Categories: News
Tags: Google passkey

Tags:  passkey

Tags:  passwordless future

Tags:  passwordless

Tags:  phishing

Google is offering users the best option to date to securing their accounts from phishing. (Hint: It's not passwords.)



(Read more...)




The post Google Passkeys: How to create one and when you shouldn't appeared first on Malwarebytes Labs.

Google has just brought users closer to a passwordless future.

In a recent blog post, the tech giant introduced the option to create and use a safer, more convenient alternative to passwords: Passkeys, a form of digital credential. So, how do they work?

Passkeys are generated using public-key cryptography, or asymmetric encryption, which involves using a pair of public and private keys. The public key is stored on the side of the app or website, while the private key, a main component of the passkey, is stored on the device. Websites have no access to the value of the passkey. When a Google user logs in to their account using a passkey, Google checks if the website has a corresponding public key.

This method of authentication makes accounts significantly more resilient, because, unlike a password, the key can't be phished, stolen from the website it's stored on, or intercepted in transit. It also means the account cannot be subject to an attack as a result of a weak password or password re-use, because there is no password.

As the authors of the blog put it:

> "Using passwords puts a lot of responsibility on users. Choosing strong passwords and remembering them across various accounts can be hard. In addition, even the most savvy users are often misled into giving them up during phishing attempts. 2SV (2FA/MFA) helps, but again puts strain on the user with additional, unwanted friction and still doesn’t fully protect against phishing attacks and targeted attacks like 'SIM swaps' for SMS verification. Passkeys help address all these issues."

The blog authors identified some benefits users could get out of using Google passkeys:

*   **Guaranteed access.** Suppose you created a passkey on a Google account you access with your smartphone. In that case, you can use this passkey to access that Google account on other devices like a laptop. Synchronizing the passkey to the device isn't needed as long as the phone is near the device and you approve the sign-in on your phone. If you create a passkey for your laptop—or for each device you own—you won't need your phone anymore to access your Google account.
*   "**Backup" key.** Some platforms securely back up your passkeys and sync them with other devices. For example, a passkey created on your iPhone will also be available on your other Apple devices if you're logged in to the same iCloud account. This prevents a user from getting locked out if they lose a device. Passkeys also make upgrading to a new device easier, as you only need to sync it with the rest of your devices.
*   **Phishing and breach protection.** Because passkeys cannot be stolen, phishers won't be able to get their hands on your account credentials. Similarly, passkeys cannot be reused or exposed in a data breach.
*   **It can replace physical security keys.** Google said that passkeys are "strong enough that they can stand in for security keys for users." A security key is a physical device used to sign in to your accounts. Like passkeys, it's another passwordless method of authentication. An example of a security key is YubiKey.

It's worth noting that passkeys use the three common types of information used in MFA: Something you have (like a smartphone), something you are (your biometrics), or something you know (like a PIN or pattern). This makes passkeys a form of MFA. However, according to the FIDO Alliance, some regulatory bodies have yet to make this recognition, something the alliance is already actively working towards.

**Minimum hardware and software requirements**

Google has listed what you'll need in order to create a passkey: Windows 10 or macOS Ventura (or later) running Chrome 109, Safari 16, or Edge 109 (or later), or iOS16 or Android 9 (or later) on a mobile device.

You also need to enable screen lock, especially Bluetooth, if you want to use passkeys on the phone to sign in to another device.

**When you _shouldn't_ create a passkey**

Passkeys should only be created on devices you personally control. That said, you shouldn't make a passkey using a Google Workspace account through a school or employer. You also shouldn't create one on devices you share with other people, like your family computer, as anyone using the device will have access to your Google account. Even if you sign out of your account, once a passkey is created on that device, anyone who can unlock the device can sign in back into your account with the passkey.

**How to create a passkey in two simple steps**

I used an iOS device here.

1\. Go to g.co/passkeys to trigger the process.

You can also log in to your Google account. From the **Home** page, go to **Security**. Scroll down to **How you sign in to Google** and pick **Passkeys** as an added sign-in option. You'll land on the same page as above.

2\. Click **Create a passkey**. An overlay will display, confirming that you can create a passkey on the device. Click **Continue**.

Note: If you have your **iCloud Keychain** disabled, your device will prompt you to enable it.

And you're done!

The first time you sign in, the computer displays a QR code you can scan with your mobile device's camera. Once signed in, you may be prompted to create a passkey for the computer. As we've said, only agree if you don't share the computer with anyone.

If in the future, you decide to stop using passkeys, Google gives you the option to remove them. You can also opt out of using passkeys entirely. In cases when devices have been lost or stolen, or the passkey goes missing or unavailable, you can check Google's recommendations on this Account Help page.

Google isn't the only company that has been working on an alternative to passwords. Apple and Microsoft have also announced they'll support passkeys on their respective platforms to address password problems. 

Watch this space!

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Google Passkeys: How to create one and when you shouldn't

Google unveiled a slew of new privacy, safety, and security features today at its annual developer conference, Google I/O. The tech giant's latest initiatives are aimed at protecting its users from cyber threats, including phishing attacks and malicious websites, while providing more control and transparency over their personal data.
Here is a short list of the newly introduced features -

Privacy / Safety / Security

Google unveiled a slew of new privacy, safety, and security features today at its annual developer conference, Google I/O. The tech giant's latest initiatives are aimed at protecting its users from cyber threats, including phishing attacks and malicious websites, while providing more control and transparency over their personal data.

Here is a short list of the newly introduced features -

*   Improved data control and transparency
*   Gmail Dark Web Scan Report
*   Effortlessly Delete Maps Search History
*   AI-Powered Safe Browsing
*   Content Safety API Expansion
*   About this Image
*   Spam View in Google Drive

Among the newly introduced features, the first on the list is improved data control and transparency. Google has unveiled an update for its Android operating system that allows users to better control location sharing through apps installed on their devices.

"Starting with location data, you will be informed in permission requests when an app shares your information with third-parties for advertising purposes," Jen Fitzpatrick, senior vice president of core systems and experiences, said.

"You can use this information to decide if you want to approve or decline location sharing for each app so you're always in control."

In addition, the company said it's expanding dark web reports to all users with a Gmail account in the U.S. to alert if their sensitive data is circulating on sites not indexed by search engines.

The feature, which was initially made available to Google One subscribers in March 2023, makes it possible to scan the dark web for personally identifiable information such as names, addresses, emails, phone numbers, and Social Security numbers, and seek appropriate guidance.

A third privacy-focused option launched by the tech giant is the ability to delete recent searches from Maps with a single tap as opposed to removing the Maps search history from Web & App Activity.

Other notable features include a new Safe Browsing API and a Spam view in Google Drive that's analogous to Gmail and automatically segregates potentially harmful files or abusive content, which can then be reviewed by users.

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

The search behemoth further said it's expanding its Content Safety API to flag child sexual abuse material (CSAM) in video content, alongside debuting an "About This Image" tool that offers users with more context to ensure reliable access to trustworthy information.

"'About this Image' provides you with important context like when an image or similar images were first indexed by Google, where it may have first appeared, and where else it's been seen online like a news, social or fact checking site," Fitzpatrick said.

The updates come a week after Google enabled passwordless sign-ins using passkeys across Google Accounts on all platforms.

Last month, the tech giant also enacted a new data deletion policy that requires app developers to offer a "readily discoverable option" to users from both within an app and outside of it.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Google Announces New Privacy, Safety, and Security Features Across Its Services

The n8n package 0.218.0 for Node.js allows Directory Traversal.

**n8n@0.226.2**

**Changes (2023-05-03)****Bug Fixes**

*   **core:** Fix bug running addUserActivatedColumn migration on MariaDB (#6157) (aa8e96d)

**n8n@0.227.0**

**Changes (2023-05-03)****Bug Fixes**

*   **AWS S3 Node:** Fix File upload, and add node tests (#6153) (deb4c04)
*   **Compression Node:** Fix issue with decompression failing with uppercase extensions (#6098) (aa59329)
*   **core:** Account for nodes with renamable content (#6109) (c99f158)
*   **core:** Assign Unknown Error only if message or description not present in error (8aedc03)
*   **core:** Avoid using Object.keys on Buffer and other non-plain objects (#6131) (a3aba83)
*   **core:** Better error message in Webhook node when using the POST method (a0dd17e)
*   **core:** Better errors for common status codes fix (700cc39)
*   **core:** Fix hasOwnProperty on augmented objects (#6124) (206b6b9)
*   **core:** Fix bug running addUserActivatedColumn migration on MariaDB (#6157) (570790e)
*   **core:** Fix canceled execution status (#6142) (839a56a)
*   **core:** Improve saml endpoints and audit events (#6107) (c0b1cdd)
*   **core:** Remove SAML config metadataUrl if XML metadata is set directly (#6143) (25fe14b)
*   **core:** Skip auth for controllers/routes that don't use the Authorized decorator, or use Authorized('none') (#6106) (59aee22)
*   Correctly allow sharees to test credential when opening the modal (#6111) (2e73f4a)
*   **Date & Time Node:** Numbers conversions fix (14f7114)
*   **editor:** Change execution list tab loader design (#6120) (188ef04)
*   **editor:** Disable changing of email and pw when SAML login enabled (#6104) (3e9ecd9)
*   **editor:** Fix Show details summary (#6113) (90a62cc)
*   **editor:** Fix copy selection behavior (#6112) (1607aeb)
*   **editor:** Fix cropped off completions docstrings (#6129) (85e8145)
*   **editor:** Fix focus jumping when using chrome autofill (#6140) (c63181b)
*   **editor:** Fix missing Stop Listening button (#6125) (20a72bb)
*   **editor:** Fix quote handling on dollar-sign variable completions (#6128) (51f5990)
*   **editor:** Fix sidebar button styling (#6138) (a72a511)
*   **editor:** Fix unique names for node duplication (#6134) (71ae6c6)
*   **editor:** Fix unscrollable node settings (#6133) (c8ff368)
*   **editor:** Loading state for executions tab (#6100) (4cbb05b)
*   **editor:** Remove pagination from binary data output (#6093) (c6e665a)
*   **editor:** Restrict [empty] in parameter input hint to zero-length string (#6003) (8862e1e)
*   **editor:** Show error in RLC if credentials are not set (#6108) (2c240a0)
*   **HTTP Request Node:** Add description for 'Specify Body' option (#6114) (af097ae)
*   **HTTP Request Node:** Always lowercase headers (983e6e1)
*   **Mattermost Node:** Fix base url trailing slash error (#6097) (25a386d)
*   **Merge Node:** Do not error if expected key is missing (d219af7)
*   Prevent displaying an endless timer in the execution list for finished executions (#6137) (701105e)
*   Prevent invocations of 'GET /rest/license' from returning an error when ephemeral licenses are used (#6154) (a3d26ef)
*   **Slack Node:** Restore ability to send text in addition of blocks or attachments (8669f95)

**Features**

*   **core:** Add notice to alert users a new version is available (cb497fb)
*   **editor:** Add support for loadOptionsDependsOn to RLC (#6101) (b17d5f9)
*   **editor:** Add version controls settings (WIP) (#6036) (0c9ce3a)
*   **Item Lists Node:** Split out items work on objects as well as arrays (c65ac03)
*   **Microsoft Excel 365 Node:** Overhaul (5364a2d)

**n8n@0.226.1**

**Changes (2023-05-02)****Bug Fixes**

*   **Compression Node:** Fix issue with decompression failing with uppercase extensions (#6098) (7136500)
*   **core:** Account for nodes with renamable content (#6109) (b561d46)
*   **core:** Fix hasOwnProperty on augmented objects (#6124) (2f015c0)
*   **core:** Fix canceled execution status (#6142) (1796101)
*   **core:** Skip auth for controllers/routes that don't use the Authorized decorator, or use Authorized('none') (#6106) (9d44991)
*   Correctly allow sharees to test credential when opening the modal (#6111) (240bb47)
*   **Date & Time Node:** Numbers conversions fix (e11e7cd)
*   **editor:** Change execution list tab loader design (#6120) (ffc033f)
*   **editor:** Fix Show details summary (#6113) (e12bafb)
*   **editor:** Fix copy selection behavior (#6112) (0efd94a)
*   **editor:** Fix cropped off completions docstrings (#6129) (06594cc)
*   **editor:** Fix missing Stop Listening button (#6125) (dcbd2d2)
*   **editor:** Fix quote handling on dollar-sign variable completions (#6128) (c23ad35)
*   **editor:** Fix sidebar button styling (#6138) (d3f4bc1)
*   **editor:** Fix unique names for node duplication (#6134) (48a4068)
*   **editor:** Fix unscrollable node settings (#6133) (f762f16)
*   **editor:** Loading state for executions tab (#6100) (2e12c50)
*   **editor:** Remove pagination from binary data output (#6093) (7b7d9de)
*   **editor:** Show error in RLC if credentials are not set (#6108) (5bf3400)
*   **HTTP Request Node:** Add description for 'Specify Body' option (#6114) (69b6ba8)
*   **HTTP Request Node:** Always lowercase headers (31c56a1)
*   **Mattermost Node:** Fix base url trailing slash error (#6097) (788fda1)
*   **Merge Node:** Do not error if expected key is missing (8b59564)
*   Prevent displaying an endless timer in the execution list for finished executions (#6137) (2672896)
*   **Slack Node:** Restore ability to send text in addition of blocks or attachments (625d672)

**n8n@0.226.0**

**Changes (2023-04-26)****Bug Fixes**

*   **Code Node:** Update vm2 to address CVE-2023-30547 (#6039) (8268f23)
*   **core:** Improve domain and url matching for extractDomain and extractUrl (#6010) (33fb732)
*   **core:** Serialize dates and regexps when reading from augmented objects (#6086) (a4eb46a)
*   **core:** Skip license activation when instance was already activated (#6064) (eaf7090)
*   **editor:** Clean up demo and template callouts from workflows page (#6023) (4ee5083)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (0970ec0)
*   **editor:** Fix typo in SSO upgrade link (#6031) (9b59f1d)
*   **editor:** Resolve expressions for grandparent nodes (#5859) (a19d444)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (41660d9)
*   **editor:** Update LDAP and Log streaming paywalls (#6069) (8a3b3e5)
*   **editor:** Update SSO upgrade link (#6016) (953198e)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (a68330f)

**Features**

*   **core:** Add license:info command (#6047) (ab12d3e)
*   **core:** Add SSH key generation (#6006) (71ed1f4)
*   **core:** Add support for digestAuth to httpRequest and declarative style (#5676) (62f993c)
*   **core:** Manage version control settings (#6079) (f3b4701)
*   **core:** Upgrade google-timezones-json to use the correct timezone for Sao Paulo (#6042) (b8cb5d7), closes #2647
*   **editor:** Add disable template experiment (#5963) (a74284b)
*   **editor:** Add SQL editor support (#5517) (70aaf24)
*   **editor:** Enhance Node Creator actions view (#5954) (390841b)
*   **editor:** Version control (WIP) (#6013) (0e0a064)
*   **editor:** Version control paywall (WIP) (#6030) (ef79b03)
*   **Google BigQuery Node:** Node improvements (#4877) (9817a15)

**n8n@0.225.2**

**n8n@0.224.4**

**n8n@0.225.1**

**Changes (2023-04-20)****Bug Fixes**

*   **editor:** Clean up demo and template callouts from workflows page (#6023) (6ec1c45)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (1b9e047)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (e9f8cfe)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (6d02ae5)

**n8n@0.224.2**

**Changes (2023-04-20)****Bug Fixes**

*   **core:** Fix paired item returning wrong data (#5898) (2a45441)
*   **core:** Make getExecutionId available on all nodes types (#5990) (8373aab)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (d8fce5b)
*   **editor:** Fix moving canvas on middle click preventing lasso selection (#5996) (a7a5778)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (b475c8f)
*   **Google Sheets Trigger Node:** Return actual error message (5e59141)
*   **HTTP Request Node:** Fix itemIndex in HTTP Request errors (#5991) (4a521a4)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (14c9b5e)

**n8n@0.225.0**

**Changes (2023-04-19)****Bug Fixes**

*   **core:** Fix broken API permissions in public API (#5978) (49d838f)
*   **core:** Fix paired item returning wrong data (#5898) (b13b7d7)
*   **core:** Improve SAML connection test result views (#5981) (4c994fa)
*   **core:** Make getExecutionId available on all nodes types (#5990) (c42820e)
*   **core:** Skip SAML onboarding for users with first- and lastname (#5966) (8474cd3)
*   **editor:** Add padding to prepend input (#5874) (cd89489)
*   **editor:** Cleanup demo/video experiment (#5974) (c171365)
*   **editor:** Enterprise features missing with UM (#5995) (f9a810a)
*   **editor:** Fix moving canvas on middle click preventing lasso selection (#5996) (3c2a569)
*   **editor:** Make sure to redirect to blank canvas after personalization modal (#5980) (7c474d3)
*   **editor:** Only treat as CTRL pressed by default on touch devices for MouseEvent (#5968) (536d810)
*   **editor:** Fix n8n-checkbox alignment (#6004) (f544826)
*   **Code Node:** Consistently handle various kinds of data returned by user code (#6002) (f9b3aea)
*   **Github Trigger Node:** Remove content\_reference event (#5830) (d288a91)
*   **Google Sheets Trigger Node:** Return actual error message (ba5b4eb)
*   **HTTP Request Node:** Fix itemIndex in HTTP Request errors (#5991) (b351c62)
*   **NocoDB Node:** Fix for updating or deleting rows with not default primary keys (ee7f863)
*   **OpenAI Node:** Update models to only show those supported (#5805) (29959be)
*   **OpenAI Node:** Update OpenAI Text Moderate input placeholder text (#5823) (6b9909b)

**Features**

*   **core:** Add variables feature (#5602) (1bb9871)
*   **core:** Add versionControl feature flag (#6000) (33299ca)
*   **core:** Support for google service account in HTTP node (0b48088)
*   **editor:** Add Ask AI preview (#5916) (f8f8374)
*   **GitLab Node:** Add Additional parameters for File List (#5621) (3810039)
*   **MySQL Node:** Overhaul (0a53c95)

**n8n@0.222.3**

**Changes (2023-04-14)****Bug Fixes**

*   **core:** Fix broken API permissions in public API (#5978) (f4be887)
*   **editor:** Only treat as CTRL pressed by default on touch devices for MouseEvent (#5968) (57af90f)
*   **editor:** Update vite legacy-plugin browser target (no-changelog) (#5952) (f565b16)

CVE-2023-27562: Releases · n8n-io/n8n

Categories: Business
How MSPs can prepare for the complex landscape of mobile malware.



(Read more...)




The post Navigating mobile malware trends: Crucial insights and predictions for MSPs  appeared first on Malwarebytes Labs.

Whether a company gives them out or they're owned by the employees or students, mobile devices are like honey for cybercriminals. And the kicker? Most of these devices are not protected enough.

Just check out the following stats from last year:

*   **18 percent of clicked phishing emails** in 2022 came from a mobile device. (Verizon Mobile Security Index 2022)
*   **46 percent of organizations** that had suffered a mobile-related security breach in 2022 said that app threats were a contributing factor. (Verizon Mobile Security Index 2022)
*   9 percent of organizations **suffered a mobile malware attack in 2022**. (Check Point 2023 Cyber Security Report)

For Managed Service Providers (MSPs), these stats represent more than just figures; they underscore the need for proactive action across their customers’ mobile endpoints.

In this post, we’ll delve into mobile malware trends, gather critical insights, and anticipate future scenarios to prepare MSPs for the complex landscape of mobile malware.

**Mobile devices: A new security frontier for MSPs****Understanding Android Droppers: A serious threat to mobile devices**

In terms of malware, the most menacing of mobile threats MSPs need to watch out for are Android droppers.

“Mobile Droppers represent the most **‘Trojan’ of all the Trojan Horses**,” said Nathan Collier, Senior Malware Intelligence Analyst at Malwarebytes. “Pretending to be an innocent app, like an app you have to pay for on Google Play found free on a third-party app store, tricks the user to allow \[the malicious dropper\] to enter onto their mobile device.“

Once installed, droppers secretly drop another piece of malware, often more vicious than the dropper itself. This could be any other type of malware, such as HiddenAds or Adware to generate money by ads-per-click. Or even scarier—a backdoor could be placed or a nefarious piece of spyware.

“Droppers can install copies of themselves, and because they can be used to drop software that downloads other malware, they can act as a permanent backdoor into a smartphone.”

According to our 2023 State of Malware Report, droppers accounted for **14 percent of Android detections**.

Examples of recent Android malware

**iOS isn't off the hook**

While it's generally harder for malware to get a foothold on iOS, phishing attacks are still a threat. These scams trick users into visiting malicious websites that masquerade as legitimate ones, usually with the promise of a prize or with a request that users install a bogus security app.

“Another trick is a fake ‘You’re infected’ phishing site to install a fake security app,” Collier said. “Although the app you install, often from the Apple store, may be safe, the scammers still get paid-per-click for redirecting to the app.”

The number of phishing sites targeting mobile has shot up by 50 percent from 2019 to 2021. These scams come in all shapes and sizes, like email, banking, and SMS-based (smishing) threats. Some even try to con users into giving up legit two-factor authentication codes.

These scammers often pretend to be big-name companies like Apple, PayPal, or Amazon, making their scams harder to spot.

