Hackers have been targeting Windows 10 and 11 users with malware for over a year, but a fix has finally arrived in the latest Windows update released on July 9th.
This vulnerability, exploited by malicious code since at least January 2023, was reported to Microsoft by researchers. It was fixed on Tuesday as part of Microsoft’s monthly patch release, tracked as CVE-2024-38112. The flaw, residing in the MSHTML engine of Windows, had a severity rating of 7.0 out of 10.
Security firm Check Point discovered the attack code, which used “novel tricks” to lure Windows users into executing remote code. One method involved a file named Books_A0UJKO.pdf.url, which appeared as a PDF in Windows but was actually a .url file designed to open an application via a link.
Internet Explorer Continues to Haunt Windows...
When viewed in Windows, these files looked like PDFs, but they opened a link that called msedge.exe (Edge browser). This link included attributes like mhtml: and !x-usc:, a trick long used by threat actors to open applications such as MS Word. Instead of opening in Edge, the link would open in Internet Explorer (IE), which is less secure and outdated.
Internet Explorer, Microsoft's infamously insecure browser has been discontinued for years, and even more previously unknown vulnerabilities are still occasionally discovered. The point being - once a hacker has Internet Explorer open, and the ability to tell it to open a URL, they can choose from a wide variety of methods to install software, execute code, or destroy data.
IE would prompt the user with a dialog box to open the file, and if the user clicked “open,” a second dialog box appeared, vaguely warning about opening content on the Windows device. Clicking “allow” would cause IE to load a file ending in .hta, running embedded code.
Haifei Li, the Check Point researcher who discovered the vulnerability, summarized the attack methods: the first technique used the “mhtml” trick to call IE instead of the more secure Chrome/Edge. The second technique tricked users into thinking they were opening a PDF while actually executing a dangerous .hta application. The goal was to make victims believe they were opening a PDF using these two tricks.
Check Point’s report includes cryptographic hashes for six malicious .url files used in the campaign, which Windows users can use to check if they’ve been targeted.
____
Author: Stephen Hannan
New York Newsroom
Apple is about to make waves in the digital payment space when iOS 18 goes live - support for Apple Pay on non-Safari desktop web browsers. That's right, apple pay in Windows PCs inside of Chrome or Firefox. It appears Apple's goal is to make Apple Pay something people use for every transaction they make.
Apple demonstrated the new feature for a group of developers at WWDC 2024 who shared the details with us.
Here's How it Will Work...
If you’re browsing the web on a desktop browser that isn’t Safari and you spot an Apple Pay button, you’re in luck, clicking that button will now generate a special QR code. Pull out your
iPhone running iOS 18, scan the code, and voila – it's like any other Apple Pay transaction from this point. This not only makes shopping more convenient but also bridges the gap between different platforms, enhancing the overall user experience.
Until Now, Apple Pay Was Only Accessible in Very Specific Situations...
Using Apple Pay outside of an Apple produced mobile device was limited to Macs computers/laptops, and even they were limited to using it only when using the Safari browser. This update really is a big change.
Regardless of your browser or operating system, you might start noticing a lot more Apple Pay buttons popping up across the web.
From a particle point of view, this option seems both faster and easier than typing in a credit card number. But in cases where someone is using service they use often and likely has their card on file, using Apple Pay would be an additional pointless step.
Stay tuned for more updates as we inch closer to the iOS 18 release date this fall!
-----------
Author: Alex Benningram
Tech News CITY // New York Newsroom
Like every week, there has been a torrent of AI news, reflecting the rapid progress and growing implications of this transformative technology. While many updates represent incremental advancements, some developments carry profound future implications, and a few are simply downright bizarre and amusing.
The AI Landscape's Overwhelming Complexity
An infographic from First Mark Capital vividly illustrates the staggering complexity of the current AI landscape. Dubbed the "2024 ML/AI/Data Landscape," the image depicts the sheer number of companies involved in this space, encompassing both established giants and numerous smaller players. This visual representation serves as a stark reminder of just how monumental and widespread the AI revolution has become.
Microsoft and OpenAI's Ambitious Data Center Plans
Unconfirmed reports suggest that Microsoft and OpenAI are planning a $100 billion data center project, which would be a staggering 100 times more costly than some of the largest existing data centers. The proposed facility would house an artificial intelligence supercomputer dubbed "Stargate." If realized, this endeavor could propel OpenAI and Microsoft to an unprecedented lead, making it challenging for other companies or open-source models to catch up.
OpenAI's Synthetic Voice Capabilities
OpenAI has unveiled its ability to generate realistic synthetic voices from a single 15-second audio sample. The quality of these AI-generated voices surpasses even the impressive capabilities of tools like Elevenlabs. However, while showcasing this remarkable feat, OpenAI has refrained from making the technology publicly available due to potential misuse concerns. The company is advocating for measures to protect individuals' voices, educate the public about AI-generated content, and develop techniques to track the origin of audiovisual media.
Advancements in AI Art and Music Generation
Several developments in AI-powered art and music generation have emerged. OpenAI has introduced an inpainting feature for its DALL-E model, allowing users to selectively modify specific areas of generated images. Stability AI has unveiled Stable Audio 2.0, enabling the generation of three-minute songs and audio-to-audio generation based on hummed or instrument sounds. However, the quality of AI-generated music remains a subject of debate, with a group of musicians, including Nicki Minaj and Katy Perry, signing a letter expressing concerns about the irresponsible use of AI in music.
Anthropic's Research and Apple's AI Ambitions
Anthropic researchers have discovered that repeatedly asking harmless questions to large language models can eventually lead them to provide potentially harmful information, a phenomenon they are actively investigating. Meanwhile, Apple appears to be deepening its involvement in AI, revealing the "Realm" language model designed to enhance voice assistants like Siri by improving context understanding and reference resolution.
Ethical Concerns and Regulatory Developments
Ethical and regulatory issues surrounding AI continue to surface. A court in Washington has banned the use of AI-enhanced video evidence, citing concerns about the potential for inaccuracies introduced by upscaling algorithms. Additionally, the company behind the AI-generated George Carlin standup comedy set has agreed to remove all related audio and video content following a settlement with Carlin's estate.
Bizarre and Amusing AI Applications
Among the more unusual AI developments, an autonomous electric scooter called the Ola Solo has been introduced in India, claiming to be the first fully self-driving scooter. In Phoenix, Waymo vehicles are now delivering Uber Eats orders, allowing customers to retrieve their food from self-driving cars. Furthermore, an upcoming season of the Netflix reality show "The Circle" will feature an AI catfish participant, adding an intriguing twist to the dating-focused premise.
As the AI news cycle continues to accelerate, it becomes increasingly evident that we are witnessing a technological revolution of unprecedented scale and impact. Stay tuned for more developments, insights, and discussions as we collectively navigate the challenges and opportunities of this "next wave" of innovation.
-----------
Author: Trevor Kingsley
Tech News CITY // New York Newsroom
Apple has introduced a new safety feature in their latest iPhone software update to help protect your personal information if your iPhone is ever stolen. It's called Stolen Device Protection.
What it does:
If your iPhone is stolen, this feature makes it harder for someone else to access your private stuff on the phone, like your bank details, saved passwords, or Apple ID.
It works by requiring Face ID or Touch ID instead of just a passcode to take certain actions on the phone. For example, if your iPhone is in an unfamiliar location, the thief would need to use Face ID or Touch ID to make payments with your saved cards or log into your accounts. This helps ensure only you can access your private info, even if a thief knows your passcode.
It also makes you wait 1 hour before changing critical security settings like your Apple ID password if your phone is not in a familiar location. This gives you time to mark your device as lost and secure your account if it's stolen.
What it doesn't protect:
If a thief knows your passcode, they can still access your email and info in unprotected apps. Apple Pay will also still work with just the passcode.
How to turn it on:
First, update your iPhone to the latest software (iOS 17.3 or higher). Go to Settings > General > About to check your current iOS version.
Then go to Settings > Face ID & Passcode. You may need to enter your passcode. Look for "Stolen Device Protection" and turn on the switch so it turns green. This enables the feature.
-----------
Author: Trevor Kingsley
Tech News CITY // New York Newsroom
A new report finds that big tech companies are falling short when it comes to keeping their promises around developing artificial intelligence (AI) responsibly. Researchers at Stanford University looked into how companies that have published ethics rules and hired experts are putting those principles into practice.
What they found is concerning. Even with all the talk of "AI ethics," many companies still prioritize performance and profits over safety and responsibility when building new AI products.
The Stanford Team Interviewed 25 People Working Inside the Current Top AI Companies...
These employees said they lack support and are isolated from other teams. Product managers often see them as hurting productivity or slowing down product releases. One person said "being very loud about putting more brakes on [AI development] was a risky thing to do."
Governments, academics and the public have raised worries about issues like privacy, bias, and AI's impacts on jobs and society. Tools like chatbots are advancing very quickly, with new releases from companies like Google and OpenAI.
Promises to Develop AI Responsibly Seems to Have Been Empty Words, Meant To Calm Public Concern...
Employees within the AI companies say ethical considerations are an afterthought, happening "too late, if at all" - instead, they're told to focus on the numbers, such as user engagement and AI performance. These are the metrics that dominate decision-making, rather than equally important measures around fairness or social good.
In short, despite public commitments to ethics, tech companies are deprioritizing real accountability as they race to build the latest, most advanced artificial intelligence.
Companies Focus on Winning the Race to Release the 'Most Powerful AI' of the Moment, then Learn What it Is Capable Of...
Instead, AI development should be guided by a clear understanding of what the AI their building can and should be able to do, rather than focusing solely on maximizing profits or building the most powerful version.
There's no downplaying the massive challenge for-profit AI companies face as they need to consider innovation, profitability, and ethics - falling short in any of these categories greatly increases the odds that a company will not survive.
It is vital that the AI industry understands it must function differently than any other segment of the tech industry, with investor satisfaction no longer the top priority. This may actually be a fairly simple change to implement, they just need to educate their investors. Informed investors will actually demand that public safety come first, as all would regret funding a company that, for example, triggered a global forced internet shut-down because that was the only way to stop their creation from self-replicating and spreading, or worse.
-----------
Author: Trevor Kingsley
Tech News CITY // New York Newsroom
