Feedback & Followups
- 🇺🇸 More consequences for past misdeeds:
- Two notable developments in the big CUPS vulnerability on Linux:
- Researchers at Akami Security have found a little sting in the tail — exposed vulnerable servers can be used to amplify distributed denial of service (DDoS) attacks — www.bleepingcomputer.com/… (exposed machines now need to be patched not just to protect themselves from takeover, but stop them being recruited for use in DDos attacks on other internet users)
- The storied security researcher Marcus Hitchins has released a Python script to scan your IP range for devices running vulnerable versions of CUPS — www.bleepingcomputer.com/…
❗ Action Alerts
- Another Patch Tuesday has been and gone, with 5 zero-days fixed by Microsoft this time — www.bleepingcomputer.com/…, krebsonsecurity.com/… & isc.sans.edu/…
- Apple releases iOS, iPadOS 18.0.1 with security updates; other “.0.1” bug-fix updates — www.intego.com/…
- Mozilla fixes Firefox zero-day actively exploited in attacks — www.bleepingcomputer.com/…
- iTunes for Windows Gets a Security Update — www.macobserver.com/…
- DrayTek fixed critical flaws in over 700,000 exposed routers — www.bleepingcomputer.com/…
- Android users need to keep an eye out for firmware updates from their vendors and apply them ASAP because Qualcomm have just patched critical flaws in the firmware for chips used in many smartphones — Qualcomm patches high-severity zero-day exploited in attacks — www.bleepingcomputer.com/… (Users can’t apply the patch directly, it has to come via their vendor, so again, any Android phone not under active patching can’t be used safely!)
Worthy Warnings
- The Internet Archive has been compromised, and 31M usernames and passwords have been breached (the data has been incorporated into Have-I-Been-Pwned), a lot of creators chose to proactively upload their content to preserve it, so many in our community could be affected — www.bleepingcomputer.com/…
Notable News
- 🇺🇸 Reporting from the WSJ claims that the Chinese government broke into the back doors for the good guys US cellphone companies were forced to install to facilitate lawful data requests — appleinsider.com/…
- This story is the perfect illustration of why the idea of back doors for the good guys in End-to-End Encryption is fundamentally flawed — daringfireball.net/…
- In-depth explanation by Peter Strzok during the Cleanup on Aisle 45 Podcast of how this breach was achieved and the implications. Episode 194 | Biblical Profit Potential starting at 28:35 Warning: this is a left-leaning political podcast.
- 🇪🇺 E.U. Court Limits Meta’s Use of Personal Facebook Data for Targeted Ads — thehackernews.com/…
- Under Article 5(1)(C) of the GDPR data used to target ads can’t be retained indefinitely, but Meta (and others) have been doing just that, and that now has to stop
- 🇺🇸 California governor vetoes major AI safety bill — www.cultofmac.com/…
- Could have been the first major AI regulation in the US, and set a new baseline like the CCPA
- Vetoed not because there is not a problem to be solved, but because this was not a good solution (Editorial by Bart: I agree with many of the points made in the veto statement, basing the law on model size not risk was the wrong approach)
- Google Joins Forces with GASA and DNS RF to Tackle Online Scams at Scale — thehackernews.com/… (information sharing to make blocking of malicious domains more effective)
- Some nice little security enhancements from Microsoft:
- Microsoft overhauls security for publishing Edge extensions — www.bleepingcomputer.com/… (makes it harder to impersonate legitimate developers and sneak malware into trusted plugins)
- Microsoft Defender adds detection of unsecure Wi-Fi networks — www.bleepingcomputer.com/… (Paid personal & family subscriptions only)
- Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server — www.bleepingcomputer.com/… (Editorial by Bart: more dangerous legacy protocols going away 🎉 — a podcast I listened to, (before they podfaded) jokingly referred to PPTP as Point to Point Toilet Paper to mock its insecurity 😀)
Excellent Explainers
- A great overview of all the various security protections in modern Macs, and a big-picture explanation of how they work: How macOS protects your data from malware — appleinsider.com/…
Just Because it’s Cool 😎
- 🇺🇸 Some ingenious policing, and a perfect illustration of just how much of a scam cryptocurrency is: FBI Creates Fake Cryptocurrency to Expose Widespread Crypto Market Manipulation — thehackernews.com/…
Palate Cleansers
- From Bart: 🎧 Irish History Podcast: Emily Anderson- The Forgotten Irish Bletchley Park Code Breaker — overcast.fm/…
Legend
When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |