This week's surveillance report covers a brutal stretch of Microsoft's vulnerabilities,
so all of you Linux users who've tuned in the last couple weeks can rejoice because it's Microsoft's turn.
There's a supply chain attack wave on open source software.
Signal has threatened to leave Canada over some encryption stuff.
Meta has this new AI-powered technology that targets underage users.
There's definitely some eyebrow raisers for you Bitwarden users listening to this podcast,
plus our usual data breaches, threats, and FOSS updates.
Welcome, everybody, to the Techlore Surveillance Report.
your essential weekly tech news, delivering deep analysis on the latest threats to security,
privacy, and digital freedom, and empowering you to reclaim control and defend your rights.
Now, before I get into the seven Microsoft stories this week, I know, crazy, just a quick
little announcement. I've done a little bit of fresh branding for surveillance reports,
so you might see some from some different stuff. I think it looks fresh. Let me know what you guys
think. All right, now this has been a crazy week for Microsoft. So I just want to kind of set the
seen here, which is the last couple weeks have been quite difficult on the Linux world because
we've had all of these exploits in the Linux side of things. There's a Microsoft Exchange server
spoofing vulnerability. So this occurs when an improper neutralization of input during web page
generation or a cross-site scripting attack enables an attacker to perform spoofing over the network.
All it takes to exploit this is to send a maliciously crafted email, which when opened in
Outlook Web Access can execute arbitrary JavaScript in the context of the browser.
Now, when this was announced, it was actually a zero day that hadn't been patched yet and didn't
make it into Patch Tuesday. At the time of recording, Microsoft has put forward an emergency
mitigation process that they recommend for this critical vulnerability. Now, if that was it for
Microsoft, this wouldn't be the highlight story. So we have a lot more, and these all tie together.
Because last week we talked about how there is a disgruntled security researcher, hacker, zero-day finder.
I don't know what their formal classification is.
But this is chaotic eclipse or nightmare eclipse, again, depending on the time of day.
They delivered on their promise when we talked about this last week.
Because last week they put forward some zero days and they were quite disgruntled about how Microsoft was handling their bug report process.
and they felt like they were wronged by Microsoft.
And so they said,
we're going to keep finding zero days and publishing them.
So this is called Mini Plasma
and it lets attackers gain system privileges
on fully patched Windows systems.
I don't know if they can fully claim
that they were the discoverer slash original author of this
because it's the same exact issue
that was reported to Microsoft by Google Project Zero in 2020,
which is still present unpatched.
In fact, the original proof of concept by Google
worked without any changes, they said. So I think they might have made some changes beyond that
original proof of concept. But the reality is the original proof of concept also still worked from
Google. So Google actually reported this to Microsoft originally, and Microsoft just chose
to ignore it for six years. Now, if you are curious on prevention tips, as always, all of these sources
are in the description. And as you can see on screen, or if you're an audio listener, you can
click into the show notes. There are ways that you can check to see and detect if you've been
exploited by this. But really, all of this is a Trojan horse for the story behind this individual,
right? Like, even Bleeping Computer, I think the lead leads into what's actually going on here,
which is this person, you know, they had Blue Hammer, they had Red Sun, they had Undefend,
they had Yellow Key and Green Plasma, which we covered last week, which was the BitLocker
bypass that we talked about. And now we have Chaotic Eclipse, you know, putting out this
brand new one. And they said, quote, normally, I would go through the process of begging them to
fix a bug. But to summarize, I was told personally by them that they will ruin my life, and they did.
They mopped the floor with me and pulled every childish game they could. It was so bad at some
point. I was wondering if I was dealing with a massive corporation or someone who was just having
fun seeing me suffer. But it seems to be a collective decision. So yeah, I guess this is
very interesting. Personally, on my end, I would love to see kind of like what these communications
looked like and why and how they felt they were wrong. I would be curious to look at it. But yeah,
this person's upset. But that's not even it. Because this last week, there is a very major
event that happens, I believe annually, which is called Pwn2Own, which happens in Berlin.
Pretty much a ton of researchers and hackers get together, and they just try to break things.
And as you could expect, there were a lot of exploits for just common pieces of software.
We have Apple Safari was in here, Red Hat Enterprise Linux for Workstation,
LM Studio, OpenAI Codex, Anthropic Cloud Code, Mozilla Firefox even.
But of course, on that list was Microsoft SharePoint, Microsoft Exchange, Windows 11.
But yeah, that's just one more thing this week that put Microsoft on the map for these vulnerabilities
and potentially some issues in how they're dealing with them.
But that's not all, because yesterday there is a report put out.
It is a sponsored piece from Bleeping Computer.
It's from this company called Beyond Trust.
They did this little report.
pretty much found that Microsoft's vulnerabilities actually fell last year.
The previous year, which I believe is 2024, would have been 1,360 vulnerabilities.
But last year, it was 1,273 vulnerabilities.
So it actually went down.
But the nuance to this is actually the critical vulnerabilities went up.
In 2024, it was 78.
And last year is 157, which is double.
But that's not all.
Because there's another kind of questionable situation that's hard to make sense of.
It's hard to know who's telling the truth or what's going on.
But there was a Microsoft Azure vulnerability that came out.
And a security researcher claims they quietly fixed this,
but they said they never cared and they didn't want to fix it.
So pretty much, this is a bit confusing,
but there was this vulnerability with Microsoft Azure.
This person came forward and they reported the vulnerability.
Microsoft said, this isn't a vulnerability.
We're not going to make any changes to this.
But the researcher came forward and said,
hey, now this requires trusted access to be manually configured,
and this actually fixes the original problem that I put forward.
So the vulnerability appears to have been fixed,
but Microsoft didn't issue a public advisory,
nor did they notify their customers about it.
This one seems a little bit more of a structural problem.
In fact, Bleeping Computer at the end talks about how,
because this didn't get a CVE or an advisory,
there's very little visibility into the exposure window,
and so it's really difficult to actually make sense of these things
and going back and forth with them.
People are complaining and saying that maybe this has to do with AI spamming these bug and security research programs.
And so it's making it harder for companies to keep up with this.
It's really hard to know what's going on, but there does seem to be this overwhelming pattern of companies maybe having shorter fuses for security researchers, which is a problem.
Now, before I get into the takeaways, I did want to say it wasn't all bad news for Microsoft.
This is actually an update from a story we covered a few weeks ago in the podcast,
because we covered how Microsoft Edge is the only Chromium-based browser
that loaded your passwords into your RAM in plain text,
so any other piece of software could have accessed it.
In fact, I even called this directly kind of a lack of care for defense in depth
and thinking about security outside of just what you're maybe responsible for at the bare minimum.
Well, it's kind of cool because Microsoft actually patched this.
I mean, it should have never been an issue in the first place, but they did patch it,
and they said, quote,
This defense and depth change will come to every supported version of Edge, including stable, beta, dev, canary.
With the extended stable channel, our enterprise customers run, and we're prioritizing the rollout.
So they are getting that issue fixed, which is good because, again, I think it was just sloppy and lazy.
And I'm glad they changed their mind on it.
And yeah, they backpedaled, but in a good way.
So there's a lot of stuff going on here, right?
We've been covering these Linux vulnerabilities.
And, you know, just to start off, I think the issue with the Linux vulnerabilities in general is that there's so much just messiness
because you have all these different Linux distributions.
You have the Linux kernel itself,
which has tons of different people who are managing it.
It's not like one person controls the Linux kernel.
And so you have these natural downstream effects
when we get these exploits.
And you have these families of exploits
that are all quite similar in nature,
but they work slightly differently.
And then you have to try to track which distro does what.
And I'm really sorry for you all
because I got some comments.
Some people were like,
Arch hasn't had any public communication about this.
They haven't fixed any of these issues.
But then when I checked their site and I looked for the CV reports on Arch's website, they actually had one or two of them fixed, but maybe not the third one.
And so this puts so much burden on all of you who are just trying to use Linux individually to have to know if you're on patched or unpatched software, which I don't think it should be your responsibility to do that.
And so that is kind of the Linux side of things.
But I think that is, for most people, a fair tradeoff maybe for getting that open ecosystem.
You're running open software, run by people, run by a community, and you don't have to deal with a company that doesn't care about you.
Now, Microsoft is quite unique here because you're actually still getting a lot of that experience, but through a centralized company that should know what the hell they're doing.
Microsoft is coming forward.
They're backpedaling on what they're considering a security issue and what's not a security issue.
They're pissing off researchers.
They are getting caught with all these vulnerabilities left and right.
It seems unclear and it doesn't seem like they internally have a clear process on what they're deciding to prioritize and fix first over something else.
It just seems like a mess back there.
Honestly, you're getting kind of the worst of all worlds right now with Microsoft because I don't think they're really handling these situations in a way that really showcases leadership, that showcases care for users, care for the user experience.
Not that we'd expect anything different given Microsoft's history these last few years.
I mean, everything they do seems to be anti-user.
So this is tough, man. It's really tough to back this up. It's really tough to not look at these situations and make me go, I don't know why someone would put faith in Microsoft right now for this kind of stuff unless they absolutely needed to use Windows operating system.
So that's Microsoft's week. And just to top it off, a couple days ago, there were actually install issues for the security update. Like people were getting errors like insufficient free space, errors 0x70. So even if you have been on top of your updates, apparently people were still having issues installing those security updates.
It's like everything Microsoft has neglected the last five years is finally coming to a
peak right now.
Like all the resources they poured into AI slop that nobody cares about that could have been
directed towards a more polished user experience, fixing update issues, fixing bugs.
They refuse to do.
And now we're kind of seeing what this actually looks like.
And the pieces of duct tape holding this operating system together and everything on top of it
is kind of falling down a little bit.
And it's nice that we can get Linux out of the spotlight and we can put Microsoft back
in that spotlight.
All right, enough about Microsoft for now. I think we have another couple stories about them later,
but let's move on. So we actually have something quite fascinating here, which is a supply chain
campaign. It's a lot of work to break into a piece of software. And that's a lot of time and
investment. And if you're an attacker, you have to put a lot of resources into figuring out an
exploit for something, figuring out the best way to mass exploit it if you're trying to
reach a lot of people. And you have to do that per piece of software. But sometimes we get these
attacks that are a little bit more interesting because what they're going to be doing is they
target the supply chain. So in this case, libraries for charting, graph visualization,
building flowcharts, and mapping. But popular packages outside of that have also been compromised.
So this is called Shai Halud. I don't know how to say that. So it's S-H-A-I-H-U-L-D,
pretty much they've published 639 malicious versions
across 333 packages in about one hour.
So this compromised the NPM account called Atool,
A-T-O-O-L,
which publishes packages in the AntV namespace.
So impacted libraries are things like G2, G6, X6, L7,
G2 Plot, Graphen, TimeAgo.js, SizeSensor, CanvasNest.js,
and it's probably a lot of other random things
that just sound like random mumbo-jumbo.
But I'll talk about why this matters in a second.
So it's targeting developers and their development workflows.
And it's going after things like SSH credentials, database credentials, Docker, vaults, etc.
Now, the good news is that this probably doesn't impact most of you out there.
But if you're a developer, this is something you really should take a look at because you could just accidentally be using this and you don't even know it.
So if you downloaded any of these infected NPM packages, you should remove or downgrade to a known good version before May 18th.
and then revoke and rotate all exposed credentials
because things like SSH keys, et cetera, could be jeopardized.
Now, there is one takeaway that I think does apply to all of you out there.
And I think Bleeping Computer maybe kind of hinted at this,
but TechCrunch was a bit more direct.
Hackers took over the account of one developer
and released all of these packages, right?
So this is just my reminder that regardless of where you get software from,
you typically always have to trust that whoever published the update authorized that update.
So even if you're getting your software from GitHub or even from somebody's website,
there's always that small, slim possibility that maybe their device,
the developer who publishes your software's device was compromised to put out a bad update.
Or maybe they just had weak credentials on their account and somebody logged into their account
and figured out a way to break into their account.
Now, this isn't to just create fear and panic, but it's something that I think everybody should be intentional about and think about.
And I think this is where you might see a place for some kind of middle person to help be an additional point of reference and, you know, someone to validate the update and nothing crazy in it.
Right. This is where we see FDroid's approval process actually really work in favor of you as the user, because when you get crazy things, I think a good example of this is Simple Mobile Tools.
Simple Mobile Tools was this Android ecosystem that's meant to replace the stock apps with open source apps.
And it was very popular on F-Droid.
But they got bought out and they pushed out updates that started including ad and trackers and all these crazy things in there.
And it never made it to the F-Droid store because F-Droid actually takes all the packages, analyzes them, makes sure that they're not doing anything shady.
And then it puts it on the store for you.
This is all to say when you're getting things direct from a developer, there are lots of freedom benefits that come along with that.
And I also get a lot of my software directly from developers as well.
I don't think it's a common issue, but I know some of you might be more sensitive to this kind of stuff.
So I just wanted to shine a light on it.
All right, coming soon, we have Meta to use AI visual analysis to detect underage users.
and we have Bitwarden quietly changing some things that are worrying a lot of people.
But before we get there, I had to just do some digging to find a non-paywalled version of this
article. So you're going to find an archived version in the show notes for this. But Signal
is threatening to pull out of Canada. Now Signal's an open source and an encrypted messenger.
And you might be wondering what the hell's going on. I thought that this is a safe platform. What's
happening? And so let's talk about it. So pretty much Canada has put forward a bill called Bill
22. Now this is being proposed as something called lawful access legislation, which if you listen to
this podcast, you know is a very subtle way of saying we want to access things that are encrypted.
