macOS Big Sur security and privacy guide

Apple will soon release macOS Big Sur to the public — and it looks like it will bring a number of important security and privacy enhancements. In this guide, we’ll tell you everything you need to know about the Mac’s new and improved OS!

About the name and number

Ever since 2013, Apple has used California landmarks to name each new version of their flagship OS, and macOS “Big Sur” is no exception. However, there is one major change this time around: the version numbering system has been updated. Instead of following …

New iPads, Apple Watches, and more at the Apple Special Event

Apple held a special event this week to introduce several new devices and features. Here are some of the highlights: 

Apple Watch Series 6

As expected, Apple used the special event to introduce the Apple Watch Series 6. Although a number of cosmetic and design changes were mentioned (including a new (PRODUCT)RED case, seamless watch bands, and more faces than ever before), the Apple Watch Series 6 was presented first and foremost as a next-gen health and wellness device.

The Apple Watch Series 6 has a number of new health features, but perhaps …

Checklist 199: iOS 14 Privacy Features with Nick Leon

With iOS 14 out for less than 24-hours, now is an excellent time to look at some of its privacy improvements. Nick Leon joins us to address them.

Checklist 198: Listener Tracking in Podcasts with Rob Walch

Did you know that some podcasts actually track their listeners? Rob joins us today to talk about how the tracking occurs and about a new tool on the way to fight it.

Is App Notarization broken?

Security researchers have discovered a variant of Shlayer malware — an extremely common macOS threat — that appears to have circumvented Apple’s App Notarization process.

What is geofencing?

Federal judges in the United States are starting to push back against police requests for “geofence warrants”, citing constitutional concerns. In this short article, we’ll introduce you to the issue, tell you what it means for your privacy, and explain how you can limit the ability of the government (and others) to track you.

What is geofencing?

Broadly speaking, geofencing refers to the practice of creating a virtual boundary around a real-world physical area. The technique is often used by marketers and advertisers who want to show more relevant ads or offer …

Checklist 197: Staring at the Cloud with Dominique West

On this Checklist, we talk with cloud security expert Dominique West. The conversation covers career paths in infosec, today’s changing threat landscape, common misconceptions about cloud security, and the importance of community to the industry.

Guide to iOS 14 Privacy Features

Apple will soon release iOS 14 to the public, and it has a number of important privacy enhancements that you should know about. In this guide, we’ll walk you through iOS 14’s privacy features, and give you tips and how-tos to help you make the most of them.

Data Sharing Controls

First up, we’ll take a look at some new features that let you control how (or if) you share your data with apps.

App tracking controls

This one is a real game-changer. Apps track us in a variety of ways, mostly so …

Ransomware attacks by amateur Iranian hackers used “off-the-shelf” malware

Threat researchers are reporting that low-skilled Iranian hackers carried out a number of successful attacks against enterprise targets in June. The incident highlights the growing threat of off-the-shelf malware to businesses and individuals.

In this short article, we’ll tell you what happened, give you some background to the issue, and let you know what you can do to stay safe.

The incident

According to researchers at Singapore-based Group-IB, newbie hackers in Iran managed to penetrate the networks of a number of companies across the globe and infect their systems with Dharma ransomware. The …

Checklist 196 : The Art of Mac Malware: Analysis with Patrick Wardle

Security pro Patrick Wardle is writing a book, and he may just want your help. We’ll cover some Mac malware basics, talk about the book he’s writing, and how the security and Mac communities can help on episode 196 of The Checklist, brought to you by SecureMac.

Checklist 195: Attacks on the 2020 Election with Nick Leon

The 2020 U.S. election is under attack. Who’s doing it? Why? How? And what can we do stop it? SecureMac’s Nick Leon joins us to talk it over.

XCSSET: New Mac malware infects Xcode projects

Security researchers have discovered an interesting new variety of macOS malware that spreads by attacking Xcode projects. It’s called XCSSET, and in this article, we’ll tell you what you need to know about this unusual threat in order to stay safe.

What is XCSSET?

XCSSET is a suite of malicious components that spreads through infected Xcode projects.

Xcode is a tool used by app developers to write software for Apple platforms. An Xcode “project” simply refers to the repository of files, information, and resources that are used to build an app for deployment.

If …

DEF CON Safe Mode Highlights

DEF CON, a major annual event in the world of cybersecurity, was held just last week. This year, the organizers decided to go virtual, calling the event “DEF CON Safe Mode”. 

There were a number of great talks and panels at the conference, and while some of them were quite technical, many also focused on topics likely to be of interest to a wide audience. 

In what follows, we’ll offer some curated highlights from DEF CON Safe Mode that you may want to check out, along with links to the full video …

Checklist 194: YouTube Hijacking Bitcoin Blues with Stephen Warwick

This week, The Checklist takes you inside yet another high-profile Bitcoin scam, this time affecting YouTube. We’ll talk about what happened, and then discuss the technical details of the compromise.

Disinformation in the age of social media: Renée DiResta’s Black Hat 2020...

Black Hat USA is a major event in the world of information security. This year, due to the ongoing pandemic, the conference went virtual — and the organizers offered open access to many of the most important talks and sessions. 

Among these were two timely keynote addresses that deal with issues around election security, one of which was delivered by Renée DiResta. DiResta is the Research Manager at Stanford Internet Observatory, an interdisciplinary program that studies the misuse of information technologies. Her work focuses on the way in which narratives spread …

Election security in a pandemic: Matt Blaze’s Black Hat 2020 keynote

Black Hat USA is one of the biggest events in the world of cybersecurity, bringing the infosec community together once a year for several days of trainings, briefings, and demos. Due to COVID-19, Black Hat 2020 went fully remote, and offered free access to some of the conference’s most important events. 

Matt Blaze gave an extremely relevant keynote entitled “Stress-Testing Democracy: Election Integrity During a Global Pandemic”. Blaze is cryptographer and professor of computer science who holds the McDevitt Chair in Computer Science and Law at Georgetown University. His work focuses …

ThiefQuest malware for macOS is a triple threat

In this piece, we’ll discuss ThiefQuest’s key capabilities, and we’ll also tell you how to protect yourself from an infection.

Checklist WWDC20 Outtake

We’re bringing you a WWDC outtake: an off-the-cuff, practically off-mic discussion of WWDCs past — as well as the roles Apple execs play.

Chris Hadnagy on social engineering

Chris Hadnagy is one of the world’s foremost authorities on social engineering. He has written four books on the topic, including Social Engineering: The Science of Human Hacking and Unmasking the Social Engineer: The Human Element of Security. Hadnagy has been a prominent figure in the security industry for many years, founding the popular Social Engineering Village (SEVillage) at DEF CON, and establishing the Innocent Lives Foundation, a non-profit organization that coordinates the resources of the infosec community to fight online child predators. Hadnagy’s company, Social-Engineer, LLC, helps …

What is key-based 2FA?

Standard 2FA has some important limitations, which is why many security experts believe that key-based 2FA is the wave of the future — especially now that Apple has made changes to make it much more accessible to iPhone and iPad users.