'Synthetic Click' attack re-emerges in macOS High Sierra at Defcon: "A vulnerability has been discovered in macOS that could allow an attacker to impersonate a mouse click, enabling for it to bypass security prompts and completely compromise a Mac, a flaw that was found by accident. "

No, mama no!

Labels: security fail, security is hard

Wipe your iPhone before selling it, because if you don't you might get your data stolen: "Even if you can't use your phone, you can safeguard your data. For instance, Apple does let you remotely wipe everything using Find My iPhone from another iOS device. That has to be enabled: if you've never switched on Find My iPhone or you've actively switched it off, you can't remote wipe."

The moral of the story is: turn on Find my iPhone.

Labels: app security, security fail

Amazon Echo recorded household audio, sent it to random contact: "An Oregon family's Amazon Echo recorded household audio and sent it to an employee of the family's husband, something Amazon blamed on a rare bug that it intends to fix."

Hmmm.

Labels: security fail, security leak

Intel promises fix for new 'Variant 4' Meltdown, Spectre vulnerability: "Industry woes over Meltdown and Spectre continued this week when Google and Microsoft on Monday revealed a newly discovered silicon-level vulnerability impacting chips used in millions of computers, including those marketed by Apple. "

I'm totally cereal about this.

Labels: security fail, security flaw, security is hard, software fail

More Spectre-style chip flaws discovered in Intel processors: "The eighth vulnerability is apparently an exception, potentially posing a greater threat than Spectre itself, as it could allow an attacker to launch an exploit in a virtual machine (VM) as a way to attack the host system. Largely affecting enterprise, as well as some individual users who operate VMs privately, the vulnerability could also be used to attack other VM instances on the same server, and due to Intel's Software Guard Extensions (SGX) not being "Spectre-safe," it could also intercept passwords and keys transmitted between VM instances. "

"Nobody ever got fired for buying IBM."

Labels: security exploit, security fail, security flaw

Intel drops plans to develop Spectre microcode for ancient chips | Ars Technica: "Intel has scaled back its plans to produce microcode updates for some of its older processors to address the "Spectre variant 2" attack. Core 2 processors are no longer scheduled to receive updates, and, while some first generation Core products have microcode updates available already, others have had their update cancelled.

I wanted to fix the worst computer bug in the history of humankind but then I realized if I don't fix it, people will buy more new CPU chips. It's a win-win situation!

Labels: security fail

Wi-Fi security has been breached, say researchers - The Verge: "At about 7AM ET this morning, researchers revealed details of a new exploit called KRACK that takes advantage of vulnerabilities in Wi-Fi security to let attackers eavesdrop on traffic between computers and wireless access points."

Kind of a major fail.

Labels: security exploit, security fail

Cult of Mac Magazine: Why you shouldn’t trust every Apple ID prompt, and more | Cult of Mac: "It’s not uncommon to see a random popup that asks you to “Sign In to iTunes Store” on iOS. They sometimes appear unexpectedly, but they’re usually genuine. There is a chance that the app’s developer is phishing for your Apple ID password. We’ll show you an easy trick to distinguish legit popups from phishing attempts."

The beginning of the end...

Labels: security fail

Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked' • The Register: "In addition, it appears that a Deloitte employee uploaded company proxy login credentials to his public Google+ page. The information was up there for over six months – and was removed in the past few minutes."

Trusted computing.

Labels: security fail, security is hard

In spectacular fail, Adobe security team posts private PGP key on blog | Ars Technica: "But instead of clicking on the "public" button, the person responsible clicked on "all" and exported both keys into a text file. Then, without realizing the error, the text file was cut/pasted directly to Adobe's PSIRT blog."

Hmmm.

Labels: security fail, software fail

Firmware update blunder bricks hundreds of home 'smart' locks • The Register

"Damned if you do, damned if you don't." - Bart Simpson

Labels: security fail, security is hard

Internet cameras have hard-coded password that can’t be changed | Ars Technica

Keep shopping for another brand...

Labels: security fail

Keylogger Found in Audio Driver of HP Laptops: "The audio driver installed on some HP laptops includes a feature that could best be described as a keylogger, which records all the user's keystrokes and saves the information to a local file, accessible to anyone or any third-party software or malware that knows where to look."

I can't hear you, could you turn it up?

Labels: security fail

How to remote hijack computers using Intel's insecure chips: Just use an empty login string • The Register: "Intel provides a remote management toolkit called AMT for its business and enterprise-friendly processors; this software is part of Chipzilla's vPro suite and runs at the firmware level, below and out of sight of Windows, Linux, or whatever operating system you're using. The code runs on Intel's Management Engine, a tiny secret computer within your computer that has full control of the hardware and talks directly to the network port, allowing a device to be remotely controlled regardless of whatever OS and applications are running, or not, above it."

Geez Louise!

Labels: security fail, security flaw, x86

Red alert! Intel patches remote execution hole that's been hidden in its chips since 2008 • The Register: "For the past nine years, millions of Intel desktop and server chips have harbored a security flaw that can be exploited to remotely control and infect vulnerable systems with spyware."

Good lord! Who updates firmware? Nobody expects the Spanish inquisition!

Labels: security fail

Interpol unplugs nearly 9,000 Asian command and control networks • The Register: "An Interpol investigation has revealed a worrying degree of insecurity in sout-east Asian countries, with even government-operated Web servers infected to operate as command and control systems for bot-herders."

Wordpress! Whodathunkit?

Labels: security fail, security flaw

Script kiddies pwn 1000s of Windows boxes using leaked NSA hack tools • The Register: "Tentler reckons that when the Shadow Brokers' arsenal hit the web on Easter weekend, script kiddies around the world grabbed the cyber-arms, went out, and infected everything they could find."

The gift that keeps on giving...

Labels: security fail, security flaw

Google slaps Symantec for sloppy certs, slow show of SNAFUs • The Register: "Google's Chrome development team has posted a stinging criticism of Symantec's certificate-issuance practices, saying it has lost confidence in the company's practices and therefore in the safety of sessions hopefully-secured by Symantec-issued certificates."

Securing internet transactions: a house of cards. Will I buy a $9.99/year Google-issued certificate? The answer is a resounding yes, Go Daddy!

Labels: security fail, security policy

Digital video recorder installers master password list 'leaked' – claims • The Register: "The vendor's 2017 list of superuser passwords for certain DVRs – designed only for CCTV installers to access customer installations – appears to have leaked online."

Master password? Now there's a good idea.

Labels: security fail

Gooligan malware roots 1M Android phones in "largest Google account breach to date": "A new strain of Android malware dubbed "Gooligan," thought to be "the largest Google account breach to date," is already in active circulation and three-fourths of the Android installed base is vulnerable. Once infected, devices give hackers access to the users' Gmail, Google Photos, Docs, Drive and other Google services accounts. "

So excited to have a new iPhone courtesy of a free upgrade from my carrier. I enjoyed learning about Android, but in the end, let me say it again: interpreted languages SUCK! 6502 ASM forever!

Labels: security fail