In Today’s Tech News:

1. Hackers Demand Reddit Reverts
2. AI Is (Not) Giving Away Windows Keys
3. Microsoft Confirms They Were DDoSed
4. Your AI May Be Stealing From You

Hackers Demand Reddit Reverts

Ransomware group BlackCat has claimed responsibility for the phishing attack on Reddit that occurred in February. 

The group asserts that it has obtained 80GB of data and threatens to publicly release it unless Reddit pays a $4.5 million ransom and rolls back its proposed API pricing changes, which sparked protests from users and moderators. 

Reddit confirmed the February breach involved a sophisticated and highly targeted phishing attack but stated that user data not already public had not been accessed. 

Reddit declined to comment on the recent claims made by BlackCat.

You can find out more about the current Reddit revolt at 2minutetechbytes.com

Sources:

AI Is (Not) Giving Away Windows Keys

Twitter user, @immasiddtweets, discovered that ChatGPT can generate free Windows 10 and 11 keys when prompted correctly. 

Screenshots of the generated keys went viral on Twitter, however, it was reported that the keys generated by ChatGPT and Google Bard were generic license keys, limiting the functionality of the operating system to the basic version.

When attempting to replicate the results, both chatbots initially decline to generate the keys, stating they lack the ability to do so, but after some prompt engineering, specifically telling the LLMs that a deceased grandmother would read Windows 10 Pro keys as bedtime stories both chatbots eventually provided keys. 

It is unclear if the keys generated are from LLM hallucinations or if the responses are from scraped articles from around the internet, but we are excited to see what users crack next.

Sources:

Microsoft Confirms They Were DDoSed

Microsoft has confirmed that recent outages to the Azure, Outlook, and OneDrive web portals were the results of layer 7 DDoS attacks.

Layer 7 DDoS attacks, or distributed denial of service attacks, are carried out at the application level of the OSI Model, the model describing standard machine-to-machine communication layers found in the sources below.

Anonymous Sudan has claimed responsibility for the attack that took out Outlook.com on June 7th, OneDrive on the 8th, and finally the Azure portal on June 9th.

Microsoft originally hinted they were being DDoSed during the incident stating they were “applying load balancing processes in order to mitigate the issue.” but did not confirm til a press release on June 19th.

Anonymous Sudan, or Storm-1359, is known for targeting organizations and government agencies worldwide, taking them down in DDoS attacks or leaking stolen data.

Sources:

Your AI May Be Stealing From You

Unit 42, a security research team at Palo Alto Networks has found ChatGPT impersonation apps targeting Android users.

SuperGPT, an AI assistant that uses GPT4 as its backend has an evil twin that has been found disturbing Command and Control Malware.

The real app, shown on screen now, will help you write emails, answer questions, and translate literature while the masquerading malware will give an attacker control of the Android device through the Meterpreter Trojan.

Another Android app, this time a ChatGPT rip-off, was found sending premium text messages to a hard-coded Taiwanese phone number after getting access to the SEND_SMS Android permission.

To mitigate your risk of AI exploitation,

• Never put sensitive information into AI generative services like ChatGPT or Bard
• Track and review all LLM use-cases to ensure no sensitive information is being exposed
• Proactively notify employees of the security risks associated with using AI generative services in the workplace.
• Never download apps from 3rd party distributors

Sources:

What Are Your Thoughts?

1. Will Reddit or its community win the stand-off?
2. Are DDoS attacks making a comeback as a new norm?
3. Why would life give you lemons?

Let us know your thoughts in the comments at the bottom of the page!

In Today’s Tech News:

1. Mac Gaming Is Right Around the Corner
2. Apple Acquires Industrial AR Startup Mira
3. WordPress Gets an AI Jetpack
4. LLM Hallucinations Proven To Be Deadly

Mac Gaming Is Right Around the Corner

The Worldwide Developers Conference has brought incredible news for Mac gamers.

The Game Porting Toolkit was announced bringing Windows gaming capabilities to macOS Sanoma using similar translation methods as Valve’s Proton.

Under the hood, Apple is using Code Weavers CrossOver source code, specifically recognizing the open-source project Wine as an incredible answer to Windows gaming on macOS.

Reddit has already gotten its hands on the Sanoma beta as its users have shared footage of Cyberpunk 2077, Diablo IV, and Hogwarts Legacy all running on Apple’s M-series devices.

The posts showing off the gameplay can be found in our sources below.

As a final bonus, Hideo Kojima announced Death Stranding Director’s Cut will be coming to macOS.

Sources:

Apple Acquires Industrial AR Startup Mira

Mira, an augmented reality corporation focused on lightweight headsets for front-line business and military applications, has been acquired by Apple just one day after the announcement of the Vision Pro.

