Home

Podfeet Podcasts

Security Bits — 20 April 2025 (Solo) 🐣

  • by Bart Busschots

    • Feedback & Followups

    • Rather aptly for this solo show, NosillaCastaway MildDeamons perfectly expressed the reason I much prefer recording with Allison on the NosillaCast Slack when he posted:
      > “I really enjoy it (and I think most of us do) when you explain things to @podfeet and she tries to wrap her head around them. The best part is when one of you say something that doesn’t quite make “sense” to me — I’m sitting there thinking, ‘Hmm, that doesn’t seem right…’ — and then @podfeet jumps in with, ‘Wait, wait… do you mean…?’ And you go on to explain it another way, and them I’m, ‘Ahhhh, now I get it!'”
    • Oracle continues to illustrate how not to respond to security breaches by continue to try, and fail, to cover up a breach of their wider cloud services (above and beyond the Oracle Health breach we mentioned last time) — www.bleepingcomputer.com/…
    • Some small but nice progress from Microsoft on some of their on-going efforts we’ve discussed before:
    • GitHub have responded to the increased abuses of their services by malicious actors by making it easier and cheaper for organisations to buy their advanced security tools — www.bleepingcomputer.com/…
    • Google continue to battle the rise of ad-based malware on their platforms: Google blocked over 5 billion ads in 2024 amid rise in AI-powered scams — www.bleepingcomputer.com/…
    • 🇺🇸 We now have an explanation for the embarrassing and illegal ‘Signal-Gate’ woopsie by the US administration — the National Security Advisor un-thinkingly accepted a Siri suggestion to update a contact in his phone — www.macobserver.com/…
      • This was spun as it all being Apple’s fault by the administration, but it is of course no such thing, it actually perfectly illustrates why secure government communications need to happen on secure and private government channels!
      • This means the national security advisor was careless twice rather than just once, not sure how that makes anything better? 😕
      • Humans make mistakes, when you use a public service, not matter how cryptographically secure, those human mistakes can leak secrets to anyone on planet earth, but similar mistakes on private government channels have much smaller blast-radiuses.
    • 🇬🇧 There is still no outcome, and we still have very little detail, but Apple have succeeded in lifting the veil of secrecy over the UK government’s attempt to break iCloud Advanced Encryption for the world — www.cultofmac.com/…

    Deep Dive — How Apple is Training Apple Intelligence without Breaking their Privacy Promise

    TL;DR — there is nothing even vaguely nefarious or dangerous going on here, none of this is enabled by default, it’s all opt-in, and for those who do opt in, it their privacy is provably protected.

    When you’re interested in big trends, you don’t need exact data. In fact, just about every real-world statistic is built on top of noisy and incomplete data because there are very few situations where everything can be known perfectly! What percentage of Americans owns a Ford vehicle? Simple question, we rarely think twice about how those numbers come to be, but for them to be perfectly accurate every single American would need to respond to the analytics company compiling the numbers truthfully. Impossible! So, we base statistics on small samples we hope are representative where we have reason to believe most respondents are truthful. As long as the sample is fairly representative of the total population and the responses are reasonably honest you get usable numbers out the other side.

    With computer usage data you can actually get perfectly clean data, but at the cost of everyone’s privacy. To determine which typos Apple’s autocorrect fixes most often iOS & macOS could log every change and send them all to Apple! That would utterly violate Apple’s privacy promises and policies, but Apple still want to get a reasonable understanding of how their tools are used in the real world by actual users, so how can they square that circle? By intentionally adding random gibberish to the data to make it noisy! If you know the accuracy of your sampling (100% for which OS features a user does and does not use), and the accuracy you actually need, you can calculate the amount of intentional lies you can inject into your raw data without ruining your results. This is what Apple have been doing for years for all their OS analytics, and it has the fancy name differential privacy. Basically, when you agree to let your iPhone, iPad, or Mac send Apple analytics data, each piece of data gathered will be replaced with an intentional lie a specific percentage of the time. This means no one piece of data can ever be used as evidence of anything, because you know for a fact how likely it is to be a lie, and yet, when you aggregate it all together, the signal still pokes up above the noise, letting Apple make meaningful product decisions.

    Apple is now extending this approach to Apple Intelligence — for tools like image playgrounds and genmoji, the prompts people who opt in to sending Apple analytics data will be shared with Apple using differential privacy. That works great for AI features powered by short little prompts, but not for AI features that take huge inputs like summarisation.

    Here Apple are being wonderfully clever — instead of training and testing their models on real emails from people’s actual inboxes, they’re using generative AI to create fake but realistic emails to use instead. This protects user privacy perfectly because no ones actual emails are ever involved in any stage of the process. But, the quality of the training entirely depends on the realism of the synthetic data. What Apple need to do is not harvest your emails, but check how similar your emails are to their synthetic ones, and this is something you can achieve safely with the help of differential privacy.

    Apple are not going to gather your emails and upload them to their servers, instead, they’re going to randomly send devices where users have opted in a few synthetic emails, and on-device, the OS will perform statistical comparisons between users actual emails and the sample synthetic ones, and report those statistics back to Apple’s servers with intentional lies mixed into all the replies. So, even without differential privacy this would already not be sending actual emails to Apple, but for extra protection, even the statistics it does send are intentionally noisy, making it mathematically impossible to actually know what emails are on who’s devices. But, Apple will none-the-less be able to get a good estimate of the quality of their synthetic data.

    The key points to note:

    1. None of the data sent to Apple includes any kind of identifier — no device IDs, no user IDs, and no network identifiers like IP addresses, so what ever is sent is completely anonymous
    2. Everything that is sent is intentionally polluted with lies so no single piece of data can ever be used as evidence of anything
    3. For long pieces of text, users are not sending any actual data to Apple, but returning accuracy scores for Apple’s synthetic dummy data
    4. All this is opt-in rather than opt-out or compulsory

    Links

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    • 🇺🇸 The Trump administration continue to undermine the nation and the world’s cybersecurity 🙁
      • The Trump administration almost killed the CVE system for cataloging and scoring known security vulnerabilities — bleepingcomputer.com/… & krebsonsecurity.com/…
        • The CVE database acts as the data source for just about every vulnerability detection tool in use today
        • The CVSS Scores assigned to vulnerabilities in the CVE database make it possible for people with jobs like mine to triage and priorities our responses to what ever vulnerabilities our scanning tools alert us to
        • There has always been an independent board overseeing the CVE database, but the contract to do the actual work has always been with the US quasi-governmental agency MITRE and paid for by the US government, current via CISA
        • Moves were already afoot to remove the CVE database’s sole dependence on US good will, but those moves have now accelerated
        • At the last minute CISA invoked a clause in the contract with MITRE to extend the contact, but it has not been renewed, so MITRE’s work maintaining the CVE database hangs by a thread 😕
      • The Trump administration have attacked the first ever director of the Cybersecurity & Infrastructure Security Agency (CISA) Chris Krebs for his declarations on the legitimacy of the 2020 elections — krebsonsecurity.com/… (Ironically, Krebs was appointed by Trump in his first term)
        • Trump launched the attack in a published Presidential Memorandum directing all agencies to remove Krebs’ security clearance as well as those from all employees at the company he works for (SentinelOne), and instructs the Attorney General and Secretary of Homeland Security to launch an investigation into Krebs and CISA and propose “appropriate remedial or preventative actions”
          • “Krebs, through CISA, falsely and baselessly denied that the 2020 election was rigged and stolen, including by inappropriately and categorically dismissing widespread election malfeasance and serious vulnerabilities with voting machines.” — the Trump Memo
        • Krebs has resigned from SentinelOne to fight the Trump administration full-time, and to protect the company — arstechnica.com/…
        • Opinion from Bart: this is full-on authoritarianism, twisting the power of the state to persecute people and companies in order to force them to accept a false narrative that has simply never stood up to scrutiny. The fiction that the 2020 election was somehow stolen from Trump is literally his Hitler-esque Big Lie.
    • 🇺🇸 Google has an illegal monopoly on online advertising, judge rules — appleinsider.com/… (
    • SSL/TLS certificate lifespans reduced to 47 days by 2029 — www.bleepingcomputer.com/…
      • March 15 2026 → 200 days for certs & domain control validation
      • March 15 2027 → 100 days for certs & domain control validation
      • March 15 2029 → 47 days for certs & 10 days for domain control validation
      • In effect, this means that if your website uses HTTPS certs and you don’t already have the process automated using something like Let’s Encrypt’s CertBot (which can use any Certificate Authority as the back end if they choose to offer the appropriate API) you’d better start work on fixing that soon!
    • Chrome 136 fixes 20-year browser history privacy risk — www.bleepingcomputer.com/…
      • For years, links you visit from any website anywhere on the web are shown in a different colour on every website everywhere on the web
      • With the advent of CSS and JavaScript it’s been possible for ages for websites to learn your browsing history by including links to sites of interest on their own pages, perhaps in hidden areas of the page, and checking the colour the browser assigns the links
      • To combat this data leak, Chrome will only show links are visited from the domains where the user clicked on them
      • So, if you only ever search the web on Google you’re not likely to notice anything because all your clicks will originate in Google, so you’ll still see results you’ve already been to in purple instead of blue
      • But, if you search the web from two sites, say Google & Bing, any results you visit in Bing will not show are visited on Google, and vice-versa.
    • Google rolls out easy end-to-end encryption for Gmail business users — www.bleepingcomputer.com/…
      • Purely an enterprise feature as it requires organisations to run their own key server
      • Only works in the web version of GMail (leverages the browser to do the encryption/decryption)
      • Very clever design though with a good delegation of trust
      • Real-world ready unlike the geek/hobbyist PGP option
      • Much easier for organisations of all sizes to deploy than S/MIME which has existed for decades but failed to gain wide adoption
      • 🎧 Get the nerdy details in Security Now episode 1020 (Ignore Steve’s failure to comprehend that in an enterprise context the ‘ends’ in end-to-end encryption are the organisations, not the individual mailboxes, so in the context it’s intended for, it absolutely is true E2E despite his scoffing)

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top