Security Bits — 16 February 2025

Feedback & Followups

• DNS discussion update: as pointed out by Ferrers in the Podfeet Slack, Cloudflare’s free DNS service does offer an equivalent to Quad9’s malware-blocking DNS service — Details on their website
  • 1.1.1.1 — unfiltered DNS
  • 1.1.1.2 — malware-filtered DNS
  • 1.1.1.3 — family-safe filtered DNS blocks adult content, gambling, etc., as well as malware (used in many schools, certainly here in Ireland)
• TikTok is back in Apple & Google’s app stores in the US, despite that still being illegal — www.theverge.com/…
  • The change reportedly came after a letter was sent to both companies by the newly confirmed Attorney General Pam Bondi
  • TikTok had started to push side-loading as an option for Android users — daringfireball.net/…
• The Salt Typhoon Chinese state-sponsored hacks of western telecom companies continue: Chinese hackers breach more US telecoms via unpatched Cisco routers — www.bleepingcomputer.com/…

Deep Dive(s)

Action Alerts

• Google have released the January Android security update, and it patches 48 vulnerabilities, including an actively exploited zero-day in the kernel – patch ASAP (if you can) — www.bleepingcomputer.com/…
• Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws — www.bleepingcomputer.com/…
  • A detailed breakdown — isc.sans.edu/…
• Apple released iOS 18.3.1, iPadOS 18.3.1, and iPadOS 17.7.5 to patch a zero-day exploited in the wild in “an extremely sophisticated attack” against carefully chosen targets — www.intego.com/…
• More obsolete routers for the bin: Zyxel won’t patch newly exploited flaws in end-of-life routers — www.bleepingcomputer.com/… (CPE series devices)
• AMD CPU users might need to install a BIOS update to fix a vulnerability in how the CPU loads microcode (basically CPU firmware) to stop attackers from injecting malware right into the CPU itself — www.bleepingcomputer.com/… (Not into PC builds enough to understand how widespread the affected CPU models are)

Worthy Warnings

• Be careful experimenting with the new hotness du-jour: DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers — arstechnica.com/…
  • NosillaCastaway Steve Mattan explains how to run large language models locally with Ollama on a Tidbit 10 of Programming By Stealth
• A good reminder of why it’s vital not to keep sensitive information in screenshots/Photos: Take my money: OCR crypto stealers in Google Play and App Store — securelist.com/…
  • The Apple and Google stores are less unsafe than the wild-west of side-loading, but malware does sneak into both, even if it is usually quickly cleaned up, especially in Apple’s more tightly managed store
  • Any app that can see your photo library could be scanning it for sensitive information
  • Legitimate apps with valid reasons for having photo library access that get taken over by baddies are a real danger here
  • Use password managers to store **all your secrets; these apps will usually let you store files such as images (1Password has great support for every kind of secret you might need to keep safe)

Notable News

• Credible reports have emerged that the UK government have used the very controversial 2024 amendment to the Investigatory Powers Act to secretly order Apple to give the UK government a back door into encrypted iCloud backups for all users (not just those for UK users) — appleinsider.com/…
  • The law makes it illegal for a company under such an order to admit to the existence of the order, so Apple’s refusal to comment is not surprising
  • The UK government have also refused to comment
  • UK’s iPhone spying backdoor demand sparks bipartisan US lawmaker anger — appleinsider.com/…
  • Opinion from Bart: I have no idea how this will play out, but it’s a very important story to watch this year, and to lobby your elected representatives about, regardless of what country you’re in!

Excellent Explainers

• An excellent explanation of the latest crypto-currency craze: The Indicator from Planet Money: How the memecoin game is played — overcast.fm/…
  • Editorial by Bart: it’s a scam, just don’t!

Palate Cleansers

• From Bart: A fascinating long read on the true history of screen savers and how flying toasters and the like are nothing more than the visible tip of a massively bigger invisible iceberg that’s come full circle with our smartphones: Saving One Screen At A Time — tedium.co/…
• From Allison: a free and open Git hosting platform (an alternative to GitHub and GitLab) from a German non-profit with servers located in Europe — codeberg.org/…
  • Comment from Bart: passes the ‘follow the money’ test with flying colours

Legend

When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

Emoji	Meaning
	A link to audio content, probably a podcast.
	A call to action.
flag	The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
	A link to graphical content, probably a chart, graph, or diagram.
	A story that has been over-hyped in the media, or, “no need to light your hair on fire”
	A link to an article behind a paywall.
	A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
	A tip of the hat to thank a member of the community for bringing the story to our attention.
	A link to video content.