Tag Archive for: Apple

Apple Warns iPhone Users Not To Answer Apple Support Calls

/in

iPhone users have been warned not to answer calls from Apple unless they have specifically requested one using the official Apple online support page. This comes off the back of a rash of spoofed support calls that have become increasingly sophisticated in their efforts to get access to Apple iCloud accounts. How sophisticated? How does displaying the Apple logo, address and correct support telephone number grab you? Here’s what you need to know.

The scam

The telephone calls are straightforward phishing, the same as you will have seen countless times in your email no doubt. They have more success because most people still aren’t expecting voice to be used in such social engineering scams. The scammers employ caller-ID spoofing techniques so as to impersonate the real telephone number of the service they claim to be representing. Most commonly as far as this particular threat is concerned that will be Apple support, although I have been told by those on the receiving end of such calls that AppleCare and Apple customer service have also been used in an attempt to gain the trust of the victim.

By spoofing that number and displaying the Apple logo, the fraudsters hope that the person answering the call will be less suspicious than if they were taking an unsolicited call from a number they didn’t recognize. This kind of brand recognition leverage is high on the phishing 101 list of ways to garner victim trust. It’s why telephone scams supposedly from Microsoft support, which don’t have the same trust-enhancing methodologies, tend to be less successful. As the fact-checking site Snopes confirms, “if the recipient is an iPhone user who then requests a call back from Apple’s legitimate customer support web page, the fake call gets indexed in the iPhone’s recent calls list as a previous call from the legitimate Apple Support line.”

The bait will vary but is always going to be a variation on the theme of your account has been compromised, there’s been a data breach or there has been suspicious activity in your iCloud account. The latest bunch of these calls have been automated with a message informing the user to call a number that purports to be Apple support, complete with estimated waiting times and convincing welcome messages and call purpose options. Sometimes the user will be asked to “press 1” to connect to a support advisor. In all cases, the danger to your data story will be spun out and you will be asked to confirm your iCloud account credentials.

What Apple says

The Apple support presence on Twitter is, unsurprisingly, getting regular tweets from concerned iPhone users who have received such a call and want to know if it is genuine and their accounts have been compromised. The response is most always the same: “Your security is our number one priority. You can find more information about phony calls and learn how you can report them by following the steps from this article here.”

If you follow that link it will take you to a support post entitled “Avoid phishing emails, fake ‘virus’ alerts, phony support calls, and other scams” which has a section covering suspicious telephone calls. Apple says that users should always verify a caller’s identity before providing any personal information. However, while that advice might seem logical it is often harder in practice than it sounds. As I’ve already pointed out, the scammers are getting increasingly sophisticated in their methods of convincing potential victims that they are genuine. Caller-ID spoofing makes it ever harder to separate fiction from reality. I think Apple could easily delete most of the advice it gives in this section and just leave the final line: “If you get an unsolicited call from someone claiming to be from Apple, hang up and contact us directly.”

Apple will never ask you for your Apple ID password, iCloud credentials or verification codes in order to provide you with support. Simple as. Never. And talking of verification codes, Apple also advises iPhone users to activate two-factor authentication as an additional layer of security to protect your account.

What Data Big Tech Companies Admit To Have On You

/in

Have you ever asked yourself, “What does the Data big companies such as Google know about me?” The answer is uncomfortable. What Google knows about you includes everything from your clicks on ads to your birthday to the device you’re using right now and the Wi-Fi network it’s connected to. But Google pales in comparison to some of the other big companies that sell your data or collect it out there.

This is what the big six tech companies have officially admitted to collecting as far as personal data about you, according to their official privacy policies.

The Data Big Tech Companies Have On You

This New Web Standard Could Finally Kill the Password

/in

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo

macOS High Sierra Bug Lets Anyone Gain Root Access Without a Password

/in , ,

If you own a Mac computer and run the latest version of Apple’s operating system, macOS High Sierra, then you need to be extra careful with your computer.

A serious, yet stupid vulnerability has been discovered in macOS High Sierra that allows untrusted users to quickly gain unfettered administrative (or root) control on your Mac without any password or security check, potentially leaving your data at risk.

Discovered by developer Lemi Orhan Ergin on Tuesday, the vulnerability only requires anyone with physical access to the target macOS machine to enter “root” into the username field, leave the password blank, and hit the Enter a few times—and Voila!

In simple words, the flaw allows an unauthorized user that gets physical access on a target computer to immediately gain the highest level of access to the computer, known as “root,” without actually typing any password.

Needless to say, this blindingly easy Mac exploit really scary stuff.

This vulnerability is similar to one Apple patched last month, which affected encrypted volumes using APFS wherein the password hint section was showing the actual password of the user in the plain text.

Here’s How to Login as Root User Without a Password

If you own a Mac and want to try this exploit, follow these steps from admin or guest account:

  • Open System Preferences on the machine.
  • Select Users & Groups.
  • Click the lock icon to make changes.
  • Enter “root” in the username field of a login window.
  • Move the cursor into the Password field and hit enter button there few times, leaving it blank.

With that (after a few tries in some cases) macOS High Sierra logs the unauthorized user in with root privileges, allowing the user to access your Mac as a “superuser” with permission to read and write to system files, including those in other macOS accounts as well.

This flaw can be exploited in several ways, depending on the setup of the targeted Mac. With full-disk encryption disabled, a rogue user can turn on a Mac that’s entirely powered down and log in as root by doing the same trick.

At Mac’s login screen, an untrusted user can also use the root trick to gain access to a Mac that has FileVault turned on to make unauthorized changes to the Mac System Preferences, like disabling FileVault.

All the untrusted user needs to do is click “Other” at the login screen, and then enter “root” again with no password.

However, it is impossible to exploit this vulnerability when a Mac machine is turned on, and the screen is protected with a password.

Ergin publicly contacted Apple Support to ask about the issue he discovered. Apple is reportedly working on a fix.

“We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”

Here’s How to Temporarily Fix the macOS High Sierra Bug

Fortunately, the developer suggested a temporary fix for this issue which is as easy as its exploit.

To fix the vulnerability, you need to enable the root user with a password. Heres how to do that:

  • Open System Preferences and Select Users & Groups
  • Click on the lock icon and Enter your administrator name and password there
  • Click on “Login Options” and select “Join” at the bottom of the screen
  • Select “Open Directory Utility”
  • Click on the lock icon to make changes and type your username and password there
  • Click “Edit” at the top of the menu bar
  • Select “Enable Root User” and set a password for the root user account

This password will prevent the account from being accessed with a blank password.

Just to be on the safer side, you can also disable Guest accounts on your Mac. for this, head on to System Preferences → Users & Groups, select Guest User after entering your admin password, and disable “Allow guests to log in to this computer.”

 

Apple removes VPN apps from the App Store in China

/in

The Chinese government’s crackdown on the internet continues with the news that Apple has removed all major VPN apps, which help internet users overcome the country’s censorship system, from the App Store in China.

The move was first noted by ExpressVPN, a provider based outside of China, which said in a blog post “all major VPN apps” including its own had been purged from Apple’s China-based store. The company shared a note from Apple (below) explaining that its app was removed because “it includes content that is illegal in China.”

The app continues to be available for users across the world outside of China, the company said. However, the process to create an App Store account in a different country is unknown to many users, so it is unlikely to fill the void of the missing Chinese app.

Another provide, Star VPN, tweeted that its app had also been removed.

Apple had not replied for comment at the time of writing.

ExpressVPN shared a note from Apple notifying it of the removal of its app in China

The App Store purge is hugely impactful because VPNs represent the only way that a China-based individual can bypass state censorship controls to access the internet without restrictions. The Chinese government effectively illegalized VPNs when new rules issued in January required them to receive government approval in order to operate. That appears to be why Apple was forced to remove ExpressVPN and others like it.

Apple may believe it is best for its business to co-operate with requests from Beijing, but this App Store purge just created one of the biggest setbacks for the free internet in China’s history.

“We’re disappointed in this development, as it represents the most drastic measure the Chinese government has taken to block the use of VPNs to date, and we are troubled to see Apple aiding China’s censorship efforts. ExpressVPN strongly condemns these measures, which threaten free speech and civil liberties,” ExpressVPN wrote on its blog.

Today’s news is the latest in a series of developments against the free internet from China.

Two popular VPN services were forced offline in China earlier this month leaving their users, which included professionals who require access to the global internet for work, without an alternative. Government officials denied a story from Bloomberg that the country’s mobile operators had been told to ban VPN apps by early 2018, but other steps have clearly been taken. Reuters reported earlier this month that the Great Firewall, the term for China’s internet censorship apparatus, had been “upgraded” with new capabilities. VPN services subsequently found that they had been hit by the most sophisticated attacks from China to date. High-end hotels have even ceased offer VPNs to guests.

