Feedback & Followups
- 🇷🇺 🇺🇦 More fallout from Russia’s invasion of Ukraine:
- 🇷🇺 Courts in Russia Declare Meta an “Extremist Organization,” Ban App — www.macobserver.com/… (WhatsApp)
- 🇷🇺 Google News appears to have been blocked in Russia — www.imore.com/…
- 🇷🇺 The Financial Times has warned that many apps use Russian internet-giant Yandex’s AppMetrica analytics package and that it sends data to Russian servers, where it’s subject to Russian law and can be easily obtained by the government — arstechnica.com/…
- 🇺🇦 Related: Ukrainian developer MacPaw has released a free macOS app named SpyBuster which finds apps with connections to Russia on your Mac (requires macOS 10.15 or later) — research.macpaw.com/…
- 🇷🇺 Spotify is pulling out of Russia — www.imore.com/…
- Social Media News:
- The Washington Post: ‘Facebook Paid Republican Strategy Firm to Malign TikTok’ — daringfireball.net/… (Editorial by Bart: this is a whole new level of ick 🙁)
- Instagram Rolls Out Chronological Favorites and Following Feed Options — www.macobserver.com/… (allows users avoid the algorithm)
- WhatsApp is limiting how people forward messages to each other — www.imore.com/… (an attempt to slow down the spread of mis/dis-information)
- 🇺🇸 Recent indictments show a new trend in malicious tracking — abusing AppleWatches:
- Prosecutors in the SDNY (Southern District of New York) have charged 7 with abusing AppleWatches to track their intended theft victims — www.macobserver.com/…
- In Nashville a man was arrested after being caught using an AppleWatch strapped to the wheel of his girlfriend’s car to track her as she fled to a Family Safety Center — www.imore.com/…
- 🇺🇸 Arizona First State to Accept ID in Apple Wallet at TSA Security — www.macobserver.com/…
- Mystery solved – thanks to an email reply from Craig Federighi, we now know why iOS updates can be slow to arrive – it’s by design, Apple use a 1-to-4-week rollout! — www.imore.com/…
> “We incrementally rollout new iOS updates by first making them available for those that explicitly seek them out in Settings, and then 1-4 weeks later (after we’ve received feedback on the update) ramp up to rolling out to devices with auto-update enabled.”
Deep Dive 1 — ProtestWare a Controversial and Dangerous New Form of Protest
One of the things I (Bart) pointed out in that case, is that the developer was merely making a point, and while he caused disruption, he didn’t do any real damage, but he could have!
In this case the motivation was very different, and I guess, somewhat understandable. The developer has ties to Ukraine, and he was (and presumably still is) very angry about Russia’s invasion of the country. He started by adding non-destructive pro-peace protest code into the very popular
node-ipc module. He did this by creating a new module he named
peacenotwar which will “add a message of peace on your users’ desktops, and it will only do it if it does not already exist just to be polite.”. He then added this module to
node-ipc as a dependency. A dependency must be loaded first for the main module to function.
In case you’re wondering,
node-ipc is (or at the very least, was) a very popular tool for solving this problem, getting near a million weekly downloads on NPM.
Having protest messages appear unexpectedly on your desktop is ethically questionable, but given the seriousness of the situation, I’m prepared to give some credence to the argument that it’s justified. I’d definitely say it falls into the moral grey zone. It’s definitely not indisputably evil.
Unfortunately, the developer didn’t stop there. He escalated things, adding code to
peacenotwar that determined if the user was in Russia (based on IP address), and if so, deleted their files. This is where I (Bart) draw the line. This is irresponsible and dangerous. All code has bugs, and geolocation is imperfect, so there is a very real danger of doing real harm here. Also, just because you’re in Russia does not mean you support Putin’s invasion!
There is room for a debate around how much protest code is acceptable in the open source community. But clearly, this went too far. FWIW, I’m (Bart’s) in the ‘none’ camp — the place for protests is your release notes, documentation, and website, not in your open source code!
As for how this ended — the destructive code was removed by NPM, but even today (3 April 2022),
node-ipc still lists
peacenotwar as a dependency, so the non-destructive protest code continues to ship with
The bottom line remains the same though — it was always a bad idea to blindly and automatically consume all updates to all dependencies in your software projects. Dependency changes need to be deliberate acts, not invisible automations! All that’s changed is that the dangers have gone from hypothetical to actual. It was always a bad idea, and it remains a bad idea!
