Here’s Google’s true vision of AI-powered mobile software

0
[ad_1]

If you think Google’s AI implementation in Android was cool, well the company has yet to take off its weighted training clothes. The company has a lot to fear with Apple Intelligence looming over the horizon. Thanks to an exclusive report from Android Authority, we have information on what the company calls Google AI, and it’s coming to the Pixel 9.

This is Google AI, and it’s going to make the Pixel 9 awesome!

While this news came from a reputable source, you’ll still want to take it with a grain of salt. We’re still dealing with early information. So there’s the chance that some of the potential features could be taken away.

Google AI (1)
From Android Authority

Add Me

First on the list, there’s a feature called Add Me. Right now, we don’t really know what the feature will do. However, the description reads “Make sure everyone’s included in a group photo”. That’s pretty vague. There’s a chance that it’s a tool to warn you if someone in a group photo could be cut off before taking a picture.

As for what it could do to a picture after the fact, we have no idea. Maybe the company will use Generative AI to reconstruct a person who was cut off in a picture. Say, if you take a picture, and your friend’s head is cut off. Well, Google could use Generative AI to zoom out of the image and reconstruct the rest of your friend. That’s only speculation.

Studio

Next up, there’s a feature called Studio. Again, information about this feature is still pretty scarce. The description reads “You imagine it. Pixel creates it.” This is also vague, but there’s information we can glean from it. It seems like a one-stop shop for you to generate content right on your phone.

We’re sure that you’ll be able to generate images and edit them all in one place. You might be able to catalog your generations and share them. Android Authority also mentioned that you might be able to generate stickers. That all remains to be seen.

Screenshots

This next feature will let Gemini glean information from an unexpected source, your screenshots. When you take a screenshot, the system will automatically apply metadata tags to it. This will have information like the links, app names, etc. Then, the information will be stored and processed locally. So, if you need to recall information about what you screenshotted, ask questions about them, or recall specific screenshots, you’ll be able to.

This calls to mind Microsoft’s Windows Recall feature. It also let you recall information from screenshots taken on your device. However, Google AI’s take won’t automatically take screenshots on your phone. Rather, it will only use screenshots that you willingly take. That’s good because Google doesn’t need any more controversy surrounding its AI.

Still outmatched

Guys, let’s be realistic, Apple blew away the tech community with Apple Intelligence. The features that the company announced will make using future iPhones much better. The AI in these phones will be super integrated with the software.

Hearing the news about Google AI, we all thought that we were going to see some comparable and powerful AI chops from Google. Queue the articles with thumbnails depicting an iPhone 16 Pro and Pixel 9 on a boxing ring background and PNG images of boxing gloves pasted over them. We were hoping to see a smackdown.

However, it seems that Google AI won’t be the competitor that Apple Intelligence needs and deserves. Google AI just looks like a couple of features tossed on top of Android rather than a marriage of software and AI. Let’s hope that Google will bring more features and integration in the near future.


[ad_2]
Source link

Grasshopper Hackers Mimic as Penetration Testing Service to Deploy Malware

0
[ad_1]

Hackers often mimic penetration testing services to disguise their malicious activities as legitimate security assessments. 

By imitating authorized security testing, attackers can exploit the trust and access typically granted to legitimate penetration testers, allowing them to move more freely within networks and systems while avoiding immediate suspicion.

While the Israeli government investigated possible threats, it discovered an infection chain using a suspicious domain as a command and control server. 

Public malware and custom components are mixed in this attack. 

Grasshopper as Pen Test Services

Late 2023 saw targeted attacks launched against private companies that used common techniques, target-specific infrastructure, and custom WordPress sites for payload delivery.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo 

These campaigns affect diverse entities across unrelated sectors. 

However, since it may not be a genuine security firm, this information should have been shared with the cybersecurity community without linking to recognized security firms or legitimate penetration testing operations.

The infection chain, probably targeting an Israeli government entity, begins with a VHD file, a pretty custom WordPress website.

Specifically crafted delivery WordPress website (Source – Harfanglab)

It’s a VHD that comes with all the hidden files, like the HTA file, which has an image as the decoy and transfers malware components to the %TEMP% folder, followed by launching a first-stage Nim downloader.

Decoy image displayed when the HTA is executed (Source – Harfanglab)

This downloader retrieves a second-stage payload from a controlled server. The final payload combines Donut, a shellcode generation framework, with Sliver, an open-source Golang trojan.

Donut disables security measures such as AMSI and WLDP before running Sliver, which gives the attacker full control of the victim’s machine through a specified command and control server.

More investigations revealed another infrastructure the operators probably used for such attack campaigns.

Infection chain (Source – Harfanglab)

These domains are fakes corresponding to popular brands such as Carlsberg and SintecMedia, although some may not have been related to intelligence gathering in general.

One of these campaigns posed as the Israeli government intending to aim at individuals or local businesses.

A famous WordPress site connected a VHD file and URL that was once redirected to a “rickroll” video, perhaps part of geofencing techniques.

The targets do not seem to have any common pattern, as the fake brand identities could mean different things.

⁤This campaign’s intriguing aspects include its narrow scope, targeted approach, and use of mostly open-source tools. ⁤

⁤However, the commonly available tools could be employed for conducting sophisticated operations, making it difficult for threat researchers to analyze these attacks.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link

Meta changes its AI label after complaints

0
[ad_1]

The next big step for AI companies is a proper labeling system to let people know when content has been artificially generated. Companies like Meta have been ahead of the game in that regard, but it still has a few bugs to work out. According to a new report, Meta had to change its AI label to “AI Info” after complaints from photographers.

The company has had a system in place that flags content it feels could have been generated with AI. Most of the AI-generated images on the platform are obvious, but the technology has progressed to the point where some media can fool the eye. This is why a proper labeling system is important.

We’re currently in an election year, and, let’s be honest, Facebook isn’t exactly known for being a platform full of accurate information. So, there’s always the threat of misinformation through AI-generated images.

Meta had to change its AI label after complaints from photographers

One issue we have to deal with, aside from no AI labels, is companies falsely labeling content as AI-generated. This is something that photographers have dealt with for some time, as Meta seems to be labeling real-life images as AI-generated. One example was from a 40-year-old photo of a baseball game. As you could guess, AI image generation wasn’t all that great back in 1984.

So, as a result, Meta has changed its “Made with AI” label to “AI Info”. This seems like a small change, but it’s something that the company hopes will keep it out of hot water. Rather than saying that the image was constructed with AI technology, it will basically say that there could have been some AI manipulation involved.

Many images posted nowadays were edited with some sort of AI tool like Photoshop’s Generative Fill tool. The thing is that, when certain tools like them are used, Photoshop adds metadata to the image letting the platform know that AI was used. Platforms like Facebook, Instagram, and Threads use this data to tell whether there was some AI manipulation.

Right now, we’re still waiting for a proper labeling system, but we’re not sure that it’s ever going to come. The companies working on the labeling systems are also pouring billions of dollars into making AI images look more realistic.


[ad_2]
Source link

Hackers Using Polyglot Files In Wild, Here Comes PolyConv For Detection

0
[ad_1]

Polyglot files have to fit in several file format specifications and respond differently depending on the calling program.

This poses a significant risk to endpoint detection and response (EDR) systems and file uploaders, which mainly rely on format identification for analysis.

By evading correct classification, polyglots can leap over feature extraction routines or signature comparisons found in malware detection systems.

Research by the following researchers from Oak Ridge National Laboratory and Assured Information Security indicates that polyglots are threats to commercial EDR tools, with 0% detection of malicious polyglots recorded during tests by some vendors:-

  • Luke Koch
  • Sean Oesch
  • Amul Chaulagain
  • Jared Dixon
  • Matthew Dixon
  • Mike Huettal
  • Amir Sadovnik
  • Cory Watson
  • Brian Weber
  • Jacob Hartman
  • Richard Patulski

The dependence on standard formats for efficient malware detection makes it vulnerable to this kind of attack whereby files can be created that are valid in multiple formats.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

Polyglot Files Used In Wild

There is a critical gap in computer security research because no one has done an extensive study on how threat actors use these artifacts and how they are detected.

Polyglot files in malware campaigns were found to play a significant role in the tactics of APT groups.

To carry out an analysis, they developed Fazah, a tool imitating real-life polyglot creation methods.

Researchers trained PolyConv, a deep learning model that attained over 99% F1 score for both binary and multi-label classifications of polyglots.

These were not very effective compared to already existing tools used to identify files.

Functionality of a polyglot (Source – Arxiv)

For image-based polyglots, the most popular means was via custom CDR tool (ImSan) which is more efficient than YARA rules in sanitizing it with 100% efficacy.

This research fills essential gaps within cybersecurity defenses against this advanced threat by providing useful information on techniques of detecting and mitigating them as well as awareness of polyglot format detection strategies.

Malware detector (Source – Arxiv)

Threat actors often use polyglots to avoid detection and bypass commercial security tools.

Out of the 30 different polyglot samples found in these cyber-attack chains 15 instances were detected.

Common combinations are JAR+JPG and HTA+CHM, which are used by groups such as Lazarus and IcedID.

MalConv Architecture (Source – Arxiv)

PolyConv based on MalConv and PolyCat using CatBoost machine learning models demonstrate encouraging results in the detection of polyglots through byte-level features and format-agnostic approaches.

PolyConv Architecture (Source – Arxiv)

With mime-type and n-gram features added, the performance of PolyCat improved.

For this reason, detecting polyglots becomes an important way of increasing our cybersecurity defenses against advancing dangers.

Recommendations

Here below we have mentioned all the recommendations:-

  • Polyglot Detection
  • Existing Signature-based Tools
  • File-format Specifications

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link

Prudential Financial data breach impacts 2.5 million people, not 36,000 as first thought

0
[ad_1]

In February 2024, Prudential Financial reported it had fallen victim to a ransomware attack. The attack was discovered one day after it started, but not before some 2.5 million people had been impacted by the resulting data breach.

As one of the largest insurance companies in the US, Prudential employs 40,000 people worldwide and reported revenues of over $50 billion in 2023.

At first, Prudential said it believed only 36,000 people had had their data stolen, but that number has now been revised to 2.5 million in a new breach notification. The company has also adjusted what information has stolen. In the original notification the company stated:

“On the basis of the investigation to date, we do not have any evidence that the threat actor has taken customer or client data.”

However, Prudential is now saying the stolen data also impacted many customers and included:

  • Full names
  • Driving license numbers
  • Non-driving license identification cards

The data breach notification states that the company will be giving affected customers 24 months of identity theft and credit monitoring services through Kroll.

Below are some general tips on what to do after you’ve fallen victim to a data breach.

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

  • Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
  • Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
  • Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
  • Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
  • Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
  • Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
  • Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.


We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.


[ad_2]
Source link

Next Google Pixel foldable to offer improved multitasking

0
[ad_1]

The next Google Pixel foldable smartphone is coming this year, and it’s expected to offer improved multitasking and more. This information comes from Mishaal Rahman who shared it via Android Authority.

The next Pixel foldable phone will offer improved multitasking & new display aspect ratio

Mishaal spotted some changes in the Android 14 QPR2 code, which suggests we’re in for a treat. Users will seemingly be able to put apps side-by-side even when the device is in portrait mode.

Next Google Pixel Fold device to offer improved multitasking

Many Pixel Fold users were missing this feature, us included. It’s nice to see that Google is planning to finally put it on the table. That foldable is also coming with a new display resolution, at least for its main screen.

The device, which is rumored to be called the Pixel 9 Pro Fold for whatever reason, is expected to offer a 2076 x 2152 resolution. As a reminder, the Pixel Fold has a 2208 x 1840 resolution on the main screen. Google is definitely looking to change the aspect ratio.

The upcoming foldable from the company will have a more squarish main display than the first-gen model. Well, at least based on this information. Now, in regards to the name.

This foldable phone could be called the Pixel 9 Pro Fold, for better or worse

This information surfaced back in April. Google is allegedly planning to name the device the Pixel 9 Pro Fold, to keep things uniform. The Pixel 9, Pixel 9 Pro, and Pixel 9 Pro XL are coming. So, the Pixel 9 Pro Fold name kind of falls in line here.

It is a mouthful, and quite frankly it’s not our favorite, but it does fit here. The Pixel Fold 2 would still make a lot more sense, but we can see why Google could make this change.

Now, the Pixel 9 series is coming on August 13. Google decided to host that event two months early this time around, for whatever reason. The event was expected to take place in early October, as per usual.

Google already confirmed that Pixel phones are coming. We’re sure that the Pixel 9, Pixel 9 Pro, and Pixel 9 Pro XL are coming… but we’re still not sure about the foldable device. It probably is, but it remains to be seen.


[ad_2]
Source link

My Favorite Robot Vacuum is currently $250 off!

0
[ad_1]

The ECOVACS DEEBOT T30S COMBO robot vacuum is on sale over at Amazon right now for just $950.99. This is an expensive robot vacuum, don’t get me wrong, but it is worth every penny. It is currently my favorite robot vacuum on the market, and as someone that has reviewed no less than 7 robot vacuums in the past 12 months, that’s saying something.

In my review of the ECOVACS DEEBOT T30S COMBO, I called it “The Most Innovative Robot Vacuum Yet”, and I still feel that way. And it’s pretty simple. This “Combo” includes a hand vacuum that docks with the robot vacuum and can auto empty, like the robot vacuum. Making cleaning so much easier, and giving you a one-stop-shop for your vacuuming needs. This lets you break out the handheld vacuum when you need to clean something up easily and then dock it away again without breaking out the robot vacuum.

The robot vacuum is also pretty impressive. ECOVACS has done some pretty incredible things with its mopping functionality, and this one does have two actual mops on the bottom instead of mopping pads. One of them actually pops out to clean the corners and edges of the room better. The dock can clean these mopping pads and dry them, making them nice and clean for the next run-through.

ECOVACS has also included its anti-tangle technology that keeps the rollers from getting tangled in hair. Honestly, I was pretty skeptical about this when I was briefed on the vacuum. But having a dog that is always shedding, I knew I’d put it to the test. And to my surprise, it worked out very well. It never got tangled in about three months of using the vacuum.

You can grab your own ECOVACS DEEBOT T30S COMBO from Amazon at the link below.

Buy at Amazon


[ad_2]
Source link

Google to offer $250,000 for Full VM Escape Zero-day Vulnerability

0
[ad_1]

Google has unveiled kvmCTF, a new vulnerability reward program (VRP) explicitly targeting the Kernel-based Virtual Machine (KVM) hypervisor.

This initiative, first announced in October 2023, underscores Google’s commitment to enhancing the security of foundational technologies like Linux and KVM, which are integral to many of its products, including Android and Google Cloud.

KVM, a robust hypervisor with over 15 years of open-source development, is widely used across consumer and enterprise landscapes.

Google, an active contributor to the KVM project, has designed kvmCTF as a collaborative platform for identifying and remediating vulnerabilities, thereby hardening this critical security boundary.

The program is similar to kernelCTF but focuses on zero-day vulnerabilities, previously unknown security flaws.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

Participants in kvmCTF will have access to a lab environment to log in and utilize their exploits to obtain flags.

The program will not reward exploits that use n-day vulnerabilities, ensuring the focus remains on discovering new, unpatched vulnerabilities.

Details regarding any discovered zero-day vulnerabilities will be shared with Google only after an upstream patch is released, ensuring that Google receives the information simultaneously with the rest of the open-source community.

Reward Tiers and Participation

The kvmCTF program offers substantial rewards for various levels of the following vulnerabilities:

  • Full VM escape: $250,000
  • Arbitrary memory write: $100,000
  • Arbitrary memory read: $50,000
  • Relative memory write: $50,000
  • Denial of service: $20,000
  • Relative memory read: $10,000

To facilitate the discovery of these vulnerabilities, kvmCTF provides the option of using a host with Kernel Address Sanitizer (KASAN) enabled, which helps identify memory errors.

Participants will engage in a controlled environment with a bare metal host running a single guest VM.

They can reserve time slots to access the guest VM and attempt guest-to-host attacks, aiming to exploit zero-day vulnerabilities in the KVM subsystem of the host kernel.

Successful attackers will obtain a flag as proof of their accomplishment, and the severity of the attack will determine the reward amount.

How to Get Involved

To participate in kvmCTF, interested individuals must start by reading the program’s rules, which provide detailed information on reserving a time slot, connecting to the guest VM, and obtaining flags.

The rules also explain the mapping of various KASAN violations with the reward tiers and offer instructions on reporting a vulnerability.

Google’s kvmCTF initiative represents a significant step forward in the collaborative effort to secure open-source technologies.

By offering substantial rewards for discovering zero-day vulnerabilities, Google aims to engage the global security community in its mission to enhance the security and reliability of the KVM hypervisor, ultimately benefiting users worldwide.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link

Galaxy S25 to offer AI upscaling for games thanks to its SoC

0
[ad_1]

There is a lot of confusion around Samsung‘s chip strategy for the Galaxy S25 series. Rumors have hinted at the possibility of a Snapdragon exclusivity, a Snapdragon-Exynos dual-chip strategy, or a three-pronged strategy with MediaTek in the mix. While we wait for the dust to settle, a new rumor has revealed exciting information about the upcoming Samsung flagships. The Galaxy S25, at least the Snapdragon-powered units, will allegedly support FSR/DLSS-like AI upscaling for games.

Snapdragon-powered Galaxy S25 to boast AI upscaling for games

Renowned Chinese tipster Digital Chat Station recently took to Weibo claiming that Qualcomm’s Snapdragon 8 Gen 4 (the chipset expected to power the Galaxy S25 series in some or all markets) will feature an improved Adreno 830 GPU with support for frame interpolation technology. In simpler words, the chip can use AI to boost frame rates in graphic-intense games. It helps make the gameplay smoother as long as developers support the technology in their games.

The tipster says the Snapdragon 8 Gen 4 can run Genshin Impact at 1080p resolution and 120fps (frames per second) frame rate. If true, we are in for a massive improvement in frame rate. The Galaxy S24’s Snapdragon 8 Gen 3 tops out at 60fps in maxed-out Genshin Impact graphics settings. This is huge for a smartphone chip. Frame interpolation is a relatively new technology limited to AMD and Nvidia’s latest PC GPUs. Their solutions are respectively named FSR and DLSS.

The trick is to artificially insert frames between existing frames, making graphics look smoother than they actually are. The technology may occasionally cause input lag and visual artifacts like blurring, but it certainly makes the gameplay smoother. As said earlier, developers must adopt frame interpolation for the feature to work on their games. However, the potential is huge if implemented correctly. We may see AAA PC/console-level games run smoothly on Android flagships.

Qualcomm Snapdragon 8 Gen 4 GPU frame interpolation technology AI upscaling games

Well, Apple’s A17 Pro-powered iPhone 15 Pro and iPhone 15 Pro Max can already run AAA games like Resident Evil Village and Assassin’s Creed: Mirage. So, it’s about time Android chipmakers catch up. And Qualcomm may lead the pack with its next-gen flagship SoC. Of course, the Snapdragon 8 Gen 4’s AI upscaling won’t be exclusive to the Galaxy S25 series. Other phones powered by this chipset will also get access to this revolutionary gaming technology.

The new Snapdragon arrives in October, possibly with a higher price tag

Qualcomm will unveil the Snapdragon 8 Gen 4 in October. Rumors say the new chip will be up to 30% costlier than its predecessor, costing as much as $260. This may make the next batch of Android flagships more expensive. Interestingly, the source says a firmware update could bring AI upscaling to Android phones powered by the Snapdragon 8s Gen 3 and Snapdragon 8 Gen 3. That certainly won’t happen before the Gen 4 arrives. Expect more leaks about the next-gen Qualcomm processor in the coming months.


[ad_2]
Source link

Hackers using Dropbox And Google Docs To Deliver Orcinius Malware 

0
[ad_1]

A new Orcinius Trojan has been discovered, employing VBA Stomping to hide its infection. The multi-stage trojan uses Dropbox and Google Docs to stay updated and deliver second-stage payloads. 

Typically, VBA stomping removes the VBA source code in a Microsoft Office document, leaving only a compiled form of the macro code known as p-code in the document file.  

“The malware contains an obfuscated VBA macro that hooks into Windows to monitor running windows and keystrokes and creates persistence using registry keys”, SonicWall Capture Labs threat research team shared with Cyber Security News.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

How The Attack Is Executed?

An Excel spreadsheet, in the present instance “CALENDARIO AZZORTI.xls,” is the initial way of infection.

Three worksheets discussing different cities’ billing cycles are included in what looks to be an Italian calendar.

The Spreadsheet file

The file contains a VBA macro that has been altered using a method known as “VBA stomping,” which destroys the original source code and leaves just compiled p-code. 

As indicated by Olevba, this means that examining the macro inside the document will either display nothing or a safe copy of the code that will execute when the file is opened and closed.

Detecting malicious activity

The file will launch the macro during runtime and carry out the following tasks:

  • To hide warnings, check the registry keys and create a new key.
  • List all of the windows that are presently open.
  • Establish persistence.
  • Access both of the encoded URLs and try to download.
  • keep an eye on keyboard input.
  • Make many randomized timers for download and activation attempts.
Enumerating running windows

URLs:

  • www-env.dropbox-dns[.]com
  • hxxps://docs.google[.]com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
  • hxxps://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

According to researchers, the sample and stated URLs have been linked to Remcos, AgentTesla, Neshta, HTMLDropper, and other malicious websites that pose as “Synaptics.exe” and are available on VirusTotal. The pages at both locations were inaccessible during runtime.

Due to the rise of harmful cyber activity, there are excessive risks of misinterpretation, escalation, and spreading impacts.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link