A Digital Apocalypse Just Happened
Our top stories this week:
- PHP ships emergency patches for critical PHP2Shell flaws
- Someone Opened a CashApp In Her Name. She Faces Years in Prison
- The Internet goes on high alert after discovery of 8 compromised TLS certs
- Is Cellebrite sitting on an iPhone radio 0day?
TWIP Live đź”´
Updates from the Team
How the US Spies On Its Own Citizens
How did a law meant to target foreign spies turn into a domestic surveillance system sweeping up millions of ordinary Americans without a warrant? In this video, we trace the full history of government surveillance, from punch cards and Operation CHAOS to Edward Snowden’s revelations and the modern debate over FISA Section 702. Discover how backdoor search loopholes allow the FBI, CIA, and NSA to query your private emails, texts, and digital files without showing probable cause, and what we can do to demand a Fourth Amendment warrant requirement.
Privacy Guides
News Briefs
This week's noteworthy headlines include a Signal bug that allows audio and video calls to stay connected even after hangup, thousands of budget Android phones around the world shipping preloaded with malware, Meta fixing a big that cause their smart glasses to record when not intended, and more.
Jonah Aragon
Sources
PHP ships emergency patches for critical PHP2Shell flaws
This week's most notable part of the digital apocalypse was PHP2Shell, two high-severity vulnerabilities impacting the PHP scripting language, which is used on over 70% of servers. Numerous websites were taken offline temporarily while sysadmins waited for patches to become available, but research suggests that the vulnerabilities began being exploited days before disclosure and experts worry that millions of sites will go unpatched for a variety of reasons, including using end-of-life versions.
Sergiu Gatlan
Someone Opened a CashApp In Her Name. She Faces Years in Prison
Amanda Smith of Pennsylvania is being charged with fraud after someone apparently stole her identity and used it to scam someone on Facebook Marketplace for $1,000 in Arkansas. Unfortunately, she now finds herself in the difficult spot of having to prove her innocence. CashApp would not cooperate at first and give her information about the fake account because she (obviously) could not prove ownership. Once data was handed over in discovery, a lot information still doesn't seem to add up, such as devices, phone networks, and other information.
Joseph Cox
The Internet goes on high alert after discovery of 8 compromised TLS certs
This week's cybersecurity apocalypse began with the discovery that Indian Certificate Authority eMudhra had been issuing TLS certificates (which enable the "S" in "HTTPS" and make the internet safer for things like ecommerce and private communications) with incredibly weak keys: just numbers ranging anywhere from one to three digits in length. Experts are struggling to understand how this happened and warn that this could take years to clean up as the affected certificates impact not just browsers, but also IoT devices, Linux distros, Docker containers, and more.
Dan Goodin
Is Cellebrite sitting on an iPhone radio 0day?
The author of this post reports a leaked Cellebrite marketing material from this year that claims to work on After First Unlock iPhones (11-16), bypassing Stolen Device Protection and working at a range of about 8 meters. The author then proceeds to speculate on why the believe this a Bluetooth vulnerability, and discuss the future of cybersecurity and phone hardening.
Forum Updates
LoSee21
MintChoco