- apple-list - University of Manitoba Mailing Lists

INTEREST: AVG AntiVirus plugin bypassed the security of Google's Chrome browser
by Wayne Billing 30 Dec '15

30 Dec '15

…from: http://arstechnica.com/security/2015/12/google-slams-avg-for-exposing-chrom… Google slams AVG for exposing Chrome user data with “security” plugin AVG AntiVirus "force-installed" Chrome plugin that left browsing data vulnerable. by Sean Gallagher<http://arstechnica.com/author/sean-gallagher/> - Dec 30, 2015 10:27am CST [cid:7457AFBE-6663-457E-A10C-A5D7DE836B30] Safer browsing... except someone can watch everything you search? A free plugin installed by AVG AntiVirus bypassed the security of Google's Chrome browser, potentially exposing the browsing histories and other personal data of customers to the Internet. The vulnerability, demonstrated in an exploit by a Google researcher earlier this year, has now been patched after initial stumbling attempts by AVG, according to a discussion of the bug in Google's security research discussion list<https://code.google.com/p/google-security-research/issues/detail?id=675>. AVG's "Web TuneUp" tool<https://chrome.google.com/webstore/detail/avg-web-tuneup/chfdnecihphmhljaae…> is a free download from the Chrome Store intended to provide reputation-based protection against malicious websites, and it was "force-installed" by AVG AntiVirus. The install, an "in-line" installation, happened only with user permission, but was performed in a way that broke the security checks Chrome uses to test for malicious plugins and malware. The plugin works by sending the Web addresses of sites visited by the user to AVG's servers to check them against a database of known malicious sites. But the way the plugin was constructed meant that information could be easily exploited by an attacker through cross-site scripting [XSS], according to a post by Google Security researcher Tavis Ormandy on December 15. "This extension adds numerous JavaScript API's to Chrome, apparently so that they can hijack search settings and the new tab page," Ormandy wrote. "The installation process is quite complicated so that they can bypass the chrome malware checks, which specifically tries to stop abuse of the extension API. Anyway, many of the API's are broken." Ormandy attached a proof-of-concept exploit that stole the authentication cookies from AVG's website, which "also exposes browsing history and other personal data to the internet." Ormandy added, "I wouldn't be surprised if it's possible to turn this into arbitrary code execution." Ormandy then sent what he described as an "angry e-mail" to AVG about the bugs. "Apologies for my harsh tone, but I'm really not thrilled about this trash being installed for Chrome users," he wrote to AVG. "The extension is so badly broken that I'm not sure whether I should be reporting it to you as a vulnerability, or asking the extension abuse team to investigate if it's a PuP [Potentially unwanted Program]. Nevertheless, my concern is that your security software is disabling web security for 9 million Chrome users, apparently so that you can hijack search settings and the new tab page." AVG's developers quickly turned around a fix, but all it did was try to "whitelist" requests only from hosts that contained the string "avg.com<http://avg.com>" in their name. Malicious websites that used avg.com<http://avg.com> in their names (such as the example provided on Ormandy's response, https://www.avg.com.www.attacker.com) could still spoof the AVG servers, and attackers could still use a man-in-the-middle attack to pass malicious JavaScript back to a victim—regardless of whether the connection was secure or not. And, as Ormandy noted, "Any XSS on avg.com<http://avg.com> can be used to compromise Chrome users"—a quick search of AVG's sites found plenty of opportunity for such attacks. As of December 28, AVG had completed a more secure patch, but installations of the plugin were still frozen while Google's Chrome Web Store team investigated possible policy violations by AVG—violations that could get AVG kicked off the Chrome Store completely. Update: A Google spokesperson contacted Ars to clarify the nature of the freeze on AVG's plugin. The block on AVG's usage of inline installation<https://developer.chrome.com/webstore/inline_installation> has no effect on the extension update process, so users with the AVG extension installed should have automatically received the updated version, as with any routine update. An AVG spokesperson sent a statement to Ars, claiming that the Web TuneUp Chrome extension is "offered as an option, not forcibly or automatically installed. Installation only begins once the customer has initiated the process and confirmed acceptance in Chrome—a double opt-in." The spokesperson added, "There is no auto-installation of Google Chrome extensions; the “inline” option allows third parties to offer installation from their own site or product, rather than requiring customers to visit the Chrome Store. We fixed the reported vulnerability just prior to the holidays and do not expect Google to confirm the availability of inline installation until early next year. In the meantime, anyone wishing to install the extension may easily do so from the Chrome Store.”

