- apple-list - University of Manitoba Mailing Lists

FYI: suspect AppleID account email and phishing@apple.com
by Wayne Billing 02 Apr '15

02 Apr '15

There seems to have been a rise in bad email specifically targeting AppleID accounts. Usually the email is attempting to get you to enter your AppleID and password. I've seen 3 of these in the past two weeks and others are reporting similar concerns. Generally the email takes one of two formats: - something is wrong with your AppleID account - just log in to fix it - something "odd" has been purchased on your AppleID - just log in to verify the purchase For example, one email indicated that "your AppleID has been used to purchase 'Game of Thrones' from an unusual location". Whatever the format or claim, following the suggested links and entering your AppleID and password to verify or correct the information can lead to unintended exposure of your account information. There are some things you can do to verify that the email is not a valid AppleInc. notification, to slightly reduce your overall exposure, and to report the problem to Apple. 1) reporting the problem to allow Apple Inc. so they can take some action is quite simple by forwarding the message to an appropriate Apple email address: a) open the original email message in MAIL b) select VIEW > MESSAGE > RAW SOURCE c) select all and copy the entire RAW SOURCE of the message d) FILE > NEW MESSAGE addressed to phishing(a)apple.com<mailto:phishing@apple.com> e) Write a brief subject indicating a PHISHING attempt and describing how you received the original message f) paste in the RAW SOURCE you'd copied earlier and hit SEND - this RAW SOURCE allows Apple to examine all of the email server paths and "hidden" links that the original message may have contained 2) verifying original message is not legitimate: examine the RAW SOURCE you'd selected earlier. Within it you will probably find many legitimate Apple links such as "http://euro.apple.com" or "http://iforgot.apple.com". You will probably also see a few very odd links which have nothing to do with AppleInc. These could be any domains such as: http://elmnitasdevigo http://fsioterapiasantarita ....just odd (perhaps already compromised) web addresses which seem to have no connection to "apple.com<http://apple.com>". One sure indicator that something phishi is happening is the presence of non-Apple links in a message supposedly originating at Apple. Apple rarely if ever does that. 3) reducing potential of exposure: one simple step you can take to help reduce your exposure profile through email is to deselect "Load remote content in messages" [cid:6346619A-5084-4345-98E3-2108DE5CE532] a) MAIL > PREFERENCES > VIEWING b) uncheck/deselect LOAD REMOTE CONTENT IN MESSAGES if it is checked - if this option is checked and the sender includes a graphic in the email message, when you open the message in MAIL, this can be an automatic indication to the sender that your email address is "alive"/someone is actually using the address. Just the fact that your mail package requested the graphic can trigger a confirmation to the sender. If you deselect this option, graphics are not loaded automatically but can be loaded manually within the email message as you read it. You'll see a "LOAD REMOTE CONTENT" button in the top-right of your email message. Deselecting this option gives you an opportunity to scan your email message first before loading the graphics allowing you to screen out any suspect email messages. This is not a guarantee that your email address will be 100% safe. It does, however, reduce the chances of an accidental confirmation/exposure relating to your email account via this "load a graphic" mechanism. I hope you find this information to be useful. Please feel free to email questions or concerns you may have. Thanks, Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support Computer and Network Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

INTEREST: Half of Android devices may be vulnerable to surreptitious install exploits
by Wayne Billing 28 Mar '15

