- apple-list - University of Manitoba Mailing Lists

FYI: CERN OpenData: 300 TB
by Wayne Billing 23 Apr '16

23 Apr '16

…from: http://opendata.cern.ch/about http://www.engadget.com/2016/04/23/cern-300tb-large-hadron-collider-data/ http://techcrunch.com/2016/04/22/cern-releases-300tb-of-large-hadron-collid… CERN Open Data Portal The CERN Open Data portal is the access point to a growing range of data produced through the research performed at CERN. It disseminates the preserved output from various research activities, including accompanying software and documentation which is needed to understand and analyse the data being shared. The portal adheres to established global standards in data preservation and Open Science: the products are shared under open licenses; they are issued with a digital object identifier (DOI) to make them citable objects in the scientific discourse (see details below on how to do this). LHC Data Data produced by the LHC experiments are usually categorised in four different levels (DPHEP Study Group (2009)<http://arxiv.org/abs/0912.0255>). The Open Data portal focuses on the release of data from level 2 and 3. * Level 1 data comprises data that is directly related to publications which provide documentation for the published results * Level 2 data includes simplified data formats for analysis in outreach and training exercises * Level 3 data comprises reconstructed data and simulations as well as the analysis level software to allow a full scientific analysis * Level 4 covers basic raw level data (if not yet covered as level 3 data) and their associated software and allows access to the full potential of the experimental data CERN releases 300TB of Large Hadron Collider data into open access [cid:00733CC4-8A47-4E42-BB67-66F6A2A47C38] CERN just dropped 300 terabytes of collider data on the world. Kati Lassila-Perini, a physicist who works on the Compact Muon Solenoid<http://home.cern/about/experiments/cms> (!) detector, gave a refreshingly straightforward explanation for this huge release. “Once we’ve exhausted our exploration of the data, we see no reason not to make them available publicly,” she said in a news release accompanying the data<http://cms.web.cern.ch/news/cms-releases-new-batch-research-data-lhc>. “The benefits are numerous, from inspiring high school students to the training of the particle physicists of tomorrow. And personally, as CMS’s data preservation coordinator, this is a crucial part of ensuring the long-term availability of our research data.” Amazing that this perspective is not more widely held — though I suspect it is, by the scientists at least, if not the publishers and department heads who must think of the bottom line. The data itself is from 2011, much of it from protons colliding at 7 TeV (teraelectronvolts, you know) and producing those wonderful fountains of rare particles we all love to fail to understand. All told, it’s about half the total data collected by the CMS detector, and makes up about 2.5 inverse femtobarns. But who’s counting? [cmsgiffy]<https://tctechcrunch2011.files.wordpress.com/2016/04/cmsgiffy.gif> There’s both the raw data from the detectors (so you can verify the results) and also “derived” datasets that are more easy to work with — and don’t worry, CERN is providing the tools to do so<http://opendata.cern.ch/search?p=Run2011A%20collection%3ACMS-Tools>, as well. There’s a whole CERN Linux environment ready for booting up in a virtual machine, and a bunch of scripts and apps (some are on GitHub<https://github.com/cms-outreach/ispy-webgl>, too). Just messing around in the same computing environment used by researchers plumbing the depths of the universe would be an interesting way to spend a few labs in a college physics course. There are even “masterclasses,” data sets and tools specially curated for high school kids. This is only the latest of several data dumps, but it’s also by far the largest. A more detailed explanation of the types of data and how they can be accessed is right here<http://opendata.cern.ch/about/CMS>.

1 0

FYI: QuickTime for Windows; iTunes unaffected
by Wayne Billing 14 Apr '16

14 Apr '16

…from: https://www.us-cert.gov/ncas/alerts/TA16-105A http://www.macrumors.com/2016/04/14/apple-ending-quicktime-windows-support/ http://9to5mac.com/2016/04/14/quicktime-for-windows-update/ …others For Windows users who want to uninstall QuickTime, Apple has published a support document<https://support.apple.com/en-us/HT205771> that outlines all of the necessary steps. QuickTime for Mac is not affected. The retirement of QuickTime for Windows has been in the planning stages for at least a few months. Apple has not yet supported QuickTime for Windows 8 or 10, although some users found ways to work around the restriction. The January update removed the browser plugin for QuickTime, making it impossible for video on websites to seamlessly play in a user's browser. As a result, there's little chance QuickTime vulnerabilities could be harnessed into a drive-by download exploit. Instead, exploits would have to rely on social engineering that convinces a user to download a video and open it in QuickTime. For those wondering, iTunes and QuickTime were separated out a couple of years ago and iTunes no longer requires QuickTime to run properly. Alert (TA16-105A) Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced Original release date: April 14, 2016 Print Document Tweet<https://twitter.com/share?url=https%3A%2F%2Fwww.us-cert.gov%2Fncas%2Falerts…> Like Me<https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.us-cert.gov%2Fncas%…> Share<http://www.addthis.com/bookmark.php?url=https%3A%2F%2Fwww.us-cert.gov%2Fnca…> Systems Affected Microsoft Windows with Apple QuickTime installed Overview According to Trend Micro, Apple will no longer be providing security updates for QuickTime for Windows, leaving this software vulnerable to exploitation. [1](link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> Description All software products have a lifecycle. Apple will no longer be providing security updates for QuickTime for Windows. [1](link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> The Zero Day Initiative has issued advisories for two vulnerabilities found in QuickTime for Windows. [2](link is external)<http://zerodayinitiative.com/advisories/ZDI-16-241/> [3](link is external)<http://www.zerodayinitiative.com/advisories/ZDI-16-242/> Impact Computer systems running unsupported software are exposed to elevated cybersecurity dangers, such as increased risks of malicious attacks or electronic data loss. Exploitation of QuickTime for Windows vulnerabilities could allow remote attackers to take control of affected systems. Solution Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows. Users can find instructions for uninstalling QuickTime for Windows on the Apple Uninstall QuickTime(link is external)<https://support.apple.com/en-us/HT205771> page. [4] References * [1] Trend Micro - Urgent Call to Action: Uninstall QuickTime for Windows Today(link is external)<http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-t…> * [2] Zero Day Initiative Advisory ZDI 16-241: (0Day) Apple QuickTime moov Atom Heap Corruption Remote Code Execution Vulnerabilit(link is external)<http://zerodayinitiative.com/advisories/ZDI-16-241/> * [3] Zero Day Initiative Advisory ZDI 16-242: (0Day) Apple QuickTime Atom Processing Heap Corruption Remote Code Execution Vulner(link is external)<http://www.zerodayinitiative.com/advisories/ZDI-16-242/> * [4] Apple - Uninstall QuickTime 7 for Windows(link is external)<https://support.apple.com/en-us/HT205771> Revisions * April 14, 2016: Initial Release

1 0

FYI: Critical Security updates available for Adobe Flash Player
by Wayne Billing 08 Apr '16