It is currently unknown how much Apple paid for the Los Angeles-based organization, but they had already acquired $17 million in funding up to this point.

Mira is focused on business applications of AR and has contracts within multiple industries including manufacturing, mining, entertainment, and defense.

Most contract details are unknown as they are private, but according to public records, a contract with the US Navy is valued at over $700,000.

Another contract is with Nintendo World as the headsets used for the Mario Kart ride were developed by Mira as well.

According to The Verge, Apple has brought on at least 11 employees from Mira, begging the question, what is Apple up to?

Sources:

WordPress Gets an AI Jetpack

Automattic, the organization that owns WordPress, has released a generative AI plugin for WordPress called the Jetpack AI Assistant.

The “creative writing partner” will be free for a limited time for WordPress.com users while others get 20 free requests before paying a monthly fee of $10.

Features of the plugin include headline creation from post summaries, tone adjustment throughout the post, entire post and table creation through prompting, intense spelling and grammar checks, translation between 12 languages including English, Spanish, French, and Chinese, and finally a conversational UI, much like ChatGPT, Bing Chat, and Bard.

To use the Jetpack AI Assistant, install the plugin to your WordPress site, add an “AI Assitant” block to your post through the block editor, and prompt to your heart’s desire.

A major concern of AI is the amount of low-grade automated garbage created, but we will have to see how or if Automattic will handle the abuse of their generative AI.

Sources

LLM Hallucinations Proven To Be Deadly

Researchers at Vulcan Cyber have recently released a proof of concept describing how attackers can easily use ChatGPT to help them spread malicious packages into developers’ environments.

They are calling the new technique “AI package hallucination” as the attack vector is as follows…

• The attacker prompts a large-language-model, or LLM, such as ChatGPT or Bard with a coding problem
• The LLM responds with the hallucinated package that doesn’t exist publicly
• The attacker creates and publishes the package containing malware (with or without expected package functionality)
• A developer then prompts the LLM with a similar problem
• The LLM responds with the hallucinated package as a solution
• The developer then installs and uses the malicious package unknowingly
• Finally, the package is run and information is sent to the attacker’s Command and Control server

Techniques used within this attack include typosquatting, masquerading, dependency confusion, software package hijacking, and trojan packaging.

As this is a brand new technique, ways to mitigate your risk are limited but include best practices such as

• Validating and verifying all packages used when building out solutions before installing them
• Auditing and monitoring the libraries and packages already used within your solutions
  • This includes static scans of obfuscated code as well as checking for common vulnerabilities and exposures or CVEs such as the OWASP top 10
• Auditing outbound links to external sites and assets
• Auditing your networking and communications for any unexpected outbound or inbound traffic

Sources:

What Are Your Thoughts?

• Is Apple’s true focus on AR a bet on itself over generative AI?  
• Will Jetpack AI be a great tool or a hindrance for journalism as a whole?  
• Why did the cookie go to the doctor? (It was feeling pretty crumby) 

Let us know your thoughts in the comments at the bottom of the page!

In Today’s Tech News:

1. Apple’s Vision Pro Magic VR Goggles
2. Reddit’s Blackout Due To API Price Hikes
3. Apple’s New & Updated Operating Systems
4. Info-Robbing Malware: Bandit Stealer

Apple’s Vision Pro Magic VR Goggles

Apple has finally announced its entry into the world of VR with the Vision Pro, a hybrid augmented and virtual reality headset.

The goggles are slated to be $3500 and are planned to be released in Q1 or Q2 of 2024.

The Vision Pro is the first original device from Apple since the AirTag, released in 2021, the first original multi-media device since the HomePod speaker, released in 2018, and the first original screen-interactive device since the release of the Apple Watch in April 2015.

The standalone headset will rely entirely on voice inputs and hand/eye gestures and will be protected by Optic ID optical authentication.

Tech Youtuber Marques Brownlee got his hands on it and called the device’s eye-tracking “the closest thing I’ve seen to magic,”

CEO Tim Cook stated he believes the “Apple Vision Pro is a revolutionary product,”

Sources:

Reddit’s Blackout Due To API Price Hikes

Reddit’s community is planning a 48-hour plus blackout as a response to the recent API price change announcement.

A full list of subreddits participating can be found in our sources and include massive communities such as r/aww, r/videos, and r/technology.

The changes, announced by Apollo creator Christian Selig and covered in last Friday’s Tech Byte linked now, would cost 3rd party Reddit browsers up to $20 million per year.

The price hikes are theorized to kill 3rd party apps including Apollo, BaconReader, Reddit is Fun, and old.reddit, which enables users to create their own customizable browsing experience

The users most affected will actually be the moderators as the 1st party Reddit app has abysmal mod tooling and the largest subreddits have incredible traffic that needs moderation.

