• Search for:
    23May, 2023
    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    SQL injection

    Labs

    If you’re already familiar with the basic concepts behind SQLi vulnerabilities and just want to practice exploiting them on some realistic, deliberately vulnerable targets, you can access all of the labs in this topic from the link below.View all SQL injection labs

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    https://youtube.com/watch?v=wX6tszfgYp4%3Forigin%3Dhttps%3A

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Retrieving hidden data

    Consider a shopping application that displays products in different categories. When the user clicks on the Gifts category, their browser requests the URL:https://insecure-website.com/products?category=Gifts

    This causes the application to make a SQL query to retrieve details of the relevant products from the database:SELECT * FROM products WHERE category = 'Gifts' AND released = 1

    This SQL query asks the database to return:

    • all details (*)
    • from the products table
    • where the category is Gifts
    • and released is 1.

    The restriction released = 1 is being used to hide products that are not released. For unreleased products, presumably released = 0.

    The application doesn’t implement any defenses against SQL injection attacks, so an attacker can construct an attack like:https://insecure-website.com/products?category=Gifts'--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts'--' AND released = 1

    The key thing here is that the double-dash sequence -- is a comment indicator in SQL, and means that the rest of the query is interpreted as a comment. This effectively removes the remainder of the query, so it no longer includes AND released = 1. This means that all products are displayed, including unreleased products.

    Going further, an attacker can cause the application to display all the products in any category, including categories that they don’t know about:https://insecure-website.com/products?category=Gifts'+OR+1=1--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1

    The modified query will return all items where either the category is Gifts, or 1 is equal to 1. Since 1=1 is always true, the query will return all items.

    Warning

    Take care when injecting the condition OR 1=1 into a SQL query. Although this may be harmless in the initial context you’re injecting into, it’s common for applications to use data from a single request in multiple different queries. If your condition reaches an UPDATE or DELETE statement, for example, this can result in an accidental loss of data.

    LAB

    APPRENTICESQL injection vulnerability in WHERE clause allowing retrieval of hidden data

    Subverting application logic

    Consider an application that lets users log in with a username and password. If a user submits the username wiener and the password bluecheese, the application checks the credentials by performing the following SQL query:SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'

    If the query returns the details of a user, then the login is successful. Otherwise, it is rejected.

    Here, an attacker can log in as any user without a password simply by using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query:SELECT * FROM users WHERE username = 'administrator'--' AND password = ''

    This query returns the user whose username is administrator and successfully logs the attacker in as that user.

    LAB

    APPRENTICESQL injection vulnerability allowing login bypass

    Retrieving data from other database tables

    In cases where the results of a SQL query are returned within the application’s responses, an attacker can leverage a SQL injection vulnerability to retrieve data from other tables within the database. This is done using the UNION keyword, which lets you execute an additional SELECT query and append the results to the original query.

    For example, if an application executes the following query containing the user input “Gifts”:SELECT name, description FROM products WHERE category = 'Gifts'

    then an attacker can submit the input:' UNION SELECT username, password FROM users--

    This will cause the application to return all usernames and passwords along with the names and descriptions of products.

    Read more

    SQL injection UNION attacks

    Examining the database

    Following initial identification of a SQL injection vulnerability, it is generally useful to obtain some information about the database itself. This information can often pave the way for further exploitation.

    You can query the version details for the database. The way that this is done depends on the database type, so you can infer the database type from whichever technique works. For example, on Oracle you can execute:SELECT * FROM v$version

    You can also determine what database tables exist, and which columns they contain. For example, on most databases you can execute the following query to list the tables:SELECT * FROM information_schema.tables

    Read more

    Examining the database in SQL injection attacksSQL injection cheat sheet

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    Read more

    Blind SQL injection

    How to detect SQL injection vulnerabilities

    The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite’s web vulnerability scanner.

    SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves:

    • Submitting the single quote character ' and looking for errors or other anomalies.
    • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
    • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses.
    • Submitting payloads designed to trigger time delays when executed within a SQL query, and looking for differences in the time taken to respond.
    • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within a SQL query, and monitoring for any resulting interactions.

    SQL injection in different parts of the query

    Most SQL injection vulnerabilities arise within the WHERE clause of a SELECT query. This type of SQL injection is generally well-understood by experienced testers.

    But SQL injection vulnerabilities can in principle occur at any location within the query, and within different query types. The most common other locations where SQL injection arises are:

    • In UPDATE statements, within the updated values or the WHERE clause.
    • In INSERT statements, within the inserted values.
    • In SELECT statements, within the table or column name.
    • In SELECT statements, within the ORDER BY clause.

    SQL injection in different contexts

    In all of the labs so far, you’ve used the query string to inject your malicious SQL payload. However, it’s important to note that you can perform SQL injection attacks using any controllable input that is processed as a SQL query by the application. For example, some websites take input in JSON or XML format and use this to query the database.

    These different formats may even provide alternative ways for you to obfuscate attacks that are otherwise blocked due to WAFs and other defense mechanisms. Weak implementations often just look for common SQL injection keywords within the request, so you may be able to bypass these filters by simply encoding or escaping characters in the prohibited keywords. For example, the following XML-based SQL injection uses an XML escape sequence to encode the S character in SELECT:

    Second-order SQL injection

    First-order SQL injection arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into a SQL query in an unsafe way.

    In second-order SQL injection (also known as stored SQL injection), the application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability arises at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into a SQL query in an unsafe way.

    Second-order SQL injection often arises in situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

    Database-specific factors

    Some core features of the SQL language are implemented in the same way across popular database platforms, and so many ways of detecting and exploiting SQL injection vulnerabilities work identically on different types of database.

    However, there are also many differences between common databases. These mean that some techniques for detecting and exploiting SQL injection work differently on different platforms. For example:

    • Syntax for string concatenation.
    • Comments.
    • Batched (or stacked) queries.
    • Platform-specific APIs.
    • Error messages.

    How to prevent SQL injection

    Most instances of SQL injection can be prevented by using parameterized queries (also known as prepared statements) instead of string concatenation within the query.

    The following code is vulnerable to SQL injection because the user input is concatenated directly into the query:String query = "SELECT * FROM products WHERE category = '"+ input + "'"; Statement statement = connection.createStatement(); ResultSet resultSet = statement.executeQuery(query);

    This code can be easily rewritten in a way that prevents the user input from interfering with the query structure:PreparedStatement statement = connection.prepareStatement("SELECT * FROM products WHERE category = ?"); statement.setString(1, input); ResultSet resultSet = statement.executeQuery();

    Parameterized queries can be used for any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can’t be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause. Application functionality that places untrusted data into those parts of the query will need to take a different approach, such as white-listing permitted input values, or using different logic to deliver the required behavior.

    For a parameterized query to be effective in preventing SQL injection, the string that is used in the query must always be a hard-coded constant, and must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It is all too easy to make mistakes about the possible origin of data, or for changes in other code to violate assumptions about what data is tainted.

    Resourse : https://portswigger.net/web-security/sql-injection

    22May, 2023
    How do we protect kids from cybersecurity threats?

    The average age of internet users and device owners is only getting younger, with at least 33% of 12 year olds in the U.S. already owning phones. Moreover, 12% of toddlers first experience with a phone is between the ages of 1 and 2! This generation of mini-techies can probably be explained in several sociological ways. As devices evolve, older versions become more affordable, so it’s becoming increasingly mainstream for families to own a number of connected devices. Screens are also becoming the inevitable “babysitter” for a lot of busy parents. 

    With this in mind, we must prioritize online safety and cybersecurity for young people.

    GOVERNMENT LEGISLATION TO PROTECT KIDS ONLINE

    To combat online safety concerns, including cyberbullying, self-harm, and online predators, more government agencies are clamping down on websites and apps that can cause potential harm. There are plenty of apps that parents, educators, and legislators would love to see banned completely; however, banning is not the answer. We need to make what’s out there safe to use.

    Some elected officials are beginning to take stands, which is promising. Recently in the U.S., California’s Governor Newsom signed the first bill in the country protecting children’s online data and privacy. Additionally, government agencies are taking constructive action. One year after Meta reportedly hid research proving the mental and emotional harm that Instagram is having on kids, the Federal Trade Commission (FTC) pushed back against them to enact change.

    While many countries around the world are beginning to pass laws to protect children online and hold social media companies accountable for the content on their platforms, it’s unfortunately not enough. There continue to be daily headlines around the world of cyberbullying, suicide, and dangerous trends that are being followed by kids. More action is needed and it must happen immediately.

    EDUCATION ABOUT ONLINE SAFETY

    Young people must understand internet safety and proper etiquette before they start using it. They need to be aware of the possible risks so that they will not engage in any dangerous activities. Some of the risks are more obvious, like strangers engaging with kids online. However, some are more nuanced, like cyberbullying or body image issues derived from social media. 

    Encouragingly, some companies and non-profit organizations have started using tech to help kids understand these risks. Google’s Be Internet Awesome program or the NPO Cyber Angels are great examples of this, showing that parental control tech, whether it be for desktop or mobile, is on the much-needed rise.

    Additionally, the app companies themselves have added their own variations. TikTok announced that it is creating a tool so parents can block their kids from accessing content with specific hashtags or keywords, while Instagram expanded its parental control components to include a “Quiet Mode” feature to encourage users to take a break from screen time.

    PARENTAL CONTROL APPS

    Parental control apps are one of the best online safety tools for young people. A good parental control app will address the concerns mentioned above that affect online safety. Most apps allow you to block unknown contacts from reaching your child, prevent dangerous apps from being used, and monitor whether offensive language is being used. In my home, we use the FamilyKeeper parental control app to provide solutions to these issues. 

    But it’s not just about blocking young users from accessing certain apps and sites. The idea behind a parental control app is to provide this population with the tools to safely navigate the digital world. Like training wheels on a bike, the premise is that your kids can learn what is and isn’t acceptable online in terms of speech, behavior, etiquette, and activity until they are experienced enough to manage without. 

    Understandably, a toddler’s needs don’t match those of a teenager. But privacy settings, screen-time monitoring, geolocation alerts, and app blocking can all be adapted to the age of your child and their needs.

    FINAL THOUGHTS

    In much the same way as you may research the best VPN or which antivirus software to install, take the time to learn about online safety for the little people in your life, and what cybersecurity measures are available to them. 

    Families should be able to make informed decisions about which apps and sites are age appropriate, and which apps and sites may enhance your child’s wellbeing, social life, or educational horizons. Families should also be able to make informed decisions about which ones should be avoided at all costs. 

    Stay current with the latest online safety recommendations from government agencies, educational institutions, and cyber tech leaders. Working together, all these factions of society can help bring about cyber safety for future generations.

    Resource : https://www.fastcompany.com/90898191/how-do-we-protect-kids-from-cybersecurity-threats

    22May, 2023
    Click and drag AI image editing could change everything

    The latest development in artificial intelligence is a tool that allows you to edit an already-generated image to your specifications.

    Say you wanted to “change the dimensions of a car or manipulate a smile into a frown with a simple click and drag,” you could do so with this model called DragGAN.

    Drag Your GAN: Interactive Point-based Manipulation on the Generative Image Manifold

    paper page: https://t.co/Gjcm1smqfl pic.twitter.com/XHQIiMdYOA

    — AK (@_akhaliq) May 19, 2023

    The Generative Adversarial Network (GAN) is currently in the form of a research paper, however, it has garnered such attention from those interested in viewing its demos that the research team’s homepage has experienced crashing due to the heavy traffic.

    The Verge compared DragGAN to the Warp tool in Photoshop, adding that it is much more powerful since it doesn’t “smush pixels around,” but rather “re-generates the underlying object,” and can even rotate 3D images.

    The potential of such a tool lies in the fact that text-to-image generative AI doesn’t always output what you might want. So you can go back in afterward and make edits to an existing image, instead of automatically having to generate a new image.

    Some demos that are a part of the research paper include adding height to a mountain, changing the positioning of a model and editing the length and shape of her clothes, opening or closing a lion’s mouth, and changing a person’s face from a plain look to a smile. With many AI tools currently available, users have to regenerate an image with a more specific prompt to get a more desirable result.