08 Apr '16

tl;dr: New version of FLASH to prevent an attacker to take control of the affected system. …from: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html Adobe Security Bulletin Security updates available for Adobe Flash Player Release date: April 7, 2016 Vulnerability identifier: APSB16-10 Priority: See table below<https://helpx.adobe.com/security/products/flash-player/apsb16-10.html#table> CVE number: CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033 Platform: Windows, Macintosh, Linux and ChromeOS Summary Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier. Please refer to APSA16-01<https://helpx.adobe.com/security/products/flash-player/apsa16-01.html>for details. Affected Versions Product Affected Versions Platform Adobe Flash Player Desktop Runtime 21.0.0.197 and earlier Windows and Macintosh Adobe Flash Player Extended Support Release 18.0.0.333 and earlier Windows and Macintosh Adobe Flash Player for Google Chrome 21.0.0.197 and earlier Windows, Macintosh, Linux and ChromeOS Adobe Flash Player for Microsoft Edge and Internet Explorer 11 21.0.0.197 and earlier Windows 10 Adobe Flash Player for Internet Explorer 11 21.0.0.197 and earlier Windows 8.1 Adobe Flash Player for Linux 11.2.202.577 and earlier Linux * To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page<http://www.adobe.com/products/flash/about/>, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system. Solution Adobe categorizes these updates with the following priority ratings<https://helpx.adobe.com/content/help/en/security/severity-ratings.html> and recommends users update their installation to the newest version: Product Updated Versions Platform Priority rating Availability Adobe Flash Player Desktop Runtime 21.0.0.213 Windows and Macintosh 1 Flash Player Download Center<http://www.adobe.com/go/getflash> Flash Player Distribution<http://www.adobe.com/products/players/flash-player-distribution.html> Adobe Flash Player Extended Support Release 18.0.0.343 Windows and Macintosh 1 Extended Support<http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html> Adobe Flash Player for Google Chrome 21.0.0.213 Windows, Macintosh, Linux and ChromeOS 1 Google Chrome Releases<http://googlechromereleases.blogspot.com/> Adobe Flash Player for Microsoft Edge and Internet Explorer 11 21.0.0.213 Windows 10 1 Microsoft Security Advisory Adobe Flash Player for Internet Explorer 11 21.0.0.213 Windows 8.1 1 Microsoft Security Advisory Adobe Flash Player for Linux 11.2.202.616 Linux 3 Flash Player Download Center<http://www.adobe.com/go/getflash> * Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 21.0.0.213 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center<http://www.adobe.com/go/getflash>. * Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.343 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html. * Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.616 by visiting the Adobe Flash Player Download Center<http://www.adobe.com/go/getflash>. * Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 21.0.0.213 for Windows, Macintosh, Linux and Chrome OS. * Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213. * Adobe Flash Player installed with Internet Explorer for Windows 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213. * Please visit the Flash Player Help<https://helpx.adobe.com/flash-player.html> page for assistance in installing Flash Player. [1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted. Vulnerability Details * These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations (CVE-2016-1006). * These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1015, CVE-2016-1019). * These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, CVE-2016-1031). * These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, CVE-2016-1033). * These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2016-1018). * These updates resolve a security bypass vulnerability (CVE-2016-1030). * These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-1014). Acknowledgments * Yuki Chen of Qihoo 360 Vulcan Team working with Trend Micro's ZDI (CVE-2016-1015, CVE-2016-1016, CVE-2016-1017) * Tencent PC Manager<http://www.pcmgr-global.com/> working with Trend Micro's ZDI (CVE-2016-1018) * Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero (CVE-2016-1011, CVE-2016-1013) * willj of Tencent PC Manager<http://www.pcmgr-global.com/> (CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033) * Stefan Kanthak (CVE-2016-1014) * bo13oy of CloverSec Labs (CVE-2016-1012) * Kang Yang of Qihoo 360 (CVE-2016-1006) * Nicolas Joly of Microsoft's security team (CVE-2016-1030) * Kafeine (EmergingThreats/Proofpoint) and Genwei Jiang (FireEye, Inc.), as well as Clement Lecigne of Google (CVE-2016-1019)

1 0

FYI: Apple Temporarily Pulls iOS 9.3 Update for Older iOS Devices
by Wayne Billing 26 Mar '16

26 Mar '16

…from: http://www.macrumors.com/2016/03/24/apple-pulls-ios-9-3-older-devices/ [Update: Apple has released a new build of iOS 9.3 for the iPad 2 and may be planning to roll out updates for additional devices. Apple has not yet resumed signing iOS 9.3 for affected devices. ] Apple Temporarily Pulls iOS 9.3 Update for Older iOS Devices Thursday March 24, 2016 5:01 pm PDT by Juli Clover<http://www.macrumors.com/author/juli-clover/> Apple has temporarily stopped offering the iOS 9.3<http://www.macrumors.com/roundup/ios-9> update for older devices like the iPad Air and earlier and the iPhone 5s<http://www.macrumors.com/roundup/iphone-5s> and earlier due to installation issues some users have experienced. On older devices, iOS 9.3 requires users to input the Apple ID and password originally used to set up the device, which can lead to the device becoming stuck at the Activation Lock screen if the original account information can't be recalled. In a statement given to iMore<http://www.imore.com/apple-working-ios-93-fix-ipad-2>, Apple says it is working on a fix and plans to issue a new version of iOS 9.3 in the next few days. Customers with an affected device who attempt to download iOS 9.3 during this time will not be able to install the update as Apple has stopped signing it. [activateiphoneerror] Updating some iOS devices (iPhone 5s and earlier and iPad Air and earlier) to iOS 9.3 can require entering the Apple ID and password used to set up the device in order to complete the software update," an Apple spokesperson told iMore. "In some cases, if customers do not recall their password, their device will remain in an inactivated state until they can recover or reset their password. For these older devices, we have temporarily pulled back the update and will release an updated version of iOS 9.3 in the next few days that does not require this step." For customers who have already installed iOS 9.3 and have gotten stuck at the Activation Lock, Apple has published a support document<https://support.apple.com/en-us/HT206203> with steps on how to solve the issue. Apple recommends removing Activation Lock via iCloud<http://www.macrumors.com/roundup/icloud> or attempting to enter an Apple ID or password through iTunes.

1 0

FYI: Bank of Canada warns of email scam using its name and logo
by Wayne Billing 20 Mar '16

20 Mar '16

I had expected to see this on some news casts but it doesn’t seem to have made it: …from: http://www.cbc.ca/news/business/email-scam-bank-canada-1.3470840?cmp=rss Bank of Canada warns of email scam using its name and logo The Bank of Canada is warning Canadians about an email and social media scam using its name and logos. (Reuters) The Bank of Canada is warning Canadians not to fall for an email scam that tries to extort money or personal information using its name. In a press release Tuesday, it says the scams on email and social media are using its name, logos and letterhead without authorization. It is warning consumers that it does not: * Accept deposits from individuals. * Collect personal or financial information via email. * Request personal or financial information through social media. People should not follow any links included in social media or email messages purported to be from the Bank of Canada, the bank said. Anyone who receives such a message should delete it and contact local authorities. The Bank of Canada is the country's central bank, meaning it sets monetary policy, issues currency and works to keep the financial system stable. The only deposits it handles are from government and financial institutions. The real Bank of Canada can be contacted at www.bankofcanada.ca<http://www.bankofcanada.ca> or at its Public Information Office at 1-800-303-1282, Last year, some Canadians were taken in by fraudsters who pretended to be from the Canada Revenue Agenc<http://www.cbc.ca/news/canada/windsor/canada-revenue-agency-scam-targeting-…>y and demanded "back taxes." Cyber-criminals are increasingly sophisticated in trying to dupe users to extort money or give up personal information that can help them break into bank accounts or credit cards.

1 0

INTEREST: Older Kindle? You Should Update It Immediately
by Wayne Billing 20 Mar '16

