• Search for:
    10Apr, 2023
    Researchers disclose critical sandbox escape bug in vm2 sandbox library

    The development team behind the vm2 JavaScript sandbox library addressed a critical Remote Code Execution vulnerability.

    The developers behind the vm2 JavaScript sandbox module have addressed a critical vulnerability, tracked as CVE-2023-29017 (CVSS score 9.8), that could be exploited to execute arbitrary shellcode.

    vm2 is a sandbox that can run untrusted code in an isolated context on Node.js servers, it has approximately four million weekly downloads and its library is part of 722 packages.

    The flaw was reported by the security researcher Seongil Wi from South Korean security firm KAIST WSP Lab.

    The vulnerability affects all versions, including and prior to 3.9.14, it was addressed with the release of version 3.9.15.

    “vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.” reads the advisory published by vm2. “A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.”

    Wi also published two proof-of-concept (PoC) exploits for this vulnerability that can be used to escape the sandbox to create an empty file named “flag” on the host.

    In October 2022, VM2 maintainers addressed another critical sandbox escape vulnerability tracked as CVE-2022-36067.

    Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
    Vote for me in the sections:

    • The Teacher – Most Educational Blog
    • The Entertainer – Most Entertaining Blog
    • The Tech Whizz – Best Technical Blog
    • Best Social Media Account to Follow (@securityaffairs)

    Resource : https://securityaffairs.com/144582/hacking/vm2-rce-sandbox-escape.html

    6Apr, 2023
    NASA’s Ingenuity Mars Helicopter breaks world records, again

    NASA’s Ingenuity Mars Helicopter has been flying on the red planet’s surface for over two years now, and it has covered a distance of over 11 kilometres in that time. While 11 kilometres in two years may not seem like much in Earth terms, Ingenuity is actually breaking world records on the Mars.

    Ingenuity’s 49th flight, which happened on Sunday, April 2, broke two different records–that for the highest altitude and the highest speed–achieved by any self-propelled aircraft outside of Earth. During its 49th flight, the little rotorcraft flew up to a height of 16 metres and reached a top speed of 23.4 kilometres per hour.

    The rotorcraft set its previous flight height record on the red planet on December 3, 2022, when it flew about 14 metres in the air. Its previous flight speed record of 19.8 kilometres per hour was achieved on three different occasions–December 10, June 11, and April 8.

    Its longest flight so far was its record-breaking 25th flight on April 8, 2022, when it covered a distance of a whopping 704 metres in what is still its longest flight and was its fastest flight until flight 49.

    What is Ingenuity?

    Ingenuity is a small solar-powered helicopter that landed on the Martian surface on February 18, 2021, along with the Perseverance Rover. On April 19, the same year, it created history by completing the first powered extraterrestrial flight in human history. During that flight, it hovered and landed and the same spot for a flight that lasted 39.1 seconds, creating history.

    Why are Ingenuity’s records so impressive?

    While these distances may seem small for us here living on Earth, do remember that Mars is more than 225 million kilometres away right now. The distance between the two planets means that it takes between 5 to 20 minutes for a signal to travel from one to another.

    Adding to this signal delay, Ingenuity also has to survive the harsh conditions on Mars. The low atmospheric density on the planet means that Ingenuity must work much harder than helicopters here on Earth in order to be able to fly. Also, it has had to survive “continent-sized” dust storms in the past and other Martian hazards in the past.

    Resource : https://indianexpress.com/article/technology/science/nasa-ingenuity-mars-helicopter-8539782/

    6Apr, 2023
    5 Most Advanced Cyber Security Technology to Aid Your Business

    Running a business using the most advanced technology and terrified about the increasing incidents of cybercrimes. As most of the business practices are getting digitized, it has created a sea change in the entire scenario. But, this approach runs the risk of exposing confidential information of your clients. The advancement of technology has become convenient for hackers to crack into the system, using the latest techniques, and create new incidences of cybercrimes. Maintaining valid cyber insurance can save a lot of your obligations following the crime.

    The Necessity for Adopting the Latest Cyber Security Technologies

    The worldwide pandemic outbreak has compelled us to resort to digital modes for the last two years. This has severely impacted our lives and the instances of cyberattacks have also become much more intense. Cyberattacks have always existed, but their current nature has turned much more grave and powerful.

