Google Confirms Chrome Zero-Day #5 As Attacks Begin, Update Now - Forbes | Canada News Media
Connect with us

Tech

Google Confirms Chrome Zero-Day #5 As Attacks Begin, Update Now – Forbes

Published

 on


August 20 Update below. This post was originally published on August 18

If you are a Chrome browser user, be that in Windows, Mac, or Linux flavor, Google has some bad news for you. Attackers are already exploiting a high-impact security vulnerability that could lead to them gaining control of a system resource or to arbitrary code execution. This is the fifth zero-day Google has had to deal with in 2022 so far.

What is the Google Chrome CVE-2022-2856 Zero-Day?

In an advisory posted August 16, Srinivas Sista from the Google Chrome team, confirms that a total of eleven security vulnerabilities, ranging from medium to critical impact, have been fixed in the latest Chrome update. One of these, CVE-2022-2856, is the zero-day in question. “Google is aware that an exploit for CVE-2022-2856 exists in the wild,” Sista stated.

Not much detail is being made public about the zero-day vulnerability until a majority of users have had time to ensure the update is installed and activated.

However, Google does confirm that CVE-2022-2856 was reported by hackers from within the Google Threat Analysis Group, Ashley Shen and Christian Resell, on July 19. It is, the advisory states, an “insufficient validation of untrusted input in Intents.”

Which will be as clear as mud for most users.

All I can add, at this point, in an attempt to clarify, is that the ‘intents’ mentioned are how Chrome processes user input. It is possible, although, again, I cannot confirm the precise technical details of CVE-2022-2856, that by creating a malicious input that prevents Chrome from validating it, potentially leading to arbitrary code execution.

What steps do you need to take to secure Google Chrome?

What I can say with complete confidence is that you should check your browser has updated to the latest Chrome version as soon as possible. For Mac and Linux users, this will be Chrome 104.0.5112.101, while for Windows users, it could be either 104.0.5112.101 or 104.0.5112.102, just for some additional unwanted confusion.

While Chrome should update automatically, it is recommended that you force the update check to be safe. You also need to perform one additional step before your browser will be secured against this zero-day and the other disclosed threats.

Go to the About Google Chrome entry in the browser menu, which will force a check for any available update. Once that update has been downloaded and installed, a relaunch button will become available. After relaunching the browser, the update will activate and protect you from the fifth Google Chrome zero-day of the year.

As other browsers that are based around the Chromium engine will likely be impacted by the same vulnerabilities, expect updates for the likes of Brave, Edge and Opera to follow in due course.

August 20 Update:

CISA adds Chrome zero-day to Known Exploited Vulnerabilities Catalog

Although nearly all the mainstream media coverage, not just tech publications, has been about the recently patched Apple iOS and macOS zero-days, that doesn’t mean the Google Chrome one suddenly becomes unimportant. The fact that the U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added CVE-2022-2856 to the ‘Known Exploited Vulnerabilities Catalog’ is proof of that. This list of vulnerabilities that are known to be exploited by threat actors out there in the real world comes with a strong recommendation from CISA to apply available patches as soon as possible. Needless to say, but I will anyway, the two Apple vulnerabilities (CVE-2022-32893 and CVE-2022-32894) are also included in this latest CISA catalog update.

Browser security extends beyond the vulnerabilities issue

However, it’s not just vulnerabilities, or even zero-day vulnerabilities, that the security-minded Google Chrome user needs to be aware of. At the start of August, I reported how a cybercrime group called SharpTongue, said to have connections to another group, Kimsuky, which CISA reports likely to be “tasked by the North Korean regime with a global intelligence gathering mission,” was bypassing the need to collect credentials in order to spy on Gmail messages. The SHARPEXT attack could even read emails of users who had implemented two-factor authentication. It manages this by grabbing authentication cookies in what’s known as an adversary-in-the-middle (AiTM) attack.