**Predicting the future of mobile malware**

Each year, we're seeing more and more mobile malware, and there's little evidence that trend will stop.

“Year over year, we have seen **an increase of mobile malware since its induction**,” said Collier. “As the use of mobile devices increases, so does mobile malware. This is a trend that will continue for the unforeseeable future.”

As an MSP, you need to stay one step ahead of mobile malware to help keep your clients safe. Collier is predicting an uptick in malware and potentially unwanted programs (PUPs) targeting the financial sector.

“This includes fake banking apps to steal online banking credentials, and fake credit loan apps to trick users into entering highly personal information as you would for a loan application,” Collier said. “More specifically, Android/Trojan.Bankbot and Android/PUP.Riskware.FakeCreditLoan.”

Understanding mobile malware trends and being proactive in defending against them is key, but what options are available for comprehensive combined endpoint protection?

**Mobile Device Management (MDM) isn't the solution**

A common misconception that we hear when we talk about mobile endpoint security is that MDM is the solution to all of our mobile malware and phishing woes.

It’s not.

Mobile device management services only secure use of corporate data, but are not designed to counter threats such as malware and phishing on iOS and Android devices.

MSPs should look beyond MDM platforms and toward mobile security products that use a variety of techniques, including behavioral analysis, to detect mobile threats. Some features of a robust mobile threat defense product include:

*   24/7 real-time protection against emerging threats
*   Advanced antivirus, anti-malware, anti-spyware capabilities
*   Malicious app protection
*   App privacy audit
*   Safe web browsing
*   Block ads and ad trackers
*   Filters suspicious fraudulent texts
*   Spam call blocking
*   Malwarebytes makes mobile device security easy

With Malwarebytes Mobile Security for MSPs, you can monitor and protect your clients’ mobile investments from a single pane of glass.

In OneView, our cloud-hosted security platform made for MSPs, all you have to do to get started is activate the endpoint agent for your clients' mobile devices.

From there, you set how your mobile endpoints behave by adding a new policy and selecting Web protection and Ad block for iOS and Behavior protection for ChromeOS and Android.

Once you save this policy, you’re set!

MSPs can easily begin protecting Chromebooks, Android, iPadOS, and iOS devices, guarding against the latest mobile threats such as ransomware, malicious apps, and PUPs.

With real-time protection, your customers can also prevent accidental access to harmful websites, safeguard against malicious apps, block unwanted in-app ads, and enable a secure mobile experience for their employees.

The Malwarebytes Mobile Security app on IOS (left) and Android (right)

The statistics don't lie—phishing and malware pose a big threat to mobile endpoint security in 2023. But with a mobile threat defense solution like Malwarebytes Mobile Security, MSPs can crush threats like these and more. Get a free trial and/or quote below!

**Try MSP Mobile Security**

Navigating mobile malware trends: Crucial insights and predictions for MSPs 

Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Smart Campus Android App Advisory**

**Summary: **

A potential security vulnerability in the Intel® Smart Campus Android application may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2022-46645

Description: Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

**Affected Products:  
**

Intel® Smart Campus Android application before version 9.9.

**Recommendations:**

Intel recommends updating the Intel® Smart Campus Android application to version 9.9 or later. Updates are available for download at this location:

https://play.google.com/store/apps/details?id=com.intel.smartbuilding21400

**Acknowledgements:**

Intel would like to thank Sheikh Rishad for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

05/09/2023

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2022-46645: INTEL-SA-00815

Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable denial of service via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Retail Edge Mobile App Advisory**

Intel ID:

INTEL-SA-00847

Advisory Category:

Software

Impact of vulnerability:

Escalation of Privilege, Denial of Service, Information Disclosure

Severity rating:

HIGH

Original release:

05/09/2023

Last revised:

05/09/2023

**Summary: **

Potential security vulnerabilities in the Intel® Retail Edge Mobile application may allow escalation of privilege, denial of service or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities.

**Vulnerability Details:**

CVEID: CVE-2022-41690

Description: Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.1 High

CVSS Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVEID: CVE-2023-25772

Description: Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.0 Medium

CVSS Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVEID: CVE-2022-46279

Description: Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable information disclosure via local access.

CVSS Base Score: 5.0 Medium

CVSS Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

**Affected Products:**

Intel® Retail Edge Mobile iOS application before version IREP App iOS 3.4.7.

Intel® Retail Edge Mobile android application before version 3.0.301145-RELEASE.

**Recommendations:**

Intel recommends updating the Intel® Retail Edge Mobile (IREP) iOS application to version 3.4.7 or later.

Updates are available for download at this location:

https://apps.apple.com/us/app/intel-retail-edge-program/id787231790

Intel recommends updating the Intel® Retail Edge Mobile android application to version 3.0.301145-RELEASE or later.

Updates are available for download at this location:

https://play.google.com/store/apps/details?id=com.phonegap.IREPMobile&hl=en\_US&gl=US

**Acknowledgements:**

Intel would like to thank Sheikhrishad (CVE-2022-41690, CVE-2022-25772 and CVE-2022-46279) for reporting these issues.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

05/09/2023

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-25772: INTEL-SA-00847

Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Unite® Android App Advisory**

Intel ID:

INTEL-SA-00825

Advisory Category:

Software

Impact of vulnerability:

Denial of Service, Information Disclosure

Severity rating:

MEDIUM

Original release:

05/09/2023

Last revised:

05/09/2023

**Summary: **

Potential security vulnerabilities in the Intel® Unite® android application may allow information disclosure or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities.

**Vulnerability Details:**

CVEID: CVE-2023-25179

Description: Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVEID: CVE-2023-23573

Description: Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure via local access.

CVSS Base Score: 4.4 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

**Affected Products:**

Intel® Unite® android application before Release 17.

**Recommendations:**

Intel recommends updating the Intel® Unite® android application to Release 17 or later.

Updates are available for download at this location:

https://play.google.com/store/apps/details?id=com.intel.unite

**Acknowledgements:**

Intel would like to thank Sheikh Rishad for reporting these issues.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

05/09/2023

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-25179: INTEL-SA-00825

Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denial of service via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Connect M Android App Advisory**

Intel ID:

INTEL-SA-00779

Advisory Category:

Software

Impact of vulnerability:

Escalation of Privilege, Denial of Service

Severity rating:

MEDIUM

Original release:

05/09/2023

Last revised:

05/09/2023

**Summary: **

Potential security vulnerabilities in the Intel® Connect M Android application may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities.

**Vulnerability Details:**

CVEID: CVE-2022-41801

Description: Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.0 Medium

CVSS Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVEID: CVE-2022-41769

Description: Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 4.8 Medium

CVSS Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

**Affected Products:**

Intel® Connect M Android application before version 1.82.

**Recommendations:**

Intel recommends updating the Intel® Connect M Android application to version 1.82 or later.

Updates are available for download at these locations:

https://play.google.com/store/apps/details?id=com.intel.connect

**Acknowledgements:**

Intel would like to thank Sheikh Rishad for reporting these issues.

**Revision History**

Revision

Date

Description

1.0

05/09/2023

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2022-41801: INTEL-SA-00779

A few weeks ago, the 32nd edition of RSA, one of the world's largest cybersecurity conferences, wrapped up in San Francisco. Among the highlights, Kevin Mandia, CEO of Mandiant at Google Cloud, presented a retrospective on the state of cybersecurity. During his keynote, Mandia stated:
"There are clear steps organizations can take beyond common safeguards and security tools to strengthen their

A few weeks ago, the 32nd edition of RSA, one of the world's largest cybersecurity conferences, wrapped up in San Francisco. Among the highlights, Kevin Mandia, CEO of Mandiant at Google Cloud, presented a retrospective on the state of cybersecurity. During his keynote, Mandia stated:

_"There are clear steps organizations can take beyond common safeguards and security tools to strengthen their defenses and increase their chances of detecting, thwarting or minimizing attack \[...\]_ **_Honeypots_**_, or fake accounts deliberately left untouched by authorized users,_ **_are effective at helping organizations detect intrusions or malicious activities that security products can't stop_**".

"Build honeypots" was one of his seven pieces of advice to help organizations avoid some of the attacks that might require engagement with Mandiant or other incident response firms.

As a reminder, honeypots are **decoy systems** that are set up to lure attackers and divert their attention away from the actual targets. They are typically used as a security mechanism to detect, deflect, or study attempts by attackers to gain unauthorized access to a network. Once attackers interact with a honeypot, the system can collect information about the attack and the attacker's tactics, techniques, and procedures (TTPs).

In a digital age where data breaches are increasingly common despite growing budgets allocated to security each year, Mandia pointed out that it is crucial to take a proactive approach to limit the impact of data breaches. Hence the need to turn the tables on attackers and the renewed interest in honeypots.

