We are pleased to announce the provisioning of Red Hat OpenShift Dedicated clusters on Google Cloud Shielded VMs is now generally available. This blog gives a short overview of Shielded VMs and the new configuration parameter introduced in the OpenShift Dedicated provisioning workflow.Shielded VMs are specialized VMs on Google Cloud with extra security features such as secure boot, firmware and integrity monitoring and rootkit protection. This protects enterprise workloads from threats like remote attacks, privilege escalation, and malicious insiders.Red Hat customers can optionally select Ena

We are pleased to announce the provisioning of Red Hat OpenShift Dedicated clusters on Google Cloud Shielded VMs is now generally available. This blog gives a short overview of Shielded VMs and the new configuration parameter introduced in the OpenShift Dedicated provisioning workflow.

Shielded VMs are specialized VMs on Google Cloud with extra security features such as secure boot, firmware and integrity monitoring and rootkit protection. This protects enterprise workloads from threats like remote attacks, privilege escalation, and malicious insiders.

Red Hat customers can optionally select Enable Secure Boot for Shielded VMs to use Shielded VMs when installing OpenShift Dedicated clusters via the OpenShift Cluster Manager Hybrid Cloud Console. This feature is available in OpenShift Dedicated version 4.13.0 or higher.

Since **Secure Boot support for Shielded VMs** is an install time setting, existing OpenShift Dedicated clusters deployed on Google Cloud cannot be edited to support Shielded VMs. One must create new clusters to enable use of Shielded VMs.

For more details, refer to the prerequisites and steps to create an OpenShift Dedicated cluster on Google Cloud Platform.

_Shielded VM setting in the OpenShift Dedicated cluster creation wizard_

With support for this feature, OpenShift Dedicated users can set constraints/compute.requireShieldedVm Google Cloud organization policy constraint to True to be sure all Google Cloud Compute Engine VM instances created within the Google Cloud organization are Shielded VMs. 

There is no additional cost for provisioning OpenShift Dedicated clusters on Google Cloud with Shielded VM support. Also, use of Shielded VM does not incur additional infrastructure costs on top of the Google Cloud Compute Engine pricing. For more details, refer Google Cloud Shielded VM pricing.

**Try OpenShift Dedicated from the Google Cloud Marketplace**

OpenShift Dedicated purchased from the Google Cloud Marketplace is an easy and self-service way to try OpenShift Dedicated with a flexible pay-as-you-go consumption model. You can also retire a portion of your Google Cloud committed spend when purchasing OpenShift Dedicated.

Red Hat OpenShift Dedicated is a fully managed application platform that helps you more quickly build, deploy, and scale applications, rather than having to deal with the underlying infrastructure. Get started with OpenShift Dedicated on Google Cloud today.

**Additional resources on this topic**

*   Shielded VMs in Google Cloud
*   OpenShift Dedicated on Google Cloud Marketplace listing
*   Steps to Create a cluster on Google Cloud Platform in OpenShift Dedicated documentation
*   Cloud deployment options in OpenShift Dedicated documentation
*   Google Cloud organization policy constraints

Deploying Red Hat OpenShift Dedicated clusters on Shielded Virtual Machines

In a test at one station, Transport for London used a computer vision system to try and detect crime and weapons, people falling on the tracks, and fare dodgers, documents obtained by WIRED show.

Thousands of people using the London Underground had their movements, behavior, and body language watched by AI surveillance software designed to see if they were committing crimes or were in unsafe situations, new documents obtained by WIRED reveal. The machine-learning software was combined with live CCTV footage to try to detect aggressive behavior and guns or knives being brandished, as well as looking for people falling onto Tube tracks or dodging fares.

From October 2022 until the end of September 2023, Transport for London (TfL), which operates the city’s Tube and bus network, tested 11 algorithms to monitor people passing through Willesden Green Tube station, in the northwest of the city. The proof of concept trial is the first time the transport body has combined AI and live video footage to generate alerts that are sent to frontline staff. More than 44,000 alerts were issued during the test, with 19,000 being delivered to station staff in real time.

Documents sent to WIRED in response to a Freedom of Information Act request detail how TfL used a wide range of computer vision algorithms to track people’s behavior while they were at the station. It is the first time the full details of the trial have been reported, and it follows TfL saying, in December, that it will expand its use of AI to detect fare dodging to more stations across the British capital.