So Signal's vice president pretty much said we would rather pull out of the country than be
compelled to compromise on the privacy promises we have made to our users. Pretty much they're
saying this could threaten encryption. It could also make private messaging services a potential
target for cyber attacks. So this is something that can impact your security as well. When your
encryption is at stake there and there's a way to break it, it makes it possible to break for
everybody. There's no way to selectively break encryption for just one or two people. But it
doesn't just impact messengers because this bill requires telecom providers, internet companies,
and other electronic service providers to make changes to their systems to give surveillance
capabilities to police and the Canadian Security Intelligence Service to combat threats and
criminal activity. I think what's quite interesting about this is these providers specifically like
telecom providers, internet companies, they already collect so much data. And it's already,
based on my understanding, quite easy to access. So I think it's quite interesting how they're
trying to get more. This is one of those situations where sometimes the companies
are on the right side of things, even gasp meta. But Apple and meta have also spoken publicly about
Bill C-22. And they also are saying this is not something we agree with. This could be really bad
for encryption, not just for Canada, but broadly, right? This is forced metadata collection for
messaging apps and could put encryption services in jeopardy because this is, and this is,
they say it right here, encrypted communication systems are a lifeline for human rights defenders,
journalists, and dissidents around the world.
So this is very important stuff.
It's not just about Signal.
It's not just about WhatsApp.
It's not just about this.
It's about your basic right to be able to communicate privately in the digital age,
which still is possible right now, right?
Like when you're using any of these end-to-end encrypted messengers, something like Signal
session, SimpleX, etc. You are actually trying your best to recreate what a private conversation
in your home with your family looks like in the digital era. And the fact that we have developed
that technology is incredible. And the fact that they're trying to poke holes in that,
so that, oh yeah, we'll just poke holes in your door so at any point we can kind of try to listen
in. That's not reassuring. That still makes it less safe. That means anybody can go and try to
listen into your conversations if you have a hole in your wall. And so we need to be very careful
with this. We've seen lots of countries try to come forward and propose these kind of,
they say it's encryption neutral. That's a direct quote from one of the politicians in Canada.
This is encryption neutral. But again, we've talked about this concept that data about data,
aka metadata, is just as important as the encryption itself. So whether or not this
actually targets encryption natively, if it starts requiring more metadata collection from these
services, it's still a huge problem for users. Right now, all Signal collects about its users
is when they first created their account and when they last logged in. And so if now they're forced
to start collecting who's talking to who all the time, at what time, on which devices, from which
IP addresses, now it's really easy to see exactly what's going on inside of this network. And the
bigger kind of global picture of this, if you're not based out of Canada, is that if this starts
getting passed in Canada, it's going to leak into other countries. This is why so many people are
coming forward and going, we need to stop this right now. We just cannot have this become a thing,
right? Like if a big massive, if a major country pushes this forward, gets it through and they get
away with it, now they've set precedent for other countries to follow. And so even if you're not
Canadian, this is a fight that you should still be a part of. Share this around with people you know,
talk about it because a lot of people don't understand the way that these bills are put
forward sound really noble and they sound like they make a lot of sense and it's they they they
cover issues that everybody can get behind like keeping children safe stopping criminals but there
are some very nasty uh side effects that these politicians do or don't intentionally have as part
of those of those bills and those laws all right coming up in just a second we have meta who is
trying to analyze underage people using ai and we also have some questionable things out of bitward
But I quickly wanted to showcase our sponsor. If you've ever looked yourself up on people searching sites and you've seen your home address sitting there for anyone to grab, that is the data broker industry happening behind the scenes. And today's sponsor is really one of the few, if not the only removal service that I actually trust to do something about it. And it's what I personally use, Easy Optouts.
Here's the thing. There's a lot of these services out there that claim to do this, but they are actually consumer reports verified. They ran a four-month study across 13 services, most of them drastically underperformed and really overmarketed what their services can provide. But Easy Optouts tied essentially with Optory, but Easy Optouts does it for an honest price for only $20 a year. For some services, that's what they charge per month. They're a small transparent team. There's no VC backing. The founder is reachable. They don't have a data side hustle funding the cheap pricing.
And they also have business plans.
They're really wonderful to work with.
I genuinely don't have a better recommendation
when people in my life ask me
what they can do about these services
in an automated way
and they don't want to go through the manual route,
which takes a lot of work and maintenance.
I always tell them easy opt-outs.
That's genuinely what I recommend
to my friends and family.
And so if you've been putting off
that data broker cleanup
because the services were too expensive
or too sketchy,
easy opt-out solves kind of both of those issues.
Links are in the show notes
if you want to check them out.
They are a wonderful service
and I wholeheartedly recommend them.
and now back to the show we're going to talk about meta who is continually doing interesting things so
meta is on a mission this is from tudor to ramp up its underage enforcement measures now the way
this works is it analyzes photos and it tries to calculate bone structure height visual cues etc
of every single photo that's published on the platform but they come forward and say this is
not facial recognition. Our AI looks at general themes and visual cues of your face to recognize
what age you might be, but it's not facial recognition. And now, you know, in Meta's defense,
this is actually a downstream impact of something broader, which is age verification, right? We see
this age verification technology put forward by these politicians. We've been covering it nonstop
the last year. It's happening all around the world. And all of these platforms are having to respond
in some way, shape, or form to try to deal with this problem.
And here's the thing.
This is what politicians created.
If I was meta and there is now laws being passed
that would hold me personally liable
if I allowed teens on my platform
that bypassed the age verification checks,
which were also mandated by those same exact politicians,
I would be probably throwing everything I can
to try to make sure that there wasn't a situation
where a kid bypassed it.
And then if something happened to that kid
as a result of my own platform,
now I'm being held legally liable
could be sued for millions of dollars. So I actually see this as a failure of, yes, meta
is being meta. We don't have high expectations for meta. This is just what we'd expect them to do.
But I actually think this is a direct downstream effect, a direct result of what these politicians
have been putting forward as what's designed to keep children safe. They're now introducing more
surveillance technology and they're trying to solve this problem with more technology instead
of just treating it like an actual human problem that it's actually designed to be.
I have serious issues with how we have these kind of ideas of how to keep children safe
online when really what we need to do is create safer environments for children to exist where
they've always existed.
I don't think that this idea of keeping children away from social media platforms is going
to work.
It's where kids are.
It's where we now socialize.
It's where technology is.
This is how we communicate as humans.
And we're penalizing kids.
We're penalizing adults by implementing all these new surveillance technologies when really
What we need to do is tell Meta they can't have addictive platforms.
We need to reel in these algorithms.
We need to actually have real accountability for these companies that know full well that
they're harming children.
We have actual court cases where it's been proven and demonstrated and Meta literally
lost, as well as other big tech companies.
These cases that show that they were exploitive and addictive to kids.
So why we're not regulating that and instead we're just trying to keep children off the
platform and then we're just letting adults join these platforms anyway, which have been
shown to be dangerous?
I don't know. This makes no sense to me. And so yes, Meta is doing this. Meta, of course,
is doing it in a privacy invasive way because they don't care about privacy. But I actually
don't think this is fully their fault. I think the politicians are putting them in a position
where they're like, well, I guess we got to roll out more surveillance technology to deal with
this problem. And I'm convinced the people who are going to actually suffer from all of this
legislation that's being passed, which I think is lazy legislation all around the world, which is
this age assurance technology and this age assurance push, the people who are going to suffer are
going to be you and me and the kids, right? Like we're going to have to deal with all this new
surveillance technology. We're going to have to deal with uploading our ID to these platforms and
trusting that they're going to be handling that safely. We're going to have to deal with this
internet now where you can't just access information and you have to upload your identity in order to
access things. And things aren't just open and public. We're going to have to deal with a world
where if you have children, they're going to have to bug you every 10 minutes just to be able to
tinker online and be able to break things and build things and become engineers someday.
Like, this is the world that we're going to move towards if these politicians don't actually try to fix things from a systemic level.
All right, we have one more story before we get into the data breaches, threats, and the open source updates.
And I guess technically this one's kind of an open source update, but it's a major enough story that I wanted to put it here in the major story section.
But many of you probably use Bitwarden.
It's open source.
It's free.
It's a password manager.
I like them a lot.
Our community likes them a lot.
They're in our resources.
I just had one of their team members on for an interview not that long ago on Techlore Talks,
which is our sister podcast.
If you want to check out that podcast, check it out.
I interview tons of people in the space.
And so this caught a lot of people off guard, including myself.
But there are some interesting flags going up right now from Bitwarden.
First is they've had a quiet shift in leadership and messaging.
Their longtime CEO and CFO stepped down and the company removed,
always free from their prominent password manager page
and replaced inclusion and transparency with innovation and trust.
I think this is really bad timing when all this is happening
because we just had OnePassword do some pricing changes.
OnePassword is a proprietary, very popular password manager,
and they changed all their prices around, right?
And it got a lot of people worked up looking for alternatives,
which were things like Bitwarden.
And so a lot of people, they just inherited this whole community
of people looking to them as kind of this leader
of good quality personal password managers.
And I think this is setting off some alarms, right?
For the record, nothing has happened yet.
No pricing changes have happened.
I don't want us to rush ahead with the speculation,
but I think these are legitimate signals.
They're things to look at.
They're things to watch out for.
For the last several years,
they brought on some VC funding
and people expressed some concern.
And now we kind of see more of those downstream concerns
maybe sprouting, right?
The seeds of doubt have maybe begun to sprout just a little bit, and we can start to see what the direction of this company looks like in the future.
So I'm curious to watch.
I really hope that they still stay very pro end user.
They still keep their free plan.
They still remain a good option.
We need to have accessible free password managers for people, right?
Otherwise, people are just going to stay with Apple passwords or their browser's password manager, and we're going to run out of options for people to get started and dip their toes into password management.
I don't think everybody should just be using the Bitwarden free plan, but I think the Bitwarden
free plan was a really, really good entryway for a lot of people to start using their first
password manager, realize, oh, I actually want some more of the paid features. And then now
they're using password managers. And down the road, they might use KeyPass, they might use ProtonPass,
whatever. And so if this goes a negative direction, this could be a big loss. So I'm going to be
watching this closely. I'm really curious for your guys' thoughts, especially if you're Bitwarden
users. I know a lot of you listening to this podcast use Bitwarden. So let me know what you
think in the comments, whether that's on Spotify or YouTube or wherever you can leave comments
nowadays. And we can dive into the defense bulletin. Again, last week, we started a new system
where the defense bulletin has three sections. We have the data breaches, we have the threats,
and then we have the open source updates, the open source, the FOSS section, which you all asked for.
So I will say too, being back here, I got a lot of comments from the last several months
that people wanted the FOSS section back.
And so when I added it back, I was like, man, people are going to be really excited for this.
I don't think I saw a single comment about it.
And so that made me a little sad.
It's also helpful to know if you guys actually liked something too,
because then I know if it worked.
Otherwise, I'm like, was it just three people complaining for a few months and no one actually cares?
So let me know.
I'd be curious if you guys actually liked the new system.
Now, we're going to start with New York City Health and Hospitals that say that hackers stole medical data and fingerprints during a breach affecting at least 1.8 million people.
And so if you're part of this NYCHHC, which is a public health system in the U.S., make sure to look into this to see if you were impacted and what your next steps are.
We also had a hotel check-in system that left a million passports and driver's licenses open for anyone to see.
This is through a company called Tabiq, T-A-B-I-Q.
It's a Japan-based tech startup.
And pretty much they found that any hotel using this system was exposed.
And we actually haven't seen this in a long time,
but it's because it was a publicly available Amazon storage bucket.
So this used to be a common joke on the podcast.
When Nate was on the podcast, we would do this whole thing of like take a shot
because these were like three times a week types of stories
where it was an Amazon storage bucket that was publicly exposed.
So I haven't seen one of these in a while,
But it's good to have a little throwback to the good old days.
All right, 7-Eleven has confirmed a data breach claimed by the Shiny Hunters gang.
This is a convenience store here, at least in the U.S.
Oh, but it says 86,000 stores globally, so it's not just the U.S.
Now, they sent breach notifications to affected individuals on May 1st.
And so you probably already heard about this if it happened to you.
And if you do think you might be caught in this breach, definitely check out the show notes.
We have three more data breaches.
The first is from West Pharmaceutical Services that disclosed it was a target of a cyber attack
that resulted in data exfiltration and system encryption.
It was on May 4th.
And there's actually very little information about this so far.
They're currently doing investigations and stuff.
So make sure to stay subscribed and we might have updates for you.
This next story was interesting.
I'm trying my best to make sense of it.
But there's an open source tool called Grafana Labs.
Grafana Labs. Grafana Labs.
I'm going to say Grafana Labs.
It's an open source tool.
But apparently some attacker attempted to blackmail them.
demanding payment to prevent the release of their code base.
But again, they're open source.
So the code is open source and public.
They compromise their GitHub environment.
And so I'm a little bit lost on the downstream impacts of this.
The company said they invalidated a token,
added additional security measures, and I think that's it.
So this was kind of a silly thing, I think,
for maybe the attacker as a target,
or maybe they did something silly once they broke into it.
But I just thought it was an interesting story
and I wanted to share it along.
And up next, this is the headline from Ars Technica, not from me, but it's called,
In Stunning Display of Stupid, Secret Siza Credentials Found in Public GitHub Repo.
This repo is called Private Siza, which included plain text passwords, SSH private keys, tokens,
and other sensitive Siza assets.
And it was just available publicly.
And they pretty much said it's not the first time Siza screwed up.
It's not even the first time this year.
And they cover a lot of your other stories from Siza messing up.
So pretty embarrassing, actually.
I would be quite embarrassed if I was Siza right now.
If you use WordPress, there's a new plugin.
We see these quite frequently, but it's called Burst Statistics, and there's a vulnerability
there.
So if you're using it on your WordPress site, make sure to look into this.
We also have a plugin called Funnel Builder, which is also a WordPress thing, and that also
had a vulnerability that you should try to patch up.
But that's not at all, because we have a third one called Avada Builder, which is also a
plugin for WordPress, and that is something else that you should look into.
Earlier in the podcast, I talked about how there's a lot of trust in the software that's pushed to your devices.
And at any point, someone could jeopardize a developer's account.
Well, here's a good example of that.
Because there's the Wii U emulator called Simu.
And they hit version 2.6.
But the Linux version was compromised by a Russian threat actor for literally a whole week.
This was their AppImage and Ubuntu zip assets.
And any of you who ran these Linux binaries between May 6th and May 12th,
They literally recommend a clean operating system install.
At minimum, delete the compromised binaries and reset all passwords, GitHub tokens, SSH keys, and any other credentials.
But honestly, you should just reinstall your operating system.
There are some more instructions here on mitigations, but this is really bad.
And again, it's a reminder that you really need to trust where you're getting your software from.
There was another vulnerability in NGINX, which pretty much allowed a DOS attack.
And it's a potential RCE.
It's a remote code execution from a very old vulnerability.
So if you want to learn more about that, check out the show notes.
This is a quick signal boost for a story from Wired,
which talks about this underground ecosystem
where criminals are trying to break into iPhones
and then they do phishing attacks against the people's contacts
from those unlocked devices to get access to bank accounts, more, etc.
And so this has to do with stolen iPhones.
This is more of a real-world attack where your device gets stolen
and then bad things happen.
And so if you want to learn more about this,
it didn't quite make a major story this week,
but I wanted to still call attention to it.
So you can find more in the show notes.
Interpol had Operation Rams, which has seized 53 malware and phishing servers.
This also included 200 individuals who were arrested.
And so if you want to keep up with more of the law enforcement side of things, check out the show notes.
FBI is now seeking $36 million for nationwide access to automated license plate reader data.
It seems like they're very much targeting Flock or similar companies here for that kind of technology.
So it's more of a signal boost for that what's going on.
And these last three stories in the threat section before we get into the open source section actually has to do with macOS.
So the first one is from Anthropics Mythos, which has helped build a working macOS exploit in five days.
Now, this vulnerability runs a command as a standard user to gain root administrator access to the machine.
There isn't that much information on this attack because they're waiting for Apple to ship the fix for this first.
So maybe we're going to learn more as that comes out.
But that wasn't the only thing because there was a macOS Info Stealer variant, which spoofs Apple security updates.
Pretty much there's a malicious Apple script you download, you run it, and then it tries to pretty much fake you out into downloading an update that you don't need that is malicious.
And so if you want to learn more about this, check out the show notes.
This is something you have to intentionally install, but some people might accidentally do it.
That's what they're counting on.
And the last thread of the week, which also impacts macOS, comes from Misk, who does a lot of security research.
and this is a critical vulnerability.
And they actually break macOS app sandboxing data containers
using archive utility.
For those who don't know,
this is the default compression utility in macOS.
If you ever click compress
or you uncompress something in macOS,
you are actually using this.
So a lot of people don't even realize they're using it.
The summary that they put here for non-technical readers,
which I'm just going to read out,
and it's a really nice feature of this,
the way they wrote this.
I wish more people did that.
They found a security issue in macOS 26.4.
If they trick you into running their code
and dragging and dropping one specific file.
They can read private app data,
including notes, messages, WhatsApp, or Safari.
They can access files in place you expect to be private,
such as your desktop, documents, folders, etc.
And they can secretly replace trusted apps
you already have installed with malicious versions.
All this can happen without your Mac's password
or any special approval.
The attack bypasses macOS security protections
by taking advantage of a bug
in the macOS built-in archive utility.
So if you want to learn more about how this works,
the app sandbox, how this works under the hood,
definitely check out the show notes. We couldn't really cover it with the time restrictions today,
but it's a really interesting attack. Okay, without further ado, we are in the open source
section. So let's talk about it. I want to start by showcasing the Free Software Foundation of
Europe. They just put out an article about the DMA, which is the Digital Markets Act.
This is pretty much them going after these big tech providers who are trying to control the
internet. They are now intervening against Apple before European Court of Justice for the second
time, pretty much trying to say, hey, Apple isn't actually complying with the DMA. They are still
challenging interoperability. And they're saying, quote, this case is one of the major judicial tests
of the EU's interoperability obligations under the DMA. This law aims at preventing large technology
companies from unfairly locking out competitors. The Free Software Foundation of Europe seeks to
enforce the DMA in a free software developer friendly way. But the idea here is Europe wants
small players to be able to compete against big tech players because Apple does things like not
letting people use third-party app stores. Apple does things like not allowing you to use a third-party
browser engine. Apple does things like making everybody use the Lightning port. It's all of
these things that Europe tried to push on and say, hey, you can't do that. We need to be using standards
and we need to actually allow things to be properly competitive. The problem is that Apple isn't
actually complying with these in a way that the Free Software Foundation of Europe thinks is
actually complying. They don't think they're complying with the law. If you want to learn
more about this, I've actually had three different people from the Free Software Foundation of Europe
on Techlore Talks, again, our sister podcast.
So if you want to learn more about this whole saga specifically,
they cover a lot more of this in those interviews.
Up next, Tor Browser released version 15.0.14.
It includes some bug fixes and some basic updates, nothing too major.
But Firefox itself had a pretty big week.
So Firefox 151 includes VPN location selection.
So when I did my review, which I'll leave a card here and also in a description,
I did a review of Firefox's new VPN.
And one of the things I even talked about
is it doesn't even tell you which location you're in.
So now they actually let you choose a VPN location
by country, it looks like, which is incredible.
And you can see it, which is also great.
You also have your AI controls
that are going to be in mobile now.
If you don't want to deal with AI at all,
you can just toggle them all off
or you can enable the specific things you want.
They're also getting Shake to summarize on Android devices,
which they say is a favorite feature.
Pretty much if you're on a page,
you just shake your phone and it summarizes the page.
and they're bringing that to Android devices.
And apparently Nightly includes a redesign of the settings page.
So that is pretty exciting stuff.
Then when we move over to Discord, this is not open source news.
Again, I said open source and like open source adjacent.
Discord is not open source at all.
But I did still think that a lot of people in the open source community are on Discord.
In fact, lots of open source projects host their communities on Discord.
So I still wanted to showcase this.
but they are rolling out end-to-end encryption by default for all voice and video calls.
I think this is a really good move forward for just a basic privacy, basic security for users.
I'm a big fan of this.
No, it's not going to be signal.
No, it's not going to be session.
No, it's not going to be absolute privacy.
But this is one step forward, and it also helps normalize encryption,
which is really important when we zoom out at all these legal attacks against encryption.
We also had a stunning, I guess, alternative to the highlight story this week,
which is Microsoft is doing its first server Linux distribution
called Azure Linux 4.0.
It's immutable, and they are...
Yeah, that's it.
If you want to learn more about it,
it's actually based on Fedora Linux,
and it's an open distribution on GitHub.
You can literally see it on the screen
after it's done loading here.
But yes, Microsoft has a GitHub repo,
and it's called Azure Linux,
and they have a Linux distribution.
So if you want to learn more about this, check it out.
It's quite fascinating.
All right, this next update actually has me really excited
because it addresses what I've been kind of alluding to
in the last couple of Surveillance Supports episodes,
which is, and even earlier in this one,
which is it's very hard to consistently patch things
on the Linux side of things, right?
You have every distro doing its own thing.
And I really appreciate this leadership from Rocky Linux.
So Rocky Linux came forward
and now they introduced a security repository.
And they specifically cite copyfail and dirtyfrag
as reasons for why they did this.
So that is directly in this article here on their website.
These were serious local privilege escalation vulnerabilities
with public proof-of-concept exploits already in the wild.
Both arrived upstream, which had fixes broadly available,
and both put Rocky Linux administrators in a position no one wants to be in,
which is they're aware of the risk, aware of the exploit, and just waiting.
And that is exactly kind of the predicament that a lot of you communicated
in the comments from these last few videos.
Now, this does target more developers, people running servers, not necessarily end users,
but the next vulnerability could be an end user.
They have launched the Rocky Linux Security Repository, which is an optional opt-in repository
that gives them a path to ship urgent security fixes ahead of upstream when circumstances genuinely demand it.
This changes nothing if you don't opt into it, but if you do opt into it, you can actually receive these updates a lot quicker.
And they actually already cite that this worked.
they already pushed out some of these updates
and they were able to bridge the gap
while Upstream got their fix out.
And so if you are a developer, administrator, et cetera,
this is something to look into.
And actually, I would love to see more of this.
I just love that they put this forward.
All right, the last story of the week is from Organic Maps.
They have brought transit line highlights,
cleaner bookmark labels, and a more legible map.
And so if you are an Organic Maps user
and you're trying to get away from Google or Apple,
this is an update for you all.
That is going to conclude the week.
If this analysis helped you reclaim control,
become a Techlorian by visiting the show notes
in the description.
It's a great way to support us.
You get access to our private signal group.
You get access to my private RSS feed
so you can keep up with all these stories
as they happen throughout the week in your RSS.
You can also join the newsletter
and get a written version of this surveillance support.
It's completely free.
There's no spam or anything.
It's just a weekly written version if you prefer that.
Other than that,
I would really like to ask everybody to leave a rating,
support this podcast in any way they can.
It doesn't have to be financial.
I see all your Apple podcast reviews and they mean a lot.
And so if you're listening to Apple,
it takes about five seconds to just scroll down
and leave a rating on a podcast
and it makes a big difference for Discovery.
You can do the same thing on Spotify.
You can share the episode.
You can really just keep tuning in as well.
Like whatever you can do to give back to this podcast
is really appreciated.
Thank you all for listening
and I'll see you in the next episode of Surveillance Report.
Stay safe out there.