    1. Changed targets of attacks:

    The targets of cyber crimes have changed over the years and have become much more sinister than only extraction of confidential information, quick money or vengeance. It has been elevated to the state of cyber warfare. Presently, all the nuclear power plants, utility services, airports, and healthcare facilities are connected to a specialized network. This is increasing with every passing day, thereby, creating more probable targets.

    2. Advanced cyber threats:

    Cybercriminals are getting more advanced and grave with time. Each hacker possesses a top-grade technical prowess and is a computer science professional of the highest grade. As technologies are getting advanced to block cyber threats, so are the nature of attacks.

    3. Critical aftermath:

    All the critical infrastructure is connected to a single frame network, possessing a worldwide expanse. All the important businesses store their confidential data digitally and are largely dependent on the system. Under such circumstances, even the smallest security breach can jeopardize their position.

    4. A critical shift in the cyber attacking nature:

    If any of the public utility infrastructures gets hacked it will lead to extreme public inconvenience, heavy regulatory penalties, loss of revenue, severe reputational damage and tremendous cost of restoration and upgrading the cyber security system measures.

    Top 5 Latest Cyber Security Measures

    Under the current circumstances, cyber warfare carries the biggest threat to advancing technologies. We have experienced malware and ransomware attacks on business enterprises on a much smaller grade. We have to remember that there is not a single protective measure that can be considered 100% foolproof. We have to keep ourselves upgraded with the advancing technologies to keep pace with time. Some of the most advanced cyber security technologies of the time include the following:

    1. Deep learning and artificial intelligence:

    Artificial intelligence is the current market trend. Have you ever wondered how can it affect and improve cyber security? Of course, the method of such an application is quite similar to the working strategy of the two-factor authentication system. It works on the user’s identity confirmation on the basis of multiple parameters. Such parameters are designed on the basis of their knowledge and possession. Adding to such layers of authentication and information, AI enters the scene.

    Deep learning is used for analyzing the data like real-time communications, logs, and transactions, detecting unwarranted activities and threats.

    2. Behavioural analytics:

    This is the biggest target for social media and several online advertisements for the correct set of target audiences. Cyber security technology is increasingly exploring behaviour analytics for even further development of the systems. The system identifies the patterns in a particular system and/or network activities for detecting real-time and plausible cyber threats. Although behavioural analytics is generally used for networks, its system application and application on user devices are considered as surging.

    3. Embedded hardware authentication:

    A password and PIN are no longer considered to be enough hardware protection. Embedded authenticators are developing advanced technologies for the verification of the identity of the concerned user. The sixth-generation vPro chips deserve a special mention in this context for its groundbreaking entry. Here, the authentication chips remain embedded within the hardware itself, ideally revolutionizing the “authentication security”. It successfully employs several levels and authentication techniques working in sync with each other.

    4. Blockchain cybersecurity:

    This is one of the most advanced in the genre and is gaining rapid popularity. His system works based on the successful identification of two transacting parties. Similarly, blockchain systems also function based on the system’s peer-to-peer network fundamentals. Each member in the blockchain system holds the responsibility for verification of the authenticity of the newly added data. Moreover, it forms a nearly impenetrable network for hackers to break into and offers almost foolproof security and protection. Artificial intelligence is capable of establishing a strong verification system for keeping potential cyber threats away.

    5. Zero-trust model:

    As the name goes, this essential cyber security model is framed based on considering an already compromised network. With the belief that any particular network cannot be trusted, one must enhance both “external” and “internal” securities. The game here lies that both the external and internal networks are prone to compromise and need similar levels of protection. It includes the proper identification of critical business data, mapping of the data flow, physical and logical segmentation, policy controlling and enforcement using constant monitoring and automation.

    Resource : https://www.hdfcergo.com/blogs/cyber-insurance/5-most-advanced-cyber-security-technology-to-aid-your-business

    29Mar, 2023
    Top 15 VS Code Extensions to Enhance Your Development Experience

    VS (Visual Studio) Code is one of the most popular standalone source code editors that you can run on macOS, Windows, and Linux. Although it’s just a rich source code editor, you can take its functionality to the next level by using different Visual Studio Code extensions.

    But choosing the best extensions for VS code can be a daunting task, as there are tons of them available in the Visual Studio Marketplace.

    That’s where this guide comes into place. It contains the top 15 Visual Studio Code extensions to make it easy for you to choose the best ones that suit your unique coding needs.

    Best Visual Studio Extensions: Our detailed list

    If you’re a developer, you’d already know how plugins and extensions can help you streamline your development workflow. If you’re looking for the best visual studio code extensions for web development or for general programming purposes, check out the following list.

