Sunday, March 31, 2024

The Iron Fist director apparently keeps getting requests to add a Waffle House stage

The Waffle House is one of America’s unique institutions. Not only is this 24/7 chain a place where you can order a breakfast combo at 3 a.m., but it’s also known to be ready to throw hands (and sometimes chairs) from unruly customers. Considering it’s notorious for late-night brawls, it’s exactly the type of setting that would provide the perfect backdrop for a fighting game like Fighting Game. Tekken 8 — fans have been asking, apparently. The long-time Tekken director posted on X this weekend asking what the deal was with all the requests for Waffle House.

Apparently this question was asked a few days before April Fools’ Day, so I wouldn’t be surprised if there were some jokes in it. But now we are having a conversation…

“Okay, I will only ask this request once,” Harada posted. “Why do some communities send me requests for ‘Waffle House’? Please be sure to explain the basis for the request, including the original story, history, and context. I’m looking forward to an explanation from someone who knows more.”

Harada then thanked everyone who explained and expressed his understanding, but then said: “The restaurant has both the trademark and the rights to the restaurant, so if the chain restaurant headquarters does not accept my proposal, it will not happen.” Waffle House now has Opportunity to do some very interesting things here.

But that shouldn’t happen until Waffle House fully addresses the concerns of its employees, some of whom have been concerned about low pay and low wages. Employees at some locations are on strike and have drafted a petition asking Waffle House to implement changes to improve working conditions. Until this issue is resolved, any collaboration with a fighting game will look bad.



Source link



from Tech Empire Solutions https://techempiresolutions.com/the-iron-fist-director-apparently-keeps-getting-requests-to-add-a-waffle-house-stage/
via https://techempiresolutions.com/

Boost productivity: What If Projects Inc. launches breakthrough business AI solution

What If Projects, Inc. is shifting its focus to empowering businesses with artificial intelligence solutions designed to automate repetitive tasks and increase productivity across industries.

What If Projects, Inc., known for its consumer artificial intelligence applications used by millions of people around the world, today announced a shift in strategy to provide enterprises with artificial intelligence solutions designed to automate repetitive tasks and accelerate innovation.

The origins of What If Projects, Inc. can be traced back to 2022, founded by serial entrepreneurs Ansh Chopra and Patrick Trudel. Their journey began at Lolly, a venture-backed dating startup where they served as chief operating officer and chief technology officer, respectively. Reunited by a shared passion for technology innovation, Chopra and Trudel successfully secured venture capital from notable investors, including renowned Cory Levy and the renowned Z Fellows program. Initially, their efforts centered on consumer AI applications, but their strategic vision quickly shifted from a B2C (business-to-consumer) model to a B2B (business-to-business) paradigm.

“Every business is limited by two things: time and resources,” said Patrick Trudel, chief technology officer at What If Projects. “In today’s fast-paced world, businesses have an obligation to allocate their precious time to those with the same core expertise. Tasks that are not directly related but necessary to the operation of their business. AI systems can perform these tasks more efficiently. Our state-of-the-art AI platform acts as a powerful catalyst, allowing businesses to move beyond these constraints and bring their brightest minds to Reallocated to value-creating work. Tasks that still require human intervention can also be significantly accelerated by this technology. ”

Leveraging machine learning, the company’s artificial intelligence models can understand complex queries, analyze large data sets, perform a variety of tasks, and improve themselves over time. The founders claim that by transferring repetitive processes to artificial intelligence, companies can significantly increase productivity.

“Wide adoption of automation technologies will make companies across industries more efficient, competitive and accelerate innovation,” said Ansh Chopra, CEO of What If Projects. “We are empowering businesses with the tools they need to become more productive.”

Trudel emphasized the universality of the problem their platform solves. “Businesses of all sizes and verticals are plagued by these tedious, repetitive tasks. Our AI solutions offer a huge opportunity to increase output by an order of magnitude and redefine how teams operate.”

“While today, this revolutionary technology is largely confined to the technology sector, its transformative potential extends far beyond technology, with applications spanning nearly every industry and every aspect of modern business operations,” Chopra said. “We are committed to accelerating adoption.”

Trudel also expressed enthusiasm for the technology’s research potential. “Imagine the progress we could make if researchers could focus solely on their expertise. How much faster we would achieve the next breakthrough if our researchers didn’t have to worry about administrative or operational tasks.”

Currently in an exclusive alpha phase, What If Projects is working with select design partners to refine and enhance the platform with valuable real-world usage data and feedback. Due to limited availability, the company is extending an invitation to businesses across industries to explore an early preview of this revolutionary AI technology.We encourage interested parties to take advantage of this unique opportunity by contacting pat@whatif.ventures

contact method:
Name: Pat Trudell
Email: Send email
Organization: What If Projects Inc.
Website: https://www.whatif.ventures/

Version number: 89125726

If you discover any errors, concerns, or inconsistencies in the content shared in this release that require action, or if you require assistance in removing the release, we strongly encourage you to notify us immediately by contacting error@releasecontact.com. Our team of experts is committed to resolving your concerns within 8 hours and working to take the necessary action to correct any identified issues or support your removal process. Providing accurate and reliable information remains our top priority.

Source link



from Tech Empire Solutions https://techempiresolutions.com/boost-productivity-what-if-projects-inc-launches-breakthrough-business-ai-solution/
via https://techempiresolutions.com/

Amazon Kindle Paperwhite on sale for $20

Amazon’s e-reader has a glare-free display and a waterproof construction you can take with you anywhere, and it’s now down to its best price so far this year. Originally priced at $150, the 16GB Kindle Paperwhite with locked screen ads is down to $130 during Amazon’s sale. That’s not an all-time low, but it’s the cheapest price for an e-reader since Black Friday. If you don’t want to see ads on your lock screen, the ad-free version is also $20 off, which is $150 off the usual $170.

Amazon

This discount is available on the latest version of the Kindle Paperwhite, available in three color options: black, agave green, and jeans. The Paperwhite is just the right size, highly readable and comfortable to hold, and comes with a 6.8-inch display. The backlight is adjustable and can be switched from bright white light to a warm amber light that’s easier on the eyes. With a 300 ppi glare-free display, on-screen text should be clearly visible and easy to read even if you’re sitting in the sun.

Amazon says the Kindle Paperwhite will last up to 10 weeks on a charge, but of course that depends on how much you use the device. It has a USB-C charging port. The Paperwhite is also suitable for poolside use, with an IPX8 waterproof rating. Not only will it be durable enough to withstand splashes, but it should also be able to withstand immersion in fresh water within reason. Amazon says it can protect it in 2 meters of fresh water for up to an hour. However, it is a little different for sea water. It can only be immersed in 0.25 meters of water for 3 minutes.

If you prefer audiobooks, the Kindle Paperwhite also supports that format and pairs with Bluetooth headphones or speakers. It doesn’t have built-in speakers or audio jacks, so you’ll need an external device to listen.

follow @EngadgetDeals on twitter and Subscribe to the Engadget Deals Newsletter Get the latest technology deals and buying advice.



Source link



from Tech Empire Solutions https://techempiresolutions.com/amazon-kindle-paperwhite-on-sale-for-20/
via https://techempiresolutions.com/

Our favorite air purifier is now $30 off for a limited time

Although your home may be clean, there are many factors that can contribute to the buildup of indoor pollutants. An air purifier is a simple way to freshen the air in your home and improve air quality—one of our favorite air purifiers is currently 14% off. In a limited-time sale at Amazon, the white Levoit Core 400S is down to $190, down from the usual $220.

see it

The white Levoit Core 400S is 14% off during this limited time sale.

Amazon $190

The design of the Levoit Core 400S is that of a standard air purifier, with vents on top of its cylindrical body and a simple display that provides touch controls and air quality readouts. A color-changing ring surrounding the pollution measurement in the center of the device provides quick information at a glance; depending on the air quality, it will be blue, green, orange or red. It has a 360-degree filtration system that is said to capture more than 99.9% of pollutants as small as 0.3 microns, including dust, pollen and pet dander.

The Core 400S is one of our top picks this year. It’s compatible with Alexa and Google Assistant for voice control and can perform automatic purification tasks. When running automatically, it adjusts the fan speed based on changes in surrounding air quality. The smart air purifier also connects to an app where you can view air quality reports even when you’re not at home. It also has a sleep mode for quieter performance at night, and it dims or turns off the display so you’re not disturbed by bright lights.

The Levoit Core 400S combines a pre-filter, activated carbon, and HEPA into a ring filter that costs $50 to replace. The company claims it can purify 1,980 square feet per hour. It may not have a great design, but it gets the job done.

follow @EngadgetDeals on twitter and Subscribe to the Engadget Deals Newsletter Get the latest technology deals and buying advice.



Source link



from Tech Empire Solutions https://techempiresolutions.com/our-favorite-air-purifier-is-now-30-off-for-a-limited-time/
via https://techempiresolutions.com/

Saturday, March 30, 2024

AT&T resets millions of customers’ passwords after account information leaked on dark web

AT&T said the recent sensitive data breach affected 7.6 million current customers and 65.4 million former account holders. TechCrunch It was first reported on Saturday morning that the company had reset passwords for all affected active accounts, a move AT&T confirmed in an update posted on its support page. According to AT&T, the data set “appears to be from 2019 or earlier” and includes names, home addresses, phone numbers, dates of birth and Social Security numbers. TechCrunch.

TechCrunch AT&T reportedly warned AT&T on Monday that the leaked data could be used to access customer accounts after a security researcher discovered that the records contained easily cracked encrypted passwords. AT&T said today that it “launched a robust investigation with support from internal and external cybersecurity experts.” According to AT&T, the data appeared on the dark web about two weeks ago.

Three years ago, a hacker named ShinyHunters claimed in 2021 that they had obtained the account information of 73 million AT&T customers. AT&T informed at the time Computer beeps It was not compromised, and the sample of information shared online by the hackers “does not appear to come from our systems.” The company now says it’s “unclear whether the data in these fields came from AT&T or one of its vendors.” So far, it has “no evidence that unauthorized access to its systems resulted in the data set being compromised.”

AT&T said it will contact current and former account holders affected by the breach. The company also said it would provide credit monitoring to these customers “where applicable.”

This article contains affiliate links; if you click on such links and make a purchase, we may earn a commission.

Source link



from Tech Empire Solutions https://techempiresolutions.com/att-resets-millions-of-customers-passwords-after-account-information-leaked-on-dark-web/
via https://techempiresolutions.com/

Hackers target macOS users by spreading malvertising that steals malware

ReportMarch 30, 2024Editorial DepartmentMalware/Cryptocurrency

macOS malware

Malvertising and fake websites served as conduits for the spread of two different types of stealing malware, including Atomic Stealer, which targeted Apple macOS users.

Persistent information stealer attacks targeting macOS users may employ different methods to compromise victims’ Macs, but the ultimate goal is to steal sensitive data, Jamf Threat Lab said in a report released on Friday.

The target of this type of attack chain is users searching for Arc Browser on search engines such as Google to provide false advertisements and redirect users to similar websites (“airci[.]net”) to serve malware.

“Interestingly, the malicious website cannot be accessed directly as it returns an error,” said security researchers Jaron Bradley, Ferdous Saljooki and Maggie Zirnhelt. “It is only accessible through a generated sponsored link, presumably to evade detection.”

Disk image files downloaded from a fake website (“ArcSetup.dmg”) provide Atomic Stealer, which uses false prompts to ask users to enter their system password, ultimately facilitating information theft.

Internet security

Jamf said it also discovered a fake website called meethub[.]gg claims to offer free group meeting scheduling software, but actually installs another type of stealing malware that can collect users’ keychain data, credentials stored in web browsers, and information from cryptocurrency wallets .

Much like the Atomic stealer, this malware (which is said to overlap with the Rust-based stealer family called Realst) also uses AppleScript calls to prompt users for their macOS login password in order to perform its malicious actions.

Attacks allegedly exploited the malware to discuss job opportunities and interview them podcastthen ask them to download the app from meethub[.]gg Join the video meeting provided in the meeting invitation.

“These attacks are often focused on the cryptocurrency industry, as such attacks can result in large losses to the attackers,” the researchers said. “Industry insiders should be highly aware that it is often easy to find public information that they are asset holders. , or be easily associated with companies that place them in the industry.”

Moonlock Lab, the cybersecurity arm of MacPaw, revealed that a malicious DMG file (“App_v1.0.4.dmg”) is being used by threat actors to deploy stealth malware designed to extract credentials and data from various applications.

This is accomplished via obfuscated AppleScript and bash payloads retrieved from Russian IP addresses, with the former used to launch deceptive prompts (as described above) to trick users into providing their system passwords.

Internet security

“It disguises itself as a harmless DMG file and uses a phishing image to trick users into installing it, thereby convincing users to bypass macOS’s Gatekeeper security feature,” said security researcher Mykhailo Hrebeniuk.

This development demonstrates that macOS environments are increasingly at risk from stealer attacks, with some strains even possessing sophisticated anti-virtualization techniques by activating a self-destructing kill switch to evade detection.

In recent weeks, malvertising campaigns have also been observed using Go-based loaders to push the FakeBat loader (also known as EugenLoader) and other information-stealing programs (such as Rhadamanthys) through decoy websites for popular software such as Notion and PuTTY.

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/hackers-target-macos-users-by-spreading-malvertising-that-steals-malware/
via https://techempiresolutions.com/

X is funding lawsuit against Jack Dorsey’s Block to support ‘free speech rights’

X is funding litigation Chloe Happe filed a lawsuit against her former employer, Block, which was founded by Jack Dorsey, the founder of Twitter. Happe said in the lawsuit that Bullock wrongfully fired her in retaliation for two posts she made on her own time on what she called an “anonymous satirical account.” A post published after Hamas attacked Israel on October 7 referred to refugees who fled Gaza and came to the Kurdistan region. In another post, she used ableist language and trans slurs while mentioning the use of “gender-neutral bathrooms in offices.”

Happe repeatedly stressed that she “expressed her political views, opinions or beliefs in a satirical form.” She said Bullock was not mentioned in any of her posts on the anonymous account and she did not make them during work hours. Happe also said she “voluntarily deleted” the post about refugees within days of posting it. After seeing that X had limited its visibility, she deleted the defamatory post the same day it was posted.

But Bullock was still given copies of the posts and would not tell her whether other employees had complained about them, she argued in the lawsuit, acknowledging that she initially denied posting the posts because she feared she would get in trouble. She accused Bullock of firing her without severance simply because she expressed views the company disagreed with. Happe argued that Bullock’s policy clearly allowed employees to post comments like hers, so the company violated its own rules. Block (financial services company) and Twitter founder Jack Dorsey publicly supported Elon Musk before he took over ownership of the social media platform. However, he changed his tune last year and criticized Musk, saying “everything went bad” after he took over and that he “should give up” on the acquisition.

In his name, Musk Forward X announced its support for Happe’s lawsuit with the caption: “Supporting your right to free speech.” The company had previously Funding other litigation In the name of “free speech”. One such case is a lawsuit filed by Gina Carano against Lucasfilm and Disney, who she accuses of removing her from the company. The Mandalorian Expressed views that “did not fit into the accepted narrative of the time.” Carano specifically questioned the effectiveness of COVID-19 vaccines and added “boop/bop/beep” as her pronouns. She also shared a post on Instagram comparing the treatment of American conservatives to the treatment of Jews in Nazi-era Germany.

Happe is asking for a court order to reinstate her status as a Bullock employee. She also seeks compensatory and punitive damages, including lost wages since her dismissal.

This article contains affiliate links; if you click on such links and make a purchase, we may earn a commission.



Source link



from Tech Empire Solutions https://techempiresolutions.com/x-is-funding-lawsuit-against-jack-dorseys-block-to-support-free-speech-rights/
via https://techempiresolutions.com/

Secret backdoor discovered in XZ Utils library, affecting major Linux distributions

ReportMarch 30, 2024Editorial DepartmentLinux/supply chain attacks

Linux backdoor

RedHat issued an “urgent security alert” on Friday, warning that two versions of the popular data compression library XZ Utils (formerly LZMA Utils) have been backdoored with malicious code designed to allow unauthorized remote storage. Pick.

Software supply chain compromise, traced as CVE-2024-3094, a CVSS score of 10.0, indicating the highest severity. It affects XZ Utils versions 5.6.0 (released on February 24) and 5.6.1 (released on March 9).

“Through a complex series of obfuscations, the liblzma build process extracts pre-built target files from disguised test files present in the source code and then uses them to modify the liblzma code,” the IBM subsidiary said in an announcement. specific functions.”

Internet security

“This results in a modified liblzma library that can be used by any software linked with the library to intercept and modify data interactions with the library.”

Specifically, the code contained malicious code designed to interfere with the sshd daemon for SSH (Secure Shell) via the systemd software suite, and could potentially enable threat actors to subvert sshd authentication and obtain remote access “under the following circumstances” Unauthorized access to the system: Correct situation. “

Microsoft security researcher Andres Freund is believed to have discovered and reported the issue on Friday. The heavily obfuscated malicious code is said to have been introduced by a user named JiaT75 through a series of four commits to the Tukaani project on GitHub.

Linux distribution

“Given that the campaign lasted for several weeks, the committers were either directly involved or had some pretty serious damage to their systems,” Freund said. “It’s unfortunate, considering they were on various lists of ‘fixes’ ‘ communicated and the latter seems unlikely to be the explanation.”

Microsoft-owned GitHub has since disabled the XZ Utils repository maintained by the Tukaani project “due to violation of GitHub’s terms of service.” There have been no reports of active use in the wild.

Evidence suggests that these packages only exist in Fedora 41 and Fedora Rawhide and do not affect Red Hat Enterprise Linux (RHEL), Debian Stable, Amazon Linux, and SUSE Linux Enterprise and Leap.

Internet security

Out of an abundance of caution, Fedora Linux 40 users are advised to downgrade to version 5.4. Some other Linux distributions affected by supply chain attacks are as follows:

This development prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue its own alert urging users to downgrade XZ Utils to an unaffected version (e.g., XZ Utils 5.4.6 Stable).

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/secret-backdoor-discovered-in-xz-utils-library-affecting-major-linux-distributions/
via https://techempiresolutions.com/

Friday, March 29, 2024

New Linux vulnerability could lead to user password leaks and clipboard hijacking

ReportMarch 29, 2024Editorial DepartmentVulnerabilities/Linux

Linux hacker

Details have emerged about a vulnerability affecting the “wall” command of the util-linux package, which could be exploited by bad actors to reveal user passwords or alter the clipboard on some Linux distributions.

This vulnerability is numbered CVE-2024-28085 and codenamed escape wall Presented by security researcher Skyler Ferrante. It is described as a situation where escape sequences are not properly neutralized.

“The util-linux wall command does not filter escape sequences from command-line arguments,” Ferrante said. “If mesg is set to “y” and wall is set to setgid, then an unprivileged user is allowed to place arbitrary text on other users’ terminals.”

The vulnerability was introduced as part of an August 2013 commit.

Internet security

The “wall” command is used to write a message to the terminals of all users currently logged into the server, essentially allowing users with elevated privileges to broadcast critical information (for example, a system shutdown) to all local users.

“wall displays messages, file contents, or standard input on all terminals of the currently logged-in user,” the man page for the Linux command reads. “Only superuser can reject messages on the terminals of users who have chosen to reject messages or who are using a program that automatically rejects messages. Write to the terminal.”

CVE-2024-28085 essentially exploits improperly sanitized escape sequences provided via command line arguments to trick users into creating fake SUDO prompts on other users’ terminals and tricking them into entering their passwords.

However, to implement this functionality, the mesg utility (which controls the ability to display messages from other users) must be set to “y” (ie enabled), and the wall command executed with setgid permissions.

CVE-2024-28085 affects Ubuntu 22.04 and Debian Bookworm because both conditions are met. CentOS, on the other hand, is not vulnerable because the wall command does not have setgid.

“On Ubuntu 22.04, we have enough control to default to leaking user passwords,” Ferrante said. “The only indication of an attack on the user is that when the user enters the password correctly, an incorrect password prompt appears and the password is in the command history.”

Likewise, on systems that allow wall messaging, an attacker could alter a user’s clipboard via escape sequences on selected terminals, such as Windows Terminal. It does not work with GNOME Terminal.

Users are recommended to update to util-linux version 2.40 to mitigate this flaw.

Internet security

“[CVE-2024-28085] According to the release notes, if mesg is set to y and *wall is set to setgid*, then unprivileged users are allowed to place arbitrary text on other users’ terminals. “Not all distributions will be affected (for example, CentOS, RHEL, Fedora will not; Ubuntu Debian wall’s setgid and mesg default to y).

The revelation comes as security researcher notselwyn details a use-after-free vulnerability in the netfilter subsystem in the Linux core that can be exploited to achieve local privilege escalation.

Assigned CVE identifier CVE-2024-1086 (CVSS score: 7.8), the root issue stems from a failure in input sanitization of netfilter decisions, which could allow a local attacker to cause a denial of service (DoS) condition or possibly execute arbitrary code. The issue was resolved in a commit pushed on January 24, 2024.

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/new-linux-vulnerability-could-lead-to-user-password-leaks-and-clipboard-hijacking/
via https://techempiresolutions.com/

Activision Blizzard is reportedly investigating malware that stole user credentials

Activision Blizzard is reportedly investigating a hacking campaign that is stealing the login credentials of its gamers.according to TechCrunch, bad actors have successfully installed malware onto victims’ computers and used their access rights to steal their gaming accounts and even crypto wallet logins. The video game publisher has apparently been helping victims remove the malware and regain control of their accounts, but there is currently not enough information to explain how the malware spreads.

TechCrunch The source said the malware “may only affect people who have third-party tools installed,” suggesting that people are getting it from non-Activision-developed software that is typically used with its games. Activision spokesperson Delaney Simmons told the publication that the company is aware of “rumors that some player credentials across the industry may have been compromised by malware due to the downloading or use of unauthorized software.” ”. He added that the company’s servers “remain secure and unaffected.”

This is certainly a reasonable theory, as the hacking scheme appears to have been discovered by a man named Zeebler, who worked for call of Duty.Zebler told TechCrunch He discovered the activity when one of his clients’ software account was compromised. After investigating, he reportedly discovered a database containing stolen credentials. He also said that the malware disguised itself as genuine software, but was actually designed to steal usernames and passwords entered by victims. Zeebler may be talking about third-party tools, such as cloning cheat software to obtain people’s login information, but phishing schemes using official Activision login designs also exist. Most importantly, people should be careful about what they download and always double-check that the login page they enter is authentic.

