Recent Posts

Pages: [1] 2 3 ... 10
1
Beneath the seemingly endless rows and columns of cells, the latest version of Microsoft Excel boasts an astonishing variety of features and capabilities. But how do you go about tapping into some of that power without spending all of your days becoming a spreadsheet guru?

It’s easy. You grab a copy of the newest edition of Microsoft Excel Dashboards & Reports For Dummies and get ready to blow the pants off your next presentation audience!

With this book, you’ll learn how to transform those rows and columns of data into dynamic reports, dashboards, and visualizations. You’ll draw powerful new insights from your company’s numbers to share with your colleagues -- and seem like the smartest person in the room while you’re doing it.

Excel Dashboards & Reports For Dummies offers:

   • Complete coverage of the latest version of Microsoft Excel provided in the Microsoft 365 subscription

   • Strategies to automate your reporting so you don’t have to manually crunch the numbers every week, month, quarter, or year

   • Ways to get new perspectives on old data, visualizing it so you can find solutions no one else has seen before

If you’re ready to make your company’s numbers and spreadsheets dance, it’s time to get the book that’ll have them moving to your tune in no time. Get Excel Dashboards & Reports For Dummies today.

Follow this link to get your copy of 'Microsoft Excel Dashboards & Reports For Dummies, 4th Edition' for this free guide. This link will redirect you to my One Drive account and click Download. [system administrator]

source
2


Latrodectus malware is now being distributed in phishing campaigns using Microsoft Azure and Cloudflare lures to appear legitimate while making it harder for email security platforms to detect the emails as malicious.

Latrodectus (aka Unidentified 111 and IceNova) is an increasingly distributed Windows malware downloader first discovered by Walmart's security team and later analyzed by ProofPoint and Team Cymru that acts as a backdoor, downloading additional EXE and DLL payloads or executing commands.

Based on the distribution and infrastructure, researchers have linked the malware to the developers of the widely-distributed IcedID modular malware loader.

While it is not known at this time if they plan on phasing out IcedID in favor of Latrodectus, the newer malware is increasingly being used in phishing campaigns and contact form spam to gain initial access to corporate networks.

Security researcher ProxyLife and the Cryptolaemus group have been chronicling Latrodectus's use of various PDF lures and themes, with the latest campaign utilizing a fake Cloudflare captcha to evade security software.

Starts with an email

Latrodectus is currently being distributed through reply-chain phishing emails, is when threat actors use stolen email exchanges and then reply to them with links to malware or malicious attachments.

ProxyLife told BleepingComputer that this campaign uses PDF attachments or embedded URLs to start an attack chain that eventually leads to installing the Latrodectus malware.


Latrodectus phishing email Source: BleepingComputer

The PDFs will use generic names like '04-25-Inv-Doc-339.pdf' and pretend to be a document hosted in Microsoft Azure cloud, which must first be downloaded to be viewed.


PDF document pretending to be hosted in Microsoft Azure Cloud Source: BleepingComputer

Clicking on the 'Download Document' button will bring users to a fake 'Cloudflare security check' that asks you to solve an easy math question. This captcha is to prevent email security scanners and sandboxes from easily following the attack chain and only delivering the payload to a legitimate user.

When the correct answer is entered into the field, the fake Cloudflare captcha will automatically download a JavaScript file pretending to be a document similar to "Document_i79_13b364058-83054409r0449-8089z4.js".


Solving a fake Cloudflare captcha to download payload Source: BleepingComputer

The downloaded JavaScript script is heavily obfuscated with comments that include a hidden function that extracts text from comments that start with '////' and then executes the script to download an MSI from a hardcoded URL, as shown in the deobfuscated script below.


Deobfuscated script that downloads MSI file Source: BleepingComputer

When the MSI file is installed, it drops a DLL in the %AppData%\Custom_update folder named Update _b419643a.dll, which is then launched by rundll32.exe. The file names are likely random per installation.


RunDLL32 used to launch Latrodectus DLL Source: BleepingComputer

This DLL is the Latrodectus malware, which will now quietly run in the background while waiting for payloads to install or commands to execute.

As Latrodectus malware infections are used to drop other malware and for initial access to corporate networks, they can lead to devastating attacks.

At this time, the malware has been observed dropping the Lumma information-stealer and Danabot. However, since Latrodectus is linked to IcedID, these attacks may lead to a wider range of malware in the future such as Cobalt Strike and we might also see partnerships with ransomware gangs.

Therefore, if a device becomes infected with Latrodectus, it is critical to take the system offline as soon as possible and evaluate the network for unusual behavior.

source
3
Windows 12 / Windows 12: Release Date, Latest News, Leaks & Prices
« Last post by javajolt on May 01, 2024, 05:16:23 AM »
Microsoft has been caught up in a romance with generative AI. So, it’s no surprise that our attention may have been pulled away from the traditional cycle of its Windows releases.

However, speculations suggest a change to the tech giant’s operating system may be back on track.

After the release of Windows 11 in 2021, rumors have been circulating about Microsoft’s Windows 12 release date. Initially, it seemed like Microsoft was gearing up for a 2024 release, following the same roadmap as Windows 11 with a June announcement and October launch. However, the rumor mill has gone eerily quiet in the first quarter of 2024, leaving us wondering what’s next for the future of Windows.

Despite Microsoft’s tight-lipped approach, Windows 12 leaks suggest that an announcement is looming on the horizon. But since there seems to be a great deal of secrecy tied to official Windows 12 news, we’re left to piece together the clues and speculate about what’s to come.

In this article, we’ll explore everything we know so far about Windows 12 leaks, from its potential release date and pricing to its rumored features and system requirements.

When is Windows 12 Being Released?

Estimated Launch: July-October 2024

The million-dollar question on everyone’s mind is: When is Windows 12 coming out? While Microsoft has remained silent about the release date, rumors and speculation are rife.

Based on the company’s previous release playbook and leaks, we estimate that Windows 12 will launch in the second half of 2024. This would put the release date around July-October 2024, aligning with Microsoft’s traditional launch windows.

Perhaps the most compelling evidence of a 2024 release came from Intel’s chief financial officer, Dave Zinsner, who, in an interview last year, predicted a surge in PC sales driven by the ’arrival of Windows 12 next year.’

New Windows 12 Features

AI Could Be the Focal Point of Windows 12

Microsoft has never been shy about its intention to bring artificial intelligence capabilities to its Windows OS. So, we don’t expect this to change in Windows 12.

Although nothing is officially confirmed, it’s exciting to consider the possibility of having more AI features than we currently have in Windows 11.

Building on the foundation of Windows 11’s 23H2 update, which introduced Microsoft Copilot to Windows, Windows 12 could take AI capabilities to new heights. Copilot has already demonstrated its ability to provide a more personalized and efficient experience, and future updates could further enhance its ability to control and interact with the PC.

One potential area of improvement is the expansion of AI-powered search capabilities, similar to those seen in Windows 11’s Taskbar, where users can easily use the search icon to look up content across Microsoft 365.

Additionally, the Recommended section in File Explorer, which suggests files and folders based on user behavior, could be further refined and expanded with better AI algorithms.


Search on the taskbar in Windows 11: (Microsoft)
Search on the taskbar in Windows 11: (Microsoft)

Another possibility is the integration of AI to suggest user actions using a virtual assistant that can anticipate user needs and provide recommendations accordingly. This type of AI, designed to understand user intentions, has the potential to bring out the best of AI-human interaction on Windows PCs.

While these ideas are purely speculative and we are yet to see an official Windows 12 concept out there, it’s clear that AI will influence a lot of changes.

Will Ads Return to Windows 12 Start Menu?

Microsoft recently released a Windows 11 update that introduced ads in the Start menu. While they’ve pulled the plug on this feature, there are still concerns that it might become a permanent addition in future versions, including Windows 12.

The ads, displayed in the Recommended section, promote Microsoft Store apps from a select group of developers, aiming to facilitate app discovery. While this update may enhance user experience, it remains to be seen whether Start menu ads will become a standard feature in future Windows versions.

What Hardware Will I Need to Run Windows 12?

While Microsoft has not said anything about its Windows 12 system requirements, we can make some educated guesses based on the current trends and technological advancements.

Firstly, due to AI-laden features expected to come with the new Windows, it’s likely that users will require nothing less than 1 gigahertz (GHz) in CPU speed, a 64-bit processor, with 2 or more cores, a minimum of 4-8 GB of RAM with 16 GB or more to run Windows 12.

In terms of storage, a solid-state drive (SSD) will be the preferred choice, given its faster read and write speeds compared to traditional hard disk drives (HDDs). A minimum of 256 GB of storage will likely be required, with 512 GB or more recommended for users with large file collections.

Graphics requirements will likely be more demanding, with a minimum graphics card that is compatible with DirectX 12 (DX12) or later.

Will There Be Different Versions of Windows 12?

Similar to its predecessors, Windows 12 is likely to come in Home and Pro versions, perhaps with different aliases. This will be to cater to end consumer and high-end user preferences. So, it should not come as a surprise if Microsoft decides to version Windows 12 following this classification.

We can also expect varying levels of features, security, and support, in the versions as we currently have in Windows 11. As with previous Windows releases, the exact editions and their features will be announced by Microsoft closer to the release date.

Windows 12 Price

Free Upgrade & Premium Options?

With many software releases following a subscription model, it’s not out of place to wonder if Microsoft would come up with a Windows 12 subscription model rather than its current license purchase model.

There is no evidence alluding to this, so it’s safer to assume that Microsoft will offer Windows 12 as a free optional upgrade, similar to what it did with Windows 11. This means that users with a valid license for Windows 11 or possibly even Windows 10 may be able to upgrade to the latest operating system at no additional cost.

However, for those who wish to purchase a standalone copy of Windows 12, Microsoft will likely follow the pricing pattern on its Windows 11.

If this is the case, we can expect Windows 12 Home to cost over $139 currently charged for Windows 11 Home. Windows 12 Pro could cost around $199.99 or more. This pricing structure is consistent with Microsoft’s previous releases, and Windows 12 will likely follow suit.

The Bottom Line

If you’re a Windows user or enthusiast, the possibility of having more AI functions to tinker with in a new Windows could be exciting. While details are scarce on Microsoft’s plans for a future Windows operating system iteration, what we do know is that the tech giant consistently strives to innovate and improve user experience with each new version and we look forward to an official Windows 12 preview.

And with AI lurking around every software, there is no reason not to expect more when the official Windows 12 release hits the news.

But beyond AI, Microsoft will likely aim to optimize performance, improve security features, and ensure seamless compatibility with apps as they forge ahead with the future of their flagship product.

And no, we have no suggestions about what the Windows 12 logo looks like.

source
4
Some ​Google Chrome users report having issues connecting to websites, servers, and firewalls after Chrome 124 was released last week with the new quantum-resistant X25519Kyber768 encapsulation mechanism enabled by default.

Google started testing the post-quantum secure TLS key encapsulation mechanism in August and has now enabled it in the latest Chrome version for all users.

The new version utilizes the Kyber768 quantum-resistant key agreement algorithm for TLS 1.3 and QUIC connections to protect Chrome TLS traffic against quantum cryptanalysis.

"After several months of experimentation for compatibility and performance impacts, we're launching a hybrid postquantum TLS key exchange to desktop platforms in Chrome 124," the Chrome Security Team explains.

"This protects users' traffic from so-called 'store now decrypt later' attacks, in which a future quantum computer could decrypt encrypted traffic recorded today."

Store now, decrypt later attacks are when attackers collect encrypted data and store it for the future when there may be new decryption methods, such as using quantum computers or encryption keys become available.

To protect against future attacks, companies have already started to add quantum-resistant encryption to their network stack to prevent these types of decryption strategies from working in the future. Some companies that have already introduced quantum-resistant algorithms include Apple, Signal, and Google.

However, as system admins have shared online since Google Chrome 124 and Microsoft Edge 124 started rolling out on desktop platforms last week, some web applications, firewalls, and servers will drop connections after the ClientHello TLS handshake.

The issue also affects security appliances, firewalls, networking middleware, and various network devices from multiple vendors (e.g., Fortinet, SonicWall, Palo Alto Networks, AWS).

"This appears to break the TLS handshake for servers that do not know what to do with the extra data in the client hello message," one admin said.

"Same problem here since version 124 of Edge, it seems to go wrong with the SSL decryption of my palo alto," said another admin.

These errors are not caused by a bug in Google Chrome but instead caused by web servers failing to properly implement Transport Layer Security (TLS) and not being able to handle larger ClientHello messages for post-quantum cryptography.

This causes them to reject connections that use the Kyber768 quantum-resistant key agreement algorithm rather than switching to classic cryptography if they don't support X25519Kyber768.

A website named tldr.fail was created to share additional information on how large post-quantum ClientHello messages can break connections in buggy web servers, with details on how developers can fix the bug.