    Antlers Toolbox

    Features:Syntax highlighting and code suggestions with autocomplete functionality
    Category:Programming Languages, Snippets, and Formatters
    Free version:Yes

    Antlers Toolbox is one of the best VS Code extensions for developing Statamic websites in Antlers templating language. It offers rich language support to make the development process easy.

    With features such as syntax highlighting, code suggestions, auto-completions, automated formatting, and runtime error reporting, it’s an indispensable extension for web developers working with Antlers.

    Key Features:

    • Parser-driving semantic highlighter
    • Basic syntax highlighter
    • Suggestions for modifier signature
    • Contextual auto-suggestions based on different variables like templates, fields, and collections
    • Advanced Antlers formatting
    • Supports core Statamic 3 modifiers, tags, and more

    StackFlex

    Features:Innovative extension to transform copy-paste into save-use
    Category:Other
    Free version:Yes

    StackFlex is a Visual Studio Code extension designed to help developers save and manage their frequently used code snippets.

    You can use it to save and access code snippets from within VS Code, and sync them across all your devices. The browser extension also allows you to save snippets from various websites with just a click of a button.

    Key features:

    • Save and manage code snippets directly within VS Code
    • Sync your snippets across all your devices
    • Save snippets from various websites using the browser extension
    • Use custom names and extensions for your saved snippets
    • Search for saved snippets using keywords and tags

    .NET nanoFramework

    Features:Enables VS Code to deploy, build, and flash C# code for .NET nanoFramework on different devices
    Category:Programming Languages
    Free version:Yes

    The .NET nanoFramework extension for VS Code allows developers to deploy, build, and flash their C# code for the .NET nanoFramework.

    It supports ESP32 and STM32 MCU devices running Visual Studio Code on different operating systems, including Windows, Linux, and macOS.

    In short, this NET nanoFramework is a powerful extension for embedded developers to write managed code applications for embedded devices.

    Key features:

    • Compatible with ESP32 and STM32 MCU devices
    • Supports Windows, Linux, and Mac
    • Provides an easy-to-use user interface for managing nanoFramework projects

    gramex-yaml-snippets

    Features:Features snippets for Gramex
    Category:Snippets
    Free version:Yes

    gramex-yaml-snippets is another powerful Visual Studio Code extension that provides YAML code snippets for Gramex.

    With this extension, you can easily configure sessions, logs, FormHandler, caching assets, and emails. It also supports various authentication methods such as auth_simple, auth_google, and auth_db.

    This extension is useful for developers who are using Gramex to build web applications and want to streamline their configuration process. It can save time and reduce errors by providing auto-complete suggestions for commonly used configuration options.

    Key features:

    • Auto-complete YAML configuration for Gramex endpoints
    • Provides configuration for caching assets, email service, Custom logs, sessions, and more
    • Supports various authentication methods

    Tabnine

    Features:AI-powered code assistant supports all popular programming languages
    Category:Programming Languages and Snippets
    Free version:Yes

    Tabnine is one of the top Visual Studio Code extensions that can help you code faster and more accurately. It’s an AI-powered code completion assistant that’s trained on open-source code and helps you improve your productivity by automating repetitive code writing.

    Tabnine is a great extension for developers who want to save time and increase their productivity by automating repetitive code writing. It can be used by both junior and professional developers working alone or in a team.

    Key features:

    • Trained on open-source code for accurate suggestions
    • AI-powered code completion that suggests the next lines of code
    • Available for multiple programming languages
    • Provide suggestions that are consistent with your team’s best practices

    Prettier

    Features:Comprehensive code formatter
    Category:Formatters
    Free version:Yes

    If you are looking for something that can help you format your code properly, then Prettier is one of the best extensions for VS Code to use.

    It’s a code formatting extension that automatically enforces consistent code styling by parsing your code and reprinting it with its own rules.

    Key features:

    • Automatically formats code to enforce consistent styling
    • Supports many languages
    • Helps you keep your code in a uniform style
    • Easy installation process

    GitLens – Git supercharged

    Features:All-around tool to streamline Git functionality
    Category:SCM Providers
    Free version:Yes

    GitLens is a powerful VS Code extension that enhances the functionality of Git by providing a rich set of features to visualize and understand the code.

    It helps you gain insights into the who, why, and when aspects related to code changes, making it easier to understand the evolution of the codebase. It’s particularly useful for teams working on large, complex projects where code changes can be difficult to track and understand.

    Key features:

    • Provides detailed and interactive visualization of Git repositories
    • Displays blame annotations for each line of code to identify when and by whom it was last changed
    • Shows commit details and code changes right in the editor margin
    • Allows you to quickly navigate through the Git history of a file, line, or code block

    Colorize

    Features:Helps you visualize CSS colors
    Category:Other
    Free version:Yes

    Colorize is a useful extension for developers who work with XML, Stylus, PostCSS, Less, Sass, and CSS.

    It generates colored backgrounds around colors in your CSS file, allowing you to see them in action on the page. This is especially useful for any developer who wants to save time and improve productivity by visualizing the colors they’re using in their code.

    Key features:

    • Instantly visualize CSS colors
    • Generate colored backgrounds for CSS variables
    • Live update of color backgrounds as you make changes in your CSS file

    Code Issue Manager: document & fix issues in your codebase

    Features:Highlight issues in code to improve the codebase health
    Category:Other
    Free version:Yes

    Code Issue Manager by Stepsize is an extension that helps engineering teams document and solve problems that exist in their codebase.

    It elevates your engineering culture to adopt best coding practices and improves the health of your codebase.

    Key features:

    • Track issues across multiple code pieces
    • Document code without adding comments
    • Convert To-Do lists into actionable issues
    • Sync issues with the issue tracker manually or automatically
    • Collaborate on issues within the editor
    • Support for various issue trackers, including Asana, DevOps, Azure, Linear, GitHub, and Jira

    Better Comments

    Features:Code comment manager/organizer
    Category:Formatters
    Free version:Yes

    Better Comments is another excellent VS Code extension that makes comments in your code more colorful and exciting.

    With its customizable settings, you can highlight important notes, reminders, and to-dos. Additionally, the extension also supports a wide range of programming languages and allows you to create your own comment styles.

    Key features:

    • Categorize your annotations into alerts, queries, TODOs, and highlights
    • Style commented-out code to indicate it shouldn’t be there
    • Customize the appearance of your comments with colors and tags
    • Compatible with a variety of programming languages

    CodeSnap

    Features:Takes screenshots of source code in Visual Studio Code
    Category:Other
    Free version:Yes

    CodeSnap is a free VS Code extension designed to make sharing code snippets more visually appealing and easier to understand. It allows you to take screenshots of your source code while keeping the indentation and syntax highlighting intact.

    It also provides a variety of customization options, so you can tailor your code snapshots to your specific preferences.

    Key features:

    • Quickly take and save screenshots of the code
    • Copy code screenshots to your clipboard for easy sharing
    • Customize your code screenshots with a variety of settings, including font size and line numbers
    • Highlight specific lines of code in your screenshots to draw attention to key details

    Peacock

    Features:Changes the color of VS Code Environment
    Category:Other
    Free version:Yes

    Peacock is a great Visual Studio Code extension that allows you to customize the color of your workspace or environment. This can be helpful when you are working with multiple instances of VS Code and want to easily identify the instance you are currently using.

    It offers a range of features and settings to help you make your coding experience truly unique.

    Key features:

    • Customize the color of your workspace or environment
    • Quickly distinguish each instance of VS Code with your preferred colors
    • Unique color settings for VS Code

    Markdown Preview Github Styling

    Features:Changes the built-in markdown preview of VS Code to match GitHub styling
    Category:Other
    Free version:Yes

    Markdown Preview Github Styling enhances the functionality of the built-in markdown preview feature of the VS Code editor. It can change this preview so that it matches GitHub styling.

    This extension is ideal for developers who work extensively with markdown documents and want to see live updates of their work in a side-by-side preview panel.

    Key features:

    • Preview your markdown documents rendered on GitHub
    • Extends the built-in markdown preview feature of Visual Studio Code
    • Supports both light and dark GitHub themes
    • Customize styling using your own CSS

    LambdaTest

    Features:Cross-browser cloud-based testing platform
    Category:Testing
    Free version:Yes

    LambdaTest is a cloud-based testing platform that enables organizations to redefine their testing strategies.

    It allows you to perform live-interactive cross-browser testing of your public and locally hosted web applications and websites directly within the VS Code editor.

    Key features:

    • Performs cross-browser real-time testing
    • Supports more than 3,000 operating systems, real devices, and browsers
    • Trigger testing within the VS Code Editor
    • Perform mobile web testing on iOS simulators and Android emulators
    • Geolocation testing across various browsers
    • Mark any UI observation as a bug
    • Inbuilt issue tracker

    Bookmarks

    Features:Bookmarks specific code areas
    Category:Other
    Free version:Yes

    Bookmarks is a VS Code extension that allows you to mark specific areas of your code with bookmarks. This functionality makes it easier to navigate and jump back and forth between different parts of your code.

    You can add and remove bookmarks, add labels, and even select regions of code between bookmarked areas. The extension also includes a dedicated sidebar where you can view all of your bookmarks at a glance.

    Key features:

    • Add and remove bookmarks in your code
    • Add labels to bookmarks for easier identification
    • Select regions of code between bookmarked areas
    • Dedicated sidebar for viewing all bookmarked areas
    • Technical support available for any questions or issues
    • Supports virtual workspaces

    Best Visual Studio Code Extensions: Final recommendations

    We have highlighted the best Visual Studio Code extensions in this article that can help you become a better coder. Here’s a quick overview of these extensions to help you narrow down your search.

    • Antlers Toolbox – a Visual Studio Code extension that provides rich language to build Statamic websites in Antlers templating language.
    • StackFlex – an extension that allows you to save code snippets locally from different websites, and sync with VS Code to use them in your projects in the future.
    • .NET nanoFramework – a tool that enables you to build, deploy, and flash C# code for .NET nanoFramework on ESP32 or STM32 MCU devices, regardless of the platform.
    • gramex-yaml-snippets – a VS Code extension that provides YAML snippets for Gramex, which is a web app development framework.
    • Tabnine – an AI-powered code completion extension that suggests and completes entire lines of code.
    • Prettier – a code formatter that automatically formats code to a standardized style, whenever you save it.
    • GitLens – Git supercharged – a powerful extension that enhances Git capabilities by providing rich information about code authors, commit history, and even code changes from within the VS Code editor.
    • Colorize – a syntax highlighting extension that colorizes source code in a variety of programming languages.
    • Code Issue Manager – a tool to document and solve issues in a codebase using custom-defined rules.
    • Better Comments – a VS Code extension that enhances code comments by adding color coding and various annotation styles.
    • CodeSnap – a Visual Studio Code extension to create screenshots of your code effortlessly.
    • Peacock – an extension that allows you to change the color of the VS Code environment or workspace.
    • Markdown Preview Github Styling – a markdown preview extension that supports light and dark GitHub themes and lets you preview your markdown as it would be rendered on GitHub.
    • LambdaTest – a cross-browser cloud-based testing platform that allows for live-interactive testing of public and locally hosted web applications and websites.
    • Bookmarks – a VS Code extension that allows you to bookmark specific areas of your code for easy navigation.

    Resource : https://cybernews.com/resources/top-vs-code-extensions-to-enhance-your-development-experience/

    22Mar, 2023
    HinataBot, a new Go-Based DDoS botnet in the threat landscape

    A new Golang-based DDoS botnet, tracked as HinataBot, targets routers and servers by exploiting known vulnerabilities.

    Akamai researchers spotted a new DDoS Golang-based botnet, dubbed HinataBot, which has been observed exploiting known flaws to compromise routers and servers.

    The experts reported that the HinataBot bot was seen being distributed since the beginning of 2023 and its operators are actively updating it.

    The name “Hinata” comes after a character from the popular anime series, Naruto.

    Akamai’s SIRT recently discovered the new bot within HTTP and SSH honeypots, it stood out due to its large size and the lack of specific identification around its newer hashes.

    The sample captured by the experts abuses old vulnerabilities and weak credentials, the researchers reported that it attempts to exploit flaws in the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers (CVE N/A). 

    HinataBot supports multiple methods of communication, including both dialing out and listening for incoming connections. The botnet can launch distributed denial-of-service (DDoS) flooding attacks that relies on protocols such as HTTP, UDP, TCP, and ICMP to send traffic. However, the latest version of HinataBot only supports HTTP and UDP attacks.

    Akamai said that by reverse engineering the bot and imitating the command and control (C2) server, was able to test the offensive capabilities of the botnet by running two attack methods (HTTP and UDP) in a 10-second period.

    HinataBot botnet

    “The http_flood generated 3.4 MB of packet capture data and pushed 20,430 HTTP requests. The request sizes ranged from 484 to 589 bytes per request, with sizes varying mostly due to randomization of User-Agent and Cookie header data.” reads the report published by Akamai. “The udp_flood generated 6,733 packets for a total of 421 MB of packet capture data over the wire. There isn’t much else that’s interesting about this attack: it is volumetric in nature and seems to do a decent job of pushing volume.”

    Test results show that a botnet composed of just 1,000 nodes can carry out a UDP flood that would weigh in at around 336 Gbps per second. A botnet of 10,000 nodes (which is roughly 6.9% of the size of Mirai at its peak) can generate a UDP flood that would weigh in at more than 3.3 Tbps. The HTTP flood at 1,000 nodes would generate roughly 2.7 Gbps and more than 2 Mrps, while with 10,000 nodes, those numbers jump to 27 Gbps delivering 20.4 Mrps.

    HinataBot is the last bot in order of time to join the ever-growing list of emerging Go-based bots after GoBruteforcer and KmsdBot.

    “The HinataBot family relies on old vulnerabilities and brute forcing weak passwords for distribution. This is yet another example of why strong password and patching policies are more critical than ever.” concludes Akamai that also privided Indicators of Compromise and YARA rules for this threat.

    Resource : https://securityaffairs.com/143618/cyber-crime/hinatabot-go-based-ddos-botnet.html

    22Mar, 2023
    Mirai V3G4 botnet exploits 13 flaws to target IoT devices

    During the second half of 2022, a variant of the Mirai bot, tracked as V3G4, targeted IoT devices by exploiting tens of flaws.

    Palo Alto Networks Unit 42 researchers reported that a Mirai variant called V3G4 was attempting to exploit several flaws to infect IoT devices from July to December 2022. 

    Below is the list of vulnerabilities exploited by V3G4:

    The threat actors’ goal is to infect the largest number of systems as possible to compose a botnet that can be used to conduct multiple attacks, including DDoS attacks.

    The researchers have observed three different Mirai V3G4 campaigns likely operated by the same threat actor for the following reasons:

    • The hardcoded command and control (C2) domains among these three campaigns contain the same string (8xl9)
    • The malware shell script downloaders are almost identical between the three campaigns
    • The botnet client samples use the same XOR decryption key
    • The botnet client samples use the same “stop list” (a list of target processes that the botnet client searches for and terminates)
    • The botnet client samples use almost identical functions

    The botnet exploited 13 vulnerabilities to achieve remote code execution on vulnerable devices. Upon successful exploitation, the malicious code executes wget and curl utilities to download Mirai bot from attackers’ infrastructure and then execute it.

    Mirai V3G4 botnet

    Upon execution, the bot prints xXxSlicexXxxVEGA. to the console. The experts noticed that V3G4 also supports a function that makes sure only one instance of this malware is executing on the compromised device. If a botnet process already exists, the botnet client will and exit.

    The botnet also attempts to terminate a list of processes, included in the hardcoded ‘stop list,’ by checking their names on the infected device.

    Unlike most Mirai variants, the V3G4 variant uses different XOR encryption keys for string encryption.

    The researchers also noticed that the bot samples from the three campaigns have minor differences. The original Mirai botnet sample spreads itself by brute-forcing weak telnet/SSH credentials, while other variants rely brute-force attacks and embedded exploits to spread.

    However, bot samples discovered between September and December 2022 don’t contain the functions of vulnerability exploitation and brute force of credentials.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS.” concludes the report. “Therefore, it is highly recommended that patches and updates are applied when possible.”

    Resource : https://securityaffairs.com/142358/malware/mirai-v3g4-botnet.html

    21Mar, 2023
    How to Build a Fast Online Store With Nexcess Managed WooCommerce

    Ecommerce is a multi-million dollar industry that’s poised to grow as physical retailers struggle to keep their doors open, and consumer trust in big brands wanes. If you want your online shop to be part of the small business renaissance, Nexcess Managed WooCommerce is a fast, efficient, and reliable tool to elevate the digital shopping experience.

    Nexcess Managed WooCommerce Hosting is a pioneer in eCommerce evolution that optimizes applications to simplify managing a digital storefront. Whereas many hosting companies tout standard hosting as “WooCommerce hosting,” Nexcess developed a platform that is true WooCommerce hosting. When implemented, Nexcess can help your online storefront run faster through many of its valuable features.

    How to Build Your eCommerce Site…

    For an eCommerce site to thrive, it needs to be a place shoppers want to go. An ugly storefront won’t stick with your consumers, and if it’s poorly laid out, they’ll leave before giving your product a second look.

