3,000+ Android Malware Using Unique Compression Methods

andreasc
-
0
3,000+ Android Malware Using Unique Compression Methods
[ad_1]

Android Smartphones lay a vital role in our daily life, as they help us to stay connected and, not only that even it also helps in performing several daily tasks like:-

  • Shopping
  • Banking
  • Browsing
  • Connections

But, besides this, it also attracts the attention of cybercriminals or threat actors since smartphones hold our valuable and confidential data.

Cybersecurity researchers at Zimperium zLab recently identified an application package file (APK) dubbed “a.apk” that could be installed on the Android OS version above Android 9 Pie, but, it can’t be scanned from most of the anti-decompilation tools.

THE EXPERTS DETECTED this APK sample (2f371969faf2dc239206e81d00c579ff) on a Tweet published by Joe Security.

Detected APK overview

  • APK Sample Name: a.apk
  • Description: Yara detected apk with invalid zip compression
  • Analysis ID: 895672
  • MD5: 2f371969faf2dc239206e81d00c579ff
  • SHA1: 0ad5289c6b7a438e3970149b183e74b89f534109
  • SHA256: b3561bf581721c8
  • Rule: JoeSecurity_apk_invalid_zip_compression

Android Malware Unique Compression

While this sample prevents the decompilation by employing a decompression method that is completely unsupported within its APK which is a zip file that makes the complete analysis difficult for many tools.

Classification (Source – Joe Sandbox)

However, though it’s an old method, it’s sophisticated in nature and involves altering APK compression algorithms to evade the automatic script analysis so, that the static examination could be prevented.

With a 16-bit scope, 65,536 options exist, but Android’s APK, utilizing ZIP, accommodates just two compression methods.

Here below, we have mentioned those two compression methods:-

  • STORED method (0x0000)
  • DEFLATE (0x0008) compression algorithm

Moreover, the unsupported compression methods in Android versions below 9 block installation, but in the case of the above Android 9 version, it functions properly.

Certain tools, like MacOS Archive Utility, fail to extract critical analysis files like “AndroidManifest.xml” from the APK. But, besides this, the JEB, in its latest release, now fixed this flawed compression.

Techniques Detected

Here below we have mentioned all the techniques that are detected by the security analysts:-

  • Filenames with more than 256 bytes
  • Malformed AndroidManifest.xml file
  • Malformed String Pool

Cybersecurity analysts at Zimperium zLabs discovered that to prevent the analysis, all the 3,300  samples were utilizing ‘unsupported unknown compression,’ and they even found some too corrupted samples for the OS to load.

Out of these identified malicious samples, security analysts were able to find only 71 Android OS-loadable malicious samples, and among these samples, none of them are available in Google Play Store at the moment.

IoC

Malicious apps using an unsupported unknown compression method:-

  • com.freerdplalobydarkhack.con
  • package.name.suffix
  • com.google.android.inputmethod.latia
  • numeric.contents.desktor
  • health.karl.authority
  • charlie.warning.professional
  • imperial.xi.asia
  • turner.encouraged.matches
  • insta.pro.prints
  • com.ace.measures
  • eyes.acquisition.handed
  • xhtml.peripherals.bs
  • com.google.services
  • google.clood.suffix
  • friends.exec.items
  • com.deveops.frogenet.service
  • com.yc.pfdl
  • publicity.inter.brooklyn
  • consist.prior.struck
  • disaster.considering.illinois
  • splash.app.main
  • labeled.configuring.servies
  • regarded.editors.association
  • com.appser.verapp
  • widely.sharp.rugs
  • handmade.catalogs.urgent
  • com.gem.holidays
  • lemon.continental.prince
  • com.koi.tokenerror
  • cmf0.c3b5bm90zq.patch
  • com.ilogen.com
  • one.enix.smsforward
  • com.app.app
  • per.hourly.wiki
  • com.mobihk.v
  • com.gmail.net
  • broadway.ssl.seasonal
  • Fees.abc.laugh
  • tjb0n81d.j9hqk.eg0ekih
  • 9fji8.pgzckbu7.nuputk
  • bullet.default.til
  • factor.apnic.constitutes

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


[ad_2]
Source link

Don’t Miss This Deal on the TCL 65-inch S4 Google TV

andreasc
-
0
Don’t Miss This Deal on the TCL 65-inch S4 Google TV
[ad_1]

Best Buy has a pretty great deal on the TCL 65-inch S4 4K Google TV right now, where you can pick it up for just $399. That’s going to save you about $130 off of its regular price. Making this a really great deal.

