Apple squashes cert-handling bug affecting macOS and iOS • The Register: "The flaw – discovered and responsibly disclosed by security researchers from Cisco Talos – stemmed from bugs in the X.509 certificate validation functionality of Apple macOS and iOS. Improper handling of X.509v3 certificate extensions fields created the code injection risk.

Labels: security exploit, security fix

Google slaps Symantec for sloppy certs, slow show of SNAFUs • The Register: "Google's Chrome development team has posted a stinging criticism of Symantec's certificate-issuance practices, saying it has lost confidence in the company's practices and therefore in the safety of sessions hopefully-secured by Symantec-issued certificates."

Labels: security fail, security policy

Microsoft Word macro malware automatically adapts attack techniques for macOS, Windows: "When executed, the macro reads and decodes base 64-encoded data stored in the file's "comments" property. This code turns out to be a python script that attempts to detect the operating system the file is opened inside, running one of two different functions depending on if the host system is running macOS or Windows. "

Labels: malware

Inside the Hunt for Russia's Most Notorious Hacker | WIRED: "Werner, as it happened, knew quite a bit about Evgeniy Bogachev. He knew in precise, technical detail how Bogachev had managed to loot and terrorize the world’s financial systems with impunity for years.

Labels: malware, security, security is hard

Apple hires renowned iPhone jailbreaker to help protect privacy | Cult of Mac: "Jonathan Zdziarski, who was active in the iPhone jailbreaking community for years, revealed today that he has accepted an offer to join Apple’s Security Engineering and Architecture team."

Labels: apptight, attack surface, hacking iphone

WikiLeaks documents show CIA struggling to crack Apple gear, little danger to everyday folk: "Apple has since revealed that it has patched most of the CIA's exploits in iOS 10.

Labels: security policy

'Password rules are bullsh*t!' Stackoverflow Jeff's rage overflows • The Register: ""These days, given the state of cloud computing and GPU password hash cracking, any password of 8 characters or less is perilously close to no password at all," he said."

Labels: security policy

After NSA hacking exposé, CIA staffers asked where Equation Group went wrong | Ars Technica: "A third error was the failure to renew some of the domain name registrations Equation Group-infected computers reported to. When Kaspersky Lab obtained the addresses, the researchers were shocked to find some machines infected by a malware platform abandoned more than 10 years earlier were still connecting to it."

Labels: security policy

WikiLeaks document dump reveals CIA iPhone penetration team, insecurity of exploit library: "Overall, WikiLeaks claims that the Engineering Development Group inside the agency's CCI has produced more than 1000 hacking systems and "weaponized" malware. Reportedly, the codebase associated with the vectors is larger than Facebook's."

Labels: security policy

How Google's lack of human curation spreads and monetizes fake news: "Google search is developing a credibility problem that could be blamed on artificial intelligence. In a statement, the company said its algorithms for generating "featured snippet" answers can cause "instances when we feature a site with inappropriate or misleading content," resulting in false answers."

Labels: security policy