Source link



from Tech Empire Solutions https://techempiresolutions.com/activision-blizzard-is-reportedly-investigating-malware-that-stole-user-credentials/
via https://techempiresolutions.com/

Malware package uploads targeting developers surge, PyPI stops registration

ReportMarch 29, 2024Editorial DepartmentSupply Chain Attack/Threat Intelligence

Malicious packets

The maintainers of the Python Package Index (PyPI) repository have temporarily suspended new user registrations after a large number of malicious projects were uploaded in a malicious cybersquatting campaign.

It said “new project creation and new user registration” were temporarily suspended to mitigate what it called “malware upload activity.” The incident was resolved 10 hours later, at 12:56 pm (UTC) on March 28, 2024.

Software supply chain security company Checkmarx said the unknown threat actor who flooded the repository targeted misspelled versions of popular software packages.

Researchers Yehuda Gelb, Jossef Harush Kadouri and Tzachi Zornstain said: “This is a multi-stage attack with a malicious payload designed to steal crypto wallets, sensitive data in the browser (cookies, extensions, etc.) and various credentials.” “In addition , the malicious payload employs a persistence mechanism to survive reboots.”

These findings were also independently confirmed by Mend.io, which noted that it detected more than 100 malware packages targeting machine learning (ML) libraries such as Pytorch, Matplotlib, and Selenium.

Internet security

The development comes at a time when open source repositories are increasingly becoming an attack vector for threat actors to penetrate enterprise environments.

Phishing is a well-documented attack technique in which attackers upload packages with names that closely resemble their legitimate counterparts (for example, Matplotlib vs. Matplotlib). Food plot Or tensorflow comparison tensorflow) to trick unsuspecting users into downloading them.

The deceptive variants, totaling more than 500 packages per checkpoint, were found to have been uploaded from a unique account starting on March 26, 2024, suggesting that the entire process was automated.

“The fragmented nature of the uploads, with each package attributed to a different user, further complicates the effort to cross-identify these malicious entries,” the Israeli cybersecurity company said.

Malicious packets

Cybersecurity firm Phylum, which has been tracking the same campaign, said the attackers posted –

  • 67 requirements changes
  • 38 variations of Matplotlib
  • 36 request variations
  • 35 color variations
  • 29 variations of tensorflow
  • 28 Variations of Selenium
  • 26 variations of BeautifulSoup
  • 26 variants of PyTorch
  • 20 different pillows
  • 15 variations of asyncio

For their part, these packages check whether the installer’s operating system is Windows and, if so, proceed to download and execute an obfuscated payload retrieved from an actor-controlled domain (“funcaptcha”)[.]Ru”).

Internet security

The malware acted as a stealer, stealing files, Discord tokens, and data from web browsers and cryptocurrency wallets to the same server. It also attempts to download a Python script (“hvnc.py”) to the Windows startup folder for persistence.

This development once again illustrates the escalating risks posed by software supply chain attacks, so developers must carefully review every third-party component to ensure it protects against potential threats.

This isn’t the first time PyPI has taken this step. In May 2023, it temporarily banned user registrations after discovering that “the number of malicious users and malicious projects created on the index over the past week exceeded our ability to respond in a timely manner.”

For similar reasons, PyPI suspended new user registrations for the second time on December 27 last year. Subsequently canceled on January 2, 2024.

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/malware-package-uploads-targeting-developers-surge-pypi-stops-registration/
via https://techempiresolutions.com/

Empowering Small Business 401(k) Plan Solutions

The Colorado-based company announced this week that it plans to launch a new digital solution to make it easier for small employers to plan for workplace retirement.

Image: Shutterstock.comThe new end-to-end 401(k) product, launching in mid-2024, will provide advisors and third-party administrators (TPAs) with a simplified way to set up retirement plans. The new program, called Ready Select, is designed for small start-ups with assets of up to $1 million.

According to the announcement, the new app will help reduce implementation time, as well as the financial and administrative costs of sponsoring a 401(k) plan, so that “advisors can help business owners spend less time managing their workplace benefits.” The The system also includes comprehensive investment advisory services provided through a third-party ERISA fiduciary.

After working with an advisor or TPA to generate on-demand proposals and complete plan setup, small business owners and employees can access digital solutions and the financial wellness and education programs offered by Empower.

The company explains that over the past few years, complexity and administrative burden have created barriers for small employers and startups to develop workplace retirement plans. Additionally, management teams are often busy growing the business, so taking on the additional work of providing retirement benefits can be daunting.

Citing data from the Small Business Administration, Empower noted that there are an estimated 33.2 million small businesses in the United States, with approximately 62 million people working for these employers. These employers represent many private sector workers who are not currently covered by workplace retirement plans.

“It’s time to close the access gap and we’re aggressively addressing it,” said Edmund F. Murphy III, President and CEO of Empower. “We have the technology, expertise and support of our consultants and TPA partners to Solve this problem for the millions of Americans who need a retirement plan.”

Murphy also praised the public-private partnership inherent in the national workplace savings system, which has played a key role in helping to close the savings gap.

As NAPA Net readers know, Congress passed the SECURE Act in 2019 and the SECURE 2.0 Act in late 2022, making retirement plans more accessible to more workers. To that end, Empower noted that retirement plan coverage for the lowest-income households increased by 25% between 2019 and 2022, more than double the growth rate for any other income group during that period, including after the SECURE Act. Years.

“Advisors and TPAs ​​using Ready Select will be able to help small employers provide the most cost-effective retirement plan options that best meet the needs of their employees,” added Joseph Smolen, executive vice president of core markets at Empower. “These partners know how to help. Empower, Empower stands ready to help them bring their expertise to new programs.”

Empower currently manages approximately $1.5 trillion in assets for more than 18.5 million investors through retirement planning, advice, wealth management and investments.

Source link



from Tech Empire Solutions https://techempiresolutions.com/empowering-small-business-401k-plan-solutions/
via https://techempiresolutions.com/

Thursday, March 28, 2024

White House lays out broad artificial intelligence guidance for federal government

It’s been five months since President Biden signed an executive order (EO) to address the rapid development of artificial intelligence. Today, the White House took another step toward implementing the Executive Order, establishing a policy aimed at regulating the federal government’s use of artificial intelligence. Safeguards that agencies must take include ways to mitigate the risk of algorithmic bias.

“I believe that all leaders from government, civil society and the private sector have a moral, ethical and social responsibility to ensure that the adoption and development of artificial intelligence protects the public from potential harm, while ensuring that everyone can enjoy artificial intelligence. The benefits of it. The benefits of it,” Vice President Kamala Harris told reporters at a news conference.

Harris announced three binding requirements under new Office of Management and Budget (OMB) policy. First, agencies need to ensure that any artificial intelligence tools they use “do not endanger the rights and safety of the American people.” They have until December 1 to ensure that “specific safeguards” are in place to ensure that the artificial intelligence systems they use do not affect the safety or rights of Americans. Otherwise, the agency will have to stop using AI products unless its leaders can demonstrate that scrapping the system would have an “unacceptable” impact on critical operations.

Impact on Americans’ Rights and Security

According to the policy, an AI system is considered to affect safety if it is “used or intended to be used under real-world conditions to control or significantly influence the outcome” of certain activities and decisions. These include maintaining the integrity of elections and voting infrastructure; controlling critical safety functions of infrastructure such as water systems, emergency services, and power grids; self-driving vehicles; and in “workplaces, schools, housing, transportation, medical, or law enforcement settings.” Operate the physical movement of the robot.

Agencies must also abandon AI systems that violate Americans’ rights unless they have appropriate safeguards in place or can otherwise justify their use. The policy presumes that rights-impacting purposes include predictive policing; social media monitoring for law enforcement; detecting plagiarism in schools; blocking or restricting protected speech; detecting or measuring human emotions and thoughts; pre-employment screening; and “reproduction of another person’s likeness or voice without explicit consent.”