The blackout is to begin on June 12th and last over 48 hours through June 14th or longer depending on the response from Reddit.

A few subreddits have decided to participate in a permanent blackout due to the moderation tools being affected.

The original announcement and list of subreddits participating can be found in our sources in the description.

Sources:

Apple’s New & Updated Operating Systems

Along with the Vision Pro, Apple has announced quite a few updates coming down the pipe over the next year.

A majority of the announcements were operating system updates including iOS 17, macOS Sonoma, watchOS 10, and visionOS, the new operating system powering the Vision Pro.

Sonoma, the new macOS, has exciting new features including new gaming functionality using Apple’s upgraded graphics processing and Metal 3 frameworks and AR functionality for Zoom and Teams.

Along with the software announcements, Apple unveiled their new 15-inch MacBook Air as well as M2 Max and M2 Ultra versions of their Mac Studio and Mac Pro.

The new Mac Pro will be Apple’s highest-end desktop costing $7,000 for the M2 Ultra package featuring a 24-core CPU, 76-core GPU, 8 Thunderbolt 4 ports, and supporting up to 7 Pro XDR displays.

We will be keeping our eye on WWDC and will have more coverage come Friday.

Sources:

Info-Robbing Malware: Bandit Stealer

Bandit Stealer, the Go-written information stealer covered last week has had more information come to light as researchers from the Zscaler ThreatLabz have released a more in-depth technical analysis of the malware.

The updates include lists of blacklisted IPs, Mac addresses, users, PC names, and processes that, if present, will trigger a self-termination.

Processes include Vmware, VirtualBox, KVM, and the Windows Debugger, including the remote debugger.

On top of listing what will cause the stealer to kill itself, the researchers also delivered fuller lists of affected web browsers, crypto wallets, FTP clients, and email clients where information can be stolen, all of which can be found in our sources in the description.

To mitigate your risk

• Regularly back up important data
• Follow the 3-2-1 rule of data storage: 3 copies, on 2 formats, 1 of which is off-site.
• Keep your operating system up to date
• Use strong, unique passwords
• Enable 2FA wherever possible
• Consider a reputable anti-malware solution like BitDefender or Malwarebytes

Sources:

What Are Your Thoughts?

• Do you think Apple can revitalize the VR market?  
• Is Reddit going to change its stance?  
• What did the janitor say when he jumped out of the closet? 

Let us know your thoughts in the comments at the bottom of the page!

In Today’s Tech News:

1. Reddit’s API Price Hikes
2. CrowdStrike’s Security AI, Charlotte
3. Google Triples Chrome Exploit Bounty
4. Motherboards Sold with a Backdoor

Reddit’s API Price Hikes

Reddit is showing signs of mutiny as Apollo creator Christian Selig posted about upcoming Reddit API price changes.

Apollo is a 3rd-party Reddit browsing app known for its customization, affordable ad-free subscription, and user-friendly experience.

In the post found in our sources in the description below, Selig unveiled the new API price of $12,000 per 50 million requests.

To put that into perspective, Imgur, the image-sharing platform has a similar pricing model with very different pricing as 50 million image requests come in at $166, or about 1.38% of the cost.

Mr. Selig did a fantastic breakdown estimation that resulted in 1st party users having a value of about $0.12/month and 3rd party users having over 20x the value at $2.50/month.

This came months after Twitter’s price hikes to $42,000 per 50 million requests but the company stated that they will be “A) reasonable and based in reality, and B) they would not operate like Twitter”

We will have to wait and see Reddit’s official response.

Sources:

CrowdStrike’s Security AI, Charlotte

Crowdstrike is joining the AI arms race by unveiling their security-focused generative AI called Charlotte.

The model will accept natural language questions and prompts to interact with the Falcon platform enabling users with minimal experience to become power users.

Charlotte is designed to help at every level of the organization including enabling IT helpdesk workers to ask if specific software is safe, assisting security analysts in threat-hunting efforts, enabling executives to get real-time domain-wide security reports, and assisting engineers in automating mundane manual security tasks.

The training data CrowdStrike has revealed includes their deep intelligence knowledge base, Falcon’s XDR telemetry, and hundreds of thousands of human-to-human interactions their internal security and engagement teams have recorded.

Charlotte is currently in a closed private customer preview.

Sources:

Google Triples Chrome Exploit Bounty

If you are proficient in exploiting web browsers, you may be interested in Google’s new exploit bounty payout!

The giant is tripling the bounty for a functional full-chain exploit resulting in a Chrome sandbox escape to the first hacker to accomplish it by December 1st.

The payout is expected to be up to $180,000.

Once the first bounty has been paid, all other functional full-chain exploits resulting in a Chrome sandbox escape will payout double (up to $120,000) all the way til December 1st.

Both the blog announcement from Google Chrome Security Team member Amy Ressler and the Chrome Vulnerability Reward Program reward matrix will be in our sources in the description below.

Sources:

Motherboards Sold with a Backdoor

Eclypsium researchers have discovered Gigabyte motherboards sold recently come with the bonus feature of an insecure backdoor.

The UEFI firmware, or the code that tells the PC how to load the OS, would load and run an updater program on start-up that in turn would download and execute software without the operating system’s knowledge.

While not intended to be malicious, the update mechanism was downloading code without proper authentication and sometimes downloading over http instead of https.

This can lead to a very simple man-in-the-middle attack being carried out before your operating system is done spinning up.

271 models have been affected including both AMD and Intel-compatible boards.

The full list of affected motherboards can be found in our sources.

To mitigate your risk of this exploit according to Eclypsium…

• Scan and monitor systems and firmware updates in order to detect affected Gigabyte systems and the backdoor-like tools embedded in firmware.
• Update systems to the latest validated firmware and software in order to address security issues like this one.
• Inspect and disable the “APP Center Download & Install” feature in UEFI/BIOS Setup on Gigabyte systems
• Set a BIOS password to deter malicious changes.
• Administrators can also block the following URLs:
  • http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
  • https://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
  • https://software-nas/Swhttp/LiveUpdate4

Sources:

What Are Your Thoughts?

• Is Reddit trying to kill 3rd party apps or correctly value their API? 
• When will the $180,000 bug bounty be claimed? 
• If a tree falls in a forest, does it make a sound?

Let us know your thoughts in the comments at the bottom of the page!

In Today’s Tech News:

1. Tesla’s Massive Document Leak
2. Google Fined $32.5 Million
3. Apple Fined $50M for Faulty Keyboard
4. Bandit, a New Go-Written Info Stealer

Tesla’s Massive Document Leak

Tesla is in the hot seat as over 23,000 internal files and documents were leaked to the german news organization Handelsblatt.

The documents hold information from 2015-2022 and include PII, or personally identifiable information, for over 100,000 current and former employees.

Along with the PII, the documents include 2400 reports about self-acceleration issues, 1500 reports about braking problems, 139 about unintentional emergency breaking, 383 about phantom stops from flash collisions, over 1000 crash reports and 3000 records where drivers expressed concerns about the driver assistance system.

Tesla has not publicly responded to the documents and is considering the data stolen via their Managing Counsel for Litigation, Joseph Alm.

Further more, the company is suing the ex-employee for “theft of Tesla confidential information and employees’ personal data.” 

Sources:

Google Fined $32.5 Million

Google has been given a crushing defeat as it has been fined $32.5 million in a verdict Friday, May 26th.

The legal battle that started in 2020 revolves around the use of patented multi-room audio technology owned by the audio technology company, Sonos.

This was not a crushing victory for Sonos as the jury deemed Google was not infringing on a separate patent regarding the Google Home app which was estimated to rack up $90 million in damages according to a Sonos expert witness.

The final fine set was broken down to $2.30 per unit, across 14,133,558 units for a grand total of $32,507,183.40.

The honorable Judge William Alsup was preceding the case and described it as an “emblematic of the worst of patent litigation” going on, addressing the issue surrounding the technical jargon within the patents.

Law360 reported that he had to check in at points that the jurors were awake during the hearing.

Sources:

Apple Fined $50M for Faulty Keyboard

Apple is also being charged with a fine as US District Judge Edward Davila upheld a $50 million settlement Friday.

The case revolves around the MacBook butterfly keyboard installed in MacBooks, MacBook Airs, and MacBook Pros from 2015 and 2016.

The lawsuit alleged that Apple failed to provide sufficient repairs or troubleshooting help for specific MacBook “butterfly” keyboards manufactured between 2015 and 2019.

Class members are expected to receive between $50 and $395 dependant upon the number of repairs they endured and the number of requests the settlement gets.

Currently, more than 86,000 claims have been submitted.

The amount seen by the end users will only hit a max of $35 million as the judge granted Apple’s lawyers’ request for $15 million in legal fees

Sources:

Bandit, a New Go-Written Info Stealer

Bandit, a new Go-written information stealer currently targeting Windows systems has been found in the wild by TrendMicro Friday.

The malware is currently Window’s only, but does have Linux commands in it’s execution, prompting researchers to expect a cross-platform version soon.

The current techniques used are similar to python based stealers including Creal Stealer, Luna Grabber, Kyoku Cookie token stealer, and Pegasus Stealer

Currently, the executable steals computer details including IP, location, and OS details; browser data including logins, cookies, history, and credit cards; local crypto currencies including Bitcoin and Ethereum; and Crypto wallets including Crypto.com and Clover.

