Passkeys are a new passwordless and phishing resistant sign-in method that is more secure and easier to use than passwords. Since the initial roll out, the use of passkeys has been available as an additional sign-in option for Google Accounts, without replacing current sign-in methods such as passwords and two-step verification.
Following the positive feedback received since implementing passkeys support, the company is attempting to further encourage their use by displaying prompts to create and use passkeys upon users signing in to their accounts. Additionally, a “Skip password when possible” toggle will now be available within Google account settings, so that users have an option to still use a password on sites or apps that have yet to get on board.
This means the next time you sign in to your account, you’ll start seeing prompts to create and use passkeys, simplifying your future sign-ins. It also means you’ll see the “Skip password when possible” option toggled on in your Google Account settings. – Google
To use a passkey, you will need to create one on your device. This can be done using a fingerprint sensor, facial recognition, or a PIN. Once you have created a passkey, you can use it to sign in to websites and apps that support them by authenticating yourself using those same biometric methods. Nothing is saved on the site or app itself, and the hassle of having to remember complicated passwords — or worse, writing them down on a piece of paper instead of using a password manager — is removed.
Google knows that passkeys won’t just become the new standard across the industry overnight, and acknowledges that passwords will still be around for a while. However, that is not stopping the company from encouraging others to pivot and adopt them so we could be one stop closer to a password-less future.
A command injection vulnerability has been discovered in the D-Link DAP-X1860 range extender, allowing threat actors to execute remote code on affected devices. The CVE ID for this vulnerability has been given as CVE-2023-45208, and the severity is being analyzed.
This vulnerability exists in the Wi-Fi network scanning functionality, which threat actors can exploit. D-Link has not yet patched this vulnerability, nor did they respond to any comments regarding this issue.
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
CVE-2023-45208 – Command Injection Vulnerability in D-Link
A threat actor can create a Wi-Fi network with a crafted SSID within the range of the extender and can execute commands during the setup process. Command injection was also possible when using the network scan function of the range extender.
The extender uses the “GetSiteSurvey” SOAP action to identify nearby networks. If any networks have an apostrophe(‘) on their SSID (for example, `Olaf’s Network`), the setup process crashes repeatedly with a response below.
———————————————————————— Error 500: Internal Server Error CGI program sent malformed HTTP headers: [0 1 ***** **:**:**:**:**:** WPA2PSK/AES 7 11b/g/n NONE In 17 YES NO 1 1 ***** **:**:**:**:**:** WPA2PSK/AES 24 11b/g/n NONE In 13 YES NO 2 1 ***** **:**:**:**:**:** WPA2PSK/AES 47 11b/g/n/ax NONE In 13 YES NO 3 1 ***** **:**:**:**:**:** WPAPSKWPA2PSK/TKIPAES 81 11b/g/n NONE In 7 YES NO 4 1 ***** **:**:**:**:**:** WPA2PSKWPA3PSK/AES 63 11b/g/n/ax NONE In 19 YES NO 5 1 ***** **:**:**:**:**:** WPA2PSK/AES 44 11b/g/n/ax NONE In 5 NO NO 6 1 Olafs Network **:**:**:**:**:** WPA2PSK/AES 47 11b/g/n/ax NONE In 20 NO NO sh: 7: not found sh ————————————————————————
Crash response (Source: Redteam-pentesting)
This can be used for performing a denial-of-service attack on the extender. However, arbitrary command execution can be achieved by including commands on the SSID name, like `uname -a`, which results in the command being executed successfully.
Error 500: Internal Server Error CGI program sent malformed HTTP headers: [0 1 ***** **:**:**:**:**:** WPA2PSK/AES 0 11b/g/n NONE In 17 YES NO 1 1 Test Linux dlink-rp 4.4.198 #3 SMP Mon Jan 11 10:38:51 CST 2021 mips GNU/Linux sh: **:**:**:**:**:**: not found sh: 2: not found sh: 3: not found sh: 4: not found […] sh: 40: not
Red team-pen testing has published a complete report about this vulnerability, which provides detailed information about the Proof-of-concept, Security Risk, Timeline, and disclosure of this vulnerability.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
Thousands of WordPress websites have been hacked as hackers exploit a vulnerability in the tagDiv Composer front-end page builder plugin.
The vulnerability is tracked as CVE-2023-3169.
It lets attackers inject malicious code into a particular location in the site’s database and propagate the code to every public page of the targeted area.
Balada malware campaign reportedly exploits a recently patched vulnerability in Newspaper and Newsmag premium themes’ key component tagDiv Composer front-end page builder plugin.
After obtaining initial access, attackers can upload backdoors, add malicious plugins, and create admin accounts to gain persistent access.
This vulnerability was fixed in the plugin’s version 4.2.
Web developers using WordPress themes Newspaper and Newsmag must remain cautious as a recently patched vulnerability is being exploited to gain full control of a website. The vulnerable plugin is tagDiv Composer, an essential component of the Newspaper and Newsmag themes. These themes are available via the Theme Forest and Envato marketplaces, boasting over 155,000 downloads.
Vietnamese researcher Truoc Phan detected it first. It is tracked as CVE-2023-3169 and carries a severity rating of 7.1 out of 10, which is Medium. It was partially fixed in version 4.1 of tagDiv Composer and fully patched in version 4.2.
According to security firm Sucuri’s researcher Denis Sinegubko, threat actors exploit this cross-site scripting (XSS) vulnerability to inject malicious code in webpages, redirecting visitors to scam or compromised websites.
These sites offer fake tech support, push notification scams, and fraudulent lottery wins to lure users. Push notification scams force users into subscribing by displaying fake captcha dialogues.
The most concerning aspect of this research is that threat actors have already compromised thousands of WordPress websites. On NIST’s National Vulnerability database, it is reported that the tagDiv Composer WordPress plugin versions before 4.2 didn’t have authorization in a REST route and didn’t validate or escape some parameters when outputting them back.
This allows unauthenticated users to conduct Stored Cross-Site Scripting attacks. Exploiting this flaw, an attacker can inject malicious code into a website.
It is worth noting that this vulnerability originated in a malware campaign dubbed Balada by Sucuri. The company has been tracking it since 2017, when it was first detected, and estimates that since 2017, the malware has compromised over one million websites.
In September 2023, Balada injections were seen on more than 17,000 websites and 40,000 users. Over 9,000 of the newly detected infections resulted from injections facilitated by CVE-2023-3169.
Balada group prefers to gain persistent control over compromised websites by injecting scripts that create accounts with administrator rights. When real admins detect it, they remove the redirection but keep the fake admin accounts. The threat actor uses the admin privileges to create a new set of malicious redirect scripts.
Commenting on this story is Chris Hauk, Consumer Privacy Advocate at Pixel Privacy said, “Unfortunately, plugins and themes are favourite targets of hackers looking to exploit weaknesses in the WordPress ecosystem.”
Chris warned that “This flaw was only recently patched in the tagDiv Composer plugin, so there are likely still thousands upon thousands of WordPress sites using the old version of the plugin. WordPress admin should immediately update their plugins and templates to protect against this hack,” he advised.
It is necessary for any web developer or website administrator using WordPress themes Newspaper and Newsmag to inspect the site and event logs to detect signs of infection. Apart from removing malicious scripts, they must check for newly added admin accounts and backdoor code. Those still using the old version must immediately switch to TagDiv version 4.2 to prevent infection.
Amazon’s Prime Big Deal Days are going strong, and that includes a pretty nice discount on the new Apple Watch Ultra 2. It’s now $50 off, making it just $749. Not a steep discount, but remember, this did just come out last month. So this is a pretty good discount in that regard.
The Apple Watch Ultra 2 has been pretty popular, like its predecessor, because of the bigger display and battery life. So this is a 49mm watch, and the battery life is double what the regular Apple Watch is. Apple claims about 36 hours of usage here. But you’ll likely get 2-3 days of use.
