- 🗒️✅ Your Security Checklist
- 🏆🎖️ Test Your Security Skills
- 📰 Your Weekly Security Update
- 🤨 This Should Be on Your Radar 📡
- 🙈 Security Fail of the Week 👎
- 🍎📱 Security Updates from Apple 🍎
If you take nothing else from this newsletter, just do these three things to protect yourself:
- Silence unknown callers to reduce scams. Your iPhone has a feature to automatically silence calls from numbers not in your contacts. Keep in mind that you will need to add phone numbers like your doctor's office or bank to your contacts to avoid missing calls.
- Double-check the legitimacy of emails before you act. Scammers frequently send out emails with fake invoices, claims of Social Security fraud, and more. There are some telltale signs to help you identify scam emails.
- Turn off app tracking. Many apps ask for permission to track your activity under the guise of personalizing your experience. You should never allow apps to track you and you can even turn off app tracking altogether.
What should you do in the following scenario?
You receive a voicemail telling you that your Social Security number has been suspended due to suspicious activity. The voicemail instructs you to call back to verify your identity and lift the suspension. What do you do? 🤔
- Follow the instructions and call the number.
- Call your local Social Security office to find out more.
- Delete the voicemail and block the caller.
Scroll to the bottom to see how you did!
If your internet service provider is Xfinity, this story is for you. Comcast, the parent company of Xfinity, is rolling out a free update to its routers that transforms them into motion detectors. This new feature, dubbed Wi-Fi Motion, works by looking for disturbances between the Wi-Fi radio signals transmitted from the router to devices in its vicinity. These disturbances indicate motion which is then sent as a notification to the Xfinity app.
This sounds like a super useful feature at first glance, but there's, of course, a catch. Any data generated by your use of Wi-Fi Motion can be turned over to third-parties for any reason, including law enforcement investigation or if Comcast is involved in a legal dispute in which it must turn over the data. Read more about Wi-Fi Motion at TechCrunch.
The Bottom Line: We don't think the risks to your privacy are worth it for this feature. If you use Xfinity internet, Wi-Fi Motion is opt-in and we would not recommend turning the feature on.
Time to Update Your Mac: New Vulnerability Discovered
Security firm Bynario recently discovered a macOS vulnerability that allows an attacker to take control of your machine. The vulnerability works by taking advantage of the screen sharing feature on macOS. Screen sharing is a feature that is designed to allow you to remotely access your Mac when you're not near it. Attackers have found a way to exploit the feature so that they can control your mouse and keyboard, and navigate your Mac with no input from you. Thankfully, Apple has already pushed out an update to address the bug that allows this exploit to work. Read more at Ars Technica.
The Bottom Line: You should update your Mac as soon as possible, especially if you rely on the screen sharing feature. If you don't need to use screen sharing, you can also just turn it off entirely by going into System Settings > General > Sharing > toggle off Screen Sharing.
Are iPhones Under Cyberattack?
Last week, Apple sent out a wave of threat notifications to iPhone users around the world. These notifications are only sent to users who are detected as being actively targeted by mercenary spyware. Mercenary spyware is typically highly advanced technology that costs hundreds of thousands of dollars to develop and is created by private companies for use by governments in espionage. Because of how difficult and expensive it is to develop, the users targeted by attacks like this are usually government employees, journalists, politicians, activists, and others of interest to governments. However, even ordinary users with connections to these types of people can also be targeted (e.g. a friend of a friend who once talked to a journalist). Read more at Bleeping Computer.
The Bottom Line: According to Apple, the majority of users will never see a threat notification. However, if you receive one, the first thing you should do is enable Lockdown Mode. You should also verify the legitimacy of the notification. You can do this by logging into your Apple Account in a web browser, where the threat notification should appear. If you receive the alert via email, double-check that the message is from threat-notifications@email.apple.com. Official emails from Apple will not direct you to open any links or to download any files or apps. If you see such a request then the message you have received is probably malicious.
A New Reason to Start Using Firefox on iOS
On the iPhone, the only web browser that can use extensions is Safari, which means other browsers do not support ad blockers, unless the functionality is built into the browser itself. Mozilla has taken the initiative to add a native ad blocker to the Firefox iOS app. The feature is turned off by default, so you'll need to go into Firefox's settings after updating to enable it. Check out Mozilla's support page for more information.
The Bottom Line: We generally recommend Firefox and Safari as privacy-focused web browser options. Firefox adding an ad blocker to its iOS app brings it up to par with Safari, though Firefox's ad blocker does not work on search engine results, so you'll still see ads in Google, DuckDuckGo, Bing, or whatever search engine you prefer.
AI Mistakes Shopper for Shoplifter
A man in the UK was ejected from a Sainsbury's supermarket after the store's AI facial recognition technology incorrectly identified him as a shoplifter. While checking out, the employees told the man that they could not serve him and he needed to leave the store due to a prior "incident." The Sainsbury's head office issued an apology the next day and suspended use of the facial recognition technology for that specific store—but the rest of the stores are still using it. Read more at The Guardian.
