Feedback & Followups
- 🇨🇦 More voices against Canada’s proposed End-to-End-Encryption ban:
- Apple Google Push Judicial Oversight Canada Online Safety Bill — www.reuters.com/…
- Citizen Lab urges Canada to withdraw parts of Bill C-22 over privacy concerns — cyberinsider.com/… (world-leading privacy lab that has found multiple state-level spyware apps over the years)
- 🇺🇸 More misguided age verification goes live: Age verification now mandatory for App Store users in Texas — appleinsider.com/…
- The law itself is still being challenged in the courts, so this could, perhaps, be temporary
- 🇺🇸 Continued Apple Account Rollout: iPhone users can now store their Arkansas driver’s license in Apple Wallet — www.cultofmac.com/…
❗ Action Alerts
- May Android Update: Google fixes one actively exploited Android zero-day, 124 flaws — www.bleepingcomputer.com/… (patch if you can, or get a new phone!)
- Related: WhatsApp, Slack Notifications Could Hijack Google Gemini on Android — thehackernews.com/… (patched too)
- ⚠️ Related — Office365 Users on Android: Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag — thehackernews.com/… (also patched)
- New CIFSwitch Linux flaw gives root on multiple distributions — www.bleepingcomputer.com/… (another Local Privilege Escalation bug, but only on some distros, and there are patches this time!)
- ⚠️ Acer Router Owners: Acer working to patch max severity zero-days in Wave 7 routers — www.bleepingcomputer.com/…
- No patch yet, so be sure to verify that your router’s management interface is not exposed to the internet!
Worthy Warnings
- FBI warns of fake FIFA websites running World Cup fraud schemes — www.bleepingcomputer.com/…
- A timely reminder to be careful installing IDE plugins: GitHub confirms breach of 3,800 repos via malicious VSCode extension — www.bleepingcomputer.com/…
- All of GitHub’s internal code repos were leaked because a developer working for Microsoft installed a plugin from the Microsoft VS Code Marketplace that was malicious!
- Hopefully this finally drives home the message that Microsoft need to get much more hands-on with regulating the VS Code marketplace!
- Note that no customer repos were accessed, just the repos the GitHub developer who installed the plugin had access to.
- ⚠️ Related — VS Code users on Windows: VS Code zero-day lets hackers steal GitHub tokens in one click — www.bleepingcomputer.com/… (no patch yet, but there is a work-around)
- ⚠️ Signal Users: Signal users targeted by attackers seeking backup recovery keys — cyberinsider.com/… (phishing via Signal messages pretending to be Signal Support)
- ⚠️ 🇺🇸 Verizon Customers: Verizon VoLTE network found missing IPsec protections for SIP signaling — cyberinsider.com/…
- The company has decided that since the encryption is only recommended by the standard, not required, they’re not going to bother with it 🙁
- The only option for customers seems to be to assume nothing said over their cellphone is actually private 🙁
- ⚠️ 🇪🇺 People travelling to Europe: Over 100 Dutch hotels hit by breach exposing guest reservation data — cyberinsider.com/…
- The Dutch hotels were the ones to notice and go public, but the problem is much bigger, confirmed to also affect hotels in Ireland and the UK, and perhaps more countries
- The hotels are not the sources of the breach, and an as-yet-unknown 3rd-party service provider appears to be the source
- Until someone figures out which of the many service providers hotels have to partner with that got breached, everyone with a European hotel booking should be extra suspicious of any emails claiming to be about a hotel reservation — victims are receiving extremely convincing phishing emails that contain correct booking details!
- ⚠️ 🇺🇸 DentaQuest Users: DentaQuest data breach exposed sensitive info of 2.6 million people — cyberinsider.com/…
- The company has not been forth-coming, but the full breach has been loaded into Have-I-Been-Pwnd (details)
- This breach is noteworthy because of how sensitive the data leaked is — including Physical addresses, Health insurance information, and government-issued IDs
- Users are vulnerable to extremely convincing targeted phishing campaigns
- ⚠️ Microsoft OutLook Users Connecting via POP: Microsoft Outlook leaves email connections unencrypted despite SSL/TLS setting — cyberinsider.com/…
- The correct way to configure TLS for POP is to tick the encryption checkbox and specify the new secure port (995), rather than the old insecure port (110).
- It’s not uncommon for people to tick the box but not update the port, and most clients resolve this inconsistent config by silently switching to the new port and using encryption
- The Exchange App currently handles this inconsistent config by continuing to use the old port, and hence, to connect without encryption 🤦
- If you use Outlook to connect to a server using POP, check that you have it properly configured!
Notable News
- Researchers built AI worm that can adapt to infect diverse devices — cyberinsider.com/…
- This is a proof-of-concept to begin to understand what is possible
- Some nice cybersecurity improvements:
- Google Chrome adds session cookie theft protection for all users — www.bleepingcomputer.com/…
- Initially a Windows-only beta, now rolled out to all platforms
- Session cookies for websites supporting the new standard are digitally signed by on-device security chips (TPM or Secure Enclave) so that even if the session gets stolen by malware or phishing, it can’t be used on any other computer.
- Google adds Android protection against AI deepfake scam calls — www.bleepingcomputer.com/…
- Interesting idea — uses special RCS messages to ping the real person’s phone to check if they are on a call or not
- Only works if the call recipient and the person being spoofed are both on Android, and, if the person being spoofed is in the recipient’s address book
- Could evolve into an interesting cross-platform standard, so interesting Proof-of-concept
- Mullvad VPN on Android passes Google-backed MASA security audit — cyberinsider.com/…
- Proton Drive adopts OpenPGP encryption, delivers 300% faster uploads — cyberinsider.com/… (upgrade of already end-to-end-encrypted service)
Just Because it’s Cool 😎
- Quantum breakthrough produces perfect randomness for secure communications — cyberinsider.com/…
- “ETH Zurich researchers have demonstrated what they describe as the world’s first generation of certifiably perfect random numbers using a quantum experiment based on entangled superconducting qubits. The breakthrough could strengthen future encryption systems, digital identity protections, and quantum-secure communications by eliminating subtle biases found in conventional random number generators.”
- Related: How Apple turned to math to defend against next-gen attacks on encryption — appleinsider.com/… (Proven correct post-quantum algorithm implementation in Core Crypto API available to all apps on Apple’s platforms)
- The Apple Security blog post: A blueprint for formal verification of Apple corecrypto — security.apple.com/…
Palate Cleansers
- From Allison: 🎦 a concise, clear, fun explanation of the differences between CPUs, GPU & TPUs (AKA NPUs) — www.tiktok.com/…
- From Bart:
- For any terminal geeks stuck on Windows: Microsoft’s Coreutils project brings Linux commands to Windows — www.bleepingcomputer.com/… (port of GNU Core Utils to Windows in Rust)
- 🎦 the surprisingly complex and fascinating history of Lorem Ipsum — youtube.com/…
- From Bart’s better half:
- This battery doesn’t need Lithium, and it just hit mass production — youtube.com/…
Legend
When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |