Private Orchards

Private Orchards

@privateorchards.bsky.social

Advanced Apple privacy, security, OSINT & more 🍏 https://privateorchards.com

12 followers94 following28 posts

Private Orchards
@privateorchards.bsky.social

Apple just backported its exploited CoreGraphics zero-day fix to the iPhone XS and XR. Worth knowing: older iOS branches only get the fixes Apple chooses to backport. Full protection means the latest iOS your phone can run, today. #iPhone #infosec

Private Orchards
@privateorchards.bsky.social

📲 Before your next flight or conference: Settings > General > AirDrop. "Contacts Only" or "Receiving Off" stops strangers sending you images, and "Everyone for 10 Minutes" switches itself back when time is up. #iPhone #Privacy

Private Orchards reposted

Zack Whittaker
@zackwhittaker.com

I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly hasn't (yet), but how the PHP-ocalypse is likely to be the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time. Bypass for ad-blockers: web.archive.org/web/20261026...

techcrunch.comPHP-ocalypse: How two critical web bugs almost broke the internet | TechCrunchTwo critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
Private Orchards
@privateorchards.bsky.social

Safari and Mail were covered automatically. On a Mac, curl, git and python3 still read /etc/ssl/cert.pem until the update. Homebrew's OpenSSL uses its own bundle, and brew upgrade ca-certificates already drops both affected roots.

MacRumors.com@macrumors.bsky.social

Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix

macrumors.comApple Addresses Web Security Threat, Working on macOS Update With Additional FixEarlier this month, a security researcher discovered that private cryptographic keys associated with eight of Indian company eMudhra's intermediate certificate authority (CA) certificates were weak. The compromised keys could have allowed attackers to impersonate legitimate websites, potentially putting users' sensitive information at risk. However, there is currently no evidence that the keys were exploited maliciously. eMudhra's certificates were widely trusted by all major web browsers, including Safari, Chrome, Edge, and Firefox, but Apple and the other companies behind those browsers have since taken action to protect users. In a support document, Apple said it has been blocking eMudhra's compromised TLS web certificates since October 19 in Safari, Mail, and apps that use Apple's networking and security frameworks. The certificates are blocked automatically with no software update required, so most Apple device owners do not need to take any action. There is one exception. Apple said those who use macOS command-line tools, such as system administrators, should be aware that some of those tools can still accept the compromised certificates until Apple releases a macOS update with a fix. In the meantime, Apple said those who use command-line tools can remove root CA certificates from the /etc/ssl/cert.pem file, with more details outlined in the support document. Apple has not provided a release date for the macOS update that will include the necessary changes to the /etc/ssl/cert.pem file. For more technical details, read Apple's support document.Tags: macOS Security, Safari This article, "Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix" first appeared on MacRumors.com Discuss this article in our forums

Private Orchards reposted

Private Orchards
@privateorchards.bsky.social

The "secret chat" trick going around: two people share an Apple Note and type to each other in it instead of texting. It's not as hidden as people think. Open the note and swipe right, and Notes shows who wrote what, and when. How to spot one 👇 #iPhone #Privacy #OnlineSafety

Private Orchards
@privateorchards.bsky.social

No Location on an iPhone photo hides the location, it doesn't erase it. If you edit the photo or turn the setting back on, the GPS data is still there. Our write-up on stripping it properly before you share: privateorchards.com/blog/remove-...

privateorchards.comRemove Location From iPhone Photos, and What Else LeaksTurning off Location isn't the whole story. What else an iPhone photo carries, what apps can see, and the advanced Photos settings that close the gaps.
Private Orchards
@privateorchards.bsky.social

The "secret chat" trick going around: two people share an Apple Note and type to each other in it instead of texting. It's not as hidden as people think. Open the note and swipe right, and Notes shows who wrote what, and when. How to spot one 👇 #iPhone #Privacy #OnlineSafety

Private Orchards
@privateorchards.bsky.social

An iPhone VPN kill switch helps, but it isn't airtight. Since iOS 16.1, some Apple services can still reach the internet outside the tunnel, even with the kill switch on. Mostly sealed, not leak-proof. Our write-up: privateorchards.com/blog/always-...

privateorchards.comAlways-On VPN on iPhone: Three Ways to Keep It ConnectedKeep a VPN always on with a kill switch on iPhone: Proton VPN, WireGuard On-Demand or built-in IKEv2, and where each one leaks on iOS 27.
Private Orchards
@privateorchards.bsky.social

A normal-looking ad was enough to plant spyware. Citizen Lab tied attacks on at least 45 devices at Al Jazeera to Candiru spyware served through Discover-Tech ads. The sample recovered was Windows malware; the report doesn't confirm any iPhone or Mac infections. 🧵

You are up to date.