In the trial at Willesden Green—a station that had 25,000 visitors per day before the Covid-19 pandemic—the AI system was set up to detect potential safety incidents to allow staff to help people in need, but it also targeted criminal and antisocial behavior. Three documents provided to WIRED detail how AI models were used to detect wheelchairs, prams, vaping, people accessing unauthorized areas, or putting themselves in danger by getting close to the edge of the train platforms.

The documents, which are partially redacted, also show how the AI made errors during the trial, such as flagging children who were following their parents through ticket barriers as potential fare dodgers, or not being able to tell the difference between a folding bike and a nonfolding bike. Police officers also assisted the trial by holding a machete and a gun in the view of CCTV cameras, while the station was closed, to help the system better detect weapons.

Privacy experts who reviewed the documents question the accuracy of object detection algorithms. They also say it is not clear how many people knew about the trial, and warn that such surveillance systems could easily be expanded in the future to include more sophisticated detection systems or face recognition software that attempts to identify specific individuals. “While this trial did not involve facial recognition, the use of AI in a public space to identify behaviors, analyze body language, and infer protected characteristics raises many of the same scientific, ethical, legal, and societal questions raised by facial recognition technologies,” says Michael Birtwistle, associate director at the independent research institute the Ada Lovelace Institute.

In response to WIRED's Freedom of Information request, the TfL says it used existing CCTV images, AI algorithms, and “numerous detection models” to detect patterns of behavior. “By providing station staff with insights and notifications on customer movement and behaviour they will hopefully be able to respond to any situations more quickly,” the response says. It also says the trial has provided insight into fare evasion that will “assist us in our future approaches and interventions,” and the data gathered is in line with its data policies.

In a statement sent after publication of this article, Mandy McGregor, TfL's head of policy and community safety, says the trial results are continuing to be analyzed and adds, “there was no evidence of bias” in the data collected from the trial. During the trial, McGregor says, there were no signs in place at the station that mentioned the tests of AI surveillance tools.

“We are currently considering the design and scope of a second phase of the trial. No other decisions have been taken about expanding the use of this technology, either to further stations or adding capability.” McGregor says. “Any wider roll out of the technology beyond a pilot would be dependent on a full consultation with local communities and other relevant stakeholders, including experts in the field.”

Computer vision systems, such as those used in the test, work by trying to detect objects and people in images and videos. During the London trial, algorithms trained to detect certain behaviors or movements were combined with images from the Underground station’s 20-year-old CCTV cameras—analyzing imagery every tenth of a second. When the system detected one of 11 behaviors or events identified as problematic, it would issue an alert to station staff’s iPads or a computer. TfL staff received 19,000 alerts to potentially act on and a further 25,000 kept for analytics purposes, the documents say.

The categories the system tried to identify were: crowd movement, unauthorized access, safeguarding, mobility assistance, crime and antisocial behavior, person on the tracks, injured or unwell people, hazards such as litter or wet floors, unattended items, stranded customers, and fare evasion. Each has multiple subcategories.

Daniel Leufer, a senior policy analyst at digital rights group Access Now, says whenever he sees any system doing this kind of monitoring, the first thing he looks for is whether it is attempting to pick out aggression or crime. “Cameras will do this by identifying the body language and behavior,” he says. “What kind of a data set are you going to have to train something on that?”

The TfL report on the trial says it “wanted to include acts of aggression” but found it was “unable to successfully detect” them. It adds that there was a lack of training data—other reasons for not including acts of aggression were blacked out. Instead, the system issued an alert when someone raised their arms, described as a “common behaviour linked to acts of aggression” in the documents.

“The training data is always insufficient because these things are arguably too complex and nuanced to be captured properly in data sets with the necessary nuances,” Leufer says, noting it is positive that TfL acknowledged it did not have enough training data. “I'm extremely skeptical about whether machine-learning systems can be used to reliably detect aggression in a way that isn’t simply replicating existing societal biases about what type of behavior is acceptable in public spaces.” There were a total of 66 alerts for aggressive behavior, including testing data, according to the documents WIRED received.

Madeleine Stone, a senior advocacy officer at privacy-focused group Big Brother Watch, says that many Tube travelers will be “disturbed” to learn that authorities subjected people to AI-powered surveillance. Stone says that using an algorithm to determine whether someone is “aggressive” is “deeply flawed” and points out that the UK’s data regulator has warned against using emotion analysis technologies.

