A Trojan SDK snuck past Google Play protections to infest 101 Android applications, bent on exfiltrating infected device data. Read More
Related Posts
![Researchers Unveild Apple’s Shortcuts Vulnerability](https://cybersecuritynews.com/wp-content/uploads/2024/02/image-7-1024x89.png)
Researchers Unveild Apple’s Shortcuts Vulnerability
Researchers Unveild Apple’s Shortcuts Vulnerability
[[{“value”:”
Researchers uncovered the vulnerability in Apple’s Shortcuts application, which could leave users’ privacy at risk. This vulnerability highlights the importance of maintaining constant and rigorous security measures to protect sensitive data.
The vulnerability, CVE-2024-23204, has raised concerns due to the widespread use of Shortcuts for automating tasks across macOS and iOS devices.
Document
Live Account Takeover Attack Simulation
How do Hackers Bypass 2FA?
Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks
.
The Nature of CVE-2024-23204
Shortcuts, a powerful automation tool by Apple, allows users to create personalized workflows to streamline tasks and enhance productivity.
These shortcuts can be distributed through various channels, including Apple’s gallery, where users can discover and share automation workflows.
The ‘Expand URL‘ function was the pivotal element that allowed the shortcut to bypass TC
However, CVE-2024-23204 exposes a critical flaw in this sharing mechanism, potentially allowing malicious shortcuts to exploit user data without their knowledge.
The vulnerability has a CVSS score 7.5, indicating a high severity level. It primarily concerns how Shortcuts handles permissions, allowing a shortcut to use sensitive data with specific actions without prompting the user.
Bitdefender said that this flaw could lead to the accidental dissemination of malicious shortcuts through diverse sharing platforms, posing a significant risk to user privacy.
This is what the attack looks like on the user’s end after they install the malicious shortcut:
It was discovered that by exploiting CVE-2024-23204, it was possible to create a shortcut file that could effectively circumvent the TCC security system.
This vulnerability could potentially allow an attacker to gain unauthorized access to sensitive information or perform malicious actions on the affected system.
The discovery of CVE-2024-23204 underscores the importance of scrutinizing shared shortcuts, especially those obtained from unverified sources.
Users are strongly advised to exercise caution when importing shortcuts and stay updated with the latest security patches Apple provides.
Apple has addressed the issue in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3, and iPadOS 17.3 with improved permissions checks, mitigating the risk posed by this vulnerability. Users must update their devices to these versions to safeguard against potential exploits.
The recent vulnerability incident has brought to light the potential risks associated with sharing and disseminating shortcuts within the Shortcuts app.
Although the app is designed to simplify the process of performing automated tasks, it also creates opportunities for security breaches.
In response to the discovery, the security community has emphasized adopting best practices for sharing and importing shortcuts. Users are advised to only download shortcuts from trusted sources and to be wary of shortcuts that request unnecessary permissions.
Apple Advisory:
The disclosure of CVE-2024-23204 has significant implications for the Apple ecosystem, emphasizing the urgency of implementing advanced security measures to counter evolving cyber threats.
As Apple continues to patch vulnerabilities and enhance the security of its devices, users must remain vigilant, ensuring their digital safety through cautious sharing and importing of shortcuts.
For more detailed information on CVE-2024-23204 and recommended mitigation measures, users and developers are encouraged to visit the official Bitdefender blog and Apple’s support pages.
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
The post Researchers Unveild Apple’s Shortcuts Vulnerability appeared first on Cyber Security News.
“}]] Read More
Cyber Security News
How to protect yourself from online harassment
How to protect yourself from online harassment
[[{“value”:”
It takes a little to receive a lot of online hate today, from simply working as a school administrator to playing a role in a popular movie or video game.
But these moments of personal crisis have few, immediate solutions, as the current proposals to curb and stem online harassment zero in on the systemic—such as changes in data privacy laws to limit the personal information that can be weaponized online or calls for major social media platforms to better moderate hateful content and its spread.
Such structural shifts can take years (if they take place at all), which can leave today’s victims feeling helpless.
There are, however, a few steps that everyday people can take, starting now, to better protect themselves against online hate and harassment campaigns. And thankfully, none of them involve “just getting off the internet,” a suggestion that, according to Leigh Honeywell, is both ineffective and unwanted.
“The [idea that the] answer to being bullied is that you shouldn’t be able to participate in public life—I don’t think that’s okay,” said Honeywell, CEO and co-founder of the digital safety consultancy Tall Poppy.
Speaking to me on the Lock and Code podcast last month, Honeywell explained that Tall Poppy’s defense strategies to online harassment incorporate best practices from Honeywell’s prior industry—cybersecurity.
Here are a few steps that people can proactively take to limit online harassment before it happens.
Get good at Googling yourself
One of the first steps in protecting yourself from online harassment is finding out what information about you is already available online. This is because, as Honeywell said, much of that information can be weaponized for abuse.
