Checklist 72: 2017 Security Review Part Two

Last week, we brought you Part One of our 2017 Security Year in Review. This week, we’ll wrap that up with Part Two! If you didn’t get a chance to check out Part One yet, the episode and its accompanying show notes are available right here in our archives. In it, you’ll find out about the highlights of the past year in both iOS and macOS security, including all the information you need to know about what the bad guys were up to in 2017. This week, we’re pulling back …

Checklist 71: 2017 Security Review Part One

For this, Episode 71 of The Checklist, we sat down during the first week of January 2018 to put a magnifying glass over the year that just ended. For part one of our discussion, we’re taking an in-depth look at the biggest security issues that affected macOS and iOS in 2017. With so many things going on — and there were quite a lot — it can be tough to remember all the details. To start our recap, we’ll go all the way back to this time one year ago: the beginning of January.

Apple Confirms Fixes for Major CPU Vulnerability, More on the Way

Apple has confirmed that a pair of critical security vulnerabilities uncovered by security researchers late in 2017, and now filtering out into media reports, does affect “all Mac systems and iOS devices.” These bugs, dubbed Meltdown and Spectre, affect the clear majority of computers and a vast number of mobile devices, regardless of make, model, or manufacturer. Though tricky to exploit, these bugs could allow an attacker untraceable access to a wide variety of user data.

By exploiting a weakness in an advanced function within the processor, Meltdown allows …

Apple Patches MacOS High Sierra Login Vulnerability

“Is Apple getting sloppy?”

That was the headline of a BBC article published on Wednesday, November 29th, 2017, reporting the discovery of a major security issue in Apple’s MacOS High Sierra operating system. It seems that a bug within the OS made it possible for anyone to access a High Sierra computer by exploiting a simple login loophole.

Usually, when you login as a user on a Mac, you must enter your username and password. On machines running High Sierra, though, it was possible to enter “root” as the username, …

iPhone Apps with Camera Permissions Could Secretly Take Your Picture

When is your phone able to take a picture? Put that question to the average user and chances are they will say something about having the actual camera viewfinder on screen. Whether it’s from the default camera app, Instagram, or Facebook, we all expect that the camera isn’t at work when we can’t see ourselves on the screen. As one Google researcher, Felix Krause, recently uncovered, however, that is not actually the case. In fact, when users grant permissions to apps for the use of the camera, it turns …

Apple Releases iOS 11.1 and Other Important Security Updates

The latest round of Apple security updates arrived on Halloween, delivering everything from iOS 11.1 to updates that affect macOS, watchOS, and more. As is often the case with large patch days, these updates address a wide variety of security flaws affecting different parts of the systems in question. From WebKit vulnerabilities to memory handling issues on the Apple Watch and in macOS, Apple squashed plenty of bugs with this batch of updates. Perhaps one of the most important issues addressed in this round of updates, however, is Apple’s …

Ransomware Attacks Target Apple Users Via iCloud

A recent rash of ransomware attacks has left some Apple users locked out of their Mac computers and iOS devices. The nature of the attacks led some users to wonder if Apple itself had suffered some kind of hack. The good news is that the situation does not appear to be an Apple hack. The bad news is that hackers have somehow managed to get their hands-on login credentials for some users.

Hackers are attacking users by logging into their iCloud accounts and enabling the “Find My iPhone” function. …

Apple Acknowledges U.S. Senate’s Request for Details about iPhone X Face ID...

As in previous years, Apple’s 2017 September keynote brought device announcements, new feature introductions, and other headline-worthy events. What’s different this year, though, is that it also prompted the United States Senate to contact Apple about security and privacy concerns.

Those concerns surrounded the announcement of Apple’s revolutionary iPhone X, the first iPhone ever to ditch the commonplace home button. Specifically, the Senate had questions about the new iPhone’s Face ID feature, which will replace Touch ID as the primary way to unlock the iPhone.

The letter, …

Apple Reports Major Spike in Government Requests for Information

Who wants information about you? Digital security practices revolve in large part around restricting your data based on the answer to that question. We try to protect our systems so that only those with authorization can access sensitive personal information of all kinds. Most frequently, hackers are the ones we must worry about looking to learn something about us, whether it’s a password or a credit card number. However, it’s important to consider that requests from the government for user information occur on a frequent basis, and these can …

iOS 11 Includes Patches for Several Vulnerabilities

September 19, 2017, marked the arrival of iOS 11, just in time for the release of the iPhone 8 and 8 Plus. The big annual update of Apple’s mobile operating system added a few new features into the mix for users, from a brand new Control Center to a keyboard made for one-handed texting.

However, amidst the new features, it turns out that iOS 11 is also an important security update. The updated operating system includes important patches for a variety of iOS vulnerabilities. Apple also patched bugs …

Apple Removes VPNs from Chinese App Store

One of Apple’s most famous marketing campaigns revolved around the catchphrase “There’s an app for that”—to the point that Apple eventually had the slogan trademarked. However, for users living in China, that statement is no longer true. According to a recent report from CNBC, Apple has removed most of the VPN apps from its Chinese App Store.

The removals weren’t random: China made unauthorized connections—including those made possible by virtual private networks—illegal in January of this year. VPNs allow users to access restricted parts of the Internet and surf …

Securing Your Data with macOS and Keychain

Every time a new version of Apple’s operating system arrives, every tech-focused publication on the Internet does a deep dive on the new key features. Occasionally, though, cool bells and whistles go overlooked. Such is the case with the macOS Keychain Access application, which, in addition to storing passwords and account information, can also be used to store and secure sensitive data.

Keychain Access gives users the option to store what it calls “Secure Notes,” alongside passwords and other valuable data. Say you need to store something like a …

The Age of iPhone Jailbreaking is Drawing to a Close

Remember jailbreaking? From the first iPhone, it has been an integral part of the community around the device and even something which has pushed its development forward. Initially, just a way to unlock the phone and release it from the “jail” of an exclusive carrier contract, jailbreaking quickly grew into more. Games made their first appearance on iOS via jailbreaking, and for several years the only way to install custom wallpapers or ringtones on an iPhone was with a jailbreak. Many of the early iterations of the phone were …

iOS 11: What to Expect from the Next Major Version Change

Among a slew of other announcements at Apple’s WWDC in June this year was the news that iPhone and iPad users would finally see the release of iOS 11 later this year. After the recent release of iOS 10.3.3 to users and the release of the latest iOS 11 beta to developers, it seems like the upgrade is not too far from its official release, currently expected sometime in September. What does Apple have in store for users, and what kinds of security improvements might we be able to …

Apple Releases iOS 10.3.3, Patching Critical Wi-Fi Vulnerability

Apple pushed a new round of security updates to many of its products on July 19, including macOS and iOS. While both updates provide important security updates, the iOS update is especially critical.  In version 10.3.3, Apple fixed a critical vulnerability affecting the device’s operations surrounding wireless networks. How does it work and what is the threat?

Inside each iPhone, from the iPhone 5 to the current iPhone 7, a dedicated chip by Broadcom powers the device’s Wi-Fi functionality. These chips handle important tasks to provide users with quick …

Apple Announces Transition to New File System at WWDC

Last year, Apple announced that it was in the final stages of development for a new file system to replace the current architecture, which has begun showing its age. At this year’s WWDC, one of Apple’s major announcements was that this new “Apple File System” (or APFS) is finally ready. It’s coming to users soon with the release of macOS High Sierra, and it brings with it a host of improvements in both performance and security.

On the performance side, we can expect to see much faster disk …

Apple Covers All the Bases with Over 100 Security Updates in May

In mid-May, while the world was waking up to deal with the chaos caused by the WannaCry ransomware spreading over the web, Apple was making its users safer again. Released on May 15th, a new set of patches dropped for iOS, macOS Sierra, and both the El Capitan and Yosemite version of OS X. So many different fixes were implemented that  it would be difficult to cover exactly what each of them accomplishes. However, of particular note in this update is the fact that ethical hackers previously identified more …

New Version of iOS Makes Quiet Changes to How Apps Use Your Location

At Apple’s annual WWDC event this year, the company made a host of big announcements. Chief among them was the unveiling of the next iteration of iOS, version 11. While they highlighted many of iOS 11’s new features during the conference, some other changes flew under the radar. One of those is a big tweak to the way apps on your phone can use your GPS location information. If you have ever used Uber, you may have encountered problems with its functionality if you’ve disabled location services. Uber is …

Apple Adds New Password Rules to Secure iCloud Accounts

iCloud users will soon need to abide by a new set of password requirements, put in place by Apple to fight against account breaches. In mid-May, Apple sent out a support email to iCloud customers, explaining the new requirements. The new requirements went into effect on June 15th.

The new policy concerns third party apps that need to access iCloud data to function. Such apps include Microsoft Outlook and other similar programs used for email, calendar management, and contacts. Apple will require app-specific passwords for such programs, instead …

Apple Retains Notes Synced to iCloud after Deletion

Apple may be retaining deleted notes in iCloud without user knowledge or consent, according to a recent blog post from security software company Elcomsoft. If you use the Notes app on your Apple device and sync the notes to iCloud, there’s a chance that Apple is holding onto the notes indefinitely—even after you delete them.

Apple has a history of holding onto iCloud data past its deletion date. In the past, Elcomsoft has been instrumental in discovering these iCloud flaws. Last year, the company found that the iCloud Photo …