A new exploit called “Log4Shell” has been giving security teams at large technology companies a headache. When exploited, the vulnerability lets hackers run malicious code on vulnerable servers, and it can reportedly affect platforms such as iCloud and Steam.
Expand Expanding Close
Facebook 2FA (two-factor authentication) will become mandatory for accounts likely to be targeted by hackers. The move is one of a range of protections offered to high-risk accounts in order to reduce the likelihood of interference in elections.
Expand Expanding Close
As part of hitting back at spyware company NSO, Apple alerted a Polish prosecutor that her iPhone appears to have been compromised by Pegasus. This also gives us our first look at the text of Apple’s security alerts.
Although Poland has not admitted purchasing and using the spyware, there is significant evidence that it has done so …
Expand Expanding Close
Journalists, lawyers, politicians, and human rights activists have all been targeted by NSO’s Pegasus software, and Apple has now said that it will send security alerts to customers whose devices may be been compromised. It has already done so for at least five Thai activists and researchers.
It follows Apple’s announcement yesterday that it is suing NSO for attacking iOS users …
Expand Expanding Close
Apple on Tuesday announced that it has filed a lawsuit against NSO Group, which is known for developing the advanced spyware “Pegasus” to attack and surveil users of iOS and Android devices. The company claims that it is suing the creators of the spyware to “prevent further abuse and harm to its users.”
Expand Expanding Close
An alleged member of the REvil ransom group has been charged, with $6.1M in funds seized from another suspect, according to the US Department of Justice.
Back in April, we learned that the REvil group accessed systems belonging to Mac assembler Quanta and obtained schematics of the upcoming MacBook Pro models, which accurately revealed the HDMI, MagSafe, and SD card slot …
Expand Expanding Close
The NSO group, whose Pegasus spyware is used to hack iPhones and Android smartphones, has been officially named by the US government as a threat to national security.
The Commerce Department’s Bureau of Industry and Security (BIS) has added the Israeli company to the Entity List, which bans the company’s products from being imported, exported or passed from one organization to another within the US.
Expand Expanding Close
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive, requiring federal agencies to apply 24 Apple security patches.
The deadline for some of these is November 17, less than two weeks from now.
Expand Expanding Close
October is Cybersecurity Awareness Month and whether you’re an expert or are new to iPhone, iPad, Mac, and more, it can be useful to audit your security settings. Let’s look at 10 tips for an Apple device security checkup.
Expand Expanding Close
A New York Times journalist covering the Middle East has described the experience of his iPhone being hacked, and the security precautions he now takes as a result.
Ben Hubbard says there were four attempts to hack his iPhone, and that two of them succeeded, with all the signs pointing to the use of NSO’s Pegasus spyware.
Expand Expanding Close
Back in April, the REvil ransomware group hacked into Mac assembler Quanta to reveal 2021 MacBook Pro designs ahead of the launch. Now REvil has itself been hacked in an FBI-led operation, in partnership with the Secret Service and law enforcement agencies in multiple countries.
Law enforcement gained control of a number of REvil servers in an operation designed to prevent further attacks, and to pursue individuals involved in running the ransomware group …
Expand Expanding Close
Last month security researcher Denis Tokarev, aka illusionofchaos, shared his experience of reporting three zero-day iOS vulnerabilities to Apple with specific criticism around how the company is slow to respond, act, and didn’t give him credit for one of the three flaws that were patched. Now it appears Apple has fixed another zero-day flaw, this one in iOS 15 that Tokarev found earlier this year, without giving him credit.
Expand Expanding Close
Amid growing pressure from private companies and governments to allow sideloading on iOS, Apple is out today with a new security paper diving into real-world data on how malware is impacting mobile devices. Along with statistics like Android having between 15 and 47 times more malware than iPhone, Apple is making its latest case against sideloading with data and recommendations from the US Department of Homeland Security, European Agency for Cybersecurity, NIST, Norton, and more.
Expand Expanding Close
Update: Statement from Visible added below
Multiple reports of an apparent Verizon Visible hack, with attackers changing shipping addresses, then ordering phones that are charged to payment details held for customers. Visible is a Verizon sub-brand that operates entirely online, meaning that customers cannot seek assistance in-store.
“My account got hacked and they shipped out an iPhone 13 worth $1k that was taken from my PayPal,” wrote one customer …
Expand Expanding Close
Cybersecurity Awareness Month is mostly geared toward businesses rather than individuals, encouraging them to ensure they carry out risk assessments and follow best practices to protect their IT systems. (There appear to be one or two companies who could use a little work there…)
But it’s also a worthwhile reminder to individuals to check their own cybersecurity, and for us to offer some advice to less-techie friends and family members.
Expand Expanding Close
Both the Facebook and Twitch messes were caused by configuration errors, admit the companies. A mistake by Facebook led to a prolonged global outage of all the company’s services, while a similar error by Twitch left all its files exposed to a hacker …
Expand Expanding Close
It appears that the entirety of Twitch.tv was hacked, so if you have an account there, you’ll probably want to change your password …
Expand Expanding Close
The Federal Communications Commission (FCC) is calling on carriers to implement better security protections against SIM-swap and port-out attacks.
These attacks are a common way for criminals to carry out identity theft, and take over anything from an Apple ID to a bank account …
Expand Expanding Close
A security researcher has shown that AirTags can be weaponized by injecting code into the phone number field before placing it into Lost mode and dropping it in strategic places. Apple has confirmed the finding.
When someone finds the AirTag and scans it, they will be redirected to the website of the attacker’s choice, which could include a fake iCloud login to report the find …
Expand Expanding Close
Apple overhauled its security bounty program back in 2019 by making it open to anyone, increasing payouts, and more. However, the program has seen a good amount of criticism from the infosec community. Now another security researcher has shared their experience claiming that Apple didn’t give them credit for one zero-day flaw they reported which was fixed and that there are three more zero-day vulnerabilities in iOS 15.
Update 9/27: After sharing his experience publicly, Apple has responded to security researcher illusionofchaos, aka Denis Tokarev.
Expand Expanding Close
A Mac shortcut bug can enable an attacker to take over your machine when you open an email, using nothing more than a standard internet shortcut file.
Apple claims to have patched the bug in Big Sur and Monterey, but the security researcher who discovered the issue says that this is only partly true.
Expand Expanding Close
Apple giving into Russia twice this week on key civil liberties issues proves that the company’s CSAM misuse assurances cannot be trusted, argues a high-profile security expert.
Apple today pulled from the App Store an opposition tactical voting app after the Russian government threatened specific local company employees with “punishment” if they refused. It turns out that Apple also turned off its Private Relay service in Russia just yesterday, likely also in response to government pressure…
Expand Expanding Close
An iPhone exploit sold to the United Arab Emirates for $1.3M was developed by a US company that used American mercenaries to facilitate the sale, according to the Department of Justice …
Expand Expanding Close
CloudKit is an Apple framework integrated into iOS and macOS that works as a backend for apps. Developer Frans Rosén has found a way to use Apple’s cloud platform to delete public Siri Shortcuts and even content from other Apple apps such as Apple News.
Expand Expanding Close