Connect with us

Technology

Apple fixes Passwords app vulnerability enabling Wi-Fi attacks

Published

on

Apple fixes Passwords app vulnerability enabling Wi-Fi attacks

Do you remember Apple’s “Privacy. That’s iPhone” marketing campaigns? If you’re not aware, the company likes to portray its products as being synonymous with privacy. However, the recent wave of security vulnerabilities affecting iPhones and Macs suggest Apple’s products may not be as secure as advertised.

A recent security blunder only reinforces this point. Security researchers discovered that Apple’s built-in password manager app, Passwords, was vulnerable to phishing attacks for nearly three months after launch. This meant an attacker on the same Wi-Fi network as you, like at an airport or coffee shop, could redirect your browser to a lookalike phishing site to steal your login credentials.

Stay protected & informed! Get security alerts & expert tech tips – sign up for Kurt’s The CyberGuy Report now.

A person holding an iPhone (Kurt “CyberGuy” Knutsson)

What you need to know

Security researchers at Mysk, noticed that Apple’s Passwords app, introduced with iOS 18 in September 2024, had a significant security flaw that left users vulnerable to phishing attacks for nearly three months.

Advertisement

The app used unencrypted HTTP connections instead of the more secure HTTPS to fetch logos and icons displayed alongside stored passwords. This allowed attackers on the same network, such as public Wi-Fi at a coffee shop or airport, to intercept these requests and potentially redirect users to phishing sites designed to steal login credentials.

The issue remained unresolved from iOS 18’s launch in September 2024 until Apple fixed it in December 2024, leaving users exposed for nearly three months. If someone opened the Passwords app and tapped a link, like “Change Password,” while connected to an insecure network, an attacker could intercept the request and redirect them to a fraudulent site mimicking a legitimate one, such as a fake Yelp login page. Since the app did not enforce HTTPS, users might not notice the switch, putting their sensitive information at risk.

Apple fixes Passwords app vulnerability enabling Wi-Fi attacks

A woman on her iPhone (Kurt “CyberGuy” Knutsson)

HOW TO PROTECT AN IPHONE & IPAD FROM MALWARE IN 2025

Apple has fixed the issue now

Apple addressed the problem after security researchers from Mysk reported it in September 2024. The iOS 18.2 update, released in December, patched the vulnerability by enforcing HTTPS for all network communications within the Passwords app, making it much harder for attackers to intercept or redirect traffic.

If you’re using an iPhone or iPad with the Passwords app, ensure your device is updated to iOS 18.2 or later. This ensures you’re protected from this vulnerability. If you haven’t updated yet and used the app on public Wi-Fi between September and December 2024, consider changing passwords for any accounts you accessed during that period, just to be safe. 

Advertisement

How to update the software on your iPhone

Follow the steps to update your iPhone or iPad:

  • Tap on Settings
  • Tap on General
  • Tap on Software Update
  • If an update is available, it will give you the option to download and install
Apple fixes Passwords app vulnerability enabling Wi-Fi attacks

Software update (Kurt “CyberGuy” Knutsson)

YOUR IPHONE HAS A HIDDEN FOLDER EATING UP STORAGE SPACE WITHOUT YOU EVEN KNOWING

6 ways you can stay safe from hackers targeting your passwords

Apple’s recent security blunder with the Passwords app highlights the importance of taking steps to protect your digital identity. Here are some ways you can stay safe from hackers targeting your passwords.

1) Use a reliable password manager: Apple apps are generally more secure than third-party options, but the Passwords app clearly wasn’t. The fact that the security vulnerability existed for three months before Apple fixed it proves that Apple needs to put more emphasis on keeping customer data secure. I’d suggest opting for a reliable password manager instead of relying on Apple’s offering. Get more details about my best expert-reviewed password managers of 2025 here.

2) Enable two-factor authentication (2FA): It’s good to have a password manager, but you know what’s even better? 2FA. Adding an extra layer of security with 2FA can prevent hackers from accessing your accounts, even if they steal your password. Use authentication apps like Google Authenticator, Microsoft Authenticator or hardware security keys instead of SMS-based codes, which are vulnerable to SIM-swapping attacks.

Advertisement

3) Avoid public Wi-Fi for sensitive activities and use a VPN: Hackers can exploit unsecured public networks to intercept your login credentials. If you must access sensitive accounts on public Wi-Fi, use a VPN to encrypt your internet traffic and prevent attackers from snooping on your data. VPNs will protect you from those who want to track and identify your potential location and the websites that you visit. A reliable VPN is essential for protecting your online privacy and ensuring a secure, high-speed connection. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices.

4) Beware of phishing attacks and install strong antivirus software: You can have all the protection in the world but a phishing email or SMS can still cause havoc. Hackers often use fake login pages to trick you into entering your credentials. Always verify URLs before entering login details, avoid clicking on suspicious links in emails or messages. The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

5) Keep your devices updated: Regularly update your devices and software to ensure you have the latest security patches.

6) Regularly monitor all your accounts: Monitor your accounts for suspicious activity and report any unusual transactions or login attempts to Apple.

APPLE RELEASES EMERGENCY SECURITY UPDATE FOR SERIOUS VULNERABILITY

Advertisement

Kurt’s key takeaway

Three months is a long time for a security flaw in a password manager to go unpatched, especially from a company that presents itself as a leader in privacy and security. This incident highlights a troubling reality. Apple’s security measures are not infallible, and even built-in system apps can expose users to serious risks. While the fix eventually arrived, it should not have taken this long for such a fundamental issue to be addressed. If Apple wants to maintain its privacy-first image, it needs to do better by ensuring more rigorous security testing before launch.

Do you think Apple is doing enough to stay ahead of evolving cyber threats or are there additional steps the company should take to protect its users? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Alert: Malware steals bank cards and passwords from millions of devices.

Ask Kurt a question or let us know what stories you’d like us to cover.

Advertisement

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.

Advertisement

Technology

Meta asks judge to throw out antitrust case mid-trial

Published

on

Meta asks judge to throw out antitrust case mid-trial

Meta has filed a motion for judgment on the antitrust case it’s currently fighting in court. The motion argues that the Federal Trade Commission (FTC) has failed to produce any evidence that Meta unlawfully monopolized part of the social networking market, something the government argues it did through its acquisitions of Instagram and WhatsApp.

The filing was submitted this evening, shortly after the FTC rested its case in a protracted trial before DC District Court Judge James Boasberg. “After five weeks of trial, it is clear that the FTC has failed to meet the legal standard required under antitrust law,” said Meta spokesperson Christopher Sgro. “Regardless, we will present our case to show what every 17-year-old in the world knows: Instagram competes with TikTok (and YouTube and X and many other apps). The FTC spent tens of millions of taxpayer dollars bringing a weak case with a market definition that ignores reality.”

A judgment on partial findings asks a judge to consider a case’s merits before it has been fully argued in court, attempting to speed its resolution. The trial is still currently scheduled to proceed, with Meta launching into its defense against the FTC’s allegations, but the filing offers a preview of its case.

As Meta’s lawyers have done in cross-examination, it takes aim at the agency’s description of Meta monopolizing a “personal social networking services” market that people use to share information with family and friends. It argues that the FTC has failed to demonstrate Meta reduced the quality of its services (a key sign that a company lacks competition) or that it bought Instagram to neutralize a potential rival.

The FTC has made its case with testimony from several high-profile players in Meta’s businesses, including Instagram’s co-founder Kevin Systrom — who aired complaints about Meta’s handling of his company — and its current head, Adam Mosseri, who offered a more optimistic take. Meta has countered by emphasizing the company’s persistent struggles against social networks that the FTC doesn’t consider full competitors, particularly TikTok, which, in the war for those aforementioned 17-year-olds’ attention, Meta portrays as a constant scourge.

Advertisement
Continue Reading

Technology

What hackers can learn about you from a data broker file

Published

on

What hackers can learn about you from a data broker file

Hackers are pretty scary. Amoral, hooded figures with magical computer skills that can break into anything within minutes. 

At least that is what most of us think of when we hear the term “hacker.” It is not exactly a realistic or particularly representative image, but, at the same time, it is not too far off the mark either. 

What many people do not realize is just how much hackers can learn about you from a data broker file, detailed profiles compiled from your personal information collected and sold by data brokers. This hidden industry fuels much of what hackers use to target individuals today.

Join The FREE CyberGuy Report: Get my expert tech tips, critical security alerts, and exclusive deals — plus instant access to my free Ultimate Scam Survival Guide when you sign up!

Illustration of a person’s personal data. (Kurt “CyberGuy” Knutsson)

Advertisement

What is a data broker, and why should you care?

When most people hear the term “data broker,” on the other hand, they draw a blank. Is it a person or company that buys and sells data? Basically, yes. Data brokers collect, sort, analyze, package and sell access to personal information. Whose personal information? Anyone’s and everyone’s, including yours.

THINK YOU CAN DELETE YOUR DATA YOURSELF? HERE’S WHY YOU’RE PROBABLY WRONG

what hackers can learn 2

Illustration of a person’s personal data. (Kurt “CyberGuy” Knutsson)

THINK YOU CAN DELETE YOUR OWN DATA? WHY IT’S HARDER THAN YOU THINK

What kinds of personal information do they deal in?

Here is a list of possible data points you, random companies, your worst enemy, your neighbors and, yes, hackers can find in a data broker file:

  • Full name
  • Past legal names
  • Known aliases
  • Social media handles
  • Gender
  • Sexual preferences
  • Date of birth or age
  • Social Security number (SSN)
  • Current and past home addresses
  • Current and past phone numbers
  • Current, past and secret email addresses
  • Political preferences and affiliations
  • Occupation
  • Current employer
  • Employment history
  • Business associates
  • Education
  • Marital status
  • Marriage and divorce records
  • Family status (number and ages of children)
  • Relatives
  • Property information
  • Vehicle registration
  • Assets
  • Financial information
  • Bankruptcies, judgments and liens
  • Licenses (drivers license, firearms permits, etc.)
  • Court records
  • Criminal records
  • Mugshots
  • Sex-offender status
  • Health history
  • Location data
  • IP information
  • Device information (phone, tablet and computer models)
  • Web browser information
  • Shopping habits
  • Interests and hobbies.

Quite the list, is it not? It is not exhaustive; there is more that data brokers collect and more yet that they and their customers can infer from data points like these. What exactly a given data broker has will depend on which category it falls into.

HACKERS CLAIM MASSIVE BREACH OF COMPANY THAT TRACKS AND SELLS AMERICANS’ LOCATION DATA

Advertisement
what hackers can learn 3

Illustration of a person’s personal data. (Kurt “CyberGuy” Knutsson)

HOW TO GET RID OF ROBOCALLS WITH APPS AND DATA REMOVAL SERVICES

Types of data brokers: Who’s collecting and selling your information?

The most visible data brokers are commonly known as people search sites or people finder sites. These are the sites that show up when you Google yourself, or a hacker Googles you. They are just the tip of the iceberg, though. There are other data brokers that do not bother indexing individual profiles with search engines, preferring instead to deal with other companies and even governments directly. These are the other major types of data brokers, in addition to people search sites:

Marketing data brokers focus more on your browsing habits, past purchases and interests. They are responsible for “personalized marketing” as well as helping other companies target you with those surprisingly relevant ads you see online.

Recruitment data brokers collect and process personal information to offer background screening services to organizations evaluating job candidates or performing background checks before making an offer. Unfortunately, although illegal, there is nothing actually stopping unscrupulous employers from using the much less regulated and reliable people search sites for the same purposes.

Risk mitigation brokers aggregate a variety of background, criminal, property and other information to provide assessment reports to various investment and business companies. The information they collect is aimed at helping such companies manage risk in taking on new business.

Advertisement

Financial information brokers collect various personal finance and background information for credit companies and banks to calculate your credit score and may influence your eligibility to get loans and lines of credit.

Health information data brokers collect information about your general health and sell it to companies in healthcare and related fields. This information can be used to target you with health product ads and even set your insurance premiums.

Hackers are most likely to use people search sites, though; they are easily accessible, eminently searchable, relatively cheap (with trial offers for as little as a dollar) and do not ask any questions. Other data brokers may also sell personal information to hackers, but they tend to sell profiles in bulk.

DATA REMOVAL DOES WHAT VPNS DON’T: HERE’S WHY YOU NEED BOTH

Want your data taken off this market?

