Microsoft's CEO Satya Nadella has hailed the company's new Recall feature, which stores a history of your computer desktop and makes it available to AI for analysis, as “photographic memory” for your PC. Within the cybersecurity community, meanwhile, the notion of a tool that silently takes a screenshot of your desktop every five seconds has been hailed as a hacker's dream come true and the worst product idea in recent memory.

Now, security researchers have pointed out that even the one remaining security safeguard meant to protect that feature from exploitation can be trivially defeated.

Since Recall was first announced last month, the cybersecurity world has pointed out that if a hacker can install malicious software to gain a foothold on a target machine with the feature enabled, they can quickly gain access to the user's entire history stored by the function. The only barrier, it seemed, to that high-resolution view of a victim's entire life at the keyboard was that accessing Recall's data required administrator privileges on a user's machine. That meant malware without that higher-level privilege would trigger a permission pop-up, allowing users to prevent access, and that malware would also likely be blocked by default from accessing the data on most corporate machines.

Then on Wednesday, James Forshaw, a researcher with Google's Project Zero vulnerability research team, published an update to a blog post pointing out that he had found methods for accessing Recall data without administrator privileges—essentially stripping away even that last fig leaf of protection. “No admin required ;-)” the post concluded.

“Damn,” Forshaw added on Mastodon. “I really thought the Recall database security would at least be, you know, secure.”

Forshaw's blog post described two different techniques to bypass the administrator privilege requirement, both of which exploit ways of defeating a basic security function in Windows known as access control lists that determine which elements on a computer require which privileges to read and alter. One of Forshaw's methods exploits an exception to those control lists, temporarily impersonating a program on Windows machines called AIXHost.exe that can access even restricted databases. Another is even simpler: Forshaw points out that because the Recall data stored on a machine is considered to belong to the user, a hacker with the same privileges as the user could simply rewrite the access control lists on a target machine to grant themselves access to the full database.

That second, simpler bypass technique “is just mindblowing, to be honest,” says Alex Hagenah, a cybersecurity strategist and ethical hacker. Hagenah recently built a proof-of-concept hacker tool called TotalRecall designed to show that someone who gained access to a victim's machine with Recall could immediately siphon out all the user's history recorded by the feature. Hagenah's tool, however, still required that hackers find another way to gain administrator privileges through a so-called “privilege escalation” technique before his tool would work.

With Forshaw's technique, “you don’t need any privilege escalation, no pop-up, nothing,” says Hagenah. “This would make sense to implement in the tool for a bad guy.”

In fact, just an hour after speaking to WIRED about Forshaw's finding, Hagenah added the simpler of Forshaw's two techniques to his TotalRecall tool, then confirmed that the trick worked by accessing all the Recall history data stored on another user's machine for which he didn't have administrator access. “So simple and genius,” he wrote in a text to WIRED after testing the technique.

That confirmation removes one of the last arguments Recall's defenders have had against criticisms that the feature acts as, essentially, a piece of pre-installed spyware on a user's machine, ready to be exploited by any hacker who can gain a foothold on the device. “It makes your security very fragile, in the sense that anyone who penetrates your computer for even a second can get your whole history,” says Dave Aitel, the founder of the cybersecurity firm Immunity and a former NSA hacker. “Which is not something people want.”

For now, security researchers have been testing Recall in preview versions of the tool ahead of its expected launch later this month. Microsoft said it plans to integrate Recall on compatible Copilot+ PCs with the feature turned on by default. WIRED reached out to the company for comment on Forshaw's findings about Recall's security issues, but the company has yet to respond.

The revelation that hackers can exploit Recall without even using a separate privilege escalation technique only contributes further to the sense that the feature was rushed to market without a proper review from the company's cybersecurity team—despite the company's CEO Nadella proclaiming just last month that Microsoft would make security its first priority in every decision going forward. “You cannot convince me that Microsoft's security teams looked at this and said ‘that looks secure,’” says Jake Williams, a former NSA hacker and now the VP of R&D at the cybersecurity consultancy Hunter Strategy, where he says he's been asked by some of the firm's clients to test Recall's security before they add Microsoft devices that use it to their networks.

“As it stands now, it’s a security dumpster fire,” Williams says. “This is one of the scariest things I’ve ever seen from an enterprise security standpoint.”

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

The guide is available inside a new support document published by the company regarding Enhanced Sign-in Security or ESS. If you are not aware, ESS essentially provides an additional level of security to biometric data with the help of Virtualization-based Security (VBS) and TPM 2.0.

Windows Hello allows authentication via facial recognition, fingerprint recognition, as well as via PIN, and with the help of ESS the authentication is done securely. If you recall, when Windows 11 was first released, Microsoft had explained the benefits of security features like VBS and TPM 2.0.

Here's MIcrosoft's guide on how to configure ESS inside Windows 11 Settings is given below:

You can use the Settings app to configure ESS.

 

• In the Settings app on your Windows device, select Accounts > Sign-in options or use the following shortcut:

   

  Sign-in options

   

• Under Additional settings > Sign in with an external camera or fingerprint reader, there's a toggle that allows you to enable or disable ESS:

   

  • When the toggle is Off, ESS is enabled and you can't use external peripherals to sign in. Remember, you can still use external peripherals within apps like Teams

     

  • When the toggle is On, ESS is disabled and you can use Windows Hello compatible peripherals to sign in

     

Bear in mind though that ESS does require specially certified hardware. For example, Microsoft says that a face or fingerprint reader should have the “CM_DEVCAP_SECUREDEVICE” capability to support ESS. This can be found in the Details tab inside the device's property.

You can find the new support article Microsoft published here. You can also learn much more about it in this document here on Microsoft's official website. This guide was published by Microsoft simultaneously in addition to one about going passwordless using MSA.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

This is not the first time Microsoft has talked about passwordless sign-ins using MSA though. However, this time the company has published a simple guide that is very easy to follow along for non-tech-savvy people.

In case you may not be aware, passwordless sign ins on Windows are done using Hello, which allows authentication via face recognition, fingerprint recognition, as well as PIN.

In its guide below, Microsoft has also explained the benefits of using MSA-based Windows Hello sign ups:

Once you remove the password option, all features on your device that require your Microsoft account and password, including various apps and web browsers, will seamlessly transition to using Windows Hello’s facial recognition, fingerprint identification, or PIN code.

 

Note: This option is available only when you sign in with your Microsoft account.

 

To go passwordless, you can use the Settings app.

 

• In the Settings app on your Windows device, select Accounts > Sign-in options or use the following shortcut:

   

  Sign-in options

   

• Under Additional settings, turn on the option For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device
  
  Note: in Windows 10, this option is under Require Windows Hello sign-in for Microsoft accounts.

   

 

Sign-in experience

 

The next time you sign in to your device, you won't have the option to use your password. Only the Windows Hello face, fingerprint, or PIN gestures will be available.

You can view the official support document here on Microsoft's website. The company has also simultaneously published a guide on how to enable Enhanced Security Sign-in that you can find here.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

Proton's native password manager app for macOS, Linux, Windows, Android, and iOS features end-to-end encryption and offline support for all your stored data. Additional capabilities include secure password sharing, password monitoring, hide-my-email capabilities for protection against spam and phishing, and the recently announced passkey support.

The macOS version of the Proton Pass app also has a new Safari extension with cross-device sync support.

Proton Pass subscribers will also benefit from the Argon2 hashing algorithm, which is included in the offline mode. It protects your passwords and sensitive data from unauthorized access without an active internet connection.

This approach ensures the highest level of security and data integrity. Users can securely access their stored information while offline, ensuring their data is always within reach. Additionally, we guarantee that any updates are synchronized and managed with the utmost security standards once connected.

 

This dual-layered strategy ensures both convenience and top-notch security for our users' data. Argon2, distinguished for its defense against brute-force attacks, underscores our unwavering commitment to safeguarding user privacy with the most robust security measures available today.

It is worth noting that TouchID for Mac and Linux authentication API support will arrive in an upcoming update in a few weeks. For now, these capabilities are not supported.

Proton Pass is available for free on an unlimited number of devices. You can upgrade to Proton Pass Plus to get additional features, such as hide-my-email, two-factor authentication, password monitoring, and more. For now, you can get the first year of Proton Pass Plus for $23.88 and save $10. You can learn more about Proton Pass here.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

These attacks are part of what looks like an ongoing campaign first spotted on Wednesday by Germán Fernández, a security researcher at Chilean cybersecurity company CronUp.

The threat actor behind this campaign—who has the Gitloker handle on Telegram and is posing as a cyber incident analyst—is likely compromising targets' GitHub accounts using stolen credentials.

Subsequently, they claim to steal the victims' data, creating a backup that could help restore the deleted data. They then rename the repository and add a single README.me file, instructing the victims to reach out on Telegram.

"I hope this message finds you well. This is an urgent notice to inform you that your data has been compromised, and we have secured a backup," the ransom notes read.

When BleepingComputer contacted GitHub earlier today for more details regarding the Gitloker extortion campaign, a spokesperson was not immediately available for comment.

After previous attacks against GitHub users, the company advised users to change their passwords to secure their accounts against unauthorized access. This should protect against malicious actions such as adding new SSH keys, authorizing new apps, or modifying team members.

To prevent attackers from compromising your GitHub account and detect suspicious activity, you should also:

• Enable two-factor authentication.
• Add a passkey for secure, passwordless login.
• Review and revoke unauthorized access to SSH keys, deploy keys, and authorized integrations.
• Verify all email addresses associated with your account.
• Review account security logs to track repository changes.
• Manage webhooks on your repositories.
• Check for and revoke any new deploy keys.
• Regularly review recent commits and collaborators for each repository.

Commonly targeted in data theft attacks

This isn't the first time GitHub accounts have been compromised to steal data from users' private repositories.

Around March 2020, hackers also compromised the account of Microsoft, the developer platform's parent company since June 2018, stealing more than 500GB worth of files from Redmond's private repositories.

While the stolen files contained mostly code samples, test projects, and other generic items (nothing significant for Microsoft to worry about), security experts were concerned that private API keys or passwords might have also accidentally been exposed in the breach.

A now-notorious threat actor known as ShinyHunters also confirmed the inconsequential nature of the stolen data by leaking it on a hacker forum for free after first planning to sell the stolen files to the highest bidder.

In September 2020, GitHub warned of a phishing campaign targeting users to compromise their accounts. The campaign used emails pushing fake CircleCI notifications to steal their GitHub credentials and two-factor authentication (2FA) codes by relaying them through reverse proxies.

GitHub said that the attackers almost immediately began exfiltrating data from victims' private repositories after the compromise, adding new user accounts to the organizations to maintain persistence if it used management permissions.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every single day for many years.

2023: Over 5,800 news posts | 2024 (till end of May): Nearly 2,400 news posts

Such a possibility is why Kaspersky released its Virus Tool for Linux. According to the official announcement the "application can scan system memory, startup objects, boot sectors, and all files in the operating system for known malware. It scans files of all formats -- including archived ones."

Antivirus solutions for the Linux operating system are not plentiful, and for good reason. I've been vocal about this topic for years, landing on the side that Linux doesn't need such solutions.

But for those migrating from Windows, antivirus tools are ingrained in the psyche, and using the OS without them may feel like a danger no one should take. On top of that, virus creators are getting more sophisticated to the point where the security of nothing (not even Linux) is certain. Although Linux itself is about as safe an operating system as you'll ever use, malicious code is finding its way into open-source projects. Should a malicious application make its way to your Linux desktop, there's no guarantee the operating system alone will be able to prevent bad things from happening.

I decided to kick the tires of Kaspersky's new tool, with the help of the EICAR malware test files to see if it could catch anything. I saved the files to my home directory and then copied the .txt version of the file to /usr/lib. I also downloaded the EICAR COM and ZIP files (saving them to the same directories).

