S3 Ep145: Bugs With Impressive Names!
Credit to Author: Paul Ducklin| Date: Thu, 27 Jul 2023 16:47:06 +0000
Fascinating fun (with a serious and educational side) – listen now! Full transcript available inside.
Read moreiPhone
S3 Ep141: What was Steve Jobs’s first job?
Credit to Author: Paul Ducklin| Date: Thu, 29 Jun 2023 16:58:40 +0000
Latest episode – listen now! (Full transcript inside.)
Read moreHow and why to use FIDO Security Keys for Apple ID
In a world that needs Apple’s recently-improved Lockdown Mode to protect good people against bad ones, high-risk individuals should consider using physical security keys to protect their Apple ID.
What are Security Keys and what do they do?
Security keys are small devices that look a little like thumb drives. Apple at WWDC 2020 confirmed plans to support FIDO authentication beginning with iOS 14 and macOS 11; now, with the release of iOS 16.3, iPadOS 16.3, and macOS Ventura 13.2, Apple lets you use them to verify your Apple ID, replacing a passcode. They become one of the two forms of identification you require with two-factor authentication (2FA).
Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!
Credit to Author: Paul Ducklin| Date: Fri, 19 May 2023 01:02:03 +0000
All Apple users have zero-days that need patching, though some have more zero-days than others.
Read moreApple, Google team up to tackle Bluetooth tracker-stalking terror
The days when people can be abusively tracked using devices such as Apple’s AirTags may be numbered; both Apple and Google today jointly announced work on a new standard that will prevent this from happening and hinted that Android users will soon be able to tell whether they’re being tracked by an AirTag.
Got to stop tracker abuse
The two companies say they have been working on a new industry specification to help prevent Bluetooth location-tracking devices being used to track people without permission. They also seem to have the industry behind them, as Samsung, Tile, Chipolo, eufy Security, and Pebblebee have all expressed support for the draft specification, which has been filed with the Internet Engineering Task Force (IETF).
Jamf debuts sophisticated security protection for executive iPhones
Newton’s Third Law of motion argues that for every action there is an equal and opposite reaction. With that in mind, it’s no surprise that the Apple ecosystem is fighting back in a big way against the mercenary spyware companies that have made headlines recently.
Improving situational awareness
Few people in tech sit comfortably with NSO Group and others in their attacks against journalists, human rights advocates, and high-value targets on behalf of repressive governments. They know that these technologies tend to proliferate, which is why most firms are now engaged in finding new ways to fight back.
Security researchers uncover NSO Group iPhone attacks in Europe
Earlier this week, we saw research showing the noxious NSO Group continues to spy on people’s iPhones in Mexico. Now, Jamf Threat Labs has found additional attacks against human rights activists and journalists in the Middle East and Europe, one of whom worked for a global news agency.
Older iPhones at most risk
The main thrust of the latest research is that while Apple has taken steps to protect devices running the most recent versions of iOS, these attacks are still being made against older iPhones. Jamf warns that the attacks “prove malicious threat actors will exploit any vulnerabilities in an organization’s infrastructure they can get their hands on.”
Yet more digital spies targeting iPhones exposed by security researchers
Just weeks after President Biden signed an executive order designed to prevent the US government from purchasing commercial spyware used to subvert democracies, researchers have identified yet another shameful zero-click, zero-day exploit that targeted iPhone users. This spy-for-hire ‘solution’ was sold by an Israeli firm called QuaDream.
Making everyone less safe
QuaDream’s attacks have been exposed by security researchers at Microsoft and Citizen Lab. QuaDream is a more secretive entity than NSO Group but shares much of the same pedigree, including being founded by ex-NSO Group employees and having connections to Israeli intelligence. Its attacks were first exposed last year, but the researchers have since found more about how these digital mercenaries worked.
Apple issues emergency patches for spyware-style 0-day exploits – update now!
Credit to Author: Paul Ducklin| Date: Sat, 08 Apr 2023 01:20:44 +0000
A bug to hack your browser, then a bug to pwn the kernel… reported from the wild by Amnesty International.
Read moreApple patches everything, including a zero-day fix for iOS 15 users
Credit to Author: Paul Ducklin| Date: Tue, 28 Mar 2023 00:23:24 +0000
Got an older iPhone that can’t run iOS 16? You’ve got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.
Read more