Those new capability apparently also made it possible for the government to interfere with messaging apps. While now blocked entirely, WhatsApp users found that they were unable to send videos and photos through the chat app and issues seemed to extend to WeChat, China’s most popular messaging service. The censorship seemed to be linked to the response to the death of dissident Liu Xiaobo, a recipient of the Nobel Peace Prize, who lost a battle to liver cancer earlier this month having been denied permission to leave custody to seek medical treatment overseas.

Going direct to Apple is becoming an effective way to enforce censorship since the U.S. firm controls what apps are available in China. The tactic proved successful for China earlier this year when Apple removed the New York Times app from the local Chinese App Store. The Times and Wall Street Journal are among a number of international news sites blocked in China, according to censorship monitoring service Great Fire.

It’s unclear whether similar action has been taken with Android stores in China. The Google Play Store is not present in China, where a handful of third-party app stores are the most influential distributors of Android apps.

Not-for-profit group GreatFire offers ‘censorship-proof’ alternatives like its Android VPN FreeBrowser and other services that include a collaboration with The New York Times, but Apple’s iOS doesn’t permit similar options.

Apple just announced Isabel Ge Mahe as the first managing director for its Chinese business and, beyond battling a sales slump in China, the long-time Apple executive is tasked with the difficult job of managing a relationship with Beijing. The U.S. firm recently announced plans to develop its first China-based data center, a move that is thought to be related to the country’s new cybersecurity laws which went into effect June 1.

tech crunch

Mac Computers Hacked With ‘FruitFly’ Surveillance Malware

/in , ,

American Apple Mac computers have been hacked with FruitFly malware, Forbes reports.

The hack is thought to be for surveillance as hackers were able to jump into the webcams of the affected computers and take screenshots, though the FruitFly malware has the ability to take over the entire computer.

“This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware,” said Patrick Wardle, cybersecurity researcher, via Forbes. “Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.”

This isn’t the first time that FruitFly is making a hacking appearance. Earlier this year, it was used to target biomedical research centers.

“The only reason I can think of that this malware hasn’t been spotted before now is that it is being used in very tightly targeted attacks, limiting its exposure,” wrote Thomas Reed, MalwareBytes researcher. “Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.”

FruitFly is difficult to detect. Not much is known about the malware.

Coda Developer Panic Says Source Code for Several Apps Stolen via Handbrake Malware Attack

/in ,

In a blog post on Wednesday, Panic Inc. developer and co-founder Steven Frank disclosed that he downloaded a malware infected version of HandBrake earlier this month, which led to the theft of the source code for several of the company’s popular apps.

In early May, a mirror download server hosting the popular video coding app Handbrake was hacked, and an infected version of the Handbrake app took the place of the genuine article. The hacked version infected user’s machines with OSX.PROTON, which gave hackers root-access privileges to a Mac.

Hacker’s were able to access Frank’s Mac via the infected app, and collected his login credentials, including his git credentials. Frank assures Panic customers that the hacker’s did not access customer data or sync data.

In a case of extraordinarily bad luck, even for a guy that has a lot of bad computer luck, I happened to download HandBrake in that three day window, and my work Mac got pwned.

Long story short, somebody, somewhere, now has quite a bit of source code to several of our apps.

Before I continue, three important points:

  • There’s no indication any customer information was obtained by the attacker.
  • Furthermore, there’s no indication Panic Sync data was accessed.
  • Finally, our web server was not compromised.

(As a reminder, we never store credit card numbers since we process them with Stripe, and all Panic Sync data is encrypted in such a way that even we can’t see it. Read more.)

Panic offers several popular apps, including web editor Coda, FTP app Transmit, SSH client Prompt, and more. The attackers have demanded a large ransom, to be paid via Bitcoin. Panic does not intend to pay the ransom.

Panics warns customers to only download Panic’s apps from the Panic website or the Mac App Store, as the stolen source code could potentially be used to create malware-laden versions of the software packages.

Panic has been in contact with both Apple and the FBI, and Apple’s team is on the lookout for any stolen or malware-infested versions of the Panic apps. The FBI is investigating the matter.

Frank asks that customers notify the company if they see any unofficial Panic apps available in the wild. Such apps are likely to be infected with malware in an attempt to spread their evil payload.

We’ll be working overtime for the foreseeable future to keep an eye on this situation.

But we could also use your help.

If you see any cracked or otherwise unofficial versions of our apps in the wild, it’s safest to assume they are infected, and we ask that you please let us know. If you see our source show up somewhere, also let us know. And if you have information that could help with the investigation into this incident, definitely let us know.

MacTrast