Staff at the transportation body ran “extensive simulations” at Willesden Green station during the trial to gather more training data, the documents say. These included members of staff falling on the floor, and some of these tests happened when the station was closed. “You will see the BTP \[British Transport Police\] officer holding a machete and handgun in different locations within the station,” one caption in the documents state, although the images are redacted. During the trial, the files say, there were no alerts for weapons incidents at the station.

The most alerts were issued for people potentially avoiding paying for their journeys by jumping over or crawling under closed fare gates, pushing gates open, walking through open gates, or tailgating someone who paid. Fare dodging costs up to £130 million per year, TfL says, and there were 26,000 fare evasion alerts during the trial.

During all of the tests, images of people’s faces were blurred and data was kept for a maximum of 14 days. However, six months into the trial, the TfL decided to unblur the images of faces when people were suspected of not paying, and it kept that data for longer. It was originally planned, the documents say, for staff to respond to the fare dodging alerts. “However, due to the large number of daily alerts (in some days over 300) and the high accuracy in detections, we configured the system to auto-acknowledge the alerts,” the documents say.

Birtwistle, from the Ada Lovelace Institute, says that people expect “robust oversight and governance” when technologies like these are put in place. “If these technologies are going to be used, they should only be used with public trust, consent and support,” Birtwistle says.

A large part of the trial was aimed at helping staff understand what was happening at the station and respond to incidents. The 59 wheelchair alerts allowed staff at Willesden Green station, which does not have access facilities for wheelchairs, to “provide the necessary care and assistance,” the files say. Meanwhile, there were almost 2,200 alerts for people going beyond yellow safety lines, 39 for people leaning over the edge of the track, and almost 2,000 alerts for people sitting on a bench for extended periods.

“Throughout the PoC we have seen a huge increase in the number of public announcements made by staff, reminding customers to step away from the yellow line,” the documents say. They also say the system generated alerts for “rough sleepers and beggars” at the station’s entrances and claim this allowed staff to “remotely monitor the situation and provide the necessary care and assistance.” TfL states that the system was trialed to try to help it improve the quality of staffing at its stations and make it safer for passengers.

The files do not contain any analysis of how accurate the AI detection system is; however, at various points, the detection had to be adjusted. “Object detection and behavior detection are generally quite fragile and are not foolproof,” Leufer, of Access Nows, says. In one instance, the system created alerts saying people were in an unauthorized area when in reality train drivers were leaving the train. Sunlight shining onto the camera also made them less effective, the documents say.

The tests also aimed to see if unfolded or nonfolding bikes and escooters—which are largely not allowed on the transport network—could be detected by AI. “The Al could not differentiate between an unfolded bike and normal bike and an e-scooter and children's scooter,” the documents state. The fare dodging model also flagged children. “During school travelling hours, we would see a spike in parent and child tailgating alerts,” the documents say. The system was adjusted to not flag people “whose height was below the gate.”

In recent years, the use of AI in public spaces to detect people’s behaviors, movements, or identities has increased—often through the guise of smart city approaches. In July last year, reports revealed that several New York City subway stations are using AI to track fare evasion. In London, TfL said in December it would expand its fare evasion trials to other stations, although the status of those experiments is unknown

Many of these systems are being developed in situations where there is a lack of specific laws governing their use, with warnings of a regulatory vacuum in the UK. “Normalizing AI-powered monitoring at transport hubs is a slippery slope towards a surveillance state, and must be subject to greater transparency and public consultation,” says Stone from Big Brother Watch.

Leufer warns that once these systems start to be used more widely, they can always be upgraded. “Once the infrastructure is there, it's absolutely trivial to update what it does,” he says. “It's really worrying, what could be added to these things. The slippery slope is very slippery."

_Update: 2/8/24, 5 pm ET: Added comment from a TfL spokesperson._

London Underground Is Testing Real-Time AI Surveillance Tools to Spot Crime

REcon is a computer security conference with a focus on reverse engineering and advanced exploitation techniques. It will be held June 28th through the 30th, 2024, in Montreal, Canada.

       +                    +                     +         +                                  +                  +           +           +                                             +                                        \ /                       +     _        - _+_ -                   ,__         _=.    .:.         /=\       _|===|_                  ||::|        |  |    _|.        |   |     | |   | |     __===_  -=- ||::|        |==|   |  |  __    |.:.|   /\| |:. | |    |   | .|| : |||::|        |  |-  |.:|_|. :__ |.: |--|==| |  .| |_   | ' |. ||.  |||:.|      __|. | |_|. | |.|...||---|  |==| |   | | |_--.     ||   |||. |     |  |  |   |. | | |::.||: .|  |==| | . : |=|===|    :|| . ||| .|     |:.| .|   |  | | |:.:|| . |  |==| |     |=|===| .   |'   | |  |     |     |      |   |   |'           :   .   |   ;     ;    '    |     '     :      `   :   '            .       '  .      .         :     '     .                                             .               `        .        R E C O N     2 0 2 4      .                '                           .   C F P          '               .                    '         https://recon.cx                                      .            June 28 to 30, 2024                     .                            Montreal, Canada                    .     REcon is a computer security conference with a focus on reverseengineering and advanced exploitation techniques.  It is held annuallyin Montreal, Canada.The conference offers a single track of presentations over the spanof three days along with technical training sessions held beforethe presentation dates.  Technical training varies in length betweentwo and four days.REcon 2024 is almost upon us.  As with years past, it will offer agreat lineup of trainings, talks from some of the top reversers in theworld, and a lot of fun.Attendees help define the event. They have always been, and will alwaysbe, those looking to learn something new, share ideas, and unwind in awelcoming environment. With the release of this CFP, we are happy toannounce registration is now open.We are now inviting speakers to submit proposals for this year's talks.Some guidelines for talks are: - 30 or 60 minute presentations  - We are open to proposals for workshops that would occur alongside talks.    REcon have a dedicated area for workshop and    village, there will be a Software and a hardware village,          the Hardware village will have a electronic lab.                       We are planning to bring soldering equipment, BGA Station,        microscope, Oscilloscope, Spectrum Analyser, Protocol Analyser,        Bench Power supply, reflow oven, 3D Printer, ... Note that the         talks will be broadcasted in the workshops area so you won't miss      anything.         - There will be time for five to ten minute informal lightning talks   during the REcon partyRegistration for training is also now open. This year we have anothergreat set of trainings available: - Automating Reverse Engineering Processes with AI/ML, NLP, and LLMs by Malachi Jones - Modern Windows Malware OPSEC and Anti-Reverse Techniques Implementation and Reversing by Silvio La Porta and Antonio Villani - Mastering Advanced Fuzz Testing Techniques on UNIX by Marc 'vanHauser' Heuse - Software Deobfuscation Techniques by Tim Blazytko - The ARM64 Exploit Laboratory by Saumil Shah - Symbolic Execution with Angr by Jeremy Blackthorne - Windows Internals for Reverse Engineers by Yarden Shafir - Advanced IC Reverse Engineering and Data Extraction by Olivier Thomas - Advanced Malware Reverse Engineering by Nicolas Brulez - Program Analysis for Vulnerability Research by Sophia D'Antoine & Kyle Martin - MacOS Sonoma and iOS 17 Kernel Internals for Security Researchers by Stefan Esser - Practical Baseband Exploitation by Pedro Ribeiro and Seamus Burke - Attacking Instant Messaging Applications by Iddo Eldor and Jacob Bech - RISC-V Security Training by Don A. BaileyThe conference talks in the following fields are encouraged (but not limited to): - Hardware reverse engineering - Software reverse engineering - Protocol reverse engineering - Finding vulnerabilities and writing exploits - Novel data visualization for hackers and reverse engineers - Bypassing security and software protections - Attacks on cryptography in hardware and software - Techniques for any of the above on new or interesting architectures - Wireless hacking (We aren't talking about wifi here) Speakers Benefits:  - Invite to speaker dinner the night before the conference  - Invite to speaker after party  - Full access to the conference - Unless your employer can cover your travel costs, We will reimburse your travel for economic                       Class round trip and hotel for at least 1 speaker / talk ( for more than one speaker,    we'll need to evaluate) - If it's a new talk that has never been presented before, you get 1000 USD - 40% rebate for a Recon Training - 10% rebate for up to 5 of your friends / coworkers                     How to submit: https://cfp.recon.cx/recon2024/cfp Get back to us soon! The first round of the CFP will end on March 29,and the CFP closes on April 26.

RECON 2024 Call For Papers

Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

“The people are in the streets. We can’t ignore them any longer. Really, we have little choice. Either we heal together, or we tear ourselves apart.” An exclusive excerpt from 2054: A Novel.