    Nexcess offers an intuitive StoreBuilder that requires no coding skill and is easy to work with, even for owners with little-to-no design experience. From product layouts to individual pages and color schemes, every aspect is at your fingertips and can be easily changed to your liking.

    Nexcess Managed WordPress enhances your time in the backend, providing an unparalleled site development process that offers everything you need to build and run a fast and functional storefront.

    …and Keep It Moving

    A lot goes into running a website, and owners shouldn’t have to spend a lot of time keeping theirs online. Nexcess oversees critical functions and features like Edge DNS to ensure your customers have a way of finding and accessing your digital store. Like the building tool, Edge DNS is user-friendly and can be configured without hassle.

    How to Optimize Your Store’s User Experience

    One of the worst things for users to experience in any online space is a slow and unresponsive website. With an eCommerce store, users should see gears moving at all times. Products should load fast. Items should be instantly placed into carts with a click. Every aspect of the checkout process should be fluid and effortlessly move the interaction forward.

    Nexcess helps to keep things flowing with free access to Object Cache Pro, a premium tool that performs queries with little delay. The result is a faster storefront designed to improve the user experience.

    A built-in content delivery network (CDN) serves as another means of caching to make frequently accessed files readily available. Users will experience much smaller downtimes while your website loads through Nexcess Managed WooCommerce hosting.

    Around-The-Clock Support

    Keeping up on your store’s analytics and having an outlet to turn to for support are essential for the long-term life of your WooCommerce store. Nexcess Managed WooCommerce comes with monitoring alerts to keep you abreast of sales trends and any site issues, such as slow speeds or errors during checkout

    Should you come across a problem you can’t handle, a team of WooCommerce experts is available 365 days, 24/7. They’ll work with you to keep your site running, whether it’s first thing in the morning or late at night.

    Start Your Ecommerce Store Today

    With your site under the care of Nexcess Managed WooCommerce Hosting, you can focus more on your products and deliver a quality customer service experience. For as little as $19 per month, you can take advantage of Nexcess’ premium hosting services, including 30GB of storage, 3TB bandwidth, any needed SSL certificates, and so much more.

    Resource : https://www.howtogeek.com/878742/how-to-build-a-fast-online-store-with-nexcess-managed-woocommerce/

    21Mar, 2023
    Bing Chat AI Is Getting Faster, and Has New Buttons

    Microsoft introduced the Bing Chat AI chatbot in February, which has quickly risen in popularity. A few new features are now rolling out, including faster performance, new sharing options, and reduced limits.

    Microsoft published a blog post outlining changes to the new Bing Chat preview. First, the company is testing an optimization on “Balanced” response mode that drastically improves performance, “resulting in shorter but much faster responses.” Bing already had the option to respond in different tones, with Balanced being the default option alongside Precise and Creative.

    The new Balanced mode does seem noticeably faster than before, though speed was never a significant problem with Bing Chat in the first place — relability is the main problem. Much like ChatGPT, Bing still doesn’t have a high success rate with factual answers. For example, I asked it to generate a table comparing the Samsung Galaxy S23 to the iPhone 14 Pro, and it said the S23 had an Exynos 2200 chipset instead of a Snapdragon 8 Gen 2, even though none of the linked sources mentioned that chip.

    Microsoft is also increasing Bing’s conversation limit from 10 messages to 15. Bing Chat originally didn’t have a conversation limit at all, but it was introduced after people were using long conversations to coax Bing into calling itself depressed or sentient in some way. Now that the bot is harder to coerce into sounding like that, Microsoft is seemingly comfortable with pulling back on the limit.

    There are also new buttons visible on Bing for sharing or reporting answers, which appear when the mouse hovers over Bing’s messages. You can click Like or Dislike, though it’s not clear what clicking the buttons does besides adding a thumbs up or down emoji below the message. There’s a Copy button for copying the answer to your clipboard, and a Share button that creates a link to your answer. Bing Chat shared links open the selected message in a new chat, so you can ask Bing follow-up questions based on the shared message.

    Annoyingly, the links only work if the web Bing Chat is already accessible — opening them in Chrome or another browser asks you to use Microsoft Edge, and you need to join the Bing waitlist (which doesn’t seem to be a waitlist anymore). Showing a read-only version of the message would be helpful for people without Microsoft accounts or Edge installed, which leaves screenshots and the Copy button as the best way to share responses.

