{"id":27756,"date":"2023-01-22T07:19:45","date_gmt":"2023-01-22T15:19:45","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=27756"},"modified":"2023-01-22T07:21:46","modified_gmt":"2023-01-22T15:21:46","slug":"security-bits-22-january-2023","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2023\/01\/security-bits-22-january-2023\/","title":{"rendered":"Security Bits \u2014 22 January 2023 (Just Bart)"},"content":{"rendered":"<h3>Feedback &amp; Followups<\/h3>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li>LastPass Update:\n<ul>\n<li>It gets worse, we now know there were some people with just 500 rounds of PBKDF2, and even a few with <strong>one round<\/strong> &#x1f641;<\/li>\n<li>There was a brief false dawn when some noticed wording about server-side additional rounds of PBKDF2, but that proved to be to protect user account info, not password vaults &#x1f641;<\/li>\n<li>&#x1f3a7; Steve Gibson does a good job explaining the latest developments: <a href=\"https:\/\/overcast.fm\/+LUuTxQikM\">Security Now 905: LastPass Aftermath, LastPass vault de-obfuscator, LastPass iteration count folly \u2014 overcast.fm\/\u2026<\/a><\/li>\n<li>An excellent summary of the LastPass story so far \u2014 <a href=\"https:\/\/www.intego.com\/mac-security-blog\/lastpass-password-manager-suffers-massive-data-breach\/\">www.intego.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>&#x1f1fa;&#x1f1f8; <a href=\"https:\/\/www.reuters.com\/legal\/us-supreme-court-lets-metas-whatsapp-pursue-pegasus-spyware-suit-2023-01-09\/\">U.S. Supreme Court lets Meta&#8217;s WhatsApp pursue &#8216;Pegasus&#8217; spyware suit \u2014 www.reuters.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>&#x2757; Action Alerts<\/h3>\n<aside class=\"small-aside\">Calls to action, if any stories in this section are relevant to you there is some action you should take.<\/aside>\n<ul>\n<li>Patch Tuesday has been and gone, so be sure to patch your Microsoft &amp; Adobe stuff \u2014 <a href=\"https:\/\/krebsonsecurity.com\/2023\/01\/microsoft-patch-tuesday-january-2023-edition\/\">krebsonsecurity.com\/\u2026<\/a> &amp; <a href=\"https:\/\/nakedsecurity.sophos.com\/2023\/01\/11\/microsoft-patch-tuesday-one-0-day-win-7-and-8-1-get-last-ever-patches\/\">nakedsecurity.sophos.com\/\u2026<\/a>\n<ul>\n<li>One of the Windows vulnerabilities is being exploited in the wild<\/li>\n<li>Windows 7 extended support finally comes to an end, no matter how much you pay Microsoft, these will be the last Windows 7 updates you ever get!<\/li>\n<li>Windows 8.1 gets its last ever updates (there&#8217;s no extended support being offered), if you&#8217;re still using it, upgrade now! (it ended on my birthday &#x1f642;)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Worthy Warnings<\/h3>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li>Norton LifeLock warns that password stuffing attacks were used to successfully access some users&#8217; password vaults in December \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2023\/01\/17\/serious-security-unravelling-the-nortonlifelock-hacked-passwords-story\/\">nakedsecurity.sophos.com\/\u2026<\/a>\n<ul>\n<li>If you will insist on reusing passwords, at the very least <strong>don&#8217;t re-use the password for your password manager<\/strong>!<\/li>\n<li>If its relevant for your password manager, <strong>turn on 2FA<\/strong>!<\/li>\n<\/ul>\n<\/li>\n<li>Note that scam ChatGPT apps are a thing ATM, this one was removed, but it shows where the baddies are focusing their attention, so be vigilant: <a href=\"https:\/\/www.macrumors.com\/2023\/01\/09\/chatgpt-app-store-apps\/\">Sketchy ChatGPT App Soars Up App Store Charts, Charges $7.99 Weekly Subscription \u2014 www.macrumors.com\/\u2026<\/a> <\/li>\n<li>&#x1f1fa;&#x1f1f8; <a href=\"https:\/\/nakedsecurity.sophos.com\/2023\/01\/20\/t-mobile-admits-to-37000000-customer-records-stolen-by-bad-actor\/\">T-Mobile admits to 37,000,000 customer records stolen by \u201cbad actor\u201d \u2014 nakedsecurity.sophos.com\/\u2026<\/a>\n<ul>\n<li>No payment data or SSNs leaked, just name, DOB, contact details, and contract details<\/li>\n<li>Biggest danger seems to be targeted phishing and perhaps identity theft<\/li>\n<\/ul>\n<\/li>\n<li>&#x1f1fa;&#x1f1f8; Brian Krebs has discovered yet another data breach at Experian: <a href=\"https:\/\/krebsonsecurity.com\/2023\/01\/identity-thieves-bypassed-experian-security-to-view-credit-reports\/\">Identity Thieves Bypassed Experian Security to View Credit Reports \u2014 krebsonsecurity.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Notable News<\/h3>\n<ul>\n<li>&#x1f1fa;&#x1f1f8; President Biden wrote an op-ed in the WSJ urging congress to act against <em>Big Tech<\/em> \u2014 <a href=\"https:\/\/appleinsider.com\/articles\/23\/01\/11\/president-biden-wants-more-bipartisan-efforts-against-big-tech\">appleinsider.com\/\u2026<\/a>\n<ul>\n<li>Calls for federal privacy protections<\/li>\n<li>Argues companies should be responsible for the content their algorithms boost, and calls for transparency about how the algorithms work<\/li>\n<li>Calls for more anti-trust actions to boost competition<\/li>\n<\/ul>\n<\/li>\n<li>&#x1f1ea;&#x1f1fa; <a href=\"https:\/\/nakedsecurity.sophos.com\/2023\/01\/16\/multi-million-investment-scammers-busted-in-four-country-europol-raid\/\">Multi-million investment scammers busted in four-country Europol raid \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Interesting Insights<\/h3>\n<aside class=\"small-aside\">High-quality opinion and editorial content recommended by Bart.<\/aside>\n<ul>\n<li>Why actual Android security is so much worse than actual iOS security: <a href=\"https:\/\/www.cultofmac.com\/803262\/newest-android-13-version-installed-on-5-percent-of-devices\/\">Newest Android version installed on a mere 5% of devices vs. 74% for iOS 16 \u2014 www.cultofmac.com\/\u2026<\/a><\/li>\n<li>An excellent snapshot of the current trends in phishing: <a href=\"https:\/\/tidbits.com\/2023\/01\/16\/an-annotated-field-guide-to-identifying-phish\/\">An Annotated Field Guide to Identifying Phish \u2014 tidbits.com\/\u2026<\/a><\/li>\n<li>(Riffing off a long-running gag in <a href=\"https:\/\/www.twis.org\/\">This Week in Science<\/a>) <strong>Good News!!!<\/strong> breaches are now so common that we can use them to test for bots, if an email address isn&#8217;t in the <a href=\"https:\/\/haveibeenpwned.com\/\">Have I Been Pwned DB<\/a> it&#8217;s probably a recently created bot address \u2014 <a href=\"https:\/\/www.troyhunt.com\/pwned-or-bot\/\">www.troyhunt.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Palate Cleansers<\/h3>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<ul>\n<li>&#x1f4ca; As Karl Sagan famously said, we&#8217;re all made of star stuff, and that&#8217;s definitely part of the truth, but there&#8217;s more to it than that! This APOD shows the periodic table with each element coloured by how it was created. Did you know most of the Rhodium comes from merging neutron stars? \u2014 <a href=\"https:\/\/apod.nasa.gov\/apod\/ap230108.html\">apod.nasa.gov\/\u2026<\/a><\/li>\n<li>&#x1f3a7; Business movers tell the story of Pixar \u2014 there was a lot more to that story than I ever realised: <a href=\"https:\/\/overcast.fm\/+nkQeA-Wq4\">Business Movers: Animating Pixar \u2014 overcast.fm\/\u2026<\/a><\/li>\n<li>For those of you who like long reads:\n<ul>\n<li><a href=\"https:\/\/arstechnica.com\/?p=1910792\">Revisiting Apple\u2019s ill-fated Lisa computer, 40 years on \u2014 arstechnica.com<\/a><\/li>\n<li><a href=\"https:\/\/arstechnica.com\/gadgets\/2022\/09\/a-history-of-arm-part-1-building-the-first-chip\/\">A history of ARM, part 1: Building the first chip \u2014 arstechnica.com\/\u2026<\/a>, <a href=\"https:\/\/arstechnica.com\/gadgets\/2022\/11\/a-history-of-arm-part-2-everything-starts-to-come-together\/\">A history of ARM, part 2: Everything starts to come together \u2014 arstechnica.com\/\u2026<\/a> &amp; <a href=\"https:\/\/arstechnica.com\/?p=1909069\">A history of ARM, part 3: Coming full circle \u2014 arstechnica.com<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Legend<\/h3>\n<p>When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">&#x1f3a7;<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x2757;<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x1f4ca;<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x1f9ef;<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> &#x1f642;<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x1f4b5;<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x1f4cc;<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">&#x1f3a9;<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Feedback &amp; Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time. LastPass Update: It gets worse, we now know there were some people with just 500 rounds of PBKDF2, and even a few with one round &#x1f641; There was a brief false dawn when some [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[147,214],"tags":[345,5673,5674],"class_list":["post-27756","post","type-post","status-publish","format-standard","hentry","category-blog-posts","category-security-bits","tag-lastpass","tag-norton-lifelock","tag-t-mobile"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/27756","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=27756"}],"version-history":[{"count":2,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/27756\/revisions"}],"predecessor-version":[{"id":27758,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/27756\/revisions\/27758"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=27756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=27756"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=27756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}