The SHARPEXT malware comes by way of, and here’s the ‘not just vulnerabilities’ point, a rogue browser extension. As well as Chrome, the campaign was found to be targeting Edge (based around the same Chromium engine) and a little-known in the West client called Whale, which appears to be used in South Korea. New research from Kaspersky has shone a light on the whole browser extension security issue, and it’s not just restricted to Chromium-based browsers.

Kaspersky research reveals extent of malicious browser extension problem

According to Kaspersky research, in the first six months of 2022 alone, some 1,311,557 users attempted to download malicious or unwanted extensions. That, dear reader, is an increase of 70% on the number affected similarly throughout the whole of 2021. While the delivery of unwanted advertising was the most common target of these browser extensions, that’s not the whole story: extensions with a malware payload were the second most common. Indeed, between January 2020 and June 2022, Kaspersky researchers say some 2.6 million individual users were attacked by such malicious extensions.

Check your Chromium-based browser is up-to-date and patched

And finally, I mentioned in the original Chrome update article that other browsers would be issuing updates in due course. These appear to all now be in place. Refer to the images below to see the latest version numbers for Brave, Edge, and Opera.

Adblock test (Why?)



Source link

Continue Reading

Tech

Building Homes Faster with our Latest 3D Construction Printer

Published

 on

Copenhagen, 22.10.2024 – COBOD International, the global leader in 3D construction printing technology, proudly introduces the BOD3 3D Construction Printer for 3D printing of real concrete. Equipped with an extendable ground-based track system, the BOD3 advances the construction process by eliminating printer downtime between multiple buildings on the same site, setting a new benchmark for productivity and efficiency. The BOD3 is the most advanced solution for high-volume low-rise construction and a very effective alternative to conventional construction methods.

The heart and key feature of the new BOD3 3D printer is the advanced extendable ground-based track system. This system enables limitless extension along the Y-axes (length), expanding the printable area to cover 2 or 3 buildings, and reducing setup time to a single installation for multi-building projects. It’s a game-changer, allowing continuous, uninterrupted printing across large sites, increasing efficiency for high volume and mass production at an unmatchable scale.

 

Render of COBOD BOD3 3D Construction Printer.

The BOD3, COBOD’s third printer model, is the outstanding achievement of years of dedicated research, development, and close collaboration with customers. It is a vital advancement in automated construction technology, directly addressing the urgent global demand for faster, smarter, more efficient and sustainable building solutions. Like every COBOD 3D printer, the BOD3’s modular design offers customization, allowing it to easily adapt to any customer’s size wishes in addition to complying with the various sizes of construction sites anywhere in the world.

The BOD3 follows COBOD’s vision to build smarter through automation. Its operational stand combines the control and monitoring of both the 3D printer and supplementary equipment in one user-friendly system. The Advanced Hose Management System (AHMS) transports 3D printable material from the materials delivery system to the printhead via hoses secured within E-chains, minimizing physical labor and optimizing material flow. With the addition of the dual dosing system for additives, operators can better control the concrete and adapt it to onsite environmental conditions. By introducing additives directly at the printhead, the system reduces drying time between layers, speeding up the overall construction process. Designed for easy operation and precision, the BOD3 can be operated by a small, trained, and certified team, reducing the costs of projects.

Incorporating the innovative Universal X-Carriage, the BOD3 is ready for future COBOD advancements and technologies, like the introduction of additional tools for the printer aimed at insulating, painting, sanding, etc. This ensures long-term versatility and performance that will keep the BOD3 at the forefront of the industry for years to come.

 

Universal X-Carriage with Printhead.

Already deployed to the global market, the BOD3 is currently active in Indonesia, by Modula Tiga Dimensi, Angola, by Power2Build, and Bahrain, by Ab’aad 3D. The customers report faster project execution with near-zero downtime between individual buildings on the same site. The projects showcase the BOD3’s ability to speed up construction and print with real concrete, with 99% locally sourced materials and 1% of innovative D.fab, a co-developed solution by COBOD and Cemex to make concrete 3D printable.

