Beware of Zoom Remote Control
In any normal Zoom call, if somebody shares their screen, then you can click a button to request control over that person's computer. This can be super helpful if you're trying to do tech support, and also for hackers. A new report from a group called The Security Alliance details how crypto thieves have started using Zoom remote control to steal crypto. It's a straightforward scam: they message you pretending to be journalists or podcasts looking to interview you on some pretext, then they set up a Zoom call, and when you join, they ask you to share your screen. When they join the call, they name themselves "Zoom" so that when they click the button to ask you to share your screen, the prompt looks like it's coming from the app itself. Once they've got control of your computer this way, they start grabbing your crypto as quickly as they can.
The Bottom Line: If you're in a video call with someone and they take control of your computer, you can just quit Zoom. Be wary of anyone requesting to control your computer in a video call.
How Bad Is It When Foreign Hackers Can Turn Off the Power?
A Chinese diplomat acknowledged China's role in the hack of US critical infrastructure systems dubbed Volt Typhoon. The Volt Typhoon hacking campaign targeted utilities like water and power in the USA. Their intent has been widely interpreted as preparing capabilities to do things like turn off the water or power, to be used in case of some hypothetical future conflict, likely over Taiwan.
The Bottom Line: In general, hackers are only able to disrupt the computers of a network temporarily, and people are more resilient than computers. Even if hackers were able to disable your power grid, it would very likely not last much longer than a bad lightning storm. Of course, we don't want people doing that, so we should take steps to prevent it. One thing you can do to help prevent these kinds of hacks is update your home Wi-Fi router's firmware. Volt Typhoon and others like to compromise home Wi-Fi routers to use as proxies to help hide their efforts.
Whistleblower at NLRB Raises Concerns About Alleged Compromise by DOGE Employees
According to an official whistleblower disclosure first reported by NPR, employees at the Department of Government Efficiency (DOGE) allegedly used privileged access to the networks at the National Labor Relations Board (NLRB) to send large quantities of data off-site. They also allegedly disabled monitoring tools and deleted the logs of their activity, steps typical of adversarial hackers who have achieved access and need to cover their tracks. Brian Krebs has a neat and tidy rundown on the factual details of the case so far.
The Bottom Line: The data hosted by the NLRB can be sensitive, related to union organizing efforts and ongoing lawsuits. If you or your union has shared sensitive data with the NLRB, then consider taking steps to identify what has been shared and to mitigate any potential risks.
Two Years of Data Protection for 77% Off
A VPN service is a crucial part of your online security toolkit and if you don't have one, now is the time to get one. Even smart devices can be a risk to your home network, and a VPN can protect you from hackers. Sign up for NordVPN and get 77% off in an exclusive iPhone Life deal!
Database of All Cybersecurity Vulnerabilities Loses Funding
Every now and then, Apple releases a patch that fixes a few security vulnerabilities in its software. Those problems are discovered by independent researchers, security engineers at different companies, and sometimes just freelance bug hunters. Apple often pays a bounty to researchers who catch those vulnerabilities. With so many different organizations searching for vulnerabilities, it can be difficult to coordinate and standardize the efforts. Imagine trying to publish books in a world without any dictionaries. That's where the Common Vulnerabilities and Exposures (CVE) program comes in. The CVE database, which is administered by a nonprofit called MITRE, analyzes every bug report, writes up a quick description, assigns it a name and severity score, and archives it. It's like a dictionary for cybersecurity vulnerabilities. MITRE's main source of funding has historically been the US government, but now that customer has declined to continue the work contract. For the moment, the CVE database is being maintained by volunteers. Read more at KrebsOnSecurity.
The Bottom Line: The security of our devices depends on the international collaboration of countless security professionals and hobbyists.
Schools Fight Off Hordes of Fake Students
Higher education is facing a massive influx of a new kind of scam, where scammers create false identities using genAI tools, then use those false identities to try to apply for financial aid. The result is that admissions officers at universities and teachers in online courses must spend time identifying which students are real and which ones are personas created by scammers. Read more at Voice of San Diego.
The Bottom Line: When trying to determine if someone is a real person or the persona of a scammer, the best tool is to insist on a video call. While it is possible to use genAI to create video, doing so in real time is quite difficult. It's best to always insist on a video call with new contacts.
US Immigration and Customs Enforcement Builds Compound Database to Enable Tracking
404 media reports that US Immigration and Customs Enforcement (ICE) has a new unified database combining information from multiple law enforcement and non-law enforcement agencies. The database is part of a new application capable of laying out records on a map updated in real time. It also allows the agency to designate targets for arrest, dispatch teams to make arrests, and record the reports made by those teams. This software already contains records gathered from the Social Security Administration; U.S. Citizen and Immigration Services; Federal Bureau of Investigation; and the Bureau of Alcohol, Tobacco, and Firearms, but plans to soon also include information from Health and Human Services, Housing and Urban Development, Department of Labor, and more.
The Bottom Line: There are many small steps you can take to prevent your privacy being infringed by apps, services, and advertisers, but if your own government wants to track you, the only thing preventing them from doing that is that separate agencies do not normally talk to each other and trade information without a criminal investigation. Combining databases like this makes tracking much easier, and there is no way to opt out.
Defense Secretary Shares Attack Details in a Second Signal Chat
A few weeks back, we reported that US Secretary of Defense Pete Hegseth had shared details of an impending military operation using the Signal app, in a group chat created by Mike Waltz, who had accidentally invited an editor at the Atlantic to the chat. Now, it appears the Defense Secretary had allegedly also shared information about attack plans in a second Signal group chat, which included his wife, brother, and personal lawyer. Reuters has more details on the story.
The Bottom Line: This second chat makes it fairly clear that the improper use of Signal was not a one-off, but part of a pattern or strategy. The Signal app allows you to set your messages to be automatically deleted after a delay, which is a great feature for private communications.
Take Better Photos, Keep Better Memories
Is your creativity limited by your technical skills when it comes to your iPhone camera? Our friends at iPhone Photography School want you to take pictures that not only show what a scene looks like, but also captures how that moment feels. Sign up for the Capture It All course to take pictures you didn't know were possible.
Social App Discord Wants to Scan Users' Faces
Popular social app, Discord, has begun asking users in the UK and Australia to verify their ages with either a facial scan or their ID. These two countries recently passed laws requiring age verification from platforms like Discord, where one could encounter sensitive content. While age verification is not a new concept, handing over a scan of your face or ID to a private company is not the most secure way of going about it. After all, if Discord were to suffer a data breach, your ID or facial scan could end up in the wrong hands.
The Bottom Line: If you are a Discord user in the UK or Australia, we don't recommend complying with this age verification process. You won't be able to view sensitive content, but other than that, the app should work the same as it always does.
CISA to Layoff One-Third of Its Workforce
Axios is reporting that the Cybersecurity and Infrastructure Security Agency (CISA) could be letting go of a third of its staff. As its name implies, the CISA is responsible for the US's cybersecurity and protects government infrastructure from hackers. The agency is also reportedly intending to cut many of its contractors who are responsible for hunting down vulnerabilities within government networks. Layoffs at this agency could have serious consequences for our nation's cybersecurity infrastructure.
FTC Report on Text Message Scams Says $470 Million Lost in 2024
Remember those unpaid toll scam texts we told you about? How about the missing USPS package texts? Turns out, enough people have fallen for those and a few other text scams to result in $470 million lost last year.
The Bottom Line: If you receive texts about unpaid tolls, USPS packages, job offers that seem too good to be true, or fraud alert texts, never interact with them. If you think they could be real, instead, reach out to the company or person you think the text is coming from using a phone number or website you know is legitimate. Otherwise, use the Report Junk button at the bottom of a text.
Chrome Extension Sold, Goes Malicious
A Google Chrome extension called "Browser Boost - Extra Tools For Chrome" was once used as a way to enhance your web browsing experience. However, at some point in the last few months, the creator of the extension appears to have sold it, and the new owner has modified it, turning it malicious.
The Bottom Line: This is a good reminder of one way that browser extensions can be dangerous. Even if you trust an extension today, there's no telling how the code could be modified tomorrow, and even if the extension is removed from the Chrome Web Store, it will still be installed on your device.
Comentarios
Publicar un comentario