adplus-dvertising
Connect with us

Tech

Scattered Spider hackers use old Intel driver to bypass security

Published

 on

A financially motivated threat actor tracked as Scattered Spider was observed attempting to deploy Intel Ethernet diagnostics drivers in a BYOVD (Bring Your Own Vulnerable Driver) attack to evade detection from EDR (Endpoint Detection and Response) security products.

The BYOVD technique involves threat actors using a kernel-mode driver known to be vulnerable to exploits as part of their attacks to gain higher privileges in Windows.

Because device drivers have kernel access to the operating system, exploiting a flaw in them allows threat actors to execute code with the highest privileges in Windows.

300x250x1

Crowdstrike saw this new tactic right after the publication of the cyberintelligence firm’s previous report on Scattered Spider at the start of last month.

According to the latest Crowdstrike report, the hackers attempted to use the BYOVD method to bypass Microsoft Defender for Endpoint, Palo Alto Networks Cortex XDR, and SentinelOne.

Disabling security products

CrowdStrike reports that the Scattered Spider threat actor was seen attempting to exploit CVE-2015-2291, a high-severity vulnerability in the Intel Ethernet diagnostics driver that allows an attacker to execute arbitrary code with kernel privileges using specially crafted calls.

Although this vulnerability was fixed in 2015, by planting an older, still vulnerable version on the breached devices, the threat actors can leverage the flaw no matter what updates the victim has applied to the system.

The driver used by Scattered Spider is a small 64-bit kernel driver with 35 functions, signed by different certificates stolen from signing authorities like NVIDIA and Global Software LLC, so Windows doesn’t block it.

The threat actors use these drivers to disable endpoint security products and limit the defenders’ visibility and prevention capabilities, laying the ground for subsequent phases of their operation on the targeted networks.

Upon startup, the driver decrypts a hard-coded string of targeted security products and patches the target drivers at hard-coded offsets.

The injected malware routine ensures that the security software drivers still appear to be functioning normally even though they no longer protect the computer.

Crowdstrike says ‘Scattered Spider’ has a very narrow and specific targeting scope but warns that no organizations can afford to ignore the possibility of BYOVD attacks.

Recently, we reported on other high-profile threat actors, such as the BlackByte ransomware gang and the North Korean hacking group Lazarus utilizing BYOVD attacks to power their intrusions with elevated Windows privileges.

A long-standing Windows problem

Microsoft tried to fix this known security problem on Windows by introducing a blocklist in 2021.

However, the issue wasn’t addressed decisively, as Windows does not block these drivers by default unless you run Windows 11 2022 and later, which came out in September 2022.

Even worse, as ArsTechnica reported in October, Microsoft only updated the driver block list on every major release of Windows, leaving devices vulnerable to these types of attacks. Microsoft has since released updates that fix this servicing pipeline to update the driver block list properly.

Microsoft recommends that Windows users enable the driver blocklist to protect against these BYOVD attacks. This support article provides information on enabling the blocklist using the Windows Memory Integrity feature or Windows Defender Application Control (WDAC).

Unfortunately, enabling Memory Integrity on devices that may not have newer drivers can be difficult.

728x90x4

Source link

Continue Reading

Tech

Apple announces Worldwide Developers Conference dates, in-person event – CityNews Toronto

Published

 on


Apple has announced their annual developers conference will take place June 10 through June 14.

The big summer event will be live-streamed, but some select developers have been invited to attend in-person events at Apple’s campus in Cupertino, California, on June 10.

The company typically showcases their latest software and product updates — including the iPhone, iPad, Apple Watch, AppleTV and Vision Pro headset — during a keynote address on the first day.

300x250x1

Contributing to a drop in Apple’s stock price this year is concern it lags behind Microsoft and Google in the push to develop products powered by artificial intelligence technology. While Apple tends to keep its product development close to the vest, CEO Tim Cook signaled at the company’s annual shareholder meeting in February that it has been making big investments in generative AI and plans to disclose more later this year.

The week-long conference will have opportunities for developers to connect with Apple designers and engineers to gain insight into new tools, frameworks and features, according to the company’s announcement.

The Associated Press

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Tech

iPhone 16 Rumors Point to Action Button and New, Vertical Camera Layout – CNET

Published

 on


The upcoming iPhone 16 and iPhone 16 Pro are still months away from their expected launch this fall, but a new set of images published online may give us a better sense of their potential features. Among the revelations, the iPhone 16 may include an action button, similar to the one on last year’s iPhone 15 Pro, and it may have redesigned cameras in a vertical stack.

