FreshRSS

πŸ”’
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

Details Released for Recently Patched new macOS Archive Utility Vulnerability

By Ravie Lakshmanan
Security researchers have shared details about a now-addressed security flaw in Apple's macOS operating system that could be potentially exploited to run malicious applications in a manner that can bypass Apple's security measures. The vulnerability, tracked asΒ CVE-2022-32910, is rooted in the built-in Archive Utility and "could lead to the execution of an unsigned and unnotarized application

Experts Uncover 85 Apps with 13 Million Downloads Involved in Ad Fraud Scheme

By Ravie Lakshmanan
As many as 75 apps on Google Play and 10 on Apple App Store have been discovered engaging in ad fraud as part of an ongoing campaign that commenced in 2019. The latest iteration, dubbedΒ ScyllaΒ by Online fraud-prevention firm HUMAN Security, follows similar attack waves in August 2019 and late 2020 that go by the codename Poseidon and Charybdis, respectively. Prior to their removal from the app

North Korea's Lazarus Hackers Targeting macOS Users Interested in Crypto Jobs

By Ravie Lakshmanan
The infamous Lazarus Group has continued its pattern of leveraging unsolicited job opportunities to deploy malware targeting Apple's macOS operating system. In the latest variant of the campaign observed by cybersecurity company SentinelOne last week, decoy documents advertising positions for the Singapore-based cryptocurrency exchange firm Crypto[.]com have been used to mount the attacks. The

Apple Releases iOS and macOS Updates to Patch Actively Exploited Zero-Day Flaw

By Ravie Lakshmanan
Apple has released another round of security updates to address multiple vulnerabilities in iOS and macOS, including a new zero-day flaw that has been used in attacks in the wild. The issue, assigned the identifierΒ CVE-2022-32917, is rooted in the Kernel component and could enable a malicious app to execute arbitrary code with kernel privileges. "Apple is aware of a report that this issue may

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

Apple Releases iOS Update for Older iPhones to Fix Actively Exploited Vulnerability

By Ravie Lakshmanan
Apple on Wednesday backported security updates to older iPhones, iPads, and iPod touch devices to address aΒ critical security flawΒ that has been actively exploited in the wild. The shortcoming, tracked asΒ CVE-2022-32893Β (CVSS score: 8.8), is an out-of-bounds write issue affecting WebKit that could lead to arbitrary code execution when processing maliciously crafted web content. WebKit is the

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

XCSSET Malware Updates with Python 3 to Target macOS Monterey Users

By Ravie Lakshmanan
The operators of the XCSSET macOS malware have upped the stakes by making iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3. "The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022," SentinelOne researchers

iPhone Users Urged to Update to Patch 2 Zero-Days

By Elizabeth Montalbano
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.

iPhone Users Urged to Update to Patch 2 Zero-Days

By Elizabeth Montalbano
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.

Apple Releases Security Updates to Patch Two New Zero-Day Vulnerabilities

By Ravie Lakshmanan
Apple on Wednesday released security updates forΒ iOS, iPadOS, andΒ macOSΒ platforms to remediate two zero-day vulnerabilities previously exploited by threat actors to compromise its devices. The list of issues is below - CVE-2022-32893Β - An out-of-bounds issue in WebKit which could lead to the execution of arbitrary code by processing a specially crafted web content CVE-2022-32894Β - An

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

How to Stay One Step Ahead of Hackers

By McAfee

Whether using the internet for play or work, you want to spend your time online enjoying the peace of mind that comes with having a secure network.Β 

You don’t want to contend with someone taking your personal data β€” whether it’s credit card information, passwords, or bank account details β€” via malware or a data breach on your Android, Windows, or Apple iOS device.Β 

Fortunately, with some sensible precautions and simple steps, you can use your connected devices productively without worrying about cybercriminals and malicious software. This article explains how to stop hackers from getting access to your sensitive data.Β Β 

