- apple-list - University of Manitoba Mailing Lists

INTEREST: Why FBI's request can affect civil rights for a generation
by Wayne Billing 17 Feb '16

17 Feb '16

Rich Mogull has twenty years experience in information security, physical security, and risk management. He specializes in data security, application security, emerging security technologies, and security management. Prior to founding Securosis, Rich was a Research Vice President at Gartner Inc (garner.com<http://garner.com>) on the security team where he also served as research co-chair for the Gartner Security Summit. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator. Rich is the Security Editor of TidBITS, a monthly columnist for Dark Reading, and a frequent contributor to publications ranging from Information Security Magazine to Macworld. He is a frequent industry speaker at events including the RSA Security Conference and DefCon. …from: http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w… Why the FBI's request to Apple will affect civil rights for a generation No legal case applies in a vacuum, and in this case the FBI needs the precedent more than the evidence. [Rich Mogull] Rich Mogull<http://www.macworld.com/author/Rich-Mogull/> | @rmogull<https://twitter.com/rmogull> Contributor, Macworld * Feb 17, 2016 11:14 AM * <http://www.facebook.com/sharer.php?u=http://www.macworld.com/article/303435…'s%20request%20to%20Apple%20will%20affect%20civil%20rights%20for%20a%20generation> * <https://twitter.com/intent/tweet?url=http%3A%2F%2Fwww.macworld.com%2Farticl…> * <https://plus.google.com/share?url=http%3A%2F%2Fwww.macworld.com%2Farticle%2…> * <https://pinterest.com/pin/create/bookmarklet/?url=http%3A%2F%2Fwww.macworld…> * <http://reddit.com/submit?url=http%3A%2F%2Fwww.macworld.com%2Farticle%2F3034…> * <http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w…> * 16 <http://www.macworld.com/article/3034355/ios/why-the-fbis-request-to-apple-w…> On Tuesday, the United States District Court of California issued an order requiring Apple to assist the FBI in accessing a locked iPhone<http://www.macworld.com/article/3034028/security/apple-ordered-to-assist-in…> (PDF<https://assets.documentcloud.org/documents/2714001/SB-Shooter-Order-Compell…>)—and not just any iPhone, but the iPhone 5c used by one of the San Bernardino shooters. The order is very clear: Build new firmware to enable the FBI to perform an unlimited, high speed brute force attack, and place that firmware on the device. Apple is not only fighting the request<http://www.macworld.com/article/3034214/security/tim-cook-says-apple-will-o…>, but posted a public letter signed by Tim Cook<http://aos.prf.hn/click/camref:1100laKZ/destination:http://www.apple.com/cu…>and linked on Apple’s front page. Make no mistake: This is unprecedented, and [in this author’s opinion] the situation was deliberately engineered by the FBI and Department of Justice to force a showdown. This is an issue with far-reaching implications well beyond a single phone, a single case, or even Apple itself. As a career security professional, this case has chilling implications. Why now? I’ve been writing about Apple’s role in our digital civil rights since 2014<http://tidbits.com/article/15137>, and specifically addressed why Apple is at the center of the battle over encryption<http://tidbits.com/article/16210> last month on TidBITS. The short version is that Apple is one of the only companies with the technologies, high profile, and business model to both find themselves in the cross hairs, and take a strong position. Apple has a long history of complying with court orders and assisting law enforcement. Previous to iOS 8, they could extract data off devices. Even today, data in most of their online services (iCloud, excluding iMessage and FaceTime) can be provided upon legal request. This case is different for multiple reasons: * Apple is being asked to specifically create new software to circumvent their security controls. They aren’t being asked to use existing capabilities, since those no longer work. The FBI wants a new version of the operating system designed to allow the FBI to brute force attack the phone. * The FBI is using a highly emotional, nationally infamous terrorism case as justification for the request. * The request refers to the All Writs Act, which is itself under scrutiny in a case in New York involving Apple<https://www.eff.org/cases/re-order-apple-all-writs>. Federal Magistrate Judge James Orenstein of the Eastern District of New York is currently evaluating if the Act applies in these cases. That’s why this is about far more than a single phone. Apple does not have the existing capability to assist the FBI. [In this author’s opinion] the FBI engineered a case where the perpetrators are already dead. And the law cited is under active legal debate within the federal courts. The crux of the issue is should companies be required to build security circumvention technologies to expose their own customers? Not “assist law enforcement with existing tools,” but “build new tools.” The FBI Director has been clear that the government wants back doors into our devices<https://www.fbi.gov/news/speeches/going-dark-are-technology-privacy-and-pub…>, even though the former head of the NSA disagrees and supports strong consumer encryption<http://money.cnn.com/2016/01/13/technology/nsa-michael-hayden-encryption/in…>. One reason Apple is likely fighting this case so publicly is that it is a small legal step from requiring new circumvention technology, to building such access into devices. The FBI wants the precedent far more than they need the evidence, and this particular case is incredibly high profile and emotional. The results will, without question, establish precedence beyond one killer’s iPhone. The technical details The court order is quite specific. It applies only to one iPhone [5c owned by San Bernardino shooters], and requests Apple create a new version of the firmware that eliminates the existing feature that erases the iPhone after 10 failed attempts at entering the passcode. It further asks Apple to allow passcode attempts to be performed as rapidly as possible. [passcodes iphone] Apple has been prompting users to choose longer and more complicated—and harder to crack—iPhone passcodes. Beginning with iOS 8, devices are encrypted using a key derived from your passcode. This is combined with a hardware key specific to the device. Apple has no way of knowing or circumventing that key. On newer devices, the hardware key is embedded in the device and is not recoverable. Thus the passcode must be combined with the device key in a chip on the phone, and that chip rate-limits passcode attempts to make a brute force attack slower. Reading through the order, it seems the FBI thinks that a modified version of the operating system would allow them to engage in high-speed attacks, if the 10-tries limit was removed. The request indicates they likely can’t image the device and perform all the attacks on their own super-fast computers, due to that hardware key. With a four-character passcode the device could probably be cracked in hours. A six-character code<http://www.macworld.com/article/3018152/security/switch-to-six-digits-for-y…> might take days or weeks, and anything longer could take months or years. Dan Guido over at Trail of Bits posted a great explanation<http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-…>: As many jailbreakers are familiar, firmware can be loaded via Device Firmware Upgrade (DFU) Mode. Once an iPhone enters DFU mode, it will accept a new firmware image over a USB cable. Before any firmware image is loaded by an iPhone, the device first checks whether the firmware has a valid signature from Apple. This signature check is why the FBI cannot load new software onto an iPhone on their own—the FBI does not have the secret keys that Apple uses to sign firmware. This opens up a few questions. Could this work on newer devices with the enhanced encryption of the Secure Enclave<http://www.macworld.com/article/2999804/security/apple-cant-decrypt-your-ip…>? How can Apple pair the device and replace the firmware in the first place? Would they be using the shooter’s computer? An over-the-air update? Apple says that all devices (with or without the Secure Enclave) are vulnerable to this kind of attack, but declined to comment on the specific technical methods, a position I initially disagreed with, but on reflection is probably the right move for reasons we will get to in a moment. Thus the FBI wants a new version of iOS, signed by Apple and installed on the device, that removes limitations on their attempts to brute-force the password. Why this matters Legal precedent is like a glacier, slowly building over time until it becomes nigh unstoppable. Major issues like this are first, and sometimes ultimately, decided on a series of small steps that build on each other. It’s the reason the NRA fights any attempts at gun control, since they fear a slow build, not a single small law. The crux of this round of the encryption debate is if companies should be forced to build tools to circumvent their customers’ security. If the answer is “yes,” it could be a small step to “should they just build these tools into the OS from the start?” I have no doubt the FBI deliberately chose the highest-profile domestic terrorism case in possibly a decade. We, average citizens, want the FBI to stop this sort of evil. We don’t necessarily see this one case as applying to our lives and our rights. Why the big deal?<http://www.theverge.com/2016/2/17/11031910/donald-trump-apple-encryption-ba…> What if the FBI could find the terrorists’ contacts and stop other attacks? What matters is if we have a right to the security and privacy of our devices and communications. But the truth is, no legal case applies in a vacuum. If this goes through, if Apple is forced to assist, it will open a floodgate of law enforcement requests. Then what about civil cases? Opening a phone to support a messy divorce and child custody battle? Or what about requests from other nations, especially places like China and the UAE that already forced BlackBerry and others to compromise the security of their customers? And once the scale of these requests increases, as a security professional I guarantee the tools will leak, the techniques will be exploited by criminals, and our collective security will decline. It really doesn’t matter if it’s the iPhone 5c or 6s. It really doesn’t matter if this is about dead terrorists or a drug dealer. It doesn’t matter what specific circumvention Apple is being asked to create. What matters is if we have a right to the security and privacy of our devices, and of our communications, which are also under assault. If we have the right to tools to defend ourselves from the government and criminals alike. Yes, these tools will be sometimes used for the worst of crimes, but they’re also fundamental to our civil rights, freedom of discourse, and our ability to protect our digital lives from the less impactful, but far more frequent criminal attacks. [It is the author’s opinion that] this situation was engineered by the FBI and Department of Justice for the maximum impact and chances of success. Apple is fighting, and as a security professional it’s my obligation to support their position, and stronger security.

