×
Security

Android Vulnerability Exposes Credentials From Mobile Password Managers (techcrunch.com) 22

An anonymous reader quotes a report from TechCrunch: A number of popular mobile password managers are inadvertently spilling user credentials due to a vulnerability in the autofill functionality of Android apps. The vulnerability, dubbed "AutoSpill," can expose users' saved credentials from mobile password managers by circumventing Android's secure autofill mechanism, according to university researchers at the IIIT Hyderabad, who discovered the vulnerability and presented their research at Black Hat Europe this week. The researchers, Ankit Gangwal, Shubham Singh and Abhijeet Srivastava, found that when an Android app loads a login page in WebView, password managers can get "disoriented" about where they should target the user's login information and instead expose their credentials to the underlying app's native fields, they said. This is because WebView, the preinstalled engine from Google, lets developers display web content in-app without launching a web browser, and an autofill request is generated.

"Let's say you are trying to log into your favorite music app on your mobile device, and you use the option of 'login via Google or Facebook.' The music app will open a Google or Facebook login page inside itself via the WebView," Gangwal explained to TechCrunch prior to their Black Hat presentation on Wednesday. "When the password manager is invoked to autofill the credentials, ideally, it should autofill only into the Google or Facebook page that has been loaded. But we found that the autofill operation could accidentally expose the credentials to the base app." Gangwal notes that the ramifications of this vulnerability, particularly in a scenario where the base app is malicious, are significant. He added: "Even without phishing, any malicious app that asks you to log in via another site, like Google or Facebook, can automatically access sensitive information."

The researchers tested the AutoSpill vulnerability using some of the most popular password managers, including 1Password, LastPass, Keeper and Enpass, on new and up-to-date Android devices. They found that most apps were vulnerable to credential leakage, even with JavaScript injection disabled. When JavaScript injection was enabled, all the password managers were susceptible to their AutoSpill vulnerability. Gangwal says he alerted Google and the affected password managers to the flaw. Gangwal tells TechCrunch that the researchers are now exploring the possibility of an attacker potentially extracting credentials from the app to WebView. The team is also investigating whether the vulnerability can be replicated on iOS.

Encryption

Beeper Mini is an iMessage-for-Android App That Doesn't Require Any Apple Device at All (liliputing.com) 122

An anonymous reader shares a report: Beeper has been offering a unified messaging platform for a few years, allowing users to open a single app to communicate with contacts via SMS, Google Chat, Facebook Messenger, Slack, Discord, WhatsApp, and perhaps most significantly, iMessage. Up until this week though, Android users that wanted to use Beeper to send "blue bubble" messages to iMessage users had their messages routed through a Mac or iOS device. Now Beeper has launched a new app called Beeper Mini that handles everything on-device, no iPhone or Mac bridge required.

Beeper Mini is available now from the Google Play Store, and offers a 7-day free trial. After that, it costs $2 per month to keep using. [...] previously the company had to rely on a Mac-in-the-cloud? The company explains the method it's using in a blog post, but in a nutshell, Beeper says a security researcher has reverse engineered "the iMessage protocol and encryption," so that "all messages are sent and received by Beeper Mini Android app directly to Apple's servers" and "the encryption keys needed to encrypt these messages never leave your phone." That security researcher, by the way, is a high school student that goes by jjtech, who was hired by Beeper after showing the company his code. A proof-of-concept Python script is also available on Github if you'd like to run it to send messages to iMessage from a PC.

XBox (Games)

Microsoft In Talks To Launch Mobile Gaming Store, Rivaling Apple (bnnbloomberg.ca) 39

According to Microsoft Gaming CEO Phil Spencer, the company is talking to partners to help launch a mobile gaming store that will take on Apple and Google. "It's an important part of our strategy and something we are actively working on today not only alone, but talking to other partners who'd also like to see more choice for how they can monetize on the phone," Spencer said in an interview in Sao Paulo during the CCXP comics and entertainment convention. From the report: The executive declined to give a specific date for a launch of the online store, which earlier reports suggested could be next year. "I don't think this is multiple years away, I think this is sooner than that,'' he said. [...] Microsoft's mobile store would also enter a challenging regulatory climate around smartphone-based digital marketplaces. Fortnite-maker Epic Games has sued both Apple and Alphabet's Google over their iOS and Android store practices, alleging they are unnecessarily restrictive and unfair. Apple doesn't allow competing stores on its iPhone and iPad platforms, and collects a 30% cut of sales for most purchases. Game makers have taken issue with the fees.

Epic lost its battle with Apple but in September asked the US Supreme Court to weigh in. Apple is also petitioning that court to reverse an order that would force the company to let developers steer customers to other payment methods. Epic is still in court fighting its case against Google, which does allow third-party app stores on its devices.The European Union's Digital Markets Act, which is just beginning to take effect, could force Apple to open up its app store ecosystem. Apple is challenging the regulation.

Microsoft may be able to use long-standing resentment against the market leaders to martial support for its store offering. Xbox's cloud gaming technology already lets users stream blockbuster games to mobile phones. "We've talked about choice, and today on your mobile phones, you don't have choice,'' Spencer said. "To make sure that Xbox is not only relevant today but for the next 10, 20 years, we're going to have to be strong across many screens."
Earlier this week, Xbox CFO Tim Stuart said during the Wells Fargo TMT Summit that Microsoft wants to make first-party games and Game Pass available on "every screen that can play games," including rival consoles. "It's a bit of a change of strategy. Not announcing anything broadly here, but our mission is to bring our first-party experiences [and] our subscription services to every screen that can play games," Stuart said. "That means smart TVs, that means mobile devices, that means what we would have thought of as competitors in the past like PlayStation and Nintendo."
Programming

BBC BASIC Is Back In a Big Way (hackaday.com) 134

An anonymous reader quotes a report from Hackaday: The BBC has a long history of teaching the world about computers. The broadcaster's name was proudly displayed on the BBC Micro, and BBC Basic was the programming language developed especially for that computer. Now, BBC Basic is back and running on a whole mess of modern platforms. BBC Basic for SDL 2.0 will run on Windows, MacOS, x86 Linux, and even Raspberry Pi OS, Android, and iOS. Desktop versions of the programming environment feature a BASIC editor that has syntax coloring for ease of use, along with luxury features like search and replace that weren't always available at the dawn of the microcomputer era. Meanwhile, the smartphone versions feature a simplified interface designed to work better in a touchscreen environment.

It's weird to see, but BBC Basic can actually do some interesting stuff given the power of modern hardware. It can address up to 256 MB of memory, and work with far more advanced graphical assets than would ever have been possible on the original BBC Micro. If you honed your programming skills on that old metal, you might be impressed with what they can achieve with BBC Basic in a new, more powerful context.

AI

ChatGPT's Voice Chat Feature Is Rolling Out To Android and iOS 9

OpenAI's "ChatGPT with voice" feature announced in September is now rolling out to all free users on mobile. Engadget reports: When the company first introduced voice chats, it admitted that the capability to create "realistic synthetic voices from just a few seconds of real speech" presents new risks. It could, for instance, allow bad actors to impersonate public figures or anybody they want. As a result, it decided that ChatGPT's voice feature will focus on conversations. It's powered by a text-to-speech model that can generate "human-like audio from just text and a few seconds of sample speech." OpenAI worked with voice actors to create the capability and offers five different voices to choose from.
The Almighty Buck

Is 'Disney Pinnacle' Preparing to Be the Next Big NFT Failure? (theverge.com) 37

"NFTs aren't gone yet," writes the Verge.

"Disney will launch an 'all-new socially driven collectible experience' called Disney Pinnacle later this year, turning characters from Pixar, Star Wars, and its classic animated films into tradable digital pins." While announcing Pinnacle, Disney and its partner Dapper Labs won't even say the word "NFT." Dapper Labs still calls itself "the NFT company," but between a variety of scams, an eye-blistering episode at a recent Bored Ape event, and a market that has plunged since peaking in early 2021, that's a term they apparently will steer clear of. The only thing available on the site right now is a privacy policy that makes clear this is a Dapper Labs effort that's licensing content from Disney — not an in-house effort on the level of Disney Plus.

The NFT collection is being launched through an iOS app, and a spokesperson tells CoinDesk that web and Android applications will come later.

The Disney Pinnacle website has a few seconds of background animation showing the pins — and, of course, a waitlist signup form.
Windows

Windows is Now an App for iPhones, iPads, Macs, and PCs (theverge.com) 57

Microsoft has created a Windows App for iOS, iPadOS, macOS, Windows, and web browsers. From a report: The app essentially takes the previous Windows 365 app and turns it into a central hub for streaming a copy of Windows from a remote PC, Azure Virtual Desktop, Windows 365, Microsoft Dev Box, and Microsoft's Remote Desktop Services.

Microsoft supports multiple monitors through its Windows App, custom display resolutions and scaling, and device redirection for peripherals like webcams, storage devices, and printers. The preview version of the Windows App isn't currently available for Android, though. The Windows App is also limited to Microsoft's range of business accounts, but there are signs it will be available to consumers, too. The sign-in prompt on the Windows App on Windows (yes that's a mouthful) suggests you can access the app using a personal Microsoft Account, but this functionality doesn't work right now.

