Advanced iPhone backdoor campaign discovered. Europol warns 443 shops of skimming. Github going strong on its 2FA game.

Researchers from Kaspersky revealed details of an incredibly sophisticated backdooring campaign targeting iPhones, iPads and Mac's. It uses a set of hardware functions that aren't documented anywhere, leaving researchers to guess as to how it was created.

Attribution seems difficult, because it's very different from other known campaigns, although the Russian CERT attributes the attacks to the NSA, with the FSB alleging that Apple themselves helped out, although Apple denies that.

It used a total of four zero-days, in a very impressive exploit chain, shown and described in the article. All four vulnerabilities have now been patched.

Coordinated by Europol and spearheaded by Greece, a two-month international operation involving law enforcement from 17 countries and private entities such as Group-IB and Sansec identified skimmer infections on 443 websites. They were notified with the help of national CSIRT teams. Impressive campaign.

The Chrome Safety Check will also alert you when using extensions that are dangerous (as in, having been taken down from the Web Store), automatically revoke permissions such as access to location or microphone for sites that you haven't visited in a long while, and flag sites that produce excessive notifications.

If you think doing a quick pentest every few quarters isn’t enough, you are correct. GlitchSecure combines continuous vulnerability assessments with real-time pentesting - all verified by highly skilled (and wonderful) humans in a user friendly platform. (Sponsored)

If you contribute code on Github, you will have to enable 2FA by January 19th or be limited in your access until you do. It doesn't count for business or enterprise accounts though, unfortunately. Not yet anyway. After the 19th you won't be able to disable 2fa, only replace it with other methods. They offer pretty much any method available: security keys, passkeys, their mobile app, authenticator apps (TOTP), and SMS text messages. I'm all for this, way to go Github.

Lapsus member Arion Kurtaj has been sentenced indefinitely in a 'secure hospital' by a UK judge, due to his autism. Another Lapsus member, aged 17, was also found guilty. It's easy to be dismissive over their age, but it is impressive, in a bad way, to see their list of corporate victims: Rockstar Games, Okta, Uber, Revolut, Microsoft, Samsung, NVIDIA, and many others.

Isovalent is the company behind much of the work on eBPF and Cilium, two technologies that have made quite an impact in the worlds of EDR and containers. This, combined with the recent acquisition of Splunk, makes it seem that Cisco is trying to up its game significantly. Let's see if it works out.

Securing GraphQL shouldn’t be this hard. Learn from Staff Security Engineer at Thinkific, why Escape stands out as the sole security scanner for GraphQL that is both engine-aware and developer-friendly. (Sponsored)

You probably use SSH to push code to GitHub, access servers, and more. So why is it such a pain to set up new keys? Well, fret no longer. You can now easily generate, store, and use SSH Keys directly from 1Password 8 and the built-in SSH agent. Securely sync your keys across devices, authenticate SSH workflows, and even sign code commits. (Sponsored)