Microsoft Power Platform API Threatened Due To Reply URL Flaw

andreasc
-
0
Microsoft Power Platform API Threatened Due To Reply URL Flaw
[ad_1]

Researchers discovered a reply URL flaw in Azure AD that could allow unauthorized access to Microsoft Power Platform API. Microsoft patched the flaw following the bug report, by removing the abandoned reply URL from the app.

A Reply URL Flaw Allowed Malicious Access to Microsoft Power Platform API

According to a recent post from Secureworks, a severe security flaw risked Microsoft Power Platform API to malicious access.

Power Platform is a business intelligence suite from Microsoft, constituting various software facilitating app connectivity, development, data visualization, and more.

Regarding the vulnerability, the researchers explained about discovering an abandoned reply URL in the Microsoft Azure Active Directory (Azure AD) application. Since it’s linked with Power Platform, exploiting this abandoned URL could let an adversary gain unauthorized access to Power Platform API. Given the range of explicit privileges the API exhibits, malicious access to the API risks granting elevated privileges to an adversary.

While the researchers didn’t exploit the vulnerability to a greater extent, they did demonstrate the exploit via a PoC. Their post described how they could redirect authorization tokens to gain admin privileges within the Power Platform.

In brief, the attack begins by tricking the victim user into clicking a malicious link that redirects to the reply URL claimed by the adversary. Next, the attacker’s server exchanges the authorization code in the URL parameter for the access token. In the last step, the researchers demonstrated calling the middle-tier service using the access token. However, they explained that an attacker could exchange authorization codes for access tokens directly without involving the middle-tier service.

Microsoft Patched The Vulnerability

Upon discovering the vulnerability, the researchers reported the vulnerability to Microsoft in April 2023. Following their report, Microsoft acted promptly to develop a patch, releasing it with an immediate Azure AD update the following day. The tech giant removed the abandoned reply URL from the Azure AD application to address the flaw.

Let us know your thoughts in the comments.


[ad_2]
Source link

Galaxy Z Flip 5 goes through rigorous durability tests: Video

andreasc
-
0
Galaxy Z Flip 5 goes through rigorous durability tests: Video
[ad_1]

Samsung‘s Galaxy Z Fold 5 passed JerryRigEverything’s rigorous durability tests with flying colors. It held surprisingly firm during a forceful bending in the opposite direction. Can the Galaxy Z Flip 5 repeat the feat? There’s only one way to find out. Zack Nelson, the man behind the popular YouTube channel, recently put the Flip model through the same set of torturous tests to determine its durability.

Foldable smartphones often don’t survive till the end in the hands of Zack. The Google Pixel Fold and the Motorola Razr+ didn’t make it. However, the Galaxy Z Fold 5 was an exception. So the Galaxy Z Flip 5 has Samsung’s reputation to protect. It started pretty nicely. The Korean firm is using Gorilla Glass Victus 2 on top of its cover display. The glass screen doesn’t scratch below Level 6 on the Mohs hardness scale.

However, the folding inner display is made of plastic and expectedly scratches at Level 2. Samsung uses a layer of UTG (ultra-thin glass) on the display assembly, but it doesn’t help make the display more scratch-resistant. You should avoid keeping the Galaxy Z Flip 5 with sharp objects. Even your nails can damage the folding display. The company already warns you about all this during the first boot of the phone.

Speaking of warnings, Samsung tells you not to remove the pre-installed screen protector either. It’s part of the display assembly. If it peels off on its own, the company offers a free one-time screen protector replacement. You must take the phone to an authorized service center, though. Samsung doesn’t allow you to do that on your own. The plastic bumpers along the edges will protect the screen during a hard fall.

Avoid using your Galaxy Z Flip 5 in dusty areas

The Galaxy Z Flip 5 has an IPX8 rating, meaning that it doesn’t have protection against dust. However, Zack’s tests show that a little bit of dust won’t kill the phone. Dust particles do seem to reach the inside, but the device is still functional. Nonetheless, you should avoid exposing your foldable to dust.

Finally, it’s time for the bend test. And the Galaxy Z Flip 5 does protect Samsung’s reputation. It doesn’t break or crack even after repeated forceful bending in the opposite direction. The internal structure of the phone keeps it firm. We’ll see the Flip’s internals during Zack’s teardown shortly. He has already torn apart the Galaxy Z Fold 5, showing us its new shock dispersion layer.


[ad_2]
Source link

Google could collaborate with Garmin to bring Emergency SOS to 150 countries

andreasc
-
0
Google could collaborate with Garmin to bring Emergency SOS to 150 countries
[ad_1]

It comes as no surprise that Google has been working towards integrating satellite connectivity with Android 14. Now, according to a new report from leaker Neil Rahmouni on X, Google is in discussions with Garmin to work on the emergency SOS feature and launch the service to over 150 countries.

According to Rahmouni’s findings, the Google Messages coding contained a reference to “Garmin Response”, which suggests that this collaboration could potentially grant users access to Garmin’s 24/7 emergency SOS response coordination centre. This would not only relieve Google from the task of developing a similar system, but it could also extend the service’s reach to a multitude of countries where the use of satellite phones is strictly banned or heavily restricted. Furthermore, this collaborative effort could enable seamless device tracking and real-time text updates for users until the necessary assistance arrives.

Google’s vision of emergency SOS

Unlike Apple’s implementation, which limits users to send pre-set text messages, Google aims to distinguish itself with a more flexible emergency SOS feature. Users would have the ability to craft custom emergency messages, as revealed by Rahmouni’s shared images showcasing the new layout of the Google Messages app. However, it is important to note that Android 14’s satellite messaging could potentially be subject to distinct character limitations.

While Google plans to introduce direct satellite connectivity support with the upcoming Android 14 release, the range of Android devices equipped with this capability remains shrouded in mystery. This is because satellite connectivity relies on specialized hardware, which is lacking in most phones. However, it is important to note that Google’s Pixel 7 series already possesses the required hardware, albeit necessitating substantial software updates. Additionally, the question of whether Google will institute a subscription fee for the service or follow Apple’s approach of providing it free for a limited period remains unanswered.


[ad_2]
Source link

Yahoo launches AI enhancements for its Mail service, new shopping feature

andreasc
-
0
Yahoo launches AI enhancements for its Mail service, new shopping feature
[ad_1]

Yahoo’s email service lost a lot of users over the years because of its inability to stop spam. Even to this day, this is the biggest problem with Yahoo Mail, so it’s no wonder that people have decided to look for other email services that offer better features and as little spam as possible.

To regain some of the customers lost, Yahoo has decided to jump on the AI bandwagon. Earlier this year, the company announced more AI enhancements for Yahoo Mail, including a new Shopping Saver tool meant to automate savings for online shopping.

The new AI tools are an expansion of Yahoo Mail’s existing AI beta experience and promises to bring “innovation to the inbox,” while “redefining the user experience.” There’s no mention of any new AI features or improvements that would thin the spam that Yahoo Mail users are bombarded with on a daily basis.

“We’ve introduced a full suite of tools on Yahoo Mail to help users save time and money, making strides toward an assistive inbox. In total, US consumers have $23 billion in unused gift cards and credits, and we hope our new tools will help users gain a fraction of that back in their wallets,” said Josh Jacobson, Senior Vice President & General Manager of Yahoo Mail.

As per Yahoo’s announcement, its new Shopping Saver feature is supposed to serve users with older deals, including gift cards, discount codes, and store credits directly in their inboxes, so more spam probably. Yahoo Mail users will also be getting drafts suggested messages to vendors to help apply the savings after a purchase has been made.

According to Yahoo, Shopping Saver and other features are available for Mail’s AI beta experience that opened to iOS users earlier this year. Also, the company announced that before it goes live for everyone, the beta expands across both iOS and web browsers.


[ad_2]
Source link

Two Men Arrested Following Poland’s Railway Signals Hack

andreasc
-
0
Two Men Arrested Following Poland’s Railway Signals Hack
[ad_1]

Authorities in Poland arrested two individuals on suspicion of planning an unlawful hack into the communication network of the national railway, which caused delays in train service in some areas.

