Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
Summary: Cisco Talos's Threat Source newsletter describes family-tracking apps like Life360, which was found in December 2021 to be selling precise location data on its users, potentially affecting millions of people, and notes that Apple updated AirTags' security and location alerts after the devices were used to track people unknowingly. The same issue covers Microsoft's warning of limited in-the-wild exploitation of two Exchange Server vulnerabilities, CVE-2022-41040 (SSRF) and CVE-2022-41082 (RCE when PowerShell is accessible), affecting Exchange 2013, 2016 and 2019.
What you should know: The newsletter's own framing is that once precise location data is sold to third parties, the original app no longer controls how it is handled - and the same trade-off applies to any tracking hardware or software welcomed into homes and onto devices.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2022-41040CVE-2022-41082
- Related
- Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server Cyber Risks ·Microsoft: Two New 0-Day Flaws in Exchange Server Cyber Risks ·Patch Tuesday, November 2022 Election Edition Cyber Risks ·