1 0

FYI: Apple USB-C Charge Cable Replacement Program
by Wayne Billing 12 Feb '16

12 Feb '16

…from: http://www.apple.com/support/usbc-chargecable/ Apple USB-C Charge Cable Replacement Program [USB-C charge cable] Please select a Country Asia Australia België Belgique Brasil България Canada (English) Canada (Français) 中国 Česká republika Danmark Deutschland España Eesti Ελλάδα France Hong Kong (English) 香港 India Indonesia Ireland Italia 日本 대한민국 Κύπρος Latin America América Latina Latvija Lietuva Luxembourg (English) Luxembourg (Français) Luxemburg (Deutsch) Malaysia Magyarország Malta México Nederland New Zealand Norge Österreich Polska Portugal Россия România Saudi Arabia Singapore Slovensko Slovenija Schweiz Suisse Suomi Sverige 台灣 ไทย Türkiye United Arab Emirates United Kingdom United States A limited number of Apple USB-C charge cables that were included with MacBook computers through June 2015 may fail due to a design issue. As a result, your MacBook may not charge or only charge intermittently when it’s connected to a power adapter with an affected cable. Apple will provide a new, redesigned USB-C charge cable, free of charge, to all eligible customers. This program also covers Apple USB-C charge cables that were sold as a standalone accessory. For MacBook owners who provided a valid mailing address during the product registration process or Apple Online Store purchase, Apple will send you a new cable by the end of February 2016. All other eligible MacBook owners should use the replacement process below to receive a new USB-C charge cable. Identifying an affected cable Affected cables have “Designed by Apple in California. Assembled in China.” stamped on them. New, redesigned cables include a serial number after that text. See images below. Affected cable [Affected cable detail] Redesigned cable [Redesigned cable detail] Replacement Process Please choose one of the options below to receive a new USB-C charge cable. We will need your MacBook serial number to verify eligibility for this program. Learn how to find your serial number here<https://support.apple.com/en-us/HT204356>. * Find an Apple Retail Store. Genius Bar reservation recommended. * Find an Apple Authorized Service Provider<https://locate.apple.com/>. * Contact Apple Support. Additional Information This worldwide Apple program does not extend the standard warranty coverage of the MacBook. If you believe you have paid for a replacement due to this issue, contact Apple regarding a refund. The program covers the affected USB-C charge cables until June 8, 2018. Information as of 2016-02-12