    The research team noted in its paper that new details can be added within the regeneration of the edited aspects of images that are beneficial to the update. “Our approach can hallucinate occluded content, like the teeth inside a lion’s mouth, and can deform following the object’s rigidity, like the bending of a horse leg.”

    There are many brands that are attempting to offer editing options for generative AI content. However, most do not go as far as allowing for the actual editing of images, but rather for aspects such as editing around images. For example, Microsoft’s Designer app allows you to generate AI images from a text prompt, and you can select your favorite from three results, then take it to the design studio where you can create a host of creativity and productivity-based projects, such as social media posts, invitations, digital postcards, or graphics with the image as the focal point. However, you cannot edit the AI-generated image.

    With the DragGAN tool still being a demo for now, there is no telling what the quality of a readily available technology would be, or if it would even be possible, especially since the demos are based on low-resolution videos. However, it is an interesting example of how quickly AI continues to develop.

    Resource: https://www.digitaltrends.com/computing/draggan-tool-click-and-drag-ai-photo-editing/

    18May, 2023
    A new perspective on security and business

    The battle continues, cyber-criminals versus their organizational victims. However, another battle is often raging under the surface inside organizations – security versus the rest of the business. Fighting the global war on cybercrime is much more challenging when the targets are distracted by internal turf wars. If security and business teams step back from the ledge, it’s not hard to see that everyone is working toward a common goal. Both groups want the same thing, not to be a victim of cybercrime. Understanding how to attack this problem without friendly fire is the missing element. A new perspective can show a path toward it.

    A challenge of standing on the ledge is the limited view of options available to work the problem. Abraham Maslow described it well, “if all you have is a hammer, everything looks like a nail.” If you focus solely on security methodologies, you will likely only view the problem from this angle. If a cybersecurity threat exists within a system, removing that threat is all that matters. The hammer is the security tool available to remove threats; the threat is a nail.

    But what if we looked at the threats from a different perspective? For a more pointed example, we can look at the threats in an OT environment. Like IT, OT devices are vulnerable to various cyber threats. However, threats to device and process configurations are an equally important concern. These operation-focused threats include misconfigurations, unexpected setting changes, unplanned updates, or anything else that could alter a device’s expected functionality. Reducing this type of threat is the focus of OT operation teams. By taking a step back, we can view the operation-focused threats the OT teams are concerned with alongside the security team’s cyber-focused threats. Doing so reveals that both teams have a common goal – maintaining operational continuity.

    Now that we have a common goal, one that both security and the business (specifically the operations team in this example) can agree on, the challenge remains how to mitigate the threat best. Continuing our OT example, this step is where a shift is needed from traditional IT security methodologies. The tools used to mitigate threats in IT systems, such as Endpoint Detection and Response (EDR), are often unsuitable for use in an OT environment. The differences between OT and IT, including system resource constraints, legacy software and operating systems, unique devices, and specialty applications, explain part of the reason IT EDR is unsuitable. It can’t monitor threat behaviors it doesn’t understand. More importantly, because of the singular focus on cyber threats, some actions taken by IT EDR tools may inadvertently introduce new operation threats. This explains the reluctance of OT teams to deploy security tools. They could hurt operational continuity more than it helps.

    Supporting the new perspective’s common goal requires a new approach simultaneously addressing cyber and operation threats—Cyber-Physical System Detection and Response (CPSDR) does just that. It takes the proven cyber threat detection and response concepts from EDR and introduces operation-threat protection to support the common goal. With this new dual context and focus, security teams can mitigate against cyber-attacks, and operation teams can lockdown configurations, allowing each to complete their mission without risking operational continuity in the process.

    TXOne Networks is pioneering this new paradigm of protection with TXOne Stellar. Designed specifically for the OT environment, Stellar supports business and security team goals by defending the operational stability of OT devices and Cyber-Physical Systems and detecting and responding to cyber threats. With TXOne Network’s deep OT industry knowledge, there is no longer a need to settle for “IT solutions will have to do.” Stellar can accelerate your OT resiliency by providing newfound confidence to operations teams that it is safe for security teams to apply security controls without impacting availability because they are dual-focused on their goals too.

    Announce your organization’s turf war reconciliation. Keep the operation running with TXOne Stellar.

    Resource : https://www.scmagazine.com/native/incident-response/a-new-perspective-on-security-and-business

    18May, 2023
    VirusTotal AI code analysis expands Windows, Linux script support

    Google has added support for more scripting languages to VirusTotal Code Insight, a recently introduced artificial intelligence-based code analysis feature.

    While launched only with support for analyzing a subset of PowerShell files, Code Insight can now also spot malicious Batch (BAT), Command Prompt (CMD), Shell (SH), and VBScript (VBS) scripts.

    Besides the list of additions included in Google’s announcement, BleepingComputer was also able to discover that the company added support for AutoHotkey (AHK) and Python (PY) scripting languages.

    “Code Insight has broadened its support for script formats, moving beyond PowerShell to offer analysis for a variety of scripting languages,” VirusTotal founder Bernardo Quintero said.

    To facilitate the analysis of larger files, Code Insight has also been updated to have an increased maximum file size limit, doubling the capacity for processing.

    “Code Insight can now handle files twice the size it could before, and we’re not stopping there. We’re going to keep working on improving this aspect in the coming months,” Quintero added.

    Additionally, the model has been improved to provide clearer and more specific high-level explanations, emphasizing the code’s behavior.

    A revamped user interface now showcases only the start of the report (the first several sentences) by default, allowing users to expand the description if needed. This ensures the default view is not inundated with lengthy AI-powered analysis reports.

    ​VirusTotal announced the launch of Code Insight last month as an AI-based code analysis feature powered by the Google Cloud Security AI Workbench, which uses the Sec-PaLM large language model (LLM) fine-tuned for security use cases.

    As Google explained, it analyzes potentially harmful files to describe their (malicious) behavior, making identifying which pose actual threats easier.

    Code Insight is currently in its early stages of development, marking the beginning of a continuous and evolving process.

    The roadmap ahead encompasses the following improvements:

    1. Expanding support for additional file types and sizes.
    2. Enabling analysis of binary and executable files.
    3. Enriching analysis by incorporating contextual information beyond the code itself.

    VirusTotal is a web-based malware-scanning platform with over 500,000 registered users, owned by Google’s Chronicle security subsidiary.

    It helps scan suspicious files and URLs for malicious content, such as viruses, worms, and trojans, by harnessing the power of more than 70 antivirus scanners and domain blocklisting services.

    Resource : https://www.bleepingcomputer.com/news/security/virustotal-ai-code-analysis-expands-windows-linux-script-support/

    11May, 2023
    Watch the Google I/O 2023 keynote in under 18 minutes

    Google’s I/O event this year was jam-packed with new product launches and an in-depth introduction to its new generative AI offerings. The star of its new set of device was, perhaps, the new Pixel Fold, a veritable rival to Samsung’s foldables powered by a Tensor G2 chip. Like the Samsung Galaxy Fold, it opens like a book so you can fully use its 7.6-inch display, though it also comes with a 5.8-inch external display. It’s now available for pre-order and will set you back $1,799 when it starts shipping in June.

    The company has also unveiled its new mid-range phone, the Pixel 7a, that will cost you $499. In addition, the Pixel Tablet is now available for pre-order for the same price. You can use the 11-inch tablet as a smart home display with Google Assistant and Chromecast when it’s attached to its speaker dock. On its own, it can last for 12 hours, and while it doesn’t come with a stylus, it does support third-party pens. 

    But the most important and relevant unveiling of the event was the company’s PaLM 2 AI language model, which is the technology behind its Bard AI chatbot and which will power new features across its products. Bard will soon have the ability to decipher images in your queries and respond with images in turn — it’s now available without a waitlist in 180 countries. Gmail will have the ability to craft responses to emails for you, while Photos is getting a Magic Editor that can move objects in your pictures. You can get a glimpse of all Google announcements in a condensed version of its I/O keynote above.

    Resource : https://www.engadget.com/watch-the-google-io-2023-keynote-in-under-18-minutes-052059113.html

    11May, 2023
    What is Pepecoin? Meme-coin mania creeps back with a new unsettling mascot

    After a crypto winter, meme coins seem to be making a bit of a comeback. Over the past couple of weeks, crypto enthusiasts have been pouring money into Pepecoin. And long-time observers of the digital currency space are feeling a bit of déjà vu.

