FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
☐ ☆ ✇ The Hacker News

Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan

By: Newsroom — February 5th 2024 at 07:37
The iPhones belonging to nearly three dozen journalists, activists, human rights lawyers, and civil society members in Jordan have been targeted with NSO Group's Pegasus spyware, according to joint findings from Access Now and the Citizen Lab. Nine of the 35 individuals have been publicly confirmed as targeted, out of whom six had their devices compromised with the mercenary
☐ ☆ ✇ The Hacker News

New iShutdown Method Exposes Hidden Spyware Like Pegasus on Your iPhone

By: Newsroom — January 17th 2024 at 10:22
Cybersecurity researchers have identified a "lightweight method" called iShutdown for reliably identifying signs of spyware on Apple iOS devices, including notorious threats like NSO Group's Pegasus, QuaDream's Reign, and Intellexa's Predator.  Kaspersky, which analyzed a set of iPhones that were compromised with Pegasus, said the infections left traces in a file
☐ ☆ ✇ The Hacker News

Apple Rolls Out Security Patches for Actively Exploited iOS Zero-Day Flaw

By: Newsroom — October 5th 2023 at 03:42
Apple on Wednesday rolled out security patches to address a new zero-day flaw in iOS and iPadOS that it said has come under active exploitation in the wild. Tracked as CVE-2023-42824, the kernel vulnerability could be abused by a local attacker to elevate their privileges. The iPhone maker said it addressed the problem with improved checks. "Apple is aware of a report that this issue may have
☐ ☆ ✇ The Hacker News

New Apple Zero-Days Exploited to Target Egyptian ex-MP with Predator Spyware

By: THN — September 23rd 2023 at 06:12
The three zero-day flaws addressed by Apple on September 21, 2023, were leveraged as part of an iPhone exploit chain in an attempt to deliver a spyware strain called Predator targeting former Egyptian member of parliament Ahmed Eltantawy between May and September 2023. "The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections," the
☐ ☆ ✇ The Hacker News

Russian Journalist's iPhone Compromised by NSO Group's Zero-Click Spyware

By: THN — September 14th 2023 at 08:51
The iPhone belonging to Galina Timchenko, a prominent Russian journalist and critic of the government, was compromised with NSO Group's Pegasus spyware, a new collaborative investigation from Access Now and the Citizen Lab has revealed. The infiltration is said to have happened on or around February 10, 2023. Timchenko is the executive editor and owner of Meduza, an independent news publication
☐ ☆ ✇ The Hacker News

Apple Rushes to Patch Zero-Day Flaws Exploited for Pegasus Spyware on iPhones

By: THN — September 8th 2023 at 03:11
Apple on Thursday released emergency security updates for iOS, iPadOS, macOS, and watchOS to address two zero-day flaws that have been exploited in the wild to deliver NSO Group's Pegasus mercenary spyware. The issues are described as below - CVE-2023-41061 - A validation issue in Wallet that could result in arbitrary code execution when handling a maliciously crafted attachment. CVE-2023-41064
☐ ☆ ✇ Naked Security

“Snakes in airplane mode” – what if your phone says it’s offline but isn’t?

By: Paul Ducklin — August 21st 2023 at 17:45
WYSIWYG is short for "what you see is what you get". Except when it isn't...

☐ ☆ ✇ The Hacker News

Apple Sets New Rules for Developers to Prevent Fingerprinting and Data Misuse

By: THN — July 29th 2023 at 05:30
Apple has announced plans to require developers to submit reasons to use certain APIs in their apps starting later this year with the release of iOS 17, iPadOS 17, macOS Sonoma, tvOS 17, and watchOS 10 to prevent their abuse for data collection. "This will help ensure that apps only use these APIs for their intended purpose," the company said in a statement. "As part of this process, you'll need
☐ ☆ ✇ Naked Security

S3 Ep145: Bugs With Impressive Names!

By: Paul Ducklin — July 27th 2023 at 16:47
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

☐ ☆ ✇ McAfee Blogs

iPhone Update — Apply It Now If You Haven’t Already

By: Jasdev Dhaliwal — July 6th 2023 at 23:24

Apple recently issued an urgent iPhone update, iOS version 16.5.1. If you haven’t updated yet, you should. 

Owners of iPads should update to iOS 16.5.1 as well. 

The update contains two critical security fixes that prevent bad actors from executing malicious code on iPhones and iPads.  

One of the fixes addresses an issue with the kernel of the device—the core code that runs iPhones and iPads. Apple reported that the issue could allow an app to execute arbitrary code with kernel privileges. With those privileges, a malicious appp could attack the device at the root level. The other addresses an issue with the operating system’s WebKit, which, if uncorrected, could process maliciously crafted web content. 

You can update to iOS 16.5.1 now by going to Settings > General > Software Update. 

The update is available for:  

  • iPhone 8 and later. 
  • iPad Pro (all models). 
  • iPad Air 3rd generation and later. 
  • iPad 5th generation and later. 
  • iPad mini 5th generation and later. 

Protecting your iPhone 

Keeping your operating system current on your iPhone, and all your devices, provides a strong foundation for protection. In addition to adding new features, updates often include fixes focused on security. In this case, a couple of critical security fixes. 

You have a few options for keeping on top of security updates: 

  1. Turn on automatic updates. This will ensure that your device is running the latest and greatest version of the operating system. Additionally, you can turn on automatic updates for all your apps as well. Together, they will take the work out of keeping things current.
  2. Check for updates yourself. Even with automatic updates turned on, you might experience slightly delayed access to the latest update. In some cases, updates get rolled out to batches of users at a time to prevent download servers from getting overwhelmed. However, manually checking for updates will provide access to the latest version regardless of where you stand in the rollout queue. This way, if you see a news story about a critical update, you can still download it right away.
  3. Use online protection software for your phone. Protection like our McAfee+ plans include a Wi-Fi & System Scan feature that notifies you when you need to update iOS. It can also take the guesswork out of whether you are current or not—and keep you in the loop if you miss the news of an important update. McAfee+ offers far more protection from there. It now includes our WebAdvisor extension, which warns you of sketchy phishing links and unsafe downloads. Privacy protection and identity protection come included as well, along with a VPN for a more secure connection. 

Keep safe. Keep your iOS (and your apps) current. 

Aside from using online protection software, keeping your device current offers a strong defense from hacks and attacks. Updates to your operating system and apps will fix security issues and loopholes—the very sorts of things that bad actors are quick to exploit. 

You can keep current quite easily, thanks to automatic updates. Yet keeping an eye on the news remains important as well. If you catch word of an important update, grab it right away. No need to wait. 

The post iPhone Update — Apply It Now If You Haven’t Already appeared first on McAfee Blog.

☐ ☆ ✇ Naked Security

S3 Ep141: What was Steve Jobs’s first job?

By: Paul Ducklin — June 29th 2023 at 16:58
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ The Hacker News

New Zero-Click Hack Targets iOS Users with Stealthy Root-Privilege Malware

By: Ravie Lakshmanan — June 1st 2023 at 15:14
A previously unknown advanced persistent threat (APT) is targeting iOS devices as part of a sophisticated and long-running mobile campaign dubbed Operation Triangulation that began in 2019. "The targets are infected using zero-click exploits via the iMessage platform, and the malware runs with root privileges, gaining complete control over the device and user data," Kaspersky said. The Russian
☐ ☆ ✇ McAfee Blogs

Anyone Can Try ChatGPT for Free—Don’t Fall for Sketchy Apps That Charge You

By: Jasdev Dhaliwal — May 26th 2023 at 17:12

Anyone can try ChatGPT for free. Yet that hasn’t stopped scammers from trying to cash in on it.  

A rash of sketchy apps have cropped up in Apple’s App Store and Google Play. They pose as Chat GPT apps and try to fleece smartphone owners with phony subscriptions.  

Yet you can spot them quickly when you know what to look for. 

What is ChatGPT, and what are people doing with it? 

ChatGPT is an AI-driven chatbot service created by OpenAI. It lets you have uncannily human conversations with an AI that’s been programmed and fed with information over several generations of development. Provide it with an instruction or ask it a question, and the AI provides a detailed response. 

Unsurprisingly, it has millions of people clamoring to use it. All it takes is a single prompt, and the prompts range far and wide.  

People ask ChatGPT to help them write cover letters for job interviews, make travel recommendations, and explain complex scientific topics in plain language. One person highlighted how they used ChatGPT to run a tabletop game of Dungeons & Dragons for them. (If you’ve ever played, you know that’s a complex task that calls for a fair share of cleverness to keep the game entertaining.)  

That’s just a handful of examples. As for myself, I’ve been using ChatGPT in the kitchen. My family and I have been digging into all kinds of new recipes thanks to its AI. 

Sketchy ChatGPT apps in the App Store and Google Play 

So, where do the scammers come in? 

Scammers, have recently started posting copycat apps that look like they are powered by ChatGPT but aren’t. What’s more, they charge people a fee to use them—a prime example of fleeceware. OpenAI, the makers of ChatGPT, have just officially launched their iOS app for U.S. iPhone users and can be downloaded from the Apple App Store here. The official Android version is still yet to be released.  

Fleeceware mimics a pre-existing service that’s free or low-cost and then charges an excessive fee to use it. Basically, it’s a copycat. An expensive one at that.  

Fleeceware scammers often lure in their victims with “a free trial” that quickly converts into a subscription. However, with fleeceware, the terms of the subscription are steep. They might bill the user weekly, and at rates much higher than the going rate. 

The result is that the fleeceware app might cost the victim a few bucks before they can cancel it. Worse yet, the victim might forget about the app entirely and run up hundreds of dollars before they realize what’s happening. Again, all for a simple app that’s free or practically free elsewhere. 

What makes fleeceware so tricky to spot is that it can look legit at first glance. Plenty of smartphone apps offer subscriptions and other in-app purchases. In effect, fleeceware hides in plain sight among the thousands of other legitimate apps in the hopes you’ll download it. 

With that, any app that charges a fee to use ChatGPT is fleeceware. ChatGPT offers basic functionality that anyone can use for free.  

There is one case where you might pay a fee to use ChatGPT. It has its own subscription-level offering, ChatGPT Plus. With a subscription, ChatGPT responds more quickly to prompts and offers access during peak hours when free users might be shut out. That’s the one legitimate case where you might pay to use it. 

In all, more and more people want to take ChatGPT for a spin. However, they might not realize it’s free. Scammers bank on that, and so we’ve seen a glut of phony ChatGPT apps that aim to install fleeceware onto people’s phones. 

How do you keep fleeceware and other bad apps off your phone?  

Read the fine print. 

Read the description of the app and see what the developer is really offering. If the app charges you to use ChatGPT, it’s fleeceware. Anyone can use ChatGPT for free by setting up an account at its official website, https://chat.openai.com. 

Look at the reviews. 

Reviews can tell you quite a bit about an app. They can also tell you the company that created it handles customer feedback.  

In the case of fleeceware, you’ll likely see reviews that complain about sketchy payment terms. They might mention three-day trials that automatically convert to pricey monthly or weekly subscriptions. Moreover, they might describe how payment terms have changed and become more costly as a result.  

In the case of legitimate apps, billing issues can arise from time to time, so see how the company handles complaints. Companies in good standing will typically provide links to customer service where people can resolve any issues they have. Company responses that are vague, or a lack of responses at all, should raise a red flag. 

Be skeptical about overwhelmingly positive reviews. 

Scammers are smart. They’ll count on you to look at an overall good review of 4/5 stars or more and think that’s good enough. They know this, so they’ll pack their app landing page with dozens and dozens of phony and fawning reviews to make the app look legitimate. This tactic serves another purpose: it hides the true reviews written by actual users, which might be negative because the app is a scam. 

Filter the app’s reviews for the one-star reviews and see what concerns people have. Do they mention overly aggressive billing practices, like the wickedly high prices and weekly billing cycles mentioned above? That might be a sign of fleeceware. Again, see if the app developer responded to the concerns and note the quality of the response. A legitimate company will honestly want to help a frustrated user and provide clear next steps to resolve the issue. 

Steer clear of third-party app stores. 

Google Play does its part to keep its virtual shelves free of malware-laden apps with a thorough submission process, as reported by Google. It further keeps things safer through its App Defense Alliance that shares intelligence across a network of partners, of which we’re a proud member. Further, users also have the option of running Play Protect to check apps for safety before they’re downloaded. Apple’s App Store has its own rigorous submission process for submitting apps. Likewise, Apple deletes hundreds of thousands of malicious apps from its store each year. 

Third-party app stores might not have protections like these in place. Moreover, some of them might be fronts for illegal activity. Organized cybercrime organizations deliberately populate their third-party stores with apps that steal funds or personal information. Stick with the official app stores for the most complete protection possible.  

Cancel unwanted subscriptions from your phone. 

Many fleeceware apps deliberately make it tough to cancel them. You’ll often see complaints about that in reviews, “I don’t see where I can cancel my subscription!” Deleting the app from your phone is not enough. Your subscription will remain active unless you cancel your payment method.  