Displays

iOS Beta Adds 'Spatial Video' Recording. Blogger Calls Them 'Astonishing', 'Breathtaking', 'Compelling' (daringfireball.net) 95

MacRumors writes that the second beta of iOS 17.2 "adds a new feature that allows an iPhone 15 Pro or iPhone 15 Pro Max to record Spatial Video" — that is, in the immersive 3D format for the yet-to-be-released Apple Vision Pro (where it can be viewed in the "Photos" app): Spatial Video recording can be enabled by going to the Settings app, tapping into the Camera section, selecting Formats, and toggling on "Spatial Video for Apple Vision Pro..." Spatial Videos taken with an iPhone 15 Pro can be viewed on the iPhone as well, but the video appears to be a normal video and not a Spatial Video.
Tech blogger John Gruber got to test the technology, watching the videos on a (still yet-to-be-released) Vision Pro headset. "I'm blown away once again," he wrote, calling the experience "astonishing."

"Before my demo, I provided Apple with my eyeglasses prescription, and the Vision Pro headset I used had appropriate corrective lenses in place. As with my demo back in June, everything I saw through the headset looked incredibly sharp..." The Vision Pro experience is highly dependent upon foveated rendering, which Wikipedia succinctly describes as "a rendering technique which uses an eye tracker integrated with a virtual reality headset to reduce the rendering workload by greatly reducing the image quality in the peripheral vision (outside of the zone gazed by the fovea)..." It's just incredible, though, how detailed and high resolution the overall effect is...

Plain old still photos look amazing. You can resize the virtual window in which you're viewing photos to as large as you can practically desire. It's not merely like having a 20-foot display — a size far more akin to that of a movie theater screen than a television. It's like having a 20-foot display with retina quality resolution, and the best brightness and clarity of any display you've ever used... And then there are panoramic photos... Panoramic photos viewed using Vision Pro are breathtaking. There is no optical distortion at all, no fish-eye look. It just looks like you're standing at the place where the panoramic photo was taken — and the wider the panoramic view at capture, the more compelling the playback experience is. It's incredible...

As a basic rule, going forward, I plan to capture spatial videos of people, especially my family and dearest friends, and panoramic photos of places I visit. It's like teleportation... When you watch regular (non-spatial) videos using Vision Pro, or view regular still photography, the image appears in a crisply defined window in front of you. Spatial videos don't appear like that at all. I can't describe it any better today than I did in June: it's like watching — and listening to — a dream, through a hazy-bordered portal opened into another world...

Nothing you've ever viewed on a screen, however, can prepare you for the experience of watching these spatial videos, especially the ones you will have shot yourself, of your own family and friends. They truly are more like memories than videos... [T]he ones I shot myself were more compelling, and took my breath away... Prepare to be moved, emotionally, when you experience this.

IOS

iOS 17.2 Hints At Apple Moving Towards Letting Users Sideload Apps (9to5mac.com) 33

9to5Mac has found evidence in the iOS 17.2 beta code that hints the company is moving towards enabling sideloading on iOS devices. From the report: iOS 17.2 has a new public framework called "Managed App Distribution." While our first thought was that this API would be related to MDM solutions for installing enterprise apps (which is already possible on iOS), it seems that Apple has been working on something more significant than that. By analyzing the new API, we've learned that it has an extension endpoint declared in the system, which means that other apps can create extensions of this type. Digging even further, we found a new, unused entitlement that will give third-party apps permission to install other apps. In other words, this would allow developers to create their own app stores.

The API has basic controls for downloading, installing, and even updating apps from external sources. It can also check whether an app is compatible with a specific device or iOS version, which the App Store already does. Again, this could easily be used to modernize MDM solutions, but here's another thing. We also found references to a region lock in this API, which suggests that Apple could restrict it to specific countries. This wouldn't make sense for MDM solutions, but it does make sense for enabling sideloading in particular countries only when required by authorities -- such as in the European Union.
Under the European Union's Digital Markets Act, or DMA, big tech companies will be required to, among other things, allow users to install any apps they want from third-party sources. "In theory, Apple is required to comply with DMA legislation by March 2024," reports 9to5Mac. "The company has even admitted in a Form 10-K filing that it expects to make changes that will impact the App Store's business model."
Bug

Apple Delays Work on Next Year's iPhone, Mac Software To Fix Bugs (bloomberg.com) 74

In a rare move, Apple hit pause on development of next year's software updates for the iPhone, iPad, Mac and other devices so that it could root out glitches in the code. From a report: The delay, announced internally to employees last week, was meant to help maintain quality control after a proliferation of bugs in early versions, according to people with knowledge of the decision. Rather than adding new features, company engineers were tasked with fixing the flaws and improving the performance of the software, said the people, who asked not to be identified because the matter is private.