Website admins can also test their own servers by manually enabling the feature in Google Chrome 124 using the chrome://flags/#enable-tls13-kyber flag. Once enabled, admins can connect to their servers and see if the connection causes an "ERR_CONNECTION_RESET" error.

How to fix connection issues

Affected Google Chrome users can mitigate the issue by going to chrome://flags/#enable-tls13-kyber and disabling the TLS 1.3 hybridized Kyber support in Chrome.

Administrators can also disable it by toggling off the PostQuantumKeyAgreementEnabled enterprise policy under Software > Policies > Google > Chrome or contacting the vendors to get an update for servers or middleboxes on their networks that aren't post-quantum-ready.

Microsoft has also released information on how to control this feature via the Edge group policies.

However, it's important to note that long-term, post-quantum secure ciphers will be required in TLS, and the Chrome enterprise policy allowing disabling it will be removed in the future.

"Devices that do not correctly implement TLS may malfunction when offered the new option. For example, they may disconnect in response to unrecognized options or the resulting larger messages," Google says.

"This policy is a temporary measure and will be removed in future versions of Google Chrome. It may be Enabled to allow you to test for issues, and may be Disabled while issues are being resolved."

source
5


Huawei is planning to expand its home-grown operating system, HarmonyOS, to global markets. Currently, Android (One UI) and iOS dominate the global mobile operating system market, while HarmonyOS has gained popularity within China despite being exclusive to that market.

Due to US restrictions, Huawei lost access to key technologies, including Android and semiconductors. In response, the company has been developing its own operating system, HarmonyOS. However, for the global market, Huawei’s devices still ship with EMUI, which is based on Android.

Huawei recognizes that a robust applications ecosystem is a major advantage of Android and iOS. Compared to these two giants, HarmonyOS lacks comprehensive app support, which is a significant barrier to its expansion into global markets. This shortfall could hinder consumer adoption outside of China, where users expect a wide range of applications readily available on their mobile devices.

At Huawei’s 21st Analyst Summit in Shenzhen, the company’s rotating chairman, Erik Xu, outlined their strategy for HarmonyOS. He stated,



HarmonyOS to go Global



Huawei’s Mate 60 Pro has achieved the top-selling status in the Chinese smartphone market, displacing Apple’s iPhone from its leading position. This success has undoubtedly caused some concern for Tim Cook, as Apple has lost its top spot in the world’s largest smartphone market.

Additionally, Huawei has recently introduced its brand-new Pura 70 series flagships. These devices feature advanced technologies and innovative camera systems, which are expected to further boost the phone maker’s growth and competitiveness in the market.

As Huawei flagships continue to gain popularity, the company plans to spend 2024 focusing on enhancing the native app ecosystem for HarmonyOS. The aim is to attract the most popular smartphone apps to its self-developed operating system, making it a more viable alternative to established platforms like Android and iOS. This strategy could help Huawei increase its market share and user base globally.

Erik Xu, a representative from Huawei, expressed the company’s ambitious goal for HarmonyOS, stating, “Once we have these first 5,000 Android apps – and thousands of other apps – up and running on HarmonyOS, we will have a real HarmonyOS: a third mobile operating system for the world.” Xu also mentioned the potential for the platform to expand significantly, claiming that the number of apps on HarmonyOS could eventually reach up to 1 million in the future. This growth would mark a significant step towards establishing HarmonyOS as a major player in the global mobile operating system market.

Conclusion



Huawei’s HarmonyOS is indeed a distinct mobile operating system, separate from Android and iOS, which presents an interesting choice for consumers. If HarmonyOS were to become available globally with proper application support, it would offer a fresh alternative with potential new features and a different user experience.

Whether to switch to a Huawei phone running HarmonyOS would depend on several factors. Key considerations might include the range and quality of available apps, how well the system integrates with other devices and services you use, the overall user experience, and how it compares in terms of privacy and security to existing platforms.

If you are someone who enjoys exploring new technology and values innovation, trying out a Huawei phone with HarmonyOS could be an exciting experience. However, if you rely heavily on specific apps or services that might not be supported, or if you prefer the familiarity and established ecosystem of Android or iOS, you might decide to stick with what you know. Ultimately, the decision would hinge on how well HarmonyOS meets your personal or professional needs compared to the alternatives.

source
6
Apple / Apple warns iPhone users about overnight iPhone charging
« Last post by javajolt on April 29, 2024, 10:05:43 AM »


What is the last thing you do each night before your head hits the pillow? For many of us, the last act we do before drifting into dreamland is to plug in our smartphone. No one likes to wake up and find out that their smartphone battery has only 2% battery life remaining and they have to leave the house for work in a few minutes. This will quickly put a damper on your day.

Apple's support page warns iPhone users not to charge their phones overnight under a pillow or blanket.

Apple has issued a warning to iPhone users about charging an iPhone overnight right on a support page titled "Important safety information for iPhone." On the support page, Apple warns, "...don’t sleep on a device, power adapter, or wireless charger, or place them under a blanket, pillow, or your body, when it’s connected to a power source. Keep your iPhone, the power adapter, and any wireless charger in a well-ventilated area when in use or charging. Take special care if you have a physical condition that affects your ability to detect heat against the body."


No one likes to spend $19 on a new iPhone charging brick

There have been times when a fire broke out because an iPhone was under a blanket or a pillow while charging. Frankly, this applies to all phones, not just the iPhone. Just make sure that before you fall asleep for the night you are not charging your handset under a pillow or blanket and that the device is well-ventilated.

Another warning on the support page covers a different aspect of charging that has resulted in some serious consequences in the past. Many of us lose our power adapters and charging cables. The typical response is to go to the online Apple Store and wonder why you should pay $19 for a new charging brick and an additional $19 for a cable. After all, you just saw a no-name cable on sale at the 24-hour convenience store for $4.99. Since Apple and many other manufacturers no longer include charging bricks in the box with their phones, new iPhone users might consider shelling out a little more dough for the official Apple accessory.

Never use your charging brick or cable if they exhibit the following signs

Unless low-priced third-party replacements carry the MFi (Made for iPhone) badge on the packaging, you need to avoid them. This is what Apple says about using third-party charging gear: "You can also charge iPhone with "Made for iPhone" or other third-party cables and power adapters that are compliant with USB 2.0 or later and with applicable country regulations and international and regional safety standards. Other adapters may not meet applicable safety standards, and charging with such adapters could pose a risk of death or injury."

Apple adds, "Using damaged cables or chargers, or charging when moisture is present, can cause fire, electric shock, injury, or damage to iPhone or other property." The tech giant wants you to look out for the following on your power adapter because any of these conditions are dangerous and should be considered a sign to buy a new charging brick:

   • The power adapter plug or prongs are damaged.

   • The charge cable becomes frayed or otherwise damaged.

   • The power adapter is exposed to excessive moisture, or liquid is spilled into the power adapter.

   • The power adapter has been dropped, and its enclosure is damaged.

To reiterate, while these warnings come from Apple, they apply to all smartphones regardless of the manufacturer. Yes, some of you no doubt see this as a ploy by Apple, a way to con you into reaching into your wallet to buy accessories from Apple or other companies. But as we've reported over the years, saving money to buy uncertified third-party charging accessories could end up costing you more than cash.

source
7
If you are a Windows user with Chrome installed on your PC, then this latest warning will impact you—you must update your browser as soon as you can…


Another critical Chrome update has just been issuedNURPHOTO VIA GETTY IMAGES

Another Chrome security update has just been issued, with the Stable channel updated to 124.0.6367.78/.79. This release includes a critical fix to the underlying graphics engine of the type that has allowed attackers to execute code on target machines in the past—albeit no news yet as to any exploitation this time around.

The update also includes two high-severity memory fixes—the kind typically seen in such updates. Google has acknowledged that such memory vulnerabilities in its core engine are the most frequently discovered and exploited. As usual, there is no further information “until a majority of users are updated with a fix.”

Given that Google has designated the first fix—essentially a vulnerability to potential code manipulation—as critical, it seems highly likely it’s a credible threat. And once the fix becomes public, users must update as soon as they can—the clock is ticking for any exploitation.

Usually, a critical fix might have been the biggest Chrome news of the week, but not this time. The other news is that the death of Chrome’s dreaded tracking cookies has been delayed once again—this time into early 2025, at least.

The issue is Google’s need to balance the privacy of its users with the seemingly fair treatment of its advertisers, especially when it essentially plays both gamekeeper (as owner of the browser) and poacher (as the world’s largest ad machine).