When it comes to generating artificial intelligence, the policy states that agencies should evaluate the potential benefits. They also need to “establish adequate safeguards and oversight mechanisms to allow the use of generative AI in the agency without undue risk.”

transparency requirements

The second requirement would force agencies to be transparent about the AI ​​systems they use. “Today, President Biden and I are asking U.S. government agencies to publish online annually an inventory of artificial intelligence systems, an assessment of the risks they may pose, and how to manage those risks,” Harris said.

As part of this effort, agencies will be required to release government-owned AI code, models and data, as long as doing so does not harm the public or government operations.If agencies cannot disclose specific AI use cases due to sensitivity reasons, they still need to report metrics

Vice President Kamala Harris speaks during a campaign event with President Joe Biden on Tuesday, March 26, 2024, in Raleigh, North Carolina. (AP Photo/Stephanie Scarbrough)Vice President Kamala Harris speaks during a campaign event with President Joe Biden on Tuesday, March 26, 2024, in Raleigh, North Carolina. (AP Photo/Stephanie Scarbrough)
Associated Press

Last but not least, federal agencies need internal oversight of their use of artificial intelligence. This includes appointing a chief AI officer in each department to oversee all agency use of AI. “This is about ensuring the responsible use of artificial intelligence and understanding that we in government must have senior leaders specifically responsible for overseeing the adoption and use of artificial intelligence,” Harris noted. Many agencies will also need to establish artificial intelligence governance by May 27 committee.

The vice president added that prominent figures from the public and private sectors, including civil rights leaders and computer scientists, helped shape the policy along with business leaders and legal scholars.

OMB suggested that as a safeguard, the Transportation Security Administration may have to let air travelers opt out of facial recognition scans without losing their spot in line or facing delays. It also recommends human oversight of things like AI fraud detection and diagnostic decisions in the federal health care system.

As you might imagine, government agencies already use artificial intelligence systems in a variety of ways. The National Oceanic and Atmospheric Administration is developing artificial intelligence models to help it more accurately predict extreme weather, floods and wildfires, while the Federal Aviation Administration is using a system to help manage air traffic in major metropolitan areas to shorten Travel time.

OMB Director Shalanda Young told reporters: “Artificial intelligence poses not only risks but also tremendous opportunities to improve public services and make progress in addressing social challenges such as climate change, improving public health and promoting equitable economic opportunity. “When used responsibly and monitored, artificial intelligence can help agencies reduce wait times for critical government services, thereby improving accuracy and expanding access to essential public services.”

The policy is the latest in a series of efforts to regulate the rapidly growing field of artificial intelligence. While the European Union has adopted a comprehensive set of rules for the use of AI in the bloc and a federal bill is in the pipeline, U.S. efforts to regulate AI have taken more of a patchwork approach at the state level. This month, Utah enacted a law to protect consumers from artificial intelligence scams. In Tennessee, the Securing Sound and Image Likeness Act (technically known as the Elvis Act) is an attempt to protect musicians from deepfakes, which are clones of their voices without permission.

Source link



from Tech Empire Solutions https://techempiresolutions.com/white-house-lays-out-broad-artificial-intelligence-guidance-for-federal-government/
via https://techempiresolutions.com/

Telegram offers premium subscription in exchange for the chance to send OTP using your number

ReportMarch 28, 2024Editorial DepartmentTechnology/Data Privacy

telegraph

In June 2017, a study of more than 3,000 Massachusetts Institute of Technology (MIT) students released by the National Bureau of Economic Research (NBER) found that 98% were willing to give up a friend’s email address in exchange for free pizza.

“While people say they care about privacy, they readily give up private data when incentivized,” the study noted, pointing to the so-called privacy paradox.

Now, nearly seven years later, Telegram has launched a new feature that offers some users a free premium membership in exchange for allowing the popular messaging app to use their phone numbers as a relay to send one-time passwords to other users ( OTP). Trying to log in to the platform.

This feature is called Peer-to-Peer Login (P2PL) and is currently being tested for Telegram’s Android users in selected countries. It was first discovered by tginfo in February 2024 (via @AssembleDebug).

According to Telegram’s terms of service, the phone number will be used to send no more than 150 OTP SMS messages per month (including international SMS), and the user’s mobile carrier or service provider will charge a fee.

Internet security

That said, the popular messaging app notes that it “cannot prevent OTP recipients from seeing your phone number after receiving your text message” and that it “cannot prevent OTP recipients from taking unnecessary, unauthorized or illegal actions.” We are not responsible for any inconvenience, harassment or harm caused by the actions of users who know your phone number through P2PL. “

To make matters worse, the mechanism (which relies heavily on the honor system) does not prohibit users from contacting strangers to whom the OTP authentication text message was sent, or vice versa, which could lead to an increase in spam calls and text messages.

Telegram said it reserves the right to unilaterally terminate P2PL program accounts if participants are found to have shared recipients’ personal information. It also warns users not to contact any OTP recipients or reply to them, even if they send them messages.

As of March 2024, Telegram has more than 900 million monthly active users. It launched a premium subscription plan in June 2022 that allows users to unlock additional features such as 4 GB file uploads, faster downloads, and exclusive stickers and reactions.

Since online services still rely on phone numbers to authenticate users, it’s worth keeping in mind the privacy and security risks that may arise from participating in experiments.

Metadata in the legal crosshairs of intercepting Snapchat traffic

At the same time, newly made public court documents in the United States claim that Meta launched a secret project called Ghostbusters, which aims to intercept and decrypt the network traffic of users using Snapchat, YouTube and Amazon to help it understand user behavior and better understand user behavior. compete with competitors.

This is accomplished through a custom application that utilizes a VPN service called Onavo. Facebook acquired the service in 2013 and shut it down in 2019 as it came under scrutiny for using its products to track users’ online activity in relation to competitors and secretly paying teenagers to capture their information. Internet browsing mode.

Internet security

The data-blocking program has been described as a “middle-middle” approach, in which Facebook essentially pays people between the ages of 13 and 35 up to $20 a month, plus referral fees for installing market research apps and giving them boosts. The right to inspect network traffic and analyze its network usage.

The strategy relies on creating “fake digital certificates to impersonate trusted Snapchat, YouTube, and Amazon analytics servers to redirect and decrypt secure traffic from these applications for Facebook’s strategic analysis.”

The apps were distributed through beta testing services such as Applause, BetaBound and uTest to conceal Facebook’s involvement. The program came to be known as the In-App Action Panel (IAAP) and ran from 2016 to 2018.

Meta said in response that there was no criminal or fraudulent conduct and that “Snapchat’s own advertising witnesses confirmed that Snap was unable to identify any of the ad sales.” [it] Meta suffered losses as a result of its use of user research products, and it is not known whether other competitors collected similar information or whether any of Meta’s research provided Meta with a competitive advantage. “

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/telegram-offers-premium-subscription-in-exchange-for-the-chance-to-send-otp-using-your-number/
via https://techempiresolutions.com/

What is micro-business?Build one from scratch

Microbusinesses are a subset of the small business world. They consist of one person or several people playing different roles simultaneously. Their operations are smaller and focus on building strong relationships with a limited customer base. Young or new professionals often start micro-businesses when entering the business world.

If you are one of them, consider setting up a guide for yourself business planning software Get funding from investors and create a roadmap.

Micro-business start-up costs are less than $50,000. It is usually a sole proprietorship, with the owner responsible for running the business. Examples of microbusiness jobs include freelance writers, small e-commerce owners, consultants, and other self-employed workers in any field. They focus on small markets and strong relationships with customers and colleagues.