20 Mar '16

…from: http://gizmodo.com/if-you-want-to-keep-using-your-kindle-you-need-to-upda-1… If You Want To Keep Using Your Kindle, You Should Update It Immediately If you own one of Amazon’s pre-2012 Kindles, listen up: there’s a critical update that you need to install if you want to keep using it, and you must do so before March 22nd. According to an update on the company’s help community<https://www.amazon.com/gp/help/customer/forums/kindleqna/ref=cs_hc_k_anmt?i…>, a new update is required for anyone using a pre-2012 device that has not connected it to the internet since October 5th, 2015. Customers using an outdated software version on Kindle e-readers, or that have not connected wirelessly since October 5, 2015, require an important software update by March 22, 2016, in order to continue to download Kindle books and use Kindle services. Failure to do so, the company warns, and you won’t be able to connect to Amazon’s Cloud, access the Kindle Store, or use any other services through the device. After March 22nd, you will also have to update the device manually, by downloading the patch and updating it through your computer. Fortunately, Amazon has provided a chart<http://www.amazon.com/gp/help/customer/display.html?nodeId=201994710&tag=gi…> that outlines which Kindles need which updates, and how to go about doing it: Device and Year Software Version Your Device Needs Update via Wireless (2G/3G) or Wi-Fi Kindle 1st Generation (2007) 1.2.1 Use Wireless Kindle 2nd Generation (2009) * 2.5.8 Use Wireless Kindle DX 2nd Generation (2009) * 2.5.8 Use Wireless Kindle Keyboard 3rd Generation (2010) ** 3.4.2 or higher Use Wi-Fi Kindle 4th Generation (2011) 4.1.3 or higher Use Wi-Fi Kindle 5th Generation (2012) 4.1.3 or higher Use Wi-Fi Kindle Touch 4th Generation (2011) ** 5.3.7.3 or higher Use Wi-Fi Kindle Paperwhite 5th Generation (2012) ** 5.6.1.1 or higher Use Wi-Fi Kindle Paperwhite 6th Generation (2013) No Update Needed No Update Needed Kindle 7th Generation (2014) No Update Needed No Update Needed Kindle Voyage 7th Generation (2014) No Update Needed No Update Needed Kindle Paperwhite 7th Generation (2015) No Update Needed No Update Needed The update provides a really good reminder to keep your device up to date, but also the fact that even if your books and purchases are on the cloud, you won’t always be able to reach them. [Amazon<https://www.amazon.com/gp/help/customer/forums/kindleqna/ref=cs_hc_k_anmt?i…>, Engadget<http://www.engadget.com/2016/03/20/amazon-kindle-crucial-update/>]

1 0

INTEREST: accused confirms he did not use security flaws in Gmail or iCloud
by Wayne Billing 16 Mar '16

16 Mar '16

…from: http://www.engadget.com/2016/03/16/celeb-photo-hacker-charged/ Man pleads guilty to hacking celebrity accounts for photos He admitted to phishing users for access to Gmail and iCloud accounts. Mariella Moon , @mariella_moon The celebrities affected by the massive nude photo leak in 2014 got some answers today. A 36-year-old man from Pennsylvania named Ryan Collins has been charged with computer hacking felony for infiltrating over 50 iCloud and 72 Gmail accounts. He has also agreed to plead guilty to one count of unauthorized access to a protected computer, according to the US Attorney's Office of the Central District of California. In his plea deal, Collins admitted to executing a phishing scheme to obtain celebs' usernames and passwords from November 2012 to September 2014. Once he got access to their accounts, he searched for and stole explicit images. In some cases, he even downloaded people's entire iCloud backups. If you'll recall, Apple denied that the hacker exploited an iCloud flaw to access its users' accounts back then. Based on Collins' statement, the company was telling the truth. The hacker didn't take advantage of a security vulnerability: he phished his victims (who include Jennifer Lawrence, Kate Upton and many other female celebrities) or tried to guess their passwords. That's why FBI Assistant Director David Bowdich warns: "We continue to see both celebrities and victims from all walks of life suffer the consequences of this crime and strongly encourage users of Internet-connected devices to strengthen passwords and to be skeptical when replying to emails asking for personal information." The feds aren't done investigating the case yet, but so far, they haven't found any evidence that Collins himself shared or uploaded the images and videos he stole. He's now facing a maximum sentence of five years in prison. If the judge agrees to both sides' recommendations, though, he could be out within 18 months.

1 0

FYI: Adobe issues emergency patch for actively exploited code-execution bug
by Wayne Billing 10 Mar '16

