TryBestTech’s Post

Google Warns: Android Zero-Day Flaws in Pixel Phones Exploited by Forensic Companies. The high-severity zero-day vulnerabilities are as follows - CVE-2024-29745 - An information disclosure flaw in the bootloader component CVE-2024-29748 - A privilege escalation flaw in the firmware component GrapheneOS noted that CVE-2024-29748 could be weaponized by local attackers to interrupt a factory reset triggered via the device admin API.

This threat is all about data sharing between apps in Android - the bottom line is that the Android mechanism for enabling data sharing does not check shared data for malicious content. So, if you have an app on your device that shares files with other apps, you could be vulnerable. You have to trust in the app developers not to be sloppy software engineers, as data validation is simply good development practice. Buyer beware...... Not a lot that, as a user, you can do about this, other than the obvious a) only use apps from trusted sources and b) keep them up to date. Or use Apple 😀

Apple's upcoming iOS 17.4 update adds a new security feature to iMessage that's so futuristic that the attack strategy it's protecting against hasn't been developed yet. Once you download the next version of iOS, your iMessage chats will have an elevated level of encryption that Apple says can't be broken into with quantum computers. PQ3 is Apple's first version of what the security industry calls post-quantum cryptography, which are algorithms designed for a future where quantum computing is commonplace. Privacy-focused chat app Signal announced last year that it would upgrade its Signal Protocol with a version of PQC, and Apple says its PQ3 solution is more advanced, as its protocol can restore security even if the cryptographic key (the security handshake authenticating each device in a conversation) is compromised by generating keys for each message.

Kim Zetter has a pretty good write up on the recently announced defect in the Apple M1 and M2 processors. Although this definitely a serious defect in the M-series CPU design, it doesn't appear to be easily exploitable, in the way that other famous hardware defects, consider Meltdown and Spectre from several years ago, have been. So far as I can tell, this M-Series defect can only be exploited from within the process performing the encryption. In some cases even that might not be sufficient — can you make a browser plugin which will discover the TLS encryption key? I don't *think* so, but I might be wrong. In order to exploit this defect, so far as I can tell, you would need to trick the user into running a Trojan app, such as get them to switch to using your Evil Crypto Wallet, at which point the evil app could discover the encryption key they use on their wallet and then exfiltrate (intentionally leak) that key. So, I guess that's the *good* news. The bad news is that's it's extraordinarily difficult to protect against that type of Trojan attack. The crypto libraries will be updated fairly soon with patches intended to protect against this CPU defect, but a Trojan app could still be constructed using older versions of the library, or by disabling the patch. As pointed out by Godin (ArsTechnica), Zetter (below) and many other headlines, there's no way to patch this in the hardware. (Some CPU defects, counterintuitively, *can* be patched via a firmware update, but this one apparently can't be.) This might have the side effect of accelerating Apple's plans to migrate various hardware products to M3 and higher versions of the M-Series processor. Consider the MacBook Air, Mac Mini, and Apple Vision Pro, which use M2 processors, to be candidates for a hardware refresh to M3, rather than a faster M2. https://lnkd.in/gNW38dCy

ICYMI: Apple launching quantum computer protection for iMessage with iOS 17.4, here’s what that means

#BYOD #nomore #IRS #congress #bill #malware #3rdparty #iOS #Android #Arm #Corellium This is part of the problem with BYOD and I read how several agencies are to move forward with BYOD. But you are opening more problems than your network needs with the number of hackers, ransomware, thieves, criminals we have attacking everyone. I'd like to hear your thoughts. And yes, I am interested because, Corellium can identify the software applications on iOS and Android with the Arm processer. We can help bring cybersecurity to the applications on a mobile or IoT device. https://lnkd.in/esF2xNPE

Last week, a group of researchers have published a new attack targeting #Apple CPU (Apple Chips m1, m2 and m3) through a hardware feature: data memory-dependent prefetchers (DMPs). This attack could potentially be used against Crypto Wallets on Apple MAC to steal seed phrase and private keys. - From a high-level point of view, DMPs is a hardware optimization presents in Apple CPU allowing to an attacker to retrieve a cryptographic secret (e.g private key) by "observing" the time taken for the CPU/application to perform an operation. This type of attack is called a timing attack, a subcategory of side channel attack, which uses leaked information from a physical system. - More precisely, DMPs mixes data and memory addresses at the hardware level. Thus, DMP generates memory-dependent secrets and therefore can be used for time-based attacks. - If you take for example a password for a website: the time to process a correct character present in the password has to be the same as the time to process a wrong character to avoid any information leak about the password. - This paradigm does not really suit with hardware optimization, here DMPs, where the goal is precisely to save time in processing operations.... - For the moment, the only fix available concerns the Apple M3 chips and it consists for developers of cryptographic software (e.g. crypto wallet) to disable this specific optimization in their software. - From my point of view, I have the impression that this type of attack is not easy to exploit, but could be exploited in the future, e.g. by state hackers sponsored, if nothing is patched. Feel free to post a comment if you have remarks or questions :) References: https://gofetch.fail/ https://lnkd.in/eqKQwE6Z https://lnkd.in/eiXJHUq8 #GoFetch #wallet #cryptography

Apple launching quantum computer protection for iMessage with iOS 17.4, here’s what that means

Secure boot is complex and has interdependencies with processes such as secure OTA updating. Get advice from experts in device lifecycle management such as Northern.tech

🔑 Exciting News from Google! 🔑 Google continues to innovate in the realm of digital security with their recent announcement of "Passkey"! It's always inspiring to see tech giants taking bold steps to enhance user security and streamline our digital experiences. Google has been working with the FIDO Alliance for years, alongside Apple and Microsoft, to bring passkeys to the world. Passkeys are an easier and more secure alternative to passwords. They let you sign in with just your fingerprint, face scan, or screen lock. With this amazing feature it is nearly impossible for an attacker to access your account remotely. Eager to see the impacts and applications of this new feature. #Google #Passkey #DigitalSecurity #Innovation