The Polish PKP railway’s radio communication system was hacked on Friday night, causing emergency train stops close to the city of Szczecin. About 20 trains came to a complete stop, but services were soon resumed.

Without significantly impacting traffic, the attacks persisted on Saturday and Sunday in various areas of the whole country.

According to media sources, the Russian national anthem and a speech by Russian President Vladimir Putin were reportedly intermingled with the signals.

The Arrest Of Two Suspects

According to Tomasz Krupa, a police spokesperson, the suspects, who are Polish nationals and are 24 and 29 years old, were caught in the eastern city of Bialystok. The radio equipment from their home was seized in addition to the arrests.

Poland, which is renowned for its loyalty to Ukraine, plays a key role in aiding the transportation of Western weapons into the nation.

Poland’s internal security agency initiated an inquiry after the event to identify those responsible for the breach. 

Stanislaw Zaryn, the special services deputy coordinator, speculated a potential link to destabilization actions carried out by Russia in collaboration with Belarus. 

Zaryn guaranteed that the attack did not endanger the safety of the passengers.“We know that for some months, there have been attempts to destabilize the Polish state.”

The Russian Federation has undertaken such attempts in conjunction with Belarus,” Stanislaw Zaryn, deputy coordinator of special services, told the PAP news agency.

The attack “did not pose risks to passengers’ health or lives”.Several incidents, including two derailments, occurred on the Polish rails during the same week as the hacker attack, although no one was harmed.

Zaryn, however, asserted that there was no evidence to support a connection between such occurrences and the hacking.

He said that the ABW was collaborating with other security services and railway authorities to identify and stop any new threats to the railway network.

Additionally, he asked the train employees and passengers to notify the authorities of any suspicious behavior or devices.

According to the country’s national transportation agency, Poland’s railway systems will be upgraded by 2025 and practically fully use GSM cellular radios, incorporating encryption and authentication.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.


[ad_2]
Source link

Sony Xperia 5V specs have surfaced days before launch

andreasc
-
0
Sony Xperia 5V specs have surfaced days before launch
[ad_1]

Ahead of its launch, details of the upcoming Xperia 5V smartphone from Sony have hit the internet. These details reveal its processor, RAM capacity, operating system, and its performance score. From the details that are available, it is safe to say that this device will easily port itself as a performance beast.

The reason for that statement dwells solely on the processor that powers this device. Under the hood, the Xperia 5V will feature a Snapdragon 8 Gen 2 flagship processor that powers other performance devices. This is the same processor that is in the more powerful Sony Xperia 1 V that became official a few weeks ago.

Details on this coming device have been made available thanks to what appears to be its Geekbench ranking. Sources point out a document that has the code name Sony XQ-DE54 as the coming Sony 5-series device. If this leak is accurate, then the said device has a lot to offer in terms of performance.

Details on the coming Xperia 5V smartphone entry that will launch in a few days

Recently, Sony took to its Twitter page to announce the global launch of a new product. The post didn’t carry any details on the said product, but previous leaks gave netizens a glimpse of what’s coming. Now more light is being shed on this coming product as it approaches its September 1st launch date.

Already, Sony has launched two smartphones this year, the Xperia 1 V and the 10 V, both packing impressive specifications. Now, for this coming smartphone, the Geekbench rating points out that it’d launch with the Snapdragon 8 Gen 2 SoC processor. Also, the device will also launch packing up to 8GB worth of RAM, but there might be some additional memory options.

The ranking also shows that this coming device will launch with Android 13. In pure Sony fashion, this software will be very close to a stock Android experience. This means that the Sony Xperia 5V won’t launch with any bloatware or customization software.

From the Geekbench ranking documentation, the performance of this device is also shown. For starters, this device secures itself a single-core score of 2004, which is impressive. On its multi-core, this device gets a score of 5059, which is also impressive.

Other leaks point out that the Xperia 5V will launch with a 5000mAh battery capacity. Its leaked promotional video shows that it’d launch with a dual rear camera setup as well. More details on this device will become available during its launch event in the coming days.


