Feedback & Followups
- 🇺🇸 Texas’s controversial age rules for all mobile app stores will not be stayed while the law is challenged, but will remain in place while the court cases continue — www.macobserver.com/…
- 🇪🇺 EU revives law allowing companies to scan private communications — cyberinsider.com/…
- “the proposal is separate from the EU’s proposed Child Sexual Abuse Regulation (CSAR), commonly referred to as ‘Chat Control 2.0’. While Chat Control 1.0 is a temporary measure permitting voluntary detection, the permanent CSAR proposal remains under negotiation and would establish a long-term legal framework governing how providers detect and report child sexual abuse material and grooming.” — Cyber Insider
- We really are still in the dangerous wild-west era: ‘Ghostcommit’ hides prompt injection in images to fool AI agents, steal secrets — www.bleepingcomputer.com/…
❗ Action Alerts
- ⚠️ Ubiquity Router Owners: Ubiquiti warns of new max severity UniFi OS vulnerability — www.bleepingcomputer.com/…
- ⚠️ Linux Users: “GhostLock” flaw survived in the Linux kernel code for 15 years — cyberinsider.com/…
- Another local privilege escalation vulnerability, letting local users become root
- It has an extra sting in the tail, allowing malicious code to break out of containers and VMs and take over the host machine!
- Patches slowly rolling out to the various distros
- NosillaCastaways using containers or virtual machines for safely running untrusted apps or web pages need to patch as soon as they can!
Worthy Warnings
- Residential proxies seem to be a big focus for cybercriminals these days:
- Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes — thehackernews.com/…
- WireVPN Service Linked to Years Long Residential Proxy Operation — cyberinsider.com/… (Free VPN for Android with millions of downloads)
- ⚠️ Tenda Router Owners: CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware — thehackernews.com/… (Chinese-made value brand with consumer and enterprise offerings)
- No patch, only workaround is to block access to the web portal
- Editorial from Bart: given the company didn’t even reply, they don’t seem worthy of trusting with privileged devices that see all your traffic and act as your first line of defence against the internet!
Notable News
- Cloudflare expands behavioral tracking to fight AI bots, says user privacy protected — cyberinsider.com/…
- Injects JavaScript into every page to try detect if the operator is human or an AI bot
- The script monitors key strokes, mouse actions, and other JavaScript events and distills them down into anonymous reports that get sent to Cloudflare for analysis
- The script does not log actual keystrokes, but the timings of key presses
- The script acts at the per-page level, so it is not a cross-site tracking tool
- Raising serious privacy concerns, but one silver lining is that JavaScript is client-side, so the code will be auditable.
- Meta briefly tried to opt everyone into having their public Instagram posts used as inputs to generative AI features, but after massive pushback, thought better of it — www.macobserver.com/…
- 🇪🇺 EU Warns Meta over Facebook and Instagrams Addictive Design — www.macobserver.com/…
- “The findings focus on features such as infinite scroll, autoplay, push notifications, and highly personalized recommendation systems that keep users engaged for long periods without meaningful limits.” — The Mac Observer
- The finding is under the Digital Services Act (DSA) which places responsibilities on large online platforms to protect children and vulnerable users
- This is a preliminary finding, so Meta have the right to reply before the commission make a final ruling
- 🇪🇺 EU Proposes Banning Social Media for Kids Under 13 with Phased Access — www.macobserver.com/…
- “European Commission President Ursula von der Leyen recently shared that the focus should be on when social media can access children, rather than the other way around.” — The Mac Observer
- Related Context: the EU are testing a privacy-protecting digital ID for age verification for Europeans.
- Editorial by Bart: both the approaches of making this the platform’s responsibility and of having a phased introduction to social media are interesting, but this is still going to require some kind of age verification, which still makes me nervous.
- Google Chrome extensions must meet new privacy standards by August 1 — cyberinsider.com/…
- “The most significant change for users concerns how Chrome extensions collect personal data. Under the revised Limited Use Policy, developers may collect user data only to the extent strictly necessary for an extension’s disclosed single purpose. Gathering additional information for unrelated uses, such as analytics, advertising, or future features that are not essential to the extension’s core functionality, is no longer permitted.” — Cyber Insider
Legend
When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |