Intego Mac Security Blog

My favourite IOS exploit was from 2010 that targeted version 3.1.2 to 4.0.1 It allowed to jailbreak with nothing more than a pdf with a corrupted font. https://www.intego.com/mac-security-blog/ios-vulnerability-allows-web-…

> the touchbar is worthless for anyone who is reading HN That seems unfair. I've never really had use for function keys, and while I do enjoy the physical volume and brightness keys, the touch bar can certainly be put to use by power users: https://www.intego.com/mac-security-blog/customize-and-personalize-you… I looked into the XPS 13 but the screen is smaller than I'd like, and more importantly Windows and the non-Apple touch pad just generally put a damper on the whole user experience. Which isn't something I want from an expensive new device.

I would argue that Android is safer, specifically from 0days. Anyone with Android 6.0 or later (a 2015 OS) gets Chrome updates. Those updates are fast, automatic, and transparently happen in the background, with no user input or downtime (e.g. need to restart). They're also not arbitrarily delayed to fit into with some rigid OS update release schedule, like iOS or macOS. That's especially important in this era where people are skeptical of updates, or just too busy, and keep delaying and skipping updates. Every time I use a family member's device, and check the version, I see they haven't updated in months. Many aren't even aware there are updates available. I told the story before, but my grandma only has 4G, no Wi-Fi, and only has an iPhone, no laptop to download IPSWs from (and obviously average users can't do that); therefore she only gets iOS updates when I visit once or twice a year. Is Apple happy with that? Provocatively: is that the best they can do? Google proves it's not. Sure, the Android OS update situation isn't great, but your biggest 0day exposures will be apps exposed to the internet (Chrome, chat apps) and those all get regular, transparent background updates with no user input; and Android users are much safer for it, than they'd be if Google imitated Apple's OS update strategy. This is an Apple-wide problem, not just iOS. Anyone with OS X El Capitan 10.11 or later (again, a 2015 OS) is running the latest Google Chrome. Yet their Safari version is…

To play the devil's advocate, does a volunteer have more incentive to keep your data private, or a company whose very business and reputation relies on keeping it private? Is a network that can readily and easily be infiltrated by malicious parties "for free" more trustworthy, or a private network locked down to trusted machines by security engineers, audited by third parties? Because there is enormous incentive to deanonymize Tor. In 2020, nearly 25% of the network was controlled by a malicious attacker. [1] You had, then, a 1.5% chance of complete and total deanonymization by a single party - a near-certain chance of deanonymization if you heavily used Tor. And this is without any traffic correlation antics. Turning off the devil's advocate, most "trustworthy" VPNs are almost certainly intelligence gathering operations, claiming "no logs" in court but in reality being a tool for parallel construction. It's too valuable a position for the 3LAs of the world to not have some ownership and stake in major VPNs. Crypto AG-style. IMHO there is no hope for modern anonymity. Interesting connections will be logged for future deanonymization with quantum computers. In the meantime, mixnets like Nym [2] might emerge to be our saving grace. [1]: https://www.intego.com/mac-security-blog/why-tor-is-bad-for-your-priva… [2]: https://nymtech.net/

The performative outrage about the GDID is quite comical in the context that everyone continues to be mum about Google Chrome, a browser explicitly designed to hoover up as much data as possible about you, even having been caught doing it in Incognito Mode [1], all while touting "privacy" features; which means no one besides Google is allowed to do it. [1] https://www.intego.com/mac-security-blog/google-forced-to-delete-chrom…

As far as I know, it is factually correct. https://www.intego.com/mac-security-blog/apples-poor-patching-policies…

Apple used to be very good at this, especially in the pre-iPhone OS X era. iTunes: https://discussions.apple.com/content/attachment/192853040 Preview: https://www.intego.com/mac-security-blog/wp-content/uploads/2022/02/pr… Garage Band: https://inside.wooster.edu/technology/wp-content/uploads/sites/83/2018…

Old hack back in 2009 iirc Here's an article from 2010 https://www.intego.com/mac-security-blog/possible-security-issue-invol… Here's one from 2021 where Microsoft leaked credentials: https://cybernews.com/security/microsoft-vancouver-leaking-website-cre…

> The author states that security updates on earlier iOS versions give a false sense of security. The author links to this article which provides more detail: https://www.intego.com/mac-security-blog/apples-poor-patching-policies… I wouldn't take everything that's written in a random tech article for granted. Fear inducing titles generate more clicks. As soon as you do something in this world, there's a risk. Even if you do nothing, there's a risk. Nobody will be able to be completely safe using any device under the sun. And if a tech company tries to make you believe otherwise, run.

This sort of things happens on iOS also. The big difference is that Google is open while Apple tries to hide it. The Xcode ghost incident for example affected half a billion installs and 100M users: https://www.intego.com/mac-security-blog/xcodeghost-malware-infected-1… Regarding big name apps... Well, WhatsApp on iOS has been the main attack vector for state actors for a few years now. https://thedefenceworks.com/blog/zero-click-infection-and-whatsapps-la…

Of just don't use numeric pins. Use a passphrase: https://www.intego.com/mac-security-blog/if-hackers-crack-a-six-digit-…

>These are transient objects for humans passing through their years. A useful novelty, a pleasant experience, that’s all they want. There is huge drive to position the products in this way. Consumers including you are manipulated to think this way for products that traditionally aren't thought of this way. It has become so ingrained that you can't tell the difference. >You cite no…

> while getting security updates Apple releases security updates properly for the current (latest) version only. Older releases get security updates that sometimes don't fix all of the known vulnerabilities. https://www.youtube.com/watch?v=o5KUvgXHOFU https://www.intego.com/mac-security-blog/apple-neglects-to-patch-zero-…

