NordVPN admits it was hacked, saying that in March 2018 one of its data centers was accessed by a third party.
Security
Samsung Galaxy S10's Finger Print Sensor Easily Bypassed
So it turns out the fingerprint sensor on the Samsung Galaxy S10 can be circumvented by a $3.47 screen protector. The BBC had that report, but it was John Gruber’s commentary I thought was spot on:
When the iPhone 5S debuted with Touch ID, we were inundated with news stories about “easy” ways to spoof it that were, in fact, not easy at all. Now we learn that Samsung’s flagship phone’s fingerprint sensor can in fact be spoofed trivially — and… crickets.
In a word, yup.
New York City Partners With Cellebrite to Hack iPhones
Documents reveal that New York City law enforcement has a partnership with Cellebrite to hack iPhones.
Previously, if law enforcement wanted to get into newer devices, they had to send the phones to one of Cellebrite’s digital forensics labs, located in New Jersey and Virginia. But Cellebrite’s new UFED Premium program gave law enforcement the ability to “unlock and extract data from all iOS and high-end Android devices” on their own, using software installed on computers in their offices.
I’ve always wondered if eventually Apple will remove the Lightning port from the iPhone once wireless charging becomes the norm. Side effects may include better waterproofing and worsened hacking.
Microsoft says Iranian 'Phosphorus' Group Tried to Hack U.S. Presidential Campaign
In a blog post today Microsoft says that Iranian hackers attacked a U.S. presidential campaign, current and former U.S. government officials, journalists covering global politics and prominent Iranians living outside Iran.
Four accounts were compromised as a result of these attempts; these four accounts were not associated with the U.S. presidential campaign or current and former U.S. government officials. Microsoft has notified the customers related to these investigations and threats and has worked as requested with those whose accounts were compromised to secure them.
No word yet on what time President Trump asked Iran to interfere with our elections.
One Year Later: Bloomberg Hasn't Retracted its iCloud Spy Chip Story
This story doesn’t need me piling on, but I think it’s astounding that a media organization with integrity, gravitas, etc. etc. still hasn’t retracted its debunked theory one year later. And the journalists who wrote the story are now in charge of Bloomberg‘s cybersecurity division. If by some miracle we learn that there really are spy chips I will most certainly apologize. But with zero evidence, I think that probability is low.
There’s been a lot of smoke, but no firings. Quite the opposite. It’s been a year since Bloomberg Businessweek published an extensively debunked story claiming that companies including Apple and Amazon had been hacked. Yet since then, all of Bloomberg‘s few responses and actions have only doubled down on how this publication lacks credibility on the topic.
'Words With Friends' Data Breach Affects 218 Million
A hacker going by the handle ‘Gnosticplayers’ claims to have hacked Words With Friends and accessed a database with over 218 million users.
Apple Films in Theaters, iPhone Adoration – TMO Daily Observations 2019-09-27
Charlotte Henry and Andrew Orr join host Kelly Guimont to discuss a security PSA, Apple content in theaters, and Charlotte’s iOS conversion.
Apple Releases iOS 13.1.1 With Security and Bug Fixes
Just three days after releasing iOS 13.1, Apple is now pushing iOS 13.1.1 to its devices. It fixes a number of security and bug issues.
DoorDash Data Breach Affects 4.9 Million People
Another day, another data breach. This time it’s DoorDash and “unusual activity involving a third-party” affecting 4.9 million.
Hacker Claims New 'checkm8' Exploit Can Lead to Permanent Jailbreak
Twitter use axi0mX posted about how a new iOS exploit called checkm8 could lead to a “permanent unpatchable bootrom exploit” for iPhone 4s to iPhone X.
What I am releasing today is not a full jailbreak with Cydia, just an exploit. Researchers and developers can use it to dump SecureROM, decrypt keybags with AES engine, and demote the device to enable JTAG. You still need additional hardware and software to use JTAG.
I’m sure governments around the world will be in touch.
macOS Mojave 10.14.6 Patches a Security Hole
Along with iOS 12.4.2 Apple is releasing macOS Mojave 10.14.6, a second supplemental update with security fixes.
If you’re running an earlier version of macOS then you will instead find Security Update 2019-005 for macOS High Sierra and Security Update for macOS Sierra available as system software updates.
The security issue as shared here fixes CVE-2019-8641: A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Be Cautious of AltStore, the New Alternative App Store
There are reports of an alternative App Store that doesn’t require jailbreaking. It’s called AltStore, and it lets you download these alternative apps via a server you install on your Mac. While the developer says that the code for AltStore is open source, that doesn’t mean the apps within are. I urge caution about installing unknown apps outside of the App Store. If they can’t make it through the app review team, there’s probably a reason for that. For example, this quote from the blog:
From the beginning, AltStore was intended to serve as a way for developers to distribute entirely new apps that push the boundaries of iOS in ways not possible with Apple’s app review system.
Hopefully, “pushing the boundaries” doesn’t include apps full of malware.
White House Blocks Audit of its Offensive Hacking Strategy
The White House is blocking an audit by Congress for its offensive hacking policy it has already used for cyberattacks against Russia and Iran.
The policy, which loosened the reins on military strikes against U.S. adversaries, has been withheld for more than a year from lawmakers — even those who regularly review classified material. Lawmakers from both parties are concerned the Trump administration could plunge the country into a cyberwar without congressional approval or oversight, or at the very least, provoke retaliation that causes serious damage at home.
The White House hacking strategy is: “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing.“
Sharing Locationless Photos, Apple Security Flaws – TMO Daily Observations 2019-09-25
Andrew Orr and John Martellaro join host Kelly Guimont to discuss sharing photos (but not their location data), and Apple’s OS security.
iOS 13: How to Add a Second Person to Face ID
You can add a second person to Face ID on iOS devices. This is great for people who share their devices. Here’s how to do it.
Cloudflare Releases Warp VPN for Everyone
Cloudflare announced its Warp VPN earlier this year and created a waiting list for it to be rolled out. Although the company had technical difficulties, the list is gone and Warp VPN is available for everyone today.
Let me start with the apology. We are sorry making WARP available took far longer than we ever intended. As a way of hopefully making amends, for everyone who was on the waitlist before today, we’re giving 10 GB of WARP Plus — the even faster version of WARP that uses Cloudflare’s Argo network — to those of you who have been patiently waiting.
This Friday I intend to publish a list of five VPN apps for iOS, and Warp will be included.
Russian Confesses to JPMorgan Chase Hack
Russian national Adrei Tyurin confessed to the 2014 hacking of JPMorgan Chase which stole the data of over 80 million customers.
Tyurin carried out the hacks at the direction of co-conspirator Gery Shalon, who used the stolen data to further a variety of schemes, including securities fraud. One scheme involved artificially inflating the price of certain publicly traded stocks by marketing them in a deceptive and misleading manner to customers of companies Tyurin had hacked.
Legislation and Tech Conflicts, iPhone Battery Life – TMO Daily Observations 2019-09-18
Andrew Orr and Bryan Chaffin join host Kelly Guimont to discuss tech and legislation colliding in unfortunate ways, and iPhone battery life.
Your X-Ray Images and Medical Data Are Available on the Internet
A ProPublica investigation revealed that medical images and health data are often stored in insecure servers that are easily accessible to anyone with a bit of computer knowledge.
We identified 187 servers — computers that are used to store and retrieve medical data — in the U.S. that were unprotected by passwords or basic security precautions. The computer systems, from Florida to California, are used in doctors’ offices, medical-imaging centers and mobile X-ray services.
All told, medical data from more than 16 million scans worldwide was available online, including names, birthdates and, in some cases, Social Security numbers.
LastPass 4.33.0 Fixes Bug That Leaked User Data
Google’s Project Zero security team found a LastPass bug that exposed user credentials on a website they previously visited.
iPhones Can Now Use Yubico NFC Security Keys
Apple is expanding NFC capabilities with iOS 13, and you’ll be able to use Yubico NFC keys or other brands with your iPhone.
SimJacker is a Newly-Discovered SIM Card Vulnerability
SimJacker is a newly-discovered vulnerability in SIM cards that lets an attacker hack your smartphone just by sending an SMS message.
Apple Card 3% Club, NSA in NYT – TMO Daily Observations 2019-09-12
Andrew Orr and Bryan Chaffin join host Kelly Guimont to discuss the latest 3% back offers on Apple Card, & a letter from the NSA in the NYT.
New Exploit Shows We Should Just Skip to iOS 13.1
A contacts exploit was discovered in iOS 13 that lets a person bypass Face ID / Touch ID to see an iPhone’s contacts.
Relatively little is at stake with this exploit. Beyond the inherent danger of an assailant having your iPhone, this method only allows someone to view the contacts within the target iPhone, provided that they have physical access to the target phone and can complete the VoiceOver exploit.
Little is at stake, but there have been so my iOS exploits in the news lately that we might as well go straight to iOS 13.1.