Security

NSO Pegasus spyware has been used by at least five EU countries, admits the company. The admission was made as part of a European investigation into the impact of Pegasus, with an interim report now published.

It’s likely that the true number is higher, with the company promising to provide a ‘more concrete number’ …

A study shows that Apple can pay up to 5x more than Samsung per exposed vulnerability on its bug bounty program. That said, the Cupertino company still faces complaints from researchers, with some saying Apple didn’t give them credit for the zero-day flaw reported.

A so-called PACMAN M1 chip attack created by MIT security researchers succeeded in defeating what has been described as “the last line of security” on Apple Silicon.

When designing the M1 chip, Apple created various layers of security, each designed to protect against an attacker who succeeded in penetrating the previous ones. Its final layer is a security feature known as PAC – and this has now been defeated …

The financial problems of iPhone spyware maker NSO were so bad by the end of last year that it struggled to make payroll – after the company failed to make a single sale over a period of several months.

The company, which sells software to remotely carry out zero-click hacks of both iPhones and Android smartphones, has been in deep trouble ever since it was blacklisted by the US government. However, its plan to overcome its woes could make Pegasus an even nastier threat …

The prospect of a world without passwords can’t come soon enough for me, but a problem has been raised with the FIDO standard designed to eliminate the need for them. Namely, that abandoning passwords could make it harder to switch between ecosystems.

If you have your passkeys setup for Apple devices, there is nothing in the standard allowing you to transfer them to an Android device, or vice versa …

A Verizon employee database was recently compromised with the hacker holding it for a $250,000 ransom. Verizon says it doesn’t believe it contains “any sensitive information” and stopped communication with the hacker. However, the list of details including employee email addresses, phone numbers, and more could present a risk for future attacks.

Way back in 2017, a security researcher created a fake apple.com website where the URL looked completely correct. The trick was that the domain he registered used a unicode character that looks like an “a” but is in fact a Cyrillic character.

Browsers were updated to detect this kind of fakery, but it’s far from a simple process – as a new video (below) illustrates …

Apple has released iOS 15.5, macOS 12.4, and more today with updates like new features for Apple Cash, the Podcasts app, and the Studio Display webcam fix. However, a bigger reason to update your devices is the security patches with today’s releases. iOS 15.5 includes almost 30 security fixes while macOS 12.4 features over 50.

In early 2020, Apple joined the FIDO Alliance, an open industry association created to increase the interoperability of authentication methods and reduce reliance on traditional passwords. Now Apple, Google, and Microsoft have committed to expanding support for the FIDO Standard, moving toward a universal “passwordless” sign-in method.

After digging into Apple Silicon, researchers have discovered a new vulnerability that affects Apple’s latest M1 and A14 chips. The Augury Apple Silicon microarchitectural flaw has been demonstrated to leak data at rest but doesn’t appear to be “that bad” at this point.

The Spanish prime minister’s iPhone was infected by NSO’s Pegasus spyware, says the government. Defense Minister Margarita Robles’ phone was also hit. This is just the latest in a slew of high-profile Pegasus attacks revealed within the last few weeks.

While it is foreign governments who would most want to target phones belonging to most prime ministers, there’s another obvious suspect in the case of Spain …

Cellebrite iPhone cracking kit allows the company’s clients to access virtually all of the private data stored on a phone – in some cases, even if the phone is locked.

But the exact capabilities depend on both the model of the iPhone and the version of iOS it is running. We managed to get access to the user documentation for a recent version of the kit to see what it can do …

We learned last month that Apple was tricked into releasing personal data to hackers, after they posed as law enforcement officials with emergency data requests. A follow-up report reveals that some of this data was used to sexually extort minors.

The latest report also sheds light on how the hackers were able to fool Apple and other tech giants, including Facebook, Google, Snap, Twitter, and Discord …

T-Mobile has suffered another data breach, this time carried out by young hackers that were part of the LAPSUS$ group. While T-Mobile has said that no customer or government information was compromised, it appears LAPSUS$ gained access to T-Mobile’s source code repositories along with its customer account management system.

An iCloud crypto wallet attack saw an estimated $650,000 worth of cryptocurrency and NFTs stolen from a trader within seconds.

While the attack relied on a sophisticated piece of phishing, it also revealed a key iCloud vulnerability with MetaMask …

NSO spyware Pegasus targeted US iPhones indirectly, despite the company forbidding customers from infecting phones with American SIMs. Devices belonging to Catalan politicians and others were also infected, with the Spanish government suspected to be responsible.

Additionally, it was discovered that a device connected to the network at 10 Downing Street – the office of British prime minister Boris Johnson – was also infected …

With the release of macOS Monterey 12.3.1 on March 31, Apple has fixed two zero-day exploits in its operating system. However, the company is yet to patch these exploits in macOS Big Sur and macOS Catalina – as these versions were likely affected by the same vulnerabilities and are still supported by the company.

It’s been revealed that NSO’s Pegasus hacked the iPhone of an award-winning journalist, just weeks after Apple sought an injunction that would bar the company from targeting iPhone users.

NSO’s Pegasus software is so dangerous for two reasons. First, it gives access to almost all the data on the phone, including messages, photos, and location. Second, it works via a zero-click approach …

With the release of iOS 15.4.1 and macOS Monterey 12.3.1 on Thursday, Apple has fixed some bugs in its operating systems. However, in addition to bug fixes, the company also made security enhancements to iOS and macOS, which include patches for multiple zero-day exploits.