Security

UPDATE: Apple has taken Group FaceTime offline in an attempt to address the issue in the interim.

A significant bug has been discovered in FaceTime and is currently spreading virally over social media. The bug lets you call anyone with FaceTime, and immediately hear the audio coming from their phone — before the person on the other end has accepted or rejected the incoming call. Apple says the issue will be addressed in a software update “later this week”.

Naturally, this poses a pretty big privacy problem as you can essentially listen in on any iOS user, although it still rings like normal, so you can’t be 100% covert about it. Nevertheless, there is no indication on the recipient’s side that you could hear any of their audio. There’s a second part to this which can expose video too …

Expand
Expanding
Close

Security on the internet has become more important with each passing year. It seems like every other month there is a major data breach from major retailers or online properties. One of the key things that you can do to minimize the effect these breaches will have on you is to set up and use two-factor (or multi-factor) authentication. Two-factor authentication can be explained as something you know (your password) and something you have (a smartphone or another authorized device). With most implementations, you will log in to a website using your normal login, and you will then prompted to input a secondary code. The secondary code can be generated in multiple ways (more on that later) and changes every thirty seconds. By enabling two-factor authentication on websites that support it, a hacker wouldn’t be able to log in just using your username and password. They’d need access to your two-factor authentication database in order to access the current code.
Expand
Expanding
Close

We’ve been seeing a lot of scam apps in the App Store lately, which try to trick users into purchasing expensive subscriptions or products, we’ve also seen apps that track and transmit the user’s location without their consent. Today, I want to talk about an app that’s using iOS devices to perform work for other users, without the device owner’s consent.

Expand
Expanding
Close

A Chinese cyber researcher has told Reuters that he has canceled an upcoming appearance at the prestigious Black Hat Asia hacking conference at the request of his employer. The researcher, Wish Wu, was preparing a presentation entitled “Bypass Strong Face ID: Everyone Can Deceive Depth and IR Camera and Algorithms”.

Expand
Expanding
Close

An upgrade to the USB-C standard allows cryptography to be used to authenticate connected devices. It will ensure that devices are properly certified, but can also be used to enhance security …

Expand
Expanding
Close

Over the last few days, a Twining app from Popsugar has gone viral across various social media platforms. Essentially, the service allows you to snap a selfie of yourself and get an instant result showing which celebrity you look like most. As it turns out, somewhat unsurprisingly, privacy wasn’t necessarily a focus for Popsugar when developing the Twinning app…

Expand
Expanding
Close

A recent bug with one of Twitter’s support forms has exposed user details such as phone number country code and whether accounts had been locked by Twitter. The company believes the flaw was likely used by state-sponsored actors to gain information about Twitter accounts.

Expand
Expanding
Close

The latest Facebook security blunder involves photos from 6.8 million users. The company shared in an update on its developer page today that a bug allowed third-parties to see photos from Facebook users who had uploaded, but chose to not post them to the social media service.

Expand
Expanding
Close

Each year, SplashData carries out an analysis of leaked passwords to find the top 25 dumb passwords. This year, the company had five million passwords to work from, most of them from hacks in the US and Europe.

There are plenty of old favorites – including ‘password’ – but this year eleven new ones made the list …

Expand
Expanding
Close

A pair of Apple marketing team members joined the Mac Admins Podcast this week to talk about Apple’s role in enterprise and business, the T2 chip found in recent Macs, and more. Topics included Apple Business Manager, adoption of Apple hardware by companies like SAP and IBM, and more.

Expand
Expanding
Close

The tech news was dominated in October by a dramatic Bloomberg claim that Chinese spy chips had been embedded into the Super Micro motherboards of servers supplied to Apple, Amazon and others. The report claimed that Apple had discovered the chips, and reported the fact to the FBI.

All involved – Apple, Amazon and Super Micro – denied the claims, but the motherboard supplier decided the only way to lay this to rest was to commission an independent audit to investigate. That investigation has now been completed, and the firm says it found absolutely no evidence to support the story …

Expand
Expanding
Close

Last week, we reported that Australia had passed a new anti-encryption law that could force Apple and other tech companies to help law enforcement access encrypted messages. TechCrunch reports today, however, that Apple is among a handful of tech companies coming out against the legislation.

Expand
Expanding
Close

An Apple security expert, who was previously hired back in 2011, and then re-hired in 2016, is now leaving the company to join the American Civil Liberties Union. Apple often touts its security and privacy efforts, so having someone who worked on Apple’s security team leave the company is always interesting, let alone leaving the company twice…

Expand
Expanding
Close

At a Georgetown Law and Department of Justice cybercrime conference today, Deputy Attorney General, Rod Rosenstein, made a strong statement that suggests Apple has a mission to “defeat legitimate law enforcement” efforts.

Expand
Expanding
Close

If you’ve ever used a Sennheiser headset or speakerphone device with your Mac (or Windows PC), the accompanying HeadSetup app has left your machine wide open to attack.

In what has been described as a ‘monumental security blunder,’ the app allows a bad actor to successfully impersonate any secure website on the Internet …

Expand
Expanding
Close