iMazing app updated with tool to easily detect Pegasus spyware on iPhone

You may have heard about Pegasus, which is a spyware created by the NSO group based on zero-day vulnerabilities to collect data from smartphones without user consent. Now iMazing has updated its app to include a new tool that can easily detect Pegasus spyware on iPhone. As we reported last month, Amnesty International has released a tool that helps users detect if a device has been infected with Pegasus. However, this method is quite complicated for a regular user as it requires compiling code available on GitHub. Luckily, iMazing has now implemented the same detection methodology in the latest version of its software.

You can now use Chrome as a two-factor security key for your Google account

Last week, Google rolled out Chrome 93 beta with quite a few PWA improvements and support for cross-device OTPs. The folks at 9to5Google have now spotted a new feature in the latest beta that turns Chrome for Android into a security key for logging in to your Google account. Google currently offers multiple ways to allow users to authenticate a log-in attempt. On iOS devices and the best Android phones, you can tap “Yes” on the Google Prompt notification that pops up when you attempt to sign in to your account on a new device. In case you have a “phone security key” set up on your device, you can also long press the volume button to confirm a sign-in attempt.

JOINT CYBER DEFENSE COLLABORATIVE

The Joint Cyber Defense Collaborative (JCDC) will lead the development of the Nation’s cyber defense plans, which outline activities to prevent and reduce the impacts of cyber intrusions. Leveraging new authorities provided by the National Defense Authorization Act (NDAA) of 2021, the JCDC will bring together public and private sector entities to unify deliberate and crisis action planning while coordinating the integrated execution of these plans. The plans will promote national resilience by coordinating actions to identify, protect against, detect, and respond to malicious cyber activity targeting U.S. critical infrastructure or national interests.

New DNS vulnerability allows ‘nation-state level spying’ on companies

Security researchers found a new class of DNS vulnerabilities impacting major DNS-as-a-Service (DNSaaS) providers that could allow attackers to access sensitive information from corporate networks. DNSaaS providers (also known as managed DNS providers) provide DNS renting services to other organizations that do not want to manage and secure yet another network asset on their own. As revealed at the Black Hat security conference by cloud security firm Wiz researchers Shir Tamari and Ami Luttwak, these DNS flaws provide threat actors with nation-state intelligence harvesting capabilities with a simple domain registration.

The Cybersecurity 202: CISA’s new director brought a unique style to Black Hat

The government’s new cybersecurity quarterback made a strong appeal at the Black Hat conference for industry cyber pros to partner with government to counter hacking threats. The entreaty from Cybersecurity and Infrastructure Security Agency Director Jen Easterly comes amid an unprecedented wave of cyberattacks against critical industry sectors that are threatening to disrupt the flow of electricity, water and gas and dramatically affect national and economic security. But, at this point, government has only limited power to ensure that companies are doing what’s necessary to protect against such attacks. “We cannot allow avoidable cyber disruptions to cost human lives,” Easterly said.  She added that “CISA was created to be something very different, not just another lumbering government bureaucracy, but really something much more akin to a hybrid public-private collaborative.”