2054, Part IV: A Nation Divided

If you've listened to software vendors in the identity space lately, you will have noticed that “unified” has quickly become the buzzword that everyone is adopting to describe their portfolio. And this is great! Unified identity has some amazing benefits! 
However (there is always a however, right?) not every “unified” “identity” “security” “platform” is made equal. Some vendors call the

Unified Identity / Cyber Security

If you've listened to software vendors in the identity space lately, you will have noticed that "unified" has quickly become the buzzword that everyone is adopting to describe their portfolio. And this is great! Unified identity has some amazing benefits!

However (there is always a however, right?) not every "unified" "identity" "security" "platform" is made equal. Some vendors call the combination of workforce IDaaS and customer IDaaS a unified identity solution, while others offer a glorified 2FA service – unified only in the mind of their marketers.

****Your landscape matters!****

So forget for a moment what the vendors claim, and think back to _your_ organization and _your_ identity security landscape. Consider this new definition: "unified" is what has the ability to consolidate your identity challenges with a complete identity solution.

Here's an example: you're responsible for the identity infrastructure of a large hospital. Frontline workers, administrative employees, audit/compliance needs and a large number of external users. You are using Active Directory, and your LOB application doesn't do identity. For this hospital, unified identity means strong access management for customers and frontline workers, strong joiner-leaver-mover handling, AD hardening and enterprise-grade reporting. Anything less fails the unified promise and means their internal identity landscape stays fractured.

Another example: a small software dev studio. They need extra strong controls on Privileged Access Management (PAM) to protect the development pipeline and make sure they won't become the initial attack vector in a supply chain attack. But they also need Identity Governance and Administration (IGA) for machine entities and their owners, working on the many automated tasks they are running. A solution which covers PAM and IGA independently from each other is not unified.

****What is the value of unified identity anyways?****

So why has "unified identity " become such a hot buzzword? Well, there are some really good arguments for it. Traditionally, the identity space was very fractured, with many experts not even considering it a singular market until fairly recently. Identity Governance and Administration (IGA), Access Management (AM), and Privileged Access Management (PAM) were the key sub-markets, with a wide array of adjacent spaces such as AD bridging and endpoint privilege management.

The key driver for unified identity is this extreme fragmentation: a large organization has on average 45 different security tools. Add to this the identity sprawl, a trend where organizations keep getting more and more identity silos in-house – a One Identity survey shows half the organizations are using more than 25 different systems to manage access rights. This is simply not sustainable, and adding a new tool each time a new threat approaches is completely unworkable. So organizations are looking to consolidate vendors, reduce complexity and slim down the number of suppliers they work with. The benefits of a Unified Identity Platform are a better cybersecurity posture and greater resilience in the face of security threats, whilst increasing simplicity and enabling agility.

Another reason is top line cost: bundles, volume discounts and ELAs are a simple way to reduce costs. Vendor consolidation also brings some less obvious savings too: a single tech stack helps the skills gap, easing the stress on hiring and training, which in turn means significant savings on headcount and may lessen the requirement for highly trained senior staff, creating more value from security with less resources or put another way, working smarter not harder.

Integration is a key aspect of the identity landscape – and one of the largest headaches. Security tools need to work together smoothly, but that's rarely a given. The industry is not keen on common standards, which makes interoperability very hard to achieve. With some effort (meaning customization, support hours and overhead) identity solutions can work together pairwise, but creating a complete ecosystem of identity tools that work flawless together is a rare achievement. It's easy to see the value a unified identity platform brings here. The tools are pre-tested, pre-validated to work together, usually without any customization required, and the platform components are supported as one by the vendor.

This brings us to the final benefit: faster time to value, an expression worthy of any MBA graduate. Identity and access management (IAM) projects are famous for taking a long time to implement, as specialists meticulously formalize business processes and implement them in code or configuration. In large organizations, this is an incredibly complex task, as the IAM setup needs to mirror every aspect (and quirk) the business has built up – sometimes over decades. Implementations become so complex that they just fail – the cost and time overruns exceeding the patience of business leaders. In a nutshell: time to value matters in IAM. And a unified identity solution removes the complexity of the multi-vendor approach, eliminating at least one factor.

After these benefits, let's talk a downside: vendor lock-in. Unified identity sounds wonderful but betting the house on a single vendor is a high ask. And what if you already have some solutions in place that you're happy with? It's important to remember that not all unified identity vendors are the same; Some vendors offer modular identity platforms which allow you to keep what you want and unify what you need. This approach enables customers to start the unification at any point (for example with PAM) without the need to embrace and implement all areas in one giant leap. When picking vendors, look for this flexible approach.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Unified Identity – look for the meaning behind the hype! 

Your essential guide to toothbrush security.

February 7, 2024 - We look at a scam campaign on Facebook that continues to do the rounds, and how you can recover your compromised account.

February 6, 2024 - The State of Malware 2024 report covers some topics that are of special interest to home users: privacy, passwords, malvertising, banking Trojans, and Mac malware.

February 6, 2024 - Big Game ransomware is just one of six threats resource-constrained IT teams need to pay attention to in 2024.

February 6, 2024 - Safer Internet Day is all about raising awareness about a safer and better internet for all, and especially for children and young people.

February 5, 2024 - Clorox has reported losses of $49 million following a cyberattack in mid-2023.

 How to tell if your toothbrush is being used in a DDoS attack 

We look at a scam campaign on Facebook that continues to do the rounds, and how you can recover your compromised account.

Recently I wrote about a malvertising campaign on Facebook that has been going on for almost a year. Apparently Facebook is struggling to stop this campaign, so now this type of campaign is showing up in other languages than English.

I have seen two different types in German.

**First Facebook scam**

_Translation: Deadly accident on highway causes several fatalities_

Notable about this one is that it was posted as a fundraiser and does not allow comments, which blocks me from posting a warning that this is a scam.

I reached out to the person that owns the account to find out if he knew how his account got compromised. He had no idea, but told me that it seemed like a lot of people were having the same issues. Not only did he see the same type of posts, but he also got a lot of Messenger messages prompting him to click a link.

In the past we’ve seen campaigns on Messenger where clicking such a link would install a Facebook app that required posting permissions. These apps would then spread further from the compromised user account.

The host storage.googleapis.com gives the link a legitimate feel, but that feeling is not justified. Although googleapis.com is a legitimate service provided by Google, it’s being abused by all sorts of cybercriminals for phishing, tech support scams, and in this case fingerprinting. The script on that site looks at your IP address, your type of machine and whether you are using a VPN. Based on the analysis of that information you are forwarded to the type of scam that is likely to be the most profitable.

An example of a redirect URL shows some of the elements that were fingerprinted.

https://byxzz.altairaquilae[.]top/?pl=Yyo1IAH5aE2Q4g9YuOImuw&click_id=da5d3q51mm737150e7&sub_id=18222478-Edge%20(Chromium)%20for%20Windows-Windows

Malwarebytes has already blocked the windyplentiful.com domain for Malvertising.

_Malwarebytes Premium blocks the domain windyplentiful.com_

**Second Facebook scam**

The second example is easier to identify as a fake. Both the ambulance and the wrecked motorcycle hail from California, so this highly unlikely to have happened on the German autobahn.

_Translation: Accident causes several victims including a child_

Not only is the picture clearly not German, the grammar used in the sentence is another sign as it’s a bad translation.

When I set my VPN to pretend I was located in Germany, the script identified it as an anonymous proxy and stopped there.

Switching back to the Netherlands I got to “enjoy” sites with explicit content, scam sites where celebrities encourage investing in cryptocurrencies, and websites offering browser push notifications.

These browser push notifications are a very annoying type of advertising, often associated with tech support scams, explicit content, gambling, and anything else that pays a handsome referral bonus.

Several attempts on both images led to different domains as well. Other blocks we encountered during our research:

_Malwarebytes Premium blocks 188.114.96.0_

_Malwarebytes Premium blocks the subdomain oyglk.altairaquilae.top_

**How to recover from a Facebook scam**

You can recognize this type of scam because they usually tag several friends of the victim. And although the image looks like a click will start a video, it never has for me. The images were hosted at media.discordapp.net/attachments and although the pages contain a link to Vimeo, the videos there have already been removed or were never even there.

If you find your account has posted a message like this, you should assume that someone else has full control over your Facebook account. Simply changing the password is not always enough.