    As with Dogecoin, this cryptocurrency is based on a popular internet meme, except this time it’s Pepe the Frog, a lovable cartoon that became a mascot of alt-right, anti-Semitic, and white supremacist groups. PEPE’s value has skyrocketed in little time, gaining roughly 500% in the past two weeks.

    Here’s what you should know about Pepecoin:

    WHAT IS PEPECOIN?

    The Twitter feed for Pepecoin calls it, “the most memeable meme coin in existence,” and it’s leaning hard into that, throwing veiled digs at Dogecoin and even creating its own Pepe memes that show the frog peeing on other meme coins.

    The coin launched with little fanfare on April 17—and while it’s based on the Pepe the Frog meme, it has no official connection to Matt Furie, the artist behind the original cartoon. It leans further into the joke realm by having a maximum circulating supply of 420,690,000,000,000 coins.

    Despite the lack of seriousness, it has already grown to be one of the 50 largest cryptos being traded. And trading volume in the coin was up 425% on Friday.

    WHERE IS PEPECOIN TRADING TODAY AND HOW HIGH HAS IT SPIKED?

    On Friday alone, Pepecoin saw its price more than double. Since its April 17 launch, it’s up 580%. Part of the reason for that could be the decision by Binance, the market’s largest exchange, to list the token Friday afternoon in its “innovation zone.”

    It’s still an incredibly cheap coin in real-world dollars, though. You’d need to buy nearly 3,000 Pepecoin to convert them into a single penny.

    And it’s worth noting that even Binance urged caution, saying, “Please note that the token has no utility and it is created by an anonymous team. . . . Also, there are signs that certain insiders or team members were able to buy 7% of the total token supply minutes after TGE [the Token Generation Event, when coins become publicly available].”

    WHAT IS PEPECOIN’S MARKET CAP?

    Because there are so many Pepecoin on the market and because the price has been soaring, this meme coin’s market capitalization is already well above $1 billion. As of Friday afternoon, it stood at $1.34 billion—and was still climbing.

    IS THERE A RISK OF A RUG PULL WITH PEPECOIN?

    Anytime you see a coin explode this quickly, it’s a good idea to be cautious. When the focus of the coin is an internet meme that is tied to so many negative groups, that’s another red flag.

    Skeptics have pointed out that the coin has a number of so-called whales, who hold large amounts of the token. Should they decide to dump their holdings, average investors could see the value of their holdings evaporate. That led to some short selling on Pepecoin early on, but so far, the people who have bet against the token are the ones who have lost money.

    HISTORICALLY, HOW HAVE MEME COINS PERFORMED?

    So far, the biggest meme coins have failed to hold onto their value, even as celebrities like Elon Musk have pumped them up. Dogecoin never reached its goal of a $1 value and currently trades for around 8 cents, which is right about what it was trading at before its big surge. Shiba Inu, another popular meme coin that saw a brief spike, is trading for well under a penny—about where it was in October of 2021, right before its spike. Buyers, as always, should beware. 

    Resource : https://www.fastcompany.com/90892884/what-is-pepecoin-meme-coin-crypto

    10May, 2023
    A Linux NetFilter kernel flaw allows escalating privileges to ‘root’

    A Linux NetFilter kernel flaw, tracked as CVE-2023-32233, can be exploited by unprivileged local users to escalate their privileges to root.

    Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network address translation, and port translation, which provide the functionality required for directing packets through a network and prohibiting packets from reaching sensitive locations within a network.

    The Linux NetFilter kernel is affected by a vulnerability, tracked as CVE-2023-32233, that can allow unprivileged local users to escalate their privileges to ‘root,’ potentially leading to the complete compromise of the system.

    “In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory.” reads the advisory. “Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.”

    The root cause of the problem resides in how tfilter nf_tables handles batch requests, allowing a local authenticated attacker to gain elevated privileges by sending a specially crafted request that causes the corruption of the internal state of Netfilter nf_tables.