[ad_2]
Source link

All 9 Apple iPhone 15 series colors shown ahead of launch

andreasc
-
0
All 9 Apple iPhone 15 series colors shown ahead of launch
[ad_1]

The iPhone 15 series is coming next month. Apple will once again launch four different phones, the iPhone 15, 15 Plus, 15 Pro, and 15 Pro Max aka Ultra. Having said that, all 9 iPhone 15 series colors have just surfaced.

All expected iPhone 15 series colors shown in a single image

Do note that these colors are based on leaks and rumors. They’ve been shared by ‘Disastrous_Street633’ via Reddit. If you check out the image below, you’ll be able to see all of them.

iPhone 15 and iPhone 15 Pro expected colors

The first four colors show the colors of the ‘Pro’ models, while the remaining five are for the vanilla versions. The first four colors are Space Black, Titan Gray, White, and Dark Blue. Those names may change by the time the phone arrives, though.

In regards to the vanilla versions, you’ll see black, white, coral, blue, and yellow colors. Apple will have different names for these colors too. What’s interesting is that the green and pink colors are not here for the vanilla versions, and they’ve been rumored earlier.

Do note that this is not a leak or anything of the sort. These colors are, as already mentioned, based on rumors and leaks, but they’ve been created by a third party. So, it remains to be seen how accurate they are.

Apple will launch its new iPhones on September 12 or 13

The entire iPhone 15 series is expected to launch on either September 12 or 13. The September 12 seems like a more likely launch date though. The phones will probably go for pre-order on September 15, and become available to purchase on September 22.

All models will include a Type-C USB port, and a Dynamic Island cutout. The ‘Pro’ models will, of course, have some advantages over the vanilla models, in addition to being more powerful.

They will ship with thinner bezels, and titanium frames. The ‘Pro Max’ aka ‘Ultra’ model will also include a periscope telephoto lens, which is a first on an iPhone. The regular ‘Pro’ model will not offer it this time around, but it’s coming next year.


[ad_2]
Source link

OPPO just announced the best Flip-Style foldable yet

andreasc
-
0
OPPO just announced the best Flip-Style foldable yet
[ad_1]

OPPO has just officially announced the Find N3 Flip, ahead of IFA. It’s the latest flip-style foldable from the company, and continues to push the envelope for the competition.

Today, OPPO is only launching the Find N3 Flip in China, but it is expected to launch globally very soon. But by “Globally”, we do not mean the US unfortunately. OPPO’s chief product officer and SVP, Pete Lau stated that for the “Find N3 Flip, we’re bringing upgrades across the board – elevated styling, an improved cover screen experience, and a game-changing flip phone camera – simply put, expect the exquisite from Find N3 Flip.”

There are some big upgrades on the Find N3 Flip, though arguably the biggest is the cameras. There’s three cameras on the outside of the Find N3 Flip, something we haven’t really seen on a flip-style foldable. Generally, we get a main camera and then an ultra-wide. But OPPO has also added a dedicated portrait camera here. With the Find N3 Flip, there’s a 50-megapixel main sensor, a 48-megapixel ultrawide sensor and a 32-megapixel portrait camera. These are some pretty big numbers and all-around, some pretty big camera sensors, on the Find N3 Flip.

Other upgrades are OnePlus-inspired

With the camera, you’ll notice that the module looks very similar to OnePlus‘ recent smartphones. With the cameras all fitting into a black circle on the back of the phone, and “Hasselblad” branding being in the center.

Another OnePlus-inspired upgrade on the OPPO Find N3 Flip is pretty interesting. It’s the Alert Slider. Something that OnePlus has used on its phones since the very first phone – OnePlus One. Though it did skip the OnePlus 10T but came back for the 11. This Alert Slider is a fan favorite feature for OnePlus, and OPPO is hoping the same is true for their users. It’s on the left side of the phone and allows you to quickly silence your phone.

The Find N3 Flip is available in three colors: Cream Gold, Pink and Black. No pricing, nor availability is available just yet. However, the Find N2 Flip did cost €1099 in Europe. So expect a similar price.

Find N3 Flip Warm Up Release Header resized


[ad_2]
Source link

Huawei & Ericsson sign a long-term 5G cross-licensing agreement

andreasc
-
0
Huawei & Ericsson sign a long-term 5G cross-licensing agreement
[ad_1]

With the boom in 5G connectivity around the world, Huawei and Ericsson are moving into a long-term business partnership. This partnership will enable both parties to make use of each other’s patents. It also covers 3GPP, ITU, IEE, and IETF for all major cellular technology standards.

This is a major move for the two firms, considering that they are both well-recognized in the industry. Despite the challenges it faces, Huawei is still making waves in the tech industry. Ericsson, on its part, is one of the major 5G equipment vendors in the world now and is also making impressive moves.

Exchanging patents between one another will enable these companies to make more advancements in the connectivity industry. This will not only be beneficial to both company’s businesses but also help prepare innovations for the end consumer. Here are the details of this partnership that were given by top officials in both firms.

Official details on the Huawei and Ericsson long-term 5G patent partnership

In an official statement from Huawei, the company points out what this partnership will cover. According to the statement, this agreement will cover the respective sale of network infrastructure and consumer devices by both companies. This will help standardize the technology that both firms roll out since they’d both have access to each other’s patents.

Both firms have their wins in the tech industry that make them stand out. On the part of Huawei, they have a vital part in the cellular, WiFi, and multimedia codecs tech industry. In terms of patents, Huawei tops the 2022 European Patent Office’s applicant ranking with 4,505 applications. 

Ericsson on their part has been a leading contributor to 3GPP and also the development of mobile standards. The company has over 60,000 granted patents, making them a top 5G vendor. Bringing these two firms together will bring a ton of improvements to the tech industry.

Both firms are very optimistic about this partnership and how it’d benefit other industries. These include areas such as the health sector and other consumer industries. Ericsson is certain that their 2023 IPR licensing revenues will hit approximately 1 billion USD.

This partnership is aimed at growing the businesses of both Huawei and Ericsson. In the coming months, netizens will see the impact of this partnership in various industries. Bringing the largest holder of 5G patents together with one of the leading 5G vendors might hold a lot in store for the tech industry.


[ad_2]
Source link

Microsoft Edge Privilege Escalation Flaw

andreasc
-
0
Microsoft Edge Privilege Escalation Flaw
[ad_1]

Microsoft Edge has published a release note that mentioned a Privilege escalation vulnerability with the CVE ID of CVE-2023-36741 and has a CVSS Score of 8.3 (High). This vulnerability exists in the Microsoft-Edge Chromium-based versions prior to 116.0.1938.62.

An unauthorized remote attacker can exploit this vulnerability which requires the interaction of the user.

The scope of this vulnerability is beyond the vulnerable component of Microsoft Edge. There is no known exploit code available for this vulnerability.

CVE-2023-36741

Microsoft has not provided any additional details about this vulnerability which limits the current knowledge about this vulnerability.

However, Microsoft mentioned in their security advisory that this vulnerability affects the CIA (Confidentiality, Integrity, and Availability) of the affected application and its environment.

In addition, Tenable has released new plugins for Nessus, which users can use to detect this vulnerability. The plugin is as follows,

IDNameProductFamilySeverity
180197Microsoft Edge (Chromium) < 116.0.1938.62 Multiple VulnerabilitiesNessusWindowsHIGH

Source: Tenable

During the previous release notes on August 21, 2023, Microsoft patched two vulnerabilities CVE-2023-38158 & CVE-2023-36787. These vulnerabilities were information disclosure and elevation of privileges patched in the versions Microsoft Edge Stable and Extended Stable Channel (Version 116.0.1938.54).

However, in this current release note, Microsoft has patched only one Elevation of privileges vulnerability, which is the 4th patch update this month. As of the month of July, only two release notes were released.

Users of Chromium-based Microsoft Edge are recommended to upgrade to the latest version in order to fix this vulnerability and prevent exploitation.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.


[ad_2]
Source link
1...966967968...1,483Page 967 of 1,483