10 Mar '16

[NOTE: if you do not have FLASH installed, you’re finished already] You can check your FLASH version at: https://helpx.adobe.com/flash-player.html …you may see a message similar to this: [cid:4876458E-FF32-41F7-87FE-8CED9BDEC423] …after the upgrade you should see the following on the FLASH test page: [cid:E97F04F3-F084-4F88-9F30-CB47D6EC50F1] ….from: http://arstechnica.com/security/2016/03/adobe-issues-emergency-patch-for-ac… Adobe issues emergency patch for actively exploited code-execution bug Adobe has issued an emergency update for its Flash media player that patches almost two dozen critical vulnerabilities, including one that's being maliciously exploited in the wild. "These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system," Adobe officials wrote in an advisory published Thursday<https://helpx.adobe.com/security/products/flash-player/apsb16-08.html>. "Adobe is aware of a report that an exploit for CVE-2016-1010 is being used in limited, targeted attacks." The notice advises Flash users to install the update as soon as possible. CVE-2016-1010 is the common vulnerabilities and exposures designation for an integer overflow vulnerability that allows attackers to remotely execute malicious code on vulnerable computers. Adobe credited Anton Ivanov of Kaspersky Lab with discovering the zero-day vulnerability but provided no additional details. In an e-mail, a Kaspersky representative wrote: Today Adobe released the security bulletin APSB16-08, crediting Kaspersky Lab for reporting CVE-2016-1010. The vulnerability could potentially allow an attacker to take control of the affected system. Kaspersky Lab researchers observed the usage of this vulnerability in a very limited number of targeted attacks. At this time, we do not have any additional details to share on these attacks as the investigation is still ongoing. Even though these attacks are rare, we recommend that everyone get the update from the Adobe site as soon as possible. The patch brings the latest version of Flash to 21.0.0.182 for Windows and Mac and 11.2.202.577 for Linux. Google Chrome and some versions of Microsoft Internet Explorer and Edge browsers bundle their own version of Flash and will update automatically. Windows 7 users who use Flash must still update manually. Once again, readers are advised to uninstall the Flash, Java, and Silverlight browser extensions to see if they're really necessary. For many people, they aren't, and the significantly decreased attack surface greatly lowers the chances of being visited by remote code-execution attacks. People who rely on Flash to access a company intranet or other site should consider using a dedicated browser for that purpose.

1 0

INTEREST: New York: Apple prevails in forced iPhone unlock case in New York court
by Wayne Billing 29 Feb '16

