A Digital Apocalypse Just Happened

A vulnerability impacting more than

seventy percent of Web servers,

a certificate flaw impacting millions of

websites and devices around the world,

and a potential remote zero click iPhone

vulnerability.

All this and more coming up on this

week in privacy number seventy six.

So stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we've been

working on within the Privacy Guides

community and this week's top stories in

data privacy and cybersecurity while

answering viewer questions.

I'm Jordan,

and this week I'm joined by Nate.

How are you, Nate?

Hello, I'm good.

How was your week?

really good week.

Definitely a lot happening this week,

a lot to cover on the podcast.

Um,

so why don't we dive straight into the

first and highlight story this week?

Yeah, for sure.

All right.

So our first story this week,

let me move these cameras around real

quick is, uh,

the legendary PHP to shell that you guys

have probably heard about.

Um,

I'll just I'll jump into it and we'll

explain as we go.

So I have a couple of articles here.

The first one comes from Bleeping

Computer,

and it says that the PHP security team

released emergency patches for two

critical remote code execution

vulnerabilities, which the CVEs are there,

but I'm not going to read those off,

tracked collectively as PHP to shell.

The two are unauthenticated remote code

execution flaws were affect all PHP

installations that serve web requests,

including PHP FM,

Apache with ModPHP, PHP CGI,

FrankenPHP and Lightspeed.

Both flaws stem from the same underlying

problem,

which is PHP can leave its memory in

a corrupted state when a request ends

abnormally,

and both can be exploited to achieve

remote code execution.

Admins should install PHP,

eight point five point twelve,

eight point four point twenty seven,

eight point three point thirty six or

eight point two point thirty five as soon

as possible on servers running PHP eight

and migrate to a fixed relief if they're

running PHP seven or older.

Let me check my notes here and see

if there's anything else I missed.

Yeah, so here we go.

The core developer Gina Peter Banyard

warned that no PHP to shell mitigations

will fully block potential attackers and

that applying the official security

patches is the only permanent defense.

If you guys have been following this

pretty closely,

then you've probably seen a lot of those

videos.

I guess like posts going around where it's

like, oh, if you can't patch,

either take your server offline or like do

this mitigation.

And that's basically what they're saying

is like, yeah, there are mitigations,

but they're not, they're mitigations,

not fixes.

The PHP security team did share a number

of mitigation measures that should reduce

exposure for those who can't immediately

patch their servers.

Although again,

they don't fully protect against

exploitation.

And this was a really, really big story,

which we are,

going to break down here in a minute.

But first, because it's such a big story,

it's kind of one of those like there's

multiple stories coming out that I wanted

to touch on a little bit.

This one comes from Wired.

It says hackers exploited the PHP

vulnerability days before they were

patched.

So apparently on – what was it?

On Wednesday evening,

which I think these were officially – so

personally,

I saw the post on like Tuesday,

like Tuesday night.

That was like, hey,

really important security patches coming

tomorrow.

Be ready.

And then Wednesday night – or Wednesday

morning is when they were published,

at ten a.m.

Eastern time, I believe.

And then –

Yeah.

Here it says,

so research published Wednesday evening by

Amazon web services indicates that at

least one actor had starting to attempting

to exploit the bugs on October,

for four days before Wednesday's public

revelations.

And, uh,

they did that with a honeypot in case

you guys don't know, that is a very,

very common thing in cybersecurity,

especially with bigger companies is they

will purposely leave servers open or, um,

Anyways,

they'll just purposely leave servers that

have nothing there.

They're just designed to be attacked,

and they will monitor them to see what

kind of attacks are attackers using.

Did they manage to get in?

It's a research tool to kind of understand

what the current landscape looks like.

So yeah,

they said that they had one of their

honeypots up,

and the attempt came from an IP address

that Amazon has linked to a quote-unquote

commercial anonymization network,

in other words, a proxy or VPN network.

And their AWS chief information security

officer, CJ Moses,

wrote in a blog post that while the

vulnerability was under embargo,

the targeting of the honeypot from an

anonymized IP address suggests that the

activity was conducted by a threat actor,

though it remains unclear how the actor

acquired exploit information prior to

disclosure.

Let's see.

Another executive director of the PHP

Foundation.

Sorry,

that one's about not relying on the

mitigations too much.

Let me go back to my notes here.

In the hours leading up to the disclosure,

AWS researchers say that their honeypots

were hit with multiple exploitation

attempts anonymized using various

providers and seemingly with various

attack goals,

likely indicating multiple different

actors.

Technical analysis is ongoing and it's

unclear if any of these attempts would

have succeeded in real-world systems,

Moses wrote.

He added that PHP shell is now being

broadly exploited in the wild.

And then the last one we want to

share here comes from The Independent.

It says websites across the world taken

down to protect systems as critical

cybersecurity update issued.

So

We'll talk about that a little more too.

I'm just going to read off my notes

here.

Several government bodies in Finland,

France, Denmark,

and the Netherlands took down the sites as

a precautionary step after reports that

the flaws were being exploited by

malicious actors.

Danish IT company Combit said several

services had been shut down,

including the country's national school of

communication platform.

In the Netherlands, several hospitals,

websites,

and platforms for the five major political

parties were taken offline.

Some sites are now back up and running.

Organizations across the board,

including private, public, large,

and small,

have been advised to follow guidance

issued by NCSE to, quote,

understand their exposure and take the

necessary actions to safeguard their

systems.

The widespread use of PHP sparked fears

that a substantial number of online

services and platforms could remain

exposed.

to cyber attacks.

And cybersecurity company Huntress said in

a blog post that HP is everywhere.

PHP, excuse me, is everywhere.

It quietly powers WordPress, Drupal,

Joomla, and Magento sites,

shared hosting platforms, control panels,

and an awful lot of software that doesn't

even advertise that it runs PHP under the

hood.

So yeah,

that is a lot to take in.

Fortunately, I think probably a lot of

A lot of people, I think,

have not seen a lot of...

have not seen the effects so much on

their end.

I haven't heard a lot of people saying

like, Oh, all the websites are down today.

Although I did see one screenshot of down

detector.

That was a pretty bad, but, um, yeah,

it seems fortunately, uh,

PHP rolled this fix out really,

really fast.

Uh,

and then at that point it was just

kind of up to everybody downstream.

Like, you know, your Linux distro, your,

um, your service provider,

your WordPress provider, et cetera,

et cetera.

So that's, um, kind of where we're at,

but, um,

I think I'll bring this back,

bring Jordan back for the analysis portion

of this.

So other than the fact that PHP is

used on like over two thirds of websites,

web services,

what would you say makes this so bad?

Like why has this been making,

I even saw this on the Reuters headlines

for like two days straight.

So what's,

what do you think is making this such

a big deal?

Well,

I think the main issue with this sort

of vulnerability is it's not based on how

well a website is programmed, right?

Like this is an actual flaw within PHP

itself, which is even more of a problem,

right?

Because, you know,

you could have taken every possible

precaution to make sure that your website

is designed in a way that it can't

be exploited,

but it is a flaw within PHP itself

that basically any website that runs...

using PHP can be affected,

which makes it kind of bad.

Even if you're hosting a website that is

like hello world,

your server could have remote code

execution.

Someone could execute code on your server

that you didn't intend to.

So that's why it's so severe and that's

why it's such an issue.

you know,

the entire internet seems like it's

burning down right now because it is such

a severe vulnerability.

But I guess we could throw it back

to, you know,

the changes have been rolling out,

things have been fixed, but is this over?

Like,

are we going to keep seeing more

vulnerabilities like this?

Is this going to be a problem in

the future?

You know,

are people going to actually update?

Because I feel like that's a big concern

too.

Yeah.

Yeah, I mean, well, first of all,

I personal opinion,

I don't think this is over.

I've mentioned before that usually when it

comes to data breaches,

we'll see a lot of like like a

really big third party company will get

breached, like Zendesk, for example.

Right.

Like Zendesk does support for a lot of

websites.

And so Zendesk will get breached and we'll

hear about it.

And then for the next like six months,

companies will be coming forward as they

do investigations.

And they're like, oh, crap.

It turns out we also got breached because

we used Zendesk and they got us through

that.

So I think we're going to see a

lot of that in the coming weeks.

I mean, it's only been like, what,

two or three days since this thing was

covered.

So like a week tops if you go

back to the seventeenth, I think.

I'm bad at math.

Don't be mad.

But it's been about a week tops.

And so I think, yeah, first of all,

we don't know who's been hit.

Right now everybody's in like just shut up

and fix it mode and we'll put the

fires out later.

Um, and yeah, I think like you said,

a lot of the time when, um,

when we have these like huge,

huge vulnerabilities,

the patches tend to have unforeseen

knock-on effects,

at least in my experience,

I could be wrong, but, um, but, uh,

the, uh,

I'm thinking of like Spectre and Meltdown.

Like they released a mitigation and it

turned out that it seriously restricted

performance to the point where it was

like, okay,

we can't just leave this as is.

So then they had to kind of tweak

it.

And then they found out there were other,

like not as bad,

but there were still additional

vulnerabilities that it didn't fix.

And so, yeah,

I think this is unfortunately probably

something that experts are going to be

dealing with for,

uh for quite a while and it probably

in the coming weeks and months we're gonna

hear a lot of companies stepping forward

and saying hey we got hit with this

php thing despite our best efforts so um

yeah i mean hopefully sysadmins are

keeping an eye on this and patching

accordingly but um do you think there's

anything that end users can do if they're

you know if they don't host their own

next cloud or their own um whatever

wordpress is there anything they can do to

protect themselves

I would say you can try and contact

websites that you use that you know that

use PHP.

But again,

it is so ubiquitous at this point that

we saw, like you mentioned,

government websites for Finland, France,

Denmark, Netherlands,

all these websites going down because they

don't want to be exploited.

So it's kind of tricky when something is

so ubiquitous and there isn't really...

that much that you can do as like

an end user in this instance.

You can make your make your concerns known

to your service providers and such.

But yeah,

if you if you host any sort of

website that uses PHP,

you should definitely be checking to make

sure that your service provider has

brought out a fix.

But if you're just someone accessing a

website,

there's really not much you can do.

But, you know,

we could always move and pivot back

towards the other important things is,

you know,

protecting your information,

using alias information,

using all things that will protect you in

case of a breach when something like this

happens.

Because like we always know,

these sort of things are bound to happen,

but it's about kind of taking

precautionary steps to make sure that if

there is a breach of your data that's

caused by one of these remote code

execution exploits, then...

you will be less affected.

But yeah,

there's not really that much you can do,

in my opinion,

as an end user using these websites,

which really sucks.

Yeah, I agree, for sure.

I guess we'll throw it over to the

audience.

Were any of you guys impacted by this?

Like, did you, you know,

you were unable to go to a website

because it was taken offline?

Or do you have any defense tips that

we missed or anything that we didn't

address on this one?

So...

Yeah, I guess with that,

we'll go ahead and we'll start.

In case you guys didn't know,

you can always leave questions and

comments in the chat.

And we have a forum thread here that

we make for every single episode.

And looking through there,

we do have one member who added a

whole bunch of other... Like,

this has just been a bad week for

cybersecurity.

I don't think these are all necessarily

related to...

What's it called?

PHP to Shell.

But yeah,

one of our regulars did comment a whole

bunch of other projects that announced

that they have some vulnerabilities that

need to be fixed.

So there's CodeBurg and ForgeJoe.

There's GitLab.

There's Plex.

They're calling it Plex to Shell.

They did add the Wikipedia page for PHP

to Shell.

And they also mentioned Linux.

We almost actually covered this story,

but there's not too much to it.

There were two Linux...

Actually,

I think there were several Linux

vulnerabilities that were exposed by

accident,

but two of them are high severity and

that were accidentally disclosed early via

the Linux mailing list.

I guess they just accidentally replied to

the wrong person and told everybody about

them.

Like I said, bad week for cybersecurity.

I don't know if you have any thoughts

on any of those.

I do have a little bit on the

Linux one.

Okay, sure.

It's a little bit of a concern here.

This specific story,

it is kind of a problem because these

vulnerabilities that were brought forward,

they haven't actually received fixes yet

in the mainline kernel,

so they are exploitable.

That's why it's kind of such a big

problem.

As Nate said,

CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS

other issues that have happened this week

later on in the show so stay tuned

for that but yeah this this is kind

of an unfortunate situation there was some

uh

speculation, let's say,

about how this actually happened.

How did someone accidentally reply to the

wrong person or reveal these

vulnerabilities that were possible to the

public before they were patched?

There was concerns that maybe someone was

using some sort of AI agent to reply

or something like that,

but that's not super clear.

So yeah, it's kind of a concern.

This one says here,

one of the vulnerabilities was it required

no authentication exposing any server

running KSM BD on port four, four, five.

So that's a concern for people running

SMB.

Yeah,

but there wasn't really a huge amount of

talk about that story this week.

But it was, in my opinion,

another big one.

There was also the other one that the

person on the forum mentioned,

which was the critical GitLab floor,

which could basically allow people to

make...

changes to Git repositories on GitLab,

which was also pretty bad.

That was a CVS-X.

So like huge,

huge vulnerabilities this week.

Really unfortunate.

GitLab says that under certain conditions,

it could allow an unauthenticated user to

run arbitrary code on the server due to

an integer overflow during the compilation

of a specifically crafted regular

expression.

GitLab has not said what those conditions

are.

And GitLab also reported there was no sign

that the flaw had been used in attacks.

So, you know,

kind of short little burst of a few

things that happened this week.

But there's just so many that we can't

really cover them all this week.

It feels like literally the entire

internet is on fire at the moment.

So we can't go into, like,

super high depth on everything.

But...

We do appreciate it whenever someone lets

us know about some of these issues in

our forum thread.

And yeah,

be sure to drop some comments there,

or you can leave some comments in the

chat,

and we'll try and get back to those

later.

Yeah,

that happened to me with the data breaches

this week.

Right after I published them,

somebody was like, oh,

there was also this data breach in...

Oh, God, I can't even remember now.

But yeah, I replied.

I was like, hey,

thanks for sharing because that did not

show up in my RSS feed.

So if I don't know about it,

I can't post about it.

And yeah, we're only human.

So real quick on that note,

we did have one other thing as well

as a question about this.

They said that...

As AI continues to prove its utility in

cybersecurity,

this comes from the forum thread,

bad actors will certainly shift their

attention towards it,

and surely cyber warfare between nations

will also become an increasing worry,

which is a frightening thought.

This makes me wonder,

should AI have far stricter regulations

than it currently has?

Must we now distinguish by law between

consumer-level AI and advanced highly

capable AI?

Must the populace's access to advanced AI

be blocked?

What do you guys think?

Do we have thoughts on that?

I mean, yeah, it's definitely a concern.

I think one of the stories,

we're going to talk about a story later

today where this was kind of an issue.

This specifically,

what you're saying was an issue.

So it is definitely becoming a problem

because, you know, these AI tools,

they can scan massive amounts of servers

and like, you know,

automate tasks that would usually take

like a threat actor a lot of time

to actually investigate, right?

Because it can just automate that entire

process.

Um,

so that's why it does become kind of

scary when,

when we have these like AI tools.

And I think it is definitely one of

the reasons why we're seeing more

vulnerabilities like this being unveiled.

Um,

I think there's a GitLab vulnerability as

well, you know,

I'm not sure if that was unveiled by

using an AI,

but the more that we see these tools

becoming better and more sophisticated,

then this does become more of a concern.

Yeah, it is kind of scary,

but I definitely think it is helping

threat actors to craft attacks more

easily.

Yeah, I don't know.

I have really conflicting opinions.

Like, I agree with you,

but at the same time,

it's kind of one of those, like,

if you outlaw something,

then only the bad guys will have access

to it kind of arguments, I think.

And, I mean, first of all,

for the record,

I do think AI in general needs regulation.

I think I'm not a fan of the

U.S.'

's, like, Wild West just, like,

first across the finish line gets to take

all the money and everybody else gets to

start that attitude.

But that's more of a political take.

But, no, like, when it comes to, like,

AI and security, I don't know.

I think...

I think something should be done,

but I don't think I'm smart enough to

say what should be done.

I don't think I'm qualified to give

feedback on that, but I do.

I don't think you have to be a

doctor to recognize when like your arm is

in pain and you need a doctor.

So that's kind of where I'm at is

like, okay,

something's wrong here and I don't know

what it is,

but I think somebody should come in.

I will say if you're a pro AI

person, at least in the terms of like,

like cybersecurity and stuff,

Bruce Schneier is very optimistic about

the potential of AI and,

um a little too much in my personal

honest opinion but he's also a really

really smart guy and i i just say

like maybe following him and some of his

posts and some of his work like maybe

that would be a good place to start

if you want to learn more about this

stuff um because even even though i

disagree with him i think he's very smart

and he knows what he's talking about um

i know carrie parker from fireballs don't

stop dragons is very i don't know if

i say pro ai but just in terms

of like security and code is very um

optimistic about ai's potential so

Maybe start in those places,

but that's kind of the best I got,

to be honest.

Yeah, no, great recommendations.

Really big fan of both of them.

I think this is probably time for us

to jump into the next story,

unless you have anything else you want to

add here.

No, totally agree.

I was about to turn it over to

you.

What you got for us?

So that was this post on our community

forum that someone made,

and they basically posted a clip of...

from Tucker Carlson's podcast with

Kim.com.

And basically,

kind of to summarize what exactly this

short clip was about,

the short clip of Kim.com on Tucker

Carlson's show claimed that Signal is the

worst messenger because, quote,

everyone is using it and, quote,

the government has a backdoor.

So

This is kind of a wild claim, right?

Obviously,

when someone makes a claim like this,

we kind of assume, you know,

they probably got a lot of evidence,

right?

So that is not the case.

This kind of started a bit of a

discussion on our forum.

Freya,

one of our privacy guides team members,

replied and said, Signal is open source,

supports reproducible builds,

and the protocol is so well known that

other apps use it like WhatsApp,

And previously, Google's RCS,

before they switched to MLS encryption,

it's analyzed by security researchers.

If there's some kind of backdoor in

Signal,

it will be reported by one of them.

And just a quick note,

a lot of those things that Freya posted,

he had links attached to that to support

his claims.

Continue.

Exactly.

Yeah.

This is like, you know,

we're linking to actual evidence.

When we're making claims,

we're linking to actual evidence.

And that is kind of important, right?

And there was another user that said,

if I was going to claim a software

had a backdoor that is known for security,

has many audits and reproducible builds,

I'd be sharing it in a technical write-up,

not a random statement on a podcast.

Another user mentioned,

zero evidence whatsoever, it seems.

Signal is open source.

He's perfectly welcome to show us this

backdoor if it exists,

but burden of proof is on him.

Basically, there was,

to kind of summarize what happened in the

rest of the thread,

the thread kind of devolved into some red

string conspiracy theories with

circumstantial

facts and without any evidence.

And there was definitely some heated

exchanges had in that thread specifically,

which now got locked,

but it's worth a look because it shows

how to make a claim,

how to refute it and the difference

between circumstantial evidence and actual

logic.

So yeah,

this is kind of one of these things

where in the privacy community,

there's a lot of people making claims

about things and saying things,

but

Not everyone has evidence to support what

they're saying.

So I guess to throw it back to

you, Nate,

do you have any tips for actually thinking

critically about things and not devolving

into this sort of thinking?

Yeah.

And, um, I do want to,

I want to give the critics a little

bit of credit because we can't prove a

negative, right?

Like we can't prove that signal doesn't

have a backdoor for example.

But, uh,

but one thing that bugs me is like,

okay, we pointed out, um,

or I should say a lot of our

community pointed out signal is open

source.

It

it supports reproducible builds.

At one point they got into talking about

the server and how like,

it doesn't really matter if the server is

compromised because all the encryption

happens on device and stuff like that.

So a backdoored server would just like,

yeah, you could scoop up some metadata,

which still wouldn't be good,

but it's not like, you know, a backdoor,

it can read all your content.

It doesn't work that way.

And just, you know, it's,

My brain just suddenly lapsed.

But we can't prove that Signal's not

compromised, but it's, oh,

it's about like the type of evidence.

When you present, in my opinion,

you present all these types of evidence

that say like,

here's why we should trust it.

And then, you know, one thing I see,

like I clicked on one of the links

in that post is like, oh,

Signal has gotten founding from the CIA in

the past.

And I kid you not,

when you click on this post,

it's like Signal got founding from the

Open Technology Fund, or excuse me,

funding.

Signal got funding from the Open

Technology Fund,

who in turn got funding from someone else,

who in turn got funding from someone else,

who in turn got funding from the CIA

once upon a time.

And so it's like this...

Again, is it possible?

Yeah, it's possible.

I'm not going to say it's impossible.

If somebody comes forward with evidence,

it's like that one person said,

Signal is open source.

He's perfectly welcome to show us this

backdoor.

Yeah, come forward and prove it.

Please prove it because if Signal is

compromised, I want to know.

But the reason I call it red string

conspiracy theories is it's like that meme

of Charlie Day from It's Always Sunny

where he's got the board and he's got

all the red string connecting everything

and he's like –

It's a conspiracy!

And it's like, yeah,

if you want to play Six Degrees of

Kevin Bacon,

everything's connected to everything.

Like,

if you play the Six Degrees game long

enough,

I'm connected to literally every person on

Earth,

including the random farmer in China that

I've never met.

Like, you can play this game all day.

So it just...

This kind of stuff bugs me.

But anyways, yeah, no, I...

um yeah number four said a nice username

by the way we'll talk about that later

uh number four said giving evidence of

your claims should be a norm i agree

um because that is the thing is like

when you make a claim like that the

burden of proof is on you like it's

not like anybody's telling you don't prove

it like again if it's compromised we want

to know people are trusting the software

with their lives but you can't just say

like signal is compromised

okay i i'm a millionaire i have a

green dragon in my closet like what i

i you could say anything you want you

got to prove it um i'm not a

millionaire i wish i was anyways getting

back to your actual question getting off

my soapbox um i don't have i mean

I think just in general,

like critical thinking,

and I almost hate using that word because

I feel like it's been so weaponized.

Like I'm actually having this discussion

with somebody right now in a completely

unrelated chat.

But, you know,

it's like it's letting the evidence lead

you regardless of your biases.

You know,

don't – like there's always that,

you know, oh,

I question who funded this study and I

question the methodology of this study.

And it's like, okay,

but you're not questioning the studies

that confirm your biases that are

obviously –

methodology and funding conflict of

interest.

But I guess the only resource I have,

I hate to show myself,

but over on my ghost, ghost.newoil.org,

I have a blog post about critical

thinking.

And this is,

I took a philosophy class in college.

I know I've told this story before,

but for anybody who hasn't heard it,

I took a philosophy class in college and

it was purely just for the credits.

I was just like,

I just needed something in that category.

And I was like, eh,

i'm interested in philosophy i'll take

that and the one-on-one class i actually

think should be taught in all classes

because they didn't really talk about

philosophy that much instead they talked

about how to evaluate a claim and how

to evaluate like the evidence and the

person making the claim without attacking

them and you know um does it conflict

with what we already know does it conflict

with other experts say and uh yeah i

definitely um

definitely recommend i guess i would say

starting there um because that kind of

summarizes all that stuff but uh and yeah

actually i was the last thing i had

written here in the notes is to turn

it over to you guys do you guys

have any favorite blogs videos podcasts

books whatever about critical thinking and

how to evaluate a claim and how to

avoid falling into the trap of like only

paying attention to things that confirm

your biases and um yeah i guess uh

or any techniques you use.

Sorry,

I was trying to click on that link

there to read it.

But yeah, I think that's all I got.

I'm going to start with that one so

I can read it later.

I agree.

I agree with everything you said.

Definitely all good points.

I think also we did get a small,

I'm not sure exactly what this means,

ten jewels.

We just got ten jewels.

I'm not sure what that means,

but thank you.

Thanks so much for that.

Someone said, I love your username,

number four.

Yes,

we will get into the number four later.

We are going to cover that,

just so you all know.

So stick around for that later.

Yeah.

But yes,

we're keeping an eye on the chat.

And if anyone has any questions about what

we're talking about,

do leave that in the chat.

But yeah,

I guess we can just hop straight into

the next story, unless you see anything.

Yeah, not that Anon said less wrong.

I feel like I've heard of that one.

Maybe,

or maybe it just sounds similar to other

things I've heard.

So not to belabor it,

but one person said, for safety purposes,

it's better to assume that it's

compromised.

I mean,

my personal opinion is you could play that

game all day with everything.

Like,

if you literally just throw that out there

with zero evidence whatsoever, like,

what's your messenger of choice?

Like, well, just for safety purposes,

we'll assume that's wrong.

And then at that point,

what are you going to do?

Like,

you just can't have a conversation with

anybody.

And yeah,

I know the easy answer is like,

we'll meet up in person.

Okay.

And back when I lived in California and

my mom lived on the East Coast, like...

what am I just going to hop on

the plane every time I wanted to talk

to my mom?

Like that's,

that's not an option all the time.

So we have to trust something somewhere.

That's again, not to show my own stuff,

but that's another blog post I have is

like anybody who says I don't trust

anything is lying because you are

literally trusting somebody somewhere all

the time.

You're trusting the building you're

standing in, not to collapse on your head.

You're trusting the food you're eating,

not to poison and kill you.

You're trusting everything at some point

somewhere.

So you have to draw the line somewhere

is my opinion.

But anyways,

I could rant about that all day.

Uh,

We'll go ahead and move on to our

next story, which is about Cash App.

And I think everybody loves Cash App,

right?

Oh, sorry, let me, forgot to,

you already shifted them around and I

didn't even notice.

So this comes from four oh four and

the headline says someone opened a Cash

App in her name and she faces years

in prison.

So this one I think actually requires a

login wall.

Yes, it is.

So this one is free to read,

but you do have to sign up for

an account, which, uh,

four Oh four does that to prevent bots

scraping the website.

So, um,

if you don't want to do that,

I totally understand, but also just,

if you do, it is free just FYI.

And, uh, this story, uh,

I'm going to go ahead and read from

my notes here.

It says Amanda Smith answered the door one

afternoon in April and came face to face

with the local sheriff's department in

upstate Pennsylvania.

The officer said they had a warrant for

her arrest with a crime that she had

allegedly committed more than a thousand

miles away in Arkansas.

Smith recalled, I was completely confused.

For one, she had never been to Arkansas.

And second,

the warrant was for computer fraud.

By her own admission,

Smith was not a very tech savvy person.

What developed over the next few days and

has now stretched across six months is a

Kafkaesque situation in which Smith,

in her telling,

is being asked to prove her innocence in

an ongoing criminal case,

while Cash App refuses to provide her any

information about the account because she

couldn't prove that she was the owner.

Which would make sense if she's, you know,

not...

Yeah, if she's telling the truth,

she can't get it.

According to a copy of the prosecuting

attorney's affidavit form,

police responded to an Arkansas address on

February fourth after a report of fraud.

The victim said that they recently found

some items for sale on Facebook

Marketplace.

When the victim messaged about buying the

items,

the seller told him to send the money

to his wife's Cash App account,

which he did.

That account was in the name of Amanda

Smith and had the username Smithy five,

six, eight, seven.

It turned out the seller's Facebook

account was hacked,

the seller wasn't really selling the items

at all, and the person had been scammed.

The Cash App account was created just

shortly before the scam at the end of

January.

Investigators then took the Cash App

account's username and served Block,

which owns Cash App,

with a search warrant seeking information

connected to the account.

The data returned included Smith's social

security number and date of birth.

Cash App requires users to provide their

social security number to, ironically,

protect against fraud.

The Cash App account was made...

This is a little further down in the

article.

The Cash App account was made with Smith's

social security number and date of birth,

but a lot of other information from the

account does not line up with Smith,

according to the Philadelphia address on

it is not Smith's or Josh's,

which is her husband, nor either one...

excuse me,

nor one either of them have ever lived

in.

They said that they did live together in

Philadelphia in the same zip code as the

address on the Cash App account,

but not that address,

and they don't live in Philadelphia

anymore.

Smith said the number used to create the

Cash App account is not her current

number.

Her husband did not remember Smith using

that phone number at all,

although Smith said she may have done so

in the early two thousands before she

switched from T-Mobile to AT&T.

Not a smoking gun,

but that is a little detail to remember,

T-Mobile, AT&T.

Four Oh four did not find this phone

number linked to an Amanda or four or

four did find this phone number linked to

an Amanda Smith in various data breaches

from years ago using open source

intelligence.

They also found that someone made a Venmo

account using the same phone number,

but under another name entirely,

whoever made that account did so about a

week before the scam cash app account.

The Cash App data also shows that whoever

made the account used an iPhone running

sixteen dot one dot one,

a very out of date operating system from

twenty twenty two.

Smith, however,

has an iPhone thirteen mini with iOS

twenty six point five point two,

according to a screenshot of her devices

settings.

She shared the IP address used during the

creation of the Cash App account during

the scam itself related to connections

from Verizon's wireless network.

So remember, I said T-Mobile, AT&T.

Again,

Smith is on an AT&T plan and says

she never had a Verizon plan.

Smith said she never used the username

Smithy-Five-Six-Eight-Seven.

Four-O-Four Media found other people

online using this moniker,

but none appeared to be this Smith.

Smith's leading theory is that someone

stole her identity,

perhaps through a data breach like the

National Public Data Breach in December of

twenty-twenty-four and used that

information to open a Cash App account.

Authorities offered Smith a plea deal of a

thousand dollar fine,

a thousand dollar restitution,

various other costs like a bailiff and DNA

samples.

and three years probation.

Smith said she refuses to accept it

because she's innocent and doing so would

have long-term negative consequences on

her life.

And I totally agree.

So let me get up and rant here

for a second.

In the article, Smith says like,

I am something to the effect of like,

I was raised to believe that, um,

in America,

you're supposed to be innocent until

proven guilty.

And, you know, a minute ago,

I just said like,

you can't prove a negative, right?

Like she can't prove that this wasn't her

unless she can like prove that she was

like,

I don't know,

on a deserted island at like a no

electronics retreat of some kind or

something, right?

But in general,

you can't prove that this isn't you.

But if we did things the way we're

supposed to,

where we're saying innocent and we have to

prove this is you, I mean,

this is so shaky, right?

Like the address is not her address that

she's ever lived at.

She's never had Verizon.

And this is all stuff they can prove

through,

like this is all stuff

Cash app proved, um, you know,

she's never had Verizon.

She doesn't have that cell phone.

She's never lived in Arkansas.

And, uh,

four Oh four said they use querying IP

geo location tools with the, the,

the IP address from cash app,

the Verizon IP address.

So presumably that puts the phone in, uh,

you know, Arkansas, which yeah,

I know there's ways to like root things

and she could be hiding the phone at

a friend's house or something like that.

But I mean, it's, it's one of those,

like it's Occam's razor, right?

Like what's more likely this lady who

claims that she's not very tech savvy has

this burner phone and she's using,

you know,

tools to spoof it,

to scam this person out of a thousand

dollars and blah, blah, blah, blah, blah.

Or somebody stole her identity,

which I was actually ranting about this to

my wife earlier.

We shouldn't even consider social security

number to be privileged information

anymore because there've been so many

freaking data breaches.

Hi, we do a roundup every single week,

by the way,

in case you guys don't remember.

We do – there's so many data breaches,

and a lot of them do reveal social

security number and date of birth and

sensitive information like that.

It's so easy to steal somebody's identity

now.

So –

Yeah, I don't know.

I'll get off that one.

I'm a little surprised by this because I

was thinking about what possible defenses

would exist for this thing,

and I'm really not sure because I actually

had to open a cash app myself the

other day because...

Just reasons.

And first of all,

I'm not even sure how they were able

to do it because even me,

Cash App made me like do the whole

liveness check, right?

To like show my face and turn my

head and whatnot.

So I don't know how they got through

that.

But then also I was thinking about it

and I'm like,

my credit is frozen and I've never,

like I had no issues opening that account.

So I don't know.

Usually our defense against identity theft

is like freeze your credit and you won't

get it stolen.

But clearly this is,

Not necessarily the case here.

So I don't know.

I guess after all that,

I'll go ahead and turn it over to

you.

Jordan,

do you have any thoughts on what we

could do to prevent this kind of stuff?

I mean, yes.

I would say it seems like in this

case,

am I right in saying that the person

wasn't aware that their social security

number and identity documents weren't

actually breached?

Am I understanding that correctly?

Yeah, so the Amanda Smith person,

she didn't even know this was happening.

She probably doesn't know.

I mean,

most people don't pay attention to these

data breach stories.

And most of the people I meet too,

even if it made headlines and she saw

it on the news, she'd be like, oh,

whatever.

I don't have any money for them to

steal anyways.

Like that's usually what people say.

So yeah,

she's probably not super familiar with all

this stuff.

They don't know exactly where the data

came from.

They're just speculating with that whole

twenty twenty four data breach thing.

Because again,

there's been so many breaches.

It could have come from anywhere.

Exactly.

Yeah, no,

I think one thing that's kind of

frustrating about this sort of story is if

you don't know that your information is

being compromised,

there's not really much you can do, right?

But I think if you do know that

your information is being compromised,

there are things you can do, right?

So I think in this circumstance, you know,

getting those documents replaced,

getting... Actually, I'm not sure.

Can you get a new social security number

if it's been breached?

Do they allow that?

You can, but from what I understand,

it's a huge ordeal and it's kind of

something that's like a last resort.

It's like a real process.

I see.

OK, so, yeah, that could be an option.

I guess it depends on how bad the

breach is.

Honestly, I would probably do it anyway,

because, you know,

like we saw in the story,

you don't want to be sentenced to prison

or like sentenced to years in prison

because of someone who's stolen your

identity.

Right.

This is like the worst case scenario for

any sort of identity theft situation.

sort of story, you know,

this is probably as bad as it's going

to get at this point.

So, you know,

obviously this is a very extreme case of

what can happen,

but I think getting those documents

replaced,

getting a new social security number,

even if it might be a kind of

a pain,

it depends on which country you live in

because it depends.

Here it's not that hard to get it

replaced as long as you can prove that

it's been reached.

You know,

getting those identity documents voided

is pretty important.

It's going to stop people from stealing

that stuff.

And also just be a little bit more

cautious about what information you share

with people.

So, you know,

not sharing your date of birth on social

media, not sharing when your birthday is,

not, you know,

all these sort of extra data points is

things that people can use to steal your

identity.

And I don't think this doesn't seem like

it's a cash app specific issue, right?

Like this could have happened to pretty

much any other like, you know,

financial services provider, right?

Yeah, potentially.

I mean,

I think we won't know that until we

figure out how they were able to game

the Cash App system.

But yeah,

it says they were able to open a

Venmo, which for the record,

I was not able to do that one.

I tried to open both because I was

like,

let me just get both in case I

need it.

And Venmo did not like my phone number.

But yeah,

so it's potentially not a Cash App thing,

possibly.

Yeah.

I think this could also be a good

argument for some of those,

What's the word I'm looking for?

those data removal services or even doing

it yourself if you want, that's fine.

I know some people really don't trust

those services,

but it is a lot of work to

do it yourself.

Um, yeah,

universe middle productions here did point

out only if you're a Senator,

Congressman or judge.

Um, I,

I know a lot of places like if

you are like a judge or law enforcement,

they'll automatically remove your stuff

from public records or not automatically,

but you have to like file for it

and they'll do it without argument.

Everyone else,

I guess we just don't matter.

We're not important and our lives don't

matter.

So always fun.

Um,

Yeah, I mean,

I have a couple other thoughts,

but did you have anything before I offer

those real quick?

No, no, please do go ahead.

Um, yeah.

So, uh,

a couple other things that stuck out to

me while I was reading this,

first of all, not to victim blame, but,

um,

if you're the person in Arkansas in this

situation,

I don't know who would pay in advance

for goods online.

Like maybe it's me,

maybe I'm a not very trusting person,

but like,

I'll pay you when I'm standing in the

parking lot and you have the item.

Like,

I don't know why you would just cash

up somebody a thousand dollars and you

haven't seen the item yet.

Um, and as for, uh, Amanda Smith,

I mean,

it seems like things are

hopefully going well for her in the sense

that like, she's, she's got a case,

she's got a lawyer, but, um,

my wife and I, again,

I was like ranting about this to my

wife.

We were talking about it earlier.

Always ask for a lawyer.

Like, even if you are innocent,

there's so many people who think like, oh,

I didn't do anything.

So I'll just like,

I'll talk to the cops and we'll straighten

this whole thing out.

And as you can see from this mountain

of evidence, the cops,

I'm going to give them the benefit of

the doubt here.

Um,

Usually the cops get their person when

they get somebody.

So I will say there are a lot

of innocent people sitting in jail,

but it's not like sixty percent of them

or something.

So they have this bad habit of once

they decide that you did it.

You did it.

And they will ignore all evidence that

says you didn't do it.

And they will only focus on the evidence

that says you did do it.

And again,

this story is a perfect example.

So if you ever have to talk to

the cops,

make sure that like you get a lawyer

because there are some innocent people

sitting in jail right now.

Again, I know it's not the majority,

but there are some innocent people sitting

in jail right now who were like, oh,

I didn't do it.

I have nothing to hide.

We'll just talk and get this whole thing

straightened out.

But the cops were like, you're our guy.

And they just turned everything against

them.

So I don't know.

Anyways, I just...

I feel the need to point that out

every time.

Always ask for a lawyer.

And then, yeah,

if any listeners have any advice on how

to defend against this kind of stuff,

because I did send a message in a

group chat, but nobody responded yet.

I don't know if maybe nobody else had

any ideas or just nobody's had time to

look at it, but yeah.

I'm checking through some of the comments

here.

Oh, interesting.

About DIY data broken removal service.

Some people are setting up local AI agents

to do it for them.

You need to know how to secure these

security nightmares, but in the end,

it could be a good option.

Yeah, I mean,

I don't know enough about setting up a

local AI agent.

I wouldn't trust myself to do it right,

but if you know what you're doing and

you're confident that it's not going to be

leaking data,

I guess that could be one thing for

it.

Yeah,

I guess we can kind of pivot to

recommendations on our website.

We do recommend data removal services.

I think right now we only recommend one,

which is easy opt-outs.

And it's really cheap.

So you don't have to make a whole

local AI agent to do it for you.

You can just pay them to do it.

It's like twenty dollars a year.

It's really cheap.

It can remove a lot of information about

you.

That is one step you can take to

stop that.

As far as I know,

that's more of an issue in the US.

But again...

It's something you should look at.

Try Googling yourself.

See what information is out there.

We also do recommend manual opt-outs.

We have some links to specific websites

that you can get removed from that are

particularly bad.

And there's also a link to the...

the big, the bad bull,

the big ass data broker opt out list,

which I think is also a really good

resource.

And we also do recommend you use,

it's only for specific people,

but there's a Google about you search,

which basically just

searches your name and information and

will alert you if something's been listed.

So that's also another option depending on

your threat model and if you're okay with

giving that information to Google.

But those are like two basic things that

we kind of do.

We do recommend people at least give a

look to reduce the chances of identity

theft and all of that.

But yeah,

I thought we should at least mention that.

No, yeah, good call for sure.

Because there's, like you said,

it's about threat model, right?

Like, there's so many different, like,

Google already has my real information

because I have monetization on my YouTube

channel.

So...

I do have the whole results about you

thing set up.

Cause like they already know everything

about me anyways.

Right.

It's to me, it's another layer of defense,

which I, for the record,

I know that's like one argument people

give to not care about privacy.

I'm just saying in my case,

I thought about it.

I weighed the choices and I willingly gave

Google that information and now they have

it.

So I may as well take advantage of

the results about you.

But I also totally respect somebody being

like, no,

I've gone out of my way for Google

to not know who I am.

I'm not going to give them my name

and like, Hey, that's totally valid.

I respect that.

So yeah.

So yeah,

lots of different options for different

people out there.

What was the one?

Oh yeah,

so kind of talking about what we said

earlier,

Asus apparently also has some CVEs.

They said that they left some links on

the forum.

Yeah, I think that's all we got.

I think maybe we can move on to

some site updates for now.

So yeah, in a little bit,

we're going to talk about a possible new

Celebrate Zero day,

which should be super exciting.

But first,

we will give some quick updates about what

we've been working on at Privacy Guides

this week.

And remember to leave any questions and

comments in the chat,

and we'll get to them in a moment.

But first,

we have a new video as soon as

I can

pull this up here.

If you guys didn't notice,

we have released a new video about FISA,

the Foreign Intelligence Surveillance Act

and Section.

I really like doing these history videos

personally because I'm

I'm very fascinated by how we got here.

And I wouldn't say like I study history.

It's more of a passing interest.

I listen to a lot of different podcasts

and some of them talk about history and

some don't.

But personally,

I feel like the more I learn about

history,

the more it kind of like explains things.

You know,

it's the more I understand it's like, oh,

This is why things are the way they

are.

This is how we got here,

so to speak.

So I really like doing this.

And,

and I did not grow up in like

the hacker culture,

the early hacker culture.

So pretty much everything like pre nine,

eleven, to be completely honest,

kind of didn't happen to me,

except Oklahoma City, I guess.

I remember that on the news.

But so, yeah, for me,

it's like learning a lot of this.

Like FISA goes all the way back to

like nineteen seventy eight, I think,

is what our research found.

And so, yeah, it's just, to me,

it's really interesting.

And also, personally,

I feel like it could be my bubble,

but I feel like whenever there's like news

headlines about like, oh,

FISA is going to be reauthorized.

People are just like,

they just say like section seven Oh two,

and it allows the warrantless spying of

Americans.

Like,

and then they just kind of move on.

And I feel like there's probably a lot

of people that.

don't necessarily know what it is or how

we got here.

And yeah, so anyway,

so we made that video and it just

kind of explains, um,

how FISA came to be,

what set the stage for it and why

it doesn't seem to work and why we're

still talking about it.

Uh,

But yeah, and then we've also, of course,

we've actually got several videos in

progress.

I know Jordan has been working on a

interview with the Obscura VPN people,

which should be really cool.

I just wrapped up a video about Graphene

OS,

just kind of giving an overview of what

it is and why people should use it.

And I think our next plan is to

work on a tutorial for Obtanium.

because I've seen a lot of people say

that they really don't know how to use

it.

And just using it in general is very

simple and straightforward.

But there's also all kinds of power tools

and stuff to get more out of it.

So yeah,

I think that's kind of all we got

going on for now.

And I will turn it over to Jordan

for anything I missed and any site

changes.

Yeah, no,

definitely stay tuned for some more

exciting videos that are coming out soon.

But yeah,

jumping into some site changes this week,

we did have a couple of small changes

this week.

We had a change that was pushed by

Freya where we removed just simply the

word alternative from Linux's description

on the Linux overview page.

So we originally said Linux is an open

source privacy focused desktop operating

system alternative,

but we removed the word alternative.

So

Quick fix there.

We added a quote to we kind of

reworked, I guess,

a little bit of the Android verified boot

documentation page.

So we basically included more quotes from

the AOSP documentation,

which made it a bit more clear and

a bit more accurate as well,

because previously it wasn't quite

correct.

So now it is correct.

That was a great change again.

from freer and i reviewed that one as

well and there was also another small

change where we basically updated some of

the systemd networkd dhcp anonymity

guidance so just a small change there um

Not really a whole lot,

just some small corrections on that page.

So yeah,

overall kind of a small amount of changes

this week,

but still we are trying to make sure

that everything is up to date on the

website and correct.

So thank you to everyone that made

contributions there.

And again,

we had more news updates this week.

So that's something that...

both Nate and Freya both work on.

And there was, as usual,

a data breach roundup from October

sixteenth to the twenty-second of October.

So that was a big week this week.

Lots of big ones there from Nate.

And we also had some posts here.

Signal vulnerability allows audio and

video, possibly video,

to continue after hanging up.

Websites down due to critical

code execution,

PHP security vulnerabilities,

thousands of Android phones shipped with

malware,

Metafix is a bug in smart glasses causing

them to record conversations without user

consent.

So all really interesting things to keep

an eye on.

Definitely keep an eye on the

privacyguides.org slash news page for more

cybersecurity and privacy updates.

But as usual,

all this is made possible by our

supporters.

You can sign up for a membership or

donate at privacyguides.org or pick up

some swag at shop.privacyguides.org.

Privacy Guides is a non-profit which

researches and shares privacy-related

information and facilitates a community on

our forum and matrix and also Fluxenau.

But people can ask questions and get

advice about staying private online and

preserving their digital rights.

So now let's talk about the eMudra story

first.

Many of you have seen Making the Rounds.

Remember to leave your questions in the

chat and we'll get back to them in

between stories.

So I feel like this is definitely the

biggest or one of the biggest stories this

week that kind of had the entire internet

exploding.

The title of this one is the internet

goes on high alert after discovery of

eight compromised TLS certs.

Security personnel around the world are on

high alert Tuesday following the discovery

of eight TLS certificates with private

keys secured.

so weak they could allow anyone to mint

trusted browser and app credentials for

any site on the internet.

Eight intermediary certificates belong to

India-based certificate authority eMudra

Limited.

An informal advisory published to

eMudra.wehaveaproblem.com over on Tuesday

posted the message,

we have a problem here, Wayne.

The words were digitally signed using the

private key of one of eMudra's

certificates with proof that the reporting

party had control of the key.

Defenders scrambled because the same key

could be used to sign unauthorized

certificates that would be trusted by

millions of servers worldwide.

So quoting from the article,

this will be a massive cleanup job,

bigger than Heartbleed.

Philippo Valsorda,

a cryptography engineer and cryptography

maintainer for the open source Go

programming language, told Ars,

there will be a very, very long trail.

IoT devices, Docker containers,

forgotten Linux machines,

unmaintained CLI tools that ship their own

copy of the roots,

which is a common mistake.

which is common in some ecosystems like

Python.

Also,

Linux distributions are still rolling out

updates.

Some of them are not ready yet,

and then system administrators will need

to apply them to a lot of machines.

Heartbleed is the name of a critical

vulnerability in the open SSL cryptography

library.

In twenty twenty in twenty fourteen,

it came under mass exploitation.

Exploits let unaffiliated hackers decrypt

TLS protected exchanges between parties.

They also recovered private TLS

certificates, keys,

session cookies and passwords.

The attacks compromised thousands of

servers,

some belonging to large companies and

government agencies around the world.

Recovery required a long series of steps

that took years.

The compromised e-mudra keys were

defective at a level that's challenging to

imagine

Challenging the imagination of many

engineers studying the incident,

a normal size for a NIST

P-th-three-eight-four elliptic curve

cryptography private key contains three

hundred and eighty-four bits of entropy,

a size allowing almost two thousand three

hundred and eighty-four,

or a number with one hundred and sixteen

digits.

different possibilities.

The key sizes of the compromised keys

ranged from three to eight bits.

Astonishingly, the private keys were four.

No, like literally the number four.

Um, fifty-six, sixty-six,

one hundred and fifteen, one five six,

So Ben Cartwright-Cox,

director of BGP Tools, said that,

my guess, it's an example of,

it's example code that accidentally leaked

to production, but hard to know,

but it's bonkers that no one noticed.

At this early stage,

the most immediate threat appears to be

for those using VPNs,

especially in countries with governments

that likely maliciously intercept traffic.

There are likely many other cases for

concern.

End users likely have no recourse other

than to hold off using many non-browser

forms of TLS communication until they

receive assurances updates are in place.

Most browsers have already blocked the

intermediate certificates and the

exception appears to be Edge running on

Windows

which at the time of this article went

live,

was still connecting to twelve vulnerable

hosts.

In response to questions asking why and if

the company had plans to do so,

a Microsoft representative said the

company will be in touch if it has

anything to, and I quote, share.

Meanwhile, Signal, WhatsApp,

WireGuard and other apps that don't rely

on TLS for confidentiality aren't

affected.

eMudra,

wehaveaproblem.com site also shows apps

known to be patched so far.

And one caveat to this is exploiting

compromised certificates requires an

active adversary in the middle attack,

meaning the attacker must act as a proxy

between two TLS parties and receive

encrypted traffic, decrypt it,

re-encrypted,

and send it to the other party.

Such capabilities in some cases are

usually limited to only the most

well-resourced attacks

attackers.

People with control of a local network,

at a coffee shop, university,

or other organization face much less of a

challenge.

So after all of this,

it kind of was, you know,

this was looking pretty bad for eMudra.

And in fact,

they decided after this entire predicament

that they would just throw the towel in.

Disgraced eMudra drops out of TLS business

after using a cert private key of four.

And

I think probably the funniest thing about

this whole situation is the amount of

memes and jokes people were making about

this.

There was a lot of, you know,

people making fun of them for just how

badly this happened.

I think we could... Yeah,

someone said here,

you wouldn't use four as a private key.

Yeah, you know,

this is pretty negligent from them.

So I guess quoting from this article,

the chairman of the India-based eMudra

Limited cited increasing costs and

complexities...

compliance requirements paired with the

business generating just one percent of

its revenue.

He also said that the emergence of

organizations providing TLS certificates

free of charge further reduced returns on

investment when compared to other products

and services the company offers.

However,

the level of social media application

around this incident has brought scrutiny

that is out of proportion to SSL slash

TLS's place in our business.

The company continued in a Thursday post.

In view of this,

after detailed deliberations,

our board has concluded that withdrawing

from global SSL and TLS is the right

decision for Imudra and its shareholders.

On Wednesday,

Imudra provided a brief explanation for

the debacle.

The certificates were created under

eMudra's ECC route in a key generation

ceremony, KGC, held on April, April,

Generation Ceremony caused a wrap-unwrap

step to produce a second set of weak

keys alongside the original strong keys.

The weak keys were the ones published to

the browser root stores.

Imudra is working to establish the root

cause."

With the immediate certificates blocked by

browsers, much of the threat is gone,

but plenty of other devices that rely on

the same certificates require much longer

windows to take the same action.

Still, other devices,

such as embedded devices,

may never be able to block them.

So, yeah,

this was kind of a huge story this

week.

A lot of people were talking about this,

and I guess kind of to throw it

back to you, Nate, what...

What is the defense against this?

Like this was kind of, you know,

this was kind of a big story this

week.

Is there anything people can do?

Do you have any more thoughts that you

want to share?

Yeah, this was kind of our headline story,

and then the PHP thing happened,

so our headline still fits.

I kind of bumped it up.

A lot of things went wrong this week.

I think it kind of highlights the

importance of keeping updates and

defenses.

Again,

I'll go ahead and get on my soapbox.

I remember when Google started rolling out

AI stuff to the Android phone,

and a lot of people were like, oh,

I'm just not going to update my Android

to Android whatever.

And it's like, okay,

but that'll only work for so long.

After a while,

they're not going to be updated.

They're not going to be supported anymore.

And then there's things like this that

you're running the risk of.

And I mean, yeah,

most of it was like the browser, right?

So, you know,

keeping your browsers updated and stuff

like that.

But yeah,

Yeah, I mean, it really depends.

Again,

there's things other than the browser,

right?

Like we said, there's Linux distros,

there's Docker containers,

there's IoT devices.

I mean, some things,

I think that second story said some things

might never get updated because

IOT,

which actually that is another thing I

wrote down here is like,

make sure that you're buying devices that

get updated.

I've told this story before,

but when my wife and I moved in

together, I didn't even own a TV,

but she loves streaming.

She loves to watch shows and stuff.

And so the compromise we reached was we

would buy a smart TV,

but I got to pick the TV.

And at the time,

hopefully it's a little better now.

At the time,

there weren't really a lot of

manufacturers that would even update their

TVs.

So like,

It really wasn't that hard because I just

did my research on like, okay,

who doesn't have a camera?

Who doesn't have a microphone?

Who actually updates their crap?

Oh,

there's like four options or like two

options.

So yeah,

like try to get things that actually get

updates, which can be really hard to tell.

I know Kerry has mentioned in the past

that,

in his opinion, and I agree,

there should be laws where at very least

they have to tell you how long they're

going to support the product for or

something like that.

And then, of course,

I just obligatory have to throw it out

there.

You could just avoid smart devices if you

don't need them, right?

I mean...

I admit I bought a smart thermostat just

to try it out and see if it

brought enough value to my life that it

was worth it.

Not really.

It's okay.

It's kind of nice being able to check

on it.

And maybe like if I go to the

next town over to go see family and

then on the way home,

we can start the AC cooling off or

whatever.

Like, yeah, that's cool.

But I don't know.

To me, it wasn't really worth it.

Whenever it dies,

I'm probably not going to buy another one.

I'll just buy like a regular programmable

thermostat.

So I think that's about all I got.

And to viewers,

please share your favorite four memes in

the chat because I've seen some good ones

today.

And yeah, I'm with you.

That's probably the silver lining in all

this is all the four memes.

Yeah,

lots of memes about the internet literally

being on fire and about the number four.

Just lots of memes about the number four,

which has been kind of entertaining at

least.

At least we get some positive from such

an awful incident.

They want it to be the Danish ID

database with password one, two, three,

four, five, six.

Yeah, no, that was quite wild.

I do think we covered that at some

point.

But yeah, no,

that is kind of it for that story.

There's not really much to add like on

top of what happened.

It's kind of messed up.

They kind of did a really bad thing.

Things are trying to be fixed.

That's kind of it.

So yeah,

we could just dive into the next topic

here.

Yeah, for sure.

So our next topic is going to be

one of our forum discussions, which is,

does Google's plan for your digital legacy

actually delete your account?

So this came from a beginner on our

forum who said,

I'm de-Googling, but no matter what I do,

I can't delete my Google account.

I consistently get hit with the,

we couldn't verify it's you message and it

won't let me do anything.

So as a last resort,

I set up this plan for your digital

legacy option,

which supposedly deletes your account

after three months of inactivity.

It also lets trusted contacts download

your data, but I didn't add anyone.

Does this actually work?

And has anyone deleted their account this

way?

Um, so two people chimed in and said,

yes, I've tried it.

It works for me.

Um,

they did say to uh you know make

sure that you're totally signed out of

anything because if you're like if you're

signed into like an old android phone that

you forgot about every time it pings

google that's going to count as activity

and it's going to reset the timer so

um you know to be aware of stuff

like that but um yeah i think this

is kind of a quick one but the

the the big thing i thought was

interesting here was two things first of

all um thinking outside of the box right

like

Can't believe I need to say this.

Don't do anything illegal.

We're not telling you to break the law

and impersonate anybody,

but just kind of thinking outside the box.

If you're trying to delete data somewhere

and they're like, oh, we can't do that.

Sometimes they genuinely can't, right?

Like financial institutions have very

strict laws about they have to keep your

data for a certain number of years or

whatever.

But then there's other times.

I actually remember years ago,

I took one of my cats to the

vet and

They sent me a reminder that, oh,

it's time to get their physical done or

whatever.

And I wrote them back.

I was like, actually,

I've moved out of state,

so I'm not going to go back to

you guys anymore.

Can you please delete all my information?

And they were like, oh,

we can't do that because of state law,

blah, blah, blah, blah, blah.

And I'm like, it's a cat.

So I emailed them back.

I'm like, what state laws?

Where can I look into this more and

find out my rights?

And then they emailed me back and they're

like, we've deleted your data.

And I'm like,

ridiculous,

but that's not really thinking outside the

box, but just, you know,

it's the point of like,

sometimes you try to delete something and

people like push back on you and just

being able to think outside the box like

that and come up with creative solutions.

And the other thing that stuck out to

me is leveraging the community, you know,

and like I just mentioned, like, Hey,

I'm trying to delete this.

I've checked online.

I can't find any way to do it.

Does anybody have any ideas that again are

legal?

I want to stress that enough.

So yeah.

Yeah.

And I think I just wanted to throw

that over to viewers.

Like,

what's your favorite legal trick that

you've done to remove your data when you

have had a hard time?

Do you have anything to add to that

one, Jordan?

I mean, one trick I have used before,

I'm not exactly sure if it's...

I don't think it's illegal.

But, you know, I said, I'm a miner.

You can't process my information.

So you need to delete it.

And they did.

So...

It's a white lie, but, you know,

it's fine.

I think that's not technically illegal.

But, you know,

I think you've got to use different ways

to get people to respond, right?

I think people are much more concerned

about, you know,

possible regulatory breaches and things.

So, you know, if you can, like...

point at something that, like you said,

you know, oh, this is against, like,

state law or this is, like, you know,

against federal law or something,

they'll probably be a lot more likely to

cave and just do it than deal with

someone like you.

Also, just being really annoying as well,

you know, message them every day,

you know, just keep sending messages.

They will probably do it eventually if you

be persistent enough.

I think it's

It kind of depends on the actual service

that you're trying to get it removed.

But I do think that is like a

fun little trick for Google at least.

I will say you will probably have better

luck if you sign into a device and

leave it signed in for like a decent

amount of time and then you delete it.

Because I have had that issue before,

but it did go away eventually after I

left it logged in for...

I think probably like a month or two

and then it allowed me to delete it

myself.

So you might better try that too.

Um,

but usually Google is decent with allowing

you to delete your accounts and stuff.

So, um, good luck.

Yeah, I will say, um,

not that I disagree with you,

but as far as like the,

the be annoying part,

I'd say make that a last resort.

Um,

cause I see a lot of people in

the, uh,

I see a lot of people online go

straight to like the privacy.

Like I actually wrote a blog about it

last year.

Naomi Brockwell released that video where

she shared somebody,

like they ordered a guitar and they use

privacy.com and then it tripped the fraud

flags.

So the person called them and they're

like, yeah,

I just need to confirm some information.

And the person just went through this

whole, like was too honest.

to the point where they're like, oh,

that's a privacy.com card.

And oh,

that's just a name I made up.

And oh, that, that, and it's just like,

dude, just a little, like you said,

like a little white lie,

like something I've had a lot of success

with.

I think I've said this on the podcast

before is, you know, when you call,

when you're trying to find out the laws

for here in the U S for, um,

Some states will allow you to put like

a PO box on your driver's license instead

of your real address.

And when I call to ask them about

that,

instead of being the weirdo who's like,

I really care about my privacy and this,

that, and the other,

what I say is like,

my wife and I are thinking about becoming

digital nomads, which...

I mean,

if you want to be technical is not

a lie.

We've talked about it before.

Like, would we like to do that someday?

Maybe, you know, it's,

it's like just that little white lie of

like, yeah, we're thinking about it.

Like what's the laws on this?

How would we go about doing that?

And you know,

they'll tell you what your options are and

they're not going to treat you as some

weirdo if you just call in and you're

like,

I'm concerned about data brokers and they

don't care.

So, um, yeah,

sometimes like finding an excuse can be

helpful to make yourself sound a little

bit less insane.

Um,

Like Universe Middle Productions here

said,

it's like tell the bank your information

has been compromised and you want a new

card.

So yeah.

Unfortunately,

that one doesn't always work.

I've heard rumors now that a lot of

companies, when you get a new card,

they have some system for automatically

updating it in their end.

So the idea is that way you don't

have to go to all these different services

and update your subscriptions.

They just automatically get your new card

number.

But yeah,

it's also a real pain if it's like,

okay,

but they're not honoring my request to

cancel my subscription and that's what I'm

trying to do here.

yeah, I digress.

I think with that,

we can probably move into our last story

here about Celebrite,

unless you've got anything to add.

No, yeah,

let's dive into this last story here about

Celebrite.

But just a reminder to everyone,

if you have any questions,

drop them in the chat.

We'll try and get to them after this

story.

So this story here is from Justin.sh.

It's, is Celebrite sitting on a

an iPhone radio zero day.

Basically,

this person said they've obtained a

Celebrite document marked Confidential Two

that describes a breakthrough method to

provide AFU, which is after first unlock,

access to iPhone XI to XVI on iOS

XXVI to iOS XXVI.IV+.

with expanded coverage promised.

According to Celebrite,

this is a next generation after first

unlock vector that is more resilient to

Apple's OS changes.

It works with stolen device protection

enabled, which tightens USB restrictions.

It's enabled by a dedicated appliance with

a stated range of about eight meters.

Celebrite calls it Advanced Unlocks AU

from here on,

but not to be confused with the advanced

unlocking services they've marketed for

years.

A press release from earlier this year

confirms Advanced Unlocks is a new product

for twenty twenty six.

The document states from March twenty

twenty six last revised September

fifteenth conspicuous conspicuously

missing the iPhone seventeen

and Air,

and those have both been out for about

a year,

and the ATEM Pro wasn't even out yet.

So the author basically warns that the

rest of the blog is speculation,

but lays out a pretty compelling case for

why they believe that this is a

proximity-based radio capability based on

Bluetooth.

The post is free to read and not

overly technical,

so we do recommend digging into that if

you are curious to learn more.

So...

I guess kind of talking about this more.

So Apple quietly fixed a nasty

vulnerability reachable over the air in

iOS twenty six point five.

Yet they made no mention of it in

the security bulletin.

Sometimes they retroactively update the

bulletins or mention a patch without

crediting a researcher.

presumably because the issue was found

internally,

but they did neither of those for this

fix.

So why?

Why did they do that?

If they wanted to keep it hush-hush,

it worked.

They haven't found any public discussion

of these vulnerabilities or changes.

Despite their pedigree,

Celebrite now feels the need to establish

credibility

upfront as the average iPhone gets harder

to break.

Vague claims about unlocking iPhones stop

commanding attention.

Mainstay techniques like the checkmate

exploit in twenty nineteen are past their

shelf life in twenty twenty six.

Apple's hardening efforts are paying off.

Charging ports have historically been the

default vector for forensic tools,

but they've they're becoming less viable.

Attackers are becoming forced

onto less appealing paths?

Has the Bluetooth front now closed too?

Or are things just getting started?

Where will the next battle be fought?

So I guess first thing to mention,

this has already been fixed,

so make sure you patch to the latest

iOS version.

And I guess also kind of throwing it

back to you, Nate,

what can people do to protect against

these sort of radio attacks that Celebrite

is using?

Yeah, I mean,

it's all speculation and I really

appreciate that the author was upfront

about that.

I have said many times,

I'm not a programmer, I'm not a developer.

To me, this looked very sound.

I was able to read it and I

was able to follow along enough that I'm

like, okay, I see your logic.

I think this makes sense.

If they're telling the truth and it's a

Bluetooth thing,

then I would say the answer is just

to disable Bluetooth whenever you don't

need it.

I've actually started my little pine time

here,

which kind of makes it a little useless.

But I've kind of stopped using it for

notifications,

which I'm not too sad about.

Because to be honest,

that's the main reason I bought it

originally.

At my last job, I've

I mentioned this before in the past that

like a lot of the time I had

my hands full and my phone would start

ringing.

And I've actually in recent months,

I've started really taking advantage of

like the notification profiles,

which I should have done back then too.

But you know,

my phone would like start ringing or I'd

get a text message and I wouldn't know

if it was like an important message,

like for my wife or my project manager.

Cause I'm going to drop what I'm doing

and answer it if it's my wife at

work or if it was just like one

of my friends.

Right.

And so the pine time was a way

for me to easily look at it and

be like, oh, that can wait.

Let me finish what I'm doing.

Or I could look at it and be

like, oh crap, hold on.

I need a minute.

So, um, but anyways, yeah, like I've,

I've started turning that off when I go

out in public,

which now means it's literally just

telling the time and I do have to

sync it up every now and then for

updates and stuff.

But yeah.

You know,

one nice thing about Graphene is it has

that like auto off for Bluetooth.

If you, you know,

when I put my headphones away,

if I'm listening to headphones while I'm

cleaning the house or whatever,

and then I put them away in fifteen

minutes, thirty minutes,

whatever I set it to,

it's gonna shut off.

Or I guess driving is a better example.

Like, you know, I do use Android Auto,

I'll be totally honest.

Mostly just for music and stuff.

And then when I get to the store,

the Bluetooth will shut off.

I think I have it set really,

really short actually.

So by the time I get inside,

it'll shut off,

which is great because we've seen many,

many articles about how stores use

Bluetooth to track people.

And they're mostly doing it for analytics.

They want to know like, oh,

are people stopping at the display we set

up?

Are people congregating over here?

Are people having a hard time finding this

item?

Whatever.

But still,

I don't want to be tracked like that.

So it's great that I don't even have

to mess with the phone.

I just unplug it,

put it in my pocket.

And by the time I get in the

door,

Bluetooth is off and they can't track me

that way anymore.

Yeah, I mean,

Bluetooth is notoriously insecure.

I wanna say the new generations of

Bluetooth are starting to get more privacy

features built in, but there's still,

it's gonna take years for that to trickle

out in new devices.

And especially if you're not one of those

people who like buys a new phone every

year,

it's gonna take a while for that to

trickle out.

So for now your best bet is just

to avoid it whenever possible.

Universe Middle said geofencing.

Geofencing is something different.

That's when the cops will use your phone.

If your phone is signed into Google,

then they can tell Google, hey,

we want to know all the phones in

this area between this time and this time,

which I think some states have outlawed

that now,

but it's still kind of a legal gray

area.

Yeah.

But yeah,

I think we do recommend on the website

actually to put your phone in airplane

mode whenever you're on Wi-Fi for that

reason.

There's no point in pinging the cell

towers because you're already getting

Wi-Fi.

So I don't know.

I think that's all I got on that

one.

Yeah, no, that's all good points.

I think also to kind of bring it

back to the article itself, though,

there was one interesting thing that we

didn't really touch on.

That is, you know,

Apple's introduction of memory integrity

enforcement, which basically...

makes memory corruption bugs a lot harder

to exploit,

which it does cover the kernel and

userland processes like Bluetooth D.

So basically, you know, it seems like,

at least from this article,

devices that were using memory integrity

enforcement, so that was the XVII and up,

are not vulnerable to this sort of thing

because of that.

It could make, you know,

exploitation a lot more difficult.

So it is interesting.

When we see these changes from Apple,

it does actually impact things.

It does actually protect you against some

sort of... Again, this is theorized.

Obviously,

this person has never tested this or

anything,

but they've theorized that memory

integrity enforcement would basically...

cause this to be less effective on those

devices.

So I think that is quite an interesting

extra tidbit from that article that I did

find quite interesting.

So, you know,

these benefits to security are not just

like a minor thing.

They do actually stop exploits.

So that is pretty cool.

They also didn't mention anything about

lockdown mode.

So I do wonder about that as well.

But

it's always kind of left out of these

posts,

which is always kind of the weird thing

for me.

Does lockdown mode protect against this

sort of threat?

Would a device using lockdown mode,

stolen device protection,

and also memory integrity enforcement stop

these sort of attacks?

And I guess we won't really know,

at least for now,

but we'll definitely keep an eye on

everything that's going on with

Cellebrite.

Because we do try and keep people updated

on if their devices are exploitable by

this sort of stuff whenever we see leaks

from Cellebrite.

So interesting stuff.

Yeah, for sure.

I'm trying to load the lockdown mode page

right now, but my internet is being slow,

shocker.

Yeah, kind of related to what you said.

I thought his little, in this blog post,

his outro of, you know,

Like has the Bluetooth front now close to,

or things just getting started wherever

the next battlefront or battle be fought.

It's,

it is kind of cool to see devices

getting harder and harder, you know,

things like SQL injection.

Every time I see an SQL data breach

caused by an SQL injection, I'm just like,

bro, it's,

that shouldn't even be possible anymore.

Like all these things are just like,

things are becoming more secure over time

in, in some ways.

So it is pretty cool stuff.

Okay, here we go.

Let's see.

Yeah,

I'm not seeing anything about Bluetooth

here on the lockdown page.

No, there's no mention of Bluetooth.

That's crazy.

Huh.

I wonder why that is.

I wonder if it's too simple of a

technology to really harden in that sense

without just disabling it completely.

I think the way that lockdown mode would

protect against that is just by reducing

the attack surface of the device in

general.

A lot of times they use exploit chains,

they use multiple exploits in one to

basically gain access to a device.

you know,

reducing the attack surface so that one of

those exploits in a chain is impossible is

much more likely.

I would assume that this is more than

one vulnerability,

but I guess we don't really know because

Celebrite is pretty cagey about the

information.

The only reason why we're seeing this is

because someone managed to find a leaked

Celebrite document marked confidential.

So...

Every time we get these sort of leaks,

it's always super interesting.

And it does bring up all those questions.

Does lockdown mode protect us?

Does this involve multiple

vulnerabilities?

We don't really know.

So it's always interesting when that

happens.

I actually realized I didn't even look at

the...

at the little attachment here.

I'm scanning it a little bit now.

I mean, it's Marketing Solutions,

so you can't always depend on it too

much.

Marketing will say anything.

Yeah, I mean,

Universe Middle says use RFID bags.

The thing is, like,

that's not always feasible for everyone,

right?

Like, if I'm going to the grocery store,

I can't... Like,

if I'm just going to put my phone

in an RFID bag,

then I should just leave my phone at

home, in my opinion.

Because, you know,

if I'm taking it to the store...

Like I said,

I'm listening to music on the way to

the store.

My grocery list tends to be in the

phone, which granted, you know, yeah,

I could just write it down in a

physical list.

And also sometimes like there's very

specific, like, you know,

it happens both me and my wife,

whichever one of us goes,

one of us will have to call the

other person and be like, Hey,

do we still need bread?

Or did you just forget to take that

out of the list?

Or like, Hey,

they don't have like this thing.

Do you want something else instead?

Or like how many of this thing do

you need?

So I don't know.

It's, it's,

It would be nice,

but it's a little bit overkill in a

lot of cases, I think.

It's not practical for everybody in all

situations, but I digress.

It's just interesting to know that this

stuff is out there and how it's growing.

But yeah,

I think that was our last story.

Cool.

Yeah, no,

I think coming back to what you said

about like, you know,

taking your phone to the grocery store,

I think we should,

we should definitely think a little bit

more about like, you know,

what's your threat model?

What are you trying to protect against?

Like, you know,

there's probably cameras everywhere when

you're going to the grocery store,

they're probably seeing where you're

going.

You know, like,

I'm not really sure that that would be,

that would make a huge amount of sense,

especially if you're not like wearing

really, you know,

anonymizing clothing.

I'm like, you know,

I'm not sure if that would be,

you know, I know they're joking.

They did like the joy emoji, but like,

yeah,

I think it is important to think about,

you know,

what you're trying to protect and if

that's actually worth doing in that

instance.

We did get some comments from Lily Smith

on Twitter saying,

They said, hi, I'm new here.

Hello.

We don't really usually get comments from

Twitter.

So that's nice.

We also got a comment from ILI,

a lot of ILI eyes on Twitch.

Good evening.

Thanks for streaming here.

Yeah, we do stream on Twitch.

Not sure.

We usually don't have too many people

watching on Twitch.

So welcome.

Yeah, that's pretty cool.

All righty.

Well,

I guess if nobody has any further

questions, thoughts,

then we can start wrapping things up.

Actually, let me check.

Somebody asked on the forum if we can

bridge messages across platforms.

I don't think we would do that on

the forum because we generally try to

protect user privacy on the forum,

even though I know it's publicly visible

and whatnot.

But we try not to record it in

a video format.

But I don't know.

I guess that's a Jonah question.

Yeah, definitely.

I guess we can dive into the outro

here, though.

Oh, my username is a red bull blocker.

I love it.

I'm more of a monster rehab guy,

but I'll take it.

Yeah.

All right.

Yeah.

On that note,

do you want to take the outro or

you want me to?

We always forget to discuss who's going to

take the outro.

I guess I'll take the outro.

All the updates from this week in privacy

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

We also offer a podcast available on all

platforms and RSS.

which now includes a video on supported

platforms.

And this video will also be synced to

PeerTube.

Privacy Guides is a impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

then you can make a donation on our

website at

http privacyguides.org donate you can make

a donation on any page on the website

by clicking the red heart icon located in

the top right hand corner of the page

you can contribute using standard fiat

currency via debit or credit card or opt

to donate anonymously

using Monero or your favorite

cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content,

exclusive video content,

and priority during the This Week in

Privacy livestream Q&A.

You'll also get a cool badge on your

profile in the Privacy Guides forum and

the warm fuzzy feeling of supporting

independent media.

Thanks for watching and we will see you

next week.

Bye.