**What Fishing Lures Are to Fishing Nets**

Although honeypots are an effective solution for tracking attackers and preventing data theft, they have yet to be widely adopted due to their setup and maintenance difficulties. To attract attackers, a honeypot needs to appear legitimate and isolated from the real production network, making them challenging to set up and scale for a blue team looking to develop intrusion detection capabilities.

But that's not all. In today's world, the software supply chain is highly complex and made up of many third-party components like SaaS tools, APIs, and libraries that are often sourced from different vendors and suppliers. Components are added at every level of the software building stack, challenging the notion of a "safe" perimeter that needs to be defended. This moving line between what is internally controlled and what is not can defeat the purpose of honeypots: in this DevOps-led world, source code management systems and continuous integration pipelines are the real bait for hackers, which traditional honeypots cannot imitate.

To ensure the security and integrity of their software supply chain, organizations need new approaches, such as honeytokens, which are to honeypots what fishing lures are to fishing nets: they require minimal resources but are highly effective in detecting attacks.

**Honeytoken Decoys**

Honeytokens, a subset of honeypots, are designed to appear like a legitimate credential or secret. When an attacker uses a honeytoken, an alert is immediately triggered. This allows defenders to take swift action based on the indicators of compromise, such as IP address (to distinguish internal from external origins), timestamp, user agents, source, and logs of all actions performed on the honeytoken and adjacent systems.

With honeytokens, the bait is the credential. When a system is breached, hackers typically search for easy targets to move laterally, escalate privileges, or steal data. In this context, programmatic credentials like cloud API keys are an ideal target for scanning as they have a recognizable pattern and often contain useful information for the attacker. Therefore, they represent a prime target for attackers to search for and exploit during a breach. As a result, they are also the easiest bait for defenders to disseminate: they can be hosted on cloud assets, internal servers, third-party SaaS tools, as well as workstations or files.

On average, it takes 327 days to identify a data breach. By spreading honeytokens in multiple locations, security teams can detect breaches within minutes, enhancing the security of the software delivery pipeline against potential intrusions. The **simplicity** of honeytokens is a significant advantage **eliminating the need for the development of an entire deception system**. Organizations can easily create, deploy, and manage honeytokens on an enterprise scale, securing thousands of code repositories simultaneously.

**The Future of Intrusion Detection**

The field of intrusion detection has remained under the radar for too long in the DevOps world. The reality on the ground is that software supply chains are the new priority target for attackers, who have realized that development and build environments are much less protected than production ones. Making the honeypot technology more accessible is crucial, as well as making it easier to roll it out at scale using automation.

GitGuardian, a code security platform, recently launched its Honeytoken capability to fulfill this mission. As a leader in secrets detection and remediation, the company is uniquely positioned to transform a problem, secrets sprawl, into a defensive advantage. For a long time, the platform has emphasized the importance of sharing security responsibility between developers and AppSec analysts. Now the goal is to "shift left" on intrusion detection by enabling many more to generate decoy credentials and place them in strategic places across the software development stack. This will be made possible by providing developers with a tool allowing them to create honeytokens and place them in code repositories and the software supply chain.

The Honeytoken module also automatically detects code leaks on GitHub: when users place honeytokens in their code, GitGuardian can determine if they have been leaked on public GitHub and where they did, significantly reducing the impact of breaches like the ones disclosed by Twitter, LastPass, Okta, Slack, and others.

**Conclusion**

As the software industry continues to grow, it is essential to make security more accessible to the masses. Honeytokens offers a proactive and simple solution to detect intrusions in the software supply chain as soon as possible. They can help companies of all sizes secure their systems, no matter the complexity of their stack or the tools they are using: Source Control Management (SCM) systems, Continuous Integration Continuous Deployment (CI/CD) pipelines, and software artifact registries, among others.

With its zero-setup and easy-to-use approach, GitGuardian is integrating this technology to help organizations create, deploy and manage honeytokens on a larger enterprise scale, significantly reducing the impact of potential data breaches.

The future of honeytokens looks bright, and that's why it was little surprise to see Kevin Mandia praise the benefits of honeypots to the largest cybersecurity companies at RSA this year.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Why Honeytokens Are the Future of Intrusion Detection

We talk to the Signal Foundation’s Meredith Whittaker about how the surveillance economy is newer than we all might realize—and what we can do to fight back.

Tag

#google