Saturday, December 31, 2022

You Can Automatically Free Up Disk Space on Your Windows 11 Computer - CNET

Use this Windows 11 feature to automatically free up space, delete temporary files and manage your cloud storage.

from CNET https://ift.tt/jdI4o6g

Everything I Learned Taking Cold Showers in 2022 - CNET

Was it all worth it?

from CNET https://ift.tt/eM0Udkt

How to Watch, Stream Georgia vs. Ohio State in the Peach Bowl Today Without Cable - CNET

The Bulldogs and Buckeyes meet in Atlanta on New Year's Eve in the semifinals of the College Football Playoff.

from CNET https://ift.tt/ejz3tHp

Credit Card Mistakes You Shouldn't Repeat in 2023 - CNET

Improve your finances in the new year by avoiding some of the most common credit card mistakes.

from CNET https://ift.tt/zTQr7YH

How to Watch, Stream Michigan vs. TCU in the Fiesta Bowl Today Without Cable - CNET

The Wolverines and Horned Frogs meet in the desert on New Year's Eve in the semifinals of the College Football Playoff.

from CNET https://ift.tt/TvVRh0Z

Friday, December 30, 2022

Trump Tax Returns Released Online via Ways and Means Committee - CNET

After years of roadblocks, the former president's tax forms are available to view.

from CNET https://ift.tt/u4eEhjn

Taylor Swift Just Had Her Most Epically Creative Year Yet - CNET

Commentary: The star has truly entered her Renaissance woman of the arts era.

from CNET https://ift.tt/vBbpeRS

Latest Tech News

Cryptocurrency trading platform 3Commas has confirmed it suffered a data breach that saw API data stolen.

As per the announcement, an unknown threat actor posted 3Commas’ API database to Pastebin, on December 28. 

After analyzing the database, the company confirmed its authenticity, saying “at this point, 3Commas can unfortunately confirm that some of 3Commas’ users’ API data (API keys, secrets and passphrases) have been disclosed by a third party”. 

Stolen money

While the leaks revolve around API data at the moment, 3Commas’ does not exclude the possibility of other data being taken, as well: “Currently and to the best of our knowledge only API data have been disclosed as part of this incident. As a likely consequence the hacker(s) may use or may have used the API data to connect your exchange accounts to his/their account and/or initiate unauthorized trades,” it says.

In a notice sent to its users via email and a blog post, the company says it has made strides to protect its users and their funds, and reported the issue to relevant law enforcement agencies, including the FBI. 

As per a BleepingComputer report, a set of 10,000 API keys were leaked, which is just 10% of the 100,000-big database. These keys are usually used by 3Commas bots to automatically interact with crypto exchange platforms, make trades and generate profit, without user interaction.

Reacting to the news, 3Commas urged all supported exchanges (including some of the biggest ones - Binance, Coinbase, and Kucoin) to revoke all API keys connected to the platform. The company also urged all users to reissue their keys on all linked endpoints personally.

Investigating the leak further, the company eliminated the possibility of this being an inside job: “Only a small number of technical employees had access to the infrastructure, and we have taken steps since November 19 to remove their access,” the company said in a Twitter post. 

“Since then, we have implemented new security measures, and we will not stop there; we are launching a full investigation in which law enforcement will be involved,” the company added.

But the damage has already been done. Apparently, threat actors have been abusing leaked API keys since November, and have managed to steal some $6 million worth of cryptocurrencies so far. 

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/GOtsZ1U

Latest Gadgets News

Google Voice will now make it more easy for a user to ignore spam calls with the launch of a new update. Google has now added a warning to its Voice feature which will alert the user by flagging “Suspected spam caller” label on calls that may seem suspicious.

from Gadgets 360 https://ift.tt/vrHheN9

Fitbit Charge 5 and Luxe Can't Sync with Samsung Phones on Android 13 - CNET

Fitbit says a fix is coming in early 2023.

from CNET https://ift.tt/zWgydKn

Thursday, December 29, 2022

Questions Swirl About Potential Twitter Hack Affecting 400M Accounts - CNET

Twitter hasn't commented, though some security researchers have voiced concerns.

from CNET https://ift.tt/E1PV0Mr

The Best Christmas Movies on Netflix - CNET

You should really check out Klaus if you haven't already.

from CNET https://ift.tt/BnkGIoX

The Best New Christmas Movies on Hallmark - CNET

Try The Holiday Stocking, Ghosts of Christmas Always and A Holiday Spectacular.

from CNET https://ift.tt/bypeHnR

Latest Tech News

Data breaches could be even more expensive next year, a new report from Acronis has claimed.

Based on data collected from more than 750,000 unique endpoints, distributed around the world, the company's report claims the average cost of a data breach is expected to hit $5 million by next year. 

To make matters even worse - the researchers expect the number of breaches to increase significantly, as well. The threats from malicious and phishing emails rose by 60% year-on-year, they said.

New solutions for new attack methods

Furthermore, social engineering attacks rose in the last four months of the year as well, and now account for roughly 3% of all attacks. Leaked or stolen passwords and other credentials were the triggers for almost half of all reported cybersecurity incidents in H1 2022. 

“The last few months have proven to be as complex as ever – with new threats constantly emerging and malicious actors continuing to use the same proven playbook for big payouts,” said Candid Wüest, Acronis VP of Cyber Protection Research. 

“Organisations must prioritize all-encompassing solutions when looking to mitigate phishing and other hacking attempts in the new year. Attackers are constantly evolving their methods, now using common security tools against us – like MFA that many companies rely on to protect their employees and businesses.”

In the third quarter of the year, the proportion of phishing attacks against malware attacks increased by 1.3 times, and now make up more than three-quarters (76%) of all email attacks (up from 58% in the first half of the year). 

The majority of the victims were located in the United States, but businesses in Germany and Brazil were also heavily targeted. Endpoints in South Korea, Jordan, and China, were the biggest malware targets, too.

Drilling deeper into the different industries that threat actors targeted with phishing and malicious emails, the researchers discovered construction, retail, real estate, professional services, and finance, as the verticals most frequently attacked. 



from TechRadar - All the latest technology news https://ift.tt/mj3AUqk

'Weather Whiplash' Is the New Normal. What It's Like Living Through It - CNET

First came the fires this year, then the floods.

from CNET https://ift.tt/rvqBplQ

Latest Tech News

Many Citrix ADC and Gateway servers remain vulnerable to high-severity flaws that were reportedly patched by the company weeks ago, experts have claimed.

In early November 2022, Citrix uncovered and patched an “Unauthorized access to Gateway user capabilities” flaw, since tracked as CVE-2022-27510. Affecting both products, it allows an attacker to gain authorized access to target endpoints, take over the devices remotely, and bypass the device’s brute force login protection.

Roughly a month later, in mid-December, the company fixed an “Unauthenticated remote arbitrary code execution” flaw, since tracked as CVE-2022-27518. This one allows threat actors to execute malicious code on the target endpoint, remotely.

NSA warning

Both have a 9.8/10 severity score, and at least one of them was abused in the wild as a zero-day, researchers from NCC Group’s Fox IT team claim.

In fact, the US National Security Agency (NSA) warned in early December, that a hacking collective backed by the Chinese state was exploiting the latter vulnerability as a zero-day security flaw. 

Back then, in an official blog post, chief security and trust officer at Citrix Peter Lefkowitz claimed that “limited exploits of this vulnerability have been reported,” but did not elaborate on the number of attacks or the industries involved.

Sometimes referred to as Manganese,  this group of threat actors has apparently explicitly targeted networks running these Citrix applications to break through organizational security without first having to steal credentials via social engineering and phishing attacks. 

The researchers have also said that while the majority of endpoints had been patched since the release of the fixes, there are “thousands” of vulnerable servers out there. As of November 11 2022, at least 28,000 Citrix servers were found to have been at risk.

“We hope this blog creates extra awareness for these two Citrix CVEs and that our research on version identification contributes to future studies,” the researchers concluded.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/2v6WXx9

Wednesday, December 28, 2022

4 Prime Membership Perks That Make Your Amazon Echo More Useful in 2023 - CNET

Here are all the perks you get when you have an Amazon Echo and Prime membership.

from CNET https://ift.tt/RZQPtDW

Why 2022 Was Taylor Swift's Most Epically Creative Year Yet - CNET

Commentary: The star has truly entered her Renaissance woman of the arts era.

from CNET https://ift.tt/Y7omtST

Heating an Older Home Is Expensive. Here's How to Slash Your Bill - CNET

We've got some easy tips to help you keep your older or period property warmer this winter.

from CNET https://ift.tt/xTNCHto

You May Be Owed Money From a False Advertising Settlement if You Use Wesson Oil - CNET

A federal judge gave preliminary approval in November to a $3 million payout to consumers who purchased Wesson Oil.

from CNET https://ift.tt/CNIHPbh

LG to Unveil New, Flat Smartphone Camera Module at CES - CNET

The new camera includes a telephoto lens with up to 9x zoom and takes the "bump" out of smartphone cameras.

from CNET https://ift.tt/KEFdAIM

Latest Tech News

A new malware variant has been detected that is capable of listening to a users’ calls, recognizing a callers’ gender and identity, and even recognizing, to some degree, what’s being said. 

Fortunately, the good news is that the malware is part of a research experiment done by white hats and poses no risk to smartphone users (at the time).

Researchers from five universities in the United States - Texas A&M University, New Jersey Institute of Technology, Temple University, University of Dayton, and Rutgers University - teamed up and built EarSpy. 

Abusing the hardware

EarSpy is a side-channel attack that abuses the fact that smartphone speakers, motion sensors, and gyroscopes, had gotten better over the years.

The malware tries to read the data captured by motion sensors, as the endpoint’s ear speakers reverberate during a conversation. In earlier years, this wasn’t a viable attack vector as the speakers and sensors weren’t that powerful. 

To prove their point, the researchers used two smartphones - one from 2016, and one from 2019. The difference in the amount of data gathered was quite obvious.

To test if the data could be used to identify the caller’s gender and recognize the speech, the researchers used a OnePlus 7T device, and a OnePlus 9 device.

Caller gender identification on the former was between 77.7% and 98.7%, while the caller’s identification between 63.0% and 91.2%. Speech recognition danced between 51.8% and 56.4%.

“As there are ten different classes here, the accuracy still exhibits five times greater accuracy than a random guess, which implies that vibration due to the ear speaker induced a reasonable amount of distinguishable impact on accelerometer data,” the researchers explained in the whitepaper.

The researchers were also able to guess the caller’s gender quite well on the OnePlus 9 smartphone (88.7% on average), but identification fell to an average of 73.6%. Speech recognition fell between 33.3% and 41.6%.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/oR42zLq

Tuesday, December 27, 2022

The First COLA Increase Comes to SSI Beneficiaries This Week - CNET

Next year's cost-of-living adjustment arrives at the end of December for Supplemental Security Income recipients.

from CNET https://ift.tt/JxBAp86

You Need to Stop Mounting Your TV Over the Fireplace - CNET

Chestnuts should roast over open fires. Your TV? Not so much.

from CNET https://ift.tt/NkMj4ST

You Need to Stop Reheating Christmas Leftovers in the Microwave - CNET

Reheat your leftovers without succumbing to soggy pizza or overly dry holiday roast. There are better ways to heat up your food without using the microwave.

from CNET https://ift.tt/g10z6Bx

10 Best Winter Skin Care Products - CNET

Protect and ease your dry and itchy skin this winter season.

from CNET https://ift.tt/oTcLbdS

Latest Tech News

Cybersquatting, a method of tricking victims into visiting malicious websites, has reached record highs in 2022, new reports have claimed.

Data from the World Intellectual Property Organization (WIPO) analyzed by Atlas VPN found 5,616 cybersquatting disputes filed with the organization this year, representing almost a 10% increase compared to 2021.

Cybersquatting is a method in which crooks try to leverage typos (or recklessness) to have people visit their malicious websites. There are various formats of cybersquatting, including typosquatting, combosquatting, and others. 

Typosquatting variants

Typosquatting, arguably the most popular among the methods, has threat actors registering domain names seemingly identical to the ones belonging to legitimate businesses. So, for example, Amazon might be Anazon, Amazom, while Netflix could be NetfIix (there is a capital i instead of the letter L). 

Combosquatting is also a popular technique and revolves around combining the domain name with an extra word such as “payment”, “support”, or similar. So, for example, Amazon might be amazon-support.com, while Netflix could be netflix-payment.com. 

With cybersquatting, threat actors are banking on two things: either people will mistype the address on their own, or the crooks share the link via email, or social channels, and hope no one notices the typo or the obvious fake domain name. The malicious websites are designed to look identical to their legitimate counterparts, and are built to steal identity and login data. 

The number of cybersquatting complaints has been steadily rising over the years, Atlas VPN further claims. Compared to the year 2000, there’s been an increase of 202% in cybersquatting disputes. The total number of complaints has exceeded 61,000, in that time period. 

One of the bigger, and more recent campaigns, included an unknown threat actor that set up more than 200 malicious domains and impersonated more than two dozen global brands to distribute all kinds of malware for both Android and Windows operating systems. Some of the brands impersonated in the attack included PayPal, SnapChat, TikTok, and others.



from TechRadar - All the latest technology news https://ift.tt/dzLYJS7

Monday, December 26, 2022

5 Google Home Settings You Should Change Right After Unboxing - CNET

These cool Google Home features can make your gift even better, if you enable them.

from CNET https://ift.tt/slxGkq4

Natural Home Remedies to Ease Your Insomnia That Actually Work - CNET

Counting sheep not helping you fall asleep? These seven natural remedies may do the trick.

from CNET https://ift.tt/OCzQaip

Amazon Has a Real-World Fitting Room, and It Makes Me Want to Shop - CNET

Commentary: Amazon's concept clothing store eliminates a lot of the awkwardness of shopping.

from CNET https://ift.tt/6o0OhNE

Television Had a Ridiculously Good Year. Here Are the Best Shows of 2022 - CNET

CNET rounds up our top TV picks.

from CNET https://ift.tt/RyTJGel

Best Noise-Canceling Headphones for 2022: Top ANC Picks - CNET

In need of actvie noise-canceling headphones? Here are our favorites.

from CNET https://ift.tt/bo1XTHB

Best Immersion Blender for 2022 - CNET

If your kitchen is missing this handy tool, we've tested nine models including Braun, Breville, KitchenAid and Cuisinart to find the best immersion blenders for 2022.

from CNET https://ift.tt/0TQdbXR

Sunday, December 25, 2022

'The Witcher: Blood Origin' Ending and Post-Credits Scene Explained - CNET

The prequel gave us the first Witcher and hinted at what's to come.

from CNET https://ift.tt/3qPxa9N

Christmas Day Deals at Amazon, Best Buy, Walmart and More to Shop Today - CNET

Just because it's Christmas doesn't mean the deals are over.

from CNET https://ift.tt/m9w4YfH

Why Yellowstone, Paramount's No. 1 Hit Show, Isn't on Paramount Plus - CNET

And here's where you actually can stream it.

from CNET https://ift.tt/Jg6IG7H

Ultimate Alexa Command Guide: 200+ Voice Commands You Need to Know for Your Echo - CNET

A vast roundup of all the Alexa voice commands you should be using.

from CNET https://ift.tt/DQOtHqM

7 Daily Habits That Will Improve Your Mental Health in 2023 - CNET

2023 is the year of keeping your mental health at the forefront.

from CNET https://ift.tt/VYgISi0

More Than 3,000 Flights Canceled on Christmas Morning - CNET

Southwest Airlines has had more canceled and delayed flights over the holiday than any other US carrier.

from CNET https://ift.tt/Fu4G6fY

Saturday, December 24, 2022

Eagles vs. Cowboys Livestream: How to Watch NFL Week 16 Online Today - CNET

Want to watch the Philadelphia Eagles take on the Dallas Cowboys? Here's everything you need to stream Saturday's afternoon game on Fox.

from CNET https://ift.tt/rmwfJ81

Got a new MacBook? You Need to Change This Setting ASAP - CNET

Apple has tap-to-click turned off by default, but you should turn it on.

from CNET https://ift.tt/ylRkaAH

Comparing Night Mode on the iPhone 14 Pro, Pixel 7 Pro and Galaxy S22 Ultra - CNET

We compared the best flagship models from Apple, Google and Samsung in a nighttime photo shoot field test.

from CNET https://ift.tt/1pvF28e

Best TV for PS5 and Xbox Series X, Series S for 2022: LG OLED, Samsung QLED, Vizio - CNET

If you want to take full advantage of features like 4K 120Hz and variable refresh rate, you'll probably need to upgrade your TV.

from CNET https://ift.tt/Mcg9A4l

The Top 100 Channels on Live TV Streaming Services - CNET

Hulu Live TV, Sling TV and YouTube TV are just some of the services we assess in this channel breakdown.

from CNET https://ift.tt/Q0LNM2q

Friday, December 23, 2022

Congress Approves Big Changes to 401(k) and IRA Accounts: Everything You Need to Know - CNET

The omnibus spending bill for 2023 now includes many changes to the rules on retirement accounts.

from CNET https://ift.tt/qYhDR0H

'Nepo Babies' Explained: What They Are, and Why Everyone's Talking About Them - CNET

A new generation is discovering an old truth: Kids of celebrities have an easier path to fame than nobodies.

from CNET https://ift.tt/KtFMQJX

Three-Legged Deer Tangled in Christmas Lights Gets Help From Humans - CNET

This is a timely reminder to secure your holiday decorations to protect wildlife.

from CNET https://ift.tt/1l6mZTv

Latest Tech News

As we enter the festive season, its peak trading time for online scammers - but luckily the FBI has waded in, recommending the use of ad blockers to keep safe. 

In recent public service announcement, the agency warned that fake ads can be put at the top of search results, indistinguishable from the results themselves, and can be very convincing when impersonating legitimate brands. 

The FBI mentioned that ads could be pretending to be from cryptocurrency exchanges, and clicking on them can result in malware being installed on your system, stealing sensitive data and ultimately your money. 

Staying safe

Other recommendations from the agency include checking the URL before clicking on a link to make sure it is legitimate by looking out for spelling errors, and typing the web address directly into your browser of the business you are looking for rather than searching for it.

In its advice to business, the FBI recommended using domain protection services to be notified when similar domain names are registered and to inform customers of any imposter websites. 

Ad blockers do what they say - they prevent adverts from appearing on your browser. There chief benefit is to stop intrusive and long-loading ads such as videos getting in your way and slowing you down.

However, they also prevent these ads from tracking you, stopping big data harvesters such as Google and Facebook from discovering your browsing habits while online, either on desktop or on mobile devices.

For this reason, the agency's announcement is unlikely to please big tech, who seem to walking a tightrope between trying to nullify their use without upsetting the large user base of such extensions.

Recently, popular ad blocker uBlock Origin complained about the upcoming API changes in Chrome, which look set to prevent it and other ad blocking extensions in chromium browsers from working. Browsers built on chromium include Microsoft Edge and Opera.

Google also confirmed in the summer that VPN apps on Android devices that block advertisements will no longer be available on the Play store. 



from TechRadar - All the latest technology news https://ift.tt/xiDYgR4

Save Up to 72% on Body Massagers and Get Relief From Sore Muscles - CNET

Renpho massage guns, leg massagers, foot massagers and more have major discounts right now at Amazon.

from CNET https://ift.tt/Xua9oR4

Latest Tech News

Someone found a way to bypass the two-factor authentication (2FA) security measure at Comcast Xfinity and compromise countless accounts, reports have claimed. 

Following the bypass, the attackers are able to use the compromised accounts to try and take over cryptocurrency exchange accounts and cloud storage services.

On December 19 Xfinity email users started getting notified of changes to their account information, but their passwords were already changed so they couldn’t enter. Those that managed to get back into the account found that a secondary email address was added to the account, from a disposable domain yopmail.com.

Bypassing 2FA

The secondary email address is a security measure used by some email providers that help with password resets, account notifications, and similar. 

Many of the victims took to Twitter, Reddit, and Xfinity forums to discuss what had happened, and said that they had 2FA enabled. So, whoever was behind the attack, managed to guess the password with credential stuffing, and then managed to bypass the two-factor authentication security measure. BleepingComputer’s report states the attackers used a “privately circulated OTP (one-time password) bypass” which allowed them to generate working 2FA verification codes.

That gave them access to the account, and adding the secondary, disposable email account, allowed them to perform the password reset process.

After gaining complete control over the compromised email accounts, the threat actors then proceeded to breach further online services, assuming people's identities to request email resets. Dropbox, Evernote, Coinbase, and Gemini, are just some of the services that the threat actors tried to breach.

Xfinity is keeping silent on the matter for the time being, but a customer said on Reddit that the firm is aware of the incident and is currently investigating. The same source also said that according to a customer support employee they spoke to, the issue seems to be quite widespread.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/rFvVnJg

Thursday, December 22, 2022

Latest Tech News

If your fancy new Corsair keyboard has started typing full sentences you first typed in days or even weeks ago, seemingly at random, don't worry - it isn't possessed. 

It is also not infected with any form of malware, keyloggers, or infostealers. Instead, it’s just an ugly bug that Corsair wasn’t even aware of, and is currently investigating the matter further.

The news, which first broke on Ars Technica, came from Corsair’s users, with multiple reports posted to the company’s forum about how their K100 keyboard suddenly started typing in full sentences that they had typed in the past. The keyboard was repeating the user’s keystrokes verbatim - if the user made a typo and backtracked - the keyboard did the same thing.

No foul play

Obviously, this left users fearing that an infostealer might be at play. After all, the keyboard was capable of typing out passwords or repeating sensitive text messages that were sent to other people in confidentiality. 

However, after analyzing the keyboard’s behavior in safe mode, it was determined that it didn’t have malware installed - it was just buggy.

As it turns out, the K100 has a macro recording function that sometimes turns itself on and begins recording keystrokes and mouse activity. The macros get saved and replayed at random, at a later date. 

A company’s spokesperson told Ars Technica, “Corsair keyboards unequivocally do not log user input in any way and do not have the ability to log individual keystrokes”.  

While the company managed to determine how the bug happens, the why is still a mystery.

Corsair is currently investigating the matter and the first thing it determined is that factory resetting the device won’t help much. Still, those that wish to stop the keyboard while typing out their passwords during a company presentation, need to unplug it and hold down the ESC button for five seconds, while plugging the peripheral back in. 

Via: Ars Technica



from TechRadar - All the latest technology news https://ift.tt/wtYeXlE

Wear This 'Snack Scarf' to Smuggle Food Out of Holiday Parties - CNET

The scarves from Hefty come with hidden slider storage bags. Sounds like Homer Simpson's dream scarf.

from CNET https://ift.tt/a4d6Wso

Latest Gadgets News

NASA has formally retired its Mars InSight lander, the first robotic probe specially designed to study the deep interior of a distant world, four years after it arrived on the surface of the red planet, the US space agency announced on Wednesday. Mission controllers at NASA's Jet Propulsion Laboratory (JPL) near Los Angeles determined the mission was over when two co...

from Gadgets 360 https://ift.tt/b2nOXBT

Ursids Boost the Holiday Meteor Count This Week: How to See the Forgotten Meteor Shower - CNET

Some gifts are best left unwrapped, because they're going to be lit on fire when they crash into our atmosphere.

from CNET https://ift.tt/T2zAM5k

Latest Tech News

Zerobot, a botnet that infects various Internet of Things (IoT) devices and uses them for distributed denial of service (DDoS) attacks, has been updated with new features and new infection mechanisms. 

A report from Microsoft's security team claims that the malware used to integrate IoT devices into the botnet has reached version 1.1.

With this upgrade, Zerobot can now leverage flaws found in Apache and Apache Spark to compromise various endpoints and later use them in the attacks. The flaws used to deploy Zerobot are tracked as CVE-2021-42013 and CVE-2022-33891. 

