Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits — 11 May 2025

  • by Bart Busschots
  • 2 Comments

    • Feedback & Followups

    • A great example of why it’s important to patch – this is one of the things the Apple updates we called out last time patched: Apple ‘AirBorne’ flaws can lead to zero-click AirPlay RCE attacks — www.bleepingcomputer.com/… (RCE is Remote Code Execution)
    • Yet another call to bin those old unpatchable routers ASAP: FBI: End-of-life routers hacked for cybercrime proxy networks — www.bleepingcomputer.com/…
    • 🇺🇸 While Apple dropped their similar case to avoid having to reveal internal data during discovery, Meta continued theirs, and won: NSO Group fined $167M for spyware attacks on 1,400 WhatsApp users — www.bleepingcomputer.com/…
    • 🇺🇸 There has been a small but significant development in the Trump Administration’s misuse of Signal for privileged military communications, AKA SignalGate, and it provides a teachable moment — www.404media.co/…, www.bleepingcomputer.com/… & www.wired.com/…
      • Thanks to the power of modern telephoto lenses, and the fact that the then National Security Advisor Mike Waltz was sneakily checking his phone in a cabinet meeting, we now know the problematic Signal chats happened using an uncertified third-party client named TeleMessage that offers centralised cloud-hosted message archiving as a feature.
      • Shortly after, security researchers tested the app’s security and found it very wanting, accessing many supposedly secret US government chat transcripts.
      • The app promptly suspended its services
      • This illustrates the boundaries of End-to-End Encryption — it secures messages all the way from one end of a conversation to the other, without being decryptable by any servers en route, even if messages get cached or stored there for hours, weeks, months, or years. But, before a message is sent, and after it is received, it can be accessed by software running on the sending and receiving devices, most especially including the actual messaging clients doing the sending and receiving! This is no more of a shortcoming than the fact that seatbelts don’t prevent gas tank explosions — that’s not the problem they are designed to solve!

    Deep Dive(s)

    ❗ Action Alerts

    Worthy Warnings

    • Student & Professional NosillaCastaways take note: Education giant Pearson hit by cyberattack exposing customer data — www.bleepingcomputer.com/…
      • Many educational and professional certifications and accreditations are examined by Pearson, including my Microsoft cybersecurity certifications 🙁
      • The company are referring to the stolen customer data as Legacy, but I’m not sure that’s very meaningful, how much of your PII has changed in the last 5 or even 10 years?
      • The company’s response is worrying at best:
        > “[W]hen BleepingComputer asked Pearson about whether they paid a ransom, what they meant by “legacy data,” how many customers were impacted, and if customers would be notified, the company responded that they would not be commenting on these questions.” — the Bleeping Computer Article
    • 🇬🇧 UK NosillaCastaways take note: Co-op confirms data theft after DragonForce ransomware claims attack — www.bleepingcomputer.com/…
      • Includes ‘personal details’ but not passwords or payment details for ‘a significant number’ of ‘current and past members’
      • Not clear if notifications will be sent
      • Worrying that the company initially tried to deny this breach had even happened 😕

    Notable News

    Top Tips

    Excellent Explainers

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    2 thoughts on “Security Bits — 11 May 2025”

    1. Frank Vos - May 12, 2025

      Hi Allison, first congratulations with 20 years anniversary of your podcast. I’m not listening that long, but I guess more than a decade. I learned a lot from you and Bart, thanks to the both of you.

      In this episode of Security Bits, you mentioned the annoying clash between two password managers on your Mac. I have the same problem, with 1Password and Apple’s Password app. So it would be nice if you could give me some advice how to sort this out.

    2. podfeet - May 14, 2025

      Thanks, Frank! I’m going to do some research to see if 1P has written about the conflict, and also write to 1P to see what we can do about it. For now the best I can offer is to hit the escape key when you see both interfering. If I find anything out, I may not remember to write back here, but I’ll definitely talk about it on the podcast if it’s helpful.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top