2025-02-11

Kaspersky discloses iPhone hardware feature vital in Operation Triangulation case

Kaspersky's research team uncovered a critical undocumented hardware feature in Apple iPhones that was exploited in Operation Triangulation, enabling attackers to bypass hardware-based memory protection. The vulnerability, now patched as CVE-2023-38606, was instrumental in a sophisticated attack chain that could give attackers complete control over targeted iOS devices.

Original archive.is archive.ph web.archive.org

Log in to get one-click access to archived versions of this article.

Related articles

Apple's Software Quality Crisis: When Premium Hardware Meets Subpar Software

Recent experiences with iPad Air 11" M2 reveal significant performance issues, including lag and overheating, particularly when using Apple's native applications like Notes and Freeform. Multiple software updates and hardware replacements have failed to resolve these problems, suggesting a broader decline in Apple's software quality that affects the premium user experience.

Banish bots from your Waiting Room and improve wait times for real users

Cloudflare introduces two major Waiting Room enhancements: Turnstile integration to detect and manage bot traffic through an Infinite Queue system, and Session Revocation for optimizing user throughput. These features work together to reduce wait times, protect against automated threats, and ensure fairer access during high-demand events while maintaining a seamless user experience.

Speedrunners = vulnerability researchers

Video game speedrunners unknowingly develop advanced cybersecurity skills through glitch hunting, using professional tools like IDA Pro and Ghidra for reverse engineering. These enthusiasts create sophisticated exploits and technical documentation comparable to professional vulnerability researchers, yet often don't realize their skills could translate into cybersecurity careers.

Xcode constantly phones home

An investigation reveals how Xcode's unnecessary connections to Apple's servers can significantly slow down build times, particularly during the 'Gather provisioning inputs' phase. The post details how blocking specific connections through Little Snitch can improve build performance and reduce unwanted analytics collection by Xcode.

Roger Sollenberger on X: "NEW: A DOGE staffer appears to be posting DOGE work on his public GitHub, as of this week. The staffer, Jordan Wick, also created a repository for a Twitter DM-downloading tool just 3 days ago. He posted work on geospatial data in Jan—undersea cables, ports & “critical minerals.” https://t.co/vtL7PZj6fJ" / X

A Department of Energy (DOGE) employee Jordan Wick has been publicly sharing sensitive work-related code on GitHub, including a Twitter DM downloader and geospatial data analysis tools for undersea cables and critical minerals.

Github scam investigation: Thousands of "mods" and "cracks" stealing your data

A widespread scam operation on GitHub involves thousands of repositories distributing malware disguised as game mods and cracked software. The malware, known as Redox stealer, collects sensitive data including passwords, crypto wallets, and gaming accounts from victims' computers, then sends it to Discord servers for exploitation.

IBM Completes Acquisition of HashiCorp, Creates Comprehensive, End-to-End Hybrid Cloud Platform

IBM has completed its $6.4 billion acquisition of HashiCorp, integrating advanced cloud infrastructure automation and security capabilities into its portfolio. The merger aims to help enterprises manage hybrid cloud environments more efficiently, with HashiCorp's Terraform and Vault products now available through IBM's automation software lineup. The acquisition strengthens IBM's position in multiple growth areas including Red Hat, watsonx, and IT automation.

nRootTag - Tracking You from a Thousand Miles Away!

Find My offline finding enables AirTags to be located through a network of Apple devices when separated from their paired device. The system uses public/private key encryption for secure location reporting, with nearby Apple devices acting as anonymous finders to relay encrypted location data through Apple Cloud.

Securing tomorrow's software: the need for memory safety standards

Memory safety vulnerabilities have been a persistent security challenge costing billions, prompting a call for industry-wide standardization and secure-by-design practices. Recent advancements in memory-safe languages like Rust and hardware technologies offer promising solutions for widespread adoption. Google advocates for establishing a common framework to assess memory safety assurances and drive industry-wide adoption of secure practices.

iMac G4(K)

A detailed walkthrough of modifying an iMac G4 to house a modern M4 Mac Mini, including replacing the original display with a 4K Sharp LCD and creating custom mounting solutions. The project involved overcoming various technical challenges like cable routing through the iMac's neck and designing custom parts for proper integration of modern components.