To my surprise, the Kaspersky tool did not detect any of the EICAR files in my ~/ directory but did catch all files copied to /usr/lib. Once found, it gave me the options to Disinfect, Delete, Copy to Quarantine, or Skip. It then gave me the option to disinfect with or without a reboot.

It didn't take me long to figure out why the EICAR files in the home directory weren't found. By default, the Kaspersky tool for Linux doesn't scan user's home directories. To make that happen, you have to go to Settings and then add /home as an object.

Once I did that, the app caught the files in my home directory and gave me the same options it did when it discovered them in /usr/lib.

I'm not saying you should shrug off the idea of an antivirus solution for Linux because who knows what the future holds. But that Kaspersky has created a free tool for Linux users shouldn't be discounted.

You can download the new Kaspersky tool from the official download page. Once you've downloaded it, you'll need to give it executable permissions with the command:

chmod u+x kvrt.run

To run the application, you can either right-click the downloaded file and select Run As Program, or issue the command (from within the directory housing the file):

./kvrt.run

You'll be asked for your sudo password before the app will run.

If you're paranoid about viruses on your computer, this is certainly as good an antivirus option as you'll find for Linux. The one caveat is that the Kaspersky Antivirus for Linux doesn't work in real-time (you have to run it manually every time). Even so, it's good to know companies like Kaspersky have Linux's back.

Source

Cybersecurity researchers collected these credentials from numerous Telegram cybercrime channels, where the stolen data is commonly leaked to the channel's users to build reputation and subscribers.

The stolen data is usually leaked as username and password combinations (usually stolen via credential stuffing attacks or data breaches), username and passwords along with a URL associated with them (stolen via password-stealing malware), and raw cookies (stolen via password-stealing malware).

The researchers, who asked BleepingComputer to remain anonymous, shared 122 GB of credentials with Troy Hunt, the owner of Have I Been Pwned, collected from many Telegram channels.

According to Hunt, this data is massive, containing 361 million unique email addresses, with 151 million never previously seen by the data breach notification service.

"It contained 1.7k files with 2B lines and 361M unique email addresses of which 151M had never been seen in HIBP before," posted Hunt.

"Alongside those addresses were passwords and, in many cases, the website the data pertains to."

With a dataset this large, it is impossible to verify that all of the leaked credentials are legitimate.

However, Hunt said that he utilized sites' password reset forms to confirm that many leaked email addresses are correctly associated with the website listed in the stolen credentials. Hunt could not confirm the password, as that would require him to log into the account, which would be illegal.

No site unaffected

With a dataset this large, no site that allows logins is unaffected by these leaked credentials, including BleepingComputer.

Last week, the same researchers shared with BleepingComputer a list of credentials stolen by information-stealing malware associated with the BleepingComputer forums.

Information-stealing malware is an infection that steals passwords, cookies, browser history, cryptocurrency wallets, and other data from an infected device.

This data is compiled into an archive called a "log" and then transmitted back to the threat actor's servers, where it is sold on cybercrime marketplaces, shared with other threat actors, or used to breach a victim's other accounts.

This type of malware is commonly distributed through social media, cracked software, fake VPN products, or simply through malicious email campaigns sent through hacked gaming company support sites.

The data shared with BleepingCompute includes the username, password, and URL that a member used to log into our forums, which was then saved in their browser's password manager.

As you can see from the URLs above, many users visited BleepingComputer because they suspected their computer was infected, which we now know was true.

BleepingComputer is currently analyzing the data and removing duplicates so we can proactively reset impacted members' passwords and warn them that they were infected at some point with information-stealing malware.

Users who are infected with information-stealing malware will now have to reset every password on every account that was saved in their browser's password manager, and any other site using the same credentials.

Unfortunately, stolen credentials are usually not shared with a timestamp to indicate when they are stolen. Therefore, impacted users must consider that all of their credentials have been compromised.

While this will be an arduous task, at least they will know why their accounts and services have exhibited strange behavior over the years.

BleepingComputer is commonly contacted by people who tell us that their accounts continuously get hacked, even when they change the password over and over. These people constantly report strange behavior on their devices or networks, but no malware infections are ever found.

The user can now gain some closure, knowing that they were not crazy, but that the malicious activity is likely attributed to their credentials previously being stolen and threat actors abusing them for their own amusement or malicious activity.

Information-stealing malware has become a scourge of cybersecurity, used by threat actors to conduct massive attacks, such as ransomware and data theft attacks.

Some well known attacks caused by credentials being stolen by information stealing malware, including attacks on the Costa Rican government, Microsoft, CircleCi, and an account at Orange Spain RIPE that led to a intentional BGP misconfiguration.

More recently threat actors stole data from Snowflake databases using what is believed to be compromised credentials stolen using information-stealing malware.

Unfortunately, there is no easy solution to prevent information-stealing attacks, as they are low complexity, making them have have wide distribution through a variety of attacks.

The best defense is to practice good cybersecurity habits, including not opening attachments from untrusted sources, downloading software only from trusted sources, enabling file extensions in Windows, using antivirus software, and keeping your software updated. 

A more detailed guide related to ransomware but still applicable can be found here.

Source

Hope you enjoyed this news post.

Microsoft unveiled "Recall" at its special event on May 20. This Copilot+ PC-exclusive feature promises to bring "photographic memory" to your computer, allowing going back to any app or file you worked with. To combat privacy concerns, Microsoft published a page with details on how Recall works. However, security researchers strongly disagree with the company's statements.

Kevin Beaumont, a cybersecurity expert, published a detailed blog post on Medium where he dug deeper into how Recall works. The verdict is a rather harsh one: stealing everything you viewed or typed on your computer is now very easy.

Beaumont claims that the idea of Recall is an interesting feature that requires "incredibly careful communication, cybersecurity, engineering, and implementation." Sadly, Recall allegedly has none of those.

Although the data processing and encryption are indeed happening on-device only, all that info is not immune to hackers and malware. The encryption will protect your data if the attacker doesn't know your username and password, but things change when hackers get a hold of your credentials using infostealers.