    Finally, Microsoft is tweaking the Creative tone to support larger amounts of context in conversations, and the Skype version can now be added to group conversations where at least one person has access to the new Bing.

    Resource : https://www.howtogeek.com/880239/bing-chat-ai-is-getting-faster-and-has-new-buttons/

    17Mar, 2023
    The Best VPN Services of 2023

    Our expert team have tested dozens of VPNs, looking at everything from streaming capabilities and speed to security and privacy. Here are BleepingComputer’s top picks for the Best VPNs in 2023.

    Consumer VPNs, or Virtual Private Networks, have grown from a niche technology to a tool used by hundreds of millions of internet users in just a few years. It makes sense: bulk data collection is now the norm, by both private organizations and governments, so it’s only natural people would look for a way to take back control of their digital privacy.

    So which VPN should you use? That’s a tricky question since the answer depends on your priorities and how you use the internet. Some providers might offer first-class security or speeds, while others pride themselves on their ability to access region-locked streaming services. In other words, the best VPN for somebody else might not be the best VPN for you.

    That’s why we’ve carefully examined dozens of leading VPN providers and whittled our list down to seven that really stand out. No matter your requirements, there’s sure to be a VPN below that’s up to the task.

    Best VPN services of 2023

    1. NordVPN: Our best VPN service for 2023. A well-known provider that continuously pushes the boundaries of what a VPN is, with unique features like Tor over VPN servers and MeshNet for creating secure point-to-point connections. Comes with a risk-free 30-day money-back guarantee.
    2. Surfshark: Best VPN for those on a budget. Connect any number of devices. Works with popular streaming services and has a 30-day money-back guarantee. Includes ad blocking and malware filtering.
    3. ExpressVPN: Quick, versatile, and easy to use, with a network spanning 94+ countries. Includes a custom app for routers, parallel connection technology for faster speeds, and reliable access in China. Unique features include a GUI app for Linux and rotating IP addresses.
    4. CyberGhost: A fast and secure VPN that is easy to use, ideal for streaming, and provides a lengthy 45-day money-back guarantee. Superb value for money.
    5. Mullvad: Fast, privacy-first VPN with one low price, no matter how long you subscribe for.
    6. ProtonVPN: Great for secure streaming. Offers a free plan with no bandwidth limits.
    7. IPVanish: Has lots of security tools, a verified no-logs policy, and industry-leading speeds.
    8. Atlas VPN: Newer VPN already offering competitive performance and innovative privacy tools.

    Resource : https://www.bleepingcomputer.com/vpn/guides/best-vpn/

    17Mar, 2023
    Latitude cyberattack leads to data theft at two service providers

    Latitude Financial Services (Latitude) has disclosed a data breach after suffering a cyberattack, causing the company to shut down internal and customer-facing systems.

    Latitude is one of Australia’s largest personal loans provider and the country’s largest non-bank consumer credit lender.

    A subsidiary of Deutsche Bank and KKE, the firm provides a broad spectrum of consumer finance services, including unsecured personal loans, credit cards, car loans, personal insurance, and interest-free retail finance.

    Moreover, Latitude provides major Australian retailers like Harvey Norman, JB Hi-Fi, David Jones, and The Good Guys with “buy now, pay later” (BNPL) schemes.

    One breach leads to another

    According to the ‘cyber incident’ notification, Latitude’s internal systems were breached, allowing a threat actor to steal an employee’s login. These credentials were then used for logging into two of the company’s service providers to steal customer data.

    “As of today, Latitude understands that approximately 103,000 identification documents, more than 97% of which are copies of drivers’ licenses, were stolen from the first service provider,” explains Latitude.

    “Approximately 225,000 customer records were also stolen from the second service provider.”

    Latitude has not clarified if the records from the second provider contain similar data as the first provider, i.e., ID and driver’s licenses or other information.

    BleepingComputer has requested a comment from the firm to clarify that, and we will update this story as soon as we receive a response.

    Exposed customers are not expected to take any action to protect themselves at this time. However, it is recommended that they stay vigilant, as their stolen data may be used in phishing or social engineering attacks.

    The company has shut down several internal and customer-facing systems while responding to the incident and says that the effort to contain the attack and prevent breaches or further customer data is still underway.

    While the public announcement was made available to all customers, those determined to be directly impacted by the security incident will receive personal notifications.

    Resource: https://www.bleepingcomputer.com/news/security/latitude-cyberattack-leads-to-data-theft-at-two-service-providers/