Abusing Apache flaws

CVE-2021-42013 is actually an upgrade for the previous fix, designed to patch CVE-2021-41773 in Apache HTTP Server 2.4.50. 

As the latter was insufficient, it allowed threat actors to use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives, the cve.mitre.org site explains. “If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.”

CVE-2022-33891, on the other hand, affects the Apache Spark UI, and allows attackers to perform impersonation attacks by providing an arbitrary username, and ultimately, allows the attackers to run arbitrary shell commands. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1, cve.mitre.org explained.

The new version of Zerobot also comes with new DDoS attack capabilities, Microsoft explained. These capabilities allow threat actors to target different resources and render them inaccessible. In almost every attack, the report states, the destination port is customizable, allowing threat actors who purchase the malware to modify the attack as they see fit.



from TechRadar - All the latest technology news https://ift.tt/Gx6wjpD

Wednesday, December 21, 2022

New Retirement Savings Rule Changes: Here's What's Coming for Your 401(k) and IRA - CNET

The omnibus spending bill expected to pass Congress this week includes major changes to the rules for retirement accounts.

from CNET https://ift.tt/EI6CQZY

Latest Tech News

Google has announced that it is set to drop TrustCor Systems as a root certificate authority (CA) for its web browser.

The tech giant cited a “loss of confidence in its ability to uphold these fundamental principles and to protect and safeguard Chrome's users” in a group discussion.

Joel Reardon, a professor and mobile space privacy researcher at the University of Calgary, said that his team had “uncovered and disclosed a spyware SDK embedded in apps that were invasively tracking users”.

TrustCor root certificate authority

In a joint effort with Wall Street Journal investigative journalists, it was found that TrustCor was registered just a month apart from the company behind the SKD, known as Measurement Systems, both in Panama. 

Reardon points out in his notice:  “To be clear, I have found no evidence of TrustCor issuing a bad certificate or otherwise abusing the authority they have in code signing, SMIME, and domain validation… Perhaps the identical ownership of TrustCor and Measurement Systems is a coincidence.”

Beyond this, there are a number of unfortunate, related coincidences that have led companies like Microsoft and Mozilla to drop TrustCor as a root CA, too.

The change is set to take effect with the rollout of Chrome 111, which is set to land on March 7, 2023, following a beta release around one month before. Previous versions of Chrome capable of receiving component updates will also be included in the change.

Just how long we’ll have to wait for the change to make its way to Android devices is uncertain. Unlike Chrome for desktop, which can be tweaked by itself, Android’s root certificate is updated as part of the entire operating system, which is likely to cause a delay.

While some apps, like Firefox for Android, can configure their own set of CAs on top of the operating system’s root store, this isn’t the case with Chrome.

While tech giant Apple is yet to announce any decision that it will make, TrustCor has published a public statement on its website.



from TechRadar - All the latest technology news https://ift.tt/pGKIXjt

Latest Tech News

Multiple cybersecurity firms have confirmed the existence of Godfather, an Android banking malware that has been found targeting victim's bank and cryptocurrency accounts. 

Experts at Group-IB, ThreatFabric, and Cyble have all recently reported on Godfather, its targets, and methodologies, which sees the malware attempt to steal login data by overlaying legitimate banking and cryptocurrency apps (exchanges, wallets, and similar). 

The group found that Godfather has targeted more than 400 different entities, with most of them being in the US (49), Turkey (31), Spain (30), Canada (22), France (20), Germany (19), and the UK (17). 

Multiple infection vectors

What’s more, the malware analyzes the endpoint it infected, and if it determines that the device language is either Russian, Azerbaijani, Armenian, Belarusian, Kazakh, Kyrgyz, Moldovan, Uzbek, or Tajik, it shuts the whole operation down - leading some of the researchers to believe that the threat actors are of Russian origin.

The exact number of infected devices is impossible to determine, as Play Store is not the only infection vector. In fact, the malware has had a relatively limited distribution through Google’s app repository, and the main distribution channels are yet to be discovered. What we do know, courtesy of Cyble’s research, is that one of the malicious apps has more than 10 million downloads under its belt. 

But when a victim downloads the malware, they first need to give it permissions, which is why in some instances, it imitates “Google Protect” and demands access to the Accessibility Service. If the victim provides, the malware takes over SMS texts and notifications, starts recording the screen, exfiltrates contacts and call lists, and more. 

By turning on Accessibility Service, the malware gets even harder to eliminate, too, and allows threat actors to exfiltrate Google Authentication one-time passwords, as well. 

The researchers also said that the malware has additional modules that can be added, giving it extra features such as to launch a VNC server, enable silent mode, establish a WebSocket connection, or dim the screen.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/SzNb5K2

Latest Tech News

Content creators eyeing up the new AMD Radeon RX 7900 XTX could be in for a disappointment. 

Benchmarking the GPU across popular content creation apps, Puget Systems found AMD’s latest offering lagged below the standards set by rival Nvidia.

The results chime with our own tests, where the graphic card remains a great option for gaming PCs, but creative workload performance could best be described as “just ok”. 

AMD Radeon RX 7900 XTX: Benchmarking  

The team over at Puget put the GPU through its paces, running a range of video editing software, VFX software, and 3D modeling software on Team Red’s most powerful graphics card. 

DaVinci Resolve was first up. The free video editing software is well-equipped to take advantage of high-end GPUs, and it’s here where the graphics card shone. 

According to Puget  the 7900 XTX showed more than a 30% overall performance boost compared to the older Radeon 6900 XT. It even edged out the Nvidia GeForce RTX 4090 to hit the top spot. 

It also achieved high marks in the H.264/HEVC and RAW debayering tests, outperforming the 6900 XT and about on par with the RTX 4090. 

Next, the custom PC builder tried out Adobe Premiere Pro, which doesn’t make much use of GPUs as a whole. Overall, it increased performance by 22% over past AMD GPUs. However, it failed to beat the RTX 4090 or 4080, with Puget noting it was “more in line with the RTX 3080 and 3090 models.” 

In Adobe After Effects, the 7900 XTX was found to be a mid-table performer. As in other tests, performance was overall superior to the 6900 XT, but couldn’t keep up with the GeForce 4080, 3090, or 4090. 

Nor did the card perform well in Unreal Engine with mixed results when used alongside the top game development tool. The team found “in rasterized workloads, the 7900 XTX performs quite well, in one test nearly matching the slightly more expensive RTX 4080. But in the other rasterized test, the 7900 XTX had the lowest score of all cards tested.” 

Finally, the 7900 XTX was used for 3D rendering software Blender. And it makes grim reading, with the GPU “unable to match the rendering power of the NVIDIA GeForce RTX series.” While GPU rendering showed a 70% performance increase compared to AMD’s RX 6900 XT, Nvidia’s RTX 4080 proved to be almost three times faster. 

In the final analysis, Puget Systems suggested that while certain content creation workloads would benefit from the AMD Radeon RX 7900 XTX, Nvidia’s line-up remained its top choice for creators. 



from TechRadar - All the latest technology news https://ift.tt/2wsHNFz

Best Cash-Back Credit Cards in December 2022 - CNET

Earn cash back on popular spending categories including groceries, restaurants, gas, travel and more.

from CNET https://ift.tt/jDBCTm3

Latest Tech News

Artificial intelligence research lab OpenAI has announced details on its latest technology that will see huge improvements to 3D rendering.

OpenAI is the company behind text-to-image generator, DALL-E, which has now turned its attention to translate text prompts into 3D point clouds, which it will call POINT-E.

According to a paper published by OpenAI, POINT-E “produces 3D models in only 1-2 minutes on a single GPU”, compared with other current solutions which can take hours and require multiple GPUs.

OpenAI POINT-E

An extract from the paper details POINT-E’s current place in the world of 3D model building:

“While our method still falls short of the state-of-the-art in terms of sample quality, it is one to two orders of magnitude faster to sample from, offering a practical trade-off for some use cases.”

It works by generating a single synthetic view with a text-to-image diffusion model. Then, a 3D point cloud is generated, which is easier to synthesize hence the reduced load on GPUs, though it doesn’t capture smaller details hence the trade-off mentioned in the paper.

A secondary AI has been trained to alleviate some of this, but the work explains that this can “sometimes miss thin/sparse parts of objects”, such as the stalks of a plant, giving the illusion of floating flowers.

OpenAI promises to have trained the artificial intelligence on several million 3D models and their metadata, though its use cases for now remain fairly limited.

One such example includes rendering real-world objects for 3D printing, though as the technology develops and becomes more refined, it’s likely that we’ll see it being used in more advanced cases such as gaming and even television.

The project’s open-source code is available on GitHub,  



from TechRadar - All the latest technology news https://ift.tt/NAlrx7e

Tuesday, December 20, 2022

Latest Tech News

Criminals have been found impersonating a well-known cybersecurity firm in an attempt to steal data from software developers, researchers have found.

Researchers from ReversingLabs recently discovered a malicious Python package on PyPI called “SentinelOne”. Named after a known cybersecurity company from the United States, the package pretends to be a legitimate SDK client allowing easy access to the SentinelOne API from within a separate project. 

However, the package also carries “api.py” files which hold the malicious code, and allow the threat actors to exfiltrate sensitive data from the developers to a third-party IP address (54.254.189.27).

Going after auth tokens and API keys

The data being stolen includes Bash and Zsh histories, SSH keys, .gitconfig files, hosts files, AWS configuration info, Kube configuration info, and others. As per the publication, these folders usually store auth tokens, secrets, and API keys, which would enable threat actors further access to target cloud services and server endpoints. 

The worst part is that the package does offer the functionality the developers expect. In reality, this is a hijacked package, meaning unsuspecting developers might end up using it and becoming victims in ignorance. The good news is that ReversingLabs confirmed the malicious intent of the package, and after reporting it to both SentinelOne and PyPI, had it removed from the repository.

In the days and weeks leading up to the removal, the malicious actors were quite active. The package was first uploaded to PyPI on December 11, and has been updated 20 times in less than 10 days. 

One of the issues that were fixed with an update was the inability to exfiltrate data from Linux systems, the researchers found.

It’s difficult to say if anyone fell for the scam, the researchers concluded, as there is no evidence the package got used in an actual attack. Still, all the published versions were downloaded more than 1,000 times. 

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/umCWvp6

Best Verizon Phone for 2022 - CNET

These are the best phones available on Verizon right now.

from CNET https://ift.tt/VhCU7S6

Why 'Santa Should Phase Out Coal' for Naughty Kids This Christmas - CNET

One pediatrician has a plea.

from CNET https://ift.tt/CAzoypj

Latest Tech News

A vulnerability more serious than EternalBlue was sitting in Windows for some time, before being finally discovered and patched, experts have revealed. 

For those with shorter memory, EternalBlue was an NSA-built zero-day for Windows which gave birth to WannaCry, possibly the most devastating global ransomware threat to ever emerge.

Researchers from IBM, which discovered the flaw, said that it was even more potent as it resided in a wider range of network protocols, giving threat actors more flexibility when conducting their attacks.

Three-month headway

The flaw, tracked as CVE-2022-37958, isn’t exactly new, as it was discovered - and patched - three months ago. 

The news is that no one - not the researchers, not Microsoft issuing the patch - knew exactly how dangerous it really was. In reality, it allows threat actors to run malicious code without the need for authentication. Furthermore, it’s wormable, allowing threat actors to trigger a chain reaction of self-multiplying exploits on other vulnerable endpoints. In other words, the malware abusing the flaw could spread across devices like wildfire. 

Discussing the findings with Ars Technica, Valentina Palmiotti, the IBM security researcher who discovered the code-execution vulnerability, said an attacker could trigger the vulnerability via “any Windows application protocol that authenticates.”

“For example, the vulnerability can be triggered by trying to connect to an SMB share or via Remote Desktop. Some other examples include Internet exposed Microsoft IIS servers and SMTP servers that have Windows Authentication enabled. Of course, they can also be exploited on internal networks if left unpatched.”

When Microsoft first patched it three months ago, it believed the flaw could only allow threat actors to grab some sensitive information from the device, and as such, labeled it as “important”. Now, the company amended the rating, labeling it as “critical”, with a severity score of 8.1.

Unlike EternalBlue, which was a zero-day and left security experts and software makers scrambling to build a fix, the patch for this flaw has been available for three months now, so its effects should be somewhat limited. 

Via: Ars Technica



from TechRadar - All the latest technology news https://ift.tt/SyeJmqP

Wyze Outdoor Cam v2 Review: Few but Impactful Improvements - CNET

It isn't much different or much more expensive than the previous outdoor camera from Wyze, but it's a noticeable upgrade nonetheless.

from CNET https://ift.tt/1Ay0TgF

Latest Tech News

Password sharing on streaming services is nothing new, and Netflix’s attempts to limit the practice in recent months are well-documented. Now, though, new piracy guidance issued by the British government suggests anyone sharing passwords in the UK could be in breach of copyright law – and even face criminal charges for fraud. 

As first reported by TorrentFreak, Britain’s Intellectual Property Office (IPO) has updated its piracy guidance to assert that “password sharing on streaming services” – which includes the likes of Netflix, Prime Video and Disney Plus – can legally be deemed an act that “break[s] copyright law.” 

TorrentFreak reached out to the IPO for clarification on the legalities of password sharing, and the agency replied as follows: “There are a range of provisions in criminal and civil law which may be applicable in the case of password sharing where the intent is to allow a user to access copyright protected works without payment.”

“These provisions may include breach of contractual terms, fraud or secondary copyright infringement depending on the circumstances," the IPO continued. 

In other words, those sharing streaming service passwords in the UK could legally be prosecuted for fraud and/or breaches of copyright law – though it’s worth noting that the likelihood, in our opinion, is very slim. 

Netlix corporate headquarters building with red logo on outside

(Image credit: Shutterstock / Elliott Cowand Jr)

For starters, the bar for what constitutes an act of fraud in the UK is low. The country’s 2006 Fraud Act notes that using the “services of a members’ club without paying and without being a member” is deemed fraud, as is posting “chargeable data or software over the internet without paying.” Both offences are commonplace – how many times have you reposted someone else’s work on social media? – and although the practice of password sharing could fall into either category, it’s highly unlikely that the Crown Prosecution Service would pursue anyone for wanting to share Stranger Things with their friends.

Publicly aligning with such draconian action would also spell reputational disaster for streaming services that have actively encouraged password sharing in the past (as recently as 2017, Netflix tweeted “love is sharing a password").

However, while password sharing isn’t likely to put you behind bars in the UK or anywhere else any time soon, the British government’s official line on the legalities of such behavior will give Netflix the confidence – and the legal mandate – to follow through with its ambitious plans to introduce account sharing surcharges in 2023. 

It wouldn’t be a surprise to see the likes of Prime Video and Disney Plus follow suit, too, if Netflix’s drastic action reaps a significant revenue boost in the months following its rollout. 

For more Netflix-related content, check out our breakdown of Netflix's cheaper, ad-supported tier, as well as its new remote logout feature



from TechRadar - All the latest technology news https://ift.tt/6Z825PR

Monday, December 19, 2022

Latest Tech News

Hundreds of Android applications being distributed through the Google Play Store have been found leaking Application Programming Interface (API) keys, putting users at risk of identity theft and other threats.

The risks were found by cybersecurity researchers at CloudSEK, who used the company’s BeVigil security search engine to analyze 600 applications on the Play Store.

Overall, the team found half (50%) were leaking API keys of three top transaction and email marketing service providers, putting users at risk of fraud or scams.

MailChimp, SendGrid, MailGun

CloudSEK found the apps were leaking APIs from MailChimp, SendGrid, and Mailgun, allowing potential threat actors to send emails, delete the API keys, and even modify multi-factor authentication (MFA). CloudSEK has since notified the apps’ developers of its findings.

Between them, the apps were downloaded by 54 million people, which are now at risk. Most of the potential victims are located in the United States, with the UK, Spain, Russia, and India, also accounting for a hefty portion. 

“In modern software architecture, APIs integrate new application components into existing architecture. So its security has become imperative,” commented CloudSEK. “Software developers must avoid embedding API keys into their applications and should follow secure coding and deployment practices like standardize review procedures, rotate keys, hide keys and use vault.”

Between the three services, MailChimp is arguably the biggest, and by leaking MailChimp API keys, app developers would allow threat actors to read email conversation, exfiltrate customer data, grab email lists, run email campaigns of their own, and manipulate promotional codes.

Furthermore, hackers could authorize third-party apps connected to a MailChimp account. In total, the researchers identified 319 API keys, with more than a quarter (28%) being valid. Twelve keys allowed for email reading, it was added. 

Leaking MailGun API keys also allows threat actors to send and read emails, but also to get Simple Mail Transfer Protocol (SMTP) credentials, IP addresses, as well as various statistics. Furthermore, they’d be able to exfiltrate customer mailing lists, as well.

SendGrid, on the other hand, is a communication platform that helps companies deliver transactional and marketing emails through a cloud-based email delivery platform. With an API leak, hackers would be able to send emails, create API keys, and control IP addresses used to access accounts.

Via: Infosecurity Magazine



from TechRadar - All the latest technology news https://ift.tt/v3dseiT

Latest Gadgets News

OnePlus 11 5G and the OnePlus Buds Pro 2 are scheduled to launch at the company’s Cloud 11 event next year. The Shenzhen-based company, in an official announcement, revealed the details of the upcoming OnePlus Cloud 11 launch event, which is scheduled to take place on February 7, 2023.

from Gadgets 360 https://ift.tt/n0yjQOc

Apple TV Plus: Every New TV Show Arriving in December - CNET

Here's a complete list of shows coming in December.

from CNET https://ift.tt/axQD9MO

Latest Tech News

Apple is looking increasingly likely to miss its projected 2022 deadline for completing the transition to using its own silicon processors across the entirety of the Mac product line, with the enterprise-aimed Mac Pro being the last to follow.

As highlighted by Bloomberg’s Mark Gurman, the path to Mac Pros powered by Apple’s custom M-series chip, which would allow iOS apps to run natively in macOS, and otherwise result in increased performance gains and decreased power consumption, has been a difficult one.

Reasons cited for the delay include relocation of manufacturing to avoid additional tariffs on goods manufactured in China, continued redesigns of the M-chips to include an “Extreme” variant, and fears of skyrocketing costs to customers.

Mac Pro M2 delay

As addressed by Gurman, Apple’s plans to move its line of high end workstations to Apple silicon began with the introduction of its M1 chip in 2020. 

Plans were made for a unique processor that, across two configurations of the Mac Pro product, would combine the power of either two or four M1 Max chips, the most powerful chip available in the Macbook Pro line at the time.

However, the Mac line of computers has not benefited from simplicity, and the dual M1 Max chip, which became known as the M1 Ultra, ended up launching with the Mac Studio, a line marketed towards creatives and others who rely on resource-heavy processes.

An M2 Ultra chip promising additional performance gains is reportedly in development, but hopes for a further M2 Extreme chip, that Gurman speculates would likely have offered “up to 48 CPU cores and 152 graphics cores” by being four M2 Max chips stuck together seem, according to him, to be dead in the water.

The biggest barriers to Mac Pros running on appears to be cost of production, and to customers. 

The complex nature of the architecture of the most powerful Apple silicon, that would give Mac Pros their unique selling point, is expensive enough without production having been relocated to Texas during the Trump presidency.

The two primary reasons for the move were for Apple to evade increased tariffs on Chinese imports and uphold a public commitment to grow the US economy - both of which point to a PR exercise, and one that is costing them the ability for a painless switching to its own silicon.

Gurman claims that an M2 Extreme version of a Mac Pro would “probably” cost “at least” $10,000 per unit, which would not be cost-effective even regardless of an ongoing recession.

Putting aside the conjecture, the Mac Pro is in a difficult place as a product. It has to offer better performance than all other Macs, which is complicated by the existence of the Mac Studio, but is a niche offering, only especially relevant to enterprise customers that need the extra power.

At the moment, only Intel-powered Mac Pros continue to only be available. There will probably be another entry in the line, but it may not appear for some time, and still not be powered exclusively by Apple's own silicon.



from TechRadar - All the latest technology news https://ift.tt/RaSp4Wx

Latest Gadgets News

Samsung Galaxy A04 and Galaxy A04e are launched in India. The handsets ship with a MediaTek Helio P35 SoC coupled with up to 4GB of RAM, a 5,000mAh battery, and more. Samsung Galaxy A04e is available in Black, Blue, and Copper color options.

from Gadgets 360 https://ift.tt/LqDYG4M

Sunday, December 18, 2022

Scientists Now Know Why Coyotes Unexpectedly Killed a Human in 2009 - CNET

When a pack of coyotes attacked a hiker in 2009, it became the first recorded instance of coyotes killing an adult in North America.

from CNET https://ift.tt/gkZ04oR

Apple's iPhone 15 Isn't the Only Exciting Phone Coming in 2023 - CNET

Samsung, Google and OnePlus have new phones in the works too. Here are the top ones to watch based on rumors so far.

from CNET https://ift.tt/CzWu6jR

Cardinals vs. Broncos Livestream: How to Watch NFL Week 15 Online Today - CNET

Want to watch the Arizona Cardinals take on the Denver Broncos? Here's everything you need to stream Sunday's afternoon game on Fox.

from CNET https://ift.tt/ELAylhe

You Can Order Free COVID Tests From USPS Again. Here's How - CNET

The Postal Service will start shipping tests to households on Monday. Learn how many you can get and when they'll arrive.

from CNET https://ift.tt/sjJNryp

DoorDash, Uber Eats or Grubhub: This Is the Cheapest Way to Get Your Lunch - CNET

We did the math to find the most affordable food delivery app.

from CNET https://ift.tt/olAWhft

Saturday, December 17, 2022

The Rising Cost of Pregnancy: What Can Parents Do About It? - CNET

Pregnant parents find their own solutions to high out-of-pocket costs when health insurance falls short.

from CNET https://ift.tt/h65AiUf

12 Kitchen Tools Under $25 I Can't Live Without -- and How to Use Them - CNET

These must-have items are everything I want in a workhorse tool. They're inexpensive, versatile and easy to store, use and clean.

from CNET https://ift.tt/nGhBdDF

The Absolute Best Fantasy Movies on Netflix - CNET

Netflix's fantasy options range from pure magic to touching allegories of the human condition.

from CNET https://ift.tt/UGkm3x6

On Twitter, Suspended Journalists' Accounts Begin Reappearing - CNET

After conducting a public poll via Twitter, Elon Musk says the suspensions are being lifted.

from CNET https://ift.tt/YGOLT29

Best High-Speed Internet Service Providers - CNET

When only the fastest home internet service will do, look to these top ISPs for gigabit and multi-gigabit internet plans.

from CNET https://ift.tt/QLoK1Na

Latest Tech News

For its next trick, Apple might be working on keyboards for its MacBooks that change the appearance and functionality of their keys dynamically, depending on context – so the A key could instantly transform into a 9 key, for example.

This comes from a patent spotted by Patently Apple (via 9to5Mac), outlining a keyboard which would have a flexible backlighting system that could display any symbol on any key. Specifically, keys with "illuminable glyphs that are selectively visible or invisible to an unaided human eye".

At the moment of course, Apple uses keyboards with static, pre-printed labels that can't be changed. Some keys that do have more than one use, such as the media playback keys, have multiple labels on them so it's clear what they do.

How a MacBook key might look

How the keys might be designed (Image credit: Patently Apple)

Changeable glyphs

Essentially, the hardware described by the patent involves keys with a matrix of individual pixels that can be turned on or off as required, using finely tuned micro-LED or OLED components that Apple is familiar with from its device displays.

The end result would be "glyphs that are changeable or adjustable between different shapes, letters, colors, symbols, animations, languages, and other features" – so a keyboard could be used for typing, and then switched to offer shortcut controls for video editing, for instance.

As always with patent applications, this doesn't suggest we're anywhere near an end product, or that one will eventually get made – but it does show what Apple is exploring in terms of future hardware innovations.


Analysis: a more flexible keyboard

It certainly looks as though Apple wants to shake up the technology of its MacBooks: only a few days ago we heard about plans for a laptop consisting of a single 20-inch foldable display, with the keyboard on one side and the conventional 'screen' on the other.

This latest patent application isn't quite so dramatic, but it makes a lot of sense. Imagine having keys that could quickly shift to take on different functions depending on what was happening on macOS: you could have various layouts for browsing the web, editing photos, playing games and plenty more.

That's not to mention the flexibility it would offer in terms of typing in different languages. Scientists and mathematicians would also benefit by having access to a certain set of functions at certain times – and when these specific keys aren't required, the layout can return to normal with another button press.

All this would cost money of course, so the trade-off might be higher prices for Apple's laptops. Perhaps to begin with it would come as an optional extra, but as with any patent, we'll have to wait and see whether or not it becomes a reality.



from TechRadar - All the latest technology news https://ift.tt/jDM2LFi

Friday, December 16, 2022

NASA Is Building the 'First Sample Depot on Another World,' on Mars - CNET

NASA has chosen a spot called Three Forks to drop off some of the Perseverance rover's rock collection.

from CNET https://ift.tt/IPHy2FY

Latest Gadgets News

YouTube is testing 'Add to Queue' feature on Android and iOS devices for users having a YouTube Premium subscription. The feature, which has been available on Youtube's web platform, is now being brought to the mobile app. The feature will be accessible through the three-dot menu. Once a video is added to the queue, users will be able to use gestures like drag and dro...

from Gadgets 360 https://ift.tt/hdnI4xq

David Harbour on Mental Health, Running and Supporting Others This Holiday Season - CNET

In need of a way to improve your mental and physical health? Follow David Harbour's lead and hit the ground running.

from CNET https://ift.tt/4s8F1HT

Stop Loading Your Dishwasher the Wrong Way. Here's How to Do It - CNET

Yes, there is a right way to fill up your dishwasher.

from CNET https://ift.tt/tcsejG3

Latest Tech News

After confirming to have aced three independent security audits only about a month ago, ExpressVPN has just released the results of further testing on its software. 

Again, the provider seems to have passed these latest audits with full marks. 

This time, cybersecurity experts from Cure53 were called to assess ExpressVPN mobile apps. Its own password manager tool ExpressVPN Keys – which comes at no extra cost with both its iOS and Android apps – was also tested for any vulnerabilities. 

Despite a few minor bugs, which the provider said to have already addressed, Cure53 was pleased with the results and the commitment shown by the ExpressVPN team in fighting back "many problems that modern VPN applications tend to face."

'Diligent efforts in minimizing any potential threats' 

"All in all, the development team deserves every plaudit for their due diligent efforts in minimizing any potential threats for the iOS application, with only minor adjustments required to further elevate the platform to an exemplary standard from a security perspective," concluded the auditing firm on its iOS audit report

A similar outcome ended the Android audit report, too. At the same time, Cure53 was pleased with the access and collaboration grant from the provider during the whole process. 

Teams of three and five senior testers performed white-box testing and source-code audits on ExpressVPN's iOS and Android apps between August 2022 and September 2022. These were aimed to determine whether ExpressVPN's mobile apps could successfully withstand external attacks.  

For the first time, ExpressVPN Keys was also tested to assure it correctly secures users' login details.   

Both audits revealed only a handful of minor vulnerabilities but with very little risk for users' data.

Specifically, the iOS audits identified a total of nine issues. Among these, only four were categorized as low and medium risk security vulnerabilities. The remaining five were referred to as "general weaknesses with lower exploitation potential." 

While the Android testing revealed a total of 13 vulnerabilities. Again, only three of the findings were deemed as security bugs at low or medium severity. 

However, as Cure53 reported: "The vast majority of findings are variations of common misconfigurations that are often present in Android applications. This positive viewpoint is also corroborated by the fact that none of the aforementioned vulnerabilities can be directly abused to conduct successful attacks."

ExpressVPN's very own password manager also received positive feedback, gaining "a solid impression on the whole."    

These latest testing bring the total of ExpressVPN's published independent VPN audits up to 13 since 2018. What's more, a security assessment on the ExpressVPN Keys browser extension is also on the way.

"We recognize the growing global need for digital privacy and security protections,” said Brian Schirmacher, penetration testing manager at ExpressVPN. “Audits by esteemed cybersecurity firms such as Cure53 are one of our many trust and transparency initiatives. We want to continue setting the bar high for the industry.”    



from TechRadar - All the latest technology news https://ift.tt/bGEI1xQ

Thursday, December 15, 2022

Facebook Memories You'd Rather Forget? Here's How to Block Them - CNET

Not all memories are good ones. Here's how to prioritize your mental well-being on social media.

from CNET https://ift.tt/dHvyEVQ

Google Nest and Android Devices Now Work With Matter - CNET

Matter is an agnostic smart-home platform that lets users connect devices from different manufacturers.

from CNET https://ift.tt/RkIxm9z

Latest Tech News

Microsoft has officially banned cryptomining within its Azure cloud services in a rather inconspicuous way. 

An update to its Universal License Terms for Online Services, which mainly applies to its cloud platform, states that "mining cryptocurrency is prohibited without prior Microsoft approval."

The post goes on to explain that written approval is needed for those looking to use the company's services for cryptomining, clarifying that "neither customer, nor those that access an online service through customer" are permitted to leverage them for this purpose.

Dangers of mining

The policy change was also posted in the Azure Solution Area of Microsoft's Partner Community webpage, under the heading "Important actions partners need to take to secure the partner ecosystem".

Here, it was listed as among the changes to "minimize potential fraud damage to your customers’ subscriptions". Again, it stressed the need for "written pre-approval... granted by Microsoft" to sanction the use of its servers for sourcing the digital tokens.

Microsoft is concerned about the dangers such activities present to their infrastructure. In responding to a query from the The Register, the tech giant commented that mining for cryptocurrencies can "cause disruption or even impairment to online services and its users", adding that cryptomining "can often be linked to cyber fraud and abuse attacks such as unauthorized access to and use of customer resources."

They did add the caveat, however, that cryptomining "may be considered for testing and research for security detections."

Microsoft isn't alone in restricting cryptomining on its cloud platforms. Google Cloud, Oracle and OHVcloud have all banned it from their services, and Amazon Web Services only allows it within its paid subscription tiers. 

Microsoft has prohibited mining for a while on its free tier, but has only now escalated its policy to its paid-for options as well.



from TechRadar - All the latest technology news https://ift.tt/BWcU9w8

Latest Tech News

Microsoft has identified a huge number of IoT security issues, finding unpatched, high-severity vulnerabilities in 75% of the most common industrial controllers in customer operational technology (OT) networks.

The tech giant's research also found that 72% of the software exploits utilized by what Microsoft terms “Incontroller” are now available online. 

"Incontroller" is what the Cybersecurity and Infrastructure Security Agency (CISA) describes as a "novel set of state-sponsored, industrial control system (ICS) oriented cyberattack tools".

What is true scale of the issue?

Microsoft cited recent IDC figures that estimate there will be 41.6 billion connected IoT devices by 2025, a growth rate much higher than that of traditional IT equipment.

However, it claims that the development of IoT and OT device security has not kept pace with that of other IT systems, and threat actors are exploiting these devices.

Microsoft pointed towards Russia’s cyberattacks against Ukraine, as well as other nation-state-sponsored cybercriminal activity, saying these demonstrate that "some nation-states view cyberattacks against critical infrastructure as desirable for achieving military and economic objectives".

You certainly do not have to look far to see examples of these types of industrial IoT attacks wreaking havoc on all involved.

In May 2021, the Colonial Pipeline ransomware attack disrupted the supply of natural gas in much of the Southern US, causing widespread price rises.

