Archive for iOS

Researcher Says “Backdoors” Closed In iOS 8…… Mostly

Posted in Commentary with tags , , on September 10, 2014 by itnerd

You might remember that security researcher Jonathan Zdziarski caused the planet to freak out because he found “backdoors” in iOS that could allow anyone to snoop on unsuspecting users. He then release a proof of concept video showing how easy they were to exploit and Apple’s response left most unimpressed.

Fast forward to today. Zdziarski has had a chance to look at iOS 8 and here’s what he had to say:

After some preliminary testing, it appears that a number of vulnerabilities reported in my recent research paper and subsequent talk at HOPE/X have been addressed by Apple in iOS 8. The research outlined a number of risks for wireless remote surveillance, deep logical forensics, and other types of potential privacy intrusions fitting certain threat models such as high profile diplomats or celebrities, targeted surveillance, or similar threats.

But before you celebrate, read this:

While closing off the file_relay service greatly improves the data security of the device, one mechanism that hasn’t been addressed adequately is the ability to obtain a handle to application sandboxes across a USB connection, even while the device is locked. This capability is used by iTunes to access application data, but also presents a vulnerability: commercial forensics tools can (and presently do) take advantage of this mechanism to dump the third party application data from a seized device, if they have access to (or can generate) a valid pairing record with the device. For example, if you are detained at an airport or arrested and both your laptop and your phone is seized, or if your phone is seized unlocked (without a laptop present), a number of forensics tools including those from Oxygen, Cellebrite, AccessData, Elcomsoft and others are capable of dumping third party application data across USB. It is not designed to be protected with a backup password either, putting the data at risk of being intercepted in cleartext. Because a pair record can unlock the data-protection encryption using the EscrowBag included in the record, this data can be dumped if the device has not been shut down or rebooted since it was last used. Still, because this information is only accessible with physical possession of the device (and no longer wirelessly), the risk is less than in prior versions of iOS.

If you’re an iOS user, you should read his entire post. It’s very enlightening. In the meantime, I wonder if Apple will have any comment on if and how they plan to address what he found.

MS Office For iPad Announced

Posted in Commentary with tags , on March 27, 2014 by itnerd

Satya Nadella the freshly minted CEO of Microsoft announced Office for iPad today. Word, Excel, and Power Point will be free downloads and will include viewing and presenting capabilities free of charge. If you want to edit or create documents,you will need an Office 365 subscription which is priced at $9.99/month or $99.99/year for a Home Premium package allowing access from multiple computers and mobile devices. You can download the apps from the App Store today.

More info can be found in this blog entry from Microsoft. Will you be downloading a copy?

Install Box On Your iOS Device, Get 50GB Of Storage Free

Posted in Commentary with tags , , on January 16, 2014 by itnerd

I had to post this as it was way too good a deal to not pass along.

If you need to store data in the cloud. Take a look at Box. Now they have always offered 10GB free to anyone which is very generous. But if you install the latest version of their app which has been completely rewritten for iPhone and iPad, they’ll give you 50GB free. There is a downside. The file upload size is limited to 250MB. Thus if you have large files to store, you’ll need to use a different service for those. But it does support Macs and PCs as well so that you can have your cloud based files everywhere.

This offer is available to new users and existing users. I’m not sure how long it lasts, thus you should act quickly.

Apple Maps Error In Alaska Fixed…. Sort Of

Posted in Commentary with tags , on September 26, 2013 by itnerd

Yesterday I reported on the fact that people who wanted to get to the airport in Fairbanks Alaska were navigated onto the runway of the airport. Today it’s been kind of, sort of, fixed:

Apple has created a temporary “you can’t get there from here” fix for the iPhone map app that directed Fairbanks drivers onto a taxiway at Fairbanks International Airport.

It took directions to the airport off the map, unless you type in the exact street address for the Fairbanks terminal.

As of Wednesday, users of iPhone Maps who asked for directions began seeing a message that “a route could not be determined” to the Fairbanks airport. This gets rid of the map error that gave turn-by-turn directions for drivers who wanted to reach the airport to end up on Taxiway Bravo.

I rarely know the exact street address for any airport I go to. I just simply type in the name of the airport into my mapping app which currently is Google Maps and I get there just fine. So from that standpoint this is a bit of a #fail. But at least nobody will be driving onto runways anymore.

#FAIL: Apple Maps Sends Alaskans Onto Airport Runway

Posted in Commentary with tags , on September 25, 2013 by itnerd

This isn’t going to help the reputation of Apple Maps in any way, shape, or form. According to the Alaska Dispatch, people using Apple Maps in Fairbanks Alaska to get themselves to the local airport are being directed onto an airport runway:

At least twice in the past three weeks, drivers from out of town who followed the directions on their iPhones not only reached airport property, but also crossed the runway and drove to the airport ramp side of the passenger terminal.

“These folks drove past several signs. They even drove past a gate. None of that cued them that they did something inappropriate,” said Melissa Osborn, chief of operations at the Fairbanks airport.

Now some common sense should come into play here to say that going onto an active runway at an airport is a bad idea. However, Apple Maps should not be directing them onto the runway in the first place. Thus it’s a #fail for Apple Maps. What makes the situation worse is this:

The problem was supposed to have been fixed promptly, according to reports form the Apple legal department to the attorney general’s office and Department of Transportation and Public Facilities, but it hasn’t been, Spear and Osborn said. 

 “We asked them to disable the map for Fairbanks until they could correct it, thinking it would be better to have nothing show up than to take the chance that one more person would do this,” Osborn said.

 A “lot of legal speak” ensued, Spear said. 

On Sept. 20, it happened again. The airport has since closed the aircraft access route to Taxiway Bravo from the Float Pond Road.

A Notice to Airmen has been issued and new barricades are in place. Airport officials said they will not be removed until it is clear the maps are corrected. Spear and Osborn said that Apple officials have assured the state the problem will be fixed by Wednesday. As of Tuesday afternoon, the app continued to direct passengers to use Taxiway Bravo to access the airport.

Apple Maps hasn’t been on my radar screen for a while as it hasn’t done anything like this recently. But seeing as iOS 7 just appeared along with new iPhones, the timing for this sort of thing to happen isn’t exactly optimal for Apple. Hopefully they fix this today. Otherwise, this will be a story that stays in the news for reasons that are all bad for Apple.

How To Fix Three Things About iOS 7 That Will Annoy You

Posted in Tips with tags , on September 20, 2013 by itnerd

So I’ve been using iOS 7 for a couple of days and there have been a few things that annoyed me. But they were easy to to fix and I’d thought that I would share how I fixed them so that you won’t have to wonder how to address these if you feel the same way:

  • Text or iMessages with first names only: iOS 7 changes a behavior that users of iOS 6 or earlier have been used to by only displaying the contact’s first name in Messages. That’s fine unless you have multiple people in your contact list with the same first name like I do. Then it’s a #fail. Here’s how to change that. Settings -> Mail, Contacts, Calendars ->Contacts. Now find Short Name and turn it off.
  • Battery Life: I noted that my battery life wasn’t what it was like under iOS 6. I traced it to three things:
    • AirDrop: When it’s on, it’s constantly looking for iPhones to share data with. Which means it is using your battery life. Turn it off and if you need it, use Control Center to turn it on. Just don’t forget to turn it back off when you’re done.
    • Frequent Locations: I spoke about this feature here. Since it’s always on, it’s always using battery power. Do yourself a favor and turn it off.
    • Background App Refresh: It’s handy to have apps that constantly update themselves. But there’s no free lunch as they consume battery power to do it (not to mention add to your data charges). Do yourself a favor and go to Settings -> General  -> Background App Refresh and disable apps that you don’t want to refresh in the background constantly (Like Shazam. Why does that need to constantly refresh? Anyone?). However, you might want to consider keeping apps that use Location Services such as Strava or Google Maps on.
  • Moving Wallpaper: A new feature in iOS 7 is the wallpaper appears to pan around as you move your phone to give a three dimensional like view. It’s called a parallax effect. This was cool for about a day and then got a bit annoying for me. Here’s how to turn that off. Go to Settings -> General -> Accessibility. Turn on Reduce Motion.

Does anyone have any fixes for things that they’ve found annoying in iOS 7? Post a comment and share your wisdom.

iOS 7 Suffers From Lock Screen Bug [UPDATED X2]

Posted in Commentary with tags , on September 19, 2013 by itnerd

Unlike the issue that I wrote about earlier today, this one is a real problem. Here’s the deal as described by MacRumors. To hack into an iPhone that has it’s screen locked, all you have to do is this:

  • Swipe upwards on the lock screen to access the Control Center
  • Open the Clock app
  • Hold the phone’s sleep button until you see “Slide to Power Off”
  • Tapping on cancel and then double clicking on the home button will open the phone’s multitasking screen
  • You now have access to the camera and the photos. The key to the trick, however, is to access the camera app from the lock screen first, causing it to appear in the recently used apps list. Because the photos from the camera app can be shared via Flickr, Twitter, Facebook, and email, an intruder can also gain access to those apps using the sharing tools.

When I tried it, I could not reproduce this. But the person who found this posted a video to YouTube to prove that this exists:

Now this isn’t the first lock screen bug the iPhone has had, but it’s never good when these bugs exist. The best way to keep yourself safe is to turn off Control Center:

  • Go to Settings
  • Go to Control Center
  • Find Access On Lock Screen and turn it off

As usual, there’s no comment from Apple. But it’s a safe bet that this will get addressed in an update that’s coming soon to an iPhone near you.

UPDATE: It took me three tries, but I was able to reproduce this.

UPDATE #2: Apple has told AllThingsD that it is working on a fix.

What Is This Frequent Locations Thing in iOS 7?

Posted in Commentary with tags , on September 19, 2013 by itnerd

Something that I tripped over today is something called Frequent Locations. To find it, go to Settings -> Privacy -> Location Services -> System Services. This is what you will see:

Photo 1

From what I can tell, it keeps track of places you’ve been. In my case, it’s already identified my home location as well as a few locations I’ve visited since I’ve updated to iOS 7 yesterday. I should also note that I have not used Maps to do navigation since I’ve updated, so it’s figuring this out on the fly. Not only that, there is an option called Improve Maps which sends this info to Apple to help it to improve Maps. And it’s on by default which bothers me a bit. But at least if you click Learn More, you’ll clearly see what they’re collecting and how it’s stored.

Now I should point out the following just to balance this a bit:

  • Mapping apps like Google Maps do some version of this. Though they may not do this by default. It may be worth your while to check to see what your mapping app does and doesn’t do.
  • This is likely an extension of the location gathering opt-in option the iPhone has had for years. Although it’s kind of buried and I likely would not have noticed it if I had not been just figuring out what iOS 7 could do. I think it’s safe to assume that the casual user would not find this.
  • Many Android phones do this sort of thing as well. This isn’t something that is unique to Apple.

So, here’s the burning question: Are you bothered by this or is this much ado about nothing? Please cast your vote below:

And for the record, I’ve turned this off on my iPhone 5. It will likely save me some battery life by doing so. I do not think that there’s anything sinister going on here. But if you ask me, It might be handy for Apple to address this so that this doesn’t get blown way out of proportion.

Why Reports Of A “Serious” iOS 7 Security Flaw Are Overblown

Posted in Commentary with tags , on September 19, 2013 by itnerd

Last night MacRumors posted a report which was promptly picked up by Boy Genius Report today that iOS 7 has a “serious” security flaw that disables the Find My iPhone feature. Here’s the description from MacRumors:

As one MacRumors reader noticed, Siri can also activate Airplane Mode, even if a passcode lock is set, allowing a thief to effectively disable Find My iPhone on a stolen device.

Okay. That sounds serious. But is it really that serious? Let’s think about this critically for a second.