1 0

FYI: Uninstalling Facebook app may save up to 15% of iPhone battery life
by Billing Wayne 08 Feb '16

08 Feb '16

….from: http://www.theguardian.com/technology/2016/feb/08/uninstalling-facebook-app… Uninstalling Facebook app saves up to 15% of iPhone battery life Facebook is one of the most downloaded apps on iOS but it has long been cited as a cause of fast-draining iPhone batteries <http://www.theguardian.com/technology/2015/oct/19/facebook-iphone-users-bat…>. Last year it was accused of using background tricks to stay active <https://www.reddit.com/r/iphone/comments/3kvfta/how_is_facebook_doing_so_mu…> even when it wasn’t being used. Facebook admitted bugs existed, and fixed them <https://www.facebook.com/arig/posts/10105815276466163>, but questions of the app’s impact on battery life remained. Similar concerns about Facebook’s Android app led to the discovery that deleting the app saves up to 20% of a phone’s battery <http://www.theguardian.com/technology/2016/feb/01/uninstalling-facebook-app…>. After that revelation, I set about seeing if the same was true for iPhone users. I discovered that uninstalling Facebook’s iOS app and switching to Safari can save up to 15% of iPhone battery life. Using an iPhone 6S Plus <http://www.theguardian.com/technology/2015/oct/02/iphone-6s-plus-review-bar…> for a week without the main Facebook app installed, I recorded the battery life at 10.30pm each day for a week comparing it to a daily average taken from a week with the app. I charged the phone overnight, taking it off the charger at 7.30am, and used it normally. I accessed Facebook for the same amount of time, and for the same purposes, using the social network’s excellent mobile site within Safari, as I had done using the app. I also left the Facebook Messenger app installed. On average I had 15% more battery left by 10.30pm each day. I had also saved space, because at the point I had deleted the Facebook app it had consumed around 500MB in total combining the 111MB of the app <https://itunes.apple.com/gb/app/facebook/id284882215?mt=8> itself and its cache on the iPhone. To make sure that this wasn’t an isolated incident, I also recruited several other Facebook-using iPhone owners to conduct a similar test. They all found similar results, with increased battery life when using Facebook in Safari having uninstalled the main Facebook <http://www.theguardian.com/technology/facebook> iOS app. <https://www.facebook.com/dialog/share?app_id=180444840287&href=http%3A%2F%2…> <https://twitter.com/intent/tweet?text=Uninstalling%20Facebook%20app%20saves…> <http://www.pinterest.com/pin/create/button/?description=Uninstalling+Facebo…> Spot the difference: one is the Facebook app, the other the Facebook mobile site. Photograph: Samuel Gibbs for the Guardian Using Facebook in Safari was almost as good as the app. You can even place a shortcut to Facebook in Safari on the homescreen that looks almost identical to the app’s icon (the white is a little less bright but you need eagle eyes to see). The only restriction was the Share-to function, which does not exist for websites, meaning that to share photos I had to manually hit the “post photos” button on the mobile site. Features of the app, such as Instant Articles, are also not available. Tapping a link on the Facebook mobile site opens a new Safari tab. The results will vary for the smaller iPhone 6S <http://www.theguardian.com/technology/iphone-6s>, as it has a smaller battery and shorter battery life overall, but judging by the 6S Plus experience, removing the Facebook app in preference of using the social network in Safari will extend the battery life of any iPhone. A Facebook spokesperson said the company was investigating the matter.