- Good coverage of the story: BIG sabotage: Famous npm package deletes files to protest Ukraine war — www.bleepingcomputer.com/…
Deep Dive 2 — Beware 1st Generation Wyze Cameras 🙁
TL;DR — if you have a Wyze generation 1 camera, it is not safe to use anymore. It has a critical un-patchable vulnerability. If you have a V2 or V3 Wyze camera, it’s very important you make sure it is fully patched.
We now know that in March 2019 the security company Bitdefender informed Wyze of a major vulnerability in their cameras. Attackers could remotely control the cameras and view videos saved on the SD card, but not watch a live stream.
Wyze did not acknowledge receipt of the report until November 2020. They did not patch the vulnerability until January 2022.
In February 2022 they discontinued the V1 camera because it can’t be patched as the hardware simply can’t work with the patch. They told users the camera was incompatible with a security update, and that using it would put them at ‘increased risk’ but gave no details.
Wyze never disclosed the details. The only reason we know about this at all is that the details were leaked to the press. It’s also important to note that Bitdefender didn’t disclose this vulnerability either. It is customary for security companies the disclose vulnerabilities in a relatively short time period, but Bitdefender says that they didn’t want to make millions of cameras vulnerable when they knew the company wasn’t going to be able to fix the problem. That response from Bitdefender isn’t being widely accepted in the security community.
It’s hard to imagine how Wyze’s response could have been worse. They sat on the problem for a year and a half, were slow to patch it even then, and were utterly opaque in communication with their users.
This is such a breach of customer trust in Allison and my opinion that we can’t ever trust them again. As a result, we will be advising all our friends and family to avoid all the company’s products from now on and to work to replace any Wyze cameras they have now.
- A good summary from Engadget: Wyze was aware of a major camera security flaw for three years — www.engadget.com/…
Deep Dive 3 — The EU Agrees on the DMA
The European Union has been working on a major new regulation to tackle the anti-trust concerns raised by big tech. This act is known as the Digital Markets Act, or the DMA.
It’s important to note that while the act passed a very major milestone this week, it has not passed, and a lot of the details remain to be worked out.
It’s important to remember that, unlike the USA, the EU it’s not a single country, so laws don’t get passed as they do within nations. The European Commission draft acts that need to get passed by both the European Parliament and the Council of Ministers to become directives, then each country then translates the directive into national law.
To avoid problems down the road, the Commission set up a marathon trialogue with representatives from the parliament and the council to hammer out a final deal on the DMA, and it’s that deal that was done this week. This means all three legislative branches of the EU agree on what will and won’t be in the act, but the final wording has not been written yet, and nothing has been passed yet. As the Commission put it in their own press release:
“After the legal text is finalised at technical level and checked by lawyer-linguists, it will need to be approved by both Parliament and Council. Once this process is completed, it will come into force 20 days after its publication in the EU Official Journal and the rules will apply six months after.”
So, we don’t have the final “technical level” text, and even when we do get it, it will still be open to interpretation. The act will give sole enforcement authority to the European Commission, but the first step will be an engagement between the commission and the company to try to agree on a path to compliance, so there’s a heck of a lot of uncertainty when it comes to the specifics.
With all those caveats out of the way, what has been agreed upon?
Firstly, since the point of this act is to fight anti-competitive behaviour, it will only apply to large corporations that provide core platform services and have been designated as gatekeepers. So unlike the GDPR, this law won’t apply to the vast majority of companies. The Commission will designate companies as gatekeepers. To be considered possible gatekeepers they really do need to be big — having a market cap of €75Bn or annual turn-over of €7.5Bn, and they must have at least 45M monthly users in the EU, and at least 10K yearly business users in the EU.
The act specifies both a list of responsibilities Gatekeepers have and a list of prohibitions. I’m not going to list them though, you can read those for yourselves 🙂. Instead, I want to focus on a few of the more important aspects.
No Data Sharing Without Explicit Consent
Gatekeepers can’t aggregate data from multiple services, including third-party services without explicit consent from the user. Targeted advertising is explicitly called out in the act as requiring consent.
In a very nice touch, gatekeepers can only nag you once a year to re-consider your choice not to consent!
Gatekeepers Must Allow Customer Choice
Exactly how far this will go isn’t clear yet, but the press release from the Commission says gatekeepers will have to “allow users to freely choose their browser, virtual assistants or search engines”.
It seems pretty clear alternative payment methods will have to be allowed in mobile apps, and it seems very likely there will be some kind of requirement for selling apps outside the gatekeeper’s own app stores, but that doesn’t necessarily mean a Wild West where anything goes. In press comments, Commission staff talked about “multiple safe and secure app stores” but didn’t mention sideloading.
Messaging Services Must Support Interoperability on Request
This was not a part of what the Commission wanted to do, so it came as a surprise to me that it was added to the act, but the Parliament was adamant that gatekeepers who run messaging services be forced to support interoperability with smaller services.
As it stands, the act will require gatekeepers to make APIs available to allow smaller messaging services to interoperate with their messaging services on request. Initially, this will only apply to one-on-one conversations. In comments, I’ve come across where the Commission staff made it clear they expect the APIs to support end-to-end encryption. The hope is that in four years it will be possible to add an interoperability requirement for group messaging as well.
- Unsubscribing from services has to be as easy as subscribing to them
- Developers must be given ‘fair’ access to ‘supplementary functionalities’ on mobile devices, i.e. things NFC.
- Sellers need to be given access to sales data on the things they sell in marketplaces run by gatekeepers
- Gatekeepers can’t rank their own services higher than others, i.e. a ban on ‘self preferencing’
- The press release announcing the deal — www.europarl.europa.eu/…
- A good overview: Europe says yes to messaging interoperability as it agrees on major new regime for Big Tech — techcrunch.com/…
- EU doubles down on new law that could force Apple to allow side-loading and more — 9to5mac.com/…
❗ Action Alerts
- ❗ Google Chrome patches mysterious new zero-day bug – update now — nakedsecurity.sophos.com/…
- ❗ Apple pushes out two emergency 0-day updates – get ’em now! — nakedsecurity.sophos.com/… & iOS 15.4.1, iPadOS 15.4.1, macOS 12.3.1 Monterey, and Siblings Fix Bugs and Security Vulnerabilities — tidbits.com/…
- If you have a QNAP NAS that’s connected to the internet, and not patched, then it’s time to fix that because Sophos are warning about active attacks by the DEADBOLD ransomware that are exploiting these NAS boxes to destroy backups before deploying a regular ransomware attack — nakedsecurity.sophos.com/…
- A pair of major vulnerabilities has been found in the Spring Java framework by VMWare. It has nothing to do with their virtualisation products! If you’re in corporate IT, and you have apps that use Spring, it’s critical they be patched. It’s extremely unlikely there is anything regular folks can, let alone need, to do — nakedsecurity.sophos.com/… (Maybe buy your friendly neighbourhood corporate sysadmin a coffee 😉)
- 🇺🇸 The Federal Trade Commission (FTC) has entered into a Consent Decree with popular custom printing site Café Press for ‘Data Breach Coverup’ that will see the company pay a fine of $½Bn and submit to a security assessment Biennially (every 2 years) for the next 20 years — nakedsecurity.sophos.com/… (Editorial by Bart: the story is worth a read because the FTC are extremely critical of Café Press for both how bad their security was before the breach, and how ineffective and dishonest their response was.)
- 🇺🇸 Brian Krebs has warned that hacked US law enforcement accounts are being used to trick major tech companies, including Apple & Meta (Facebook), into handing over user data. Normally a subpoena is needed to get data, but there is a procedure for bypassing that requirement in cases where there is an immediate threat to life. Illegitimate access to any legitimate law enforcement email account is all attackers need to get the data they want — krebsonsecurity.com/… & www.macobserver.com/… (Editorial by Bart: this means the entire system is as strong as the weakest IT practices in the smallest of US police departments 😨)
- Related: Fake Emergency Search Warrants Draw Scrutiny from Capitol Hill — krebsonsecurity.com/…
- Apple Stores won’t repair iPhones that are marked as missing anymore — www.imore.com/…
- 🎧 Related Tip: Checklist 273: What Do You Do If You Lose Your iPhone? — overcast.fm/…
- World Backup Day: 5 data recovery tips for everyone! — nakedsecurity.sophos.com/… (March 31st was World Backup Day)
- If you’ve been meaning to get started with offsite backups, consider Allison’s favorite company Backblaze. With her affiliate link you can get one month free and so will she: secure.backblaze.com/…
- 🎧 The Business Wars podcast has a special episode on EVs to preview their next mini-series, Tesla -v- Detroit: Best of Business Wars Daily: Electric Vehicles Shock the System — overcast.fm/…
When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.
|🎧||A link to audio content, probably a podcast.|
|❗||A call to action.|
|flag||The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.|
|📊||A link to graphical content, probably a chart, graph, or diagram.|
|🧯||A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂|
|💵||A link to an article behind a paywall.|
|📌||A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.|
|🎩||A tip of the hat to thank a member of the community for bringing the story to our attention.|