North Korean hackers are running tailored campaigns using AI-generated video and the ClickFix technique to deliver malware for macOS and Windows to targets in the cryptocurrency sector. [...]

This week on the Lock and Code podcast…

In January, Google settled a lawsuit that pricked up a few ears: It agreed to pay $68 million to a wide array of people who sued the company together, alleging that Google’s voice-activated smart assistant had secretly recorded their conversations, which were then sent to advertisers to target them with promotions.

Google denied any admission of wrongdoing in the settlement agreement, but the fact stands that one of the largest phone makers in the world decided to forego a trial against some potentially explosive surveillance allegations. It’s a decision that the public has already seen in the past, when Apple agreed to pay $95 million last year to settle similar legal claims against its smart assistant, Siri.

Back-to-back, the stories raise a question that just seems to never go away: Are our phones listening to us?

This week, on the Lock and Code podcast with host David Ruiz, we revisit an episode from last year in which we tried to find the answer. In speaking to Electronic Frontier Foundation Staff Technologist Lena Cohen about mobile tracking overall, it becomes clear that, even if our phones aren’t literally listening to our conversations, the devices are stuffed with so many novel forms of surveillance that we need not say something out loud to be predictably targeted with ads for it.

“Companies are collecting so much information about us and in such covert ways that it really feels like they’re listening to us.”

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

---

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

Last week on Malwarebytes Labs:

• Apple Pay phish uses fake support calls to steal payment details
• Open the wrong “PDF” and attackers gain remote access to your PC
• Flock cameras shared license plate data without permission
• Grok continues producing sexualized images after promised fixes
• Firefox is giving users the AI off switch
• An AI plush toy exposed thousands of private chats with children
• AT&T breach data resurfaces with new risks for customers
• Apple’s new iOS setting addresses a hidden layer of location tracking
• [updated] A fake cloud storage alert that ends at Freecash
• How Manifest v3 forced us to rethink Browser Guard, and why that’s a good thing
• Scam-checking just got easier: Malwarebytes is now in ChatGPT
• How fake party invitations are being used to install remote access tools

Stay safe!

Apple is introducing a new privacy feature that lets users limit the precision of location data shared with cellular networks on some iPhone and iPad models. [...]

We identified remote code execution vulnerabilities in open-source AI/ML libraries published by Apple, Salesforce and NVIDIA.

The post Remote Code Execution With Modern AI/ML Formats and Libraries appeared first on Unit 42.

Apple heeft met de iOS 18.2-update in december een groot beveiligingslek verholpen. Het bedrijf laat op zijn eigen website weten dat gebruikers van de Wachtwoorden-app al sinds de lancering van iOS 18 waren blootgesteld aan phishing.

Apple-gebruikers kunnen dankzij het Zoek Mijn-netwerk makkelijk hun apparaten en accessoires vinden, maar die zijn blijkbaar niet de enige. Onderzoekers van de George Mason Universiteit hebben ontdekt dat hackers, ondanks Apple ’s maatregelen, stiekem mee kunnen kijken.

David Fletcher // Recently we were involved in an engagement where we expected to see a large number of Macs in the target environment. As an element of the engagement […]

The post How to Phish for Geniuses appeared first on Black Hills Information Security, Inc..

BBKing // So I’m working the other day, and my wife asks me why the TV is on. I don’t know. I didn’t turn it on. But it’s near my […]

The post AppleTV & nmap -sV appeared first on Black Hills Information Security, Inc..

Lawrence Hoffmann // So, Apple announced a new bug bounty program at BlackHat, and there are some interesting deviations from the norm in their plan to implement and pay out. […]

The post Lawrence’s List 081216 appeared first on Black Hills Information Security, Inc..