Sophos News

Follow this story, It's weird from start to finish https://www.itv.com/news/tyne-tees/2023-01-30/council-admits-being-lax… https://news.sophos.com/en-us/2020/02/18/council-returns-to-using-pen-…

> Also UK had law for years that can land you in prison for not providing decryption keys for data that you supposedly encrypted. It's not actively used, but it's there. It is actively used, it's just most people fold and hand over the data [0][1][2]. [0] https://www.bbc.co.uk/news/uk-england-11479831 [1] https://www.pinsentmasons.com/out-law/news/court-of-appeal-orders-men-… [2] https://news.sophos.com/en-us/2017/09/27/campaigner-who-refused-to-dec…

If you're wondering like I was why he is able to tweet from prison, this article explains that he's dictating tweets via phone to his family, and they are sending back comments to him via mail. [1] [1] https://news.sophos.com/en-us/2018/08/16/silk-road-founder-ross-ulbric…

> he provided helpful advice They use the 'they/them' pronouns. Do you run a large open source project or website that gets security contacts? The vast majority of security reports are poorly written and bogus, with the person either trying to get money or pad their resume with CVE. I think that contributes to developer's wariness of these things, and the "please prove that this is a real security issue" attitude you often see. May I reference: Beg bounties - https://news.sophos.com/en-us/2021/02/08/have-a-domain-name-beg-bounty… The bogus CVE problem - https://lwn.net/Articles/944209/

Telescreen works both ways. That could come in handy if you truly have nothing to hide, or I suppose if what you are hiding must be within His tolerances. Chalmers sent a copy of his timeline to Premier Park Ltd, the company that charged him with the crimes, and the defendant was able to prove his innocence. The charges against him were dropped.[1] the lawyer met with the detective in order to show him screenshots of McCoy’s Google location history, including data recorded by RunKeeper. The maps showed months of bike rides past the burglarized home, NBC News reports.[2] 1: https://www.phonearena.com/news/google-maps-keeps-user-from-jail-and-f… 2: https://news.sophos.com/en-us/2020/03/10/google-data-puts-innocent-man… 3: https://www.youtube.com/watch?v=d-7o9xYp7eE

I don't have a direct source but I found some other posts that suggest many people are unknowingly turning it on. "While this feature is turned off by default, many of Google's services and apps require it to be turned on, so unless you're actively keeping it off, there's a good chance it's enabled for your Google account." https://www.xda-developers.com/google-location-history/ "lots of people seem to have it switched on without even realising" https://news.sophos.com/en-us/2017/10/03/the-google-tracking-feature-y… Also, "Turning off the timeline feature doesn’t remove Google’s access to your location data as long as you use it for navigation and Google searches." https://www.guidingtech.com/how-to-view-and-manage-location-history-in…

We've seen companies do a lot of silly things with SMS. Facebook used 2FA SMS for ads [1]. Companies sometimes use your phone number from SMS 2FA as a single factor for password reset. I think this is debatable. [1] https://news.sophos.com/en-us/2018/10/01/facebook-turn-off-sms-2fa-if-…

You hope they cannot be held liable. That doesn’t mean that you can’t be raided, or have to defend yourself against charges of illicit content being found in a computer you use, or accusations that you’re knowingly supporting crimes. A lot of that is going to depend on the service and how much visibility you have into user activity - a caching storage node is going to be riskier than forwarding encrypted packets, for example. Here’s an example of some privacy activists: https://news.sophos.com/en-us/2016/04/07/couple-hosting-tor-exit-node-… Maybe you’re super ideologically committed to providing a privacy service and willing to take the risk, but you still want to soberly consider those risks and think about the impact if it’s harder to defend yourself than you thought. It’s not a casual decision.

No. It was a policy problem large enough that legislators required it as a condition of selling phones. It was a real problem that kids walking around high-school, or people walking in the street, were carrying something easily stolen and fenced for several hundred dollars. Ride-by theft by bike was a notorious mode. The equivalent would be people walking around with a stack of $50s flapping in their hands. A target like that is called an "attractive nuisance", and the law has a long tradition of discouraging them. https://news.sophos.com/en-us/2015/07/02/smartphone-anti-theft-kill-sw…

Since this article inexplicably doesn't link to the source material https://news.sophos.com/en-us/2023/11/14/active-adversary-for-security…

Some examples: https://threatpost.com/discord-malware-researchers/168096/ https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-… https://thenewstack.io/roblox-and-discord-become-virus-vectors-for-new…

Technical details: https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pd… Pages 30-32 describe the command and control server update mechanism using blockchain.

Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply-october-2… I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

Yes, embedding a Windows app is essentially pointless for mobile users, but there are many other delivery vectors available from QR codes. There are some interesting approaches listed at https://news.sophos.com/en-us/2019/10/17/beware-the-square-how-to-spot…

This is blogspam of https://news.sophos.com/en-us/2019/09/25/fleeceware-apps-overcharge-us… The only thing this user does is submit articles from secalerts.co, and almost all of them are blogspam.

Isn't that how most ransomware spreads? Here's a detailed view on Angler exploit kit which spreads through ad networks[1]. What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user [1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-the-angler-e… [2]: https://firejail.wordpress.com/

It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below). The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have. SOURCES: - https://www.mandiant.com/resources/blog/supply-chain-node-js - https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-check… - https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems - https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-packa… - https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-c… - https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-re…

It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox. - Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobi… - HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-r… - xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-andr… You are also underestimating the amount of damage malware can cause even within the sandbox. - The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/15689… - The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gi… Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on…