Samsung‘s September update for the Galaxy S23 series is now rolling out widely in the US. The company began the rollout last week but initially only covered carrier-locked units. The update is now available for factory-unlocked units as well.
The latest update for the Galaxy S23, Galaxy S23+, and Galaxy S23 Ultra brings nothing more than this month’s security fixes, which we will discuss in more detail below. Samsung first pushed this release to carrier-locked units on Verizon’s network. It came with the firmware build number S91*USQS1AWHD.
The update has since reached the phones on other networks as well, including T-Mobile, Comcast, Dish, and Xfinity Mobile. While it’s the same build number for most of them, Galaxy S23 users on T-Mobile and Metro networks are receiving the September security patch with firmware version S91*USQU1AWHI. Despite a notably different build number, the changelog remains the same. Samsung isn’t pushing anything more than the latest security fixes.
This expansion also covers unlocked units, which are picking up the build number S91*U1UES1AWHD (unchanged for T-Mobile and Metro users as well). The update is already live on most networks, with the remaining few expected to join the action soon. If you’re using a Galaxy S23 in the US and have yet to receive the September update, watch out for a notification in the coming days. You can also manually check for new updates from the Settings app.
The September update brings over 60 security fixes to Galaxy devices
This month’s security update for Galaxy devices contains patches for more than 60 vulnerabilities. Samsung’s updated monthly security bulletin mentions 23 Android OS patches from Google and other partners, with at least four of them confirmed to be critical issues.
Additionally, the Korean firm is pushing 35 Galaxy-specific patches. These issues don’t affect Android products from other brands. Samsung hasn’t detailed all of them yet due to security reasons, but none of the detailed ones are critical. The September SMR (Security Maintenance Release), as the company calls these updates, also contains four patches from Samsung’s semiconductor division.
These security fixes will soon reach the Galaxy S23 series in international markets and gradually make their way into more eligible Galaxy devices. Since Samsung’s software team is busy with the development of One UI 6.0, which brings Android 14 to Galaxy devices, it could take longer than usual for the latest SMR to be available for everyone. We will keep you posted with the updates.
Apple has shifted its AirPods Pro and EarPods accessories to using USB-C. The company announced the change during its big Apple event where it also announced the Watch Series 9 and other devices. It’s a change that’s been a long time in the making after the company slowly began changing to USB-C for its laptops back in 2015. And with these changes, nearly all of the company’s mobile products use USB-C. Including today’s newly announced iPhone 15 series.
For the longest time Apple used a proprietary cable for most of its products. But it made the commitment to switch and has done just that. This means anyone buying the new versions of these products can now use old USB-C cables and phones. Though you’ll still need to use Apple’s cables if you’re on the iPhone 14 series or earlier.
There are some unfortunate downsides to these changes though. At least initially. And depending on how you look at things.
Apple’s AirPods Pro now come with a USB-C charging case
Here’s the downside. The AirPods Pro come with a USB-C charging case now. But Apple does not sell the case separately.
It is likely that the company will offer it as a standalone buy for those who already own a pair of AirPods Pro earbuds. But for now, only a new pair will have the USB-C case. That being said, we wouldn’t recommend spending that money just to charge the case with USB-C. It would be a better idea to simply wait for the case as a separate purchase option or until your earbuds actually need to be replaced.
On the EarPods side of things, they now come with a USB-C plug. But that also means you won’t be able to plug them into your older iPhones. Since those don’t use USB-C. So the new EarPods aren’t really worth it either unless you’re upgrading to the new iPhone 15 series devices. If you’re interested in picking either of these new accessories up, they’re both available right now on Apple’s website. The AirPods Pro (2nd Gen) with USB-C case retail for $249, and the EarPods USB-C retail for a measly $19.
Researchers have found a new distribution method for the DarkGate Loader which circumvents the security features in Microsoft Teams.
Researchers have found a new method by which cybercriminals are spreading the DarkGate Loader malware. Until now, DarkGate was typically distributed via phishing emails. The malspam campaign used stolen email threads to lure victims into clicking a hyperlink, which downloaded the malware. But Malwarebytes also found DarkGate reloaded via malvertising and SEO poisoning campaigns.
A cybercriminal who goes by the handle RastaFarEye has been advertising DarkGate Loader on cybercrime forums since June 16, 2023. Once active, the malware can be used for several malicious activities like remote access, cryptocurrency mining, keylogging, clipboard stealing, and information stealing.
What’s new is that the researchers found evidence of a campaign using Microsoft Teams to deliver the DarkGate Loader.