There are not currently any groups associated with this malware.

To mitigate your risk of stealers

• Update your operating system
• Install a reputable antivirus
• Enable 2FA wherever possible
• Don’t download anything you aren’t expecting

Sources:

What Are Your Thoughts?

• Have you enabled 2FA on your YouTube account?
• How far out are self-driving cars?
• Did Peter really pick a patch of picked peppers?

Let us know your thoughts in the comments at the bottom of the page!

Today In Tech News:

1. Photoshop Gets an AI Upgrade
2. Winrar Sunset by Windows Update
3. Apple’s Multi-Billion Dollar US Deal
4. Android’s Screen Recording Trojan

Photoshop Gets an AI Upgrade

Adobe has given Photoshop an incredible facelift with its new integration with the Firefly generative AI.

The go-to design platform will now allow creators to add, extend, and remove content using simple text prompts with  the “worlds-first” co-pilot in creative and design workflows.

The changes created by the AI will be non-destructive as each of the generated edits will live on their own layer of the project.

Photoshop is the first app to get an AI co-pilot, but Adobe has announced that they plan on bringing Firefly integrations across the Creative Cloud suite, Document Cloud suite, Experience Cloud suite, and Adobe Express.

The AI co-pilot is currently available in the desktop beta version of Photoshop and will be generally available in Q3 or Q4 of this year.

Sources:

Winrar Sunset by Windows Update

Panos Panay, Microsoft’s Chief Product Officer of Windows and Devices, has announced upcoming Windows 11 features in a blog post Tuesday.

Features mentioned include:

• A native AI assistant called Windows Co-pilot, 
• Native Bing Chat plugins, 
• A development productivity companion called Dev Home, 
• AI features in the Microsoft Store
• Native support for .rar, .7z, and .gz archive formats

This means you will no longer have to not pay for Winrar or 7zip as Microsoft is integrating libarchive into Windows 11.

Libarchive is an open-source Multi-format archive and compression library written in C and has been used by other operating systems since as early as 2004.

According to Panay, “You now can get improved performance of archive functionality during compression on Windows.”

Microsoft sources at The Verge have stated that Windows 11 support for the new formats should roll out in a work-in-progress build later this week.

Sources:

Apple’s Multi-Billion Dollar US Deal

Apple is making moves to fulfill its investment promise to the United States with a multiyear, multi-billion dollar deal with the technology manufacturing giant Broadcom.

The partnership is revolving around the manufacturing of 5G radio frequency components and highlighted the manufacturing of Film Bulk Acoustic Resonator filters, or FBAR filters, for future Apple products.

CEO Tim Cook has spoken on the partnership saying “We’re thrilled to make commitments that harness the ingenuity, creativity, and innovative spirit of American manufacturing…” and that the company will “continue to deepen our investments in the U.S. economy because we have an unshakable belief in America’s future.”

The release highlighted the Broadcom facility in Fort Collins Colorado as a key manufacturing and technology hub as the partnership hopes to expand upon the 1,100 Broadcom jobs there today.

This deal is expected to be one of many over the next few years as it is a part of the $430 billion investment commitment Apple promised the United States economy in 2021. 

Sources:

Android’s Screen Recording Trojan

The ESET security team, a Google App Defense Alliance partner, has deemed a once harmless Android screen recorder as a Trojan.

The iRecorder – Screen Recorder app, was originally released in the fall of 2021 as a vanilla screen recorder until August 2022, when version 1.3.8 was released.

The new version came with malware based on the open-source project AhMyth that ESET has dubbed AhRat.

Once the app is installed, the Trojan has the ability to turn on the microphone to record audio and grab files with the extensions seen on screen, including images, web pages, videos, and documents.  

It then can compress the files into archives, and finally sends the archives to a Command and Control server.

Once the attack has run its course the rat pings the C&C server to ask for new attack configurations every 15 minutes.

Google has removed iRecorder from its store but 3rd party stores are still hosting the malicious app for download.

Ways to mitigate your risk of app trojans are to 

• update your phone’s operating system to the latest version, 
• avoid downloading apps from third-party marketplaces, 
• remain cautious when granting third-party apps permission to access your files, camera, and microphone, 
• and finally use a mobile antivirus like Bitdefender or Norton

Sources:

What Are Your Thoughts?

• Do you prefer Winrar or 7-zip?
• Will Adobe’s AI give it the advantage it needs over free options?
• Who sold sea shells by the sea shore? 

Let us know your thoughts in the comments at the bottom of the page!

Today In Tech News:

1. EU Fines Meta For Data Privacy Violation
2. Apple Trademarks Augmented Reality Names
3. Apple Releases Security Patch For WebKit
4. FIN7 (Now Sangria Tempest) Ransomware

EU Fines Meta For Data Privacy Violation

Meta has yet again crossed a line in the EU as the company has been fined €1.2 billion for infringing the General Data Protection Regulation, or GDPR.

