- 🗒️✅ Your Security Checklist
- 🏆🎖️ Test Your Security Skills
- 📰 Your Weekly Security Update
- 🤨 This Should Be on Your Radar 📡
- 🙈 Security Fail of the Week 👎
- 🍎📱 Security Updates from Apple 🍎
If you take nothing else from this newsletter, just do these three things to protect yourself:
- Use a password manager if you aren't already. If you're already using a password manager, great! If not, check out our recommended password managers.
- Learn to spot scam texts. Scammers often use text messages to try and trick you into opening malicious links or turning over sensitive information. These can come in the form of undeliverable packages, unpaid tolls, billing for an expensive service, or even pretending to have texted the wrong number.
- If you ever encounter a pop-up claiming your iPhone has a virus, close the window. A common scam technique is to display a fake pop-up to make you think your iPhone or Mac has been infected with a virus and that you need to install an app or contact a specific phone number to get rid of it. In reality, all you need to do is close the window.
What should you do in the following scenario?
While browsing the web on your Mac, a full-screen window opens telling you that your computer has been infected with a virus, and it's instructing you to call a phone number for assistance. Your Mac is completely locked up, you can't close the window, and a siren is playing from the page. What should you do first? 🤔
- Force shut down your computer by holding the power button.
- Call the phone number and find out what's going on.
- Take your Mac to the Apple Store and see if they can help.
- Contact Apple Support for assistance.
Scroll to the bottom to see how you did!
If some of your favorite websites went offline over the last few days, it's likely the result of two security vulnerabilities in the PHP programming language. Around 70 percent of websites use PHP. Two flaws in the programming language were discovered that can allow attackers to make malicious changes to websites, exfiltrate data, or even take over entire servers. These vulnerabilities affected sites as large as Facebook. Thankfully, a patch was developed and deployed very quickly. However, the patch needs to be manually applied to all existing PHP websites, which means almost every affected website had to temporarily go offline while they were updated. Read more at Ars Technica or at PHP.
The Bottom Line: If you run a website, it is recommended that you check to see if your servers are using a vulnerable PHP version and, if so, apply the patch as soon as possible. If you're not sure whether or not your website needs this patch, reach out to your website hosting provider.
Canadian Government Wants Access to Your Private Data
A few years ago, the UK attempted to force Apple to implement a backdoor in iCloud's encrypted storage in the name of national security. Apple resisted this order and eventually the UK government backed down. Canada is following in the UK's footsteps by proposing a new bill that would require tech companies, whether they are based in Canada or not, to create a way for law enforcement access to decrypt anything that uses end-to-end encryption, whether it's iCloud storage or Signal messages. Several companies, including Signal, DuckDuckGo, and NordVPN, have said they will pull out of the country if the law passes. Check out the full story at Wired.
The Bottom Line: If this law passes, it would be a major hit to data privacy. If you feel the same and are a Canadian resident, you can contact your elected representatives and voice your concerns about the C-22 bill.
You Can Now Lock Your ChatGPT History
ChatGPT now allows you to lock your chats. If you want to chat with your AI assistant but you're concerned about someone in your household reading it, you can lock the chat with a PIN or biometrics. This feature is separate from Temporary Chats, which are chats that disappear after you close the app. Locked chats cannot be accessed by other users of the same device, but they are not end-to-end encrypted and can still be read by OpenAI employees. This feature only protects your chats from others who have physical access to your device. Find out more at TechCrunch.
The Bottom Line: We recommend against talking to ChatGPT or any other AI chatbot about personal, sensitive information. Anything you say to an AI chatbot could potentially be reviewed by OpenAI employees.
Flock Continues to Be Abused by Law Enforcement
It's that time of the week to check in on Flock, the surveillance company whose automated license plate reader (ALPR) cameras have been creating controversy in cities all over the country in the past year. This week, The Washington Post published a story about a police officer who retired from the force in 2021 but kept his Flock login. For the past five years, despite no longer being employed as a police officer, he continued to log into Flock and stalk his ex-wife. He was only stopped and arrested recently after an anonymous tip. And he's not alone. According to the article, this is only one of 11 incidents involving unauthorized Flock access.
Another incident of unauthorized access happened in Savannah, Georgia, where a police officer shared her Flock login with her husband who is an Immigration and Customs Enforcement agent.
In response to the rise of Flock cameras, navigation app MapQuest has added a feature that allows users to see the locations of ALPR cameras from Flock and a variety of other surveillance companies.