People start microbusinesses as a side hustle or hobby. They may operate on their own or with the help of a small team. Although microbusinesses are small, they play an important role in the U.S. economy and job market.

Micro business examples

You probably encounter micro-businesses almost every day and don’t realize it. These small operations exist in many forms, such as:

  • Freelance worker services. Some freelancers run their businesses as sole proprietors, which means they and their business are one and the same. This arrangement means that the freelancer has some liability for any debts or obligations of the company. To gain protection, they can form a single-member limited liability company (LLC).
  • Small e-commerce business. The digital store sells handicrafts, clothing and many other one-of-a-kind products. Business owners use e-commerce platforms to easily run their online stores.
  • Small retailers. A small shop, café or restaurant is a micro-enterprise run by a few people.
  • professional service. Professionals such as lawyers, accountants, doctors or dentists engage in private practice in the form of microenterprises. They have clinics and small offices, and now some are running their businesses digitally through virtual offices.

Microenterprises and Small Enterprises

People use “microbusiness” and “small business” interchangeably without realizing that microbusiness is a subset of business. small business.

small companies The number of employees ranges from 100 to 1,500. In contrast, microenterprises have up to 9 employees. This means that all microbusinesses are small businesses, but the converse is not necessarily true.

Micro-enterprises Specialize in a specific area, such as technical writing, marketing consulting, or web design.

However, small businesses typically offer a range of services and products to their target market. When it comes to loans or financing, they are subject to various guidelines related to their size and scope.this U.S. Small Business Administration (SBA) A business is classified as small if its revenue is between $1 million and more than $40 million. Dimensional parameters are set by North American Industry Classification System (NAICS) codes.

Small Entrepreneurs and Entrepreneurs

Micropreneurs and entrepreneurs both have unlimited earning potential and flexible work schedules, but their paths are very different.

entrepreneur While aiming for rapid expansion, microentrepreneur Focus on meeting customer needs while making optimal operational and staffing investments. Microentrepreneurs choose a more closed approach. They often work alone, unlike entrepreneurs who build large teams to scale.

free-lancer content Writing or online store management are two common micro-startups. Entrepreneurs, on the other hand, develop products and services designed to serve a larger market and increase revenue.

Benefits of microenterprises

Starting a microbusiness doesn’t require a lot of cash, making it an excellent option for many aspiring professionals. It also offers flexibility. For example, a small restaurant can add a new drink or menu item faster than a chain restaurant.

Here are some of the notable benefits microbusinesses provide to their owners.

  • Niche product or skill. Microentrepreneurs focus on specific skills that make their product or service unique, such as cupcakes from Mom’s Little Bakery. This uniqueness attracts customers.
  • flexibility. Micro-entrepreneurs can set working hours and decide how much work they want to take on. It has complete control over their behavior.
  • The capital investment is small. Micro businesses have much lower start-up and operating costs and require no operations Payslip For big teams.
  • Adaptability. Microenterprises have rapid decision-making processes that allow them to adapt to reduce risks or seize new opportunities.

Challenges of running a microenterprise

While microenterprises have many benefits, they also come with some challenges. Lenders often view smaller businesses as less stable, and their ability to handle risk or debt is perceived to be far less than it actually is. This makes it difficult for small and micro business owners to obtain loans at reasonable interest rates.

Additionally, because microenterprises operate on a smaller scale, they typically do not invest much in marketing or finding larger markets. This limits their scope and ability to compete with smaller businesses, which invest heavily in marketing and construction. sales funnel.

Finally, microbusiness employees often multitask. This is typically a super lean team and responsibilities can easily overlap. Everyone ends up with a heavy workload that makes managing sales, marketing, finance, and operations overwhelming.

Businesses respond to these challenges in a variety of ways, including some listed here.

  • Find an online lender. Micro businesses may not qualify for small business loans, but many online lenders offer working capital when emergency funding needs arise. This money can help your business get through tough times, but be aware of the higher-than-average interest rates.
  • Stick to a low-cost marketing plan. consider content marketing Reach potential buyers organically. If you are looking for nearby customers, you can do search engine optimization (SEO). Build your brand on social media platforms and attract customers through social networks.
  • Delegate work to software. Look for ways to automate simple, time-consuming tasks.on board Project management software Or a Pomodoro timer to keep everything organized while you’re deep in work.

How to Start a Micro Business: A Step-by-Step Guide

You can build your microbusiness with these basic steps. They are here to help you navigate the challenges you will face along the way.

1. Write a mission and vision statement

Define your core purpose and aspirations through clear mission and vision statements. Articulate your company’s values, commitment to customers, and long-term goals.

This document guides your business and attracts customers and investors who share similar values.

2. Plan your operations

Break down business operations into achievable goals and milestones. Try to anticipate and address potential challenges when planning and forecasting. Consider your location, resources, business structure, and customer needs.

Ensure the business model is sustainable by outlining the cost structure and potential revenue streams.

3. Assess your financial situation

collect or create financial documents Such as a balance sheet, profit and loss statement, and cash flow statement to give you a clear picture of your expected performance. To obtain funding, develop a well-researched plan that explains your viability and profitability.

4. Develop a marketing plan

A strong marketing plan is crucial, especially for micro businesses with limited resources. Understand your target market and how to best serve them.Use this research to inform your strategy and execute online marketing campaigns by social mediaemail, content, and search engine optimization.

5. Research and test your product

Test your product or service with potential customers before launching it. To collect feedback, build a pre-launch website, use surveys, or try direct outreach.

This feedback can help you improve your products and services and provide ways to improve the customer experience. Be prepared for rejection. They are opportunities to learn and iterate on your product.

Start small, but start right

Starting a microbusiness is a journey of learning, growth and opportunity. Understand your capabilities and take on projects and work that you can deliver. Otherwise, you may become overworked when you lack resources or help. With a clear mission and vision, you can make your tiny entrepreneurial dreams a reality.

Learn more about Ansoff matrix Carefully plan your growth and the risks along the way.



Source link



from Tech Empire Solutions https://techempiresolutions.com/what-is-micro-businessbuild-one-from-scratch/
via https://techempiresolutions.com/

Oregon’s right-to-repair bill now becomes law

Oregon Gov. Tina Kotke has signed her state’s right-to-repair bill into law, and it even comes with a provision that could make it stronger than versions in California and Minnesota. It is the first to ban (PDF) a practice called “parts matching,” which requires the use of certain proprietary components for repairs. Part matching prevents third-party repair services from replacing damaged components with components that are not native to the brand because it won’t work with the company’s software. If people try to install unauthorized parts, they often receive an error message forcing them to purchase from the company itself.

Under the new regulations, independent suppliers are prohibited from installing off-brand parts. Devices repaired with unauthorized components may also experience reduced performance. Even those error messages and warnings are not allowed. However, the parts matching ban does not cover devices that are already obsolete and only applies to any device manufactured after January 1, 2025.

While manufacturers like Apple appear to have changed their tune in recent years and now generally support the right-to-repair movement, Oregon’s parts-matching regulations remain a point of contention. Apple senior manager John Perry told lawmakers in a deposition that his company “agrees with the vast majority of Senate Bill 1596.” However, it is also concerned about the security implications of allowing replacements with unauthorized parts, such as biometric sensors.

Regardless, the ban on parts matching is now a requirement of Oregon law, along with the provision of compatible parts to device owners through companies or authorized service providers at reduced prices and without any “substantial” conditions. Companies must also provide documentation for repair shops to use on how to repair their equipment and any special tools needed to repair the equipment. These rules will apply to all mobile phones sold after July 1, 2021, and other consumer electronic devices sold after July 1, 2015.

