Nostr notes by Mysk🇨🇦🇩🇪

RE: https://mastodon.social/@mysk/116974847786124516 🚨 PSA: ...

2026-07-26T16:05:07Z

RE: https://mastodon.social/@mysk/116974847786124516

🚨 PSA: Uninstalling Google Chrome on macOS doesn't remove Chrome's background updater. It keeps running until you remove:
~/Library/Application Support/Google/GoogleUpdater
~/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist

Then, restart.

quoting
note142c…32ls

Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart.
With the macOS bug we described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)

https://youtu.be/lLJkxWR71B0

*This is also a good reminder to uninstall Chrome 😎

Google Chrome on macOS installs a background app called ...

2026-07-24T12:02:07Z

Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart.
With the macOS bug we described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)

https://youtu.be/lLJkxWR71B0

*This is also a good reminder to uninstall Chrome 😎

We made a few mockups showing how we think Apple could improve ...

2026-07-23T19:16:37Z

In reply to nevent1q…ga3r
_________________________

We made a few mockups showing how we think Apple could improve macOS permission prompts to make app-tampering attacks far less effective:

2) Show a clear warning if macOS detects that an app’s signing identity has changed since it was last opened.

Simple changes like these could make it much harder for attackers to trick users into granting sensitive permissions.

Link to the blog: ...

2026-07-23T13:27:37Z

In reply to nevent1q…pqs0
_________________________

Link to the blog:

https://mysk.blog/2026/07/23/macos-overwrite-app-executables/

🚨 We're disclosing a macOS security bug that Apple says is ...

2026-07-23T13:24:10Z

🚨 We're disclosing a macOS security bug that Apple says is not an issue.
Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web—no password or warning is required.
Here's a demo using Signal to steal its encryption key.
📝 Blog with technical details: link in the replies.
Do you think this should be considered a security bug?
🎬👇
#Apple #privacy #infosec #security #macOS

https://youtu.be/0bOC8S3NQxI

RE: https://mastodon.social/@mysk/116816065579359109 QUICK ...

2026-07-13T21:11:56Z

RE: https://mastodon.social/@mysk/116816065579359109

QUICK UPDATE: no update whatsoever.
To those exploiting this bug in the wild, have fun with it and do be respectful.

This is the report ID as a reference: OE110656176047

quoting
note190m…j79k

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇

#privacy #Apple #security #infosec #cybersecurity

🚨PSA: If you think you're a targeted individual, don't ...

2026-06-26T11:01:43Z

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇

#privacy #Apple #security #infosec #cybersecurity

Using Loupe, we found out that Proton VPN is the only VPN that ...

2026-06-15T13:11:08Z

Using Loupe, we found out that Proton VPN is the only VPN that prevents internal tunnel IP fingerprinting by assigning 10.2.0.2 to all users. Other VPNs, such as Mullvad, assign a static and unique IP per session. This allows iOS apps to track user sessions across apps.

Mullvad is aware of this issue. It is described in this blog:

https://mullvad.net/en/help/why-wireguard

You can download Loupe here:
https://apps.apple.com/app/id6766152470

#iOS #privacy #infosec #security #cybersecurity

Introducing Loupe, our latest privacy app for iOS. Discover what ...

2026-06-05T20:33:40Z

Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more

Loupe is free, private, and open source. Give it a try 👇

https://apps.apple.com/app/id6766152470

Link to source code:

https://github.com/mysk-research/loupe

#iOS #privacy #infosec #security #cybersecurity

On iOS and macOS, WhatsApp stores chat databases unencrypted in ...

2026-05-24T21:48:43Z

On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified.

https://blog.cryptographyengineering.com/2026/02/02/whatsapp-encryption-a-lawsuit-and-a-lot-of-noise/

This is a demo we prepared recently to show a macOS bug that allowed unrestricted access to protected app containers. WhatsApp stores data at rest without encryption.

https://m.youtube.com/watch?v=Naq5IojVoNs

RE: https://mastodon.social/@mysk/116557912618505785 This bug was ...

2026-05-11T21:57:29Z

RE: https://mastodon.social/@mysk/116557912618505785

This bug was reported to Apple on October 17, 2025. It has now been fixed and can be disclosed. Our initial assessment found it to be critical, so we paused all Psylo: Privacy Browser & Proxy (npub12gv…jrul) activities and focused on preparing excellent demoes to convince Apple of the bug's severity. After 206 days the issue was addressed. We were surprised it remained unpatched for so long, perhaps Apple had higher priority bugs.

quoting
note13uk…47e6

RE: https://mastodon.social/@mysk/116557828381660916

🚨 If you use Signal or 1Password on macOS, make sure you upgrade to:
Tahoe 26.5
Tahoe 26.4
Sequoia 15.7.7
Sonoma 14.8.7

We're working hard to get the blog and videos out ASAP
note19ky…f0yt

RE: https://mastodon.social/@mysk/116557828381660916 🚨 If you ...

2026-05-11T20:50:02Z

RE: https://mastodon.social/@mysk/116557828381660916

🚨 If you use Signal or 1Password on macOS, make sure you upgrade to:
Tahoe 26.5
Tahoe 26.4
Sequoia 15.7.7
Sonoma 14.8.7

We're working hard to get the blog and videos out ASAP

quoting
note19ky…f0yt

We got the acknowledgment.... Stay tuned...

Spoiler: The videos include demoes showing how to exploit this vulnerability to impact Signal, 1Password, iMessages, Safari, and more...

We got the acknowledgment.... Stay tuned... Spoiler: The videos ...

2026-05-11T20:28:36Z

In reply to nevent1q…d4m4
_________________________

We got the acknowledgment.... Stay tuned...

Spoiler: The videos include demoes showing how to exploit this vulnerability to impact Signal, 1Password, iMessages, Safari, and more...

Still waiting for Apple to acknowledge our work in the security ...

2026-05-11T20:12:52Z

Still waiting for Apple to acknowledge our work in the security release notes so we can disclose a bug we discovered and reported in October last year. It has been a tough experience.............................hell to bounty programs.
We have a blog and a bunch of videos to share.

Forget about switching off "Share Analytics Data" in ...

2026-02-18T18:19:54Z

Forget about switching off "Share Analytics Data" in Pages settings. Keynote, Numbers, and Pages share it regardless of your choice.
#Privacy #Apple #infosec

This happens when the #security team doesn't sync with the ...

2025-09-14T22:20:34Z

This happens when the #security team doesn't sync with the #UI team. 😅
The code that Instagram sent was alphabetical, but the UI in the app showed a numpad and only allowed numeric input.

To investigate this, You need to connect your iPhone to a network ...

2025-09-14T21:58:33Z

In reply to nevent1q…ecmt
_________________________

To investigate this, You need to connect your iPhone to a network where you can capture HTTPs traffic and decrypt it.
1- quit Instagram so it is not running in the background
2- Send yourself a DM or let someone comment on your posts
3- You get notifications and the app should wake up in the background and send the massive data
4- Capture the data, analyze it, redact it and publish it

You can do it with Proxyman.

This article by @npub1w9z…cg82 is spot on 👌 ...

2025-09-14T21:39:59Z

In reply to nevent1q…axf3
_________________________

This article by 9to5Mac (npub1w9z…cg82) is spot on 👌

https://9to5mac.com/2025/08/21/meta-allegedly-bypassed-apple-privacy-measure-and-fired-employee-who-flagged-it/

P.S.: The data collection is massive. We can't consistently ...

2025-09-14T21:23:56Z

In reply to nevent1q…x8ry
_________________________

P.S.: The data collection is massive. We can't consistently simulate accounts that aren't based in the EU. Data collection isn't as massive for EU accounts. Our entire team is currently in the EU, which makes recording a demo capturing the massive data collection difficult. Our time is limited. It would be great if researchers outside the EU investigated this. We're happy to help.

Link to our demo from last year. Apple's Required Reason API ...

2025-09-14T21:23:27Z

In reply to nevent1q…esqm
_________________________

Link to our demo from last year. Apple's Required Reason API rules aren't being enforced - either they're ignoring it or they can't do it.

https://youtu.be/4ZPTjGG9t7s?feature=shared

We detailed this last year and we checked again today. Meta ...

2025-09-14T21:22:59Z

In reply to nevent1q…3n4t
_________________________

We detailed this last year and we checked again today. Meta collects everything it needs to track users across apps, a practice strictly prohibited by Apple.

Stop using the native app. Use the web app.

#privacy #fingerprinting #iOS #PWA
More 👇

🤯 Instagram is testing new iOS push notifications that include ...

2025-09-14T21:22:03Z

🤯 Instagram is testing new iOS push notifications that include a profile photo. Each time the notification is shown on your screen, it triggers a GET request to fetch that image, letting Meta track every on-screen impression.

The app still misuses push notifications to send detailed device analytics about the device (uptime, battery, volume, locale, timezone, memory, CPU, etc.)

#privacy #infosec #privacymatters #Apple #iOS #meta
More 👇🧵

Live Translation with AirPods is not going to be available in the ...

2025-09-11T13:07:34Z

Live Translation with AirPods is not going to be available in the EU. This means that it doesn't use on-device AI model and the microphones forward everything to remote servers 🤯

#Apple #privacy #infosec

2/2 That said, using Apple Pay for age verification can be ...

2025-08-01T16:46:17Z

In reply to nevent1q…73kw
_________________________

2/2

That said, using Apple Pay for age verification can be practical. In fact, all iOS browsers allow websites to present the Apple Pay sheet unexpectedly, except for Psylo. Psylo is the only #iOS browser that blocks Apple Pay APIs. While using Apple Pay for age verification seems convenient, it is not fully anonymous, as #Apple knows which merchants you use with #applepay

Psylo is our private browser. You can try it 7 days for free:

https://apps.apple.com/app/id6741358035

This ad displays a blurry image of "sensitive" content. ...

2025-08-01T16:44:51Z

This ad displays a blurry image of "sensitive" content. When clicked, it presents an age verification screen. However, clicking anywhere on the screen unexpectedly opens an Apple Pay sheet to authorize a payment of $0. This seems like an attempt to verify the visitor's age, but the website's implementation feels a bit shady:

1. Initiating an Apple Pay transaction without informing the user.
2. Requesting an email contact without explaining the reason.

… 1/2

#privacy #cybersecurity #infoSec

Not to mention that everything you type in the search bar of the ...

2025-07-02T18:07:38Z

In reply to nevent1q…qhs5
_________________________

Not to mention that everything you type in the search bar of the App Store app is associated with your Apple account and sent to Apple in realtime.

https://mastodon.social/@mysk/113527249253336530

A major privacy issue with Signal is its constant request for ...

2025-03-28T00:16:56Z

A major privacy issue with Signal is its constant request for access to contacts. It might sound convenient, but this access increases the risk of accidentally choosing the wrong contact (such as The Atlantic journalist) when adding someone to a group or forwarding texts. We have been critical of this "we'll remind you later" pattern that Signal adopts when access to contacts is denied. An app "built for privacy" should respect its user's #privacy choices.
#infoSec #privacyMatters

🚀 Exciting news! We're now inviting users to Wave 2 of our ...

2025-02-11T08:16:21Z

🚀 Exciting news! We're now inviting users to Wave 2 of our closed beta test of our privacy-focused iOS app! Your feedback is highly appreciated, and we can't wait to hear from you. If you missed the first round, now's your chance!
DMs are open 📩
#Privacy #PrivacyMatters #iOS

This is an example of what the App Store app shares with #Apple ...

2024-11-22T15:12:29Z

This is an example of what the App Store app shares with #Apple when you search for an app. Everything you type in the search field is recorded as an event and associated with your Apple ID before it is sent to Apple. When I search for "Google Authenticator," events are recorded as I type character by character. The leap between rows 78 and 79 is when I picked a suggestion. The timestamp of every event is recorded, i.e. Apple can calculate my typing speed 🙃.
#Privacy
#infosec #privacymatters

BREAKING: Court allows #privacy lawsuit against #Apple to proceed ...

2024-09-27T21:27:10Z

BREAKING: Court allows #privacy lawsuit against #Apple to proceed in part.

This lawsuit is based on our work. We found out that Apple apps, including the App Store app, collect detailed and identifiable analytics and there's no option to switch it off

https://www.reuters.com/legal/apple-must-face-narrowed-privacy-lawsuit-over-its-apps-2024-09-27/

#infosec #iOS #security

iOS 18 lets you delete the new Passwords app, but it shows a ...

2024-09-16T17:09:32Z

iOS 18 lets you delete the new Passwords app, but it shows a warning that deleting the app will not delete any of the passwords or secrets stored in the app 🤷‍♂️

#iOS18 #privacy #security #infosec

🚨 iOS 18 will be released today. During the upgrade, your ...

2024-09-16T14:36:39Z

🚨 iOS 18 will be released today. During the upgrade, your passwords will be migrated from the built-in password manager to the new Passwords app. If you don't use iCloud Keychain, you need to know that the Passwords app will sync your passwords with iCloud by default.
The same applies to #macOS Sequoia.
#iOS18

🚨 Mainstream media spreads misinformation about Telegram ...

2024-08-27T11:44:59Z

🚨 Mainstream media spreads misinformation about Telegram encryption while covering the arrest of Pavel Durov in France.

In this report, CNN puts #Telegram ahead of #WhatsApp in terms of strong encryption 🤯
This will definitely lead many users to pick wrong #privacy options.

#InfoSec #privacymatters