1 0

INTEREST: Apple Pushes Against British Talk of Breaking Encryption
by Wayne Billing 22 Dec '15

22 Dec '15

…from: http://www.nytimes.com/2015/12/22/world/europe/apple-pushes-against-british… Apple Pushes Against British Talk of Softening Encryption By DAVID E. SANGER<http://topics.nytimes.com/top/reference/timestopics/people/s/david_e_sanger…>DEC. 21, 2015 WASHINGTON — With governments threatening crackdowns on encrypted communications after the jihadist-inspired attacks in San Bernardino, Calif., and Paris, Apple<http://topics.nytimes.com/top/news/business/companies/apple_computer_inc/in…> on Monday pushed back hard, arguing that lawmakers who talk about gaining court-ordered access to iPhone communications do not understand the technology. “The best minds in the world cannot rewrite the laws of mathematics,” the company told the British Parliament, submitting formal comments on a proposed law<https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/4…> that would require the company to supply a way to break into the iMessage and FaceTime conversations of iPhone users. “We believe it would be wrong to weaken security for hundreds of millions of law-abiding customers so that it will also be weaker for the very few who pose a threat,” Apple wrote. Apple’s statement came as questions about encryption — considered an arcane component of cybersecurity just a few months ago — has become a central issue in the American presidential campaign. Twice<http://www.nytimes.com/2015/12/07/us/politics/hillary-clinton-islamic-state…> in<http://www.nytimes.com/2015/12/16/us/politics/hillary-clinton-calls-on-tech…> the past three weeks, Hillary Clinton<http://www.nytimes.com/interactive/2016/us/elections/hillary-clinton-on-the…>, the leading contender for the Democratic nomination, according to polls, has urged Silicon Valley companies to work with Washington to find a way out of their standoff over encrypted communications. Republican candidates have almost all called for giving intelligence and law enforcement agencies the kind of access to text messages and data stored on cellphones that they have long enjoyed with telecommunications providers, like AT&T and Verizon. Congress is calling for hearings, and there is talk of legislation, though it seems unlikely to include the kind of demands for access that Britain<http://topics.nytimes.com/top/news/international/countriesandterritories/un…>’s prime minister, David Cameron, advocates. The arguments made by Apple are not new, but the political context is. In the aftermath of the two most recent terrorist attacks, the political pendulum has swung away from protecting privacy — the direction Europe was moving after Edward J. Snowden, the former intelligence contractor, leaked classified documents on government surveillance — and more toward law enforcement. The technology companies argue that although the political winds may be changing, the technological challenge has not: To create an opening for government investigators is to also create a vulnerability that Chinese, Iranian, Russian or North Korean hackers could exploit. Mrs. Clinton rejected that argument recently, arguing that if the companies wanted to put their best minds to the problem, they would solve it. But in the British filing, and in an interview<http://www.cbsnews.com/news/60-minutes-apple-tim-cook-charlie-rose/> on “60 Minutes” on Sunday, Apple’s chief executive, Tim Cook, argued that politicians calling for such access do not understand the damage they would cause. So far, Mr. Cook still has a partial ally in President Obama. The White House determined in October that, despite a recommendation from the F.B.I. to put forward legislation requiring access to encrypted communications, it would not seek legal changes. That rankled the F.B.I. director, James B. Comey, who has long warned about the “going dark” problem, and offered up evidence<http://www.nytimes.com/2015/12/10/us/politics/fbi-chief-says-texas-gunman-u…> a week ago that an attack in Texas this year had been plotted over encrypted text messages, which he said investigators still could not crack. Apple pushed back on Mr. Comey’s arguments in its submission to the British government. “Some would portray this as an all-or-nothing proposition for law enforcement,” it wrote. “Nothing could be further from the truth. Law enforcement today has access to more data — data which they can use to prevent terrorist attacks, solve crimes and help bring perpetrators to justice — than ever before in the history of our world.” That data, many experts say, includes phone “metadata” about who is calling whom, GPS coordinates for individuals, and access to unencrypted data stored on so-called cloud services. But the arguments in Britain and the United States have focused largely on systems designed by Apple and its competitors, including Google and Microsoft, that automatically encrypt data exchanges, and put the keys to those communications into the hands of the users, not the companies. Apple contended that if Britain went ahead with its legal changes, the company, and its competitors, may find themselves violating American laws to comply with British law — or vice versa. “This would immobilize substantial portions of the tech sector and spark serious international conflicts,” it argued. Correction: December 22, 2015 An earlier version of this article used an outdated name for iPhone messaging software. It is iMessage, not iChat.

1 0

FYI: Mozilla would like to move Thunderbird to someone else
by Wayne Billing 02 Dec '15

02 Dec '15

…from: http://arstechnica.com/information-technology/2015/12/thunderbird-a-tax-on-… https://groups.google.com/forum/#!topic/mozilla.governance/kAyVlhfEcXg Thunderbird “a tax” on Firefox development, and Mozilla wants to drop it Thunderbird is already low on its priority list; Mozilla wants to spin it off. by Andrew Cunningham<http://arstechnica.com/author/andrew_cunningham/> - Dec 1, 2015 9:41am CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Finform…> * Tweet<https://twitter.com/share?text=Thunderbird%20%E2%80%9Ca%20tax%E2%80%9D%20on…> 146<http://arstechnica.com/information-technology/2015/12/thunderbird-a-tax-on-…> [cid:69FC9635-901D-4FD7-94DA-0D3A09EF4DC1] Mozilla would like to drop Thunderbird from its list of projects. Andrew Cunningham FURTHER READING MOZILLA TO PUSH THUNDERBIRD OUT OF THE NEST<http://arstechnica.com/uncategorized/2007/07/mozilla-to-push-thunderbird-ou…> Mozilla CEO Mitchell Baker wants to spin off an independent organization for … You might know Mozilla primarily for its Firefox browser, but for many years the company has also developed an e-mail client called Thunderbird. The two projects use the same rendering engine and other underlying technology, but Mozilla Executive Chairwoman Mitchell Baker has announced<https://groups.google.com/forum/#!topic/mozilla.governance/kAyVlhfEcXg> that Mozilla would like to stop supporting Thunderbird, calling its continuing maintenance "a tax" on the more important work of developing Firefox. "Many inside of Mozilla, including an overwhelming majority of our leadership, feel the need to be laser-focused on activities like Firefox that can have an industry-wide impact," Baker writes. "With all due respect to Thunderbird and the Thunderbird community, we have been clear for years that we do not view Thunderbird as having this sort of potential." Mozilla doesn't plan to drop Thunderbird immediately, however—the current maintenance schedule will continue, and Thunderbird users can continue to use the product. But the end goal for Mozilla, according to Baker, is to find "the right kind of legal and financial home" for the Thunderbird project, and "[separate] itself from reliance on Mozilla development systems and in some cases, Mozilla technology." In other words, the company would like to give Thunderbird to people who will take care of it, freeing the Firefox team from having to worry about it. Mozilla's recent support for Thunderbird has been limited—it still receives security updates and basic changes imported from Firefox, but adding major features hasn't been a priority for Mozilla for several years now<http://techcrunch.com/2012/07/06/so-thats-it-for-thunderbird/> despite some efforts from the development community<https://blog.mozilla.org/thunderbird/2014/11/thunderbird-reorganizes-at-201…>. In fact, Thunderbird is currently only updated on Mozilla's "extended support release<http://arstechnica.com/business/2012/01/firefox-extended-support-will-mitig…>" (ESR) schedule, originally implemented to help IT managers deal with Firefox and Thunderbird's then-new rapid-release cycle.