This is a 2023 model, and it’s the first meaningful discount for this TV. So definitely a good time to grab one.

TCL S4 Google TV – Best Buy

Why you should buy the TCL 65-inch S4 Series Google TV

The TCL 65″ S4 Google TV has a number of features that make it a great choice for a home theater. It has a 4K Ultra HD resolution with HDR10 and HLG support, which means it can display images with stunning clarity and detail. It also has a wide viewing angle, so you can enjoy the picture from anywhere in the room.

The TCL 65″ S4 Google TV runs on the Google TV platform, which is one of the most user-friendly smart TV platforms on the market. It has a simple and intuitive interface that makes it easy to find and watch your favorite content. You can also use Google Assistant to control the TV with your voice.

In addition to its 4K picture quality and smart TV features, the TCL 65″ S4 Google TV also has a number of other features that make it a great value. It has a built-in Roku Media Player, so you can stream movies and TV shows from a variety of sources. It also has a Dolby Atmos sound system, which provides immersive audio that will make you feel like you’re right in the middle of the action.

If you’re looking for a great value 4K smart TV, the TCL 65″ S4 Google TV is a great option. It’s currently on sale for just $399, so don’t miss out on this great deal. Which you can pick up from Best Buy using the link below.

TCL S4 Google TV – Best Buy


[ad_2]
Source link

NVIDIA-powered Chromebooks might not arrive anytime soon

andreasc
-
0
NVIDIA-powered Chromebooks might not arrive anytime soon
[ad_1]

In a recent report, it becomes clear that NVIDIA-powered Chromebooks might not be making the launch stage. News that Google was working on a gaming laptop hit the internet earlier this year. This took Chromebook lovers off their feet as they hoped for a high-performance device that they could play more games.

However, their hopes for these high-performance Chromebooks with NVIDIA graphics cards might not see the light. Some experts have found proof, pointing out that Google is no longer working on this project. This doesn’t mean that the idea of launching NVIDIA-powered Chromebooks has been met with Google’s axe.

There might still be plans to bring NVIDIA graphics cards to Chromebooks, but that won’t happen anytime soon. At the moment, Google seems to be solidifying gaming on Chromebooks for users to benefit from. By doing this, Google will make more games available on Chromebooks and this will then increase the importance of an NVIDIA graphics card.

High-performance NVIDIA-powered Chromebooks are not coming soon, but the dream isn’t dead

Although plans regarding NVIDIA-powered Chromebooks are on hold, the dream isn’t. According to the folks at About Chromebooks, the codes that point out the existence of this plan have been replaced. On the ChromeOS baseboards, sources found out that codes Herobrine, Hades, and Agah are all gone.

The baseboards clearly say that these codes “are all cancelled” and their projects shut down. These codes had various attributes that pointed to Google’s work to build NVIDIA-powered Chromebooks. This is bad news for those who were looking forward to gaming Chromebooks that would use NVIDIA graphics cards.

However, the removal of these codes leads to the birth of new codes that might bring some hope. Sources also point out that a new code, Aurora, is now in existence on the ChromeOS baseboard. This new code in question makes use of the NVIDIA RTX 3050 but doesn’t show that it will be available for public usage.

Google might have the intention of using this new code to lay the groundwork for truly gaming Chromebooks. With this new code, Google might work hard to perfect Steam gaming on Chromebooks and make more non-cloud-based games available. At the moment, there are only a handful of non-cloud-based games that are available for ChromeOS gamers.

