[U: Fix coming] Months-old security vulnerability still hasn’t been patched on Pixel, Samsung

Google’s Project Zero this week highlighted the “gap” in getting security patches out the door and to affected users, and in doing so also revealed that millions of Android phones are at risk of an active security vulnerability. The specific issue that Google’s Project Zero is highlighting this week is a security vulnerability known as CVE-2022-33917. It’s a vulnerability that affects devices using Arm’s Mali GPU, which means it affects Google Pixel, Samsung Galaxy, and countless other Android smartphones. If exploited, it would allow an attacker to “read and write physical pages after they had been returned to the system,” potentially gaining  “broad access” to a user’s data.

TikTok ‘Invisible Body’ challenge exploited to push malware

Hackers are capitalizing on a trending TikTok challenge named ‘Invisible Challenge’ to install malware on thousands of devices and steal their passwords, Discord accounts, and, potentially, cryptocurrency wallets. A new and trending TikTok challenge requires you to film yourself naked while using TikTok’s “Invisible Body” filter, which removes the body from the video and replaces it with a blurry background. This challenge has led to people posting videos of them allegedly naked but obscured by the filter. 

Tech Giant Yandex, Battered By Wartime Censorship, Reorganizes, Will Leave Russia

Russian tech giant Yandex has said it is reorganizing its operations, moving to cut its ties with Russia in a restructuring that solidifies government control over a company once seen as a bellwether for the country’s digital economy. The announcement comes after months of internal turmoil, with executives departing, the sale of the two of the company’s best-known products, and company shares hitting basement prices prior to being frozen on international stock exchanges. “These are exceptionally challenging times,” John Boynton, chairman of Yandex’s board of directors, said in a statement released late on November 25. According to the online news site The Bell, which was first to report on the reorganization, Yandex’s parent company, which is headquartered in the Netherlands, will lose ownership and control of all businesses of the Yandex Group.

FCC faces long road in stripping Chinese tech from US telecom networks

The Federal Communications Commission took its most aggressive step yet to expunge Chinese tech from U.S. telecom networks with its decision late last week to ban the sale of equipment from companies Congress and the Biden administration deem a national security threat. But gear from the targeted Chinese tech giants Huawei, ZTE, Hytera, Hikvision and Dahua is so deeply embedded within the American telecom and networking landscape, it’ll take years and billions of dollars to effectively eliminate any risk that these companies pose. While the FCC order is latest in a series of moves that Washington has made to reduce China’s influence, experts say it remains underfunded and offers no clear plan to help telecoms replace existing Chinese parts or find more affordable alternatives.

Lastpass discloses the second security breach this year

Password management solution LastPass disclosed a new security breach, the attackers had access to a third-party cloud storage service using information stolen in the August 2022 breach. The impacted cloud storage service is GoTo, it is currently shared by both LastPass and its affiliate. The company launched an investigation into the incident with the support of cyber security firm Mandiant and notified law enforcement. “We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.” reads the notice of security incident published by the company. The company pointed out that customers’ passwords were not compromised due to LastPass’s Zero Knowledge architecture.