  1. If this didn’t exist, a thief could simply pop out the SIM card and Find My iPhone would not work.
  2. If this didn’t exist, a thief could simply turn off the phone from the lock screen and Find My iPhone would not work.

So is the fact that Siri could turn on airplane mode which stops Find My iPhone from working any worse than the above? Not from my perspective. But if this does concern you, you can disable Siri from being used at the lock screen:

  • Go to Settings
  • Go to General
  • Go to Passcode Lock and enter your passcode
  • Under Allow Access When Locked, find the option for Siri and disable it

While you’re at it, you should also disable Control Center access on the lock screen as that has an option to turn on airplane mode:

  • Go to Settings
  • Go to Control Center
  • Find Access On Lock Screen and turn it off

That make the phone a bit less convenient to use (for example, I tend to use Siri from the lock screen when in my car), but it does take this issue off the table. But someone with physical access to the phone can use the two methods that I described above to disable Find My iPhone.

Another thing that makes this discussion moot to some degree is the fact that iOS 7 introduced a new feature called Activation Lock that makes it impossible for anyone to re purpose an iPhone without your Apple ID and password. That will pretty much make the stolen iPhone or iPad useless to a thief.

So with all that in mind, I really think this is overblown. But you can be rest assured that Apple will slip a fix of some sort into a future iOS 7 release that takes this story off the headlines.

So, I Updated To iOS 7 The Second It Was Available [UPDATED]

Posted in Commentary with tags , on September 18, 2013 by itnerd

I guess I now qualify as an Apple Fanboi.

I did something I usually avoid doing which is updating to the latest version of an OS the second it was available. My logic? I did a backup of my iPhone this AM (You do backup your iPhone to your computer? Right?). So I figured that worst case I could always restore that backup. So when 1PM EST time rolled around (as that’s when Apple tends to release software like this), I did an over the air update. Now, doing an upgrade over the air has some risks. but as long as you are on a stable Internet connection (preferably WiFi as that won’t cost you anything) and you have your phone plugged into AC power (I did), the risk level was low. Besides, I have a back up.

So, I downloaded iOS 7, which took about 45 minutes to download, verify the update, and begin the upgrade process. Now it might have been faster, but it likely wasn’t because Apple’s servers were getting hammered. After doing all that, my iPhone rebooted to a black screen with a white apple and a progress bar. It took about 10 or so minutes for the bar to go across the screen. Then it rebooted again to the same black screen with a white apple and a progress bar. This time the bar took about a minute to go across the screen and then iOS 7 appeared. After walking through a setup wizard, I was done.

That was painless.

I’m still getting used to the look and feel, but here are my early observations:

  • It feels fast on my iPhone 5
  • Apple seems to have “borrowed” a gesture from BlackBerry. You double click the home button to see all of your running apps. If you want to quit one, put your thumb on the app window and swipe up. Just like BlackBerry 10. Hmmm….
  • Notes now communicates with Microsoft Exchange. In iOS 6 it did not. That’s a change quite a few of my customers will jump for joy over.
  • Bluetooth got turned off when I upgraded. Thus I had to go to Control Center (swipe from the bottom of the screen to bring it up) to turn it back on.
  • Apps now automatically update in the background.
  • If you plug your iPhone into a computer, it will prompt you to trust this computer in order to share data. That’s a good security feature.
  • The interface looks very clean. I wasn’t sure I was going to like it, but I do.

I’ll continue to use it for the rest of the day to get further impressions. If you’ve updated to iOS 7, post a comment to share your thoughts on this latest update from Apple.

UPDATE: Three other things I noted. There’s a option in SETTINGS -> CELLULAR that disables by default the ability to use cellular data when roaming. That will save you money if you travel. Not only that, but there is an option to enable and disable LTE as well. In some places, that might save you money. I also noted that syncing with Microsoft Exchange is MUCH faster under iOS 7 than on iOS 6.

UPDATE #2: If you look at the clock icon on iOS 7, the sweep hand actually moves and the time is accurate.