8 ways to protect your identity from hackers

You can take steps to protect your different computing and mobile devices and operating systems. These steps can be divided into technological solutions and the right awareness and information to provide a comforting measure of self-protection.Β 

It’s like learning karate for self-defense, giving you confidence as you negotiate the wider world (and hoping that you never have to use it).Β 

Use identity protection software

When it comes to identity protection software, McAfee provides a proven solution with our identity protection and privacy services. The protection includes alerts if your sensitive information is found on the dark web (up to 10 months sooner than other providers), personal data cleanup from sites gathering and selling your information, and an unlimited virtual public network (VPN) service that protects your privacy as you use public Wi-Fi networks.Β 

You’ll also get up to $1 million in identity theft coverage and hands-on restoration support to help you reclaim your identity.Β Β 

Use complex passwords

Simple, obvious passwords and passcodes (like your street address, your birthday, your kids’ or pets’ names, or β€œ1234” or β€œabcd”) are easy for cybercriminals to crack, giving them unwanted access to your private data.Β 

The stronger your password, the better your protection. Some best password practices include:Β 

  • Use a different password for all your online accounts, including your email accounts, social media platforms, and bank accounts.Β 
  • Create a password that’s at least eight characters long, combining lowercase and uppercase letters, numbers, and symbols.Β 
  • Don’t use consecutive keystrokes, such as β€œqwerty.” 
  • Don’t share your passwords with anyone.Β 
  • Avoid entering your password on unsecured public Wi-Fi, such as at an airport or in a coffee shop.Β 

Regularly update passwords

It’s important not to be a standing target. Just as you should use different passwords for everything, you should regularly change your passwords. You should do this a few times a year (although some cyber experts say this might not be necessary if you have a long and very complicated password).Β 

If you have a number of passwords that you update often, it might be worth getting a password manager like McAfee True Key to keep track of them. Not only will you not be faced with remembering all your different passwords or writing them down (also a no-no), but it can also help you create and store unique passwords.Β Β 

The software uses the strongest encryption algorithms available to protect your passwords, scrambling them so no one else can access them. It’ll also suggest new passwords and automatically log you into your online accounts with just one master password.Β 

Use multi-factor authentication

Another important line of defense is multi-factor authentication (sometimes known as two-factor authentication). This system uses a password and a second piece of verification β€” often an SMS message sent to your Android device or iPhone β€” to authenticate your identity.Β 

This provides hard-to-beat protection even if a hacker has your password. Besides receiving SMS codes, there are also code-generating apps and physical security keys.Β 

Learn to spot potential scams

Thinking before you click on an email or text is a very important defense against phishing scams. Your bank won’t send you an email or text notifying you that there’s been suspicious activity on your account.Β Β 

Does getting a large refund from your phone company sound too good to be true? It is. Similarly, the Internal Revenue Service (IRS) won’t text to tell you that you owe them money, and princes aren’t going to give you a fortune out of the blue.Β 

Internet users beware: If you’re not absolutely certain that the text message you received is from a legitimate and trusted source, delete it. You can always contact the business or person directly to confirm that the message is legit.Β 

Keep device software up to date

Any operating system or app you use is open to malicious cyberattacks. This is why you should keep all your software up to date with the latest versions. Software developers are continually fixing holes in their products and offering cybersecurity patches to make them as safe and hacker-proof as possible.Β 

Make sure your software, firmware, and security settings are up to date on your home’s Wi-Fi router, as well. You can often change your settings to allow for automatic updates.Β 

Be cautious when using public Wi-Fi

Sure, who doesn’t like to go to a cafe, library, or hotel lobby to use the free Wi-Fi? But security is often weak in these public networks. If you open your online banking account or access personal information, you may unwittingly be giving a personal invitation to eavesdropping cybercriminals.Β Β 

This is where the bank-grade level of protection of McAfee Secure VPN comes in, which automatically turns on when you need it and keeps you safe on public Wi-Fi networks.Β 