To mitigate these types of risks, Microsoft recommends customers work with stakeholders to map business-critical assets, in IT and OT environments, as well as work to identify what IoT and OT devices are critical assets by themselves, and which are associated with other critical assets.

Microsoft also recommends that organizations perform a risk analysis on critical assets, focusing on the business impact of different attack scenarios.

  • Interested in keeping your organization safe from cyber threats? Check out our guide to the best firewalls


from TechRadar - All the latest technology news https://ift.tt/90B7JMf

Latest Gadgets News

OnePlus is all set to unveil its first customisable mechanical keyboard. The product, which will launch for global markets, is a part of products that will be unveiled through OnePlus Featuring. It will be compatible for Mac, Windows and Linux. The layout will be similar to MacBook keyboard, but can work with MS Windows as well. 

from Gadgets 360 https://ift.tt/rLWKlOi

Spider-Man 2 Hits PS5 Next Fall - CNET

Marvel heroes will take on an alien symbiote nemesis in developer Insomniac's sequel.

from CNET https://ift.tt/jaicRU4

Latest Tech News

A popular Android browser app with more than five million downloads on the Google Play Store may have been leaking user data including browser history, experts have claimed.

Cybernews says it discovered that the ‘Web Explorer - Fast Internet’ app had left its Firebase instance open - a mobile application development platform that’s designed to assist with analytics, hosting, and cloud storage

At risk is five days’ worth of redirect data, including country, direct initiating address, redirect destination address, and user country, all presented by user ID.

Android Web Explorer data leak

Cybernews senior journalist Vilius Petkauskas, explains that getting their hands on this data alone may not be enough to give threat actors what they seek, however cross-referencing it with additional details could prove harmful.

The app was also found to be hardcoding on the client side, including keys relating to anonymized partial user browsing history, unique public identifiers, and a cross-server communication enabler.

“If threat actors could de-anonymize the app’s users, they would be able to check a bunch of information on browsing history for a specific user and use it for extortion,” CyberNews noted.

It has since been discovered that the open Firebase instance has been closed and is no longer accessible, which means that threat actors can no longer access sensitive data. However, it’s not all good news: Cybernews reached out to the app’s team about its findings, but it’s yet to receive a reply.

Further digging also uncovers that the app was last updated in October 2020, meaning that the hardcoded ‘secrets’ are likely still there. The researchers write: “...we can only guess what other information could be leaking through the application’s secrets”.



from TechRadar - All the latest technology news https://ift.tt/LFqYK8B

Wednesday, December 14, 2022

Major Energy Breakthrough: Milestone Achieved in US Fusion Experiment - CNET

The National Ignition Facility achieves ignition in a fusion reactor.

from CNET https://ift.tt/TUPgreO

Latest Tech News

Businesses have become more reliant on their IT hardware every year, as their activities go through increasing digital transformation. The move towards hybrid working during the pandemic has further accentuated the importance of computing to economic success. But while small- and medium-sized businesses (SMBs) have been swept along by this trend as much as larger ones, their ability to roll out the necessary hardware upgrades is more financially constrained. Your choices should prioritize devices that are made to last, so the maximum amount of utility can be obtained from the IT equipment purchased over the longest period.

This goes well beyond merely ensuring that IT purchases deliver the most features possible for the money and are obtained from reputable brands. Computer equipment typically has a three- to five-year lifespan, and it will need to deliver the best possible performance during this period. Not only must the hardware provide performance and features to run contemporary applications, but also fit with emerging work patterns. Most important of all, it must be able to resist current and emerging cyber threats, which are constantly evolving and gaining sophistication.

The right PC for the job

The changing nature of work from being primarily on-premises to hybrid models has meant that employees now use a much wider range of devices than before. Gone are the days when a standard desktop configuration could be rolled out across everyone’s desk, with a fixed specification guaranteed for a long period of time so administrators always knew what they were managing. Now, while some employees will still be in the office, many will divide their time between home and workplace, some will be mostly on the road, and some may even operate almost exclusively from where they live. It may even be necessary to onboard new employees remotely.

While you can’t apply a ‘one size fits all’ approach anymore, you can still unify within a family of systems that offer a reliable set of features. Standardizing on devices based on the Intel vPro®, An Intel® Evo™ Design platform ensures that your fleet will share core capabilities including performance, connectivity, management, updating methods and security. For example, Dell’s Latitude 7420 and 7430 notebooks provide baseline performance that can be enhanced for more demanding workloads, alongside cutting-edge features.

The Dell Latitude 7420 and 7430 powered by Intel vPro®, An Intel® Evo™ Design, offer a dependable level of hardware-enhanced security, business-grade performance, efficient remote management, reliability, and stability. The platform also promises consistent system responsiveness, a long-lasting battery and comprehensive state-of-the-art connectivity. Both Dell devices have a 2-in-1 form factor, with touch screen and foldable hinge, delivering flexible use for employees who need to hot desk, work on the move, present and browse information in a tablet configuration.

For organizations that require a blend of desktops and notebooks, Intel vPro®, An Intel® Evo™ Design features are also available in desktop computers. For example, the Dell OptiPlex 7000 series comes in a broad range of formats, from micro and small form factor to all-in-one, meeting space solutions and medium towers. Virtually any computing need from tiny and inconspicuous to power systems for more gruelling workloads can be accommodated. These systems can be managed alongside Intel vPro®, An Intel® Evo™ Design notebooks as part of a common fleet.

This is a fundamentally valuable characteristic, because keeping systems healthy and running smoothly will extend their useful life for as long as possible. All hardware becomes obsolete eventually, but a lot of it may cease to be used before then because the operating system and software hasn’t been updated, has become corrupted by malware or the device itself hasn’t been repaired in the case of a hardware failure. Intel vPro®, An Intel® Evo™ Design facilitates this process by providing a common interface for management. For example, the Dell Command Intel vPro® Out of Band console, through its support for Intel vPro®, An Intel® Evo™ Design, can remotely manage a range of disparate devices. This enables remote onboarding and offboarding of employees who never come to the central office.

Security and sustainability

Security is another central feature of maintaining system uptime. Intel vPro®, An Intel® Evo™ Design provides built-in hardware security out of the box including Intel Hardware Shield. This delivers protection from malware that is baked into the hardware, allowing devices to be easily and cleanly rebooted if compromised. Alongside these built-in features, the system can use AI to detect new threats as they emerge. Alongside remote management, it’s possible to provide constant additional improvement to security as threats are detected on devices, whether on a local network or remotely connected. So an Intel vPro®, An Intel® Evo™ Design always has the latest protection from cyberattacks.

Keeping systems running through a hardware failure is also key. Upgrading an entire system when a single component has broken is a waste of resources and will also work against sustainability targets. Although functional integration has made this harder, even portable systems can be manufactured in a way that enables repair. Purchasing one of these expands the possibility of keeping systems running longer. Dell’s laptops also score highly amongst independent hardware repairers for being constructed in a way that makes fixing them easier than most other brands. Dell’s commitment to sustainability stretches back some years and underpins this facility. Dell has even pioneered the use of augmented reality to facilitate this process with its AR Assistant.

With the increasing importance of IT in delivering value and enabling a distributed workforce to operate efficiently as a team, ensuring hardware is based on the right platform is paramount. Client systems must be kept healthy, usable and fully operational for the longest time possible. Selecting devices based on Intel vPro®, An Intel® Evo™ Design, such as from Dell’s extensive portfolio, can help deliver the best possible service. That way, companies can get the most enduring service out of their IT spend.

Intel technologies may require enabled hardware, software or service activation.

No product or component can be absolutely secure.

Your costs and results may vary.

@Intel Corp. Intel, the Intel logo, Intel vPro® and other Intel marks are trademarks of Intel Corporation or its subsidiaries. Other names and brands may be claimed as the property of others.



from TechRadar - All the latest technology news https://ift.tt/5KnUviu

Could Apple's New Adaptive Power Feature Extend Your iPhone's Battery Life?

With this new feature being tested in the iOS 26 developer beta, you may be able to ditch the Low Power Mode setting in the future. from C...