authentication Archives

AppWizard

April 28, 2025

My favorite SSH clients for Android – and why you need them

Users can access Linux machines on a local area network using SSH commands from an Android phone, with various applications available on the Google Play Store. 1. JuiceSSH is a popular SSH client for Android that features font size adjustment, identity management, automatic script execution, plugins, themes, and external keyboard support. The Pro version offers additional features for a one-time fee of .99. 2. Termius is another SSH client that provides cloud-based encrypted storage for connection configurations, a connection manager, SSH key authentication, and SFTP support. The Pro version includes advanced features and requires account setup, but the app is free with optional in-app purchases. 3. Termux serves as a terminal emulator that allows users to run Linux commands, including SSH, after installing the openssh package. It is free to install and use. 4. ConnectBot is an open-source SSH client that offers a clean interface, color categories, font size customization, SSH key authentication, and persistent connections across multiple machines. It is also free to install and use. Recent updates to Android enable users to access a full Linux environment and install SSH using the command apt install openssh-client.

AppWizard

April 28, 2025

For Android users: How to secure your Instagram account

Two-factor authentication (2FA) enhances online account security by requiring a second form of verification in addition to a password. To enable 2FA on Instagram, users should: open the app, go to their profile, tap the menu icon, select "Settings," navigate to "Security," and choose "Two-Factor Authentication." Users can receive verification codes via text message or an authentication app. This measure helps protect accounts even if a password is compromised.

Winsage

April 27, 2025

Last Chance to Get Windows 11 Pro at an All-Time Low Price

The majority of Windows users are still using Windows 10, with the end of support for this version approaching, prompting the need to upgrade to Windows 11. Windows 11 Pro license keys are currently available for .97, down from the regular price of 9, but this offer expires on April 27. Windows 11 Pro includes features such as biometric login, encrypted authentication, advanced antivirus protections, improved voice typing, and better search capabilities. It also integrates Microsoft Teams and Widgets and introduces an AI-powered assistant called Copilot. For gaming, Windows 11 Pro supports DirectX 12 Ultimate for enhanced graphics. To upgrade, devices must meet specific requirements: running Windows 10 or higher, a processor of at least 1GHz, a minimum of 4GB of RAM, and 64GB of storage. The upgrade is designed to improve productivity with tools like Snap Layouts and support for multiple virtual desktops.

Winsage

April 26, 2025

Windows 11 KB5055627 update released with 30 new changes, fixes

Microsoft has released the KB5055627 preview cumulative update for Windows 11 24H2, which introduces new features and bug fixes. This update is part of optional non-security preview updates and does not include security updates. Users can install it via Settings under Windows Update or download it directly from the Microsoft Update Catalog. The update elevates Windows 11 24H2 systems to build 26100.3915 and includes features such as Recall (preview), Click to Do (preview), improved Windows Search, Narrator enhancements, Phone Link, interactive Widgets, curated views in File Explorer, updated Settings for app recommendations, and Windows Studio Effects. It also addresses bugs related to blue screen errors, DHCP Client connectivity issues, Windows Hello functionality, and provides estimated offline times for updates. Notable issues include potential installation blocks for Citrix components and download issues for Roblox players on Windows Arm devices, with workarounds available.

AppWizard

April 25, 2025

12 Android apps secretly recorded your conversations

Recent findings from cybersecurity experts at ESET revealed that several Android applications, disguised as harmless tools, have been secretly recording conversations and stealing sensitive data. These malicious apps infiltrated devices through the Google Play Store and third-party platforms, compromising the privacy of thousands of users. One tactic used by cybercriminals involved romantic deception, where victims were coaxed into downloading a seemingly harmless messaging app containing the VajraSpy Trojan, which activated upon installation to record conversations and harvest personal data. The identified malicious apps fall into three categories: 1. Standard Messaging Apps with Hidden Trojans: These apps, including Hello Chat, MeetMe, and Chit Chat, request access to personal data and operate silently in the background, stealing contacts, SMS messages, call logs, device location, and installed app lists. 2. Apps Exploiting Accessibility Features: Apps like Wave Chat exploit Android’s accessibility features to intercept communications from secure platforms, record phone calls, keystrokes, and ambient sounds. 3. Single Non-Messaging App: Nidus, a news app, requests a phone number for sign-in and collects contacts and files, increasing the risk of data theft. The 12 malicious Android apps identified include: Rafaqat, Privee Talk, MeetMe, Let’s Chat, Quick Chat, Chit Chat, YohooTalk, TikTalk, Hello Chat, Nidus, GlowChat, and Wave Chat. The first six apps were available on the Google Play Store and had over 1,400 downloads before removal. Users are advised to uninstall these apps immediately to protect their personal data.

AppWizard

April 24, 2025

Trojanized Alpine Quest app geolocates Russian soldiers

Russian soldiers are facing a digital threat from a modified Android application, Alpine Quest, which has been tampered with to track their locations and extract sensitive information. The malware, known as Android.Spy.1292.origin, was embedded in an older version of the app and distributed as a free upgrade to Alpine Quest Pro via a fraudulent Telegram channel. Once installed, the trojan collects various types of information, including geolocation, downloaded files, phone numbers, and app versions, and can download additional modules to exfiltrate specific files. Additionally, researchers at Kaspersky discovered a backdoor hidden in counterfeit software updates for ViPNet, a secure networking suite. The malware, disguised as msinfo32.exe, connects to a command-and-control server to steal files and deploy more malicious components. On the Ukrainian side, Russian operatives are conducting a phishing campaign targeting Ukrainian officials and allies, using social engineering tactics to hijack Microsoft 365 accounts. Attackers contact victims via messaging apps, invite them to video calls, and trick them into providing OAuth codes, granting access to their accounts.

Winsage

April 23, 2025

Microsoft fixes Windows Server 2025 blue screen, install issues

Microsoft has addressed issues affecting Windows Server 2025 for systems with more than 256 logical processors, which could lead to installation failures, slow start-up times, and blue screen errors. These problems have been resolved through updates since the KB5046617 cumulative update released in November. IT administrators are advised to install the latest security updates, which include essential fixes. A temporary workaround involves limiting the number of logical processors to 256 or fewer by adjusting settings in the UEFI Setup. Additionally, Microsoft warned of potential accessibility issues with Windows Server 2025 domain controllers post-restart and reported login difficulties with Windows Hello after the April 2025 updates. A bug causing authentication issues with Credential Guard has been fixed, and a new safeguard hold for Windows 11 24H2 has been introduced due to compatibility problems with the SenseShield Technology's sprotect.sys driver.

Winsage

April 19, 2025

Windows vulnerability with NTLM hash abuse exploited for phishing

A vulnerability in Windows, identified as CVE-2025-24054, is being exploited in phishing campaigns targeting government and private organizations. Initially considered low-risk, it was addressed in Microsoft's March 2025 Patch Tuesday updates. Following the release of these patches, Check Point observed a rise in exploitation attempts, particularly linked to the Russian group APT28. Attackers sent phishing emails with Dropbox links containing .library-ms files, which, when accessed, connected to an external SMB server controlled by the attackers, allowing interception of NTLM hashes. A subsequent wave of attacks involved .library-ms files sent as direct attachments, requiring minimal user interaction to exploit the vulnerability. The malicious ZIP archive also contained files exploiting older NTLM vulnerabilities. Check Point identified the attackers' SMB servers with specific IP addresses. Despite being classified as medium-severity, the vulnerability's potential impact is significant, prompting organizations to apply the March 2025 updates and consider disabling NTLM authentication if not essential.

Tech Optimizer

April 18, 2025

Breached Identities and Infostealers: One of the Largest Ongoing Data Leak in History

Breached identities due to infostealer malware are a significant threat to corporate information security in 2024. Infostealers are a type of remote access trojan that exfiltrate sensitive data, including saved credentials, session cookies, browser history, crypto wallet information, screen captures, and host data. Infections often stem from downloading cracked software, malicious advertising, fake Windows updates, and repackaged games. Infostealers do not require local administrative privileges, making them easy to execute. Threat actors primarily aim to profit from breached bank accounts and crypto wallets, often bypassing multi-factor authentication by targeting session cookies. They also seek credentials for subscription services and corporate access. Research shows that 90% of breached companies had leaked corporate credentials in a stealer log, with 78% experiencing leaks within six months of a breach. In comparison, 76% of similar companies without breaches had experienced a corporate stealer log compromise. The investigation identified high-criticality credentials from various corporate applications, indicating that a single user often has access to multiple credentials. The rise of infostealer malware represents a broad threat, encompassing a wide range of sensitive data. Organizations are advised to implement strategies such as restricting download privileges, avoiding illegal content, disabling macros, and regularly updating software to mitigate risks associated with infostealer malware.

Winsage

April 17, 2025

Windows NTLM hash leak flaw exploited in phishing attacks on governments

A vulnerability in Windows, identified as CVE-2025-24054, is being actively exploited in phishing campaigns targeting government and private sectors. Initially addressed in Microsoft's March 2025 Patch Tuesday, it was not considered actively exploited at that time. Researchers from Check Point reported increased exploitation activities shortly after the patches were released, particularly between March 20 and 25, 2025. Some attacks were linked to the Russian state-sponsored group APT28, but definitive attribution is lacking. The vulnerability allows attackers to capture NTLM hashes through phishing emails containing manipulated .library-ms files that trigger the flaw when interacted with. Check Point noted that subsequent attacks involved .library-ms files sent directly, requiring minimal user interaction to exploit. The malicious files also included additional components that exploit older vulnerabilities related to NTLM hash leaks. The attacker-controlled SMB servers were traced to specific IP addresses. Although rated as medium severity, the potential for authentication bypass and privilege escalation makes it a significant concern, prompting recommendations for organizations to install updates and disable NTLM authentication if not necessary.