The GDPR is a set of regulations and standards that define what is OK to do with European data.

The group handing out the punishment is Ireland’s Data Protection Commission, the group responsible for Meta’s European oversight.

On top of the fine, Meta is to “suspend any future transfer of personal data to the US within the period of five months”.

This means Meta will either have to undergo a massive infrastructure initiative as only 4 of its 21 data centers are outside the US, or it will have to appeal.

Shocker that they have already announced their intent to appeal.

If the appeal fails, Meta may have to follow through with a warning from last year, shutting down Facebook and Instagram in Europe.

Sources:

Apple Trademarks Augmented Reality Names

Many rumors have surfaced as Apple has applied for four trademarks related to its augmented reality system over the past week.

The trademarks include xrOS, xrProOS, realityproOS, and realOS.

xrOS was filed for last Tuesday, the other three were filed yesterday.

The AR headset is estimated to have a manufacturing cost of $1500 and a price estimate of $3000.

Highlights from the parts list include Dual M2 processors, two micro OLED displays, and a whopping 14 cameras!

For an in-depth breakdown of the costs, check out our sources in the description below.

Nothing official has come from Apple, but the device is expected to be revealed at Apple’s Worldwide Developers Conference on June 5th.

We will be keeping a close eye on this one.

Sources:

Apple Releases Security Patch For WebKit

On the opposite side, Apple released a patch for security vulnerabilities around the WebKit browser engine, the engine powering Safari.

The browser engine, used across all of Apple’s native operating systems, had 3 vulnerabilities announced, two of which were originally addressed in the failed Rapid Security Response deployment from May 1st.

The scariest of the three, CVE-2023-32409, allowed attackers to escape the Web Content sandbox, opening up the system to anything from Command and Control to Ransomware attacks.

The update has been deployed to almost all device operating systems and Safari.

To protect yourself from these zero-day attacks, make sure all your Apple devices are on the latest version of their operating systems.

Sources:

FIN7 (Now Sangria Tempest) Ransomware

Microsoft has found traces of an old hacking rival once thought dead.

Sangria Tempest, previously known as the infamous FIN7, has been found launching a ransomware campaign targeting PaperCut.

If that sounds familiar, this is the same vulnerability the Bl00dy Ransomware Gang was exploiting in last week’s security segment.

FIN7 had been inactive since late 2021, but last month Microsoft found traces of their Lizar backdoor on affected systems.

The attack vector includes a highly obfuscated PowerShell script called POWERTRASH that loads a Lizar or Diceloader backdoor for network access.

Once breached, the attacker uses OpenSSH and Impacket, a network protocol python collection, to deploy the Clop ransomware, effectively pwning the system.

Much like last week, the best ways to mitigate your risk include following the 3-2-1 rule of data storage, implementing network segmentation, enforcing the principle of least privilege, upgrading PaperCut to the latest versions, and ensuring your PaperCut servers are not internet accessible.

In summary, a malicious shell script opens a back door allowing for the deployment of the Clop Ransomware, pwning the system.

Sources:

What Are Your Thoughts?

• Will Apple’s AR system revitalize the market?
• Where do hacking groups get their names?
• How much wood would a woodchuck chuck if a woodchuck could chuck wood?

Let us know your thoughts in the comments at the bottom of the page!

Today In Tech News:

1. Apple Car System – Stolen Trade Secrets
2. OpenAI CEO’s Congressional Hearing
3. Google Plans To Delete Inactive Accounts
4. Hardware Hack: Wemo Mini Smart Plug

Apple Car System – Stolen Trade Secrets

The United States is suing an ex-Apple employee for six counts of trade secret theft allegedly committed in 2016.

Weibao Wang was a member of the team responsible for developing algorithms for annotating real-world objects for the Apple Car system. 

He had broad access to the team’s databases and is accused of stealing Apple’s entire autonomy source code as well as hardware and systems information.

Before getting access, Wang had to sign confidentiality and Intellectual Property Agreements as well as attended Apple’s secrecy training.

Wang resigned in 2018 and relocated to Guangzhou China before US officials could get him.

Wang is one of three ex-Apple employees accused of trade secret theft around the Apple Car systems.

Xiaolang Zhang pled guilty as part of a plea and Jizhong Chen pled not guilty.

If Wang is extradited and convicted, he could receive up to 60 years behind bars.

Sources:

OpenAI CEO’s Congressional Hearing

OpenAI CEO Sam Altman expressed both positive visions and harrowing realities of what AI could do in a congressional hearing Wednesday, May 16th.