AppleInsider published a series of photos it says show dummy 3D prints of the upcoming iPhone 16 and iPhone 16 Pro from an unnamed leaker. Aside from the action button and reworked cameras on the iPhone 16, AppleInsider also said its source found the iPhone 16 Pro to be “slightly larger” than its predecessor. Analysts had earlier said they expect the Pro model screens will grow somewhat.

Read more: iPhone 16: All the Major Rumors on Apple’s Next iPhone

300x250x1

The new details suggest that a series of expected hardware updates are likely for this year’s new iPhones. Apple typically announces new iPhones around September, and the company tends to offer incremental upgrades to each new phone, introducing, over the period of several years, better cameras, screens and battery life, features that end up seeming like major upgrades when people get around to buying a new phone

Last year, Apple added a new titanium frame, action button and USB-C charging to its iPhone 15 Pro, which starts at $999. For its entry-level iPhone, Apple followed its well-worn strategy of trickling pro features down to the mainstream, adding the iPhone 14 Pro’s well-received Dynamic Island to the $799 iPhone 15, along with USB-C charging.

AppleInsider didn’t indicate whether its leaker had divined a reason for the iPhone 16’s shifted camera placements, but the two lenses will now reportedly be stacked one on top of the other, instead of diagonally. Apple has previously said it uses stacked lenses on the iPhone 15 Pro for spatial video capture, a key new technology the company highlighted as part of its $3,499 Apple Vision Pro headset, released in February.

Though AppleInsider’s leaks appear to confirm many previous rumors, not all renders and 3D prints are accurate, something the rumor blog notes itself in its report. Apple didn’t immediately respond to a request for comment about the veracity of the leaks.

Watch this: What Google Gemini AI on the iPhone Could Look Like

08:16

I Took 600+ Photos With the iPhone 15 Pro and Pro Max. Look at My Favorites

See all photos

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Tech

Leaked iPhone 16 dummy units hint at larger sizes and new buttons

Published

 on

The iPhone 15 Pro Max, with a 6.7-inch screen
(Image credit: Future)

We’re already counting down to the arrival of the iPhone 16 series – most probably sometime in September – and a leak showing dummy units of the upcoming phones has revealed a few of the changes we can expect to see later this year.

These dummy units are usually based on supply chain information, and have various business uses – like helping case manufacturers get their wares ready for new phones before they’re launched, for example. In this case, the images were posted to Chinese social network Weibo, as spotted by MacRumors.

Perhaps the most interesting reveal from these blocks of plastic and metal is that they show the previously rumored increase in size for the iPhone 16 Pro and iPhone 16 Pro Max displays – up to 6.3 inches (from 6.1 inches) and 6.9 inches (from 6.7 inches) respectively.

That’s not a huge jump of course, but it does mean more screen space for apps and media. The bezels are apparently shrinking down to accommodate the larger screens, which means the increase in the physical size of these handsets is only a slight one.

300x250x1

On the button

iPhone 16 dummy units leak

The next iPhones might look a bit like this, but less blue (Image credit: Weibo)

Further reveals from this leak match up with what we’ve heard before: that all four models are going to get the Action button that replaced the Ring/Silent switch on the 2023 Pro models, as well as a brand-new Capture button for getting more creative with photos.

Also of note is the redesigned rear camera module that we think is coming to the back of the iPhone 16 and iPhone 16 Plus. The new vertical, pill-shaped look has been leaked already, but this is more evidence that it’s on the way – taking us back to a design that’s more reminiscent of the iPhone 12, which came out in 2020.

As always with such rumors, be somewhat cautious about reading too much into the look of these dummy units. That said, as more and more similar leaks pile up, it becomes more likely that they’re based on accurate information.

The next big Apple date for your calendar is WWDC 2024 – its Worldwide Developers Conference starts on June 10, at which time we should hear much more about what’s coming this year with iOS 18 and Apple’s other software platforms.

You might also like

Freelance Contributor

Dave is a freelance tech journalist who has been writing about gadgets, apps and the web for more than two decades. Based out of Stockport, England, on TechRadar you’ll find him covering news, features and reviews, particularly for phones, tablets and wearables. Working to ensure our breaking news coverage is the best in the business over weekends, David also has bylines at Gizmodo, T3, PopSci and a few other places besides, as well as being many years editing the likes of PC Explorer and The Hardware Handbook.

Leaked iPhone 16 dummy units hint at larger sizes and new buttons

Adblock test (Why?)

728x90x4

Source link

Continue Reading

Trending