    “Netfilter nf_tables allows updating its configuration with batch requests that group multiple basic operations into atomic transactions. In a specific scenario, an invalid batch request may contain an operation that implicitly deletes an existing nft anonymous set followed by another operation that attempts to act on the same nft anonymous set after it is deleted.” wrote Piotr Krysiuk on SecLists.

    Researchers Patryk Sondej and Piotr Krysiuk developed an PoC exploit code that allows unprivileged local users to start a root shell by abusing this vulnerability.

    “That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code.” continues Krysiuk. ” Therefore, according to the linux-distros list policy, the exploit must be published within 7 days from this advisory. In order to comply with
    that policy, I intend to publish both the description of exploitation techniques and also the exploit source code on Monday 15th by email to this list. The fix is available from mainline kernel git repository:
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab “

    The two researchers shared their exploit privately with the Linux kernel team to allow the development of a patch to solve the issue.

    The engineer Pablo Neira Ayuso addressed the flaw by deactivating anonymous set from preparation. phase preventing users to perform any update on it.

    Resource : https://securityaffairs.com/145989/security/linux-netfilter-kernel-flaw.html

    10May, 2023
    GitHub Secret-Blocking Feature Now Generally Available

    GitHub today announced the general availability of push protection, a feature designed to prevent developers from unknowingly exposing secrets in their code.

    Push protection was initially announced in December 2022 as part of secret scanning, a new feature meant to help developers and organizations identify any secrets exposed in their repositories.

    In March 2023, the Microsoft-owned code hosting platform announced the general availability of secret scanning, after previously making it available for free for public repositories.

    Now, the push protection feature is also generally available and is free for all public repositories. It can also be used for private repositories with a GitHub Advanced Security (GHAS) license.

    With push protection enabled, developers are warned as soon as they push a commit containing a highly identifiable secret, and are also provided with guidance on how to remove that secret. As soon as the exposure has been eliminated, the developer can re-push the commit.

    “Push protection only blocks secrets with low false positive rates, so when a commit is blocked, you know it’s worth investigating,” GitHub says.

    The platform is working with service providers to ensure a low false positive rate and is delivering exposure alerts directly in the developers’ IDEs or command line interfaces.

    Push protection, GitHub explains, can be bypassed in urgent circumstances, by providing a reason, such as ‘testing’, ‘false positive’, or ‘acceptable risk’.

    Whenever a bypass occurs, security managers and repository and organization administrators receive an email alert. They can audit all bypasses via audit logs, REST API, alert view UI, and webhook events.

    Push protection can be enabled in the ‘Code security and analysis’ settings, in the ‘Secret scanning’ section. By clicking on the ‘Enable all’ button, both features will be enabled at once.

    “You can automatically enable push protection or provide a custom resource link that will appear in a push protection message via the checkboxes under the ‘Push Protection’ section. This will ensure push protection is applied to any new repository created in your enterprise or organization,” GitHub explains.

    GitHub customers with a GHAS license can also enable push protection on their custom secret patterns.

    Resource : https://www.securityweek.com/github-secret-blocking-feature-now-generally-available/

    9May, 2023
    Gmail Is Adding Blue Checkmarks to Verify Senders

    Blue checkmarks used to be a sign of legitimacy, ensuring someone truly is who they say they are. While they have lost their meaning on Twitter, they’re now appearing in Gmail as a method to fight spam and phishing.

    Gmail is officially adding blue checkmarks to verified senders on Gmail. Senders that have BIMI, or Brand Indicators for Message Identification — a system to ensure that brands can use their logo as a profile picture only if they’re allowed to do so — will get a blue checkmark in emails sent by them.

    That way, users will be able to more easily tell apart fake emails from real ones — if you get a message from your bank, for one, you should now see a verified check in the email’s sender information.

    If you’re a business owner looking to get some added protection against phishing, make sure to enroll in BIMI. You’ll need to enroll in DMARC first, too. For the rest of us, you should see this feature sometime within the next few days — we don’t see it on our end yet, but according to Google, it should begin showing up within the next 3 days.

    Resource: https://www.howtogeek.com/890490/gmail-is-adding-blue-checkmarks-to-verify-senders/