29 Feb '16

…from: http://arstechnica.com/tech-policy/2016/02/apple-prevails-in-forced-iphone-… http://www.macworld.com/article/3039452/security/judge-strikes-down-order-f… ….others Apple prevails in forced iPhone unlock case in New York court Ruling: All Writs Act can't be used to achieve goal that Congress hasn't granted. by Cyrus Farivar<http://arstechnica.com/author/cyrus-farivar/> - Feb 29, 2016 5:23pm CST A judge in New York ruled Monday<https://www.documentcloud.org/documents/2728314-Orenstein-Order.html> in favor of Apple in a case where investigators wanted the court to compel the company to unlock a seized iPhone 5S running iOS 7, which the company does have the ability to unlock. This case involves a drug dealer who has already pleaded guilty. It pre-dates Apple's current battle with the government over a locked iPhone 5C<http://arstechnica.com/tech-policy/2016/02/apple-fires-back-at-doj-this-is-…> that belonged to one of the shooters in the December 2015 terrorist attack in San Bernardino—that case is due to be heard in court next month in nearby Riverside, California. By contrast, the San Bernardino case involves an iPhone 5c, running iOS 9, which Apple says it cannot unlock. In the California case, federal investigators asked for and received an unprecedented court order compelling Apple to create a new firmware to unlock the device. Last week, Apple formally challenged<http://arstechnica.com/tech-policy/2016/02/apple-fires-back-at-doj-this-is-…> that order, and the outcome is pending. However, on both coasts, Apple is fighting the government's attempt to use the same law, known as the All Writs Act—an obscure catchall statute that dates back to the 18th Century. There are several related AWA cases involving unlocking Apple devices that remain pending nationwide. US Magistrate Judge James Orenstein ruled that what the government was asking for went too far. The ruling, the first of its kind on the topic, has no legal bearing on the outcome of the California case as they are proceeding in different federal judicial districts. Apple hopes, however, that that Riverside judge will be "persuaded" by the decision, according to a company executive who was granted anonymity on a call with reporters. As the judge wrote in his Monday ruling: In short, whatever else the AWA's "usages and principles" clause may be intended to accomplish, it cannot be a means for the executive branch to achieve a legislative goal that Congress has considered and rejected. But because such rejection can take many forms, only one of which (and arguably the least likely in most circumstances) is outright prohibition, the government's argument here is manifestly irreconcilable with the statute. The New York case began back in October 2015, when Judge Orenstein invited Apple to tell the court why it felt that the government<http://arstechnica.com/tech-policy/2015/10/feds-since-apple-can-unlock-ipho…> could not compel it to unlock a seized phone. At the time, bringing Apple into a case like this was new. Nine days later, defendant Jun Feng pleaded guilty<https://www.documentcloud.org/documents/2499370-jun-feng-guilty-plea.html> to one count of conspiracy to distribute and possess with intent to distribute methamphetamine. Judge Orenstein then asked the government why the issue of Apple's compliance was not pointless given the guilty plea. In the government's own filing<https://www.documentcloud.org/documents/2711972-123111286409.html#document/…>, dated October 30, 2015, prosecutors said that the investigation was not over and that it still needed data from Feng's phone. If Feng's phone had iOS 8 or later installed—as 90 percent of iPhones do—this entire issue would likely be moot. Apple now enables full encryption by default, and the company specifically said the move happened<http://arstechnica.com/apple/2014/09/apple-expands-data-encryption-under-io…> "so it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8." How far can you go? Another key portion of the ruling showed that Judge Orenstein is particularly concerned with the government’s expansive view of this law, and addressed head-on the government’s assertion that because Apple licenses, rather than sells its software means that the company retains some amount of control over it. As he wrote<https://www.documentcloud.org/documents/2728314-Orenstein-Order.html#docume…>: In a world in which so many devices, not just smartphones, will be connected to the Internet of Things, the government's theory that a licensing agreement allows it to compel the manufacturers of such products to help it surveil the products' users will result in a virtually limitless expansion of the government's legal authority to surreptitiously intrude on personal privacy. … But the concern about whether the AWA, as construed by the government, would confer on the judiciary an overbroad authority to override individual autonomy cannot be so easily avoided in this case. Nothing in the government's arguments suggests any principled limit on how far a court may go in requiring a person or company to violate the most deeply-rooted values to provide assistance to the government the court deems necessary. Judge Orenstein also noted that he "deliberately" asked the government during oral arguments how far its interpretation of the All Writs Act could go. Could federal authorities, for example, compel the manufacturer of lethal injection drugs to make them over corporate moral objections? The government didn’t answer during oral arguments, but said in a later filing that it would simply depend on the circumstances, which Judge Orenstein found unsatisfying. "If the government cannot explain why the authority it seeks here cannot be used, based on the same arguments before this court, to force private citizens to commit what they believe to be the moral equivalent of murder at the government's behest, that in itself suggests a reason to conclude that the government cannot establish a lack of unreasonable burden," he concluded. Orenstein’s opinion parallels arguments that Apple made in its San Bernardino filing<https://www.documentcloud.org/documents/2722196-Motion-to-Vacate-Brief-and-…>just last week. As its lawyers wrote then: Finally, given the government’s boundless interpretation of the All Writs Act, it is hard to conceive of any limits on the orders the government could obtain in the future. For example, if Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing. Headed for the Supreme Court? Similarly, privacy law scholars roundly hoped that this case would exert some influence over the case pending before the court in California. "It's a meticulous and scholarly opinion," Alex Abdo<https://www.aclu.org/bio/alex-abdo>, an attorney for the American Civil Liberties Union, told Ars. "It should be a roadmap for any court considering one of these requests from the government." Rep. Ted Lieu<https://lieu.house.gov/> (D-Calif.), one of just four congressmen to hold a computer science degree, also applauded the ruling. "I am very pleased with the decision, because it validates what I and others have been saying which is that Congress specifically rejected the FBI's proposal to put in backdoors to weaken encryption and now they're trying to do it through a 1789 law that is not appropriate for the situation," he told Ars. The New York case could be appealed up to the 2nd Circuit Court of Appeals, and similarly, the California case could move up to the 9th Circuit Court of Appeals. If those appellate courts disagree with each other as to the limits of the All Writs Act, constituting a "circuit split," that probably would set the stage for a ruling at the nation's highest court. "Ultimately, if the federal courts in California and New York disagree about how much authority the AWA gives the government to force Apple to unlock iPhones, the conflict could only be resolved by Congress clarifying the law or the Supreme Court settling it," Neil Richards<https://law.wustl.edu/faculty/pages.aspx?id=314>, a law professor at Washington University in St. Louis, told Ars.

