Apple fixes USB Restricted Mode zero-day. Massive brute force attack from 2.8 million IP's. Manipulating AI long-term memory.

Apple has released emergency security updates to patch a zero-day vulnerability that the company says was exploited in targeted and sophisticated attacks. The attack apparently disables USB Restricted Mode, which is a feature where USB data connections are blocked when the device has been locked for over an hour.

That's an impressive scale to perform brute force password attacks on. The Shadowserver Foundation says that it's been going on since last month.

It's possible to publish an AMI with the same AMI ID as another, just with a different owner ID, but not everyone checks the owner ID. Especially scripts or Terraform code, set to "most_recent=true", will pick the most recently published AMI with the right AMI ID. It might be good to check your infrastructure to see if you use the right AMI's, and to make use of the new "Allowed AMI's" allowlist feature.

Indirect prompting is when, for example, the article you're asking the AI to summarize contains a malicious instruction that triggers it to do something you didn't want. This can lead to direct, or delayed actions, like sending an email with sensitive content to an attacker. Or, apparantly, manipulate the "long-term memory" of the AI to set some context that it will use in all subsequent conversations, leading to all sorts of malicious control over what you do or read in the future. Fascinating stuff.

When Bruce Schneier talks, one tends to listen. He writes about how the recent DOGE actions are extremely concerning from an infosec perspective.

I don't think most developers realise how valuable 1Password can be. It doesn't just hold passwords, it also hold your SSH keys, signs your Git commits, injects token and other secrets in CLI scripts when you want, and much more. (Sponsored)