Appsec adventures

Apple's Security Engineering and Architecture and Camera & Photos teams introduce Apple Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that lets a photographer create a securely timestamped reference image accurately reflecting what the camera sensor captured. The post argues that AI-generated and altered photorealistic images make "it looks like a photo" insufficient when a photograph's essential role is to prove something happened, and that existing C2PA-based approaches fall short: they sign after capture, remain vulnerable to compromise anywhere in the editing chain, and can tie images to a public identity, endangering photographers in conflict zones. Apple's design meets three requirements: semantic authenticity (the image faithfully shows what the sensor captured, with processing publicly verifiable), resilience to compromise (including sensor removal, cryptographic attacks, and jailbreaks), and ...

A BBC News report on a cyber attack that hit hundreds of French supermarkets, causing fridges and freezers to heat up and spoiling fresh and frozen food estimated to be worth millions of euros. Hackers gained control of the software regulating refrigeration temperatures, forcing some units to warm to 50C overnight—one chain's fridges reportedly stayed at that temperature for six hours, and in some places there were even small fires. The attack targeted software from Danish engineering firm Danfoss that lets retailers manage cold units remotely; Danfoss said the affected units were older models whose security software could not be updated to address a risk it had identified, and that it had long advised businesses to keep supported systems up to date. More than 100 Coopérative U supermarkets were targeted, while 180 Intermarché and Netto stores were affected and another 100 were urgently disconnected from the internet. Carrefour, Monoprix, and E.Leclerc were also hit; Carrefour repo...

PCMag Principal Writer Neil J. Rubenking, who has reviewed antivirus software for nearly 40 years and installed well over a thousand apps, shares eight mistakes people make when installing antivirus and how to avoid them. The advice: be aware of all the features you paid for, including add-ons like VPNs, password managers, and bonus apps that only appear in the app's online console; skip installing features you don't want, especially browser extensions that hijack your homepage, new tab page, or search engine, and proprietary browsers offered during install; keep everything up to date, since manual update checks often surface updates the app claims don't exist, and confirm frequent update checks are configured; always run a full scan after installing, because the "initial scan" offered at the end of setup is often a quick or smart scan rather than a full look; schedule scans, since full scans and real-time protection don't always handle malware the same way, s...

Dan Haiem, CEO of AppMakers USA, explains how AI provider keys end up exposed in mobile apps and what a secure setup looks like. The piece opens with a Wake Forest University study of 444 iPhone AI chatbot apps, 282 of which exposed paid AI access through their network traffic—researchers simply watched what apps sent over the network and collected credentials as they passed, letting anyone run AI requests on the developer's account. Worse, when the researchers warned all 282 developers and waited three months, only 28% had clearly fixed the problem. Haiem attributes the problem to speed to launch (calling the AI provider directly from the app skips building a backend), AI-generated code that ships unreviewed with keys in config files, prototypes quietly becoming production apps, and the false belief that a compiled app hides its secrets. The study sorted leaks into three patterns: replayable tokens (136 apps—tokens that leak and stay valid far too long, one expiring in 2125 and an...

Dimitri Stiliadis of Endor Labs explains why traditional software composition analysis tools produce so many false positives (and sometimes false negatives), especially for Python and JavaScript. The root cause is that in most languages the package manager and the compiler or runtime operate in isolation—"like ships in the night"—so dependency definitions are human-driven and the runtime never checks them. Because most SCA tools simply scan the file system for manifest files, parse them, assume the declared dependencies match what the code actually uses, build a dependency graph, and generate an SBOM with vulnerability analysis, they miss four situations: phantom dependencies (packages imported in code but not declared, causing false negatives), misused dependency scopes (dev or test dependencies actually used at runtime), direct use of transitive dependencies (leading to wrong severity and remediation advice), and unused dependencies (declared but never used, causing false p...

Juraci Paixão Kröhling of OllyGarden describes finding personal data, credentials, and secrets in real OpenTelemetry telemetry at banks, fintechs, health platforms, and IoT companies—in traces, metrics, and logs alike. Examples include a bank's trust store password, passed as a Java command-line flag, captured by the process resource detector into process.command_line and replicated onto every span; OAuth codes, access tokens, and JWTs in url.query and url.full, sometimes URL-encoded twice; bearer tokens in captured headers; Brazilian tax IDs in logs and metric attributes; clinician PII from an ORM logging every SQL statement with bound values; phone numbers as Prometheus labels; and database connection strings with embedded credentials. The post argues most leaks come from tools doing what they were configured to do—resource detectors, HTTP instrumentation defaults, wildcard header capture, ORM logging—rather than careless developers, and that SIEM tools miss them because they rea...