Recall works by taking screenshots of everything that happens on your computer every few seconds. Then, the system OCRs (recognizes optical characters) that data and puts it into a database in the user folder. Everything is stored in plain text, and there is no need for system rights to access it.

They have tried to do a bunch of things but none of it actually works properly in the real world due to gaps you can drive a plane through.

Kevin Beaumont created a website that can process a Recall database and instantly search for anything inside it. However, he is holding the project back until Microsoft ships it or maybe does something to improve security. Kevin says, "the wider cyber community will have so much fun with this when generally available."

Things get worse when you realize what is stored in your Recall database:

Everything a user has ever seen, ordered by application. Every bit of text the user has seen, with some minor exceptions (e.g. Microsoft Edge InPrivate mode is excluded, but Google Chrome isn’t).

 

Every user interaction, e.g. minimizing a window. There is an API for user activity, and third party apps can plug in to enrich data and also view store data. It also stores all websites you visit, even if third party.

Customers should also know that deleting emails, messages, pictures, files, or anything else on your computer will not delete them from Recall—it stays there indefinitely or until manually deleted/overwritten.

Although Microsoft Defender is pretty good at detecting infostealers and malware, "off the shelf" malware can scrape the entire database before automated detection kicks in.

Beaumont claims Microsoft "should recall Recall" and rework the feature to address all the privacy concerns, especially in light of Satya Nadella saying engineers should prioritize security over any other priority.

You can read the full story in Kevin's Medium post. If you still want to try Recall and see how it works, check out this third-party app that makes it possible to enable the feature on existing hardware (with caveats).

It remains to be seen how Microsoft will address these revelations. For now, Recall is technically available in the Release Preview Channel of the Windows Insider program. It is expected to arrive for the general public with the first Copilot+ PCs, such as the new Surface Pro and Surface Laptop.

Source

Hope you enjoyed this news post.

Sincere thank you for your Feedback and Likes.

The security firm notes that despite the common misconception that Linux systems are intrinsically secure from threats, there has been a constant supply of "in the wild" examples that prove otherwise, most recently, the XZ Utils backdoor.

Kaspersky's new tool isn't a real-time threat protection tool but a standalone scanner that can detect malware, adware, legitimate programs abused for malicious purposes, and other known threats and offers to clean them.

Copies of malicious files that are deleted or disinfected are stored in a quarantine directory at '/var/opt/KVRT2024_Data/Quarantine' (for root users) in a non-harmful form.

The application uses a frequently updated antivirus database to scan the entire system for matches, but users need to download a new copy each time for the latest definitions.

"Our application can scan system memory, startup objects, boot sectors, and all files in the operating system for known malware. It scans files of all formats — including archived ones," says Kaspersky.

One thing to note is that KVRT only supports 64-bit systems and requires an active internet connection to work.

Kaspersky has tested the tool on popular Linux distributions and confirmed it works on Red Hat Enterprise Linux, CentOS, Linux Mint, Ubuntu, SUSE, openSUSE, and Debian, among others.

Even if your distribution isn't on the list of supported systems, there's a good chance that KVRT will work without problems, so it wouldn't hurt to attempt to run a scan, Kaspersky says.

Using KVRT

KVRT can be downloaded from here, and once downloaded, the user needs to make the file executable and run it as root for maximum functionality.

KVRT can be executed both in a graphical user interface (GUI) or the terminal, as a command-line tool. So, it's also usable in lower init runlevels (down to 3) where people might be stuck following a malware infection.

If regular users execute the scanner, it won't have the required permissions to scan all directories and partitions where threats could be hiding.

During initialization, the scanner unpacks some necessary files into a temporary directory at '/tmp/<random_character_sequence,' but those are wiped once it's closed.

Kaspersky has provided detailed instructions on how to set up the binary for execution both via the GUI and the console on this webpage.

BleepingComputer has not tested the effectiveness, nor can it guarantee the safety of KVRT, so use the tool at your own risk.

Source

Hope you enjoyed this news post.

Sincere thank you for your Feedback and Likes.

The malware delivered to users includes remote access trojans (RATs), cryptocurrency miners, malware downloaders, proxy tools, and anti-AV programs.

AhnLab Security Intelligence Center (ASEC) has identified the ongoing campaign and warns about the risks of downloading pirated software.

The Korean researchers discovered that the attackers use multiple lures, including Microsoft Office, Windows, and the Hangul Word Processor, which is popular in Korea.

Microsoft Office to malware

The cracked Microsoft Office installer features a well-crafted interface, letting users select the version they want to install, the language, and whether to use 32 or 64-bit variants.

However, in the background, the installer launches an obfuscated .NET malware that contacts a Telegram or Mastodon channel to receive a valid download URL from where it will fetch additional components.

The URL points to Google Drive or GitHub, both legitimate services that are unlikely to trigger AV warnings.

The base64 payloads hosted on those platforms contain PowerShell commands that introduce a range of malware strains to the system, unpacked using 7Zip.

The malware component 'Updater' registers tasks in the Windows Task Scheduler to ensure it persists between system reboots.

According to ASEC, the following types of malware are installed by the malware on the breached system:

• Orcus RAT: Enables comprehensive remote control, including keylogging, webcam access, screen capture, and system manipulation for data exfiltration.
• XMRig: Cryptocurrency miner that uses system resources to mine Monero. It halts mining during high resource usage, such as when the victim is gaming, to avoid detection.
• 3Proxy: Converts infected systems into proxy servers by opening port 3306 and injecting them into legitimate processes, allowing attackers to route malicious traffic.
• PureCrypter: Downloads and executes additional malicious payloads from external sources, ensuring the system remains infected with the latest threats.
• AntiAV: Disrupts and disables security software by modifying its configuration files, preventing the software from operating correctly and leaving the system vulnerable to the operation of the other components.

Even if the user discovers and removes any of the above malware, the 'Updater' module, which executes upon system launch, will re-introduce it.