Lawmakers held the hearing to discuss the future of AI and the potential regulation of future implementations.

The hearing, unlike others regarding AI, was met with bipartisan support and focused on listening to what Mr. Altman’s opinions and predictions were regarding regulating the technology as the US is currently behind both the EU and China in implementing restrictions.

One point that all parties agreed on was Section 230, a law that protects social media companies from liability for their users’ content, does not apply to AI models.  This means AI model owners can be sued for something a user on their platform has trained the model to do.

Two of Mr. Altman’s regulation ideas are a government agency responsible for oversight and licensing for organizations working on advanced AI models as well as an international regulation committee, much like the International Atomic Energy Agency (IAEA) today.

Congress members compared the current AI boom to the first cellphone, the internet, the industrial revolution, the printing press, and most hauntingly the atomic bomb.

Sources:

Google Plans To Delete Inactive Accounts

Google is going to begin deleting abandoned accounts starting as soon as December.

The company is implementing a phased approach, so starting this year they will be focussing on accounts that were created and never used.

The account service will send notifications to both the account email and recovery email months before deletion occurs.

The following actions will keep your account active

• Reading or sending an email
• Using Google Drive
• Watching a YouTube video
• Downloading an app on the Google Play Store
• Using Google Search while logged in
• Using your Google account to sign in to a third-party app or service

Accounts associated with subscriptions like Google One, News providers, or app logins are not considered inactive. 

To back up your account data, you can use Google’s Takeout service to export and download your data.

You can find a link to the Google blog in our sources below. 

Sources:

Hardware Hack: Wemo Mini Smart Plug

In security news a hardware hack discovered in January has come to light as the Wemo Mini Smart Plug v2 has been cracked.

The team at Sternum, an IoT security company, found a “FriendlyName” vulnerability with the plug that can lead to a Command and Control attack.

The name comes from the editable name field of the device as the attack vector starts with a buffer overflow when assigning a name over 30 characters to the device.

Sternum informed Belkin about the exploit in January but the company has since declared the product’s end-of-life meaning there are no plans to patch the vulnerability.

You can mitigate your risk by

• Not exposing the device’s UPNP port to the internet, including port-forwarding
• Making sure any devices on the shared network aren’t sensitive

The most secure path is using another smart plug without unpatched vulnerabilities.

Sources:

What Are Your Thoughts?

• What story did you find the most interesting this week? 
• Do you think Google cleaning old accounts is going to set a new standard?
• How many licks does it take to get to the center of a tootsie pop? 

Let us know your thoughts in the comments at the bottom of the page!

Today In Tech News:

1. Google Goes All-In on AI
2. Google has New Androids
3. FTC Goes After Robocaller
4. Bl00dy Ransomware Gang Hits Education

Google Goes All-In on AI

Google IO happened last Wednesday, May 10th, and brought with it Google’s new initiatives, most of which revolve around the world of AI.

We will be running through them quickly, so if any of these announcements piques your interest, check out our sources in the description below.

Bard is getting a massive facelift as Google has announced PaLM 2, Google’s answer to GPT-4.

On top of better math, logic, and coding outputs, Bard is getting image processing and generation.

If you would like to play with Bard, you no longer have to wait as the waitlist has been dropped for over 180 countries and territories.

Search got an upgrade that will now pull data from multiple sources and give its generated report before showing results.

On top of that, search now has a conversational mode, much like how chat GPT works today.

Google Images also got some AI love with the new Magic Editor, an AI assistant for partial image generation and editing.

Maps revealed a new feature that gives the user an immersive route experience before they start their trip, allowing them to see what their route will look like.

Duet AI was announced for Google Workspace, the umbrella product including sheets and docs.

The AI is a generative assistant that can help with both text and image generation that will eventually be accessible from any document through the Sidekick menu.

A Google Cloud model training platform called Vertex AI was revealed allowing individuals to train their models on specialized cloud infrastructure.

A personal note-taking and organizational assistant called Project Tailwind was announced and the waitlist became available.

Finally, Google announced their Responsible AI project that will help track the origin of generated photos, attempt to find where photos originated from on the internet, and add metadata to Google-generated images for better validation and authenticity.

Sources:

Google has New Androids

On top of all the AI announcements, Google revealed their new Android devices and features coming to the platform.

Highlights of the features include adding Find My Device support to devices like headphones and tablets, AI-generated original wallpapers, and, in association with Apple, defining an industry standard for unknown tracker alerts so all tracked devices can work together.

The hardware announced included a new Pixel Fold phone that unfolds into a small tablet as well as a Pixel Tablet.

The Pixel Fold is available for preorder and comes in at $1799 for the 256GB model and $1919 for the 512GB model

The Pixel Tablet is also available for preorder and comes in at $499 for the 128GB model and $599 for the 256GB model.