1 0

FYI: If, after charging, your iPad Pro stops responding....
by Wayne Billing 19 Nov '15

19 Nov '15

…from: https://support.apple.com/en-us/HT6671 If your iPad Pro stops responding and the screen is black Learn what to do if your iPad Pro doesn't respond when you press buttons or tap on the screen, and the screen is black. To get back to using your iPad Pro, force restart<https://support.apple.com/kb/HT201559> it by pressing and holding both the Sleep/Wake and Home buttons for at least ten seconds, until you see the Apple logo. Apple is aware of this issue and is investigating. This document will be updated as more information becomes available. Last Modified: Nov 19, 2015

1 0

FYI: El Capitan v10.11.1 Update is recommended for all OS X El Capitan users
by Wayne Billing 26 Oct '15

26 Oct '15

…from: https://support.apple.com/en-us/HT205360 About the OS X El Capitan v10.11.1 Update The OS X El Capitan v10.11.1 Update is recommended for all OS X El Capitan users. The OS X El Capitan 10.11.1 update improves the stability, compatibility, and security of your Mac, and is recommended for all users. This update: * Improves installer reliability when upgrading to OS X El Capitan. * Improves compatibility with Microsoft Office 2016. * Fixes an issue where outgoing server information may be missing from Mail. * Resolves an issue that prevented display of messages and mailboxes in Mail. * Resolves an issue that prevents certain Audio Unit plug-ins from functioning properly. * Improves VoiceOver reliability. * Adds over 150 new emoji characters with full Unicode 7.0 and 8.0 support. * Resolves an issue that caused JPEG images to appear as a gray or green box in Preview. For detailed information about the security content of this update, see Apple Security Updates<https://support.apple.com/kb/HT201222>. How to update your Mac Before updating, it's a good idea to back up up your Mac<https://www.apple.com/support/backup/>. Then use the Mac App Store<https://support.apple.com/HT201541> to install the update. Some updates become available only after installing other updates. Install all available updates, and allow installation to complete without interruption. You can also get this update from the Apple Support Downloads<http://support.apple.com/downloads/macos> site. You might have unexpected results if third-party OS X modifications have been installed, or you modified OS X in other ways. Last Modified: Oct 21, 2015 Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support Computer and Network Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne.Billing(a)umanitoba.ca<mailto:Wayne.Billing@umanitoba.ca>

1 0

FYI: Microsoft OFFICE and Outlook problems with El Capitan OS X release
by Wayne Billing 14 Oct '15

14 Oct '15

…from: http://www.macrumors.com/2015/10/05/microsoft-office-2016-el-capitan-bugs/ http://answers.microsoft.com/en-us/mac/forum/macoffice2016-macoutlook/outlo… Microsoft Working on Fix for Office Bugs in OS X El Capitan Monday October 5, 2015 10:06 am PDT by Juli Clover Since OS X El Capitan was released to the public<http://www.macrumors.com/2015/09/30/os-x-10-11-el-capitan-released/> last week, Microsoft Office users have noticed some serious bugs when attempting to use the software. Word, Excel, Outlook, and PowerPoint are crashing for many Microsoft users who have installed Office 2016, and Office 2011 users are also noticing problems with Outlook. Microsoft is aware of the problems with its software and has been responding to customer complaints. In a thread on the Microsoft forums<http://answers.microsoft.com/en-us/mac/forum/macoffice2016-macoutlook/outlo…>, Microsoft Program Manager Faisal Jeelani said the company is working with Apple to resolve the issues, but said there is no timeline for a fix. Microsoft also gave Computerworld<http://www.computerworld.com/article/2988995/mac-os-x/microsoft-acknowledge…> a similar statement: "We know that some users may be experiencing issues with Office 2016 for Mac running on El Capitan," the statement read. "We are actively investigating the matter with Apple. Until there is a fix, we recommend people install the latest updates to Office 2016 for Mac using Microsoft AutoUpdate." Microsoft Program Manager Faisal Jeelani: <http://answers.microsoft.com/en-us/profile/41b14d01-7c89-4fc5-8523-b55a7903…> FJ Faisal Jeelani<http://answers.microsoft.com/en-us/profile/41b14d01-7c89-4fc5-8523-b55a7903…> replied on October 1, 2015 * Microsoft Hello everyone, We are aware of the issue with Outlook 2011 on El Capitan and of Office 2016 on El Capitan. We are working on a fix for 2011 and for 2016 we are working closely with Apple to resolve this issue as soon as possible. Unfortunately we do not have any timelines for either fix, please stay tuned and thank you for your understanding. Faisal Jeelani | Program Management | Outlook for Mac

