Followup 🇺🇸 Mozilla refute the very misleading (factually incorrect) presentation American ISPs gave to congress urging them to take action against encrypted DNS (DoH) — nakedsecurity.sophos.com/… Microsoft have issued yet another warning about the patch they released a few months ago for older versions of Windows to remove the so-called BlueKeep vulnerability. Attacks have now […]
Continue readingCategory: Security Bits
Security Bits – 1 Nov 2019
Security Bits – 1 Nov 2019 Notable Security Updates Apple updates just about everything: Everything you need to know about iOS and iPadOS 13.2 — arstechnica.com/… Some users experiencing bricked HomePod after updating to iOS 13.2 [Update: pulled] — 9to5mac.com/… Related: Apple resumes human reviews of Siri audio with iPhone update — apnews.com/… Related: iOS […]
Continue readingSecurity Bits – 20 October 2019
Security Medium 1 — Apple Card is not Magic A story made a lot of news this week because it involved a physical Apple Card being skimmed. It underlines the fact that people do not understand that when they fall back to using the physical card or entering the virtual number into a website manually, […]
Continue readingSecurity Bits – 5 October 2019
Followup Bluetooth permissions on iOS A nice article explaining some of the most common legitimate reasons apps me request BlueTooth access: Here’s why so many apps are asking to use Bluetooth on iOS 13 — www.theverge.com/… CloudFlare’s Warp VPN has Finally been Released — blog.cloudflare.com/…, nakedsecurity.sophos.com/… & www.imore.com/… Note that VPNs can provide encryption and […]
Continue readingSecurity Bits – 21 September 2019
Security Medium 1 — SimJacker A remotely exploitable vulnerability has been found in the firmware running on billions of SIM cards around the world. The vulnerability can be triggered by sending a malicious SMS message to the phone number served by the victim SIM card. Once the SIM card is infected it can then reach […]
Continue readingSecurity Bits – 8 September 2019
Followup Apple draws a line under the ‘Siri Grading’ kerfuffle with a a public letter apologising for not reaching their own high standards, explaining how Siri protects user privacy, and outline some changes to how grading will be carried out in future — www.apple.com/… Apple send as little as possible data to Siri, using on-device […]
Continue readingSecurity Bits – 27 August 2019
Followups GitHub joins WebAuthn club — nakedsecurity.sophos.com/… Human Review of Voice Assistant Recordings: Facebook got humans to listen in on some Messenger voice chats — nakedsecurity.sophos.com/… Microsoft have humans review your conversations, and they’re not up for changing that fact: Microsoft won’t shift on AI recordings policy — nakedsecurity.sophos.com/… Humans may have been listening to […]
Continue readingSecurity Bits – 10 August 2019
Security Medium 1 — Human Review of Voice Assistant Recordings The Guardian newspaper started what turned out to be a far-ranging controversy be reporting that when Apple said they kept anonymised Siri recordings for analysis, that analysis included grading by human beings. Specifically, by outside contractors.
Continue readingSecurity Bits – 25 July 2019
Followups The Zoom webcam/webserver issue We now have confirmation that the vulnerability was also present in the RingCentral and Zhumu apps — www.imore.com/… Apple have rolled out an additional automatic security update to address the issues with these apps — www.macobserver.com/… Related Opinion: John Gruber addresses the question Isn’t [Apple’s response] “nonconsensual technology” too? in […]
Continue readingSecurity Bits – 14 July 2019
Security Medium 0 (more of a Followup) — 3rd-party Parental Control Apps Return to iOS Editorial by Bart: I’ve seen some very lazy reporting on this story, and I think the context and nuance are important, hence giving this apparently simple story the ‘Security Medium’ treatment. To understand what happened this week, it’s important to […]
Continue reading