Downfall vulnerability may affect Intel Macs; usual precautions recommended
A newly-discovered Downfall vulnerability found in Intel chips may affect older Macs powered by these processors …
Expand Expanding Close
MacBook Pro keyboard audio can tell an attacker what you are typing
Security researchers have demonstrated that MacBook Pro keyboard audio can reveal what you are typing, with an accuracy of between 92% and 95%. They say the attack is a practical one on things like Zoom calls …
Expand Expanding CloseUS is number one for ransomware attacks, 7x more than the next country
Following its 2023 State of Malware report back in February, Malwarebytes is out with its yearly State of Ransomware study. As attacks continue to grow, the US saw 7 times more ransomware incidents than the second most attacked country. Here are the details of what the report found.
Expand Expanding CloseHidden VNC tool gives attackers full access to Macs; comes with $100K guarantee
Cybersecurity firm Guardz has found Russian hackers offering for sale a Hidden VNC tool specifically designed to give attackers full access to Macs. It follows a similar tool for accessing Windows PCs, and is geared to stealing personal data and logins.
The HVNC (Hidden Virtual Network Computer) is being sold on the dark web, and as a sign of good faith that the tool works as claimed, the hackers have deposited $100K in an escrow account …
Expand Expanding Close
Data breaches must be reported within 4 days, says SEC
There have been many cases of US companies covering up serious personal data breaches for months at a time – often only admitting to them when an outside source learns of it.
This isn’t possible in Europe, where the law requires unauthorized access to personal data to be reported to regulators within three days, and now the US is finally adopting a similar requirement – even if it’s not for your benefit …
Expand Expanding CloseRealst Mac malware targets macOS Sonoma; here’s how to stay safe
Coming on the heels of ShadowVault, a new infostealer malware dubbed “Realst” is being implemented into fake blockchain games by cybercriminals in a massive campaign targeting Windows and macOS users, including those on macOS 14 Sonoma.
Expand Expanding CloseApple fixes 16 security flaws with iOS 16.6, two actively exploited
Apple has released iOS 16.6 today for everyone and while the update doesn’t come with new user-facing features, it has over a dozen important security fixes. And notably, two of the fixes are for actively exploited flaws.
Expand Expanding Close
Data breaches: Corporations want to make us pay, not spend money on security
IBM’s latest report on data breaches reveals attackers are now more interested in stealing personal data for identity theft than they are simply taking credit card details. It also found that big companies would rather just pass on the costs to consumers, than spend more on security …
Expand Expanding CloseApple employee reportedly didn’t tell Google about zero-day exploit found in Chrome
As we often report here, it’s common for tech companies to help each other improve their security systems by sharing zero-day exploits found by security researchers. Google, for example, does this a lot. But recently, an Apple employee reportedly found a zero-day exploit in Google Chrome – and that bug was never reported to Apple by that person.
Expand Expanding CloseUS Cyber Trust Mark will boost smart home security, says White House
The White House has announced a plan intended to improve the security of smart home tech. The government will test everything from smart speakers to Wi-Fi routers, awarding a US Cyber Trust Mark logo to products which pass the tests.
The National Institute of Standards and Technology (NIST) will set the standards to be met, and the Federal Communications Commission (FCC) will manage the program …
Expand Expanding CloseRussian security service bans all Apple devices, repeats nonsensical spying claims
The Russian security service, the FSB, has extended its earlier ban on the use of iPhones. The latest ban applies to thousands more government workers, and now includes iPads and Macs.
The FSB has repeated its earlier claims that Apple has provided the NSA with a backdoor into its devices, allowing US security services to spy on Russian officials …
Expand Expanding CloseiOS 16.5.1 security fix temporarily pulled after it broke websites
Apple yesterday released an iOS 16.5.1 update to fix a security vulnerability which is being actively exploited by attackers – but then withdrew it again.
The problem, it appears, is that a tiny change in Safari caused a number of websites to break …
Expand Expanding CloseShadowVault macOS Stealer surfaces as the newest sophisticated Mac malware
Earlier this year, we saw a new malware designed for Macs called MacStealer that can compromise passwords, credit card numbers, crypto wallets, and more. After a second version of that popped up in April, a third advanced Mac malware called ShadowVault macOS Stealer has surfaced. Here’s what it can do and how to protect your Mac.
Expand Expanding CloseProton Pass end-to-end encrypted password manager is here and free for everyone
Back in April, Proton launched a beta for the service that’s been one of the most requested by its users. Now Proton Pass, the end-to-end encrypted password manager has officially launched for all users on desktop and iOS/Android. And there’s even a free version that includes storing unlimited credentials and notes.
Expand Expanding CloseWhy tips like ‘turn off your iPhone for five minutes’ don’t actually help users
Last week, Australia’s prime minister offered some security advice for iPhone users, suggesting that everyone should turn off their iPhone for five minutes every night. On the surface, this may seem like harmless advice for iPhone users, but the reality is quite a bit more nuanced.
In fact, such broad and generalized statements like this one can do a disservice to most people. Here’s why.
Expand Expanding CloseTurn off your iPhone for five minutes – Australian PM echoes cybersecurity advice
Australia’s prime minister has echoed the advice of cybersecurity professionals, in recommending that you turn off your iPhone for five minutes every night.
No, it’s not so you can reduce your daily Screen Time to 23 hours and 55 minutes, but to stop any spyware that may be running in the background on your device …
Expand Expanding Close
Apple has finally removed fake Microsoft Authenticator app from the App Store [U]
Update four months later: A fake Microsoft Authenticator app somehow survived the cull, but was finally removed in June …
Expand Expanding CloseApple patches two actively exploited security flaws with iOS 16.5.1 and more
Coming with the release iOS 16.5.1, macOS 13.4.1, and more today, Apple has shipped two important fixes for security flaws. The updates arrive for devices on the latest public software and those on older versions of its software. Notably, Apple has heard the flaws have been actively exploited.
Expand Expanding Close
PSA: Serious Windows iTunes vulnerability discovered, immediate update advised
A serious Windows iTunes security vulnerability has been revealed, affecting all versions prior to the latest update, released a week ago …
TheApple responds to dubious iPhone security claim by Russia, vowing to never create a backdoor to iOS
Earlier today, the Federal Security Service accused the NSA of hacking iPhones of citizens and foreign diplomats in Russia as part of a an espionage operation. Apple has now responded indirectly to Russia’s claim that the alleged operation included close cooperation between the company and the NSA. 9to5Mac has the statement below.
Expand Expanding CloseNSA hacked iPhones, claims Russia, but Apple involvement simply isn’t credible
Russia has claimed that the NSA hacked iPhones belonging to both Russian citizens and foreign diplomats based in the country.
More than this, it claims that Apple assisted the NSA by providing backdoor access into iPhones …
Expand Expanding CloseUS govt banned NSO’s Pegasus, but said to buy rival spyware Paragon Graphite
The US government banned the use of NSO’s Pegasus spyware 18 months ago, but a new report today says that at least one government agency is using very similar malware from a rival company: Paragon Graphite.
Graphite reportedly has the same capabilities as Pegasus, and the US Drug Enforcement Administration (DEA) is said to be using it …
Expand Expanding CloseApple alerted Pegasus spyware victims during first known use in a military conflict
Security researchers have documented the first known case of NSO’s Pegasus spyware being used in a military conflict. The hacks relate to the long-running military conflict between Armenia and Azerbaijan, over a region claimed by both countries.
The victims – who included a United Nations official, journalists, human rights advocates, and a former government minister – received alerts from Apple that their iPhones had been hacked …
Expand Expanding CloseApple security fix didn’t address root cause – now corrected in iOS 16.5
An Apple security fix in iOS 15.6.1 back in August of last year was said to close two major security vulnerabilities, one of which could have allowed a rogue app to execute arbitrary code with kernel privileges (aka do Very Bad Things). But it’s now been revealed that the more serious vulnerability wasn’t closed after all.
Apple did succeed in blocking a specific way of exploiting the vulnerability, but didn’t address the root issue until last week’s iOS 16.5 update, some nine months later …
Expand Expanding Close