28 Mar '15

...from: http://arstechnica.com/security/2015/03/android-hijacking-bug-may-allow-att… Android hijacking bug may allow attackers to install password-stealers Half of Android devices may be vulnerable to surreptitious install exploits. by Dan Goodin<http://arstechnica.com/author/dan-goodin/> - Mar 25, 2015 2:40pm CDT Roughly half of all Android handsets are vulnerable to a newly discovered hack that in some cases allows attackers to surreptitiously modify or replace seemingly benign apps with malicious ones that steal passwords and other sensitive data. The "Android installer hijacking" vulnerability, as it has been dubbed by researchers from Palo Alto Networks, works only when apps are being downloaded from third-party app stores or when a user clicks on an app promotion advertisement hosted by a mobile advertisement library. Technically, it's based on what's known as a Time-of-check to time-of-use vulnerability<http://en.wikipedia.org/wiki/Time_of_check_to_time_of_use>. Affected devices fail to verify that the app being installed at the time of use was the one the end user approved during the time of check, which occurs when a user approves app permissions such as network access or access to the contacts database. The bug involves the way the system application called PackageInstaller installs app files known as APKs. "A vulnerability exists in this process because while the user is reviewing this information, the attacker can modify or replace the package in the background," Palo Alto Networks researcher Zhi Xu wrote in a blog post published Tuesday<http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijack…>. "Verified with Android OS source code posted in AOSP [Android Open Source Project], it shows that the PackageInstaller on affected versions does not verify the APK file at the 'time of use.' Thus, in the "time of use' (i.e., after clicking the 'install button), the PackageInstaller can actually install a different app with an entirely different set of permissions." One scenario for exploiting the vulnerability involves an attacker using a benign-looking app to install malware in the future. A second scenario uses the same weakness to mask the true permissions an app requires. In both cases, targeted users can end up installing apps that are vastly different from the ones they approved during the permissions process. The vulnerability has been patched in Android version 4.3_r0.9 and later, but Xu warned that some Android 4.3 devices remain vulnerable. By Google estimates<https://developer.android.com/about/dashboards/index.html>, that accounts for 49.9 percent of the handsets the company monitors. Palo Alto Networks has released a scanner app<http://play.google.com/store/apps/details?id=com.paloaltonetworks.ctd.ihsca…> that will indicate if a given device is vulnerable. People using vulnerable devices should steer clear of third-party app stores and use Google Play as their sole source of apps.

1 0

INTEREST: smartphone + dongle = test for Detecting HIV And Syphilis
by Wayne Billing 23 Mar '15

23 Mar '15

...from: http://www.forbes.com/sites/judystone/2015/02/04/a-dongle-for-detecting-hiv… A Dongle For Detecting HIV And Syphilis Rapid, inexpensive, easy to use point-of-care (POC) diagnostic tests are critically important in stemming infectious diseases, particularly in developing countries. Researchers at Dr. Sam Sia’s Columbia University<http://orion.bme.columbia.edu/~sia/> lab have invented a promising device that can detect both HIV and syphilis and have successfully piloted it in Rwanda. The Columbia device pairs a microfluidic cassette dongle with a smartphone. Test reagents are preloaded into the cassette. A “one-push” vacuum, like a bulb on an old-fashioned blood pressure cuff, is used to fill the chamber of the cassette with a blood sample, and reduce the need for electricity. Further, the audio jack on a smartphone is used to power the dongle and for data transmission. [cid:E558023E-BC12-4249-AA10-838DA368784E]Step-by-step illustration of dongle testing. [Credit: Tassaneewan Laksanasopin] .....from: http://stm.sciencemag.org/content/7/273/273re1 A smartphone dongle for diagnosis of infectious diseases at the point of care 1. • Tassaneewan Laksanasopin1,*, • Tiffany W. Guo1,*, • Samiksha Nayak1, • Archana A. Sridhara1, • Shi Xie1, • Owolabi O. Olowookere1, • Paolo Cadinu1, • Fanxing Meng1, • Natalie H. Chee1, • Jiyoon Kim1, • Curtis D. Chin1, • Elisaphane Munyazesa2, • Placidie Mugwaneza3, • Alex J. Rai4, • Veronicah Mugisha2, • Arnold R. Castro5, • David Steinmiller6, • Vincent Linder6, • Jessica E. Justman7, • Sabin Nsanzimana3 and • Samuel K. Sia1,† • ↵†Corresponding author. E-mail: ss2735(a)columbia.edu<mailto:ss2735@columbia.edu> Abstract This work demonstrates that a full laboratory-quality immunoassay can be run on a smartphone accessory. This low-cost dongle replicates all mechanical, optical, and electronic functions of a laboratory-based enzyme-linked immunosorbent assay (ELISA) without requiring any stored energy; all necessary power is drawn from a smartphone. Rwandan health care workers used the dongle to test whole blood obtained via fingerprick from 96 patients enrolling into care at prevention of mother-to-child transmission clinics or voluntary counseling and testing centers. The dongle performed a triplexed immunoassay not currently available in a single test format: HIV antibody, treponemal-specific antibody for syphilis, and nontreponemal antibody for active syphilis infection. In a blinded experiment, health care workers obtained diagnostic results in 15 min from our triplex test that rivaled the gold standard of laboratory-based HIV ELISA and rapid plasma reagin (a screening test for syphilis), with sensitivity of 92 to 100% and specificity of 79 to 100%, consistent with needs of current clinical algorithms. Patient preference for the dongle was 97% compared to laboratory-based tests, with most pointing to the convenience of obtaining quick results with a single fingerprick. This work suggests that coupling microfluidics with recent advances in consumer electronics can make certain laboratory-based diagnostics accessible to almost any population with access to smartphones.

1 0

FYI: Apple: more security updates; iPhoto compatibility
by Wayne Billing 19 Mar '15

19 Mar '15

There have been a few security concerns washing through the Internet the past few weeks. Fixes and patches have been coming from various quarters as they have been readied. Today saw Apple's most recent security patch for OS X (following closely on the heals of the Safari patch earlier this week). In addtion, there is an iPhoto update to improve transition to the upcoming Photos app that will replace it later this year. Just launch the APP STORE and check the UPDATES section to begin the installation of these.

1 0

INTEREST: Apple improves deal for shuttle bus workers following earlier deal for security guards
by Wayne Billing 13 Mar '15

13 Mar '15

...from: http://9to5mac.com/2015/03/09/apple-shuttle-bus-workers/ http://www.mercurynews.com/business/ci_27673431/exclusive-apple-gives-shutt… Apple improves deal for shuttle bus workers following earlier deal for security guards<http://9to5mac.com/2015/03/09/apple-shuttle-bus-workers/> [Shuttle-Bus] Apple is ensuring that its sub-contracted shuttle bus workers get a better deal, directly funding a 25% bump in their pay and requiring contractors to pay a higher hourly rate for split shifts–where drivers work both mornings and evenings but are kept hanging around without pay between the two … Apple is also requiring bus companies to improve rest areas, reports the Mercury News<http://www.mercurynews.com/business/ci_27673431/exclusive-apple-gives-shutt…>: “Over 5,000 Apple employees in the Bay Area take advantage of our commute alternatives program every day,” said Apple spokeswoman Kristin Huguet. “We’re working with the bus companies to help make a number of changes for the more than 150 drivers of our commute shuttles, including funding a 25 percent increase in hourly wages, premium pay for coach and shuttle drivers who work split shifts and improving the driver break and rest areas.” One of Apple’s shuttle contractors, Royal Coach Tours, said the pay rise would make the drivers among the highest paid in Silicon Valley. Contract drivers for Apple and other tech companies voted to unionize<http://9to5mac.com/2015/01/13/apple-drivers-unionize/> back in January. Jesse Jackson wrote to Tim Cook last November, urging Apple to take a lead in creating “world-class working conditions” for low-paid contractors like security guards and shuttle drivers. The two met<http://9to5mac.com/2015/03/09/apple-shuttle-bus-workers/world-class%20worki…> to discuss the issue in December, and Apple last week announced<http://9to5mac.com/2015/03/03/apple-security-contractors-staff/> that it would be taking on the majority of its security guards as direct employees, ensuring that they would receive health insurance and retirement benefits.

1 0

FYI: Apple MB Pro Repair: a small percentage of MacBook Pro systems (sold between February 2011 and December 2013) may exhibit distorted video, no video, or unexpected system restarts
by Wayne Billing 20 Feb '15

20 Feb '15

...from: http://www.apple.com/support/macbookpro-videoissues/ MacBook Pro Repair Extension Program for Video Issues Apple has determined that a small percentage of MacBook Pro systems may exhibit distorted video, no video, or unexpected system restarts. These MacBook Pro systems were sold between February 2011 and December 2013. Apple or an Apple Authorized Service Provider will repair affected MacBook Pro systems, free of charge. See below for details on affected models and service options. As of February 20, 2015, the repair process will be available in the U.S. and Canada. In other countries, it will be available as of February 27, 2015. Symptoms An affected MacBook Pro may display one or more of the following symptoms: * Distorted or scrambled video on the computer screen * No video on the computer screen (or external display) even though the computer is on * Computer restarts unexpectedly Products affected * 15-inch and 17-inch MacBook Pro models manufactured in 2011 * 15-inch MacBook Pro with Retina models manufactured from Mid 2012 to Early 2013 Identify your model Use the "Check your Coverage<https://selfsolve.apple.com/agreementWarrantyDynamic.do>" tool on the Apple Support site to determine if your MacBook Pro model matches the list of affected products below. Sample results: [Check your coverage] Affected Models * MacBook Pro (15-inch Early 2011) * MacBook Pro (15-inch, Late 2011) * MacBook Pro (Retina, 15-inch, Mid 2012) * MacBook Pro (17-inch Early 2011) * MacBook Pro (17-inch Late 2011) * MacBook Pro (Retina, 15 inch, Early 2013) Note: If your MacBook Pro is not experiencing any of these symptoms and is not one of the products affected, you do not need to contact Apple. Repair Process Please choose one of the options below for service. Your MacBook Pro will be examined prior to any service to verify that it is eligible for this program and is otherwise in working order. Note: If your MacBook Pro has any damage, which prevents the repair, such as a cracked screen, that issue will need to be resolved during service. You will be notified about any additional repair charges that are required. Please back up your data before your MacBook Pro is serviced. Learn more about backup options.<http://www.apple.com/support/backup/> * Carry-in * Bring your MacBook Pro to a participating provider<https://locate.apple.com/> - Apple Retail Store or Apple Authorized Service Provider. * A technician will run a diagnostic test on the MacBook Pro to verify eligibility. * Repair turn around time will vary based upon parts and technician availability. * You will be notified when your MacBook Pro is ready for pickup. * Mail-in * Call Apple and request a postage paid box to send your MacBook Pro to the local Apple Repair Center. * A technician will run a diagnostic test on your MacBook Pro to verify eligibility. * The repair process takes approximately 5-7 days from the time your MacBook Pro is received at the repair center until it is returned to you. * After it has been serviced, your MacBook Pro will be returned to you by mail. Additional Information Apple is contacting customers who paid for a repair either though Apple or an Apple Authorized Service Provider to arrange reimbursement. If you have not been contacted, but paid for a repair that you think was due to this issue, please contact Apple. This worldwide Apple program does not extend the standard warranty coverage of the MacBook Pro. The program covers affected MacBook Pro models until February 27, 2016 or three years from its original date of sale, whichever provides longer coverage for you. Information as of 2015-02-19

1 0

INTEREST: Obama: “Everybody’s online and everybody’s vulnerable”
by Wayne Billing 15 Feb '15

15 Feb '15

...from: http://arstechnica.com/tech-policy/2015/02/obama-everybodys-online-and-ever… Obama: “Everybody’s online and everybody’s vulnerable” [cid:35FD4F1C-650E-476F-8800-26270944CC66] White House<https://www.youtube.com/watch?v=KlTo9hFAFXs&spfreload=10> President Barack Obama signed an executive order<http://www.whitehouse.gov/the-press-office/2015/02/12/fact-sheet-executive-…> on Friday that encourages more cybersecurity threat-related data sharing between the private sector and the government. Speaking at Stanford University in California, where many tech leaders and other government officials also assembled, the president acknowledged that federal authorities are in a bind. “I have to tell you that grappling with how government protects the American people from adverse events while at the same time making sure that government itself is not abusing its capabilities is hard,” he said. “This cyber world is the Wild Wild West, and to some degree we’re asked to be the sheriff. When something like Sony happens<http://arstechnica.com/security/2014/12/sony-pictures-hack-gets-uglier-nort…>, people want to know what government can do about it. The technology so often outstrips whatever rules and structures and standards have been put in place.” “Everybody’s online and everybody’s vulnerable,” he added. In an online statement<http://www.whitehouse.gov/the-press-office/2015/02/13/fact-sheet-white-hous…>, the White House added: "We must have new technologies that combine greater security and convenience. This technology moves beyond usernames and passwords to employ multiple security steps to better ensure a person is who they say they are." The Obama administration has been actively working<http://www.whitehouse.gov/the-press-office/2015/02/13/fact-sheet-white-hous…> on this issue since 2013, when a previous executive order on Critical Infrastructure Cybersecurity was signed. That, in turn, led to something called the “Cybersecurity Framework,” or a sort of blueprint that some Silicon Valley and other major firms have adopted, including Bank of America, Apple, and others. Last month, Obama announced<http://arstechnica.com/tech-policy/2015/01/obama-calls-for-new-consumer-stu…> new legislation aiming to protect consumer privacy and student privacy and offer enhanced protection of home energy usage data, among other things. (Some of the new suggested policies were first put forth in 2012<http://arstechnica.com/tech-policy/2012/02/white-house-announces-new-privac…>.) Some tech companies have butted heads with Washington and are dismayed that National Security Agency and other digital surveillance reforms have stalled. While Apple CEO Tim Cook did speak, executives from Google, Yahoo, Facebook, and Twitter were not in attendance. According to Reuters<http://www.reuters.com/article/2015/02/12/us-usa-cybersecurity-exclusive-id…>, copies of the executive order’s text have not been made available to top tech executives. A copy of the executive order has yet to be published on the White House website.

1 0

FYI: iCloud beta now lets anyone create an Apple ID and use Pages, Numbers, and Keynote for free | iMore
by Doug Hamilton 13 Feb '15

13 Feb '15

http://www.imore.com/icloud-beta-now-lets-anyone-create-apple-id-and-use-pa… iCloud beta now lets anyone create an Apple ID and use Pages, Numbers, and Keynote for free Good news for people wanting to use Apple's productivity software: starting tonight, anyone, with or without a Mac or iOS device, will be able to create an Apple ID and sign in to the iCloud beta website to start using Pages, Numbers, and Keynote for free. When users visit beta.icloud.com, they will be presented with a banner at the top of the page prompting them to create an Apple ID. Afterwards, in addition to gaining access to Pages, Numbers, and Keynote, the free accounts will also grant 1GB of free cloud storage to users. This is a great way for Apple to extend its services beyond its own devices, as now even PC users can start using the company's productivity suite. It is important to note, however, that this currently only works from the beta version of the iCloud website. If you'd like to give it a shot, hit up that source link below to get started. Source: iCloud Beta Have something to say about this story? Share your comments below! Need help with something else? Submit your question!

1 0

INTEREST: Busy week for Apple: conflict-free audit, new record market-cap, solar farm to offset electricity use; LOCK reducing iPhone theft
by Wayne Billing 12 Feb '15

12 Feb '15

...from: http://9to5mac.com/2015/02/12/apple-conflict-minerals/ Apple dropping four smelters from supply chain after they refused conflict-free audit<http://9to5mac.com/2015/02/12/apple-conflict-minerals/> Apple has revealed in its annual Supplier Responsibility Progress Report<http://images.apple.com/supplier-responsibility/pdf/Apple_Progress_Report_2…> that it has informed four smelters–who provide metals used in the production of the company’s devices–that they will be dropped from the supply chain after refusing to submit to “conflict mineral” audits … The audits are designed to ensure that the extraction of the minerals used does not finance armed groups associated with human rights violations: “Tantalum, tin, tungsten, and gold are called conflict minerals because, in the Democratic Republic of the Congo (DRC) and adjoining regions, their extraction may finance or benefit armed groups associated with human rights violations. Apple is dedicated to using only conflict-free minerals in our products […] Unfortunately, even after extensive encouragement, there were four smelters that were unwilling to commit to be audited by a third party, so Apple put these smelters on notice that they will be removed from our supply chain.” [...] ...from: http://9to5mac.com/2015/02/10/apple-becomes-1st-company-ever-to-close-at-ma… Apple becomes 1st company ever to close at market cap of over $700B (AAPL)<http://9to5mac.com/2015/02/10/apple-becomes-1st-company-ever-to-close-at-ma…> Update 2/11: After passing $700 billion in market capitalization yesterday, Apple has been trading up<http://finance.yahoo.com/q?d=t&s=AAPL> as high as $124.43 a share raising market cap over $720 billion. Apple’s stock price closed <https://www.google.com/search?q=TSLA&oq=TSLA&aqs=chrome..69i57j0l5.957j0j4&…> up 2.3 points today [...] ..from: http://9to5mac.com/2015/02/10/apple-announces-850m-solar-farm-in-monterey-t… Apple announces $850m, 1600-acre solar farm in Monterey to offset all its CA operations incl. Campus 2<http://9to5mac.com/2015/02/10/apple-announces-850m-solar-farm-in-monterey-t…> [apple-Solar-reno] During Tim Cook’s talk at the Goldman Sachs Tech Conference 2015<http://9to5mac.com/2015/02/10/live-blog-tim-cook-goldman-sachs-conference/> today, the Apple CEO announced a new initiative that will see the company build a solar farm in Monterey County, California that Cook called Apple’s “biggest, boldest and most ambitious” energy project yet. “We know at Apple that climate change is real… our view is the time for talk is past and the time for action is now… we’re now running all of our data centres… off renewable energy.. Just today we’re announcing our biggest, boldest and most ambitious project ever…building a solar farm in Monterey County…” Apple says the new solar farm will offset all of its California operations including 55 retail stores, its entire under construction Campus 2,<http://9to5mac.com/tag/apple-campus-2/> its other offices in California, and at least one of its data centers. Apple’s new Campus 2 alone is scheduled to house approximately 16,000 of its employees in 2.8m square feet once complete. ...from: http://9to5mac.com/2015/02/11/iphone-thefts/ Activation Lock has reduced iPhone theft by 25% in NY, 40% in SF, 50% in London<http://9to5mac.com/2015/02/11/iphone-thefts/> [activation-lock-02] Officials in three major cities have reported dramatic reductions in iPhone thefts since Apple introduced Activation Lock<http://9to5mac.com/tag/activation-lock/> as part of iOS 7, preventing devices being re-activated without the original owner’s iCloud login. Reuters<http://www.reuters.com/article/2015/02/11/us-usa-smartphone-killswitch-idUS…> reports that the number of reported iPhone thefts has fallen year-on-year by 25% in New York, 40% in San Francisco and 50% in London … Activation Lock was originally announced<http://9to5mac.com/2013/06/10/apple-announces-activation-lock-theft-deterre…> in June 2013 as part of iOS 7, resulting in theft reductions<http://9to5mac.com/2014/06/18/police-ios-7s-activation-lock-has-helped-redu…>in the three cities of 19%, 24% and 38% respectively. Switching on Activation Lock by default in iOS 8<http://9to5mac.com/2014/09/17/apple-turns-activation-lock-on-by-default-in-…> has further boosted these numbers as thieves are discovering that stolen iPhones are little more than pretty-looking bricks.

1 0

FYI: Smithsonian allows viewing of 40, 000 pieces of asian art online (Freer|Sackler)
by Wayne Billing 04 Jan '15

04 Jan '15

http://www.asia.si.edu/collections/edan/default.cfm Open F|S (Freer|Sackler) [homepage banner] Welcome to Phase 1 of Open F|S, the complete digitized collections of the Freer and Sackler Galleries and the Freer Study Collection. With more than 40,000 works being made available for high-resolution download—expanding regularly with our new acquisitions<http://www.asia.si.edu/collections/new-acquisitions/default.asp>—you can explore the Smithsonian's museums of Asian art from anywhere in the world, whenever you like. Images can be used for all non-commercial purposes<http://www.asia.si.edu/collections/usage/>, from desktop wallpapers<http://www.asia.si.edu/collections/wallpaper/> to artistic gifts for family and friends. Send us your creations and your feedback about this beta version at openfs(a)si.edu<mailto:openfs@si.edu?subject=WEB:%20Collection%20Creations>! For permission to use high-resolution images commercially, contact Rights and Reproduction<http://www.asia.si.edu/research/imagePermissions.asp>.

1 0