Security Roundup: Apple Email Privacy Claim, Pegasus and SharePoint

Summary

The panel discusses a reported flaw in Apple’s Hide My Email, a Pegasus infection, a SharePoint patch and the extradition of an alleged Scattered Spider hacker.

Key points

• The panel says a reported Hide My Email flaw was disclosed to Apple, but its mechanism is not public. The speakers are uncertain why it remains unfixed.
• A European Parliament committee member investigating spyware reportedly had Pegasus on an iPhone. The speakers speculate about who was responsible but provide no attribution.
• The speakers recommend promptly patching a recently disclosed vulnerability affecting self-hosted SharePoint. They speculate, without evidence, about a connection to a reported DHS network breach.
• Peter Stokes was extradited to the United States to face charges related to four Scattered Spider breaches, according to the panel.
• The panel describes a Bluetooth-chip vulnerability that could allow nearby attackers to send unauthenticated firmware updates and potentially monitor conversations on affected devices.
• Meeting TV sued PaloAlto after a report attributed espionage activity to the company, which disputes the attribution, according to the panel.