Hello World, Apple is introducing "Lockdown Mode", a new and unprecedented security feature

for iPhones and Macs, that aims to combat "mercenary spyware", in particular "state

sponsored mercenary spyware", which has been a big problem over the last few years.

For the simple reason that governments around the world are quite keen on hacking into the

phones of journalists and activists, this demand has created companies like "NSO Group"

- an Israeli business which employs hundreds of hackers to find severe vulnerabilities

in mainly iOS and Android phones, they then package these up into spyware software which

they sell to governments of dubious moral standing, to use against quote "terrorists

and criminals" - but on occasion this spyware is seemingly used against other groups, allegedly

of course.

Tech giants like Apple aren't happy about this, whether that's because they actually

care about their user's privacy or because constant news of their devices being hacked

just isn't a good look - I'll leave up to your judgement.

But either way Apple has done a fair bit to thwart spyware made by companies like "NSO

group" including beefing up iOS security and implementing a notification system for people

targeted by state sponsored hackers.

Apple is also suing "NSO Group", pledging to donate any damages to anti surveillance

organisations.

But Apple's latest idea is called "Lockdown mode" which will arrive in the next versions

of iOS and MacOS, now this feature isn't a gimmick, it is a real attempt at improving

a device's security.

"Lockdown mode" takes the relatively simple approach of reducing your device's attack

surface - in practice this means that by enabling "Lockdown mode", you are disabling a bunch

of your phone's features.

For example, when "Lockdown mode" is enabled, in the Messages app "Most message attachment

types other than images are blocked."

The whole point of doing this is that whilst I suppose there is someone out there who finds

it useful that the Messages app can handle a wide array of attachment formats, this functionality

introduces a lot of code which could potentially contain vulnerabilities.

And in the past, it has!

One of the most famous exploits that "NSO Group" used was called "FORCEDENTRY", it worked

by using a maliciously crafted pdf file.

And by merely sending the malicious pdf file to a victim through the "Messages App" you

could take over their entire iPhone, all without them even knowing - a bad actor could then

exfiltrate a victims files, read their messages, record their microphone and so on.

This exploit was allegedly used to target "Jordanian Human Rights Defenders and Journalists".

Now, receiving PDF files isn't really essential to an iPhone's functionality, so in "Lockdown

Mode" this feature is removed.

As well as other features that could be exploited like "just-in-time (JIT) JavaScript compilation"

when you're browsing the web, Facetime calls from people you don't have in your contacts,

and wired connections with a computer when your phone is locked.

I mentioned at the beginning of this segment that "Lockdown mode" is kinda unprecedented,

that's because nothing like it has come before.

No other major phone manufacturer has intentionally limited their device's functionality in order

to improve security.

However this new feature isn't for everyone, obviously it's not going to come enabled by

default, it's only meant to be used by people who suspect they're at risk of being targeted

with advanced spyware, which probably isn't you or I. Nevertheless it is, shall we say,

encouraging that Apple is introducing a feature like this, it's only going to be used by a

very small number of people, and will on paper at least make Apple no money.

That being said, it is a pretty good talking point for them, so I imagine we can expect

some bragging about it at the next keynote.

Next up, we have one of the largest data breaches of all time.

1 billion Chinese citizens' personal information was leaked, all because credentials to a database

belonging to the "Shanghai National Police" were posted online by a sloppy developer.

It looks like the programmer accidentally pasted the creds into a blog post, which went

on to cause only the largest data leak in Chinese history.

And before the post could be deleted someone managed to download the entire 24 Terabyte

database, and did the only obvious thing, listing the entire treasure trove for sale

on "breachforums" for 10 bitcoin.

Now, as far as leaks go, this is a pretty spicy one, not only does it include basic

stuff like names, addresses and mobile numbers, but also more sensitive data like national

ID numbers - and because this came from the "Shanghai national police", details of crimes

committed by each person are in the dump - now, most of the crimes are pretty trivial stuff

like road incidents and so on.

But nevertheless, this kind of information is gold dust for personalised spear phishing

campaigns, someone with enough time on their hands could automate a campaign of text messages,

targeting everyone on this list, urging them to... idk... pay a fine for the crime they

committed or something.

However such a campaign wouldn't be quite so effective if the Chinese government did

the right thing and notified their citizens of the leak, encouraging them to be wary of

scams.

But unfortunately, authoritarian governments aren't known for being humble, and the authorities

did the most predictable thing, going one step further than just ignoring the problem

and instead trying to actively stop people from discussing the issue.

The financial times is reporting that on Chinese social media, Hashtags such as “data leak”,

“Shanghai national security database breach” and “1 billion citizens’ records leak”

are being censored.

Also, I tried searching some keywords on Chinese search engine Baidu "china data leak 1 billion"

- But there's no news of the leak at all, instead I was suggested the page "One billion

Chinese fully vaccinated", and I guess, maybe the search engine figured out I was searching

for dissenting information, because it showed me an article titled "Falsehoods in US Perceptions

of China".

The forum that was initially host to the sale of the leak subsequently deleted the post,

and they also censored discussion of the leak - a post by a forum admin said they had removed

the post and deleted any threads discussing the leak, but they didn't give a reason why.

What you tend to find is that forums hosting data leaks and hacking tools will often self

censor if they draw too much negative attention - which shouldn't be surprising I suppose,

would you want to make yourself an enemy of the Chinese state?

I imagine not.

This video was made possible by Octopart - a website I've been relying on over the last

few years in my electronics business.

Octopart.com is essentially your component sourcing swiss army knife - making it simple

to keep tabs on component stock levels in real time throughout a range of distributors

- which is pretty important given the current component supply situation, you can also easily

grab datasheets and cad models for components when you need them.

The best part is it's free to use, and Octopart is integrated right into altium 365, if you

want to give altium a go you can find your free trial link in the description.

As always thanks for watching and have a good one.