1 2

INTEREST: Firefox PLUGINS: support for most being removed by end of 2016
by Wayne Billing 10 Oct '15

10 Oct '15

…from: https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/ http://www.engadget.com/2015/10/09/firefox-stops-plugin-support-by-end-of-2… NPAPI Plugins in Firefox Benjamin Smedberg [cid:02D89318-17F6-4D45-8A15-4E6068B848D0] <https://blog.mozilla.org/futurereleases/author/bsmedbergmozillacom/> OCT <https://blog.mozilla.org/futurereleases/2015/10/> 8 2015 <https://blog.mozilla.org/futurereleases/2015/> Mozilla has been steadily improving the Web platform to support features that were once only available via NPAPI plugins. […] Mozilla intends to remove support for most NPAPI plugins in Firefox by the end of 2016. Firefox began this process several years ago<https://blog.mozilla.org/futurereleases/2013/09/24/plugin-activation-in-fir…> with manual plugin activation, allowing users to activate plugins only when they were necessary. This decision mirrors actions by other modern browsers, such as Google Chrome and Microsoft Edge, which have already removed support for legacy plugins. Moreover, since new Firefox platforms do not have to support an existing ecosystem of users and plugins, new platforms such as 64-bit Firefox for Windows will launch without plugin support. […] Websites and publishers which currently use plugins such as Silverlight or Java should accelerate their transition to Web technologies. The Web platform is powerful and can usually do everything that a plugin can do. In the rare cases where a site needs to extend Web technologies, the recommended solution is to develop the additional features as a Firefox add-on. Site maintainers should prepare for plugins to stop working in all versions of Firefox by the end of 2016. Mozilla continues to work with the Oracle Java Platform Group to ensure a smooth transition for those web sites that use Java. More information from Oracle about Java transition plans can be found in a post<https://blogs.oracle.com/java-platform-group/entry/npapi_plugin_perspective…> from the Oracle team. Oracle recommends<http://docs.oracle.com/javase/8/docs/technotes/guides/deploy/applet_dev_gui…> that sites currently using Java applets consider switching to plugin-free solutions such as Java Web Start<https://blogs.oracle.com/java-platform-group/entry/java_web_start_in_or>. […]

1 0

FYI: Project Apollo Archive: NASA publishes thousands of Apollo photographs
by Wayne Billing 04 Oct '15

04 Oct '15

…from: http://www.planetary.org/blogs/jason-davis/2015/20151002-apollo-astronaut-p… Thousands of Photos by Apollo Astronauts now on Flickr Posted By Jason Davis 2015/10/02 15:49 UTC A cache of more than 8,400 high-resolution photographs taken by Apollo astronauts during trips to the moon is now available for viewing and download. Kipp Teague, who created the massive image repository Project Apollo Archive in 1999, recently uploaded new, unprocessed versions of original NASA photo scans to the image sharing service Flickr. Teague says every photo taken on the lunar surface by astronauts with their chest-mounted Hasselblad cameras is included in the collection, along with numerous other Hasselblad photos shot from Earth and lunar orbit, as well as during the journey between the two. [unknown.jpg] https://www.flickr.com/photos/projectapolloarchive/albums [unknown.jpg]

1 0

INTEREST: Chrome browser stops FLASH ads.... ish
by Wayne Billing 29 Aug '15

29 Aug '15

Google, maker of the Chrome browser, has already stated it would be pausing many FLASH animations. In their latest posting, they emphasize this will begin September 1st, 2015 and they suggest that the makers of the ads change from FLASH to HTML 5 to ensure the ads keep displaying: …from: https://plus.google.com/+GoogleAds/posts/2PmwKinJ7nj [cid:B3A47200-282F-40B7-BF4F-315E1E27E9A7]<https://plus.google.com/+GoogleAds/posts/114353304932511604018> AdWords<https://plus.google.com/+GoogleAds/posts/114353304932511604018> Shared publicly - 27 Aug 2015<https://plus.google.com/+GoogleAds/posts/+GoogleAds/posts/2PmwKinJ7nj> In June, we announced (https://goo.gl/TF7dmD) that Chrome will begin pausing many Flash ads by default to improve performance for users. This change is scheduled to start rolling out on September 1, 2015. Most Flash ads uploaded to AdWords are automatically converted to HTML5. To ensure your ads continue to show on the Google Display Network, please follow these steps before September 1: 1) Identify any Flash ads in your account that aren’t eligible for automatic conversion: https://goo.gl/I4186A 2) Convert these ads to HTML5: https://goo.gl/ZBq5DR [cid:C7980F2F-5765-43F2-8FFA-B4BD75F06620]<https://goo.gl/TF7dmD> Bringing Better Performance to Rich Media on Chrome Video and interactive…<https://goo.gl/TF7dmD> = - = - = - = - = - = NOTE: this is in addition to the Chrome embargo on NPAPI plugins such as VLC: NPAPI plugins don't work on Chrome version 42 and higher https://support.google.com/chrome/answer/6213033?hl=en

1 0

FYI: iSight Camera Replacement Program for iPhone 6 Plus
by Wayne Billing 21 Aug '15

21 Aug '15

The following item has just been released but other recall/repair of Apple items can be found at: http://www.apple.com/ca/support/exchange_repair/ The first thing to do is check your serial number on the appropriate Apple page (linked to from the Exchange/Repair page). Each page has instructions on how to find the serial number of your device. …from: https://www.apple.com/ca/support/iphone6plus-isightcamera/ iSight Camera Replacement Program for iPhone 6 Plus [iPhone 6 Plus] Please select a Country Albania Australia Armenia Bahrain België Belgique Bolivia Brasil България Cambodia Canada (English) Canada (Français) Česká republika Chile 中国 Colombia Danmark Deutschland Egypt España Eesti Ελλάδα France French Polynesia Hong Kong (English) 香港 Hrvatska Iceland India Indonesia Ireland Israel Italia 日本 Kazakhstan 대한민국 Latvija Lietuva Luxembourg (English) Luxembourg (Français) Luxemburg (Deutsch) Macau (English) 澳門 Macedonia Magyarország Malaysia Malta México Moldova Montenegro Nederland Nepal New Zealand Norge Österreich Pakistan Philippines Россия Polska Portugal Réunion România Saudi Arabia Schweiz Suisse Serbia Singapore Slovensko Slovenija South Africa Sri Lanka Suomi Sverige 台灣 ไทย Türkiye United Arab Emirates United Kingdom United States Vietnam Other countries Apple has determined that, in a small percentage of iPhone 6 Plus devices, the iSight camera has a component that may fail causing your photos to look blurry. The affected units fall into a limited serial number range and were sold primarily between September 2014 and January 2015. If your iPhone 6 Plus is producing blurry photos and falls into the eligible serial number range, Apple will replace your device's iSight camera, free of charge. The iSight camera is located on the back of your iPhone 6 Plus: [iPhone 6 Plus iSight camera] …follow the above link to check your serial number, for more information, and for instructions on how to proceed if your serial number qualifies for the replacement….

1 0