Apple, Mac, MacOS, iOS4, iPad, iPhone and (in)security...

Apple Is Tracking You Even When Its Own Privacy Settings Say It’s Not, New Research Says
An independent test suggests Apple collects data about you and your phone when its own settings promise to “disable the sharing of Device Analytics altogether.

For all of Apple’s talk about how private your iPhone is, the company vacuums up a lot of data about you. iPhones do have a privacy setting that is supposed to turn off that tracking. According to a new report by independent researchers, though, Apple collects extremely detailed information on you with its own apps even when you turn off tracking, an apparent direct contradiction of Apple’s own description of how the privacy protection works.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Zoom est l’une des solutions de visioconférence les plus populaires, surtout dans le monde de l’entreprise. Comme Skype ou Hangout, cette app permet de créer des réunions virtuelles que les participants peuvent rejoindre avec leur ordinateur et une webcam. Le chercheur en sécurité Jonathan Leitschuh a découvert plusieurs failles de sécurité dans l’app macOS du service, dont la plus importante permet à un site web d’activer la webcam d’un Mac sans aucune interaction de la part de l’utilisateur.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

https://www.scoop.it/topic/apple-mac-ios4-ipad-iphone-and-in-security/?&tag=Zoom

 

 

Yet another teenager has uncovered a serious weakness in Apple technology.

Just last week it emerged that a 14-year-old uncovered a bug that allowed snooping on iPhone and Mac users thanks to a problem in FaceTime. Now German 18-year-old Linus Henze has uncovered a vulnerability affecting the latest Apple macOS that leaves stored passwords open to malicious apps. That could include logins for your bank website, Amazon, Netflix, Slack and many more apps. And even though this is a Mac-only bug, if you’re using the iCloud keychain, passwords synced across iPhones and Macs may also be in danger.

To make matters worse, it’s likely that no fix is in the works. Henze isn’t disclosing his findings to Apple, telling Forbes the lack of payment for such research was behind his decision to keep the hack’s details secret from the Cupertino giant.

The researcher, who has uncovered other iOS and macOS bugs in the recent past, discovered a way into the Apple “keychain.” That’s the area of the macOS that stores private keys and passwords, making it a goldmine for hackers.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/

 

Apple plans to share facial mapping data captured by the iPhone X’s series of front-facing cameras and sensors, according to a report by Reuters. The revelation, contained in a developer agreement detailing the use of Apple’s new facial recognition software, would appear to undermine statements Apple made during the iPhone X reveal back in September. The company’s executives at the time made an effort to placate privacy concerns with talk of strict on-device storage and end-to-end encryption.

However, there’s quite a bit of unpacking to do here regarding what developers actually have access to and under what terms. According to the developer agreement, third-party app makers only have access to the visual facial mapping data, and not the same mathematical representation of it that is used to unlock the iPhone X using Face ID. Apple claims the latter is encrypted on the device itself, so not even its own employees have access to it. Yet developers do still have access to a map of a user’s face as part of the True Depth camera, along with data on as many as 50 facial expressions that could tell a developer how exactly you raise your eyebrows or move your mouth, to name a few telling instances. This is how Snapchat’s iPhone X-specific filters, demoed onstage during the phone’s reveal, appear more sophisticated than standard ones.

 

Despite the apparent protections, organizations like the American Civil Liberties Union are concerned that an era of widespread facial recognition technology, no matter the intentions or safeguards of its creator, could yield unexpected results. “Apple does have a pretty good historical track record of holding developers accountable who violate their agreements, but they have to catch them first - and sometimes that’s the hard part,” Jay Stanley, an ACLU senior policy analyst, told Reuters.

 

“It means household names probably won’t exploit this, but there’s still a lot of room for bottom feeders.”

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

MacOS-Keychain kann per App ausgelesen werden
Der Sicherheitsforscher Patrick Wardle hat demonstriert, dass Apples Keychain unter MacOS mit einer App komplett ausgelesen werden kann. Diese muss aber zunächst an Apples Gatekeeper vorbei.

Der Hacker Patrick Wardle hat nach eigenen Angaben eine Sicherheitslücke in der aktuellen Version von Apples Desktop-Betriebssystem High Sierra gefunden, die es bösartigen Applikationen ermöglicht, Passwörter aus Apples Keychain auszulesen. Normalerweise müssen Nutzer einzelne Passwörter durch Eingabe eines Master-Passworts freigeben.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?&tag=MacOS

 

Wie aus einem geleakten Dokument hervor geht, zeichnet Apple Metadaten zu iMessages-Konversationen auf und kann diese auch auf richterliche Anordnung der Polizei aushändigen. Die Konversation selbst bleibt verschlüsselt, doch speichert Apple für 30 Tage auf seinen Servern Daten über die Kontaktaufnahme. In dem Moment, in dem man in die Nachrichten-App eine Nummer oder einen Namen eintippt, richtet das iPhone eine Anfrage an den Server bei Apple, ob der Kontakt mit iMessages verknüpft ist oder eine unverschlüsselte SMS versandt werden soll. Diese Daten bleiben dann einen Monat bestehen, es geht aber aus ihnen nicht hervor, ob tatsächlich eine Konversation stattgefunden hat oder nicht.

Die ursprüngliche Meldung ist gestern auf " The Intercept " erschienen, die Autoren bekamen jede Menge Unterlagen zugespielt, die wohl einst im internen Umlauf beim Support-Team der Abteilung für elektronische Überwaschung der Staatsanwaltschaft in Florida war. Darunter fand sich ein Dokument mit dem Namen "iMessage FAQ für Strafverfolgungsbehörden". Bis zu der letzten Frage liest sich das Dokument wie eine Einführung zur iMessage-Nutzung, erst als Antwort auf die letzte Frage "Was bekomme ich von Apple, wenn ich eine Gerichtsverfügung für ein iMessage-Konto habe?" eine detaillierte Liste der Meta-Daten. Darunter sind die Kontaktdaten wie die Telefonnummer des Gesprächspartners in iMessage, das Datum und die Uhrzeit, wann das iPhone versucht hat, den Kontakt per iMessage zu erreichen, die IP-Adresse des nächsten WLANs, über die die Verbindung zum Apple-Server stattgefunden hat. Die Apple-Sprecherin hat gegenüber "The Intercept" bestätigt, dass das geleakte Dokument den tatsächlichen Stand der Dinge beschreibt, allerdings speichert Apple nach deren Angaben solche Logs nur einen Monat lang, danach werden sie gelöscht.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=Privacy

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/

 

Researchers caught malware spreading itself around to OS X users through a signed version of the BitTorrent client Transmission.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=BitTorrent

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=keydnap

 

Apple has banned a top-selling iOS app that raised the alarm if it determined your iPhone or iPad had been jailbroken without your knowledge.

The app, "System and Security Info," was only released a week ago and made its way rapidly to the top of the paid-for app charts, outselling the likes of Minecraft and Grand Theft Auto.

I don't think anyone really expected System and Security Info to maintain a lead over such popular, heavyweight video games for long, but I certainly didn't anticipate Apple throwing it out of the iTunes Store quite so quickly either.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Der womöglich erste Trojaner für iOS, die nicht von Jailbreaks geschwächte iPhones und iPads befallen können, lautet auf den Namen AceDeceiver. Die Sicherheitsspezialisten von Palo Alto Networks haben heute einen ausführlichen Blogbeitrag veröffentlicht, in dem sie die Funktionsweise erklären. Derzeit besteht zwar keine konkrete Gefahr, da Apple bereits vor drei Wochen von Palo Alto informiert wurde und die von AceDeceiver in den App Store geschmuggelten Apps aus dem Angebot entfernt hat.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=AceDeceiver

 

Ein Erpressungs-Trojaner verschlüsselt erstmals auch Daten von Mac-Nutzern. Der Schädling versteckt sich im BitTorrent-Client Transmission. Apple und die Entwickler haben bereits reagiert.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=RANSOMWARE

 

http://www.scoop.it/t/ict-security-tools/?tag=Ransomware

 

Users of BitTorrent client app Transmission became the first reported victims of Mac ransomware this week. People who downloaded infected versions of the app also received "KeRanger" malware, 9to5Mac says, nefarious software that would encrypt a user's hard drive three days after being installed and demand payment to unlock the data.

 

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=RANSOMWARE

 

http://www.scoop.it/t/ict-security-tools/?tag=Ransomware

 

 

Des groupes de cybercriminels, spécialisés dans les arnaques à la cryptomonnaie, utilisent le service TestFlight et la technologie WebClip d'Apple pour abuser leurs victimes.
Apple met régulièrement en avant le fait que l'environnement verrouillé de l'App Store est une des meilleures garanties de la sécurité d'iOS, pour éviter les attaques et autres programmes malveillants. Le problème, c'est que les pirates ont de la ressource et de l'imagination... Les chercheurs en sécurité de Sophos ont en effet découvert deux nouveaux moyens utilisés pour abuser de pauvres utilisateurs.

 

AppleInsider reports that a vulnerability first disclosed to Apple three months ago remains unpatched and now the security researcher who found it has gone public. Filippo Cavallarin has published details of how the vulnerability enables a user to be tricked into running malicious applications, bypassing the Gatekeeper function in the process.

Gatekeeper is the Apple mechanism that has, since 2012, been enforcing the code signing and verification of application downloads. If a user were to download an app outside of the Mac App Store then Gatekeeper would kick in and prevent it from running without the express consent of the user. In theory anyway.

Cavallarin says that, on macOS X version 10.14.5 (Mojave) and below, it is possible to "easily bypass Gatekeeper in order to execute untrusted code without any warning or user's explicit permission." According to Cavallarin, he contacted Apple February 22 and the vendor is aware of the issue. It was, he says, "supposed to be addressed, according to the vendor, on May 15, but Apple started dropping my emails." As a 90 day disclosure deadline, which he says Apple is aware of, has now passed, Cavallarin has made details of the vulnerability public.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

https://www.scoop.it/topic/apple-mac-ios4-ipad-iphone-and-in-security/?&tag=Gatekeeper

 

Les contraintes imposées par Apple à toutes les apps qui veulent trouver leur place sur le Mac App Store ne suffisent pas à éviter toutes les failles de sécurité, même si cela n’y ressemble pas à première vue. Felix Krause a trouvé un moyen original pour qu’une app puisse récupérer à votre insu tout le contenu affiché sur l’écran de votre Mac, tout en respectant les exigences de sandboxing de la boutique.

Son idée est de faire une capture d’écran de macOS avant d’appliquer un traitement de reconnaissance optique des caractères (OCR) pour y trouver des informations intéressantes. Il peut s’agir des sites que vous visitez, mais aussi de vos identifiants et même de vos mots de passe. Pour cela, il suffit de faire des captures d’écran très régulières et si l’utilisateur affiche un mot de passe dans son gestionnaire, ne serait-ce que brièvement, il sera enregistré et analysé.

Concept développé par Felix Krause, qui récupère effectivement des informations sensibles tout en respectant les conditions de du Mac App Store. Cliquer pour agrandir
La possibilité de prendre une capture d’écran est accessible à n’importe quelle application macOS avec quelques lignes de code seulement. Il n’y a aucune autorisation préalable à obtenir pour que ces lignes soient fonctionnelles et le système n’alerte pas l’utilisateur, par exemple de façon visuelle comme sur iOS. En clair, une app distribuée sur le Mac App Store et respectant toutes les consignes de cloisonnement d’Apple pourrait se transformer en malware qui analyse en permanence ce que vous faites sur votre ordinateur et l’envoie sur un serveur tiers.