All links to preorder are available on our sources link in the description below.

Sources:

FTC Goes After Robocaller

The Federal Trade Commission is going after a robocalling giant called Xcast Labs Inc.

Xcast allegedly violated the Federal Trade Commission Act (“FTC Act”), the Telemarketing and Consumer Fraud and Abuse Prevention Act (“Telemarketing Act”), and the Telemarketing Sales Rule, (TSR)

The violations include funneling hundreds of millions if not billions of illegal robocalls through its network, impersonating federal officials from the Social Security Administration, threatening to cut off utilities, and claiming that credit cards had been charged when it was untrue.

The FTC had given XCast Labs multiple written warnings including a letter from January 29th, 2020 that warned the voice-over IP, or VoIP, provider, that they were assisting and facilitating illegal robocalls.

Despite this warning, XCast continued to transmit calls through its network.

The court is seeking a decree to prevent future violations, monetary civil penalties of up to $50,120 per offense, and any other financial relief the court sees fit.

Sources:

Bl00dy Ransomware Gang Hits Education

A hacking group called the Bl00dy Ransomware Gang has been targeting the education sector through PaperCut, a print management system.

The attackers used vulnerable versions of the PaperCut software to create an attack vector with the following attributes.

• Bypassed authentication through a Java class with broken access control.
• Executed remote code with root-level shell commands through the print scripting interface
• Encrypted underlying file systems, 
• Exfiltrated data through Tor proxies, 
• And finally left ransom notes with payment requirement information.

There is also evidence that command and Control malware including DiceLoader, TrueBot, and Cobal Strike Beacons, was being deployed, but the placement within the attack vector is still unknown.

To mitigate your and your organization’s risk

• Upgrade PaperCut to the latest versions
• Ensure PaperCut servers are not internet accessible
• Follow the 3-2-1 rule of data storage
• Implement network segmentation
• Finally enforce the principle of least privilege.

Sources:

Today In Tech News:

1. Wendy’s AI Order Takers
2. Amazon Targets Pickup by Giving You $10
3. Spotify Purges AI
4. A Self-Encrypting Ransomware: Cactus

Wendy’s AI Order Takers

Wendy’s is preparing for the rise of skynet by rolling out an AI order-taker to one of their restaurants.  

The burger chain, known for their square patties and frostys has partnered with Google to test out a drive thru assistant built using a fast-food trained Large Language Model.

The model used is expected to be a modified instance of Google’s Bard, but there has not been any confirmation.

CEO Todd Penegor expects the bot will be very conversational and hopes customers might not even know they aren’t talking to a human.

The experimental order-taker is scheduled to be rolled out in June at a restaurant in Columbus Ohio, Wendy’s founding state.

Sources:

Amazon Targets Pickup by Giving You $10

Amazon is currently running a promotion that gives users the option of a $10 discount if they pickup their order rather than wait for delivery.

The campaign applies to orders over $25 and hopes to spread awareness of the Amazon Pickup option to customers who have never used Amazon pickup or those that have not used it within the last 12 months.

PickUp points include Amazon affiliates including Whole Foods, Amazon Fresh, and Kohls.

The kicker of this entire promotion is that it has been running for 2 years, while last month, they added a $1 charge to returns that are sent through mail carriers rather than dropped off at an Amazon Pickup Points.

Sources:

Spotify Purges AI

The music industry continues to feel the pressure of AI as Spotify removes tens of thousands of songs produced by the AI Music startup Boomy.

The songs in question we’re removed due to artificial streaming, the audio equivalent of bot views on YouTube videos.

The removed songs comes up to about 7% of Boomy’s library as the startup is working with Spotify to address the issue.

Boomy claims that it’s users have created over 14 and a half million songs, about 14% of “the world’s recorded music.”

Sources:

A Self-Encrypting Ransomware: Cactus

A new ransomware is avoiding antiviruses by encrypting itself after infecting a target.

Cactus, a ransomware campaign that began in March is targeting large commercial organizations and is doing a good job of hiding itself.

The malware 

• exploits Fortinet VPN vulnerabillties for entry
• encrypts itself to avoid detection
• Sets up an SSH backdoor to maintain access
• Setups Cobalt Strike and Chisel for command and control
• Attempts to disable/uninstall security software
• Steals local credentials from web browsers
• Then uses Powershell scripts for data exfiltration and ransomware deployment
• Finally uses a batch script to extract the data using 7-zip

Currently, there are no public ransoms but sources claim they are north of 7 figures.

You can mitigate your risk by following VPN and RDP best practices which include

• Making sure all VPN and RDP software is up to date
• Enforcing a principle of least privilege
• Ensuring RDP services are not open to the internet
• Double-checking your anti-malware software is up to date

Sources: