The Israeli forensics firm Cellebrite revealed this week that it now has the ability to unlock any iOS device that’s running up to iOS 12.3. The firm made the announcement on Twitter, touting a new version of its Universal Forensic Extraction Device.
Apple announced its upcoming single sign-on service “Sign in with Apple” at WWDC last week and it’s received quite a bit of attention, including concerns about a requirement to include the Apple offering if an app offers a login with a Google or Facebook option. Today, The Verge has shared an interview with Google’s product management director covering the company’s own SSO feature, how he feels about Apple’s entrance to the space, and more.
A new report today from The Wall Street Journal takes another look at the growing problem of how apps are sharing user data with third-party companies without user knowledge. While this happens on both iOS and Android, the report focuses on iPhone since Apple has strong beliefs about privacy. While the company hasn’t announced anything official, WSJ sources have said that Apple is going to tighten up app privacy soon, starting with kids’ apps.
Apple, Google, Microsoft and 44 other organisations and security experts have signed an open letter condemning a proposal to secretly add law enforcement organizations to encrypted chats and calls.
As expected, a second teenager who hacked into Apple servers and downloaded internal company documents has also been granted probation by an Australian court. It follows the same outcome for his fellow hacker last year.
The first teen was 16 years old at the time the attacks began, while the second was even younger, at just 13 …
Multiple Snapchat employees spied on users by misusing internal tools, accessing such information as location, phone numbers and their own saved Snaps.
The tools are supposed to be used to help the company fight spam and abuse, and to comply with law enforcement requests, but many staff have access and are abusing it, say former employees …
Following the announcement of new speculative execution exploits that target Intel CPU architecture, Apple has posted a new document on its website that explains how customers with computers that are ‘at heightened risk’ of attack can enable full mitigation. Full mitigation is not enabled by default as it is probably an excessive amount of security for the average user, and it comes with big performance penalties.
In its tests, Apple recorded up to a 40 percent drop in performance with full mitigation activated. This is because enabling MDS protection involves disabling hyper-threading entirely, and adds additional barriers when the processor switches contexts.
Last fall, Facebook discovered a major flaw with its “View as” feature which saw security tokens for 50 million accounts stolen. Facebook has today announced its security review of the incident is complete and has brought back the View as Public feature in addition to adding a quick button to “Edit Public Details.”
While there has been lots of talks about regulating Facebook and the tech industry as a whole, there’s so far been no real action. Now Facebook’s cofounder, Chris Hughes has published an opinion piece today in The New York Times, making the case for why Facebook needs to be broken up. But beyond that, he believes we need a new government agency to handle the growing tech regulation issues. Read on for the five main reasons Facebook’s cofounder believes the platform needs to be broken up.
Smart home devices are ‘creepy’ according to the majority of people who own them, based on an Ipsos MORI poll. Two-thirds of US owners of smart home gadgets bought them despite this feeling.
The take-away appears to be that consumers consider the convenience to outweigh privacy concerns …
Smart home devices are potentially one of the bigger security threats since there is no easy way to check what they are up to on your network. That’s a problem Princeton University has set out to solve, with the Princeton IoT Inspector.
It works on HomeKit and non-HomeKit devices alike …
In yet another abuse of the enterprise distribution program, security analyst Lookout has identified apps (via TechCrunch) that were pretending to be published by cell carriers in Italy and Turkmenistan. The apps were available for iPhone users to download through Safari as they were signed by an enterprise certificate. These apps used carrier branding and pretended to offer utilities for the users’ cell plans when in reality they would ask for every permission they could to track location, collect contact, photos, and more, and had the capability to listen in on users’ phone conversations.
Apps using enterprise certificates are not available through the App Store, but malicious criminals can target iOS users through Safari (perhaps with a phishing attack-esque email) and get people to download the app over the web, outside of the purview of the App Store review process.
In the latest security gaffe for Facebook, millions of private records from the platform’s users have been found unprotected on Amazon’s cloud servers.
White-hat hackers at a security conference in Vancouver have found two zero-day Safari exploits, one of which allowed them to escalate their privileges to the point that they were able to completely take over the Mac …
Microsoft is renaming its Windows Defender antivirus software to Microsoft Defender Advanced Threat Protection (ATP), and bringing it to macOS for the first time.
In the latest episode of consumers affected by tech companies’ security flaws, Comcast’s Xfinity Mobile wireless service was found to be setting customer PINs by default to 0000. As reported by The Washington Post (via The Verge) one of the users who had their phone number stolen because of Xfinity’s weak PIN default even saw a hacker purchase an Apple computer with his credit card.
A new post from the EFF (Electronic Frontier Foundation) today has announced a new initiative called “Fix It Already.” The first post describes specific privacy and security issues that Apple and eight other major tech companies should fix right now.
The Cellebrite Universal Forensic Extraction Device (UFED) is a smartphone hacking tool commonly used by the FBI, Department of Homeland Security and other law enforcement agencies in the US and elsewhere. It’s the most powerful tool yet created by the Israeli company, able to extract a huge amount of data – even data which has been deleted from phones.
A brand new one normally costs $5,000 to $15,000 depending on the model, but older models can be found on eBay for as little as $100 …