“On August 29, in the timespan from 11:25 to 12:25 UTC, Microsoft Teams chat messages were sent from two external Office 365 accounts compromised prior to the campaign. The message content aimed to social engineer the recipients into downloading and opening a malicious file hosted remotely.”
The distributed link initially points to a traffic distribution system (TDS). If the requirements set by the attacker are met, the TDS will redirect the victim user to the final payload URL for the MSI download. When the user opens the downloaded MSI file, the DarkGate infection is triggered.
The download locations observed in the Teams attacks were sharepoint.com URLs hosting .zip files with names like “Changes to the vacation schedule.zip.” The ZIP file contains a malicious LNK file (shortcut) posing as a PDF document: “Changes to the vacation schedule.pdf.lnk.”
Clicking the shortcut executes a command line which triggers the download and execution of a renamed cURL (a command-line tool for getting or sending data including files using URL syntax) to download and execute Autoit3.exe and a bundled script. The pre-compiled AutoIT script hides the code in the middle of the file and, on execution, drops a new file that contains shellcode.
When the shellcode is run, the first thing it uses is the “byte by byte” technique aka called stacked strings, to create a new file: a Windows executable identified as DarkGate Loader.
Protection
Current Microsoft Teams security features such as Safe Attachments or Safe Links failed to detect or block this attack. BleepingComputer reported in June of 2023 that security researchers had found a simple way to deliver malware to an organization with Microsoft Teams, despite restrictions in the application for files from external sources. Microsoft Teams has client-side protections in place to block file delivery from external tenant accounts. But the restriction can be circumvented by changing the internal and external recipient ID in the POST request of a message, which ends up with Teams treating an external user as if it was an internal one.
The only way to prevent this attack vector within Microsoft Teams is to only allow Microsoft Teams chat requests from specific external domains. This may be troublesome in some environments since this means that all trusted external domains need to be whitelisted by an IT administrator.
Malwarebytes customers are protected against this attack as Malwarebytes blocks the C2 server hosting the downloaded files. Malwarebytes detects the LNK file and the scripts as Trojan.DarkGate.
Malwarebytes blocks 5.188.87.58
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Samsung‘s September security update rollout has been a tad slower by its standards. This is likely because its software team is busy with the development of Android 14-based One UI 6.0. However, the company is still finding time to push the latest SMR (Security Maintenance Release) to eligible models. After the Galaxy S23, Galaxy S22, and Galaxy A14 5G, the Korean firm has now released the update for the Galaxy A52 5G and Galaxy Xcover 5.
The Galaxy A52 5G is currently receiving the September SMR in Canada. According to SamMobile, which first reported this rollout, the 2021 premium mid-range handset is picking up the latest security patch with the firmware build number A526WVLSAEWH1. The update is already live on most carriers in the country, including Bell Mobile, Cahatr Mobile, EastLink, Fido, Globalive, Koodo, Rogers, SaskTel, Tbaytel, Telus, Videotron, and Virgin Mobile.
This update doesn’t bring anything notable to the Galaxy A52 5G. Well, there are plenty of important security fixes here, but there’s no user-facing change or new features in the tow. Samsung will likely expand this release to more markets in the coming days, including the US. The 4G version of the Galaxy A52 may also receive the September update later this month. This phone is an enterprise model and is eligible for monthly security updates.
The Galaxy Xcover 5 is also an enterprise offering from Samsung. The rugged phone is now getting the September update as well, with users in Argentina, Chile, Guatemala, and Mexico leading the pack. Other Latin American countries may follow soon, with a global rollout to come next. The new firmware version for this phone is G525FXXS8CWH3, the same source reports. Once again, the update is all about the latest security fixes.
The Galaxy A52 5G and Xcover 5 are getting over 60 security fixes
Samsung has already revealed the content of the September SMR for the Galaxy family. This month’s security update patches more than 60 vulnerabilities across various system apps, components, and services. Four of the 23 Android OS patches provided by Google are classified as critical flaws.
All of these vulnerability patches will soon reach the Galaxy A52 5G and Galaxy Xcover 5 globally, while Samsung simultaneously expands the coverage to more eligible models. If you’re using a Galaxy smartphone or tablet, you can always check for new updates from the Settings app. You’ll find the option to “download and install” the updates under the Software update menu.
PayPal credit and debit cards have added support for Apple Pay. You can now add these cards to your Apple Wallet app and use them for mobile payments.
