Introduction

This week is all about the word itself: security.

How law enforcement gets around your smartphone’s encryption

Yeah, you read that right and if you think: No system is safe, you are probably right.

The research was carried out at Johns Hopkins University led by Mathew D. Green.

Excerpt from the article:

“It just really shocked me, because I came into this project thinking that these phones are really protecting user data well,” says Johns Hopkins cryptographer Matthew Green, who oversaw the research. “Now I’ve come out of the project thinking almost nothing is protected as much as it could be. So why do we need a backdoor for law enforcement when the protections that these phones actually offer are so bad?”

Apple Removes macOS Feature That Allowed Apps to Bypass Firewall Security

Earlier in this series we discussed a story about how native apps on macOS Big Sur bypassed the firewall, but now, Apple has removed the feature that allowed such access.

Excerpt from the article:

Called "ContentFilterExclusionList," it included a list of as many as 50 Apple apps like iCloud, Maps, Music, FaceTime, HomeKit, the App Store, and its software update service that were routed through Network Extension Framework, effectively circumventing firewall protections.

This exclusion list has been scrubbed now from macOS 11.2 beta.

Researchers Earn $50,000 for Hacking Apple Servers

You might argue that the "big guys" system should be lockdown pretty good, but as we've seen before, when attackers want something from your systems, they'll find a way to get it.

Excerpt from the article:

Jaiswal and Maini said their research focused on Apple hosts running a content management system (CMS) powered by Lucee, an open source scripting language designed for developing web applications.

During their analysis, they discovered three Apple hosts that exposed the Lucee admin panel, including two apparently associated with a travel portal provided by Apple to employees.

Google Details Patched Bugs in Signal, FB Messenger, JioChat Apps

For the foreseeable future, patching bugs will remain a process in software maintenance.

Excerpt from the article:

The vulnerability was deemed so severe that the iPhone maker removed the FaceTime group chats feature altogether before the issue was resolved in a subsequent iOS update.

Since then, a number of similar shortcomings have been discovered in multiple video chat apps such as Signal, JioChat, Mocha, Google Duo, and Facebook Messenger — all thanks to the work of Google Project Zero researcher Natalie Silvanovich.

MrbMiner Crypto-Mining Malware Links to Iranian Software Company

The title says it all.

Excerpt from the article:

The attribution was made possible due to an operational security oversight, said researchers from cybersecurity firm Sophos, that led to the company's name inadvertently making its way into the cryptominer code.

UK govt gives malware infected laptops to vulnerable students

I guess what you are thinking: Are you kidding me!?

Excerpt from the article:

Upon unboxing and preparing them, it was discovered that a number of the laptops were infected with a self-propagating network worm.

The malware found on the infected laptops is Gamarue (aka Andromeda), a modular malware strain known to be commonly used by Russian and Eastern European cybercriminals.

Amazon Awards $18,000 for Exploit Allowing Kindle E-Reader Takeover

The title says it all.

Excerpt from the article:

The attack, dubbed KindleDrip, was discovered in October 2020 by Yogev Bar-On, a researcher at Israel-based cybersecurity consulting firm Realmode Labs. KindleDrip involved the exploitation of three different security holes, all of which were addressed by Amazon.

Credits

The new cover photo is by Debby Hudson on Unsplash. Moving forward, it will be the cover photo for all articles in this series for the foreseeable future.

That's it for this week, I'll see you next Friday.