Use encryption

Even if your device does get hacked, you can protect vital information on your Windows or macOS system with an encryption program like BitLocker or FileVault. You can protect any hard drive you use, including portable ones and USB keys.Β 

It’s also a good idea to only shop at encrypted websites marked with the prefix β€œHTTPS” in their URLs.Β 

Discover how McAfee keeps you secure online

One of the best ways to surf the web in comfort while keeping hackers at bay is with the comprehensive solutions provided by McAfee Total Protection.Β 

Your protection includes proactive measures (meaning we’ll guide you to the best choices for prevention), early detection, and expert identity theft support.Β Β 

This means you’ll get identity monitoring, up to $1 million in identity theft coverage, lost wallet protection, premium antivirus software, a secure VPN, and personal data removal. In particular, our Personal Data Cleanup service will help find and remove your personal information from data broker websites and people search sites.Β Β 

With McAfee, you don’t have to be afraid of hackers. Let us deal with them.Β Β 

The post How to Stay One Step Ahead of Hackers appeared first on McAfee Blog.

What Personal Data Do Companies Track?

By McAfee

Private tech companies gather tremendous amounts of user data. These companies can afford to let you use social media platforms free of charge because it’s paid for by your data, attention, and time.Β Β 

Big tech derives most of its profits by selling your attention to advertisers β€” a well-known business model. Various documentaries (like Netflix’s β€œThe Social Dilemma”) have attempted to get to the bottom of the complex algorithms that big tech companies employ to mine and analyze user data for the benefit of third-party advertisers.Β Β 

This article will help you better understand what information is being collected by tech companies, how it’s being used, and how you can protect your privacy online.Β Β Β 

What information can companies collect?

Tech companies benefit from personal information by being able to provide personalized ads. When you click β€œyes” at the end of a terms and conditions agreement found on some web pages, you may be allowing the companies to collect the following data:Β Β 

  • Personal data. This includes identity-related information like your name, gender, Social Security number, and device-related information like IP address, web browser cookies, and device IDs. Personal data is usually collected to classify users into different demographics based on relevant parameters. This helps advertisers analyze what sections of the audience interact with their ads and what they can do to cater to their target audience.Β Β 
  • Usage data. Your interactions with a business’s website, text messages, emails, paid ads, and other online activities are recorded to build an accurate consumer profile. This consumer profile is used to determine and predict what kind of content (including ads) you are more likely to interact with and for how long.Β Β 
  • Behavioral data. Purchase histories, repeated actions, time spent, movement and navigation on the platform, and other types of qualitative data are covered under behavioral data. This helps platforms determine your β€œfavorite” purchases or interactions so they can suggest other similar content/products.Β Β 
  • Attitudinal data. Companies measure brand and customer experiences using data on consumer satisfaction, product desirability, and purchase decisions. Marketing agencies use this data for direct consumer research and creative analysis.Β Β 

For someone unfamiliar with privacy issues, it is important to understand the extent of big tech’s tracking and data collection. Once these companies collect data, all this information can be supplied to third-party businesses or used to improve user experience.Β Β 

The problem with this is that big tech has blurred the line between collecting customer data and violating user privacy in some cases. While tracking what content you interact with can be justified under the garb of personalizing the content you see, big tech platforms have been known to go too far. Prominent social networks like Facebook and LinkedIn have faced past legal trouble for accessing personal user data like private messages and saved photos.Β 

How do companies use the information you provide

The information you provide helps build an accurate character profile and turns it into knowledge that gives actionable insights to businesses. Private data usage can be classified into three cases: selling it to data brokers, using it to improve marketing, or enhancing customer experience.Β Β 

To sell your info to data brokers

Along with big data, another industry has seen rapid growth: data brokers. Data brokers buy, analyze, and package your data. Companies that collect large amounts of data on their users stand to profit from this service. Selling data to brokers is an important revenue stream for big tech companies.Β Β 

Advertisers and businesses benefit from increased information on their consumers, creating a high demand for your information. The problem here is that companies like Facebook and Alphabet (Google’s parent company) have been known to mine massive amounts of user data for the sake of their advertisers.Β Β 

To personalize marketing efforts

Marketing can be highly personalized thanks to the availability of large amounts of consumer data. Tracking your response to marketing campaigns can help businesses alter or improve certain aspects of their campaign to drive better results.Β Β 

The problem is that most AI-based algorithms are incapable of assessing when they should stop collecting or using your information. After a point, users run the risk of being constantly subjected to intrusive ads and other unconsented marketing campaigns that pop up frequently.Β Β 

To cater to the customer experience

Analyzing consumer behavior through reviews, feedback, and recommendations can help improve customer experience. Businesses have access to various facets of data that can be analyzed to show them how to meet consumer demands. This could help improve any part of a consumer’s interaction with the company, from designing special offers and discounts to improving customer relationships.Β Β 

For most social media platforms, the goal is to curate a personalized feed that appeals to the users and allows them to spend more time on the app. When left unmonitored, the powerful algorithms behind these social media platforms can repeatedly subject you to the same kind of content from different creators.Β Β 

Which companies track the most information?

Here are the big tech companies that collect and mine the most user data.Β Β 

  • Google. Google is the most avid big tech data miner currently on the internet because the search engine deals almost exclusively with user data. Google tracks and analyzes everything from your Gmail and calling history (for VoLTE calls) to your Chrome browsing preferences through third-party cookies.Β Β 
  • Facebook. Meta’s Facebook collects phone numbers, personal messages, public comments, and metadata from all of your photos and videos. Facebook primarily uses this data to fuel its demographic-based targeted ad mechanisms.Β Β 
  • Amazon. Amazon has recently admitted to storing many user data points, including phone numbers, credit card information, usernames, passwords, and even Social Security numbers. Amazon also stores information about your search terms and previously bought products.Β Β 
  • Twitter. Platforms like Twitter employ a β€œfamily of apps” technique to gather sensitive user data. While these platforms openly collect and mine user data themselves, they also collect information from app networks (like Twitter’s MoPub or Google’s AdMob) that include several other third-party apps. These apps choose to partner with tech giants for better profits.Β Β 
  • Apple. While much better than its competitors, Apple still mines a considerable amount of user data. While Apple’s systems allow users to control their privacy settings, Apple gives all of its users’ information to Apple’s iOS-based advertisement channels. The iPhone App Store is another place where user data is exclusively used to create customized user experiences.Β 
  • Microsoft. Microsoft primarily collects device-related data like system configurations, system capabilities, IP addresses, and port numbers. It also harvests your regular search and query data to customize your search options and make for a better user experience.Β Β 

Discover how McAfee can help protect your identity onlineΒ 

Users need a comprehensive data privacy solution to tackle the rampant, large-scale data mining carried out by big tech platforms. While targeted advertisements and easily found items are beneficial, many of these companies collect and mine user data through several channels simultaneously, exploiting them in many different ways.Β Β 

It’s important to make sure your personal information is protected. Protection solutions like McAfee’s Personal Data Cleanup feature can help. With this feature, our teams scour the web for traces of your personal information and assist in getting it removed to enhance your online privacy.Β Β 

McAfee’s Total Protection provides antivirus software for all of your digital devices and a secure VPN connection to avoid exposure to malicious third parties while browsing the internet. Our identity monitoring and personal data removal solutions further remove gaps in your devices’ security systems.Β Β 

With our airtight data protection and custom guidance (complete with a protection score for each platform and tips to keep you safer), you can be sure that your internet identity is protected.Β Β 

The post What Personal Data Do Companies Track? appeared first on McAfee Blog.

Apple Releases Security Patches for all Devices Fixing Dozens of New Vulnerabilities

By Ravie Lakshmanan
Apple on Wednesday rolled outΒ software fixesΒ for iOS, iPadOS, macOS, tvOS, and watchOS to address a number of security flaws affecting its platforms. This includes at least 37 flaws spanning different components in iOS and macOS that range from privilege escalation to arbitrary code execution and from information disclosure to denial-of-service (DoS). <!--adsense--> Chief among them is CVE-2022-

Experts Uncover New CloudMensis Spyware Targeting Apple macOS Users

By Ravie Lakshmanan
Cybersecurity researchers have taken the wraps off a previously undocumented spyware targeting the Apple macOS operating system. The malware, codenamedΒ CloudMensisΒ by Slovak cybersecurity firm ESET, is said to exclusively use public cloud storage services such as pCloud, Yandex Disk, and Dropbox for receiving attacker commands and exfiltrating files. "Its capabilities clearly show that the

Microsoft Details App Sandbox Escape Bug Impacting Apple iOS, iPadOS, macOS Devices

By Ravie Lakshmanan
Microsoft on Wednesday shed light on a now patched security vulnerability affecting Apple's operating systems that, if successfully exploited, could allow attackers to escalate device privileges and deploy malware. "An attacker could take advantage of this sandbox escape vulnerability to gain elevated privileges on the affected device or execute malicious commands like installing additional

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system

By Paul Ducklin
"Install this moneymaking app" - this one is so special that it isn't available on Google Play or the App Store!

Apple patches 87 security holes – from iPhones and Macs to Windows

By Paul Ducklin
Lots of fixes, with data leakage flaws and code execution bugs patched on iPhones, Macs and even Windows.

apple-1200

Apple AirTag anti-stalking protection bypassed by researchers

By Paul Ducklin
Problems with Apple's Tracker Detect system, which warns you of likely stalking attempts using hidden AirTags.

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By Paul Ducklin
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

Apple fixes Safari data leak (and patches a zero-day!) – update now

By Paul Ducklin
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

Can Apple Macs get Viruses?

By McAfee

It’s a long-standing question. Can Apple Macs get viruses?

While Apple does go to great lengths to keep all its devices safe, this doesn’t mean your Mac is immune to all computer viruses. So what does Apple provide in terms of antivirus protection? Let’s take a look along with some signs that your Mac may be hacked and how you can protect yourself from further threats beyond viruses, like identity theft.

Signs that your Mac may be hacked

Whether hackers physically sneak it onto your device or by tricking you into installing it via a phony app, a sketchy website, or a phishing attack, viruses and malware can create problems for you in a few ways:

  • Keylogging: In the hands of a hacker, keylogging works like a stalker by snooping information as you type.
  • Trojans: Trojans are type of malware that can be disguised in your computer to extract important data, such as credit card account details or personal information.
  • Cryptominers: Similar to trojans, this software hides on a device. From there, it harnesses the device’s computing power to β€œmine” cryptocurrencies. While cryptomining is not illegal, β€œcryptojacking” a device without the owner’s consent is most certainly illegal.

Some possible signs of hacking software on your Mac include:

Performance issues

Is your device operating more slowly, are web pages and apps harder to load, or does your battery never seem to keep a charge? These are all signs that you could have malware running in the background, zapping your device’s resources.

Your computer feels like it’s running hot

Like the performance issues above, malware or mining apps running in the background can burn extra computing power (and data). Aside from sapping performance, malware and mining apps can cause your computer to run hot or even overheat.

Mystery apps or data

If you find apps you haven’t downloaded, along with messages and emails that you didn’t send, that’s a red flag. A hacker may have hijacked your computer to send messages or to spread malware to your contacts. Similarly, if you see spikes in your data usage, that could be a sign of a hack as well.

Pop-ups or changes to your screen

Malware can also be behind spammy pop-ups, changes to your home screen, or bookmarks to suspicious websites. In fact, if you see any configuration changes you didn’t personally make, this is another big clue that your computer may have been hacked.

What kind of antivirus do Macs have?

Macs contain several built-in features that help protect them from viruses:

  • XProtect and Automatic Quarantine: XProtect is Apple’s proprietary antivirus software that’s been included on all Macs since 2009. Functionally, it works the same as any other antivirus, where it scans files and apps for malware by referencing a database of known threats that Apple maintains and updates regularly. From there, suspicious files are quarantined by limiting their access to the Mac’s operating system and other key functions. However, .
  • Malware Removal Tool: To further keep Apple users protected, the Malware Removal Tool (MRT) scans Macs to spot and catch any malware that may have slipped past XProtect. Similar to XProtect, it relies on a set of constantly updated definitions that help identify potential malware. According to Apple, MRT removes malware upon receiving updated information, and it continues to check for infections on restart and login.
  • Notarization, Gatekeeper, and the App Review Process: Another way Apple keeps its users safe across MacOS and iOS devices is its Notarization Apps built to run on Apple devices go through an initial review before they can be distributed and sold outside of Apple’s App Store. When this review turns up no instances of malware, Apple issues a Notarization ticket. That ticket is recognized in another part of the MacOS, Gatekeeper, which verifies the ticket and allows the app to launch. Additionally, if a previously approved app is later to found to be malicious, Apple can revoke its Notarization and prevent it from running.

Similarly, all apps that wish to be sold on the Apple App Store must go through Apple’s App Review. While not strictly a review for malware, security matters are considered in the process. Per Apple, β€œWe review all apps and app updates submitted to the App Store in an effort to determine whether they are reliable, perform as expected, respect user privacy, and are free of objectionable content.”

Do I need to purchase antivirus for my Mac?

There are a couple reasons why Mac users may want to consider additional protection in addition to the antivirus protection that Mac provides out of the box:

  1. Apple’s antivirus may not recognize the latest threats. A component of strong antivirus protection is a current and comprehensive database of virus definitions. As noted above, , leaving Mac owners who solely rely on XProtect and other features susceptible to attack.
  2. Apple’s built-in security measures for Macs largely focus on viruses and malware alone. While protecting yourself from viruses and malware is of utmost importance (and always will be), the reality is that antivirus is not enough. Enjoying the life online today means knowing your privacy and identity are protected as well.

In all, Macs are like any other connected device. They’re susceptible to threats and vulnerabilities as well. Looking more broadly, there’s the wider world of threats on the internet, such as phishing attacks, malicious links and downloads, prying eyes on public Wi-Fi, data breaches, identity theft, and so on. It’s for this reason Mac users may think about bolstering their defenses further with online protection software.

Β Further protecting your Mac from viruses and attacks

Staying safer online follows a simple recipe:

  • Being aware of the threats that are out there.
  • Understanding where your gaps in protection are.
  • Taking steps to protecting yourself from those threats and closing any gaps as they arise.

Reading between the lines, that recipe can take a bit of work. However, comprehensive online protection can take care of it for you. In particular, McAfee Total Protection includes an exclusive Protection Score, which checks to see how safe you are online, identifies gaps, and then offers personalized guidance, and helping you know exactly how safe you are.

An important part of this score is privacy and security, which is backed by a VPN that turns on automatically when you’re on an unsecure network and personal information monitoring to help protect you from identity theftβ€”good examples that illustrate how staying safe online requires more than just antivirus.

Consider your security options for your Mac

So, Macs can get viruses and are subject to threats just like any other computer. While Macs have strong protections built into them, they may not offer the full breadth of protection you want, particularly in terms of online identity theft and the ability to protect you from the latest malware threats. Consider the threats you want to keep clear of and then take a look at your options that’ll help keep you safe.

The post Can Apple Macs get Viruses? appeared first on McAfee Blog.

Serious Security: Apple Safari leaks private data via database API – what you need to know

By Paul Ducklin
There's a tiny data leakage bug in the WebKit browser engine... but it could act as a "supercookie" identifier for your browsing

Apple Home software bug could lock you out of your iPhone

By Paul Ducklin
The finder of this bug insists it "poses a serious risk". We're not so sure, but we recommend you take steps to avoid it anyway.

❌