You also get a dedicated button, which Apple calls the Action Button here. You can map this to do all sorts of things. Like starting a workout. The Apple Watch Ultra 2 does run on watchOS 10, which was a pretty big upgrade this year for the Apple Watch, including bringing widgets over to the wrist.
It’s a really good watch to pick up, especially if you’re already in the Apple ecosystem, and it will last. That is because this is a titanium watch, with a sapphire display. Meaning that it’s going to be pretty tough to scratch this one up.
You can pick up the Apple Watch Ultra 2 from Amazon at the link below. Remember this deal is available during Prime Big Deal Days only, ending on October 11, at 11:59PM PT. You also need to be a Prime member to get this deal, which you can sign up for a free trial here.
Earlier this year, OnePlus released its first table, and it’s an affordable device. Well, the OnePlus Pad is even more affordable during Amazon Prime Day. The OnePlus Pad is now even more affordable with the deep $80 discount bringing the price down to $399.99 from $79.99.
One of the best qualities of this tablet is the display. The OnePlus Pad has an 11.61-inch LCD display with an impressive 144Hz refresh rate. While it’s an LCD display, it’s still a beautiful and colorful display. It has a unique 7:5 aspect ratio that OnePlus calls the ReadFit display. It’s great for reading content.
Moving onto the internals, this tablet uses the powerful Dimensity 9000 SoC. This delivers a ton of power with excellent performance and gaming chops. Backing that up, we have 8GB of RAM that can be extended to 12GB via storage.
The OnePlus Pad has a set of powerful quad speakers. They deliver a powerful sound that will greatly augment the movies, TV shows, or games that you’re playing. It’s there if you need to put your Bluetooth speaker away. The speakers also have Dolby Atmos, so you’ll be able to tune the audio to your liking.
The OnePlus Pad comes with Android 13 out of the box, and OnePlus did a great job optimizing OxygenOS to work on the tablet. This is thanks to the work that Google did to make Android more tablet-friendly. So, everything in the software just flows and reacts perfectly.
When it comes to gaming, the software has a game boost that will overclock the processor and give you amazing gaming performance. You can play through graphically intensive games like Genshin Impact at their highest settings without a hiccup. It’s definitely the tablet to get if you want a powerful tablet experience at a great discount.
It’s been quite the ride since 2020 when a legal war began between Sonos and Google, claiming theft and patent infringement, resulting in an import ban on a number of Google smart home products including Nest, Chromecast, and Pixel smartphones. Additionally, as the two companies have continued to go back and forth suing each other, the consumer paid the price by losing key functionality on their devices.
One of the changes Google had to implement in order to comply with the cease and desist court order that was placed on the company, was to make changes to the way its smart home devices could be controlled by users. After a software update, Google removed the ability to add Nest speakers, displays, and Chromecast devices to multiple speaker groups, among other software limitations.
Today, in a scathing blog post, Google has provided an update on the ongoing case, adding that last week a federal judge ruled in its favor when it pertains to two of the patents in question. The court wrote the below in its decision:
This was not a case of an inventor leading the industry to something new. This was a case of the industry leading with something new and, only then, an inventor coming out of the woodwork to say that he had come up with the idea first — wringing fresh claims to read on a competitor’s products from an ancient application.
In fact, in 2014, five years before Sonos filed the applications and presented the claims, accused infringer Google LLC shared with Sonos a plan for a product that would practice what would become the claimed invention… Google then began introducing its own products that practiced the invention in 2015. Even so, Sonos waited until 2019 to pursue claims on the invention (and until 2020 to roll out the invention in its own product line).
Devices will now be able to live in multiple speaker groups
Following the announcement of the legal decision, Google swiftly took to its Google Nest Community with a post advising that it will be rolling back the changes made to speaker groups where devices could only belong to one speaker group at a time. Therefore, an update to the Google Home app for Android will be coming in the next 48 hours and soon on iOS. Affected units, such as Nest speakers, displays, and Chromecast devices, will also be updated with this change.
While this is great news for those of us that own Google smart speakers, let’s not all celebrate too soon. According to Reuters (via 9to5Google), Sonos has responded to the decision by stating that it was “wrong on both the facts and the law” and that an appeal would follow. Let’s hope this war between Google and Sonos doesn’t continue to affect us, the consumers.
Protecting personal data is a growing concern, with local storage as the last line of defense. Even here, precautions are needed against adversaries like thieves, and at this point, disk encryption offers solutions for this threat.
But disk encryption alone can’t protect against powerful adversaries who can coerce users into revealing encryption keys.
Plausible deniability (PD) is a security measure to hide crucial data’s existence, allowing users to deny its presence to violent adversaries.
Elia Anzuoni and Tommaso Gagliardoni from their following respective university and organizations recently unveiled “Shufflecake,” a stealthy data concealment technique, inheriting the legacy of TrueCrypt and VeraCrypt:-
EPFL, Switzerland
Kudelski Security, Switzerlan
DocumentFREE Demo
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
Shufflecake Hidden Linux Filesystems
Plausible deniability (PD) approaches vary by the storage layer they target, with filesystem-level and FTL-level options.
Each has pros and cons, but adversaries can compromise layer-specific solutions with access to lower layers.
A robust plausible deniability (PD) approach operates at the block layer, using a block device interface with bRead and bWrite methods.
This framework formats one device with multiple encrypted volumes, including decoy volumes. Even after surrendering passwords for decoy volumes, PD ensures the hidden volumes remain undetectable to adversaries.
Early PD research mainly focused on single-snapshot adversaries, assuming devices would only be checked once. However, modern storage, especially SSDs, can leave traces of data changes, challenging single-snapshot security. This scenario is addressed in multi-snapshot security models.
Addressing multi-snapshot attacks in PD systems, especially with TrueCrypt and derivatives, poses challenges. Some solutions, like oblivious random access machines (ORAMs), offer multi-snapshot security but at significant performance costs.
WoORAMs, which obfuscate write requests, provide an efficient alternative for post-arrest physical layer adversaries, sparking a new research direction for multi-snapshot-resistant PD solutions.
The landscape of available PD solutions has usability and security gaps, with limited adoption. VeraCrypt is the most widespread but has limitations.
WoORAM-based alternatives have potential but suffer significant performance drawbacks. Additionally, read requests’ impact on the physical device state is uncertain.
Many PD solutions, including TrueCrypt, may unintentionally leak hidden data through OS behaviors. A versatile PD solution balancing security and usability is lacking, particularly for Linux.
Shufflecake’s disk layout (Source – Arxiv)
The device’s storage is divided into a header and data sections. The header includes a fixed-size DMB and equal-sized volume headers, preventing easy volume count deduction by header size.
Shufflecake offers operational advantages over TrueCrypt and is open-source to build trust and encourage community contributions for future enhancements.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
This week on the Lock and Code podcast, we speak with Bay Area teenager Nitya Sharma—for the second year in a row—about what she’s most worried about online and what she does to stay safe.
This week on the Lock and Code podcast…
What are you most worried about online? And what are you doing to stay safe?
Depending on who you are, those could be very different answers, but for teenagers and members of Generation Z, the internet isn’t so scary because of traditional threats like malware and viruses. Instead, the internet is scary because of what it can expose. To Gen Z, a feared internet is one that is vindictive and cruel—an internet that reveals private information that Gen Z fears could harm their relationships with family and friends, damage their reputations, and even lead to their being bullied and physically harmed.
Those are some of the findings from Malwarebytes’ latest research into the cybersecurity and online privacy beliefs and behaviors of people across the United States and Canada this year.
Titled “Everyone’s afraid of the internet and no one’s sure what to do about it,” Malwarebytes’ new report shows that 81 percent of Gen Z worries about having personal, private information exposed—like their sexual orientations, personal struggles, medical history, and relationship issues (compared to 75 percent of non-Gen Zers). And 61 percent of Gen Zers worry about having embarrassing or compromising photos or videos shared online (compared to 55% of non Gen Zers). Not only that, 36 percent worry about being bullied because of that info being exposed, while 34 percent worry about being physically harmed. For those outside of Gen Z, those numbers are a lot lower—only 22 percent worry about bullying, and 27 percent worry about being physically harmed.
Does this mean Gen Z is uniquely careful to prevent just that type of information from being exposed online? Not exactly. They talk more frequently to strangers online, they more frequently share personal information on social media, and they share photos and videos on public forums more than anyone—all things that leave a trail of information that could be gathered against them.
Today, on the Lock and Code podcast with host David Ruiz, we drill down into what, specifically, a Bay Area teenager is afraid of when using the internet, and what she does to stay safe. Visiting the Lock and Code podcast for the second year in the row is Nitya Sharma, discussing AI “sneak attacks,” political disinformation campaigns, the unannounced location tracking of Snapchat, and why she simply cannot be bothered about malware.
“I know that there’s a threat of sharing information with bad people and then abusing it, but I just don’t know what you would do with it. Show up to my house and try to kill me?”
During Amazon Prime Big Deal Days, it is discounting Anker’s newest power station, the SOLIX F1200, which is a 1229Wh battery that can power your home. It’s currently on sale for $699, which is half off of its regular price. So now is a really great time to grab one.
The SOLIX F1200 is a really good purchase for anyone that goes camping, or loses power quite often. It can actually power your home, and work as a generator, as well as having Solar Panels available for recharging at the same time.
This one has four USB-A ports, two USB-C ports and six AC outlets. There is also a car socket available, so you can plug in any car accessories to this as well. As if that wasn’t enough, Anker has included a nice bar light at the top, which acts as a flashlight and gives you light when there’s no power.
I have a similar one to this, which I’ve had to use quite a few times this Summer, thanks to these insane storms. And it works really well. It’s a purchase that everyone should make. Because you never know when you won’t have power, nor for how long.
You can pick up the Anker SOLIX F1200 from Amazon at the link below. Remember this deal is available during Prime Big Deal Days only, ending on October 11, at 11:59PM PT. You also need to be a Prime member to get this deal, which you can sign up for a free trial here.
CYFIRMA shared a report for September 2023, detailing ransomware threats from last month. The company pulled out some interesting tidbits that occurred last month, as a number of different ransomware groups were active.
CYFIRMA details ransomware attacks that occurred last month
Let’s kick things off with LockBit. This ransomware group emerged as a “significant threat”, says the company. It claimed 79 known victims last month. The manufacturing sector has seen the most attacks, with 80 of them being reported.
The company also says that the USA was the most targeted region last month, with 237 incidents overall. When compared, August and September 2023 were on the same playing field when it came to ransomware attacks.
Some notable incidents include MGM Resorts, which have been hit by a major cyber incident. That incident forced the shutdown of its internal networks as a precaution. AlphV ransomware affiliate is to blame.
Save the Children International, a nonprofit organization, has also suffered a ransomware attack last month. The hackers managed to acquire nearly 7TB of data. Johnson Controls International also got attacked, while several more reports were shared.
LockBit claimed most victims last month
LockBit claimed 79 victims last month, LostTrust 53, while AlphV is responsible for 49 incidents. RansomedVC and Cactus affected 44 and 33 victims, respectively.
Manufacturing was the most targeted industry by ransomware, followed by Real Estate & Construction, Health Care, E-commerce & Telecommunication, FMCG, Government, Banking & Finance, and IT sectors.
The US was the most hit country with 237 attacks. It is followed by the UK with 27 attacks, Canada with 24, Germany with 14, and France with the same number of attacks.
Needless to say, ransomware has been on the rise for years now. We’ve been seeing quite a few notable incidents from one month to the next. Chances are this won’t change anytime soon, but let’s hope we won’t see major growth either.