Luckily, your phone makes it easy to cancel subscriptions right from your settings menu. Canceling makes sure your credit or debit card won’t get charged when the next billing cycle comes up. 

Be wary. Many fleeceware apps have aggressive billing cycles. Sometimes weekly.  

The safest and best way to enjoy ChatGPT: Go directly to the source. 

ChatGPT is free. Anyone can use it by setting up a free account with OpenAI at https://chat.openai.com. Smartphone apps that charge you to use it are a scam. 

How to download the official ChatGPT app 

You can download the official app, currently on iOS from the App Store 

The post Anyone Can Try ChatGPT for Free—Don’t Fall for Sketchy Apps That Charge You appeared first on McAfee Blog.

☐ ☆ ✇ Naked Security

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

By: Paul Ducklin — May 19th 2023 at 01:02
All Apple users have zero-days that need patching, though some have more zero-days than others.

☐ ☆ ✇ The Hacker News

NSO Group Used 3 Zero-Click iPhone Exploits Against Human Rights Defenders

By: Ravie Lakshmanan — April 20th 2023 at 10:11
Israeli spyware maker NSO Group deployed at least three novel "zero-click" exploits against iPhones in 2022 to infiltrate defenses erected by Apple and deploy Pegasus, according to the latest findings from Citizen Lab. "NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world," the interdisciplinary laboratory
☐ ☆ ✇ Naked Security

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By: Paul Ducklin — April 8th 2023 at 01:20
A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

☐ ☆ ✇ The Hacker News

Apple Issues Urgent Security Update for Older iOS and iPadOS Models

By: Ravie Lakshmanan — March 28th 2023 at 03:41
Apple on Monday backported fixes for an actively exploited security flaw to older iPhone and iPad models. The issue, tracked as CVE-2023-23529, concerns a type confusion bug in the WebKit browser engine that could lead to arbitrary code execution. It was originally addressed by the tech giant with improved checks as part of updates released on February 13, 2023. An anonymous researcher has been
☐ ☆ ✇ Naked Security

Apple patches everything, including a zero-day fix for iOS 15 users

By: Paul Ducklin — March 28th 2023 at 00:23
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

☐ ☆ ✇ Naked Security

Apple pushes out iOS security update that’s more tight-lipped than ever

By: Paul Ducklin — December 2nd 2022 at 21:02
We grabbed the update, based on no information at all, just in case we came across a reason to advise you not to. So far, so good...

☐ ☆ ✇ Naked Security

Updates to Apple’s zero-day update story – iPhone and iPad users read this!

By: Paul Ducklin — October 28th 2022 at 12:04
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...

☐ ☆ ✇ Naked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By: Paul Ducklin — October 25th 2022 at 18:03
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

☐ ☆ ✇ Naked Security

S3 Ep104: Should hospital ransomware attackers be locked up for life? [Audio + Text]

By: Paul Ducklin — October 13th 2022 at 16:37
Have your say on three deep questions posed by this week's podcast. Read or listen as suits you best...

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By: Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ The first stop for security news | Threatpost

iPhone Users Urged to Update to Patch 2 Zero-Days

By: Elizabeth Montalbano — August 19th 2022 at 15:25
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.
☐ ☆ ✇ Threatpost | The first stop for security news

iPhone Users Urged to Update to Patch 2 Zero-Days

By: Elizabeth Montalbano — August 19th 2022 at 15:25
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack.
☐ ☆ ✇ Naked Security

Apple patches “0-day” browser bug fixed 2 weeks ago in Chrome, Edge

By: Paul Ducklin — July 21st 2022 at 12:38
One vendor's zero-day is another vendor's routine patch...

☐ ☆ ✇ Naked Security

Apple pushes out two emergency 0-day updates – get ’em now!

By: Paul Ducklin — March 31st 2022 at 23:38
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

☐ ☆ ✇ Naked Security

Apple zero-day drama for Macs, iPhones and iPads – patch now!

By: Paul Ducklin — February 11th 2022 at 14:25
Sudden update! Zero-day browser hole! Drive-by malware danger! Patch Apple laptops and phones now...

apple-1200

☐ ☆ ✇ Naked Security

Apple fixes Safari data leak (and patches a zero-day!) – update now

By: Paul Ducklin — January 27th 2022 at 21:09
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.

apple-1200

☐ ☆ ✇ Naked Security

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

By: Paul Ducklin — December 16th 2021 at 17:41
Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

❌