Hello, welcome to the Wednesday, March 27th, 2019 edition of the Sands and the Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Madrid, Spain.

Well, today we got updates from Apple for pretty much all of its products. This, of course,

comes at the back end of the big announcements yesterday,

and in addition to new features, there are also a large number, about 50 or so different

security vulnerabilities that are being addressed by these updates. This affects two Windows

applications as well. ICloud and iTunes for Windows have been updated. The main issue here is WebKit vulnerabilities that are being addressed, but for ICloud it also fixes some issues that sort of sound like these DLL loading vulnerabilities that are being exploited if you are launching the application

or installing the application from an untrusted directory.

In addition to updates for these Windows applications, we have updates for Safari, also security

updates for macOS Mojave and high Sierra, Sierra, TBS, and Xcode and iOS.

The Xcode issue is, rather sort of addressing a kernel approach escalation vulnerability.

One interesting vulnerability in iOS sort of caught my attention.

And they're talking about the ability to execute arbitrary code if you are clicking on a link

within an SMS message. Also interesting, this vulnerability is located in the Geoservices subsystem.

Also, in Mail, this update fixes another problem with S-Mime.

Of course, last year, there was a lot of news around how S-Mime cannot necessarily be trusted.

At this point, I haven't seen any reports of any problems with this particular update.

If you don't hear anything by the time you are listening to this podcast, it's probably

good idea to update your devices.

And Aces responded to yesterday's news from Kaspersky that its life update software was backdoored and used by an advanced persistent threat actor in order to modify selected target systems.

The press release states that AIS has modified the software to hopefully prevent a repeat of such an attack

that they put in some internal checks to make sure the software didn't get modified

...