“We recognize that there are ongoing challenges related to reconciling divergent feedback from the industry, regulators and developers,” Google said in a post mid-week, “and will continue to engage closely with the entire ecosystem.”

That’s a critical update of an entirely different kind.

The update comes as Google’s ongoing engagement with the UK’s Competition and Markets Authority (CMA) tries to carve a path through this messy situation. “We will not complete third-party cookie deprecation during the second half of Q4,” Google confirmed. “Assuming we can reach an agreement, we envision proceeding with third-party cookie deprecation starting early next year.”

Google is in something of a bind here, given its unique role in the industry. As web users become ever more privacy savvy, the gap between where Chrome is today and Apple’s Safari remains too wide. Chrome is an excellent browser, and its users rightly want to see it line up more closely with the alternatives.

Google seems to agree—notwithstanding its awkward Incognito Mode stumble—but it needs to find a compromise that doesn’t kill its ad model as well as those cookies.

Meanwhile, the bigger open question is around AI, of course, and just what this will mean for browser searching and advertising in the coming years. All told, by the time these cookies finally disappear, we may be in new territory anyway.

source
8
Microsoft / Microsoft Warns Windows Users Of Ongoing Russian Hack Attack
« Last post by javajolt on April 27, 2024, 09:58:01 AM »

Microsoft says Russian hackers exploiting Windows print spooler vulnerabilityNURPHOTO VIA GETTY IMAGES

Researchers at Microsoft Threat Intelligence have issued a warning that Russian state-sponsored hackers have been targeting Windows users with a custom tool used to steal credentials and even install backdoors.

APT28 Fancy Bear Hackers Behind Newly Reported Windows Attacks

The hackers, more commonly identified as APT28 or Fancy Bear but tracked by Microsoft as Forest Blizzard, are known to be affiliated with Military Unit 26165, which is part of Russia’s GRU military intelligence agency.

Microsoft said that it has seen Forest Blizzard/APT 28 using the post-exploitation tool, dubbed GooseEgg, against government, education, and transport sector organizations in the U.S., Western Europe, and Ukraine. “Forest Blizzard primarily focuses on strategic intelligence targets,” Microsoft said. It would appear, the Microsoft intelligence analysts said, that APT28 has been using GooseEgg since at least June 2020 and quite possibly as early as April 2019.

Unpatched Windows Vulnerabilities Lay A Golden Exploit Egg

What, in essence, appears to be a relatively simple launcher application, GooseEgg, is actually a very dangerous tool in the hands of attackers who are exploiting a long-since patched vulnerability in the Windows Print Spooler service. The vulnerability in question, CVE-2022-38028, was fixed as part of the October 2022 Patch Tuesday rollout, having been first reported by the National Security Agency. GooseEgg exploits an unpatched vulnerability by “modifying a JavaScript constraints file and executing it with SYSTEM-level permissions,” Microsoft said. The extent to which GooseEgg can aid the Russian hackers was laid bare by the Microsoft Threat Intelligence report: “GooseEgg is capable of spawning other applications specified at the command line with elevated permissions, allowing threat actors to support any follow-on objectives such as remote code execution, installing a backdoor, and moving laterally through compromised networks.”

How To Mitigate The GooseEgg Attacks

Once again, this active cyber-espionage campaign by state-sponsored hackers highlights the importance of patching vulnerabilities as soon as possible. In addition to the CVE-2022-38028 Windows Print Spooler vulnerability, GooseEgg can also be used alongside exploits for PrintNightmare, which was first disclosed in 2021. Additional vulnerabilities known to have been targeted by the APT28 hackers include CVE-2023-23397, CVE-2021-34527 and CVE-2021-1675.

Microsoft urges organizations and users to apply the CVE-2022-38028 security update to mitigate this attack. It notes that Microsoft Defender Antivirus detects the specific Forest Blizzard capability as HackTool:Win64/GooseEgg.

source
9
Here's how



USPTO, the patent agency from the US government, has recently published a patent application from Microsoft that describes a system of tailored social media notifications based on engagement.

So, in other words, the Redmond company is developing a system for social media apps to send notifications, but they’re customized based on whether the receiver engages with the poster’s content a lot. The 22-page document‘s publication date is dated April 23, 2024, although Microsoft initially filed for it back in December 2022.