Users should be cautious when installing files downloaded from dubious sources and generally avoid pirated/cracked software.

Similar campaigns have been used to push STOP ransomware, which is the most active ransomware operation targeting consumers.

As these files are not digitally signed and users are prepared to ignore antivirus warnings when running them, they are often used to infect systems with malware, in this case, an entire set.

Source

In the official Chromium Blog, Google reminded users that despite popular belief, the idea behind Manifest V3 was not to kill content blockers but to improve security, privacy, and performance in the extension ecosystem.

The road to Manifest V3 was a bumpy one, and after significant user and developer backlash, Google was forced to implement some important changes and even postpone the enforcement of Manifest V3. Community feedback resulted in Google implementing support for user scripts, increasing the number of rule sets, allowing DOM (Document Object Model) APIs, and more. As a result, a lot of popular extensions, namely ad blockers, are already on Manifest V3.

The process of phasing out Manifest V2 extensions will kick off on June 3, 2024, with Google Chrome showing a warning banner for customers running Beta, Dev, and Canary builds with Manifest V2 extensions. The message will notify that some of those extensions will soon be out of support. Also, outdated Manifest V2 extensions will lose their badges in the Chrome Web Store.

Killing Manifest V2 is a long and slow process that won't happen overnight. Chrome will direct customers to the store and recommend Manifest V3 alternatives for extensions that no longer work. Also, there will be a grace period during which the browser will allow disabled extensions to be turned back on. However, Google will eventually remove this option.

Users in Chrome Stable will get all those changes over the next few months. Google plans to finish the process by early 2025. Enterprise customers will have the option to avoid Manifest V2 changes with a special policy until June 2025.

You can learn more about the end of the road for Manifest V2 extensions in Google Chrome on the official Chromium Blog. Microsoft Edge, which is also powered by Chromium, has its own timeline for Manifest V2 extensions, but most of it is still TBD. Firefox also has a similar one.

As an online publication, Neowin relies on ads for operating costs, and if you use an ad blocker, we'd appreciate being whitelisted. In addition, we have an ad-free subscription for $28 a year, which is another way to show support!

Source

Hope you enjoyed this news post.

Feedback welcome and Likes very much appreciated.

Internet Archive explained in a blog post:

The Internet Archive, the nonprofit research library that’s home to millions of historical documents, preserved websites, and media content, is currently in its third day of warding off an intermittent DDoS (distributed denial-of-service) cyber-attack.

 

According to library staff, the collections are safe, though service remains inconsistent. Access to the Internet Archive Wayback Machine – which preserves the history of more than 866 billion web pages – has also been impacted.

This came after the Internet Archive shared a series of updates about the DDoS attacks on the social media platform X (formerly Twitter). It notes that cyberattacks have become more frequent against libraries and other knowledge institutions, such as the British Library, Berlin Natural History Museum, and Ontario’s London Public Library, among the recent victims.

Internet Archive's founder Brewster Kahle assured the collections are safe and said the organization is hardening its defenses to offer more reliable access to the library. "What is new is this attack has been sustained, impactful, targeted, adaptive, and importantly, mean,” he added.

The cyberattacks share the timeline with the legal battle Internet Archive is facing from US book publishers, claiming copyright infringement and seeking combined damages of hundreds of millions of dollars from all libraries. Last year, the non-profit lost a lower court ruling against the book publishers in a case about its Controlled Digital Lending program.

Source

Source

Two years ago when “Michael,” an owner of cryptocurrency, contacted Joe Grand to help recover access to about $2 million worth of bitcoin he stored in encrypted format on his computer, Grand turned him down.

Michael, who is based in Europe and asked to remain anonymous, stored the cryptocurrency in a password-protected digital wallet. He generated a password using the RoboForm password manager and stored that password in a file encrypted with a tool called TrueCrypt. At some point, that file got corrupted and Michael lost access to the 20-character password he had generated to secure his 43.6 BTC (worth a total of about €4,000, or $5,300, in 2013). Michael used the RoboForm password manager to generate the password but did not store it in his manager. He worried that someone would hack his computer and obtain the password.

“At [that] time, I was really paranoid with my security,” he laughs.

Grand is a famed hardware hacker who in 2022 helped another crypto wallet owner recover access to $2 million in cryptocurrency he thought he’d lost forever after forgetting the PIN to his Trezor wallet. Since then, dozens of people have contacted Grand to help them recover their treasure. But Grand, known by the hacker handle “Kingpin,” turns down most of them, for various reasons.

Grand is an electrical engineer who began hacking computing hardware at age 10 and in 2008 cohosted the Discovery Channel’s Prototype This show. He now consults with companies that build complex digital systems to help them understand how hardware hackers like him might subvert their systems. He cracked the Trezor wallet in 2022 using complex hardware techniques that forced the USB-style wallet to reveal its password.

But Michael stored his cryptocurrency in a software-based wallet, which meant none of Grand’s hardware skills were relevant this time. He considered brute-forcing Michael’s password—writing a script to automatically guess millions of possible passwords to find the correct one—but determined this wasn’t feasible. He briefly considered that the RoboForm password manager Michael used to generate his password might have a flaw in the way it generated passwords, which would allow him to guess the password more easily. Grand, however, doubted such a flaw existed.

Michael contacted multiple people who specialize in cracking cryptography; they all told him “there’s no chance” of retrieving his money. But last June he approached Grand again, hoping to convince him to help, and this time Grand agreed to give it a try, working with a friend named Bruno in Germany who also hacks digital wallets.

Grand and Bruno spent months reverse engineering the version of the RoboForm program that they thought Michael had used in 2013 and found that the pseudo-random number generator used to generate passwords in that version—and subsequent versions until 2015—did indeed have a significant flaw that made the random number generator not so random. The RoboForm program unwisely tied the random passwords it generated to the date and time on the user’s computer—it determined the computer’s date and time, and then generated passwords that were predictable. If you knew the date and time and other parameters, you could compute any password that would have been generated on a certain date and time in the past.

If Michael knew the day or general time frame in 2013 when he generated it, as well as the parameters he used to generate the password (for example, the number of characters in the password, including lower- and upper-case letters, figures, and special characters), this would narrow the possible password guesses to a manageable number. Then they could hijack the RoboForm function responsible for checking the date and time on a computer and get it to travel back in time, believing the current date was a day in the 2013 time frame when Michael generated his password. RoboForm would then spit out the same passwords it generated on the days in 2013.

There was one problem: Michael couldn’t remember when he created the password.

According to the log on his software wallet, Michael moved bitcoin into his wallet for the first time on April 14, 2013. But he couldn’t remember if he generated the password the same day or some time before or after this. So, looking at the parameters of other passwords he generated using RoboForm, Grand and Bruno configured RoboForm to generate 20-character passwords with upper- and lower-case letters, numbers, and eight special characters from March 1 to April 20, 2013.

It failed to generate the right password. So Grand and Bruno lengthened the time frame from April 20 to June 1, 2013, using the same parameters. Still no luck.

Michael says they kept coming back to him, asking if he was sure about the parameters he’d used. He stuck to his first answer.

“They really annoyed me, because who knows what I did 10 years ago,” he recalls. He found other passwords he generated with RoboForm in 2013, and two of them did not use special characters, so Grand and Bruno adjusted. Last November, they reached out to Michael to set up a meeting in person. “I thought, ‘Oh my God, they will ask me again for the settings.”

Instead, they revealed that they had finally found the correct password—no special characters. It was generated on May 15, 2013, at 4:10:40 pm GMT.

“We ultimately got lucky that our parameters and time range was right. If either of those were wrong, we would have … continued to take guesses/shots in the dark,” Grand says in an email to WIRED. “It would have taken significantly longer to precompute all the possible passwords.”

Grand and Bruno created a video to explain the technical details more thoroughly.

RoboForm, made by US-based Siber Systems, was one of the first password managers on the market, and currently has more than 6 million users worldwide, according to a company report. In 2015, Siber seemed to fix the RoboForm password manager. In a cursory glance, Grand and Bruno couldn’t find any sign that the pseudo-random number generator in the 2015 version used the computer’s time, which makes them think they removed it to fix the flaw, though Grand says they would need to examine it more thoroughly to be certain.

Siber Systems confirmed to WIRED that it did fix the issue with version 7.9.14 of RoboForm, released June 10, 2015, but a spokesperson wouldn’t answer questions about how it did so. In a changelog on the company’s website, it mentions only that Siber programmers made changes to “increase randomness of generated passwords,” but it doesn’t say how they did this. Siber spokesman Simon Davis says that “RoboForm 7 was discontinued in 2017.”

Grand says that, without knowing how Siber fixed the issue, attackers may still be able to regenerate passwords generated by versions of RoboForm released before the fix in 2015. He’s also not sure if current versions contain the problem.

“I'm still not sure I would trust it without knowing how they actually improved the password generation in more recent versions,” he says. “I'm not sure if RoboForm knew how bad this particular weakness was.”

Customers may also still be using passwords that were generated with the early versions of the program before the fix. It doesn’t appear that Siber ever notified customers when it released the fixed version 7.9.14 in 2015 that they should generate new passwords for critical accounts or data. The company didn’t respond to a question about this.

If Siber didn’t inform customers, this would mean that anyone like Michael who used RoboForm to generate passwords prior to 2015—and are still using those passwords—may have vulnerable passwords that hackers can regenerate.

“We know that most people don't change passwords unless they're prompted to do so,” Grand says. “Out of 935 passwords in my password manager (not RoboForm), 220 of them are from 2015 and earlier, and most of them are [for] sites I still use.”

Depending on what the company did to fix the issue in 2015, newer passwords may also be vulnerable.

Last November, Grand and Bruno deducted a percentage of bitcoins from Michael’s account for the work they did, then gave him the password to access the rest. The bitcoin was worth $38,000 per coin at the time. Michael waited until it rose to $62,000 per coin and sold some of it. He now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin.

Michael says he was lucky that he lost the password years ago because, otherwise, he would have sold off the bitcoin when it was worth $40,000 a coin and missed out on a greater fortune.

“That I lost the password was financially a good thing.”

Source

Source

Having covered multiple Microsoft events in the past, this week's special press event where the company unveiled its new lineup of Surface hardware powered by Qualcomm's cutting-edge Snapdragon X Series SoCs (what our Editor-in-chief refers to as "The Great PC Reset") was by far the best I've seen yet. 

And while we didn't get the beloved Windows Phone back or a Surface-themed variant, I'm stoked to see Microsoft go all in on Windows on Arm. We won't have to wait for long to lay hands on these shiny products, either. Microsoft promises that they will be available as early as next month.

On the Windows side of things, Microsoft is bringing a plethora of next-gen AI features to Windows 11 in June, including Recall, Live Captions, Windows Studio effects, and more. However, not everyone will have access to these sophisticated features. This is because they'll require a device with a neural processing unit (NPU) that can output up to 40 TOPS of power. Essentially, you'll need a Copilot+ PC to access them.

Is Windows 11's Recall feature diabolical?

Source

Revealed during a Monday AI event, the feature is designed to help "recall" information you have looked at in the past, making it easily accessible via a simple search.

While it's currently only available on Copilot+ PCs running Snapdragon X ARM processors, Microsoft says they are working with Intel and AMD to create compatible CPUs.

Recall works by taking a screenshot of your active window every few seconds, recording everything you do in Windows for up to three months by default.

These snapshots will be analyzed by the on-device Neural Processing Unit (NPU) and an AI model to extract data from the screenshot. The data will be saved in a semantic index, allowing Windows users to browse through the snapshot history or search using human language queries.

Microsoft says that all of this data is encrypted using BitLocker tied to the user's Windows account and is not shared with other users on the same device.

While this sounds fun and interesting, it immediately raised concerns about obvious privacy risks and whether Microsoft plans on gobbling up all of this data.

However, Microsoft says Recall has been designed so that all of the data is saved directly on the user's device in an encrypted format, providing users with complete control over the feature, including if it's enabled and what apps it can take screenshots of.

Microsoft also says it will not create screenshots of Microsoft Edge's InPrivate windows (and other Chromium-based browsers) or content protected by DRM. However, they have not confirmed whether other browser's private modes, like Firefox, will be supported.

In a Monday press event, Yusuf Mehdi, Corporate Vice President & Consumer Chief Marketing Officer, assured journalists that Microsoft is taking a very conservative approach with Recall.

"We're going to keep your Recall index private and local and secure on just the device," said Mehdi.

"We won't use any of that information to train any AI model, and we put you completely in control with the ability to edit and delete anything that is captured."

Furthermore, Microsoft also reiterated to BleepingComputer that data for Recall will only be available locally and not be stored in the cloud, with the company once again restating that "data is not accessed by Microsoft."

Microsoft has also started to share more technical details, such as group policies that can be used to disable Recall company-wide and how end users can disable the feature.

Cybersecurity experts and regular users still concerned

Microsoft's promises have not done much to reassure the cybersecurity community or its customers, with our tweet regarding this new feature receiving over 90 comments, all negative.

So, why are most cybersecurity experts, researchers, and analysts so worried about this feature?

First and foremost, large companies have a history of exploiting users' data for their own profit, making it hard for users to trust Microsoft when they say they won't access the Recall data.

Users are not alone, as the United Kingdom's data protection agency, the Information Commissioner's Office (ICO), is also contacting Microsoft to ensure that users' data will be properly safeguarded and not used by the company.

"We expect organisations to be transparent with users about how their data is being used and only process personal data to the extent that it is necessary to achieve a specific purpose. Industry must consider data protection from the outset and rigorously assess and mitigate risks to peoples' rights and freedoms before bringing products to market," reads a press statement from the ICO.

"We are making enquiries with Microsoft to understand the safeguards in place to protect user privacy."

Even if we accept that Microsoft will not access Recall data, there are still massive security and privacy implications with this product.

Microsoft admits that the feature performs no content moderation, meaning it will gobble up anything it sees, including passwords in a password manager or your account numbers on your banking website.

Or if you are in Word, writing a confidential agreement, a screenshot of that content will be created, too. If you have a single PC and share it with others, then you may want to be careful about what pictures or videos you look at, as, guess what, those will be recorded as well.

Yes, you can block apps from being screenshotted by this feature, but most people will just let it run without mucking around with the feature's settings.

All of this information is now stored in Windows 11's semantic index and easily searchable by anyone with access to your PC, whether authorized or not.

That's just the tip of the iceberg, though.

If a threat actor or malware compromised your device, all of this data will already be decrypted by Bitlocker, making it accessible to the hacker. 

For example, a threat actor or malware could simply steal a Recall database and upload it to their own servers for analysis. This information could then be used to extort users or potentially breach user's accounts if credentials were exposed.

Cybersecurity expert Kevin Beaumont, known to be an outspoken critic of Microsoft at times, also expressed concern about how this feature creates a massive attack surface, likening it to a keylogger "baked into Windows."

"If you look at what has happened historically with infostealer malware — malicious software snuck onto PCs — it has pivoted to automatically steal browser passwords stored locally," Beaumont explained in a new blog post.

"In other words, if a malicious threat actor gains access to a system, they already steal important databases stored locally. They can just extend this to steal information recorded by Copilot's Recall feature."

And it's not only information-stealing malware, as enterprise-targeting malware like TrickBot had previously included modules that would steal a domain's Active Directory database for offline cracking of credentials. There is nothing to stop malware from taking a similar approach and stealing the Recall databases as well.

Microsoft has always taken the stance with vulnerabilities and attacks that once a device is compromised, all bets are off, and security boundaries are thrown out the window.

Basically, you got infected or fell for a social engineering attack, so it's your fault all these bad things will happen to you.

However, as Microsoft is one of, if not the, largest caretakers of consumer data and computing security, it seems irresponsible to introduce additional risk into an already risky environment.

While we can go on and on expressing how this feature is a massive privacy risk, I will instead leave you with this quote from Microsoft's recent pledge to prioritize security above all else.

"If you're faced with the tradeoff between security and another priority, your answer is clear: Do security. In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems," Microsoft's CEO Satya Nadella said in an email to Microsoft employees.

"This is key to advancing both our platform quality and capability such that we can protect the digital estates of our customers and build a safer world for all."

Update 5/22/24: This article previously said Microsoft is working with Intel and AMD to make all Windows 11 devices compatible, when they are instead working with them to make compatible CPUs.

Source

Microsoft says right off the bat that all the processing and snapshot storing happens on-device only. Windows 11 should not send any of that data to Microsoft or third parties. That also means you can use Recall without an internet connection. In addition, Windows 11 encrypts snapshots so that nobody can access your activities. Finally, users can pause or turn off the experience, filter apps, and delete taken snapshots at any time.

Windows 11 will notify you about Recall during the initial setup experience and offer you the option to customize some of its parts. Once turned on, Recall will place an icon in the tray area to notify you that the operating system is taking snapshots of what is going on. Clicking the icon will let you pause snapshots, open Racall, or go to Settings.

Speaking of settings, Recall options will sit under Privacy & Security > Recall & Snapshots. Available customization includes the ability to tweak how much space Windows reserves for snapshots, filtered apps, filtered websites, and more. Note, however, that website filters will only work in Microsoft Edge and other Chromium-based browsers.

You can learn more about privacy measures Microsoft uses in the new Recall experience in a document on the official support page. The first Copilot+ PCs with Recall and other AI-based experiences will start shipping in June 2024 (some features will arrive later).

Source

You're welcome.

Source

Source

However, that does not mean there was nothing of interest released this week about ransomware.

A report by CISA said that the Black Basta ransomware oepration has breached over 500 organizations worlwide since the group launched in April 2022.

After the Conti suffered a massive data breach, the ransomware operation shut down and its members splintered into different groups or launched their own ransomware operations.

One of those operations is Black Basta, which is believed to be composed of prior Conti members who operate it as a private group rather than as public ransomware-as-a-service.

It is widely believed that CISA released this report after news of massive disruption at Ascension Healthcare was caused by a Black Basta ransomware attack.

In other news, the relatively new Inc Ransomware was attempting to sell its source code for $300,000. However, it is unclear whether the group was selling older, unused code or shutting down the operation.

Ransomware phishing attacks also took front stage this week, with the Phorpiex botnet sending millions of emails that led to LockBit Black ransomware attacks, with the encryptor believed to have been created using LockBit's leaked source code.

BlackBasta was also found mailbombing employees in targeted organizations by subscribing their email addresses to various subscription services. They then contacted the target as IT support from their company to conduct a social engineering attack that let them gain access to the victim's computer.

Finally, Australian electronic prescription provider MediSecure shut down its IT systems and phones after suffering a 'large-scale' ransomware data breach.

Contributors and those who provided new ransomware information and stories this week include: @serghei, @BleepinComputer, @billtoulas, @fwosar, @demonslay335, @Ionut_Ilascu, @Seifreed, @LawrenceAbrams, @malwrhunterteam, @rapid7, @MsftSecIntel, @3xp0rtblog, @Intel_by_KELA, @NJCybersecurity, @proofpoint, @troyhunt, @CISAgov, @FBI, @AhnLab_SecuInfo, @briankrebs, @NCSC, @sekoia_io, @JakubKroustek, and @pcrisk.

May 11th 2024

CISA: Black Basta ransomware breached over 500 orgs worldwide

CISA and the FBI said today that Black Basta ransomware affiliates breached over 500 organizations between April 2022 and May 2024.

May 12th 2024

Largest non-bank lender in Australia warns of a data breach

Firstmac Limited is warning customers that it suffered a data breach a day after the new Embargo cyber-extortion group leaked over 500GB of data allegedly stolen from the firm.

New STOP ransomware variant

Jakub Kroustek found a new STOP ransomware variant that appends the .paaa extension.

May 13th 2024

Botnet sent millions of emails in LockBit Black ransomware campaign

Since April, millions of phishing emails have been sent through the Phorpiex botnet to conduct a large-scale LockBit Black ransomware campaign.

INC ransomware source code selling on hacking forums for $300,000

A cybercriminal using the name "salfetka" claims to be selling the source code of INC Ransom, a ransomware-as-a-service (RaaS) operation launched in August 2023.

Mallox affiliate leverages PureCrypter in MS-SQL exploitation campaigns

Recently, our team observed an incident involving our MS-SQL (Microsoft SQL) honeypot. It was targeted by an intrusion set leveraging brute-force tactics, aiming to deploy the Mallox ransomware via PureCrypter through several MS-SQL exploitation techniques.

How Did Authorities Identify the Alleged Lockbit Boss?

Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “LockBitSupp” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to Khoroshev. This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years.

Malware Distributed as Copyright Violation-Related Materials (Beast Ransomware, Vidar Infostealer)

The distribution of a new malware strain has been identified based on a recent copyright infringement warning, and it will be covered here.

New STOP ransomware variant

Jakub Kroustek found a new STOP ransomware variant that appends the .vehu extension.

New STOP ransomware variant

PCrisk found a new STOP ransomware variant that appends the .vepi extension.

New ransomware variant

PCrisk found a new STOP ransomware variant that appends the .capibara extension and drops a ransom note named READ_ME_USER.txt.

May 14th 2024

Cyber insurance industry unites to bear down on ransom payments

Joint guidance from the NCSC with the Association of British Insurers (ABI), British Insurance Brokers’ Association (BIBA) and International Underwriting Association (IUA) aims to help organisations faced with ransomware demands minimise disruption and the cost of an incident.

Guidance for organisations considering payment in ransomware incidents

This guidance has been jointly developed by the insurance industry bodies ABI, BIBA, IUA and the NCSC. It is for organisations experiencing a ransomware attack and the partner organisations supporting them.

May 15th 2024

Nissan North America data breach impacts over 53,000 employees

Nissan North America (Nissan) suffered a data breach last year when a threat actor targeted the company's external VPN and shut down systems to receive a ransom.

Windows Quick Assist abused in Black Basta ransomware attacks

?Financially motivated cybercriminals abuse the Windows Quick Assist feature in social engineering attacks to deploy Black Basta ransomware payloads on victims' networks.

Tornado Cash cryptomixer dev gets 64 months for laundering $2 billion

Alexey Pertsev, one of the main developers of the Tornado Cash cryptocurrency tumbler has been sentenced to 64 months in prison for his part in helping launder more than $2 billion worth of cryptocurrency.

May 16th 2024

MediSecure e-script firm hit by ‘large-scale’ ransomware data breach

Electronic prescription provider MediSecure in Australia has shut down its website and phone lines following a ransomware attack believed to originate from a third-party vendor.

That's it for this week! Hope everyone has a nice weekend!

Source

Here are the patched vulnerabilities in Microsoft Edge 124.0.2478.109:

• CVE-2024-30056: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability. Exposure of Private Personal Information to an Unauthorized Actor

• CVE-2024-4947: Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

• CVE-2024-4948: Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CVE-2024-4949: Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

• CVE-2024-4950: Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

   

Microsoft Edge 124.0.2478.109 is now available in the regular Stable Channel (four-week update schedule) and the Extended Stable Channel (eight-week update schedule). You can get to the latest version by heading to Menu > Help & Feedback > About Microsoft Edge or directly to the edge://settings/help page.

As a reminder, Microsoft will soon end Edge support on systems with processors that do not support the SSE3 instruction set. Edge 126 will be the last release that does not require SSE3. However, you should not fret if your PC is not a 20-year-old museum exhibit since PC processors have supported SSE3 since 2004.

Source