Transcript
Brian McCullough (0:04)
Welcome to the Techmeme ride home for Thursday, January 9th, 2025. I'm Brian McCullough. Today, big new zero day to tell you about Apple says Siri is Safe Honest Google rolls out an AI Daily Listen audio feature looking at the next wave of wearable AI. And let me tell you about WatchDuty, the app that everyone in LA was using overnight. Here's what you missed today in the world of tech Foreign is warning that threat actors exploited a critical rated zero day in its widely used Connect Secure VPN tool to compromise its corporate customers networks. Quoting TechCrunch, Avanti said on Wednesday that the critical rated vulnerability, tracked as CVE2025 0282, can be exploited without any authentication to remotely plant malicious code on Avanti's Connect Secure, Policy Secure and ZTA gateways products. Says its Connect Secure Remote Access VPN solution is the most widely used adopted SSL VPN by organizations of every size across every major industry. This is the latest exploited security vulnerability to target Ivante's products in recent years. Last year, the technology maker pledged to overhaul its security processes after hackers targeted vulnerabilities in several of its products to launch mass hacks against its customers. The company said it became aware of the latest vulnerability after its Avanti Integrity checker tool flag malicious activity on some customer appliances. In an advisory post published on Wednesday, Avanti confirmed threat actors were actively exploiting a quote zero day, which means the company had no time to fix the vulnerability before it was discovered and exploited, and that it was aware of a limited number of customers whose Avanti Connect Secure appliances were hacked. Avanti said a patch is currently available for Connect Secure, but that patches for Policy Secure and ZTA gateways, neither of which have confirmed exploitability, won't be released until January 21. The company said it also discovered a second vulnerability which has not yet been exploited. Avanti has not said how many of its customers are affected by the hacks or who is behind the intrusions. Spokespeople for Avanti did not respond to TechCrunch's questions by press time.
Unknown (2:10)
End quote.
Brian McCullough (2:15)
Apple wants you to know it has never used Siri data to build marketing profiles and never sold it for advertising or other purposes. This comes, of course, after they had to pay up $95 million to settle a lawsuit around activities that sounded like they were doing that very Quoting the Verge Apple is refuting rumors that it ever let advertisers target users based on Siri recordings. In a statement published Wednesday evening describing how Siri works and what it does with data. The section specifically responding to the rumors reads, apple has never used Siri to build marketing profiles, never made it available for advertising, and never sold it to anyone for any purpose. We are constantly developing technologies to make Siri even more private and will continue to do so. The conspiracy theory the company is responding to resurfaced last week after Apple agreed to pay $95 million to settle a lawsuit over users whose convers were captured by its Siri voice assistant and potentially overheard by human employees. Apple's statement tonight says it does not retain audio recordings of Siri interactions unless users explicitly opt in to help improve Siri, and even then the recordings are used solely for that purpose. Users can easily opt out at any time. Facebook responded to similar theories in 2014 and 2016 before Mark Zuckerberg addressed it directly, saying no to the question while being grilled by Congress over the Cambridge Analytica scandal in 2018.