The Bottom Line: Flock continues to demonstrate why it's a bad idea to have cameras on every street corner with almost no accountability for how law enforcement uses it. If you feel strongly about Flock, we recommend reaching out to your local representatives and voicing your opinion.
Can an Ad Infect Your iPhone with Spyware?
Citizen Lab recently published its research into AdFection, a new zero-click (i.e. no input from the user is required for infection to happen) method through which mercenary spyware is delivered through targeted advertising. In a first, a collection of related mercenary spyware companies have developed a system to use ad-profiling—just regular internet advertising—to identify the specific phone of a designated individual and then serve a malicious ad on that device which, when rendered, causes the device to become infected with spyware. Check out the full report from Citizen Lab for a more detailed breakdown.
The Bottom Line: While AdFection sounds scary, it is most likely to be used to target specific individuals, like politicians, journalists, activists, etc. Nevertheless, it demonstrates how incredibly targeted online advertising has become, and how that technology can be abused for surveillance and stalking. You can reduce how much online advertising technologies can learn about you by employing an ad blocker, like uBlock Origin, and by using a privacy-focused web browser, like Firefox, Safari, or Brave.
Food Delivery Robots Are Being Sued
Two separate class action lawsuits have been filed against Coco Robotics and Serve Robotics, two food delivery robot companies in Chicago. The lawsuits are claiming that the companies are collecting biometric data without telling customers. The robots navigate and deliver food using cameras and LiDAR sensors, which can be used to map 3D environments. Whenever people are in range of these sensors, their biometrics can also be mapped. The companies involved in the lawsuits are denying these claims. Read more at AP News.
The Bottom Line: While there isn't any clear cut evidence yet one way or the other, it certainly wouldn't be surprising if these companies were collecting biometric data. We're certainly going to keep an eye on these lawsuits and we're curious to see the outcomes.
New macOS Ransomware on the Market
A new type of ransomware called Heartbreaker has found its way onto macOS. Heartbreaker is not as threatening as it sounds. When your Mac becomes infected, Heartbreaker encrypts your downloads folder and a scary looking window pops up directing you to pay the hacker responsible in order to have your files decrypted. What makes Heartbreaker interesting though is that it can rewrite its own code each time it infects a computer, making it harder for antivirus software to detect. Check out the full technical breakdown at Objective-See.
The Bottom Line: Make sure you have a reputable antivirus software installed, and avoid downloading files from suspicious websites. If you need an app on your Mac, try to get it from the App Store if possible. Of course, some apps are only available to download from their official websites. Just be sure to double-check the URL before downloading them.
If You Thought “123456” Was a Bad Password, Wait 'Til You Hear About “4”
On the internet, websites certify their legitimacy using a Transport Layer Security (TLS) certificate, which contains the keys used to encrypt and secure connections to that website. They're created by a few different important Certificate Authorities. You could think of it like paper money: every business needs them, but only a few institutions can securely make them. Ordinarily, the private key of a TLS certificate contains hundreds of digits for endless, unique combinations. However, this past week, one certificate authority, eMudhra, was found to have distributed eight TLS certificates with private keys that had only 3 to 8 digits. One simply used the number 4. This means anyone could create fraudulent TLS certificates using these easily guessable private keys and impersonate a legitimate website. Read more at Ars Technica.
The Bottom Line: It's not known how these bizarrely simple private keys came to be, but we find it hilarious. At this point, most web browsers and apps have begun blocking the compromised TLS certificates. Microsoft Edge appears to be the only browser that hasn't been updated yet. Be sure to install the latest version of your preferred web browser.
- The most recent iOS and iPadOS is 27.0.1
- The most recent macOS is 27.0.1
- The most recent tvOS is 27
- The most recent watchOS is 27.0.1
- The most recent visionOS is 27.0.1
Read about the latest updates from Apple.
The correct answer is probably A. Force shut down your computer by holding the power button. This is a scam tactic to get you to call the number without a second thought. The page enters full screen to make it harder for you to close the window and the siren sound effect is designed to induce panic. In reality, your computer is unlikely to actually be infected with a virus. Forcing your computer to shut down and then turning it back on should be sufficient, since it will close the window. If you're still concerned, you can take it to a nearby Apple Store or contact Apple Support to be safe. You can also run a malware scan using antivirus software like Malwarebytes.
There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Rhett Intriago and edited by Donna Schill and Cullen Thomas.
Interested in learning how to use your iPhone's password manager? Check out:
|
