News of the Cyber World

[kyonides]

Tim Cook's damage-control day on Capitol Hill

Amid an onslaught of criticism from Republicans and Big Tech rivals, Apple CEO Tim Cook met with lawmakers on Thursday to try to shore up support on Capitol Hill.

The big picture: Tech's leaders are beginning to take stock of a new political landscape in Washington as Republicans prepare to take over the House and ready hearings to spotlight what they see as biased treatment at Big Tech's hands.

Some lawmakers have criticized Apple for an update to its AirDrop feature on phones in China last month that could make it harder for protesters to share video.

The company says the update, which turns off the ability to AirDrop anyone outside of a user's contact list after ten minutes, is for security purposes and will be rolled out globally.
...
On the Republican side, Apple remains suspect for App Store rules that lawmakers say unfairly block conservatives and the apps they prefer.

Cook arrived in D.C. after settling (for now) a brawl with Twitter owner Elon Musk over App Store fees.
Rep. Darrell Issa (R-Calif.) said he and Cook spoke about China, Section 230 and the need for greater encryption and security in tech.
...
Rep. Jim Jordan (R-Ohio), who will soon take the reins of the House Judiciary committee, told Axios his meeting with Cook was "very good" and they spoke about the "AirDrop issue" and the "App Store issue."

Google reveals Spanish IT firm's links
to spyware targeting Chrome, Firefox and Microsoft Defender

A Spanish company that offers “tailor made Information Security Solutions” may have exploited vulnerabilities in Chrome, Firefox and the Microsoft Defender antivirus program to deploy spyware, researchers with Google’s Threat Analysis Group said Wednesday.

The company’s apparent exploitation framework called “Heliconia” provided “all the tools necessary to deploy a payload to a target device,” the researchers said. And although the team has not detected active exploitation, researchers added “it appears likely these were utilized as zero-days in the wild.”

A script within the code that Google examined referred to Variston IT, a Barcelona company that offers “Custom Security” solutions and tools that support “the discovery of digital information by [law enforcement agencies],” among other services.

Google, Microsoft and Mozilla fixed the relevant vulnerabilities in 2021 and early 2022, researchers said.
...
Heliconia was discovered when an anonymous party submitted three vulnerabilities to the Chrome bug reporting program, each with instructions and an archive that contained source code. The bug reports contained three unique names: “Heliconia Noise,” “Heliconia Soft,” and “Files.”

An analysis of the submissions revealed the frameworks capable of deploying exploits in the wild and also a script within the source code that checked whether binaries contained sensitive strings including “variston,” the company name, as well as the project or developer names, the researchers said.

Musk Suspends Ye From Twitter After Offensive Image Post

The artist tweeted an image combining the Star of David with a swastika, which got removed by the social media service. In its place was a message saying the post violated Twitter Inc.’s rules and a link to its policy page explaining enforcement actions. Since then, the entire account has been suspended, with all of its tweets now obscured. Ye had 32.2 million followers before the suspension.

Musk addressed the issue after the post’s initial removal, saying Ye had -- not for the first time -- breached Twitter’s rule against incitement to violence and his account would be suspended. It’s the most high-profile test yet of Musk’s avowed policy of making Twitter a home for free speech, even where it offends, so long as it’s not in breach of the law.