- ๐๏ธโ Your Security Checklist
- ๐๐๏ธ Test Your Security Skills
- ๐ฐ Your Weekly Security Update
- ๐คจ This Should Be on Your Radar ๐ก
- ๐ Security Fail of the Week ๐
- ๐๐ฑ Security Updates from Apple ๐
If you take nothing else from this newsletter, just do these three things to protect yourself:
- Disable app tracking on your iPhone. Some apps will ask for permission to track your activity to personalize the app. You should never allow apps to track you.ย
- Use Private tabs to browse the web privately. Private browsing allows you to browse the web without recording your browsing history, saving cookies, or collecting data. Note: While your browser will not save history, your internet service provider will still record the sites you visit.
- Temporarily disable Face ID in pinch. If you are ever in a situation where you might be compelled to unlock your iPhone with Face ID, you can quickly disable the Face ID sensor.
What should you do in the following scenario?
You're browsing the web on your Mac and come across a page requesting to verify that you are not a bot. It presents a familiar test: a box that you must click to prove you're a human. However, upon clicking the checkbox, you are instructed to copy and paste a line of text into an application called Terminal to complete the verification process. What do you do? ๐ค
- Close the window immediately.
- Follow the instructions to copy and paste the text into Terminal.
- Copy and paste the text into Google to find out more about what it does.
Scroll to the bottom to see how you did!
ChatGPT has become a go-to tool for medical questions, general life advice, or even companionship. We have always recommended against telling AI tools anything too personal since your chats are not private and the companies that own the AI can turn your data over to law enforcement at a moment's notice. Turns out, there's even more cause for concern.
According to a new report from 404 Media, a team of human beings, dubbed Project Lily, could be reading your ChatGPT conversations. In the past, OpenAI has been clear that when a chat suggests that the user may harm themselves or others, it would be reviewed by a human. However, what it hasn't disclosed is that all ChatGPT conversations are subject to human review through Project Lily in order to improve the AI model's responses. While usernames are removed from the prompts to keep them as anonymous as possible, the prompts themselves can still contain personal information. We recommend checking out the full story for more details.
The Bottom Line: If you want to avoid having your private chats exposed to OpenAI's team, you can disable the "improve the model for everyone" setting under Data Controls in the ChatGPT app. However, we still wouldn't trust this company with private, sensitive information, so we continue to recommend against telling ChatGPT (or any AI model, for that matter; according to the 404 Media report, Anthropic is doing the same thing with Claude) anything too personal.
Apple Releases iOS, macOS, iPadOS, and watchOS 27
Apple's annual updates to its various operating systems are finally here. Whether you have a Mac, an iPhone, or an iPad, each of your Apple devices should be ready to update to OS 27. These updates come with a suite of new features to improve how you use your devices; however, even more importantly, they include fixes for over 200 security flaws, including bugs related to memory corruption and information leaks. Read more at Security Week, or check out Apple's security updates page for more details.
The Bottom Line: You should install the relevant OS 27 updates on your Apple devices as soon as possible. If any of your devices are not compatible with OS 27, version 26.7 is also available.
Flock Continues to Demonstrate Why It Is Bad for Privacy
In this week's roundup of Flock news, the city of Boston has canceled its contract with the surveillance company after discovering it violated the terms of the contract it had signed. When the Boston Police Department first began using Flock cameras, the agreement with the company stated that Flock would not share data about Boston drivers with other agencies. In other words, only the BPD would have access to the data. However, within the first week of the program going into effect, the BPD discovered that Flock was indeed sharing the data it collected with outside agencies. Read more at WBUR.
In other news, the Electronic Frontier Foundation and 404 Media were able to get ahold of snapshots showing various Flock searches from law enforcement agencies across the country. Under the "Reason" field, rather than an actual justifiable reason, police were often found to enter things like "LOL," "idk," expletives, or just gibberish. Speaking of bogus reasons, a Florida woman is suing two Florida Highway Patrol officers after they used Flock cameras to incorrectly identify her as the perpetrator of a crime and arrest her.
The Bottom Line: We have extensively covered how Flock and automated license plate readers (ALPRs) in general are bad for the privacy of the general public and how easily they can lead to false arrests. If you feel particularly strongly about the use of ALPRs in your community, be sure to voice those concerns to your local officials. In some jurisdictions, this has proved effective in eliminating the use of Flock and other ALPRs.
Chrome Web Browser Vulnerability Lets Hackers Run Wild
There's a new exploit on the loose, dubbed BlueMoon, that chains together three vulnerabilities found in both Chromium-based web browsers and Windows installations. BlueMoon works by exploiting multiple vulnerabilities in how Chrome handles JavaScript and allows an attacker to remotely install whatever malware they like on your device. The exploit was linked to four hacking groups who acted quickly to take advantage of the vulnerabilities before they were patched. Check out more technical details at Ars Technica.
The Bottom Line: This exploit affects more than just Google Chrome, but all Chromium-based web browsers. You can think of Chromium as the foundation upon which many browsers are built. Some common web browsers that are built on Chromium are Microsoft Edge, Brave, Opera, and DuckDuckGo. Patches for the vulnerabilities are being rolled out to the affected platforms, so if you have any Windows devices or use a Chromium browser, be sure to keep them up to date. If you want to switch to a non-Chromium browser, we recommend Firefox or Safari.
Why You Should Be Wary of Your Computer's Terminal
We've previously reported on ClickFix attacks, but they're now becoming more common, so we thought a reminder was due. ClickFix is a type of attack that uses a fake CAPTCHA to trick the victim into entering a specific command into either Command Prompt on Windows or Terminal on macOS. Command Prompt and Terminal are powerful tools that can be used to make significant changes to your computer at an administrative level. When scammers prompt you to enter commands into Terminal, the command will likely install malware or give an attacker control over your computer. ClickFix has been gaining traction with attackers because so many of us enter autopilot when clicking a CAPTCHA; it sometimes doesn't occur to us that we're about to do something harmful to our machines. Read more at Ars Technica.
The Bottom Line: Staying informed is the best defense against cyberattacks like ClickFix. If you ever come across a CAPTCHA that asks you to copy and paste something into your computer's Terminal (or Command Prompt if you are on Windows), then you are looking at a malicious webpage. Close the window or tab and definitely do not open Terminal or paste anything into it. macOS has a built-in defense against ClickFix, which will stop you from pasting any malicious-looking commands into Terminal. If you ever see this alert, you should listen to it and close Terminal.
ID Scanning Company Confirms Theft of 150 Million IDs
Two weeks ago, we reported on a story from KrebsOnSecurity about a massive dark web database of stolen IDs. At the time, it was believed that the database was sourced from IDscan, a company that collects IDs and stores them for businesses, such as car rental agencies. Now, IDscan has confirmed that a data breach has exposed its database of over 150 million IDs. It appears that an attacker had persistent access to IDscan's backend for a year, allowing them to slowly collect every ID available and grab new ones when they were added to the database. Head over to TechCrunch for more details.
The Bottom Line: If you have rented a car or used a service that required your ID or passport to be scanned in the last year, it is very likely that your ID or passport was exposed. The best way to protect yourself is to freeze your credit at the major credit bureaus. You can do this for free online, and you can also unfreeze it at any time if needed. This will help defend against attempts to steal your identity.
Apple Intelligence Can Be Trained on Your Data If You Let It
After updating your iPhone to iOS 27, you may receive a new prompt asking if you want to share your data with Apple to help improve Apple Intelligence. Like ChatGPT, Apple says that any data you share is not tied to your Apple Account or email address and will only be used for improving its AI models. Find out more at 9to5Mac or check out the Apple Support document itself.
The Bottom Line: This feature is opt-in, so if you don't want to share your data with Apple, you don't have to. In fact, we would recommend against it, for the same reasons we recommend against sharing your ChatGPT logs with OpenAI. If you accidentally opt in, you can always opt out later by going to Settings > Privacy & Security > Analytics & Improvement, then look for the toggle for Improve Siri & Apple Intelligence or Improve Siri & Dictation.
This App Can Notify You When Smart Glasses Are Nearby
A Polish developer, Paweล Szydลowski, has created an app that can detect when smart glasses are nearby. The app, called Zuckoff, is relatively simple. It scans your surroundings for Bluetooth devices, and if it finds identifiers that match a pair of Meta or Ray-Ban smart glasses, you will receive a notification. Of course, the app is not going to pinpoint exactly who in your vicinity is wearing the glasses, whether or not they are recording, or defend against being recorded; it just lets you know that they are nearby. Read more at TVP World.
The Bottom Line: We're always wary of apps from independent developers, because, as we always say, cybersecurity is difficult to get right. This app can scan for nearby Bluetooth devices. If a malicious actor were to see a log of the Bluetooth devices around you at all times, they could use that information to triangulate where you are. However, according to the app's description, this log never leaves your phone, unless you export it yourself. That means that even though this app is continuously scanning for Bluetooth devices, it is not reporting those devices back to the developer or anyone else; the list is only visible to you.
Do Garbage Trucks Need Spy Cameras?
Garbage trucks in the city of Dallas, Texas, are being outfitted with AI-powered cameras. The cameras are reportedly being used to look for code violations, such as dirty chimneys or unmowed lawns, and send notices to residents to fix those violations. The company operating the cameras, City Detect, is working with other states to expand the technology's use. According to City Detect's CEO, the cameras blur faces and license plates, and the recordings are not accessible to law enforcement. Additionally, if the cameras detect a violation, city staff will review the footage before sending out any notices. Read more at The Drive, or check out the local NBC news report.ย
The Bottom Line: We just really don't think there's any need to have cameras watching us everywhere we go. If you feel the same and are located in a city where this type of technology is in use, the best thing you can do is reach out to your local officials and voice any concerns you have. In some jurisdictions, the thoughts and opinions of citizens can affect local policy.
Hackers Steal Flock Camera, Rummage Through Its Operating System
The software that powers Flock cameras has been stolen. Hackers cut down a Flock camera and managed to breach the device's encryption, allowing them to copy the contents of the device. Turns out, the encryption key needed to access the camera's footage was saved to its internal storage, which means the hackers were able to view thousands of videos and reverse engineer the software powering the camera. Perhaps one of the biggest revelations as a result of this hack is that, despite Flock's claims to the contrary, Flock cameras can and do detect people, and will record them when they walk into frame. Read the full report at either 404 Media or Wired.
The Bottom Line: This hack was only possible thanks to Flock's own lax stance on privacy and security. Storing an encryption key in the same place as the encrypted storage is the digital equivalent of hiding a spare house key under your doormat. Plus, this hack has proven with hard evidence that Flock is tracking people with its cameras despite the company repeatedly claiming that it does not.
- The most recent iOS and iPadOS is 27
- The most recent macOS is 27
- The most recent tvOS is 27
- The most recent watchOS is 27
- The most recent visionOS is 27
Read about the latest updates from Apple.
The correct answer is A. Close the window immediately. If you ever encounter a page like this, it is a ClickFix attack, as we covered above. If you paste the text into Terminal, it will give an attacker control of your computer. After you close the window, it also wouldn't hurt to clear your computer's clipboard by copying a random bit of text from somewhere else.
There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written byย Rhett Intriagoย and edited byย August Garryย andย Cullen Thomas.
Interested in learning more about password managers? Check out:
|