The Bottom Line: This is not a problem unique to Sainsbury's. AI facial recognition technology is not especially reliable under real-life conditions, and will consistently misidentify people. Nevertheless, AI facial recognition is being adopted in more and more environments, so this kind of inconvenience is likely to become more routine unless the public pushes back. If you feel strongly about this type of tech, we recommend voicing your opinions to decision makers.
What to Know About Social Security & Medicare Scams
Scammers are targeting seniors with scams related to Social Security and Medicare. The scam works by either calling, texting, or emailing the victim about an issue with their Medicare enrollment or their Social Security number. It could be that the victim's Medicare number is needed to finish enrollment, their SSN has been suspended, their SSN has been linked to criminal activity, etc. Read more about these types of scams and how you can avoid them at Fox News.
The Bottom Line: Neither Medicare nor Social Security will call you asking for sensitive information. These types of scams are designed to induce panic so that you are more likely to comply without thinking the situation through. If you receive a phone call, text, or email asking for confidential details like your Social Security number, hang up, and call either Medicare or Social Security at a trusted phone number. You can find contact information at Medicare.gov and SSA.gov.
Data Breach of Microsoft Azure Could Affect Multiple Companies
A single hacker calling themselves TheHatman is claiming to have stolen millions of records after breaching Microsoft Azure accounts used by multiple Fortune 500 companies. Azure is Microsoft’s cloud computing platform, where users and companies can rent computing capacity to run their apps or services. TheHatman claims to have employee names, IDs, addresses, and phone numbers from companies like McDonald's, Gap, Wyndham, Vodafone, and many others. One of the affected companies, Tata Consultancy Services, says that the stolen data is four years old, meaning the other millions of records could also be out of date. Read more at Bleeping Computer.
The Bottom Line: While passwords were not present in this particular data breach, it's worth noting that every data breach highlights the importance of using unique passwords. If passwords were leaked and those passwords were being used across multiple organizations, then it would be trivial for any hacker to use them to access internal systems or personal accounts. That's why we always recommend using a password manager to ensure every password you use is unique.
Are Flock Cameras Safe Now?
In the wake of negative press, surveillance company Flock is updating its policies to help the public feel more at ease. By default Flock cameras will now only store data for 7 days rather than 30. However, this time frame can be adjusted by local policies to store the data for longer or shorter periods of time. All queries within Flock's database will now also require a case number to go along with it, to help prevent frivolous use cases. The database will also have a "Audit Assistance" tool which looks for abnormal behavior and, if it is detected, suspends a particular user's access to the database pending administrative review.
The Bottom Line: Even with these changes in place, we're not confident in Flock's ability to prevent misuse of its system. Someone will always find ways around these safeguards. Not to mention, it will be impossible for the public to know if the Audit Assistance tool is working unless we see more action taken against officers abusing the system.
It's also important to highlight that automated license plate readers are not a uniquely Flock problem. Flock is only one of many surveillance companies manufacturing these cameras and building databases using the data they capture. Even with these safeguards in place at Flock, there are dozens of other companies out there, like Axon, doing the same thing without those safeguards.
US Government Approves Private Companies for Offensive Cyber Operations
The Trump administration has announced that it will allow approved private cybersecurity companies to conduct offensive operations against criminal organizations. Historically, private companies have been allowed to defend against cyberattacks but never initiate them, making this a first for US history. Participating companies must submit $1 million in escrow, which will be forfeited if they are found not to be complying with the rules set by the government. Additionally, any operation must be signed off on by the Department of Justice and Homeland Security before it is carried out. Check out the full story at TechCrunch.
The Bottom Line: This is a similar strategy that countries like China employ. If you have ever seen the term "state sponsored hackers" in this newsletter, it is usually referring to private companies that have been approved and funded by a foreign government. As this change takes effect, we are likely to see an increase in cyberattacks both against the US and from it.
Australian Man Accidentally Hacks Gym Website Using AI
An Australian man, Andrew, accidentally hacked into his local gym's website using AI. He had been experimenting with Anthropic's AI tool OpenClaw when he asked it to register him for a class at his local gym. The problem was the class was filled up. When he asked the AI if there was a way to move him off of the waitlist, the AI quickly came up with a solution: kick someone out. On its own, it accessed the website's Application Programming Interface and removed someone from the list, moving Andrew up on the waitlist. He tried telling the AI to undo the change, but it told him that it was impossible to restore the user. Andrew eventually had his AI agent email the gym's customer support to inform them of the vulnerability in the website. Head over to ABC Australia for more on this story.
The Bottom Line: Perhaps don't use highly advanced AI agents capable of hacking to book a gym class for you.
- The most recent iOS and iPadOS is 26.6.1
- The most recent macOS is 26.6.2
- The most recent tvOS is 26.6
- The most recent watchOS is 26.6
- The most recent visionOS is 26.6.1
Read about the latest updates from Apple.
The correct answer is C. Delete the voicemail and block the caller. Social Security numbers cannot be suspended and anyone claiming otherwise is trying to scam you. If deleting and blocking the caller makes you uneasy, it also doesn't hurt to call or visit your local Social Security office to make sure your SSN is safe.
There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Cullen Thomas and Rhett Intriago and edited by August Garry.
Interested in browsing the web privately on your iPhone? Check out:
|
