Hosts Discuss ICS Phishing, X Passkey Migration Issues and CISA’s Future
· 11:51 · Watch on YouTube ↗
Summary
The hosts explain how malicious calendar invites can bypass controls and potentially expose credential hashes, recommend disabling automatic invite acceptance, and discuss reported X passkey lockouts and uncertainty about CISA’s future.
Key points
- The hosts describe malicious calendar invites, called “ICS fishing,” as a way to bypass security measures; they say an invite with an embedded HTTP link may trigger a hash challenge when clicked or automatically processed, depending on browser configuration.
- They recommend disabling automatic calendar invitation acceptance. One host says Google Calendar can be set to add only invitations the user accepts or responds to.
- A host reports that a passkey migration associated with changing from Twitter to X signed out both of his accounts and left them in an enrollment loop; the other host says the issue had not affected him.
- The hosts say affected passkey users had to wait for support or back out the code change, while authenticator-app TOTP access reportedly continued working.
- They discuss uncertainty about CISA’s future, saying the act that created it expired while noting its role in critical-infrastructure vulnerability notifications and the Known Exploited Vulnerabilities catalog.
Article Details
- Topics
- [00:41] Malicious calendar invites (“ICS fishing”) and potential credential-hash extraction
- [02:41] Mitigating invite abuse by disabling automatic invitation acceptance
- [05:02] Reported passkey migration problems and account lockouts during the Twitter-to-X transition
- [08:49] Discussion of CISA’s possible future and its vulnerability-notification and KEV catalog work