But what does it do? Well, when you follow people on social media apps, like Instagram, X, and YouTube for example, you can opt to get notified on their latest Insta post, tweet, or long video. This system is deemed as outdated because, truth be told, not everyone clicks on all of these “new post” notifications.

Microsoft wants to eliminate that. Even though you’ve followed or subscribed to these accounts, this system will only send you these notifications if you’re engaged with their content a lot (click, like, watch, etc.). Other than that, it will only send you occasional notifications. So, if you’re a content creator, you can use this information to create content that your audience likes a lot, lot better.



This method uses a “scoring system” called rAffinity, which measures how likely a content creator is to interact with a notification when a viewer engages with their content. It then guides content recommendations for content creators so that they know which content gets the most engagement.

It’s somewhat similar to what YouTube does by letting you get “all” or “personalized” notifications, but the difference is, that it’s the system itself that decides on the intensity of these notifications.

The USPTO has granted Microsoft this patent, just like the patent for a system that makes Bing’s reverse image search smarter, so we might see it in action soon. But it’s best to take this with a grain of salt: since most big social media apps aren’t Microsoft’s, except LinkedIn and Skype, they might have to work with other companies.

source
10


Security researchers have discovered a new Android banking trojan they named Brokewell that can capture every event on the device, from touches and information displayed to text input and the applications the user launches.

The malware is delivered through a fake Google Chrome update that is shown while using the web browser. Brokewell is under active development and features a mix of extensive device takeover and remote control capabilities.

Brokewell details

Researchers at fraud risk company ThreatFabric found Brokewell after investigating a fake Chrome update page that dropped a payload, a common method for tricking unsuspecting users into installing malware.


Legitimate (left) and fake (right) Chrome update pages ThreatFabric

Looking at past campaigns, the researchers found that Brokewell had been used before to target "buy now, pay later" financial services (e.g. Klarna) and masquerading as an Austrian digital authentication application called ID Austria.


APKs used for distributing Brokewell ThreatFabric

Brokewell's main capabilities are to steal data and offer remote control to attackers.

Data stealing:

   • Mimics the login screens of targeted applications to steal credentials (overlay attacks).

   • Uses its own WebView to intercept and extract cookies after a user logs into a legitimate site.

   • Captures the victim's interaction with the device, including taps, swipes, and text inputs, to steal sensitive data displayed or entered on the device.

   • Gathers hardware and software details about the device.

   • Retrieves the call logs.

   • Determines the physical location of the device.

   • Captures audio using the device's microphone.


Stealing the victim's credentials ThreatFabric

Device takeover:

   • Allows the attacker to see the device's screen in real-time (screen streaming).

   • Executes touch and swipe gestures remotely on the infected device.

   • Allows remote clicking on specified screen elements or coordinates.

   • Enables remote scrolling within elements and typing text into specified fields.

   • Simulates physical button presses like Back, Home, and Recents.

   • Activates the device's screen remotely to make any info available for capture.

   • Adjusts settings like brightness and volume down to zero.

New threat actor and loader

ThreatFabric reports that the developer behind Brokewell is an individual calling themselves Baron Samedit, who for at least two years had been selling tools for checking stolen accounts.


Tools sold on the threat actor's website ThreatFabric

The researchers discovered another tool called "Brokewell Android Loader," also developed by Samedit. The tool was hosted on one of the servers acting as command and control server for Brokewell and it is used by multiple cybercriminals.

Interestingly, this loader can bypass the restrictions Google introduced in Android 13 and later to prevent abuse of Accessibility Service for side-loaded apps (APKs).

This bypass has been an issue since mid-2022 and became a bigger problem in late 2023 with the availability of dropper-as-a-service (DaaS) operations offering it as part of their service, as well as malware incorporating the techniques into their custom loaders.

As highlighted with Brokewell, loaders that bypass restrictions to prevent granting Accessibility Service access to APKs downloaded from shady sources have now become common and widely deployed in the wild.

Security researchers warn that device takeover capabilities such as those avaialble in the Brokewell banker for Android are in high demand among cybercriminals because it allows them to perform the fraud from the victim's device, thus evading fraud evaluation and detection tools.

They expect Brokewell to be further developed and offered to other cybercriminals on underground forums as part of a malware-as-a-service (MaaS) operation.

To protect yourself from Android malware infections, avoid downloading apps or app updates from outside Google Play and ensure that Play Protect is active on your device at all times.

source
Pages: [1] 2 3 ... 10