1 0

FYI: Ethernet stopped working for you?
by Wayne Billing 28 Feb '16

28 Feb '16

Hi. Seems a few Apple machines have been affected by security update ""Incompatible Kernel Extension Configuration Data version 3.28.1”. Apple has repaired the problem so new updates should not be affected but some people are reporting that they’ve received the “broken Configuration Data update”. This configuration file/version can interfere with the working of your Ethernet card. If the Ethernet connection on your Mac stopped working recently, you can follow these steps to restore it. …from: https://support.apple.com/en-us/HT6672 If the Ethernet connection on your Mac stopped working recently If the Ethernet connection on your Mac stopped working recently, check System Information to find out which version of "Incompatible Kernel Extension Configuration Data” is installed. If you have version 3.28.1, you need an update. If you can connect to WiFi, your Mac will update to version 3.28.2 automatically, or you can follow the steps below to restore it manually. First, check your version number: 1. While pressing the Option key, select System Information from the Apple menu. 2. Expand the Software section and select Installations. 3. Click on the Software Name column header to sort the list alphabetically. 4. Look for “Incompatible Kernel Extension Configuration Data.” 5. If the most recent version installed is 3.28.1, then follow the steps below. If you can connect to WiFi, follow these steps to update to version 3.28.2: 1. Open the Terminal app. 2. Type this command to update to the current version of the “Incompatible Kernel Extension Configuration Data” kernel extension: sudo softwareupdate --background 3. Quit Terminal and restart your Mac. If you can't connect to WiFi, follow these steps to update to version 3.28.2: 1. Follow the instructions<https://support.apple.com/kb/HT201314> to restart your Mac in OS X Recovery. After your Mac restarts, go to step 2. 2. Select Disk Utility from the list of OS X Utilities. 3. Select your drive from the list of internal drives in the sidebar. The default name is "Macintosh HD." Your drive might have a different name or location, if you renamed or moved it. 4. If the drive name is gray, then your drive might be protected by FileVault. Select File > Unlock from the Disk Utility menu, and enter your FileVault password. 5. Select File > Mount in Disk Utility to mount your drive, if it's not already mounted. 6. Quit Disk Utility. If you'd like to be able to copy and paste the command required in Step 8, select Get Help Online from the OS X Utilities list to open Safari and view this article on Apple's support site at support.apple.com/kb/HT6672<http://support.apple.com/kb/HT6672>. Quit Safari before you go to the next step. 7. Launch the Terminal app from Utilities > Terminal. 8. Type (or copy and paste) this command as one line in Terminal. In the example below, the drive name is “Macintosh HD," and there's a space between Macintosh and HD. If your Mac's drive name is different, adjust the text: rm -rf “/Volumes/Macintosh HD/System/Library/Extensions/AppleKextExcludeList.kext” 9. Quit the Terminal app. 10. Select Restart from the Apple menu. 11. After your Mac restarts, your Ethernet connection should work. 12. Open the Terminal app and type this command to update to the current version of the “Incompatible Kernel Extension Configuration Data” kernel extension: sudo softwareupdate --background 13. Quit Terminal and restart your Mac. Alternatively, if you confirmed that your Mac has Incompatible Kernel Extension Configuration Data version 3.28.1, you can also follow the instructions<https://support.apple.com/kb/HT201314> to restart your Mac into OS X Recovery mode, and then select Reinstall OS X. You can reinstall OS X on your drive without reformatting it.

1 0