Not to freak out anyone, but there’s a serious flaw in all supported versions of Microsoft Windows that allows attackers to take over your machine. The so-called Follina vulnerability can be exploited using a weaponized Word document, and security researchers say they’ve already spotted government-backed hackers using this attack in the wild. Fingers crossed that Microsoft, which has downplayed the severity of the flaw, issues a patch soon.
Speaking of patches, everything from Apple’s iOS and Google Android to Chrome, Firefox, and Zoom received major security updates in May. Check out our complete list of available updates to see which apps you need to attend to as soon as possible.
We also explored the race to protect your voice from hackers and corporate greed. And we tried to unravel the mystery of China’s sudden warnings about US state-sponsored hackers going after Chinese systems, despite the fact that these hacks are well known and happened ages ago.
Meanwhile, in India, the country’s telecom regulator is preparing to crack down on robocall spam and scammers by requiring callers’ names to appear on caller ID. The idea sounds good—until you realize the privacy implications and the fact that such a plan might not even work.
Finally, because nothing’s sacred, Canada’s privacy commissioner this week announced that a mobile app for Tim Hortons, the beloved coffee chain, illegally spied on its users’ locations. The app, which used location-tracking tech from US-based firm Radar, collected a constant stream of users’ location data—checking as frequently as every 2.5 minutes—and would create an “event” anytime a user “entered or left” their home, office, major sports complex, or rival coffee shop, according to the commissioner’s office.
But that’s not all, folks. Each week, we round up the big security and privacy news we didn’t cover ourselves. Click the links for the full stories, and stay safe out there.
If you lived in Illinois between May 1, 2015, and April 25, 2022, Google may owe you some cash. The company recently settled a class-action lawsuit over a feature in the Google Photos app that categorized photos of people based on their faces. The problem? According to the lawsuit, Google failed to receive consent to do so from millions of users, a violation of the state’s Biometric Information Privacy Act. Google did not admit fault as part of the settlement, but it has agreed to pay $100 million and put in place measures to avoid further privacy violations. If you were an Illinois resident during that seven-year period and appeared in a photo uploaded to the Google Photos app, you can file a claim for your piece of the $100 million pie.
The blurry line between “at war” and “not at war” grew even fuzzier this week. General Paul Nakasone, the head of US Cyber Command and the NSA, told Sky News that the US military has conducted “a series of operations across the full spectrum,” including “offensive, defensive, and information operations” in support of Ukraine’s defense against Russia’s invasion. Nakasone declined to detail what these operations entailed but assured that they were perfectly legal. The general’s admission coincides with the US agreeing to provide Ukraine with advanced missile systems with a range of 50 miles. The Kremlin responded to this news by saying the US was “pouring fuel on the fire.”
As part of the US Supreme Court’s investigation into the leak of a draft opinion overturning guaranteed abortion rights in the United States, the Court’s clerks have been asked to turn over their private phone records and sign an affidavit, according to CNN. The “unprecedented” move is jarring for civil liberties advocates. As Albert Fox Cahn, found of the Surveillance Technology Oversight Project, writes for WIRED: “The intrusive probe reveals a disturbing about-face from the Supreme Court, and particularly Chief Justice John Roberts, on surveillance powers.” The clerks, meanwhile, are reportedly hesitant to refuse the demand for phone records or seek legal counsel for fear of being wrongly suspected of leaking the draft opinion to Politico reporters.
A Trump-era conspiracy theory can finally be put to rest—theoretically, at least. A 52-page classified report into the “unmasking” of Michael Flynn, a former US national security adviser to Donald Trump, has now been made public thanks to a Freedom of Information Act request filed by Jason Leopold of Buzzfeed News. Republicans have long accused Obama administration operatives of revealing Flynn’s name in classified material for political purposes in the lead-up to the 2016 election. But the Justice Department report, prepared by former US Attorney John Brash, found “no evidence that unmasking requests were made for political purposes or other inappropriate reasons during the 2016 election period or the ensuing transition period.” Flynn ultimately resigned in 2017 for misleading vice president Mike Pence about Flynn’s calls with Russia’s ambassador to the US.