Last year, PayPal announced its plans to adopt Apple Pay and Tap to Pay on iPhone. The partnership will allow both companies to expand their reach and provide customers with more options for payment. As a result, you can now connect your PayPal credit and debit cards to the Apple Wallet app for payments.
Most banks and card issuers have added support for Apple Wallet and Apple Pay years before, and PayPal finally joined the bandwagon to catch up with the competition. This has been one of the most anticipated partnerships in the mobile payment industry.
PayPal credit and debit cards now support Apple Pay for mobile payments
There are two ways to add PayPal credit and debit cards to your Apple Wallet app. First, open the PayPal app on your iPhone and look for a banner that says “Pay with your iPhone.” The Apple Wallet app opens by tapping on this banner, and you can add your PayPal credit or debit card.
The second way is even more straightforward. If you can’t find the banner on the PayPal app, open the Apple Wallet app instead and tap the “+” icon in the upper-right corner. Here, you can add one or both of your PayPal cards and choose one for accomplishing transactions. Finally, it’s worth noting that Apple keeps 0.15% of each transaction, which equates to 15 cents out of a $100 purchase.
The PayPal-owned Venmo might also add support for Apple Pay for its debit and credit cards. The move isn’t yet confirmed, but it will likely happen soon.
Over 55 million people in the United States are currently using Apple Pay. The number is expected to grow to 67 million by 2026. The tech giant reported that its payment system had generated $4 billion in revenue this year and is the fifth-most widely used payment method worldwide after PayPal, Visa, Mastercard, and American Express. PayPal is also one of the most popular online payment gateways, with over 435 million users globally.
Chrome users are being urged to patch a critical vulnerability for which an exploit is available.
Google has released an update for Chrome Desktop which includes one critical security fix. There is an active exploit for the patched vulnerability, according to Google, which means cybercriminals are aware of the vulnerability and are using it.
If you’re a Chrome user on Windows, Mac, or Linux, you should update as soon as possible.
The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong—such as an extension stopping you from updating the browser.
So, it doesn’t hurt to check now and then. And now would be a good time, given the severity of the vulnerabilities in this batch. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.
If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete.
After the update, the version should be 116.0.5845.187 for Mac and Linux, and 116.0.5845.187/.188 for Windows, or later.
The vulnerability
Google never gives out a lot of information about vulnerabilities, for obvious reasons. Access to bug details and links may be kept restricted until a majority of users are updated with a fix. However, from the update page we can learn a few things.
The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The zero-day patched in this update is listed as:
CVE-2023-4863: a heap buffer overflow in WebP, also described as a vulnerability that resides in the WebP image format which could lead to arbitrary code execution or a crash.
A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches its address boundary and writes into an adjacent memory region. In software exploit code, two common areas that are targeted for overflows are the stack and the heap.
The heap is an area of memory made available use by the program. The program can request blocks of memory for its use within the heap. In order to allocate a block of some size, the program makes an explicit request by calling the heap allocation operation.
Credit for reporting the vulnerability was given to Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06. The fact that this happens to coincide with a report by CitizenLab about two Apple vulnerabilities that used by the NSO group to drop the Pegasus spyware, seems too much to be a coincidence.
Add the fact that both Apple CVE-2023-41064 and Chrome CVE-2023-4863 are based on image processing and we feel comfortable saying that these two vulnerabilities are very, very likely to be related.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Alongside announcements for the Watch Series 9, Watch Ultra 2, and iPhone 15 series today, Apple announced the release date for iOS 17 and iPadOS 17, coming to iPhones and iPads in the near future.
The details were announced today during Apple’s ‘Wonderlust’ event. Those eagerly awaiting the new software won’t have to wait much longer to install it on their devices. Apple has confirmed that the update will be rolled out to users next week. Specifically on September 18. This release date will apply to iOS 17 as well as iPadOS 17 for both iPhones and iPads. Although that probably not surprising as Apple tends to release its software all simultaneously.
Technically iOS has already been available for months now though. As it’s been in beta since June and has been steadily installed by more users in the beta format over the following weeks and months. That being said, the stable software rollout will give new users the chance to check out the improvements. And those on the beta should get a more reliable build.
The biggest changes with the iOS 17 release
iOS 17 is coming with quite a few new features and if you’d like to read about every single one of them, you can find them in our dedicated post here. But for those who want the cliff notes, we though it would be a good idea to highlight some of the bigger changes in this post now that there’s an official release date.
One of the bigger changes is the inclusion of the ‘Leave a message’ feature. A new video voice mail feature that’s designed to help you catch missed FaceTime calls. Just like with a phone call, if you FaceTime someone and they miss the call, you can leave a message for them. This will support both video messages and voice messages. It’s your preference.
Another big feature is the ability to turn your phone into a smart display. The ‘StandBy’ feature will display various things on your screen while docking and charging it via MagSafe chargers. The phone will need to be in landscape mode though.
Google has put forth a denial of any wrongdoing in its trial with the Department of Justice over allegations of antitrust practices. The trial began Tuesday September 12 and is expected to last through the next 10 weeks.
The DOJ initially filed a lawsuit against Google back in 2020. Alleging that Google had used its considerable market power and large coffers to edge out competitors. The lawsuit alleges that Google paid companies to give Google Search the default spot. Thus blocking competitors from having any real chance at competition. Google denied these claims back in 2020 and at the start of the trial it has denied them again. Sticking to its story that users chose Google over competitors.
In court, the DOJ has argued that Google paid billions of dollars to companies like Apple and others to make Google the default search engine. Lead litigator for the DOJ Kenneth Dintzer says Google “began weaponizing defaults” around 15 years ago. Dintzer also called these tactics an “Achilles Heel” for competitors. An interesting argument when you think about how often Yahoo and MSN are probably used today compared to Google.
Google pays more than $10 billion per year for these default contracts
Google is worth about $1.7 trillion these days. And the majority of that money comes from Search ad revenues. Amounting to somewhere in the ballpark of $224 billion a year. By no means a paltry sum. That makes it a little more believable when you hear how much Google is being accused of paying for default search contracts. According to Dintzer, Google is paying about $10 billion. But not just $10 billion flat since it started “weaponing defaults.” $10 billion per year. A staggering dollar amount that many companies will never see in lifetime revenue. Annually. All to keep Google Search at the top.
The allegations against Google are pretty serious and could result in sweeping changes across the industry. And as the biggest antitrust case in the US in over 20 years, its decision will probably end up setting a precedent going forward. Interestingly, Google argues that it still faces plenty of competition. Noting competitors like Amazon and Yelp, stating that “consumers can post questions about what to buy or where to go.”
Google is also accused of deleting documents “for years” that could have been used in the court proceedings. With Dintzer saying that Google “turned history off to rewrite it in this court.” It’s going to be a long 10 weeks.
Ransomware news in August was highlighted by the sudden fall of CL0P from the list of the monthly most active gangs, while Lockbit returned to the number one spot.
This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.
Ransomware news in August was highlighted by the sudden fall of CL0P from the list of the most active gangs in any given month, while Lockbit returned to the number one spot after a steady four-month decline in activity.
CL0P published the data of just four victims on their leak site last month, down from 91known victims in June and 170 known victims in July. In June, CL0p shot to the top of the charts due to their use of a zero-day exploit in MOVEit Transfer, with victims of those attacks continuing to be posted into July.
This dramatic decrease isn’t too surprising given that CL0P’s vulnerability-focused approach to attacking has diminishing returns. As more organizations became aware of and patched the zero-day that CL0P discovered, CL0P’s zero-day campaign saw less and less momentum, with fewer at-risk targets. We witnessed a similar trend earlier this year when, after targeting 104 victims using a GoAnywhere MFT zero-day, CL0P’s presence almost vanished in April and May, as organizations presumably caught on and patched the vulnerability.
Lockbit, on the other hand, posted a total of a 124 victims on its leak site last month to reclaim its usual number one spot on the monthly charts. Before this sudden increase in attacks, we had been observing an average decrease of 20 attacks a month from the group since April 2023.
Known ransomware attacks by gang, August 2023Known ransomware attacks by country, August 2023Known ransomware attacks by industry sector, August 2023
We speculated on reasons for the downward trend in last month’s review, such as it being possibly related to a recent affiliate arrest, but interesting research published last month may also hold the clue to other answers.
In the third installation of his “Ransomware Diaries” series, researcher Jon DiMaggio reveals the extent of Lockbit’s alleged internal instability, including how its apparent storage limitations and slow response times have led to affiliates leaving it for competitors. If more frustrated clientelle are leaving Lockbit than before, then it could be a novel, possible explanation to any monthly dips in activity.