Apple a été notifié de cette faille dans la sécurité de macOS et on imagine qu’une future version du système bloquera cette possibilité. Ou au moins, s’assurera que l’utilisateur autorise une app à faire des captures d’écran, en général ou au cas par cas.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Uber has said it will remove code from its iPhone app that security researchers say could let the ride-sharing app record the screen -- even when the app is closed.

Will Strafach, a security researcher, discovered this week that Uber had been granted an undocumented private app permission allowing access to the screen-recording feature. It's one of many "entitlements" that allow developers to tap into features of an iPhone or iPad that are normally off limits to most app developers, unless they have been granted special permission by Apple.

Many screen-recording apps use this entitlement without permission, such as iRec, which run on jailbroken devices.

Strafach said that to his knowledge, based on thousands of app binaries he has indexed, Uber is the only third-party app that was given a private entitlement.

Other iPhone and iPad app developers said the move was unprecedented.

Apple expert and jailbreak author Luca Todesco told ZDNet that it was an "extremely dangerous use case."

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

https://gustmees.wordpress.com/2014/03/05/often-asked-questions-are-there-cyber-security-dangers-with-apps-and-whats-about-privacy/

 

 

Furthermore, there is no doubt that Apple has done a much better job of keeping its iPhone and iPad customers patched with the latest security operating system updates than many of the Android manufacturers – some of whom have left their users in the lurch with badly out-of-date and at-risk software.

But malware and operating system vulnerabilities aren’t the only considerations.

 

The truth is that the most significant threat is probably not your chances of encountering malware, or whether your OS is properly patched, but rather the third-party apps that you have installed on your device.

After all, you don’t know what your apps are *really* doing do you, or how well they’re keeping your sensitive information safe and secure?

 

New research has discovered scores of buggy iOS apps that do a lousy job of securing users’ information, and could be making life all too easy for hackers keen to intercept and steal data.

Security researcher Will Strafach says that he was able to identify 76 popular apps in the official App Store that failed to make use of the Transport Layer Security (TLS) protocol, and allowed a malicious attacker to silently perform a man-in-the-middle (MiTM) attack, stealing or manipulating data as it is sent and received from the mobile device.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Although it has previously claimed otherwise, Apple stores Messages metadata and can be compelled by court orders to hand over such data logs.

 

It turns out that’s not entirely true: The Intercept has secured a document from the Florida Department of Law Enforcement’s Electronic Surveillance Support Team, that details how Messages stores metadata about every phone number you try to contact through the app, and how police can get their hands on that data by filing a request.

Here’s how it works: When you enter a number into Messages on your iPhone, the app pings Apple servers to figure out whether it should send your message over SMS or over the company’s encrypted service (if the recipient also uses Messages).

 

Apple records those queries, in addition to the date and time when you entered that number, as well as your IP address – which could used to determine your approximate location. The company is compelled to hand over these logs when served with court orders in connection with investigations.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=Privacy

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/

 

Once again, BitTorrent client Transmission has distributed malware to some users through an altered installer, with downloaders of the software on Aug. 28 and 29 probably infected by the "Keydnap" package.

 

Learn more:

 

- http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Apple made iOS 9.3 available last week, fixing a number of serious security holes.

But it hasn’t been plain sailing for everyone, with hundreds of Apple users complaining in the Apple Support Communities and on Twitter that links in Safari, Mail, Messages and other apps sometimes cause their iDevices to crash, freeze or hang.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

 

Erstmals greift ein Erpresser-Trojaner Mac-User an. Die Ransomware KeRanger hat sich über eine infizierte Version der Torrentsoftware Transmission verbreitet.

 

Learn more / En savoir plus / Mehr erfahren:

 

http://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/?tag=RANSOMWARE

 

http://www.scoop.it/t/ict-security-tools/?tag=Ransomware