Source link



from Tech Empire Solutions https://techempiresolutions.com/oregons-right-to-repair-bill-now-becomes-law/
via https://techempiresolutions.com/

Wednesday, March 27, 2024

Elon Musk says Grok chatbot will soon be live for X Premium users

xAI’s Grok chatbot, the Elon Musk-led company’s answer to OpenAI’s ChatGPT, will be usable It will be available to Premium subscribers of X later this week. Musk announced Grok’s expanded availability in a tweet, accompanied by an instructional video on how to post conversations with the chatbot directly on the X website. Since exiting early beta, Grok has been available to X’s Premium+ subscribers, but a paid plan on the social network costs $16 per month, or $168 for the full year when billed annually. The launch makes Grok even easier to use, since the Premium tier costs half as much, at $8 per month or $84 per year.

Musk’s xAI open sourced its Grok-1 model, which powers its chatbot, in mid-March. Just weeks ago, the executive sued OpenAI and Sam Altman, accusing them of chasing profits and abandoning their non-profit mission. Musk was one of OpenAI’s earliest supporters and funded its operations when it first started. He claimed in the lawsuit that OpenAI is developing generative artificial intelligence “to maximize Microsoft’s profits, not for the benefit of humanity.” He said it was a “blatant betrayal of the founding agreement.”

But in rebutting his claims, OpenAI said it had “no founding agreement and no agreement with Musk” to open source its technology. The company said Musk not only knew the company would transform into a for-profit entity, but was involved in its planning, initially wanting to gain a majority stake, control of the initial board of directors and the CEO position.



Source link



from Tech Empire Solutions https://techempiresolutions.com/elon-musk-says-grok-chatbot-will-soon-be-live-for-x-premium-users/
via https://techempiresolutions.com/

New phishing attack delivers keylogger disguised as bank payment notification

ReportMarch 27, 2024Editorial DepartmentVulnerability/Cybercrime

A new phishing campaign has been observed using a new loader malware to deliver an information stealer and keylogger called Agent Tesla.

Trustwave SpiderLabs said it discovered a phishing email with this attack chain on March 8, 2024. The email is disguised as a bank payment notification and urges users to open archived file attachments.

The file (“Bank Handlowy w Warszawie – dowód wpłaty_pdf.tar.gz”) hides a malicious loader that launches a program that deploys Agent Tesla on the compromised host.

“The loader then uses obfuscation to evade detection and leverages complex decryption methods to exploit polymorphic behavior,” security researcher Bernard Bautista said in Tuesday’s analysis.

“The loader also demonstrated the ability to bypass antivirus defenses and retrieve its payload using a specific URL and user agent, leveraging proxies to further obfuscate traffic.”

The tactic of embedding malware in seemingly benign files is a tactic used repeatedly by threat actors to trick unsuspecting victims into triggering an infection sequence.

Internet security

The loader used in the attack is written in .NET, and Trustwave discovered two different variants, each using a different decryption routine to access its configuration and ultimately retrieve the XOR-encoded Agent Tesla payload.

To evade detection, the loader is also designed to bypass the Windows Anti-Malware Scanning Interface (AMSI), which enables security software to scan files, memory and other data for threats.

Bautista explains that it achieves this by “patching the AmsiScanBuffer function to evade malware scanning of memory contents.”

The final stage involved decoding and executing Agent Tesla in memory, allowing the threat actor to covertly steal sensitive data via SMTP using a compromised email account (“merve@temikan”) associated with a legitimate Turkish security system vendor.[.]com[.]tr”).

Trustwave says this approach not only raises no red flags, but also provides a layer of anonymity that makes tracking attacks more difficult to trace back to an adversary, not to mention saving the effort of building a dedicated exfiltration channel.

“[The loader] “It uses methods such as patching to bypass Anti-Malware Scanning Interface (AMSI) detection and dynamically load the payload, ensuring stealth execution and minimizing traces on the disk,” Bautista said. “This loader marks a specific Significant evolution of SLA agent deployment tactics.”

This disclosure comes as BlueVoyant uncovers another phishing campaign conducted by a cybercriminal group known as TA544, which uses PDFs disguised as legitimate invoices to deliver WikiLoader (aka WailingCrab) and is associated with an almost entirely Hacked WordPress command and control (C2) servers create links to websites.

It is worth noting that TA544 also weaponized In November 2023, a Windows security bypass vulnerability tracked as CVE-2023-36025 distributed Remcos RAT through a different family of loaders called IDAT Loader, allowing it to seize control of infected systems.

The findings also showed a surge in the use of a phishing kit called Tycoon, which Sekoia said “has become one of the most widely used phishing kits.” [adversary-in-the-middle] Over the past few months, we have identified more than 1,100 domains detected between late October 2023 and late February 2024. “

Internet security

Tycoon, which Trustwave publicly documented last month, allows cybercriminals to target Microsoft 365 users via fake login pages to capture their credentials, session cookies, and two-factor authentication (2FA) codes. It is understood that the service has been active since at least August 2023 and is provided through a private Telegram channel.

The phishing kit, known for employing extensive traffic filtering methods to thwart bot activity and analysis attempts, requires website visitors to complete a Cloudflare Turnstile challenge before redirecting users to a credential collection page.

Tycoon also shares operational and design similarities with the Dadsec OTT phishing kit, which increases the likelihood that developers can access and adapt the latter’s source code to suit their needs. The fact that the Dadsec OTT source code was leaked in October 2023 proves this.

“Developers have enhanced the stealth capabilities of the latest version of the phishing kit,” Sekoia said. “Recent updates may reduce security product detection rates of Tycoon 2FA phishing pages and infrastructure. Additionally, its ease of use and relatively low price make it very popular among threat actors.”

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/new-phishing-attack-delivers-keylogger-disguised-as-bank-payment-notification/
via https://techempiresolutions.com/

Trezor’s Twitter account hijacked by cryptocurrency scammers via fake Calendly invitation

This is not what you expect to see on the official Twitter account of Trezor, a well-known cryptocurrency wallet manufacturer.

This is a rather blatant attempt to trick unwary cryptocurrency fans into transferring digital currency to a scammer’s wallet.

Whoever hacked Trezor’s Twitter account wasn’t limited to posting hoaxes. They also posted a very offensive message on Twitter.

Trezor quickly deleted the unauthorized tweet and posted a warn Its 205,000 followers.

In a subsequent blog post, Trezor explained how its Twitter account was compromised – despite the company taking reasonable security precautions, such as strong passwords and multi-factor authentication.

According to Trezor, someone pretending to be a “trusted entity in the cryptocurrency space” contacted its PR team on February 29, 2024, using a Twitter account with thousands of followers. The imposter requested an interview with Trezor CEO Matej Zak.

After several days of “credible back-and-forth communication,” the attacker shared what appeared to be a Calendly invitation link.

The scam link purported to be a way to schedule a meeting through Calendly, but ultimately led Trezor’s PR staff to Twitter, which asked them to enter their login credentials.

Trezor’s team realized something was wrong and stopped the behavior without compromising their Twitter account.

The attacker then successfully tried again to break into Trezor’s Twitter account.

Pretending a “technical issue” and wanting to reschedule the meeting, someone at Trezor social engineered an authorization request for a fake Calendly app to connect to the official Trezor Twitter account.

Attackers can now use a fake Calendly application to post fraudulent tweets through Trezor’s Twitter account.

Trezor emphasized to customers that only its Twitter account was affected by the security incident:

We would like to emphasize that the safety of all our products is not compromised. This incident in no way affects or compromises the security of the Trezor Hardware Wallet or any of our other products. Your Trezor device and Trezor Suite are still safe to use.

Still, the fact that the company’s Twitter account was exploited by cryptocurrency scammers and posted racist slurs doesn’t bode well.

Be careful when third-party applications ask for access to social media accounts. I have personal experience of my Twitter account being exploited by hackers through rogue third-party services.

Trezor said it revokes all active sessions (kicks out anyone with access to a Twitter account) as well as removes unauthorized posts, and blocks further access by revoking third-party applications.

This isn’t the first time a phishing scam has emerged, tricking companies into clicking on fake Calendly links.

For example, January edge Reports claim that a scammer posed as a journalist and pretended to use Calendly to arrange interviews with targets – all in an effort to drain cryptocurrency wallets.

That same month, a scammer impersonated another journalist and successfully tricked blockchain security agency CertiK into believing they were scheduling meetings through Calendly. The scammers subsequently took control of the company’s Twitter account and posted malicious links.

Sadly, this isn’t Trezor’s first run-in with cybercriminals.

In April 2022, Trezor users received a telling warning that the company had suffered a security breach and that their cryptocurrency wallets could be compromised.

It later emerged that cybercriminals had hijacked control of a newsletter run by Trezor’s MailChimp to issue the warning. The warning attempts to trick users into downloading a malicious, counterfeit version of Trezor Suite.



Source link



from Tech Empire Solutions https://techempiresolutions.com/trezors-twitter-account-hijacked-by-cryptocurrency-scammers-via-fake-calendly-invitation/
via https://techempiresolutions.com/

Two Chinese APT groups step up cyber espionage activities against ASEAN countries

Chinese APT group

Two China-linked advanced persistent threat (APT) groups have been observed targeting Association of Southeast Asian Nations (ASEAN) affiliated entities and member states in cyber espionage campaigns over the past three months.

These include a threat actor called Mustang Panda, which has recently been linked to cyberattacks targeting Myanmar and other Asian countries that used a variant of the PlugX (also known as Korplug) backdoor called DOPLUGS.

Mustang Panda (also known as Camaro Dragon, Earth Preta, and Stately Taurus) is believed to have targeted entities in Myanmar, the Philippines, Japan, and Singapore, sending phishing emails designed to deliver two malware packages.

Palo Alto Networks Unit 42 said in a report shared with The Hacker News: “Threat actors targeted the ASEAN-Australia Special Summit on March 4-5, 2024 (March 4-6, 2024). Malware was created for these packages.”

One of the malware packages is a ZIP file that contains an executable file (“Talking_Points_for_China.exe”), which upon startup loads a DLL file (“KeyScramblerIE.dll”) and ultimately deploys a program called PUBLOAD The known Mustang Panda malware is a type of malware called PUBLOAD. Downloader previously used to remove PlugX.

It’s worth pointing out here that the binary is a renamed copy of a legitimate piece of software called KeyScrambler.exe, which is susceptible to DLL sideloading.

The second software package, on the other hand, is a screensaver executable (“Note PSO.scr”) that retrieves next-stage malicious code from a remote IP address, including one signed by a video game company The benign program was renamed WindowsUpdate. exe and a malicious DLL launched using the same technique as before.

Internet security

“The malware then attempts to establish a connection to www[.]Open server name[.]com 146.70.149[.]36 for command and control (C2),” the researchers said.

Unit 42 said it also detected network traffic between ASEAN-affiliated entities and the C2 infrastructure of a second Chinese APT group, indicating a compromise of the victim’s environment. This unnamed threat activity group has been attributed to similar attacks targeting Cambodia.

“These types of activities continue to demonstrate how organizations are being targeted for cyber espionage purposes, with nation-state affiliated threat groups gathering intelligence on geopolitical interests within the region,” the researchers said.

Earth Krahang appears in the wild

A week ago, Trend Micro revealed a new Chinese threat actor called Earth Krahang that exploits spear phishing and flaws in public-facing Openfire and Oracle servers to deliver custom malware such as PlugX. Targeted 116 entities in 35 countries, ShadowPad, ReShell and DinodasRAT (also known as XDealer).

The earliest attacks date back to early 2022, with attackers using a combination of methods to scan for sensitive data.

cyber espionage

Earth Krahang is focused on Southeast Asia and also has some overlap with another tracked China-linked threat group, Earth Lusca (aka RedHotel). Both intrusions are likely managed by the same threat actor and associated with a Chinese government contractor called I-Soon.

“One of the favorite tactics of threat actors is to use their malicious access to government infrastructure to attack other government entities, abuse the infrastructure to host malicious payloads, proxy attack traffic, and use compromised government email accounts to Relevant targets are sent spear phishing emails,” the company said.

“Earth Krahang also uses other tactics, such as setting up a VPN server on a compromised public-facing server to establish access to the victim’s private network and performing a brute force attack to obtain email credentials. These credentials are then used to Exfiltrate victim’s emails.”

I-Soon leaks and shady hacker-for-hire scene

Last month, a set of documents leaked on GitHub by I-Soon (aka Anxun) revealed how the company sold various stealth programs and remote access programs such as ShadowPad and Winnti (aka TreadStone) to multiple Chinese government entities Trojan horse. This also includes an integrated operating platform designed to conduct offensive network activities and an undocumented Linux implant code-named Hector.

“The integrated operations platform covers internal and external applications and networks,” Bishop Fox said. “Internal applications are primarily used for task and resource management. External applications are designed to perform network operations.”

This unknown hacker-for-hire entity was also involved in the 2019 POISON CARP campaign targeting Tibetan groups and the 2022 Comm100 hack, in addition to targeting foreign governments and domestic ethnic minorities to obtain valuable information, some of which Information is provided via the Internet. They grew independently, hoping to gain government clients.

“This data breach provides us with rare insights into how the Chinese government outsources parts of its network operations to private third-party companies, and how these companies work with each other to meet these needs,” ReliaQuest noted.

Internet security

Cybersecurity firm Recorded Future said in its own analysis that the leak revealed “operations between the company and three different Chinese state-backed cyber groups: RedAlpha (also known as Deepcliff), RedHotel and POISON CARP” and organizational relationships.”

“It provides supporting evidence regarding the existence of long-suspected ‘digital quartermasters’ that provide capabilities to multiple Chinese government-backed groups.”

It also said that overlap indicates the presence of multiple sub-teams within the same company that focus on specific tasks. I-Soon’s victims are spread across at least 22 countries, with government, telecommunications and education being the most targeted sectors.

Additionally, publicly available documents confirm that the Tianfu Cup—China’s own Pwn2Own hacking competition—serves as the government’s “vulnerability supply system,” allowing it to store zero-day vulnerabilities and engineer exploitable code.

“While Tianfu Cup submissions have not yet fully exploited the chain, the Department of Public Safety will distribute proof-of-concept vulnerabilities to private companies to further exploit these proof-of-concept capabilities,” Margin Research said.

“China’s vulnerability disclosure requirements are part of the puzzle of how China stores and weaponizes vulnerabilities, which laid the foundation for the secret collection provided by the Tianfu Cup in previous years.”

The source of the leak is unclear at this time, but two I-Soon employees told The Associated Press that it is cooperating with law enforcement in the investigation. The company’s website is now offline.

SentinelOne’s Dakota Cary and Aleksandar Milenkoski said: “This leak provides some of the most concrete details yet made public about the nature of China’s cyber espionage ecosystem. mature nature.” “It clearly demonstrates how the government’s goal requirements are driving competition in the independent contractor hacker employment market.”

Did you find this article interesting?follow us Twitter and LinkedIn to read more exclusive content from us.



Source link



from Tech Empire Solutions https://techempiresolutions.com/two-chinese-apt-groups-step-up-cyber-espionage-activities-against-asean-countries/
via https://techempiresolutions.com/

Pokémon Trading Card Website Making 100k!

This Website Gets Over 150,000 Organic Views A Month!   Are you a Pokémon fan? There has been this new Pokémon game on ...