1 0

INTEREST: Oracle: JAVA's future: one side step
by Wayne Billing 31 Jan '16

31 Jan '16

…from: http://www.macworld.com/article/3027473/security/oracle-is-planning-to-kill… https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free Migration options: http://www.oracle.com/technetwork/java/javase/migratingfromapplets-2872444.… Oracle's killing a favorite security hole for attackers: the Java browser plug-in Lucian Constantin<http://www.macworld.com/author/Lucian-Constantin/> IDG News Service * Jan 28, 2016 4:26 AM Oracle will retire the Java browser plug-in, frequently the target of Web-based exploits, about a year from now. Remnants, however, will likely linger long after that. “Oracle plans to deprecate the Java browser plugin in JDK 9,” the Java Platform Group said in a blog post<https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free> Wednesday. “This technology will be removed from the Oracle JDK and JRE in a future Java SE release.” The Java Development Kit (JDK) 9, the reference implementation for the next version of Java SE, is expected to reach general availability<http://openjdk.java.net/projects/jdk9/> in March 2017. By then, however, most modern browsers will no longer accept the Java browser plug-in anyway. Mozilla announced in October that it plans to remove support for plug-ins<https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/> in Firefox by the end of 2016. Chrome disabled support in September for plug-ins that, like Java and Silverlight, use the old Netscape Plugin Application Programming Interface (NPAPI) standard. Microsoft’s Edge browser doesn’t support plug-ins either. With Internet Explorer and Safari the only browsers set to still accept traditional NPAPI plug-ins after 2016, Oracle is pretty much forced into this decision, even though Chrome does support a new plug-in technology called PPAPI (Pepper Plug-in API). “Oracle does not plan to provide additional browser-specific plugins as such plugins would require application developers to write browser-specific applets for each browser they wish to support,” the company said in a white paper<http://www.oracle.com/technetwork/java/javase/migratingfromapplets-2872444.…> that outlines migration options for developers. “Moreover, without a cross-browser API, Oracle would only be able to offer a subset of the required functionality, different from one browser to the next, impacting both application developers and users.” The main alternative proposed by the company is to switch from Java Applets to Java Web Start applications. This type of application can be launched from the Web without the need for a browser plug-in. From a security perspective though, Java Web Start applications can be used as an attack vector for exploiting vulnerabilities in the Java runtime, just like Applets. Even after the Java plug-in is retired, it’s likely that many computers will continue to have it installed for years to come. This is especially true in business environments where custom built Web-based Java applications are common and cannot be easily replaced or rewritten. Even now, for application compatibility reasons, there’s a large number of computers in business environments that continue to use Java 6 or Java 7, versions that no longer receive public security updates.

1 0

INTEREST: Fire last night at Foxconn’s main iPhone manufacturing plant “spanned several floors of the factory”
by Wayne Billing 25 Jan '16

25 Jan '16

…from: http://9to5mac.com/2016/01/25/foxconn-fire/ http://www.wsj.com/articles/fire-breaks-out-at-foxconn-iphone-manufacturing… Fire last night at Foxconn’s main iPhone manufacturing plant “spanned several floors of the factory” | 9to5Mac 24 Jan 2016 Update: A video from the People’s Daily does make it seem surprising that production would be unaffected. A fire broke out last night at Foxconn’s main iPhone manufacturing plant in Zhengzhou, China, with the WSJ<http://www.wsj.com/articles/fire-breaks-out-at-foxconn-iphone-manufacturing…> noting that it spanned several floors of the factory. Foxconn confirmed reports, but said that there were no casualties and production was not affected. Local authorities said they are investigating the cause of the fire. The fire began in the central air conditioning fan and ventilation ducts on the roof of one of Foxconn’s Zhengzhou plants, according to a statement on the website of the Zhengzhou Airport Economy Zone. There have been previous fires<http://9to5mac.com/2011/09/27/another-fire-at-foxconn-plant-extinguished/> and explosions at Foxconn factories, the most serious<http://9to5mac.com/2011/05/20/explosion-rocks-foxconns-ipad-2-manufacturing…>of which was at an iPad 2 production facility in 2011, when three workers were killed<http://9to5mac.com/2011/06/02/ipad-plant-is-back-in-business/>and fifteen injured. That incident also had a major impact<http://9to5mac.com/2011/05/23/isuppli-foxconn-explosion-could-cost-apple-ha…> on iPad production.

1 0

FYI: Missing features in Office for Mac & iPad vs Windows
by Wayne Billing 21 Jan '16

