Archive for Apple

Apple Says Fixes On The Way For Recently Discovered Vulnerabilities

Posted in Commentary with tags , on June 20, 2015 by itnerd

You’ll recall that earlier this week a team of researchers discovered some serious vulnerabilities in iOS and OS X that could allow all sorts of really bad things to happen to users. Plus Apple appears to have done nothing after having six months to fix these issues. Well, Apple has popped up and said that fixes are on the way. In a statement provided to iMore, Apple confirmed that they knew about these vulnerabilities and then they said this:

“Earlier this week we implemented a server-side app security update that secures app data and blocks apps with sandbox configuration issues from the Mac App Store. We have additional fixes in progress and are working with the researchers to investigate the claims in their paper,” 

That’s great, but the real question is this: Why does it take six months and bad press to get the ball rolling to get fixes into the hands of users? Apple, would you care to answer that question as I am sure users of their products would be interested in that answer, and how you as a company can be trusted to keep users safe.

New Research Reveals Serious Security Flaws in iOS And OS X…. And Apple Has Had 6 Months To Fix It

Posted in Commentary with tags , on June 17, 2015 by itnerd

MacRumors has posted research from a team at Indiana University who have discovered a very serious security issue with iOS and OS X:

A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.

Oh joy. So much for Apple products being secure. If I were you, I’d take the time to not only read the article but to watch the YouTube videos in the article. It’s detailed and a bit technical, but it will open your eyes. So will this:

Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker’s request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.

What is with companies not addressing security flaws like these in a timely manner? I say that because just yesterday Samsung was accused of not acting quickly to address a serious security issue. I say that if companies don’t want to do this as a part of their normal business practices, perhaps legislation or lawsuits might be the way to go?

FBI Nabs Chicago Man’s Computers In Relation To Epic iCloud Hack

Posted in Commentary with tags , on June 11, 2015 by itnerd

Remember that iCloud hack that resulted in the nudie pix of various celebrities being leaked to the world? Well, the FBI apparently has hit the home of a Chicago man and taken all his computers as part of the investigation. Here’s what Gawker had to say:

A recently unsealed federal search warrant and related affidavit pertaining to the FBI’s investigation into the iCloud hacker ring shows the investigation moving offline. On October 15th, 2014, federal agents entered the neat, modest brick home of Emilio Herrera on the South Side of Chicago. According to a sworn affidavit by Special Agent Josh Sedowsky of the FBI’s Cybercrimes Unit, someone in this house had been on an iCloud hacking spree.

“Based on victim account records obtained from Apple,” Sedowsky wrote, “one or more computers used at [Herrera’s house] access or attempted to access without authorization multiple celebrities’ e-mail and iCloud accounts over the course of several months.

Now, here’s the part that has me floored:

Herrera’s alleged iCloud cracking went way beyond that narrow list of celebs: between May 31, 2013, and August 31, 2014, his IP address “was used to access approximately 572 unique iCloud accounts,” and “in total, the unique iCloud accounts were accessed 3,263 times.”

Really? He didn’t hide his own IP address? Folks, he isn’t some sort of hacking mastermind. He’s a low grade script kiddie. Of course that assumes that he’s the responsible party as he hasn’t been charged with anything. Yet. Stay tuned to this space to see if he does get charged.

So, What Did Apple Announce Today At WWDC 2015? [UPDATED]

Posted in Commentary with tags on June 8, 2015 by itnerd

The answer is quite a bit. Here’s the rundown:

  • OS X 10.11 is going to be named El Capitan which will ship this “fall” as a free upgrade. El Capitan is a vertical rock formation in Yosemite National Park for those who wonder where the name comes from. Click here for more info on that. The point of the name is that this is an enhancement to Yosemite. Key enhancements include:
    • Safari allows sites to be pinned to the tab bar. If a window is closed and reopened, the pinned sites reload instantly.
    • Cursor gets bigger to help find it when waking a Mac.
    • Tabs show if music or video is playing in the background, allows users to mute background tabs easily.
    • Spotlight includes better contextually aware results.
    • New snapping apps feature, No doubt “borrowed” Microsoft Windows.
    • Can split apps left and right on the screen, slide the windows to make them bigger or smaller.
    • New Power User features making it easier to deal with lots of windows.
    • Increased speed and performance.
    • Better battery life for notebooks.
    • Better graphic performance.
  • iOS 9 was announced and will show up as a free update in the fall. It will support any device that supports iOS 8. The feature set for that is as follows:
    • Siri gets a new user interface and becomes more proactive. For example, if you run in the morning, your phone can learn that you like to listen to music. It can offer music when you plug in headphones. Plus it is context sensitive to time and place.
    • New search window, offers commonly used apps or contacts, one-tap links to nearby locations like food and drink, or breaking news. Search is also improved.
    • Privacy has also been improved in iOS 9. Things you do such as searches are not associated with your Apple ID but a randomized identifier instead. Plus they’re not linked to other Apple services nor are they shared with third parties.
    • Enhancements to the Notes app are coming which include formatting options, checklist options, photos and drawing/sketching tools.
    • The much maligned Maps app has been improved. Transit will be a major focus. It will support a number of cities at launch in Canada (in the form of Toronto only), US, and China.
    • A new app called News will replace Newsstand. It will bring iOS users news from the world’s greatest sources, personalized for them. To emphasize the privacy spin on iOS 9, Apple points out that what you read is not linked to other apple services.
    • Two-factor authentication support is now present to protect data in iCloud.
    • Reductions in the amount of free space you need to get to iOS 9 from 4.6GB in iOS 8 to 1.3GB.
    • Lots of additional health metrics to be tracked including reproductive health.
    • HomeKit: Adding support for Window Shades, CO sensors, motion sensors, security systems. You can access your home remotely and securely through iCloud.
    • CarPlay is going to do a whole lot more in cars that support it. Plus you will not have to take your iPhone out of your bag or pocket to do anything.
  • Apple Pay was discussed as well. Here’s the key points.
    • They announced that they were working with Square to enable small businesses to accept Apple Pay. Square is launching reader to accept Apple Pay this fall.
    • Pinterest will launch buyable pins using Apple Pay.
    • Apple Pay will be coming to the UK. Users will be able to commute and pay for fares on London’s Underground with Apple Pay along with having support from a number of UK banks at launch.
    • Support for store credit and debit cards is coming. Store cards offer unique membership benefits. Kohl’s, JCPenney, BJ’s. Loyalty and rewards cards are coming too.
    • Dunkin’ Donuts will support Apple Pay this fall.
    • Passbook is being renamed “Wallet.”
    • One thing that I do note is that there is no mention of Apple Pay coming to Canada. I wonder what the deal is with that?
  • The iPad was mentioned today in the context of new functionality with iOS 9. They include:
    • Better multi-tasking on iPad.
    • New QuickType keyboard. Plus shortcuts are coming to the bar. Cut, paste, formatting now included. Finally you can put two fingers on the iPad keyboard and it becomes a trackpad to move the cursor and make selections.
    • New task switcher and full screen previews of apps on the iPad. A finger-swipe from the slide brings in an app,
    • Picture-in-picture with currently playing videos while in another app.
    • Better performance and better battery life.
  • Swift 2 which is Apple’s programming language was also announced today. It’s going to go open source. That should increase adoption in a huge way.
  • watchOS 2 is coming this fall to an Apple Watch near you. Enhancements include:
    • Timepiece functions. You can now use a picture as your watch face for example.
    • Health and fitness: Your favorite health and fitness apps can run natively on the watch.
    • Apple Pay
    • Maps
    • Siri
    • Native HomeKit support
    • Digital Touch improvements including color in drawings.
    • FaceTime Audio
    • Better WiFi support when not connected to an iPhone.
    • Mail. You can now reply to an e-mail on the watch.
    • Nightstand mode: Display the time, set an alarm that will wake you up in the morning and you can snooze or turn off the alarm with the buttons on the side.
  • Tim Cook used the “One More Thing” tagline that the late Steve Jobs was so fond of using in this keynote to announce Apple Music which presumably is the rebrand of the Beats Music service that they got when they bought Beats. It’s described as ” the first ever worldwide live radio station, broadcast from three cities that plays music not based on research or genre or drumbeats. Only music that it great and feels great.” It’s Launching in 100 countries later this month with iOS 8.4, and a new version of iTunes for Mac and Windows, Interestingly, there’s Android coming this fall.

I’ll be adding relevant links later today including a link to the WWDC keynote for you to watch. Check back later to see them.

UPDATE: A link to the keynote can be found here when they post it later today. I’ve updated this story with links on Apple’s website relating to what was announced.

An Old Vulnerability Returns To Threaten Macs

Posted in Commentary with tags , on June 1, 2015 by itnerd

Just recently Apple patched the Thuderstrike vulnerability. Or so it was thought. Let me quote Security researcher and Apple hacker Pedro Vilaca:

The attack requires you to reverse the boot script implementation, which is a royal pain in the ass. EFI binaries are a bit annoying to reverse even with the assistance of Snare’s EFI utils. IDA also has some bugs regarding EFI binaries.
While doing some experiments with flashrom I finally noticed something big. I couldn’t believe it the first time so I tried it in other Macs and it was indeed true. Macs have an even bigger hole than Dark Jedi.

Drum roll…

What is that hole after all? Is Dark Jedi hard to achieve on Macs?
No, it’s extremely easy because Apple does all the dirty work for you. What the hell am I talking about?
Well, Apple’s S3 suspend-resume implementation is so f*cked up that they will leave the flash protections unlocked after a suspend-resume cycle. !?#$&#%&!#%&!#

And you ask, what the hell does this mean? It means that you can overwrite the contents of your BIOS from userland and rootkit EFI without any other trick other than a suspend-resume cycle, a kernel extension, flashrom, and root access.

Wait, am I saying Macs EFI can be rootkitted from userland without all the tricks from Thunderbolt that Trammell presented? Yes I am! And that is one hell of a hole :-).

In short, if you never turn off your Mac, meaning you put it to sleep or leave it running, you can get the EFI BIOS taken over remotely. Thus your Mac gets pwned without physical access being required. Scary indeed. The only defense against this flaw is to always shut down the computer and never put it to sleep.

Now here’s where it get really scary:

I have tested against a MacBook Pro Retina, a MacBook Pro 8,2, and a MacBook Air, all running latest EFI firmware available. And every single one is vulnerable.

It appears that latest MacBook models are not vulnerable but I’m not 100% sure about this. I couldn’t fully test it on a recent model (the owner was afraid of giving me root access ;-)). The first impression was that the bug was silently fixed by Apple but this requires extensive testing to be sure (or some EFI binary disassembling).
I expect all mid/late 2014 machines and newer to not be vulnerable. Apple either fixed it by accident or they know about it. It’s not something you just fix by accident, just sayin’.

In other words, only Apple’s latest and greatest Macs are protected. If you have any Mac older than mid 2014, you may have cause for concern. You can bet that Apple is aware of this. But are they doing something about it for users of ALL their products? That’s the question.

Android Auto & Apple CarPlay Coming To 2016 Chevrolet Models

Posted in Commentary with tags , , on May 27, 2015 by itnerd

If you’ve been looking for a car that has Car Play from Apple or Android Auto from Google, the company that will have to go onto your shopping list is going to be GM. That’s because they made an announcement today that both platforms will be available on 14 2016 Chevrolet models in Canada as well as Mexico and Brazil among other markets.

The size of the touchscreen inside a GM vehicle govern’s what you get. Chevrolet’s seven-inch MyLink system gives owners a smart and simple way to access both Android Auto and Apple CarPlay. The eight-inch version of MyLink will be compatible only with Apple CarPlay at the beginning of the 2016 model year. While development and testing is not yet complete, Android Auto compatibility may be available on the eight-inch version of MyLink later in the 2016 model year. So stay tuned on that front.

Expect other automakers to accelerate their plans to get Car Play and Android Auto into their cars to keep GM from stealing the spotlight.

Another iOS Flaw Breaks Security For Thousands Of Apps

Posted in Commentary with tags , on April 27, 2015 by itnerd

Fresh off the heels of this flaw in iOS along with this flaw in iOS comes another flaw that is a real threat to iOS users. Here’s the details:

We began auditing the AFNetworking SSL code after the previous vulnerability was announced. Version 2.5.1 would accept self-signed certificates (pretty much game over for your users’ data). It was released for only 6 weeks, and yet 1,500 apps+ were affected.

A few weeks ago, we found that version 2.5.2 did fix this issue, but there was another flaw nearby in the same code. Domain name validation could be enabled by the validatesDomainName flag, but it was off by default. It was only enabled when certificate pinning was turned on, something too few developers are using.

This meant that a coffee shop attacker could still eavesdrop on private data or grab control of any SSL session between the app and the Internet. Because the domain name wasn’t checked, all they needed was a valid SSL certificate for any web server, something you can buy for $50.

This flaw affects up to 25,000 apps which is downright scary. If you’re worried about this, and you should be, SourceDNA set up an online service called Searchlight that can be used to check if the iOS apps installed on your iDevices are vulnerable.

One thing that you should know is that this service shows that apps from large developers like Microsoft, Yahoo and Google are potentially affected by the AFNetworking flaws. It really sounds like Apple and a lot of other people have a lot of work to do to fix this before some evil doer exploits this.

Apple Sells Tons Of iPhones, Makes Piles Of Money And Gives Some Back To Shareholders

Posted in Commentary with tags on April 27, 2015 by itnerd

It must be nice to be Apple these days. They came out with their quarterly results and here are the highlights:

  • Apple reported a profit of $13.6 billion with revenue up 27% to $58 billion.
  • Apple sold 61.1 million iPhones in the first three months of 2015.
  • Apple sold 12.6 million iPads, down 23% from a year earlier.
  • Apple is increasing its share-buying program which will return $200 billion to investors, up from $130 billion.
  • Apple has an outrageous $195 trillion in cash on its books. There are countries that don’t have that amount of cash.

Clearly, it’s good to be Apple.

Bug In iOS Can Remotely Cause Reboots And Crashes

Posted in Commentary with tags on April 23, 2015 by itnerd

Oh look here. There’s a nasty bug in iOS that can cause your device to reboot and crash among other things if it is in the range of a malicious WiFi network. Here’s the details:

Skycure bods Adi Sharabani and Yair Amit say the attack, dubbed “No iOS Zone”, will render vulnerable iOS things within range unstable – or even entirely unusable by triggering constant reboots.

“Anyone can take any router and create a Wi-Fi hotspot that forces you to connect to their network, and then manipulate the traffic to cause apps and the operating system to crash,” Sharabani told the RSA security conference in San Francisco today.

“There is nothing you can do about it other than physically running away from the attackers. This is not a denial-of-service where you can’t use your Wi-Fi – this is a denial-of-service so you can’t use your device even in offline mode.”

Charming. The good news is Apple is working on a fix. However, there’s basically no way to protect yourself as there’s no way to tell if you’re in range of one of these networks. So until this is fixed, if your iDevice constantly reboots, you’ll have to get out of range of whatever network is causing it.

Apple Security Questioned As Researcher Finds Method To Bypass OS X Security

Posted in Commentary with tags on April 23, 2015 by itnerd

This week has not been a good week for Apple on the security front. After serious bugs in iOS and OS X were disclosed yesterday, a researcher by the name of Patrick Wardle, director of research at Synack says that all of the protections in OS X are simple to bypass and pwning a Mac as an attacker isn’t hard. Here’s the high level overview starting with Gatekeeper which is a key security framework of OS X:

“Gatekeeper doesn’t verify an extra content in the apps. So if I can find an Apple-approved app and get it to load external content, when the user runs it, it will bypass Gatekeeper,” Wardle said in a talk at the RSA Conference here Thursday. “It only verifies the app bundle.” 

Lovely. But Gatekeeper is backed up by XProtect which protects a Mac from malware. That has to come to the rescue, right? Wrong:

Getting past XProtect turns out to be just as simple as bypassing Gatekeeper. Wardle found that by simply recompiling a known piece of OS X malware, which changes the hash, he could get the malware past XProtect and execute it on the machine. Even simpler, he could just change the name of the malware, which also lets it sneak in under the fence.

“It’s trivial to bypass XProtect,” he said.

Great. But OS X sandboxes apps. Surely that provides protection. Well….. :

“While the core sandbox technology is strong, there are plenty of bugs that can bypass it,” he said. 

This is depressing. But apps have to be code signed so that they can run on OS X. That’s not much good apparently:

“The code signing just checks for a signature and if it’s not there, it doesn’t do anything and lets the app run,” he said. “I can unsign a signed app and the loader has no way to stop it from running.” 

Why is that? Here’s why:

The check for this runs in user mode, which is a huge security fail because the attacker would be in user mode.” he said. “He could just modify a kernel extension or load unsigned ones.” 

Bottom line. OS X security isn’t secure. This report isn’t going to go over well at 1 Infinite Loop. Plus you can bet that evil doers are right now using this info to stage attacks on Macs. Which means Apple needs to step up their game when it comes to security. And they need to do it now.