Feedback & Followups
- 🇦🇺 Apple is testing an enhancement to its child protection features in Australia – when Apple’s existing opt-in nudity detection AI feature flags an image as potentially problematic, a new option appears to allow the child to report the image to Apple for review before passing it on to local law enforcement if appropriate — appleinsider.com/…
- 🇨🇦 Canada joins the attack on TikTok, ordering their Canadian subsidiary to shut down on national security grounds — www.bleepingcomputer.com/…
❗ Action Alerts
- Remember, Apple’s point updates are not just about new features!: Apple Updates Everything — isc.sans.edu/…
- Google’s November Android patches: Google fixes two Android zero-days used in targeted attacks — www.bleepingcomputer.com/… (Patch if you can 😕)
- Two of the most popular NAS vendors rush out critical security updates after their devices are exploited at the recent Pwn2Own competition in Dublin Ireland:
- D-Link won’t fix critical flaw affecting 60,000 older NAS devices — www.bleepingcomputer.com/… (If you own one of the affected DNS-320 variants, time to bin it and buy a new NAS.)
- Related: Windows 10 home users will be able to buy an extra year of security updates (branded ESU for Extended Security Updates) for $30 when Windows 10 goes out of support on October 14th, 2025 — www.bleepingcomputer.com/…
Worthy Warnings
- LastPass are warning of yet another way scammers are trying to trick their users into compromising all their passwords by putting fake customer support numbers in app store reviews (the one for Google Chrome extensions in this case) — www.bleepingcomputer.com/…
- There is a lesson here for all of us — not all the information on an app’s page in an app store is from the developer, reviews are user-generated content, so are absolutely not trustworthy! Check the context of any kind of contact information before believing it!
- Attackers have found a way to exploit DocuSign’s APIs to send very convincing fake invoice phishing emails — www.bleepingcomputer.com/…
- An example of the ever more popular Living off the Cloud technique of abusing trusted domains for illicit ends
- This was a big campaign, saw quite a few examples in the wild!
- 🇬🇧 Scammers target UK senior citizens with Winter Fuel Payment texts — www.bleepingcomputer.com/…
Notable News
- Cybercriminals are deploying new tactics you should be aware of: Android malware “FakeCall” now reroutes bank calls to attackers — www.bleepingcomputer.com/… (those are outgoing calls initiated by the user!)
- Major Software-as-a-Service (SaaS) vendors continue to nudge the world towards universal Multi-Factor Authentication:
- Microsoft Entra “security defaults” to make MFA setup mandatory — www.bleepingcomputer.com/… (most likely to positively impact small mom-and-pop businesses who use Office365 for a handful of users and don’t have a dedicated IT person)
- Google Cloud to make MFA mandatory by the end of 2025 — www.bleepingcomputer.com/… (will make us all a little safer by making it more difficult for the baddies to hijack the admin accounts that manage the Google Platform as a Service (PaaS) infrastructure powering many of the apps and services we all use every day — this affects Google’s alternative to Amazon Web Services AKA AWS, and Microsoft Azure, both of which are already further down the same path)
- The dark and light sides of AI in the cybersecurity space:
- We knew this was coming, and it will only get better: ChatGPT-4o can be used for autonomous voice-based scams — www.bleepingcomputer.com/…
Researchers have shown that it’s possible to abuse OpenAI’s real-time voice API for ChatGPT-4o, an advanced LLM chatbot, to conduct financial scams with low to moderate success rates.
- Google’s AI Tool Big Sleep Finds Zero-Day Vulnerability in SQLite Database Engine — thehackernews.com/…
“We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software” — the Google team
- Android users are confused and cranky as Google injects a tracking domain into all links shared from their popular Google app for Android — www.bleepingcomputer.com/… (similar to how X/Twitter adds their
t.cotracking domain to all links on that platform) - 🇰🇷 South Korea Fines Meta $15.67M for Illegally Sharing Sensitive User Data with Advertiser s— thehackernews.com/…
Top Tips
- If the exposé on the US location tracking industry linked last time left you concerned, Adam Engst has some practical advice for you: Protect Yourself Against Location Tracking Abuses — tidbits.com/…
Excellent Explainers
- Why free VPNs aren’t always safe to use — appleinsider.com/… (or, as I would put it “follow the money” 🙂)
- 🎧 An excellent explanation of the economics data breaches: Planet Money: So your data was stolen in a data breach — overcast.fm/…
Palate Cleansers
Legend
When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |