Security Friday 
|
|
Week of 11/13/26
|
|
|
Even tech billionaires aren't immune to romance scams
The internet is abuzz after the famous CEO of tech company Nvidia was outed for cheating on his wife of 40 years. But not just cheating on her, but cheating on her with a potential spy for the Chinese government. It's a crazy story straight out of an espionage film and just goes to show how no one is immune to being scammed. We have the full breakdown of what happened down below.
If you've experienced any scams or come across any interesting hacking cases that we didn't cover in this week's edition of Security Friday, be sure to let us know by emailing security@iphonelife.com or by replying to this email.
Stay safe out there!
|
|
|
|
Rhett Intriago,
Feature Writer at iPhone Life
|
|
|
|
|
|
Protect Yourself from Spam, Scams, Identity Theft & More
While there's no silver bullet for digital privacy, one way to reduce your personal risk is to remove yourself from online lists. Data brokers are constantly buying and selling your information, landing your phone number and more in the hands of spammers, scammers, and more.
Incogni removes your personal data from these sites automatically. You don't have to track anything down. Incogni contacts the data brokers for you and forces them to delete your records. Use code IPHONELIFE at checkout to save 55%.
|
|
|
|
|
|
|
In This Newsletter
|
|
|
- 🗒️✅ Your Security Checklist
- 🏆🎖️ Test Your Security Skills
- 📰 Your Weekly Security Update
- 🤨 This Should Be on Your Radar 📡
- 🙈 Security Fail of the Week 👎
- 🍎📱 Security Updates from Apple 🍎
|
|
|
🗒️✅ Your Security Checklist
|
|
|
If you take nothing else from this newsletter, just do these three things to protect yourself:
- Do not interact with virus warnings. Many scam sites will display warnings about your iPhone being infected with a virus and urge you to install an app to remove it. When this happens, all you really need to do is close the window.
- Don't ignore AirTag warnings. Your iPhone can detect if an AirTag is being used to track your location and will warn you about it. If you ever see one of these warnings, you can tap the notification to track down the AirTag.
- Consider hiding text message previews. If you don't want your text messages popping up on your Lock Screen for all to see in public, you can hide message previews.
|
|
|
Incogni removes your data from lists to help you reclaim your data privacy. Get 55% off with discount code IPHONELIFE and let Incogni work to get you off the lists that data brokers buy and sell every day. There's no silver bullet for stopping spam, but keeping your information out of the wrong hands is the place to start.
|
|
|
|
|
|
|
🏆🎖️ Test Your Security Skills
|
|
|
What should you do in the following scenario?
You receive a text from an unknown number saying, "Hey, Jules. Are you still available to meet for dinner?" If your name is not "Jules," "Julie," or any other variation of that name, and you know you never made any dinner plans with anyone, what should you do? 🤔
- Delete the text.
- Respond to let the person know they have the wrong number.
- Block the number.
- Delete the text and report it as spam.
Scroll to the bottom to see how you did!
|
|
|
Even Tech CEOs Are Not Immune to Romance Scams
|
|
|
For decades, Nvidia has been one of the world's largest producers of graphics processing units (GPUs). The increased demand for GPUs for use in AI data centers over the last few years has made Nvidia very profitable and has also made it a major target for espionage, as the company's CEO, Jensen Huang, has admitted to an affair with a woman, Alice Huang (no relation), who is suspected of being a spy for the Chinese Ministry of State Security.
Ms. Huang is reportedly an executive at Megaspeed, a data center firm based out of Singapore. It is believed that through her relationship with Jensen Huang, she was able to purchase hundreds of thousands of Nvidia chips and GPUs for her company, some of which went to data centers based in China. China is aiming to become the leader in AI technology, and Ms. Huang's ability to acquire chips otherwise restricted from being sold in the country gave it the edge it needed to achieve that goal.
Jensen Huang has resigned, and Congress has requested a closed-door briefing with him to discuss his affair, while the FBI is currently investigating the matter. The Chinese government has denied any involvement with Alice Huang.
The Bottom Line: When you boil this situation down to its core, it's really just an extremely sophisticated version of the romance scam. A romance scam involves someone building a relationship with you, gaining your trust, and eventually asking for help, usually in the form of money for medical bills or travel expenses so that they can come see you. Romance scams can go on for months (or, in the case of Mr. Huang, years) while the scammer builds trust with you, making you believe they are your friend or that they've fallen in love with you.
Everyone is susceptible to this type of scam, even billionaire tech CEOs. And you don't have to be a billionaire CEO to be targeted. Romance scammers will go after retirees or whoever they think is the most vulnerable, whether they're wealthy or not.
|
|
|
|
|
🤨 This Should Be on Your Radar 📡
|
|
|
Still Using iOS 18? Time to Update
Last month, we reported on a new spyware infection technique, which The Citizen Lab dubbed AdFection. At the time, we believed the primary targets of AdFection were specific individuals, like politicians, journalists, and activists. Now, mobile security platform iVerify is warning that AdFection is under active exploitation by hackers who are using it to infect iPhones with DarkSword, an iOS-based infostealer malware that is designed to steal passwords, photos, messages, or anything else that might seem valuable. Anyone with iOS devices still on iOS 18.4 through 18.7 is vulnerable. AdFection requires no interaction from the user; all it takes is being served one malicious ad, whether it's in your favorite social media app or while browsing the web. Read the full report at iVerify.
The Bottom Line: DarkSword only affects iPhones running iOS 18.4 to 18.7, so as long as you're running the latest software, you should be safe. If your iPhone cannot update beyond iOS 18, it may be time to upgrade.
FBI Outsourcing Investigative Work to AI
This week, FBI director Kash Patel did a deep dive into how the bureau is using AI to boost efficiency and reduce staff workload. According to Patel, the FBI is using AI to automate transcription and translation work. In one example, the agency used AI to transcribe hundreds of hours of audio from a wiretap in order to accelerate the rescue of a human trafficking victim. Head over to NextGov for Patel's full statement.
The Bottom Line: At first glance, it almost sounds like this is a positive use for AI. It's reducing the FBI's workload and allowing it to move through investigations more quickly. However, we remain skeptical of outsourcing forensic investigative decisions to AI. AI cannot be held responsible for its decisions or its mistakes, and going fast is not the same as being right. Translation software can be a powerful tool, but when the outcome matters, remember to always manually check the results.
|
|
|
The Sonos Beam Ultra fills your room with Dolby Atmos sound that bounces off your walls, keeps dialogue as clear as you want, and lets you hear more at low volumes, all tuned to your room and connected in minutes. Add other Sonos speakers for wireless surround sound or pair it with Sonos headphones and toggle between the two with ease, making it a holiday gift that fits right into any Sonos setup. Shop the Sonos Beam Ultra.
|
|
|
|
|
|
Sleep-Tracking Headbands Might Be Using Your Data for AI
Electroencephalogram (EEG) headbands are popular for tracking sleep and learning from your sleep patterns. These headbands record your brain waves and transform that activity into readable data. As it turns out, many manufacturers (such as Interaxon, the parent company of the popular Muse headband) are using the collected data to train AI. These companies don't make it explicitly clear to the user how their data is being used. Muse's privacy policy was only updated recently to clarify that data from electrical brain activity is being used for AI training. Check out the full story at Tom's Hardware.
The Bottom Line: HIPAA privacy rules only apply to health information you share with your healthcare provider, not information you share with a private company like Muse. Legally, there's nothing stopping these headband companies from collecting and using this data however they please, as long as it's disclosed in their privacy policies. If tracking your sleep is important to you, we recommend using an Apple Watch for privacy. It won't scan your brainwaves like an EEG headband, but it still has its uses.
UK Government Sites Left Vulnerable
Security researcher Chris Nesbitt-Smith has identified a number of vulnerabilities in the code of multiple UK government websites. He found the vulnerabilities using two Claude AI models. For transparency purposes, the UK government publicly posts the source code of its websites online for anyone to access. This is not an abnormal process; for example, Apple makes the source code of Private Cloud Compute publicly available so that independent researchers can verify its privacy and security. However, the side effect of making that data public means vulnerabilities can be found, both by researchers and by cybercriminals using AI. Read more at Wired.
The Bottom Line: AI is a double-edged sword for the cybersecurity sector. It can be used by researchers to expose bugs and vulnerabilities, but it can also be used by bad actors for the same purpose. With cybersecurity firms stretched thin, it's difficult to patch all of these newfound vulnerabilities before hackers can exploit them.
|
|
|
|
With virtual Dolby Atmos surround, crystal-clear dialogue, and easy setup that works with your Sonos ecosystem, the Beam...
|
|
|
|
Mozilla VPN Offering Unlimited Data for Free Until New Year
Earlier this year, Mozilla added a free VPN built into its Firefox web browser. Normally, it includes 50 GB of data that can be used for free, after which you'll need to pay a subscription fee to continue using it. However, starting now through January 31, 2027, Mozilla VPN is getting unlimited data. That means you can change your location and hide your web traffic on public Wi-Fi as much as you want, free of charge, until the New Year. Mozilla's blog post has more details.
The Bottom Line: It's important to keep in mind that Mozilla's free browser VPN does not make you anonymous online, and it only affects your web traffic within Firefox. If you need truly private internet access and need your VPN to work outside of Firefox, we recommend a standalone VPN, like NordVPN or Mullvad.
How Scammers Use Social Media to Tailor Scams to You
Scammers are continuing to find new ways to use AI to their advantage. One such method is to use your social media. By plugging in publicly available social media data, scammers can send out phishing texts or emails custom-tailored to your personal details. In the example provided by Fox News, a scammer-controlled AI could find photos you posted of a recent vacation and generate an email appearing to be from the hotel you stayed at, ensuring you're more likely to open any links in the email.
The Bottom Line: Identifying suspicious emails can be difficult, especially when they're carefully designed to look legitimate. Always be on your guard when it comes to emails, and look for signs of phishing.
|
|
EU Aims to Curtail Infinite Doomscrolling & Other Manipulative Design Techniques
The EU is proposing a new law, called the Digital Fairness Act, to combat apps and websites with anticonsumer practices, like promoting addictive behaviors or the unnecessary difficulties of canceling subscriptions. The Digital Fairness Act is a part of a larger initiative to strengthen EU consumer laws. However, it's nothing more than an outline of what lawmakers hope to achieve; no law has been passed at the moment. Find out more and read the full text of the Digital Fairness Act at the European Commission.
The Bottom Line: While the Digital Fairness Act is only a proposal at this time, it's certainly a step in the right direction. We hope that it can lead to something fruitful that will ultimately improve the internet for everyone.
|
|
|
|
Eney by MacPaw notices what needs your attention, from sorting your Downloads to planning your day, so your Mac does more...
|
|
|
|
|
🙈 Security Fail of the Week 👎
|
|
|
Hackers Flush Out Customer Data from TP Company
Who Gives a Crap is the name of a toilet paper brand that supplies eco-friendly toilet paper made from recycled materials. The company has been hit by a data breach through a third-party marketing provider, exposing customer names, addresses, emails, and phone numbers. Customers from the US, UK, and Australia have all been affected. Unfortunately, Who Gives a Crap will need more than toilet paper to clean up the mess it has found itself in. It has cut all ties with the marketing company where the breach originated. Read the full story in The Register.
The Bottom Line: Despite the company's name, Who Gives a Crap appears to care very much about its customers and is working to amend the damage done by this breach. If you've ever purchased from Who Gives a Crap, your data might be exposed. As always, when it comes to data breaches, we recommend freezing your credit, which can be done online at the three major credit bureaus.
|
|
|
🍎📱 Security Updates from Apple 🍎
|
|
|
- The most recent iOS and iPadOS is 27.2.1
- The most recent macOS is 27.2.1
- The most recent tvOS is 27.2
- The most recent watchOS is 27.2.1
- The most recent visionOS is 27.2.1
Read about the latest updates from Apple.
|
|
|
Security Skills Answer
|
|
|
D. Delete the text and report it as spam is the most correct answer, though blocking the number wouldn't hurt either. This type of text is how many romance scams start. An innocuous wrong-number text opens the door for communication so that the scammer can begin a relationship with you. The relationship can remain platonic but can often grow romantic, and will eventually lead to the scammer asking for monetary favors, often in the form of money for medical bills, legal fees, transportation funds, or any number of excuses.
|
|
|
Mission Statement
|
|
|
There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Rhett Intriago and edited by August Garry and Cullen Thomas.
|
|
|
Next Steps
|
|
|
Want to keep your Wi-Fi connection private? Check out:
|
|
|
|
|
Did we help with your security concerns?
With your feedback, we can improve this security newsletter. Let us know how we did:
|
|
|
|
|
Comentarios
Publicar un comentario