It is perfectly normal to want no part in any of this. Unfortunately, there is no federal law on the books in the U.S. that would either prevent this kind of data trade or give you an easy, legally enforced way to opt out.

Advertisement

The good news is that, thanks to an incomplete patchwork of state laws, personal information removal services can approach hundreds of individual data brokers on your behalf with legally binding data-removal requests.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap — and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here. 

Kurt’s key takeaways

It is easy to feel overwhelmed when you realize just how much of your personal information is out there, and how many different players are collecting, selling and using it. But knowing how data brokers operate is the first step to taking back control. Whether it is people search sites or the less visible brokers working behind the scenes, your data is valuable, and you deserve to know who has it and what they are doing with it. The good news is, there are tools and services out there that can help you clean up your digital footprint and protect your privacy. So, do not just sit back and hope for the best — take action and make your data work for you, not against you.

In your opinion, what should be done to give people more control over their data? Let us know by writing us at Cyberguy.com/Contact

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Advertisement

Copyright 2025 CyberGuy.com. All rights reserved.  

Continue Reading

Technology

Love, Death, and Robots keeps a good thing going in volume 4

Published

on

Love, Death, and Robots keeps a good thing going in volume 4

At its best, Netflix’s Love, Death, and Robots creates the same feeling as picking up a collection of sci-fi short stories. You don’t always know what to expect, and not everything is brilliant, but you’re guaranteed to experience something interesting. That was especially true of volume 3 of the animated anthology, which offered nine shorts, all of which were excellent. The latest volume doesn’t quite hit the same heights, nor does it have a singular standout episode like “The Very Pulse of the Machine,” but it’s still a strong offering.

What volume 4 does do well — and it’s something that’s a strength of LDR as a whole — is offer a wide variety of tones and styles. There are still the dark, violent, and hyperreal episodes that are so closely associated with LDR, like “Spider Rose,” a follow-up to last season’s “Swarm,” which tells a cyberpunk story about a woman consumed with revenge who ends up finding it with the help of a very strange creature. There’s also “The Screaming of the Tyrannosaur,” in which trained warriors fight to the death in front of rich dignitaries and royalty, all while racing on dinosaurs. In a strangely inspired bit of casting, the death races are hosted by MrBeast.

But the show also continues to push beyond classic, darker science fiction. There’s a lot of comedy here, for instance. One episode is a confessional for smart devices like connected toothbrushes and toilets, which complain about how horrible it is to serve humans. Another follows a cat intent on world domination, who finds the perfect accomplice when its owners bring home a robotic assistant. And if you enjoyed last season’s “Night of the Mini Dead,” there’s a sequel that similarly turns an alien invasion into a cutesy diorama of death and destruction.

And while the show still skews heavily toward CG animation, there are a pair of great 2D episodes, as well. “How Zeke Got Religion” is pure Heavy Metal and is a story about a group of WWII soldiers who end up fighting a demonic monstrosity summoned by the Nazis. It’s filled with copious amounts of blood and gore and a truly terrifying monster that’s all hands, mouths, and screams. That’s joined by “400 Boys,” a wild and kinetic post-apocalyptic action story about a world filled with warring gangs that join together to fight a group of towering, naked babies that are simply called “boys.”

Volume 4 takes a few fun risks, as well. “Golgotha” is the show’s first fully live-action short, a simple story about a priest, an alien invasion, and a resurrected dolphin who might be the messiah. Like the best of LDR, the episode is satisfying on its own, but it also leaves you wanting to see and learn much more about its world. Not all the episodes are quite so successful. “For He Can Creep” is a fine-if-forgettable tale of a cat fighting Satan, while “Can’t Stop” is an impressive-looking music video that turns the Red Hot Chili Peppers into marionettes but feels pretty out of place amid the rest of the season (and LDR as a whole).

Advertisement

But even the worst episodes of volume 4 are still interesting, and that’s the promise of Love, Death, and Robots, really. Streaming services have helped usher in a new wave of sci-fi anthologies, which have ranged from prophetic and impactful to completely unnecessary. LDR might be the most consistent modern example of the form. It’s funny, violent, and surprising — and almost never boring.

Volume 4 of Love, Death, and Robots is now streaming on Netflix.

Continue Reading
Advertisement

Trending