21 Jan '16

[Kurt Schmucker - currently works for PARALLELS software; used to be Senior Evangelist for Microsoft's Mac Business Unit - compares Microsoft Office for OS X, iPad, and Windows] …from: http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/ Comparison breaks down all the missing features in Office for Mac & iPad vs Windows<http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/> Jordan Kahn<http://9to5mac.com/author/jordankahn/> - 40 mins ago @JordanKahn<https://twitter.com/intent/user?screen_name=JordanKahn> APPS<http://9to5mac.com/category/apps/> IOS<http://9to5mac.com/category/ios/> IOS DEVICES<http://9to5mac.com/category/ios-devices/> MAC<http://9to5mac.com/category/mac/> TECH INDUSTRY<http://9to5mac.com/category/tech-industry/> APPS & UPDATES [windows-mac-ipad-microsoft-office-comparison.png] This comparison of the differences between Microsoft Office on Mac, Windows, and iOS devices was put together by Kurt Schmucker who (disclaimer) works for Parallels<http://blog.parallels.com/author/kschmuckerparallels-com/> — the company that makes slick virtual machine apps for running Windows and other operating systems on Mac<http://www.anrdoezrs.net/click-5781858-12310291-1446142151000> — but he also happens to know a thing or two about the subject after his previous role as Senior Mac Evangelist at Microsoft and on the Office team<http://9to5mac.com/2010/09/28/official-office-for-mac-available-october-26/>. So what exactly is missing on Mac and iOS devices compared to Windows when it comes to the Office suite? In the charts below, Schmucker breaks down feature-by-feature exactly what you get (and don’t get) in each of the different versions of the productivity suite including Office 2016 and 2013 for Windows, Office 2016 and 2011 for Mac, and Office for iPad<http://9to5mac.com/2016/01/21/microsoft-3d-touch-iphone-6s-apple-pencil-ipa…>. The full charts (below) show suite-wide differences between the versions such as missing apps, lack of support for Visual Basic and ActiveX, right-to-left language support, accessibility features, AppleScript and much more. Other charts in the study show feature variations for Word, Excel, PowerPoint, and Outlook, with the majority of the features listed unavailable for iPad users and a mixed bag for the other versions. [Microsoft-Office-Comparison-Parallels-02] And Schmucker points out two things regarding the iPad specifically. One positive is support for right-to-left languages, which he notes is something that Mac users have bene asking for but have yet to receive, while a negative for the iPad is lack of multiple selection support in PowerPoint, something Schmucker notes is a pretty basic but crucial function for the app. In the end, he concludes that a mix of the various Office suites is the best approach but admits that his main, go-to version is MacOffice 2011 (apart from using the latest version of Outlook due to enhanced performance): “I worked for the MacOffice team at Microsoft for several years, and at that time I also worked closely with colleagues on the WinOffice teams. Because of this background, I am often able to pick just the right Office app that will make a given task the easiest to do. One task might be particularly well suited to MacWord 2011 because Publishing Layout View— a feature only in that one Word version— will make this task easy. Another task might be suited to WinPPT because of the Animation Painter, which is not in any MacPPT version. Yet another task might be best suited to WInPPT 2013 because it needs an Office extension not available in other Office suites.” Click the charts below to view them in full size: [Microsoft-Office-Comparison-Parallels-03]<http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/…> [Microsoft-Office-Comparison-Parallels-04]<http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/…> [Microsoft-Office-Comparison-Parallels-05]<http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/…> [Microsoft-Office-Comparison-Parallels-06]<http://9to5mac.com/2016/01/21/windows-mac-ipad-microsoft-office-comparison/…>

1 0

INTEREST: Apple, DJI, and the price of oil
by Wayne Billing 20 Jan '16

20 Jan '16

The Dow-Jones Industrial has dropped about 2,000 points over the past year from around 18,000 to around 16,000; about an 11% drop. [search "dow jones industrial” on google] Apple stock prices have dropped from about 110 a year ago to around 98 today; about 10.9% drop. [search “apple stock” on Google] Oil has dropped from a high of about 100 - 110 to around 28 today; roughly 75% drop. http://www.nasdaq.com/markets/crude-oil.aspx?timeframe=5y USA today’s headline reads: "Apple stock destroys $218B: How low can it go?” http://www.usatoday.com/story/money/markets/2016/01/15/apple-stock-destroys… Apple stock destroys $218B: How low can it go? Stocks plummeted Friday as oil prices, which were already at a 12-year low, fell below $30 a barrel. [cid:A05DF82E-00D5-4E0E-BE49-E6AD7D8F5588] Matt Krantz<http://www.usatoday.com/staff/1035/matt-krantz/>, USA TODAY 8:59 p.m. EST January 15, 2016 Apple (AAPL<safari-reader://www.usatoday.com/money/lookup/stocks/aapl/>) is the poster child of this market crash. It took a market meltdown to help expose just how overvalued the stock was. The question is how much lower can it fall. Shares of the gadget maker closed down another $2.47, or 2.5%, to $97.05 Friday — capping off what's been a breathtaking 28% decline from the stock's high last year. Apple's fall will go down as one of the biggest wealth destroyers in recent market history - shredding $218 billion in market value from the market's high on May 21, 2015 adjusted for stock buybacks. That's more than the entire market value of roughly 485 stocks individually in the Standard & Poor's 500. Latest on markets: Apple is the most widely held stock by consumers — so it is the market to many. By that measure, Apple's shares are a disaster amid this latest market downturn. Apple — by far — has accounted for more of the market value lost in this market decline than any other. Energy pipeline company Kinder Morgan (KMI<safari-reader://www.usatoday.com/money/lookup/stocks/KMI/>) is the second biggest wealth destroyer — but it only wiped out $63.5 billion from the high. The question now is how much lower Apple shares can do. Here are some ways to think about that: ► $92: Apple's previous intraday low. Shares of Apple plunged to $92 a share on an intraday basis back in August during a market malfunction. Many investors are hoping this previous freak-out low will hold. ► $77: The pattern of where Apple shares have crashed before. The last time investors worried about slowing smartphone growth sent the stock down 43% between Sept. 2012 and June 2013. If Apple drops from its $134.54 high to the same degree, that would put the shares at $77. ► $39.65: This could be somewhat of a worst-case scenario. Apple investors like to say Apple is cheap because it trades for 11 times its diluted trailing earnings. There's just one problem — Apple is a giant hardware company. Large hardware companies tend to have low multiples. There's really one one decent publicly traded large hardware company left: HP (HPQ<safari-reader://www.usatoday.com/money/lookup/stocks/HPQ/>). HP, a seller of computer hardware, trades for 4.3 times trailing earnings. That same multiple applied to Apple would give it a stock price of $39.65. Growth mutual funds, like American Funds Capital World Growth & Income Fund and Hartford Capital Appreciation fund have slashed their holdings in Apple the past six months seeing signs that the company's rapid growth is stalling, according to Reuters. To be sure, while analysts are worried smartphone sales are mature and slowing, that's a far cry from the state of the personal computer or printer market HP is competing in. HP is expected to grow just 3.5% a year over the next five years. That's a fraction of the 13.3% long-term growth analysts expect from Apple, says S&P Capital IQ. These scary scenarios may never come to pass. Analysts remain bullish on the stock — despite signs of a slowdown — and are calling it a buying opportunity. Analysts have an average 18-month price target on Apple at $142.91, says S&P Capital IQ. If correct that would be a staggering upside. Meanwhile, Apple is sitting on more than $200 billion in cash and investments. Even if you strip out the company's debt, the company still has a tangible book value a share of $19.78. That means Apple is trading for just about 5 times tangible book value — which is a discount to the average 11.2 price to book value of companies in the S&P 500. If Apple were to trade at that multiple, it would be worth $221 a share. There's no question Apple was overvalued - given the historic decline in its value. But the question now is what is the right price? Given the huge range of possibilities - you can understand why Apple has become the ultimate battleground stock. Matt Krantz on Twitter: @mattkrantz<https://twitter.com/mattkrantz>.

1 0

INTEREST: Linux bug breaches sandbox; tens of millions of PCs, servers, and Android phones may be affected
by Wayne Billing 19 Jan '16

19 Jan '16

…from: http://arstechnica.com/security/2016/01/linux-bug-imperils-tens-of-millions… Linux bug imperils tens of millions of PCs, servers, and Android phones Vulnerability allows restricted users and apps to gain unfettered root access. by Dan Goodin<http://arstechnica.com/author/dan-goodin/> - Jan 19, 2016 1:16pm CST For almost three years, millions of servers and smaller devices running Linux have been vulnerable to attacks that allow an unprivileged app or user to gain nearly unfettered root access. Major Linux distributors are expected to fix the privilege escalation bug this week, but the difficulty of releasing updates for Android handsets and embedded devices means many people may remain susceptible for months or years. The flaw, which was introduced into the Linux kernel in version 3.8 released in early 2013, resides in the OS keyring. The facility allows apps to store encryption keys, authentication tokens, and other sensitive security data inside the kernel while remaining in a form that can't be accessed by other apps. According to a blog post published Tuesday<http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-…>, researchers from security firm Perception Point discovered and privately reported the bug to Linux kernel maintainers. To demonstrate the risk the bug posed, the researchers also developed a proof-of-concept exploit that replaces a keyring object stored in memory with code that's executed by the kernel. The vulnerability is notable because it's exploitable in a wide array of settings. On servers, people with local access can exploit it to achieve complete root access. On smartphones running Android versions KitKat and later, it can allow a malicious app to break out of the normal security sandbox to gain control of underlying OS functions. It can also be exploited on devices and appliances running embedded versions of Linux. While security mitigations such as supervisor mode access prevention<https://lwn.net/Articles/517475/> and supervisor mode execution protection<https://en.wikipedia.org/wiki/Control_register> are available for many servers, and security enhanced Linux<https://en.wikipedia.org/wiki/Security-Enhanced_Linux> built into Android can make exploits harder, there are still ways to bypass those protections. "As of the date of disclosure, this vulnerability has implications for approximately tens of millions of Linux PCs and servers, and 66 percent of all Android devices (phones/tablets)," Perception Point researchers wrote. "While neither us nor the Kernel security team have observed any exploit targeting this vulnerability in the wild, we recommend that security teams examine potentially affected devices and implement patches as soon as possible." While malware distributors have focused most of their resources over the years on infecting computers running Microsoft Windows, they have put increased focus on attacking competing OSes. In 2014, for instance, researchers uncovered a powerful Linux trojan that may have remained undetected for years<http://arstechnica.com/security/2014/12/powerful-highly-stealthy-linux-troj…> as it siphoned sensitive data from government agencies and pharmaceutical companies. A vulnerability like the one reported by Perception Point can be the means for surreptitiously installing such malware. The bug is indexed as CVE-2016-0728. Major Linux distributions are expected to make fixes available as early as Tuesday.

1 0

INTEREST: Microsoft failed to warn victims of email hack
by Wayne Billing 02 Jan '16