Hmm, lots to unpack there, I'll stay focused on my iPhone,...I'm not so sure...the lead article on HN yesterday showed you can track people unrelated to tag's routes, live. https://www.intego.com/mac-security-blog/i-mailed-an-airtag-and-tracke… I've gathered there's a beep if this is going on for 3 days, but...still not comfy with this. And this isn't a particularly fringe opinion, plenty of comments on the article wondering how to opt out:

>2013: iSeeYou: Disabling the MacBook Webcam Indicator LED https://jscholarship.library.jhu.edu/handle/1774.2/36569 ... applies only to older Mac notebooks from like 2008 period which are long since obsolete according to Apple's announced support policy. >2016: Your Mac’s Camera Can Be Hacked https://www.intego.com/mac-security-blog/your-macs-camera-ca... ... refers specifically the exploit above. >2016: Former NSA employee: This hack gains access to your Mac's webcam https://www.cnet.com/news/mac-webcam-hack-ex-nsa-employee/ ... is an attack that depends on the camera already being in use by another application and therefore has nothing to do with the camera indicator.

> "Designed to protect your privacy, Mac notebooks have a camera indicator light to let you know when the camera is on. ... Published Date: July 02, 2020" Perhaps Apple missed these? 2013: iSeeYou: Disabling the MacBook Webcam Indicator LED https://jscholarship.library.jhu.edu/handle/1774.2/36569 2016: Your Mac’s Camera Can Be Hacked https://www.intego.com/mac-security-blog/your-macs-camera-can-be-hacke… 2016: Former NSA employee: This hack gains access to your Mac's webcam https://www.cnet.com/news/mac-webcam-hack-ex-nsa-employee/

The concept of HTTPS must sound crazy to you. Edit: Or this guy: https://www.intego.com/mac-security-blog/wp-content/uploads/2016/03/Br…

> Airo Security (AiroAV) has recently discovered that a Comscore product for macOS, called PremierOpinion > PremierOpinion is a decade old [0] spyware developed by VoiceFive, a ComScore company (NASDAQ: SCOR) The "news" does seem a bit overblown. It looks like it always had HTTP MITM functionality, presumably now also for HTTPS. [0] https://www.intego.com/mac-security-blog/intego-security-alert-osxopin…

>There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt). There's nothing accurate about this description. The user can turn off all update checking, or use the granular permissions to just turn off silent security updates. >To allow macOS to update automatically, go to System Preferences > Software Update, then check Automatically keep my Mac up to date. The Mac offers some more granular update options than iOS. If you click Advanced…, you see a number of options: https://www.intego.com/mac-security-blog/everything-you-need-to-know-a… If you only want to turn off silent security updates, the option to uncheck is "Install system data files and security updates".

https://www.intego.com/mac-security-blog/iphone-20-and-ipod-touch-20-u… The first iPod touch had a broadcom chip that supported Bluetooth, but wasn't supported in the software stack. You needed to upgrade to use the Bluetooth hardware that you had already paid for.

Ah the immunity of non-Microsoft operating systems: https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-co… https://www.zdnet.com/article/eset-discovers-21-new-linux-malware-fami…

Apparently photos can be taken with the Mac camera and trigger the green light so briefly that it is not noticeable [1]. It would be good if Apple set a minimum activation period for the green light, so that even if the camera is only on for a millisecond, the green light is on for 5 seconds or something. In the meantime, there are tools that can alert you to any activations [2]. 1: https://www.intego.com/mac-security-blog/your-macs-camera-can-be-hacke… 2: https://www.macworld.com/article/3129449/security/how-to-keep-your-mac…

Reddit has been used to point to C&C servers in the past[0], so I wouldn't be surprised if some malware does send commands directly via Reddit. [0] https://www.intego.com/mac-security-blog/iworm-botnet-uses-reddit-as-c…

I meant the IOS App Store, not the Mac App Store. But this does highlight why Mac App Store app restrictions exist. Re blacklisting, I'm referring to Apple's Xprotect (https://www.intego.com/mac-security-blog/topic/xprotect/).

Can someone explain how the encryption works on the iPhone? I was under the impression that the 4 digit code is just a screen lock and had nothing to do with the encryption. Also is there a reason they can't just use this piece of hardware to brute force the phone? https://www.intego.com/mac-security-blog/iphone-pin-pass-code/

Apple used to have a bug where they'd report PIN failure before writing that failure to nonvolatile storage. Somebody took advantage of this by building a box that cut power before the write could be performed, allowing a brute force attack: https://www.intego.com/mac-security-blog/iphone-pin-pass-code/ The proposal here is similar, just using a different technique to prevent the write. There isn't any nonvolatile storage besides the flash memory, so if you can reset that then the software has no way of knowing what happened before.

Spotlight suggestions is the issue, and there are settings for both Safari and Spotlight to adjust so searches are not shared. This article shows the steps to disable: http://www.intego.com/mac-security-blog/spotlight-suggestions-in-os-x-…

80% on 10.9 or 10.10: http://www.intego.com/mac-security-blog/os-x-market-share-statistics-1… Only 50% on Windows 7 or 8: https://analytics.usa.gov Oh, wait, Windows 7 is from 2009. Only 10% use a Windows younger than two years.

I wondered why Safari (running on an older OS X 10.6 system) didn't report the certificate as revoked, although Firefox on the same system did. The answer appears to be as described here: http://www.intego.com/mac-security-blog/protect-safari-from-fraudulent… After setting the proper options in Keychain Access, Safari reported the revocation correctly.

Actually, this mechanism has been there since at least Snow Leopard, if not before. See the screenshot of Exceptions.plist on page 4 of [0]. [0]http://www.intego.com/mac-security-blog/dl/How-the-Anti-Malware-Functi…