Winter Olympics hit by cyber attack. Government sites compromised to mine crypto. New iOS crashing bug.

The games experienced various issues as a result, from Internet and television services going down to the website being unreachable. They don't want to comment on who did it, although Russia and North Korea are prime candidates. The attacks work through a piece of malware dubbed 'Olympic Destroyer'. Here's an overview of what it does.

Several government sites were compromised with a Coinhive mining script this week. The attack happened through a piece of Javascript they all shared called 'Browsaloud', an accessibility service that converts the website's text to speech.

A new bug was discovered where if you send a certain sequence of characters for an Indian language called Telugu, you crash your phone. Apple will release a fix. For a much deeper dive on why this might happen check out this Hackernews post and comments.

The update fixes 50 vulnerabilities, of which 14 are rated critical. A particularly bad one is a fix for Outlook where just previewing a malicious email can compromise your system.

A researcher points out that there is nothing blocking any app on MacOS from using the builtin screenshot API. It's available to all and doesn't require any permission. Add some phone-home code and OCR and you can sneak out pretty much anything.

Since ad blockers are related to security, I figure it's useful to show clearly what Chrome's built-in ad blocker does, starting February 15th.
In short it blocks obnoxious ads and sites, but is no substitute for the likes of uBlock Origin from a security point of view.

Fantastic overview of various security measures to take and suggested tools to implement them.

Very interesting read on how Lyft tries to work security in the development cycle with a high degree of respect for the engineers' time and responsibilities.

A few issues back we saw a thought provoking article on how to steal credit card information through third-party packages. I can certainly recommend it if you haven't read it yet.
This article is part 2, where the author explores what you can do about it. None of the options are an easy fix, but worth a read for sure.

Real-time phishing, while difficult to pull off, can defeat 2fa protection by proxying the two-factor response to the attacker. These researchers released a tool on Github based on Selenium and Python that communicates between the phishing site and the attacker's session.

Cool little video showing a skimmer sliding a keypad over a payment terminal in an Aldi store. It only takes him about a second.