Once the work to perfect gaming on Chromebooks is done, netizens might then welcome a new graphics card to ChromeOS devices. This graphics card will be none other than the RTX series from NVIDIA. When these devices will become available isn’t clear, but fans can keep their fingers crossed in anticipation.


[ad_2]
Source link

Interpol Arrested 14 cybercriminals and 20,674 cyber networks

andreasc
-
0
Interpol Arrested 14 cybercriminals and 20,674 cyber networks
[ad_1]

The recent Africa Cyber Surge II operation conducted by INTERPOL and AFRIPOL has revealed a stark reality – the surge in digital insecurity and cybercriminals threats across Africa. 

This operation spanned 25 African countries and successfully identified 20,674 suspicious cyber networks, leading to the arrest of 14 suspected cyber criminals. 

These networks were linked to financial losses exceeding USD 40 million. This article delves into the operational highlights, key findings, and significance of the Africa Cyber Surge II operation.

Operational Highlights

The four-month Africa Cyber Surge II operation, launched in April 2023, focused on identifying cybercriminals and compromised infrastructure. 

In collaboration with the INTERPOL Africa Cybercrime Operations Desk and AFRIPOL’s Support Programme, INTERPOL’s Cyber Crime Directorate orchestrated the operation. 

Africa Cyber Surge Operation

The primary aim was to streamline cooperation between African law enforcement agencies, fostering communication, analysis, and intelligence sharing to combat cyber threats effectively. 

This operation targeted cyber extortion, phishing, business email compromise, and online scams.

Operational successes were noted across participating countries:

  • Cameroon: Arrested three suspects in connection with an online scam involving fraudulent art sales worth USD 850,000.
  • Nigeria: Apprehended a suspect accused of defrauding a Gambian victim.
  • Mauritius: Arrested two money mules linked to messaging platform-initiated scams.
  • Gambia: Took down 185 malicious Internet Protocols (IPs) through proactive measures and strong partnerships.
  • Kenya: Successfully dismantled 615 malware hosters.

Key Findings and Analysis

The operation produced around 150 analytical reports, providing participating countries with crucial intelligence and insights. 

Developed by INTERPOL in collaboration with partners like Group-IB, Trend Micro, Kaspersky, and Coinbase, these reports highlighted:

  • 3,786 malicious command and control servers
  • 14,134 victim IPs linked to data stealer cases
  • 1,415 phishing links and domains
  • 939 scam IPs
  • Over 400 other malicious URLs, IPs, and botnets.

The significance of these findings underscores the undeniable link between financial crime and cybercrime. 

By adopting a “follow the money” approach, participating countries were able to expand their law enforcement responses. 

This approach enhances the effectiveness of cybercrime departments and solidifies partnerships with vital stakeholders, including computer emergency response teams and Internet Service Providers. 

The Africa Cyber Surge II operation serves as a clarion call for global cooperation to combat cybercrime and its far-reaching impact.

The success of the Africa Cyber Surge II operation was not a singular effort. 

It was preceded by a tabletop exercise in Tanzania, imparting essential skills and knowledge to officials from 20 African countries. 

As technologies like Information Communication Technologies and Artificial Intelligence continue to evolve, it is paramount for public and private entities to collaborate against cyber criminals. 

Coordinated operations like Cyber Surge are essential for disrupting criminal networks and ensuring comprehensive levels of protection.

Funding from the UK Foreign Commonwealth and Development Office, the German Federal Foreign Office, and the Council of Europe played a pivotal role in enabling this operation, further emphasizing the necessity of international support in tackling cyber threats.

The Africa Cyber Surge II operation stands as a testament to the evolving landscape of digital insecurity and cyber threats. 

The operation successfully identified and disrupted cybercriminal networks by fostering international cooperation, sharing intelligence, and adopting innovative strategies. 

This operation highlights the urgency for governments, law enforcement agencies, and private sector partners to collaborate proactively and effectively. 

As the digital realm continues to expand, operations like Africa Cyber Surge II pave the way for a more secure and interconnected future.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


[ad_2]
Source link

New Galaxy S24 Ultra concept has an under-display camera, flat display & more

andreasc
-
0
New Galaxy S24 Ultra concept has an under-display camera, flat display & more
[ad_1]

A new Samsung Galaxy S24 Ultra concept design has just surfaced on YouTube. The video itself has a duration of around 2 minutes, and it shows a rather appealing Galaxy S24 Ultra design.

This design is mostly the designer’s imagination, of course. It is based on the previous models, to a degree, but there’s a lot of imagination thrown into the mix too. The real device will not look like this, of course.

This Galaxy S24 Ultra concept has an under-display camera, different sides & more

This model differs from the Galaxy S23 Ultra. It has a dedicated camera island on the back, though the placement of the cameras remains unchanged. All sides of this phone are curved, the bottom is not flat as it is on the Galaxy S23 Ultra.

This particular concept also includes a flat display, and no display camera hole of any kind. Its bezels are also noticeably thinner. It actually looks more like an evolution of a Galaxy S23(+) to my eyes, to be quite honest… as long as we don’t talk about the S Pen.

Yes, the S Pen is shown here as well, and it’s tucked away in the lower portion of the device. The S Pen silo is accessible from the bottom, as it is on the Galaxy S23 Ultra. You’ll also notice that all the physical buttons are located on the right-hand side of the device, as you’d expect.

The designer envisioned the phone in six color options

The phone is shown in six colors here, Gold, Phantom Black, Phanom White, and Purple, as regular colors. Deep Red and Green are supposed to be Samsung.com exclusive colors. Now, the designer did envision some specs for this phone too.

This Galaxy S24 Ultra concept has a 6.9-inch display with a 144Hz refresh rate. It also includes a 50-megapixel telephoto camera, and a new and improved telephoto periscope camera with 10x optical zoom, and 120x digital zoom.

The Snapdragon 8 Gen 3 SoC is also mentioned by the designer, along with 16GB of RAM and a 5,000mAh battery. He even envisioned a price tag for the phone, it’s $1,199.


[ad_2]
Source link

Nvidia outsources production of over half of its AI hardware to one company

andreasc
-
0
Nvidia outsources production of over half of its AI hardware to one company
[ad_1]

The Chinese company Foxconn is now responsible for producing over half of Nvidia AI hardware, Techradar (via Economic Daily reports).

When it comes to producing tech gadgets in China, Foxconn is the first name that comes to mind. The company has close ties with global tech leaders like Apple and produces their devices in China. Much of Foxconn’s reputation is due to producing iPhones. However, Nvidia is also outsourcing its AI hardware production to Foxconn.

According to Liu Yangwei, the chairman of Foxconn, the company now produces over 70% of AI servers sold globally. That said, Nvidia’s compute GPU modules, such as the A100, A800, H100, and H800, are also manufactured by Foxconn.

Foxconn agrees to produce AI hardware for Nvidia

The company is also expanding its production to servers and server cabinets, which doesn’t include Nvidia orders only. Servers that use proprietary AI processors by Amazon Web Services and Google are made by Foxconn. Demand for AI servers is skyrocketing, and Foxconn is pegging itself as the most reliable producer of servers of this kind. Inventec, Quanta, and Supermicro are other AI server producers.

Yangwei added that cloud service providers (CSPs) are the biggest customers for AI servers. AI-based applications have exploded in popularity, and cloud service providers (CSPs) strive to offer a platform capable of running these apps. Likewise, Nvidia CEO Jensen Huang has recently said AI-powered chips can reinvent computers, and AI platforms are the future of computing.

Foxconn’s CEO also stated that the company has close ties with American CSPs like Google, Amazon, and Microsoft. It’s also capable of manufacturing parts in its firm in Wisconsin to prevent unprecedented conflicts with the US government.

The AI server market is expected to reach $150 billion by 2027. The market’s value in 2023 is also estimated at $30 billion. Foxconn’s dominance will allow it to acquire a major share of this segment. According to IDC data, the entire server market was valued at $123 billion in 2022. This number can grow to $186 billion by 2027.


[ad_2]
Source link

This is how eSIM transfer will work on Android

andreasc
-
0
This is how eSIM transfer will work on Android
[ad_1]

In January this year, Google was spotted working on the ability to transfer eSIM profiles between two Android devices. While the feature has yet to roll out to the public, the company seems to have made significant progress with its development. We now have visuals of how the whole process will work.

Screenshots shared on X, formerly Twitter, by app researcher AssembleDebug show that supported Android devices will gain a new settings page for transferring eSIM profiles. You will initiate the process on your current device and then scan a QR code on the new device. Once the scanning is complete, your new phone will show some on-screen instructions. Follow them as instructed and your eSIM will be transferred to it shortly.

You will now have your eSIM profile active on your new Android phone. You don’t need to contact your carrier at any point during this process. Without this feature, which might roll out to users later this year, you first need to deactivate eSIM on your current phone and activate it on the new phone. Since some carriers require you to contact customer service for eSIM activation, that’s an added convenience.

It’s unclear if eSIM transfer will be part of Android 14

Codes associated with an eSIM transfer feature for Android devices first appeared within Android 13 QPR2 Beta 2, which was the second beta build for the second quarterly feature drop for Pixel devices (stable update rolled out in March). The feature didn’t make it to the stable build. Google has since rolled out one more feature drop, and eSIM transfer wasn’t part of that either.

In the meantime, we are now nearing the stable Android 14 rollout. It’s unclear if Google will push this feature with the latest Android version in a few weeks. Even if the initial release doesn’t bring it, we hope the company won’t take much longer to make eSIM transfer seamless for Android users. Apple already offers a built-in tool in iOS that allows iPhone users to seamlessly transfer eSIM profiles to another iPhone.

There also have been hints of Google working on the ability to convert a physical SIM card into an eSIM. Unfortunately, the latest discovery doesn’t mention anything about this feature. It’s unclear whether the company has dropped this development of this feature for the time being or if it’s still in the works. We will let you know when we have more information.


[ad_2]
Source link

New York Times could take legal action against OpenAI amidst copyright issues

andreasc
-
0
New York Times could take legal action against OpenAI amidst copyright issues
[ad_1]

The use of copyright material in training AI models such as ChatGPT has always been a matter of hot debate. Now, in a recent development, OpenAI has found itself in hot water with The New York Times, which is reportedly contemplating legal action to safeguard its intellectual property rights pertaining to journalistic content.

As reported by NPR, the root of the issue lies in OpenAI’s use of web-scraping bots to extract information, a practice that extends beyond materials that are free of copyright. This prompted The New York Times to modify its terms of service, explicitly forbidding the application of its articles and visual content for AI language model training. However, this move has also set the stage for potential legal action, as the publication aims to secure a licensing agreement, which would require OpenAI to provide compensation to The New York Times for the integration of its news stories into AI tools.

Additionally, the publication also argues that the chatbot poses a direct threat to the newspaper itself, as it generates responses based on the original reporting from the editorial team. This not only undermines the team’s efforts in reporting on specific topics but also poses a significant threat to the newspaper’s survival, especially as companies like Google and Microsoft prominently feature these AI-generated chatbot responses ahead of conventional web pages.

Legal action likely

Based on insider sources, the talks have escalated to the point where the newspaper is seriously considering legal action, a prospect that could prove detrimental to OpenAI. This is because if the court rules in favour of The New York Times, OpenAI would be compelled to erase the entire ChatGPT dataset and reconstruct its AI model exclusively using content for which it holds valid rights. Moreover, experts argue that each instance of copyrighted material used in training the AI models could potentially result in a financial liability of up to $150,000.

“If you’re copying millions of works, you can see how that becomes a number that becomes potentially fatal for a company. Copyright law is a sword that’s going to hang over the heads of AI companies for several years unless they figure out how to negotiate a solution,” said Daniel Gervais, co-director of the intellectual property program at Vanderbilt University.


[ad_2]
Source link

ScrutisWeb ATM Software Vulnerabilities Risked ATMs’ Security

andreasc
-
0
ScrutisWeb ATM Software Vulnerabilities Risked ATMs’ Security
[ad_1]

Researchers found numerous security vulnerabilities in the ScrutisWeb ATM fleet monitoring software that threatened ATM security. Exploiting the vulnerabilities could allow an adversary to hack target ATMs.

Multiple Vulnerabilities Found In ScrutisWeb ATM Software

The US CISA has recently warned users of numerous serious vulnerabilities affecting the Iagona ScrutisWeb ATM fleet monitoring software.

ScrutisWeb is a dedicated ATM software from Iagona – an industrial software provider firm – that empowers banks and the retail sector in monitoring ATM fleets for security issues and other software/hardware glitches.

According to CISA’s advisory, three researchers, Neil Graves, Jorian van den Hout, and Malcolm Stagg, discovered numerous security vulnerabilities in ScrutisWeb ATM software, which directly risked the security of the respective ATMs.

Specifically, they found the following vulnerabilities affecting the Iagona ScrutisWeb versions 2.1.37 and earlier.

  • CVE-2023-33871 (CVSS 7.5): a directory traversal vulnerability allowing an unauthenticated adversary to access any file outside the webroot.
  • CVE-2023-38257 (CVSS 7.5): an Insecure Direct Object Reference (IDOR) vulnerability that an unauthenticated adversary may exploit to view profile data and login credentials (with encrypted passwords).
  • CVE-2023-35763 (CVSS 5.5): a vulnerability affecting the cryptographic functionality that would allow an unauthenticated attacker to decrypt encrypted passwords in plaintext.
  • CVE-2023-35189 (CVSS 10): a critical-severity remote code execution flaw letting an unauthenticated attacker upload and execute malicious payloads on the target systems.

Upon discovering the vulnerabilities, the researchers reported the flaws to CISA, recommending the following mitigations.

  • Minimizing network exposure for control devices/systems.
  • Isolating control system networks and devices from the business network and securing them with firewalls.
  • Deploying VPNs to secure remote access to the systems.

Besides, Iagona has also patched the vulnerabilities with ScrutisWeb v2.1.38. Hence, all ScrutisWeb customers must update their systems with the latest software updates to receive the patches. Moreover, CISA advises organizations to perform impact analysis, risk assessments and consider ATM penetration testing before deploying defensive measures.

Let us know your thoughts in the comments.

 


[ad_2]
Source link

X won’t allow you to block other users any longer

andreasc
-
0
X won’t allow you to block other users any longer
[ad_1]

X (formerly known as Twitter) is reportedly working on a new feature that makes it impossible to block users on the platform. According to BBC, the company chief Elon Musk said blocking users “makes no sense,” and the feature will be removed.

Blocking users is a common way on social platforms to prevent users from reaching your content or stopping them from abusing you. However, X is now going in the opposite direction and wants to remove the blocking feature. Of course, you will still be able to block users from directly messaging you. But you can no longer stop them from interactions.

Some users now complain that removing the blocking feature makes removing abusive posts and users from the timeline harder. When you now block a user on the platform, his posts no longer appear on your timeline, and he cannot send you direct messages.

You can no longer block users on X (Twitter)

Twitter former CEO Jack Dorsey also agrees with the change, saying, “100%. Mute only.” But the problem with a complete mute is it might not provide enough protection against abusive users. A muted user can still interact with the muter and comment on his posts.

Additionaly, Musk’s decision to remove blocking features contradicts App Store and Google Play Store policies. Both stores require social platforms to provide users with tools to protect themselves against harassment, including the ability to block. Insisting on implementing the change might lead to removing the X app from both app stores unless Musk can settle with Google and Apple.

Another question that X needs to answer is whether the accounts that were blocked before the implementation of this decision will be automatically unblocked. If the change takes effect, the only way to protect your tweets is to make your account private.

Protecting free speech was arguably one of Elon Musk’s main incentives to pay $44 billion for Twitter. After taking over the company, the billionaire reinstated some controversial accounts like Andrew Tate, Jordan Peterson, and Donald Trump. Removing the blocking feature might also align with Musk’s free speech incentives and the “digital town square” he wants to build.


[ad_2]
Source link
1...991992993...1,482Page 992 of 1,482