1.  Check for unknown and unused Facebook apps.
    *   Click your profile picture.
    *   Select **Settings & Privacy**, then click **Settings**.
    *   Click **Apps and Websites**.Go to the app or game you want to remove, then next to the name of the app or game, click **Remove**.
    *   Click **Remove** again to confirm.
2.  Enable two-factor authentication (2FA)
    *   Go to your **Security and Login Settings**.
    *   Scroll down to **Use two-factor authentication** and click **Edit**.
    *   Choose the security method you want to add and follow the on-screen instructions.
3.  Change your password on Facebook if you’re already logged in:
    *   Click your profile picture.
    *   Select **Settings & Privacy**, then click **Settings** (or **Accounts Center** if you’re on your phone).
    *   Click **Security and Login** (or **Password and Security** if you’re on your phone).
    *   Click **Edit** next to **Change password** (or just **Change password** if you’re on your phone).
    *   Enter your current password and new password.
    *   Click **Save Changes**.

If you’re logged in but have forgotten your password or it has been changed to something you don’t know, follow the steps above to change your password, then click **Forgot your password?** and follow the steps to reset it. Keep in mind that you’ll need access to the email associated with your account.

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using Malwarebytes Identity Theft Protection.

 Facebook fatal accident scam still rages on 

“You’d have an incomprehensible level of computational, predictive, analytic, and psychic skill. You’d have the mind of God.” An exclusive excerpt from 2054: A Novel.

2054, Part III: The Singularity

The State of Malware 2024 report covers some topics that are of special interest to home users: privacy, passwords, malvertising, banking Trojans, and Mac malware.

Released today, the Malwarebytes State of Malware 2024 report takes a deep dive into the latest developments in the world of cybercrime. 

As home users, many of the threats we cover will only affect you second hand, such as disruptions after a company suffers a ransomware attack, or when your private information is sold online after a data breach. Sadly, there’s not a lot you can do to prevent incidents like these yourself, other than stay on top of the news and protect yourself against identity theft. 

But other threats you can do something about. So in this article we’ll focus on what threats affect you directly and how you can protect yourself. 

**Privacy **

In the last year, the UK’s Online Safety Act attempted to challenge the status quo for social media and messaging companies. The act was widely interpreted as a demand that companies scan users’ messages for illegal material, and is a first warning about the directions in which privacy may continue to be threatened in the name of greater good.  

It also acts as a reminder to be careful about what you share, even if you are under the impression that you are using the internet securely. We have seen news of ChatGPT leaking user’s information and law enforcement asking for backdoors in encryption routines. 

**Passwords **

Google and Microsoft made good on their promise to back passkeys, an encryption-based alternative to passwords that can’t be stolen, guessed, cracked, or phished.

We’d like to see more companies embrace new methods of authentication and wave passwords goodbye: Too many breaches have shown us that user education only works for those that were already doing the right things. Keeping track of the hundreds of passwords an average user has, along with the relative complexity of using a password manager have convinced us it’s time for a better alternative. 

**Malvertising **

If the last year has taught us something, it’s that scammers and malware peddlers can afford to buy sponsored search results and outbid the brand owner so that their links come out on top. Cybercriminals create Google Search ads mimicking popular brands, which lead to highly realistic, replica web pages where users are scammed or tricked into downloading malware. 

Despite efforts on the side of search providers like Google, the cybercriminals remained one step ahead, able to consistently bypass ad verification checks all year. The type of malware that’s used varies with each campaign but infostealers (which gather information from your computer, such as usernames and passwords) were the most common type. 

**Banking Trojans **

Banking trojans are one of the most serious threats facing Android devices. Banking trojans come disguised as regular apps like QR code scanners, fitness trackers, or even copies of popular apps like Instagram. 

The malicious app asks the user for permissions that allow it to monitor what happens in other apps and will then create overlay screens for legitimate apps. This allows them to capture login credentials and even multi-factor authentication (MFA) tokens.

**Mac malware **

The days of “my Mac is safe” and “Macs don’t get malware” are definitely over. There are many signs that criminals are taking note of the platform’s increasing popularity by enabling attacks to target both Windows and Mac users at the same time. 

Contrary to outdated beliefs, malware for Macs has always existed, it was just considered less serious since most Mac malware was adware or potentially unwanted programs (PUPs). This is changing. For example, in September, 2023, Malwarebytes discovered a cybercriminal campaign spreading Atomic Stealer (AMOS) malware to Mac users through malicious ads. AMOS malware can steal passwords from browsers and Apple’s Keychain, as well as grab files.

**Malwarebytes  **

Malwarebytes has solutions to safeguard individuals’ data and identities. We can protect your Android and iOS devices, Macs, Chromebooks, and Windows systems. We also have software to protect your identity, safeguard your online privacy, and block unwanted ads and trackers.

Tag

#mac