features that might be a secret to most people.
When it first launched, Threads was pretty bare bones, and this led many folks to ditch it. We know that the user base has dropped off considerably since its peak. Now, the platform is working on retaining as many users as it can and building it back up. It’s still behind X by a large margin, but Elon Musk’s social media site is facing its own issues.
Threads has some features that are a secret to most users
Threads doesn’t have a ton of features, so when a new feature hits the scene, we know about it. For instance, it’s getting the ability for users to edit their posts. However, not every new feature receives fanfare; several additions fall under the radar. That’s not great, as new features are what will lead people back to the site.
So, what are these features? Mosseri outlined a handful of secret features for either mobile, web, or both of Threads. The first feature will let you paste media directly into a post. This is for the web version, and it lets you paste content directly into your post. It eliminates the need to save the file to your computer and upload it to Threads.
Next up, if you want to quickly follow a bunch of people who are interacting with a post, you can. Using the mobile app, simply hold your finger down on a post. You’ll see a list of the users interacting in that post, and it will give you the option to follow all of them. You can also pick and choose which ones to follow.
The last feature is for people who like to tag other accounts. Threads already gives you the ability to tag other Threads accounts. Now, you can also tag Instagram accounts. This is good if the account has much more content posted to Instagram than on Threads. Also, it could be helpful if that person hasn’t signed up for Threads yet.
Threads is still growing and developing, so you shouldn’t be surprised if you see more features coming as time goes on.
A few weeks ago, Android Auto users were facing an issue with the navigation bar on the app’s interface. It made the navigation bar disappear while in use, leaving the users stranded and not able to switch between apps. Last week, Google began rolling out a fix to this issue that was bringing lots of pain to its users around the world.
To fix the problem, Google had to roll out an Android Auto app update. Users were then encouraged to update their app via the Google Play Store, and this new app version brought a fix to the issue. After the update, users who noticed the disappearance of their navigation bar could wave goodbye to this problem.
The navigation bar on the Android Auto app is necessary for switching between various apps. Without this bar, users were stuck on a particular screen and not able to make use of other apps that they needed. This is an important and timely fix from Google, however, the team now has other bugs to look into and offer fixes as soon as possible.
After the Android Auto navigation bar issue, Google is turning its attention to the Pixel 8 series connection bug
Both devices in the Pixel 8 series have been making the headlines for weeks now, ever since their launch. These devices have been dropping jaws in the smartphone industry because of their performance and camera abilities. But now, they are making headlines for an issue that some users are noticing.
This new pain point has to do with the Android Auto connection on these devices. Some users are finding it hard to connect Android Auto on their Pixel 8 or 8 Pro to their vehicle’s infotainment system. Others are finding it hard to open the Android Auto app on their smartphones.
For the second group, the app on their smartphone goes into a frozen screen when opened. This is an issue as these users can’t make use of Android Auto from their devices when driving. Most of these users rely on Android Auto for not only navigation but also media controls.
Google is now looking into this bug to provide users with a fix. Users of the Pixel 8 and 8 Pro can now rest assured that a fix is on the way. At the moment, Google says that it is investigating the issue alongside other devices having similar problems.
This bug that some Pixel 8 and 8 Pro users are facing is not affecting all users. Some users can use Android Auto on their Pixel 8 or 8 Pro without any issues. In the coming days, Google will roll out a fix to this problem which will roll out via an app update.
Google recently gave the Fitbit app a makeover, aiming for a cleaner look and better organization of tabs. While the initial revamp aimed to prioritize health information, user feedback hinted at a less-than-perfect reception. Today’s Fitbit update addresses these concerns.
Taking cues from user input, Fitbit shared a list of upcoming changes for the Fitbit app (via 9to5Google). Expect design tweaks, new features, and enhanced customization options.
One immediate change is the display of tracker and smartwatch battery percentages in the Today tab’s top-left corner. No more navigating to the Devices page; it’s right there for quick access.
For Android users, the Steps streak feature, previously exclusive to iOS, is making its debut. Fitbit acknowledges the positive response as the reason for bringing it to the Android platform and returning it to iOS. Additionally, the Fitbit app now celebrates when you reach your daily step goal.
Addressing user concerns about too much white space in the stat cards, Google is streamlining the Today tab layout. The update aims to reduce spacing and optimize the overall design based on user feedback.
In a nod to customization, Fitbit reminds users that they can tailor the four stats displayed at the top of the Today feed in rings. No need to stick with the default settings; just tap the pencil icon in the top-right corner and navigate to “Custom preset.”
Looking ahead, a future app update will introduce the much-anticipated “Dark mode.” Fitbit is currently working on it, with the release scheduled for some point down the road. This feature will be a welcome addition, especially for those who exercise during early mornings or late nights.
Multiple vulnerabilities were detected in the SonicOS Management web interface and the SSLVPN portal, resulting in a firewall crash.
In a security alert that was just released by SonicWall, 9 vulnerabilities were patched. Organizations utilizing older SonicOS firmware releases are highly encouraged by SonicWall to update to the most recent firmware updates.
SonicWall Vulnerabilities
The post-authentication stack-based buffer overflow vulnerability, identified as CVE-2023-39276, has a CVSS score of 7.7. A flaw in the getBookmarkList.json URL endpoint causes a firewall crash.
The vulnerability was identified as CVE-2023-39277, with a CVSS score of 7.7. Post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicflow.csv. and appflowsessions.csv endpoints cause a firewall crash.
Following that is the bug identified as CVE-2023-39278, with a CVSS Score of 7.7; post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi, resulting in a firewall crash.
CVE-2023-39279, Post-Authentication Stack-Based Buffer Overflow, has a CVSS score of 7.7. A vulnerability in the getPacketReplayData.json URL endpoint causes a firewall crash.
The bug identified as CVE-2023-39280, which has a CVSS score of 7.7, the Post-authentication Stack-Based Buffer Overflow Vulnerability in the ssoStats-s.xml, ssoStats-s.wri endpoints cause the firewall to crash.
The Post-authentication Stack-Based Buffer Overflow bug CVE-2023-41711 has a CVSS score of 7.7. A vulnerability in the sonicwall.exp and prefs.exp endpoints cause the firewall to crash.
This vulnerability is designated as CVE-2023-41712 and has a CVSS score of 7.7 is a Stack-Based Buffer Overflow Vulnerability in the SSL VPN’s plainprefs.exp URL endpoint results in the firewall crash.
The vulnerability is tagged as CVE-2023-41713 with a CVSS Score of 4.3 and is a Use of Hard-coded Password in the ‘dynHandleBuyToolbar’ demo function.
The post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel, identified as CVE-2023-41715 with a CVSS Score of 6.4, allows users to escalate their privileges inside the tunnel.
Affected Products
“The vulnerabilities mentioned have no impact on SonicWall SSLVPN SMA100 and SMA1000 series products. Additionally, there is no substantiated evidence to suggest that these vulnerabilities are currently being actively exploited in real-world scenarios”, the company said in its advisory.
Fixes Available
SonicWall PSIRT advises administrators to only allow trusted sources access to the SSLVPN portal and SonicOS management until the updates are implemented. Multi-factor authentication is also advised.
