Apple Updates Apple Intelligence Apple Security Patches

  Apple updated most of its software products January 27, 2025.

Updates: iOS 18.3, iPadOS 18.3, macOS 15.3, watchOS 11.3, tvOS 18.3, HomePod 18.3, visionOS 2.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, iPad17.7.4

With this update Apple Intelligence is On by default for supported devices.
To disable Apple Intelligence on iOS 18.3, iPadOS 18.3, and macOS 15.3         Settings > Apple Intelligence & Siri then toggle Apple Intelligence.

This update also addresses several security flaws, including a 0-day actively being exploited in the wild. Other security issues include five security issues in AirPlay, 3 vulnerabilities in CoreAudio. A total of 29 vulnerabilities including WebKit the engine that underpins the Safari browser. 

Microsoft Patch Tuesday January 14, 2025

 

Flash Drive Capacity LIES

 BE AWARE

Many cheap flash and SSD drives lie about their capacity.
Not malicious lies, just that the semiconductor cells may not have passed all quality control.
This was covered in the January 6, 2025 Cyber Security presentation recording.
The slides concerning this issue:

Be Aware. Do not lose your important files, documents, photos, etc. to cheap hardware!

Apple SECURITY updates available today January 6, 2025

  Updates to iOS 18.2.1 and iPadOS 18.2.1

 DoubleClickjacking is a sophisticated form of clickjacking that exploits a double-click sequence to bypass existing security measures. Here's a brief overview of how it works and why it's concerning:

How DoubleClickjacking Works

1. Initial Setup: The attacker creates a website with a button that opens a new window.

2. Prompting Double-Click: When the user clicks the button, a new window opens, prompting the user to double-click.

3. Manipulating Windows: During the double-click sequence, the attacker manipulates the timing and event sequence to replace or close the top-level browser window.

4. Unauthorized Actions: The second click unknowingly authorizes a malicious action, such as granting access to sensitive information or authorizing a transaction.

Why It's Dangerous

DoubleClickjacking is particularly dangerous because it can bypass modern web browsers' clickjacking protections by exploiting the brief interval between clicks. This makes it difficult to detect and prevent, leaving many online platforms vulnerable

Real-World Impact

• Account Takeovers: Attackers can take over user accounts by authorizing malicious applications.

• Unauthorized Actions: Users may inadvertently change critical account settings or initiate financial transactions.

• Platforms Affected: Major websites relying on OAuth for account authorization, such as Salesforce, Slack, and Shopify, are vulnerable to this attack.