Henrik Lund-Nielsen, Founder and General Manager of COBOD, commented on the BOD3: “The global housing crisis demands a more efficient construction solution that is faster, more efficient, and scalable. The BOD3 is our answer to this challenge. Drawing on years of research and expertise, we’ve designed the BOD3 with innovative features, making it our most cost-effective and efficient model yet for multiple low-rise buildings. Its design supports high-volume, linear production of houses, enabling mass production without compromising quality. The fact that six units have already been sold before its official launch speaks volumes about the BOD3’s market demand and the trust our customers place in our technology.

Michael Holm, Chief Innovation Officer at COBOD, states, “The advanced ground-based track system was developed as a response to our customers’ needs to increase efficiency and productivity. Now the 3D construction printer can be easily extended, and multiple consecutive structures can be printed with minimal repositioning and zero downtime between projects, making 3D construction printing more efficient than ever before.

 

The BOD3 is now available for purchase worldwide; for more information, please visit our website, www.cobod.com, or contact us at info@cobod.com.

 

RELEVANT LINKS

 

ABOUT COBOD

COBOD stands as the global leader in supplying 3D printers for the construction sector, with over 80 printers distributed across North and Latin America, Europe, the Middle East, Africa, and Asia-Pacific. Driven by a mission to revolutionize construction through multifunctional robots based on 3D printing, COBOD envisions automating half of the construction processes to achieve faster, cost-effective, sustainable results with enhanced design versatility.

From residential, commercial, and public buildings, COBOD’s 3D printers have been instrumental in erecting 1- to 3-story structures across all six inhabited continents. The innovative technology also extends to fabricate large-scale data centers, wind turbine towers, tanks, and more.

Embracing an open-source material approach, COBOD collaborates with global partners, including customers, academia, and suppliers. The company, backed by prominent shareholders such as General Electric, CEMEX, Holcim, and PERI, operates from its main office in Copenhagen, Denmark, and regional competence centers in Miami, Florida, and Kuala Lumpur, Malaysia. COBOD’s dynamic team comprises over 100 professionals from 25 diverse nationalities.

 

ABOUT MODULA TIGA DIMENSI

PT Modula Tiga Dimensi is a joint venture between Bakrie & Brothers (BNBR) and COBOD. BNBR focuses on offering and providing solutions for housing backlog problems currently encountered by the country.

Teaming up with COBOD International, the company is now set to adopt the latest 3D printing construction technology and is ready to offer the Indonesian market a new and better solution to housing obstructions.

 

ABOUT POWER2BUILD
Reshaping the construction sector and adapting it to urgent human needs.

Power2Build is a technology company for the construction industry, prepared to establish partnerships with private, public, and non-governmental organizations (NGOs) so that they can make the transition to Build 4.0 through 3DCP.

We offer our clients value-added services and high-quality projects, always with a multidisciplinary approach that brings together the necessary experience to deal with complex issues.

Continue Reading

Tech

Slack researcher discusses the fear, loathing and excitement surrounding AI in the workplace

Published

 on

 

SAN FRANCISCO (AP) — Artificial intelligence‘s recent rise to the forefront of business has left most office workers wondering how often they should use the technology and whether a computer will eventually replace them.

Those were among the highlights of a recent study conducted by the workplace communications platform Slack. After conducting in-depth interviews with 5,000 desktop workers, Slack concluded there are five types of AI personalities in the workplace: “The Maximalist” who regularly uses AI on their jobs; “The Underground” who covertly uses AI; “The Rebel,” who abhors AI; “The Superfan” who is excited about AI but still hasn’t used it; and “The Observer” who is taking a wait-and-see approach.

Only 50% of the respondents fell under the Maximalist or Underground categories, posing a challenge for businesses that want their workers to embrace AI technology. The Associated Press recently discussed the excitement and tension surrounding AI at work with Christina Janzer, Slack’s senior vice president of research and analytics.

Q: What do you make about the wide range of perceptions about AI at work?

A: It shows people are experiencing AI in very different ways, so they have very different emotions about it. Understanding those emotions will help understand what is going to drive usage of AI. If people are feeling guilty or nervous about it, they are not going to use it. So we have to understand where people are, then point them toward learning to value this new technology.

Q: The Maximalist and The Underground both seem to be early adopters of AI at work, but what is different about their attitudes?

A: Maximalists are all in on AI. They are getting value out of it, they are excited about it, and they are actively sharing that they are using it, which is a really big driver for usage among others.

The Underground is the one that is really interesting to me because they are using it, but they are hiding it. There are different reasons for that. They are worried they are going to be seen as incompetent. They are worried that AI is going to be seen as cheating. And so with them, we have an opportunity to provide clear guidelines to help them know that AI usage is celebrated and encouraged. But right now they don’t have guidelines from their companies and they don’t feel particularly encouraged to use it.

Overall, there is more excitement about AI than not, so I think that’s great We just need to figure out how to harness that.

Q: What about the 19% of workers who fell under the Rebel description in Slack’s study?

A: Rebels tend to be women, which is really interesting. Three out of five rebels are women, which I obviously don’t like to see. Also, rebels tend to be older. At a high level, men are adopting the technology at higher rates than women.

Q: Why do you think more women than men are resisting AI?

A: Women are more likely to see AI as a threat, more likely to worry that AI is going to take over their jobs. To me, that points to women not feeling as trusted in the workplace as men do. If you feel trusted by your manager, you are more likely to experiment with AI. Women are reluctant to adopt a technology that might be seen as a replacement for them whereas men may have more confidence that isn’t going to happen because they feel more trusted.

Q: What are some of the things employers should be doing if they want their workers to embrace AI on the job?

A: We are seeing three out of five desk workers don’t even have clear guidelines with AI, because their companies just aren’t telling them anything, so that’s a huge opportunity.

Another opportunity to encourage AI usage in the open. If we can create a culture where it’s celebrated, where people can see the way people are using it, then they can know that it’s accepted and celebrated. Then they can be inspired.

The third thing is we have to create a culture of experimentation where people feel comfortable trying it out, testing it, getting comfortable with it because a lot of people just don’t know where to start. The reality is you can start small, you don’t have to completely change your job. Having AI write an email or summarize content is a great place to start so you can start to understand what this technology can do.

Q: Do you think the fears about people losing their jobs because of AI are warranted?

A: People with AI are going to replace people without AI.

The Canadian Press. All rights reserved.

Source link

Continue Reading

Tech

Biden administration to provide $325 million for new Michigan semiconductor factory

Published

 on

 

WASHINGTON (AP) — The Biden administration said Tuesday that it would provide up to $325 million to Hemlock Semiconductor for a new factory, a move that could help give Democrats a political edge in the swing state of Michigan ahead of election day.

The funding would support 180 manufacturing jobs in Saginaw County, where Republicans and Democrats were neck-in-neck for the past two presidential elections. There would also be construction jobs tied to the factory that would produce hyper-pure polysilicon, a building block for electronics and solar panels, among other technologies.

Commerce Secretary Gina Raimondo said on a call with reporters that the funding came from the CHIPS and Science Act, which President Joe Biden signed into law in 2022. It’s part of a broader industrial strategy that the campaign of Vice President Kamala Harris, the Democratic nominee, supports, while Republican nominee Donald Trump, the former president, sees tariff hikes and income tax cuts as better to support manufacturing.

“What we’ve been able to do with the CHIPS Act is not just build a few new factories, but fundamentally revitalize the semiconductor ecosystem in our country with American workers,” Raimondo said. “All of this is because of the vision of the Biden-Harris administration.”

A senior administration official said the timing of the announcement reflected the negotiating process for reaching terms on the grant, rather than any political considerations. The official insisted on anonymity to discuss the process.

After site work, Hemlock Semiconductor plans to begin construction in 2026 and then start production in 2028, the official said.

Running in 2016, Trump narrowly won Saginaw County and Michigan as a whole. But in 2020 against Biden, both Saginaw County and Michigan flipped to the Democrats.

The Canadian Press. All rights reserved.

Source link

Continue Reading

Trending

Exit mobile version