02 Jan '16

…from: http://www.reuters.com/article/us-microsoft-china-insight-idUSKBN0UE01Z2016… Microsoft failed to warn victims of Chinese email hack: former employees SAN FRANCISCO | BY JOSEPH MENN<http://blogs.reuters.com/search/journalist.php?edition=us&n=josephmenn&> [An electronic Microsoft logo is seen at the Microsoft store in New York City, July 28, 2015. REUTERS/Mike Segar] Microsoft Corp experts concluded several years ago that Chinese authorities had hacked into more than a thousand Hotmail email accounts, targeting international leaders of China’s Tibetan and Uighur minorities in particular – but it decided not to tell the victims, allowing the hackers to continue their campaign, according to former employees of the company. On Wednesday, after a series of requests for comment from Reuters, Microsoft said it would change its policy and in future tell its email customers when it suspects there has been a government hacking attempt. Microsoft spokesman Frank Shaw said the company was never certain of the origin of the Hotmail attacks. The company also confirmed for the first time that it had not called, emailed or otherwise told the Hotmail users that their electronic correspondence had been collected. The company declined to say what role the exposure of the Hotmail campaign played in its decision to make the policy shift. The first public signal of the attacks came in May 2011, though no direct link was immediately made with the Chinese authorities. That's when security firm Trend Micro Inc announced it had found an email sent to someone in Taiwan that contained a miniature computer program. The program took advantage of a previously undetected flaw in Microsoft's own web pages to direct Hotmail and other free Microsoft email services to secretly forward copies of all of a recipient's incoming mail to an account controlled by the attacker. Trend Micro found more than a thousand victims, and Microsoft patched the vulnerability before the security company announced its findings publicly. Microsoft also launched its own investigation that year, finding that some interception had begun in July 2009 and had compromised the emails of top Uighur and Tibetan leaders in multiple countries, as well as Japanese and African diplomats, human rights lawyers and others in sensitive positions inside China, two former Microsoft employees said. They spoke separately and on the condition that they not be identified. Some of the attacks had come from a Chinese network known as AS4808, which has been associated with major spying campaigns, including a 2011 attack on EMC Corp's security division RSA that U.S. intelligence officials publicly attributed to China. To see the report click here<http://www.secureworks.com/cyber-threat-intelligence/threats/sindigoo/> Microsoft officials did not dispute that most of the attacks came from China, but said some came from elsewhere. They did not give further detail. "We weighed several factors in responding to this incident, including the fact that neither Microsoft nor the U.S. government were able to identify the source of the attacks, which did not come from any single country," the company said. "We also considered the potential impact on any subsequent investigation and ongoing measures we were taking to prevent potential future attacks." In announcing the new policy, Microsoft said: "As the threat landscape has evolved our approach has too, and we'll now go beyond notification and guidance to specify if we reasonably believe the attacker is `state-sponsored.'" The Chinese government "is a resolute defender of cyber security and strongly opposes any forms of cyber attacks", Chinese Foreign Ministry spokesman Lu Kang said, adding that it punishes any offenders in accordance with the law. "I must say that if the relevant party has some real and conclusive evidence, then it can carry out mutually beneficial cooperation with China in a constructive way in accordance with the existing channels," Lu said at a daily news briefing. "But if there's the frequent spreading of unfounded rumors, it will, in fact, be of no benefit to solving the problem, enhancing mutual trust and promoting cyber security." The Cyberspace Administration of China did not respond to a request for comment. INTERNAL DEBATE After a vigorous internal debate in 2011 that reached Microsoft's top security official, Scott Charney, and its then-general counsel and now president, Brad Smith, the company decided not to alert the users clearly that anything was amiss, the former employees said. Instead, it simply forced users to pick new passwords without disclosing the reason. The employees said it was likely the hackers by then had footholds in some of the victims' machines and therefore saw those new passwords being entered. One of the reasons Microsoft executives gave internally in 2011 for not issuing explicit warnings was their fear of angering the Chinese government, two people familiar with the discussions said. Microsoft's statement did not address the specific positions advocated by Smith and Charney. A person familiar with the executives' thinking said that fear of Chinese reprisals did play a role given the company's concerns about the potential impact on customers. Microsoft said the company had believed the password resets would be the fastest way to restore security to the accounts. "Our primary concern was ensuring that our customers quickly took practical steps to secure their accounts, including by forcing a password reset," the statement said. It is unclear what happened to the email users and their correspondents as a result of Microsoft's failure to alert them to the suspected government hacking. But some of those affected said they were now deeply worried about the risks, especially for those inside China. "The Internet service providers and the email providers have an ethical and a moral responsibility to let the users know that they are being hacked," said Seyit Tumturk, vice president of the World Uyghur Congress, whose account was among those compromised. "We are talking in people's lives here." HUNDREDS OF LIVES Unrest in Xinjiang, the Chinese region bordering Kazakhstan that is home to many Uighurs, has cost hundreds of lives in recent years. Beijing blames Islamist militants, while human rights groups say harsh controls on the religion and culture of the Uighurs have led to the violence. Until Wednesday, Microsoft had rejected the idea of explicit warnings about state-sponsored hacking, such as those Google Inc began in 2012, the former employees said. In the 2011 case, the company also opted not to send a more generic warning about hacking. Yahoo Inc and Facebook Inc have been issuing such warnings for several years, former employees of those companies told Reuters, including when the principal suspect was a government. Both companies, along with Twitter Inc, announced in recent months that they would follow Google's lead and explicitly notify users about suspected state-sponsored hacking. Google said on average it now issues tens of thousands of warnings about targeting every few months, and that recipients often move to improve their security with two-factor authentication and other steps. Reuters interviewed five of the Hotmail hacking victims that were identified as part of Microsoft's investigation: two Uighur leaders, a senior Tibetan figure and two people in the media dealing with matters of interest to Chinese officials. Most recalled the password resets, but none took the procedure as an indication that anyone had read his or her email, let alone that it may have been accessed by the Chinese government. "I thought it was normal, everybody gets it," said one of the men, a Uighur émigré now living in Europe who asked not to be named because he left family behind in China. Another victim identified by Microsoft's internal team was Tseten Norbu of Nepal, a former president of the Tibetan Youth Congress, one of the more outspoken members of a community that has frequently clashed with Chinese officials. Another Microsoft-identified victim was Tumturk, the World Uyghur Congress vice president who lives in Turkey. Microsoft investigators also saw that emails had been forwarded from the account of Peter Hickman, a former American diplomatic officer who arranged high-profile speeches by international figures at the National Press Club in Washington for many years. Hickman said he used his Hotmail account on Press Club computers to correspond with people, including the staff for the Tibetan government in exile, whose leader Lobsang Sangay spoke at the club in 2011; Tumturk's World Uyghur Congress, whose then-president Rebiya Kadeer spoke in 2009; and the president of Taiwan, who spoke by video link-up in 2007. Hickman said he didn't recall the password reset. He said he never suspected anything was wrong with the account, which he continues to use. (Reporting by Joseph Menn; Additional reporting by Humeyra Pamuk<http://blogs.reuters.com/search/journalist.php?edition=us&n=humeyra.pamuk&> in Istanbul and Sui-Lee Wee<http://blogs.reuters.com/search/journalist.php?edition=us&n=suilee.wee&> in Beijing; Editing by Jonathan Weber and Martin Howell<http://blogs.reuters.com/search/journalist.php?edition=us&n=martin.howell&>)

1 0

INTEREST: AVG AntiVirus plugin bypassed the security of Google's Chrome browser
by Wayne Billing 30 Dec '15

30 Dec '15

…from: http://arstechnica.com/security/2015/12/google-slams-avg-for-exposing-chrom… Google slams AVG for exposing Chrome user data with “security” plugin AVG AntiVirus "force-installed" Chrome plugin that left browsing data vulnerable. by Sean Gallagher<http://arstechnica.com/author/sean-gallagher/> - Dec 30, 2015 10:27am CST [cid:7457AFBE-6663-457E-A10C-A5D7DE836B30] Safer browsing... except someone can watch everything you search? A free plugin installed by AVG AntiVirus bypassed the security of Google's Chrome browser, potentially exposing the browsing histories and other personal data of customers to the Internet. The vulnerability, demonstrated in an exploit by a Google researcher earlier this year, has now been patched after initial stumbling attempts by AVG, according to a discussion of the bug in Google's security research discussion list<https://code.google.com/p/google-security-research/issues/detail?id=675>. AVG's "Web TuneUp" tool<https://chrome.google.com/webstore/detail/avg-web-tuneup/chfdnecihphmhljaae…> is a free download from the Chrome Store intended to provide reputation-based protection against malicious websites, and it was "force-installed" by AVG AntiVirus. The install, an "in-line" installation, happened only with user permission, but was performed in a way that broke the security checks Chrome uses to test for malicious plugins and malware. The plugin works by sending the Web addresses of sites visited by the user to AVG's servers to check them against a database of known malicious sites. But the way the plugin was constructed meant that information could be easily exploited by an attacker through cross-site scripting [XSS], according to a post by Google Security researcher Tavis Ormandy on December 15. "This extension adds numerous JavaScript API's to Chrome, apparently so that they can hijack search settings and the new tab page," Ormandy wrote. "The installation process is quite complicated so that they can bypass the chrome malware checks, which specifically tries to stop abuse of the extension API. Anyway, many of the API's are broken." Ormandy attached a proof-of-concept exploit that stole the authentication cookies from AVG's website, which "also exposes browsing history and other personal data to the internet." Ormandy added, "I wouldn't be surprised if it's possible to turn this into arbitrary code execution." Ormandy then sent what he described as an "angry e-mail" to AVG about the bugs. "Apologies for my harsh tone, but I'm really not thrilled about this trash being installed for Chrome users," he wrote to AVG. "The extension is so badly broken that I'm not sure whether I should be reporting it to you as a vulnerability, or asking the extension abuse team to investigate if it's a PuP [Potentially unwanted Program]. Nevertheless, my concern is that your security software is disabling web security for 9 million Chrome users, apparently so that you can hijack search settings and the new tab page." AVG's developers quickly turned around a fix, but all it did was try to "whitelist" requests only from hosts that contained the string "avg.com<http://avg.com>" in their name. Malicious websites that used avg.com<http://avg.com> in their names (such as the example provided on Ormandy's response, https://www.avg.com.www.attacker.com) could still spoof the AVG servers, and attackers could still use a man-in-the-middle attack to pass malicious JavaScript back to a victim—regardless of whether the connection was secure or not. And, as Ormandy noted, "Any XSS on avg.com<http://avg.com> can be used to compromise Chrome users"—a quick search of AVG's sites found plenty of opportunity for such attacks. As of December 28, AVG had completed a more secure patch, but installations of the plugin were still frozen while Google's Chrome Web Store team investigated possible policy violations by AVG—violations that could get AVG kicked off the Chrome Store completely. Update: A Google spokesperson contacted Ars to clarify the nature of the freeze on AVG's plugin. The block on AVG's usage of inline installation<https://developer.chrome.com/webstore/inline_installation> has no effect on the extension update process, so users with the AVG extension installed should have automatically received the updated version, as with any routine update. An AVG spokesperson sent a statement to Ars, claiming that the Web TuneUp Chrome extension is "offered as an option, not forcibly or automatically installed. Installation only begins once the customer has initiated the process and confirmed acceptance in Chrome—a double opt-in." The spokesperson added, "There is no auto-installation of Google Chrome extensions; the “inline” option allows third parties to offer installation from their own site or product, rather than requiring customers to visit the Chrome Store. We fixed the reported vulnerability just prior to the holidays and do not expect Google to confirm the availability of inline installation until early next year. In the meantime, anyone wishing to install the extension may easily do so from the Chrome Store.”

1 0