By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Intel has confirmed that a source code leak for the UEFI BIOS of Alder Lake CPUs is authentic, raising cybersecurity concerns with researchers. Alder Lake is the name of Intel's 12th generation Intel Core processors, released in November 2021. On Friday, a Twitter user named 'freak' posted links to what was said to be the source code for Intel Alder Lake's UEFI firmware, which they claim was released by 4chan. The link led to a GitHub repository named 'ICE_TEA_BIOS' that was uploaded by a user named 'LCFCASD.' This repository contained what was described as the 'BIOS Code from project C970.' The leak contains 5.97 GB of files, source code, private keys, change logs, and compilation tools, with the latest timestamp on the files being 9/30/22, likely when a hacker or insider copied the data. BleepingComputer has been told that all the source code was developed by Insyde Software Corp, a UEFI system firmware development company. The leaked source code also contains numerous references to Lenovo, including code for integrations with 'Lenovo String Service', 'Lenovo Secure Suite', and 'Lenovo Cloud Service.' At this time, it is unclear whether the source code was stolen during a cyberattack or leaked by an insider. However, Intel has confirmed Tom's Hardware that the source code is authentic and is its "proprietary UEFI code." While Intel has downplayed the security risks of the source code leak, security researchers warn that the contents could make it easier to find vulnerabilities in the code. "The attacker/bug hunter can hugely benefit from the leaks even if leaked OEM implementation is only partially used in the production," explains hardware security firm Hardened Vault. "The Insyde’s solution can help the security researchers, bug hunters (and the attackers) find the vulnerablity and understand the result of reverse engineering easily, which adds up to the long-term high risk to the users." Positive Technologies hardware researcher Mark Ermolov also warned that the leak included a KeyManifest private encryption key, a private key used to secure Intel's Boot Guard platform. Stay informed by visiting OUR FORUM often.

October 5 marked one year since Windows 11 hit general availability. Lansweeper, an IT asset management software provider that assists organizations understand, manage and protect their IT devices and network, has come up with a detailed report that has highlighted that 43% of Microsoft devices still can’t run Windows 11 based on 30 million Windows devices scanned at 60,000 enterprises.<br /><br />Lansweeper further detailed in their report that of those machines, only 2.61% are currently running Windows 11. In comparison, the adoption rates for the new OS at the beginning of the year and six months ago stand at 0.52% and 1.44% respectively indicating a significant growth.&nbsp; As per their findings, the Windows 11 minimum system requirements greatly affected this growth as a good number of the workstations forming part of the estimated 27 million Windows devices surveyed were not able to conform to them.<br /><br />92.9% of the devices factored in during the survey passed the RAM test while only 64.6% of those tested for the TPMs met the miminum system requirements."If this trend continues at its current pace, it will take around four years for devices to meet the minimum requirements for Windows 11," said Roel Decneut, Chief Strategy Officer at Lansweeper.&nbsp;Further in the report, it is evident that Windows 11 has moved up in the ranks beating Windows 8, however, Windows 7 is still ahead as far as market share is concerned even after reaching end of support. According to the report, "4.82% of devices are still running Operating Systems that aren’t being fully supported, as well as 0.91% of Servers that are also End-of-Life".&nbsp;Interestingly enough, you might recall that at the beginning of this, Microsoft's CEO&nbsp; Satya Nadella reported that there are now 1.4 billion monthly active Windows 10 or Windows 11 devices, while AdDuplex's report&nbsp; indicated that the new Microsoft operating system is now running on 23.1% of surveyed PCs. Perhaps these figures might change in the foreseeable future, as Windows 11 reached broad deployment opening up its doors to users with Windows 10 PC that meets minimum requirements. Follow this and other threads on OUR FORUM.

Some 400 apps on Android and Apple have been stealing login information, the platform’s owner says The personal data of at least 1 million Facebook users could have been stolen by certain apps on Apple and Android, the platform’s owner, Meta, has warned. Around 400 malicious applications, distributed through Google Play and the App Store, have been stealing people’s login information, the company’s security team said on Friday.

They posed as harmless tools such as photo editors, games, VPN services, and other things to lure users into downloading them. The apps then asked people to ‘log in with Facebook’ and forwarded their usernames and passwords to the perpetrators as soon as they were entered. This data could potentially be used by the attackers to gain full access to people’s accounts and send messages to their friends lists or obtain private information.

Meta has said it was not aware of the exact number of users affected, as this information is known to Apple and Google. The company is “being kind of deliberately overcautious and notifying about 1 million users across our entire platform that they may have been exposed to applications like this,” Meta’s director of threat disruption, David Agranovich, stated. “That doesn’t mean that they were compromised, just that we think that they may have been exposed to one of these applications,” he added.
Google and Apple say they have already removed the apps mentioned in Meta’s report. Apps sold through their online stores are carefully vetted, but some malicious software still makes it through. Meta has advised users to be cautious and carefully examine what they download. “If a flashlight application is requiring you to log in with Facebook before it gives you any flashlight functionality, it’s probably something to be suspicious of,” Agranovich said.
Source by David Agranovich, Pic the Net