Picture an angry diner posting a chef’s address on Yelp alongside a poor review, or a complete stranger sending in a fake bomb threat to a school address, or a real-life bully scraping the internet for embarrassing photos of someone they want to harass.
All this information could be available online, and the best way to know if it exists is to do the searching yourself.
As for where to start?
“First name, last name, city name, or other characteristics about yourself,” Honeywell said, listing what, specifically, to search online.
It’s important to understand that the online search itself may not bring immediate results, but it will likely reveal active online profiles on platforms like LinkedIn, X (formerly Twitter), Facebook, and Instagram. If those profiles are public, an angry individual could scrape relevant information and use it to their advantage. Even a LinkedIn profile could be weaponized by someone who calls in fake complaints to a person’s employer, trying to have them fired from their position.
In combing through the data that you can find about yourself online, Honeywell said people should focus on what someone else could do with that data.
“If an adversary was trying to find out information about me, what would they find?” Honeywell said. “If they had that information, what would they do with it?”
Take down what you can
You’ve found what an adversary might use against you online. Now it’s time to take it down.
Admittedly, this can be difficult in the United States, as Americans are not protected by a national data privacy law that gives them the right to request their data be deleted from certain websites, platforms, and data brokers.
Where Americans could find some help, however, is from online resources and services that streamline the data removal process that is enshrined in some state laws. These tools, like the iOS app Permission Slip, released by Consumer Reports in 2022, show users what types of information companies are collecting about them, and give user the opportunity to request that such data be deleted.
Separately, Google released on online tool in 2023 where users can request that certain search results that contain their personal information be removed. You can learn more about the tool, called “Results about you,” here.
When all else fails, Honeywell said that people shouldn’t be afraid to escalate the situation to their state’s regulators. That could include filing an official complaint with a State Attorney General, or with the Consumer Financial Protection Bureau, or the Federal Trade Commission.
“It sounds like the big guns,” Honeywell said, “but I think it’s important that, as individuals, we do what we can to hold the companies that are creating this mess accountable.”
Lock down your accounts
If an adversary can’t find your information through an online search, they may try to steal that information by hacking into your accounts, Honeywell said.
“If I’m mad at David, I’m going to hack into David’s email and share personal information,” Honeywell said. “That’s a fairly standard way that we see some of the worst online harassment attacks escalate.”
While hackers may have plenty of novel tools at their disposal, the best defenses you can implement today are the use of unique passwords and multifactor authentication.
Let’s first talk about unique passwords.
Each and every single one of your online accounts—from your email, to your social media profiles, to your online banking—should have a strong, unique password. And because you likely have dozens upon dozens of online accounts to manage, you should keep track of all those passwords with a devoted password manager.
Using unique passwords is one of the best defenses to company data breaches that expose user login credentials. Once those credentials are available on the dark web, hackers will buy those credentials so they can attempt to use them to gain access to other online accounts. You can prevent those efforts going forward by refusing to repeat passwords across any of your online accounts.
Now, start using multifactor authentication, if you’re not already.
Multifactor authentication is offered by most major companies and services today, from your bank, to your email, to your medical provider. By using multifactor authentication, also called MFA or 2FA, you will be required to “authenticate” yourself with more than just your password. This means that when you enter your username and password onto a site or app, you will also be prompted with entering a separate code that is, in many cases, sent to your phone via text or an app.
MFA is one of the strongest protections to password abuse, ensuring that, even if a hacker has your username and password, they still can’t access your account because they will not have the additional authentication that is required to complete a login.
In the world of cybersecurity, these two defense practices are among the gold standard in stopping cyberattacks. In the world of online harassment, they’re much the same—they work to prevent the abuse of your online accounts.
Here to help
Online harassment is an isolating experience, but protecting yourself against it can be quite the opposite. Honeywell suggested that, for those who feel overwhelmed or who do not know where to start, they can find a friend to help.
“Buddy up,” Honeywell said. “If you’ve got a friend who’s good at Googling, work on each other’s profile, identify what information is out there about you.”
Honeywell also recommended going through data takedown requests together, as the processes can be “extremely tedious” and some of the services that promise to remove your information from the internet are really only trying to sell you a service.
If you’re still wondering what information about you is online and you aren’t comfortable with your way around Google, Malwarebytes has a new, free tool that reveals what information of yours is available on the dark web and across the internet at large. The Digital Footprint Portal, released in April, provides free, unlimited scans for everyone, and it can serve as a strong first step in understanding what information of yours needs to be locked down.
To learn what information about you has been exposed online, use our free scanner below.
“}]] Read More
Malwarebytes
![Ukraine at D+561: Ukraine’s advance continues.](https://thecyberwire.com/images/social-media/articles/pro/cw-pro-image-146.jpg?#)
Ukraine at D+561: Ukraine’s advance continues.
Ukraine at D+561: Ukraine’s advance continues.
Ukraine’s incremental advances continue in the south. Both sides exchange drone strikes, and cyber operations remain a continuing threat to both Russia and Ukraine. Read More
The CyberWire