Apple Passwords App Bug May Have Enabled Phishing, Now Fixed
A bug in Apple’s Passwords app was discovered by the security researchers at Mysk. They found that when a new password was saved in the app, the app would query the domain to get a copy of its icon, and those queries were not done using encrypted HTTPS, but instead over unencrypted HTTP. After further investigation, they found that the Passwords app was also opening password reset pages using the older insecure HTTP connection. That amounts to a fairly serious mistake, since it means that a malicious network operator, such as someone who has control over airport Wi-Fi, might intercept the password reset page and replace it with a phishing page.
For some reason, Apple patched this bug in January with iOS 18.3, but waited two months to announce that it had done so, and also refused to pay a bug bounty to Mysk.
The Bottom Line: Keep your devices up to date. Researchers are constantly looking for flaws like this, and so are scammers.
Mac Users Beware of New Phishing Strategy
There is a new phishing campaign targeting Mac users. The strategy works by showing you a legitimate-looking web page (like the Apple Store). Then, a pop-up will warn you that your Mac has been compromised and prompt you to enter your Apple Account email and password.
The Bottom Line: If you come across any pop-ups like the ones described above, do not enter your email or password. Close the window, and make sure the URL you entered is correct.
Your Data May Be Compromised by a Stalkerware’s Security Failure
Stalkerware is the name for a category of apps engineered to allow a third party to monitor everything on a victim’s phone, and sometimes to control or interfere with the phone. They’re often marketed as parental controls, to allow parents to keep track of their children, but they can just as easily be used by domestic abusers who have access to their victim’s phone. One stalkerware vendor, called SpyX, recently got hacked and its database of private information leaked. That database included the emails of a lot of SpyX customers, but also many of their victims. The data from this breach has been shared with the archive at haveibeenpwned.com so you can check that website to see if you are affected.
The Bottom Line: Usually spyware on iOS works by adding an extra device to the victim’s Apple account. Once added, that fake device can download copies of the victim iPhone’s iCloud device backups. iCloud device backups contain copies of text messages, emails, app activity, and more. You can check to see what devices have access to your Apple ID (and thus, could download your iPhone backups) by going to Settings > Apple Account. Scroll to the bottom of the page and you’ll see a list of devices. To remove a device, tap on it and select Remove from Account.
Without True Backup, Your Files, Photos & Videos Aren’t Protected
There is nothing worse than losing your phone or spilling coffee on your laptop and realizing you haven’t backed up any of your photos, videos or files. Carbonite Safe Backup offers automatic, unlimited backup to ensure your files are always protected. With secure cloud storage and advanced encryption, your data remains safe from online threats and our easy file recovery and remote access capabilities mean you can retrieve files from anywhere, anytime. World Backup Day is 3/31 and to celebrate we are offering our best deal of the year: 75% off Carbonite Safe Backup plans!
Cybersecurity Experts Warn DOGE Is Creating Unnecessary Risk
Time magazine has a piece out on the alarms raised by the security and privacy industry regarding the Department of Government Efficiency's efforts to cut waste. These alarms have generated a large amount of press coverage, but I found the Time Magazine article to be a sober summary.
Check the Safety of Your Accounts, a Guide from Tech Crunch
Ever wondered how to check if your primary accounts have been compromised? Check out Lorenzo Franceschi-Bicchierai’s guide over at Tech Crunch. It will walk you through each of the most important accounts you’re likely to be using, including Apple, Google, and Meta, as well as WhatsApp, Signal, and other messaging services, and how to make sure it’s locked down tight.
Lawsuit Forces Meta to Stop Tracking One Single User, but It’s Still Tracking You
Back in 2022, Tanya O’Carroll filed a lawsuit against Meta, objecting to the way the company was using her data to show her targeted ads. This week, a settlement was reached, and Meta will no longer track her or show her personalized ads. While this is a great win for O’Carroll herself, a settlement means that Meta has not accepted liability and is free to continue tracking all other users. O’Carroll’s case could help set a precedent, but we won’t know for sure until it’s tested in court.
Know Your Rights: What Can US Border Agents Do with Your iPhone?
The Verge has published an excellent overview of how to lock down your iPhone when planning to cross a US border, and why you might, or might not, want to. They offer some advice that is applicable any time you’re approaching a situation where your iPhone is at increased risk of being confiscated or stolen.
The Bottom Line: Be aware of what material is accessible through your iPhone—which accounts it can access, and what is stored on it locally. When preparing to travel, consider taking steps to reduce what is stored on your iPhone, and what accounts the phone can access. Use a strong password and disable biometric locks.