To get a better idea of the true strength of Lockbit’s current operations, however, we can compare any period of decline to their typical number of monthly attacks. Data stretching back to March 2022, for example, places their median number of attacks at around 67 a month. From April 2023 to July 2023, their median number of attacks was actually slightly higher than this at 69 attacks a month, making the decline seem less substantial. In other words, while Lockbit might be plagued by internal instability at the moment, the effect of this on their monthly numbers seems insignificant in the long-run.
Contrasting with LockBit’s storage server challenges, the recent move by CL0P last month to use torrents underscores the evolving tactics ransomware gangs employ to circumvent storage limitations.
As ransomware gangs steal data from major companies, the scale of the information requires immense storage capacities. Traditional cloud services like AWS and Azure not only come with high costs but also demand personal identifiable information (PII) and credit card details upon registration—information that can easily be subpoenaed by law enforcement. A torrenting service, on the other hand, optimizes downloads by sourcing data from multiple proximate locations, rather than a lone server.
Since torrenting necessitates the data be scattered across all participating nodes in the peer-to-peer network, ransomware gangs can bypass the challenges of storage and bandwidth while also better evading law enforcement. Additionally, if more top ransomware gangs can follow CL0p’s footsteps and start to rely more on torrents to distribute stolen data, victims may feel increased pressure to pay ransoms as their data becomes more widely available.
Newcomers
CloAk
CloAk is a relatively new ransomware group that emerged between late 2022 and the beginning of 2023. In August 2023 the group published the data of 25 victims, mostly from Europe and with a special focus on Germany.
The CloAk leak site
Metaencryptor
Metaencryptor is a new ransomware gang that published the data of 12 victims in August 2023.
The Metaencryptor leak site
RansomedVC
RansomedVC is a new group that published the data of nine victims on its leak site last month. The group has adopted a favorite ideology of other ransomware actors—that they are serving as nothing more than “pen-testers”—and added a twist, alleging that any vulnerabilities they have found in victims’ networks must also be reported under compliance to Europe’s General Data Protection Regulation (GDPR). RansomedVC has advertised themselves as a “digital tax for peace” service and threatened victims with data breach fines if the ransom isn’t paid.
The RansomedVC leak site
INC Ransom
INC Ransom is a newcomer to the ransomware scene last month that published three victims to its leak site in August.
Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
Stop malicious encryption. Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.
Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.
Following the new iPhone 15 series launch, Apple also made a USB-C to Lightning adapter available for purchase. This new accessory is very important for the brand, considering that it has made the switch to USB-C ports. However, the pricing of this new accessory is not only jaw-dropping but also makes it seem like an unnecessary accessory.
The tech giant already has this new accessory listed on their website for purchase. There is also the new 2-meter-long USB-C charging cable, supporting 240 watts of charging and USB 2 data transfer speed. Now, the pricing of this new USB-C to Lightning adapter and the 2-meter USB-C is $29.
Apple still offers the same USB-C charging cable but measuring at 1 meter for $19. This option gives users up to 60 watts of charging whilst supporting USB 2 data transfer speed. But why should users concern themselves with purchasing a $29 USB-C to Lightning adapter in place of a $19 USB-C cable?
What makes the new Apple USB-C to Lightning adapter stand out as a smart purchase
According to Apple, this new USB-C to Lightning adapter is packed with a ton of features. Aside from connecting your lightning cable to the new iPhone 15 series for charging, it also brings other benefits. This new accessory brings three key functions that will impact how users interact with the new iPhone 15 series.
These functions include charging, data transfer, and audio for listening to music. If users of the new iPhone 15 series still have a lightning cable, they can connect with this adapter and charge their devices. For data transfer, those who purchase this adapter will be able to connect their previous device and move data over to their new iPhone 15 device.
Since the new devices lack a headphone jack, the audio function of this adapter is helpful. Connecting the lightning headphone cable to this adapter will enable users to listen to music via the USB-C port on their new iPhone 15 device. These are some useful features, but critics can easily question the last on the list.
Most buyers of the new iPhone 15 series already have AirPod Pros or other wireless headphones, making the audio function useless. Also, for charging, buyers of any device in the new iPhone 15 series will get a USB-C Charge cable in the box. Apple still tries to make this product look useful by giving it the ability to connect lightning accessories to a USB-C iPhone or iPad.
Lastly, those looking out to purchase this product for $29 can consider purchasing the more affordable $19 USB-C cable. However, an impressive feature of this USB-C to Lightning adapter is that it’s braided, just like other USB-C cables from Apple. In the coming weeks, once the iPhone 15 series starts shipping, netizens will get to see this product in use.
The CloAk leak site
The Metaencryptor leak site
The RansomedVC leak site