Apple's software -- famous for its clean interfaces, easy-to-use controls and focus on privacy -- is one of its biggest selling points. That makes quality control imperative. But the company has to balance a desire to add new features with making sure its operating systems run as smoothly as possible. [...] When looking at new operating systems due for release next year, the software engineering management team found too many "escapes" -- an industry term for bugs missed during internal testing. So the division took the unusual step of halting all new feature development for one week to work on fixing the bugs. With thousands of different Apple employees working on a range of operating systems and devices -- that need to work together seamlessly -- it's easy for glitches to crop up.

The Courts

Epic Games Goes To Court To Challenge Google's App Store Practices (cnn.com) 63

Epic Games, the maker of the popular game "Fortnite," has launched a battle against Google in federal court in a closely watched antitrust showdown that could reshape how smartphone users get Android apps and pay for in-app content. From a report: Epic's lawsuit in the US District Court in California's Northern District targets the Google Play Store, focusing on Google's fees for in-app subscriptions and one-off transactions, along with other terms that app developers such as Epic say helped Google maintain an illegal monopoly in app distribution.

The legal battle follows a years-long debate about whether app store operators such as Google and Apple foster an open, competitive app ecosystem. The two companies argue their app stores help unlock billions in revenue for small businesses, while ensuring that Android and iOS users benefit from security oversight that the technology giants provide. The jury may hear high-profile witnesses testify from both sides, including Google CEO Sundar Pichai and Epic CEO Tim Sweeney.

The court fight traces back to 2020, when Epic launched Project Liberty, a plan to circumvent Apple and Google's app store terms. That move by Epic forced a confrontation with the tech giants. Epic updated the Fortnite app to encourage players to pay for in-app content directly through Epic's own website -- rather than through Apple and Google's in-app payment systems. That gambit triggered a violation of the app stores' developer terms. The move also prompted both app stores to remove the Fortnite app from their platforms.

Biotech

FSF Warns About the Perils of Medical Devices with Un-Free Software (fsf.org) 58

"Software that controls your body should always respect your freedom," warns the program manager of the Free Software Foundation: In July, users of the proprietary software app LibreLink, who live in the UK and use Apple devices, found that the app they depend on to monitor their blood sugar was not working anymore after the developer Abbott pushed an update for the app... Despite what its name may suggest, there is nothing libre about the LibreLink app. It's proprietary software, which means users must depend on the company to keep it running and to distribute it. With free software, [a user] would have had the freedom to run, copy, distribute, study, change, and improve the software himself, or he could have leaned on a community of developers and users to share and fix the software, and the old version of the software would have been available to revert the update...

Two months later, with Apple's update to iOS 17, users of the FreeStyle LibreLink and Libre 2 apps had reason again to fear that the software they rely on wouldn't work after updating their iPhones. This time, users all over the world were affected. In September, Abbott warned Apple users: "As part of the upcoming iOS 17 release, Apple is introducing StandBy Mode and Assistive Access Mode ... this release may impact your experience with the FreeStyle Libre 2 app, the FreeStyle LibreLink app, or the FreeStyle LibreLinkUp app. We recommend that you disable automatic operating system updates on the smartphone using the mentioned apps." This warning was made because StandBy Mode would sometimes prohibit time-sensitive notifications such as glucose alarms, and the Assistive Access Mode would impact sensor activation and alarm setting modification in the app...

And a scenario where a company abandons service or updates to its users is not merely theoretical. This is the bitter reality faced by users of eye implants produced by Second Sight Medical Products since the company decided to abandon the technology in 2020 when facing the prospect of bankruptcy. [">According to IEEE Spectrum], Terry Byland, whose sight has been dependent on the first-generation Argus implant since 2004, says of his experience, "As long as nothing goes wrong, I'm fine. But if something does go wrong with it, well, I'm screwed. Because there's no way of getting it fixed." That's what also happened to Barbara Campbell, whose retinal implant suddenly stopped working when she was on a subway...

It's up to us advocates of free software to inform the people around us of the issues with proprietary software in medical aids. Let's encourage our friends, parents, and grandparents to ask their doctor about the software in their medical devices and to choose and insist upon free software over proprietary software.

Google

Apple Called Android a 'Massive Tracking Device' In 2013 (9to5google.com) 29

An anonymous reader quotes a report from 9to5Google: Coming out of the ongoing Google antitrust trial, an internal Apple presentation has surfaced (via The Verge) in which the company called Android a "massive tracking device." The presentation in question was regarding a push within Apple to start "Competing on Privacy." The slides, made in January 2013, dove into how Apple's competitors (Google, Facebook, Amazon, and Microsoft primarily) handled privacy matters and user data. A "privacy timeline" includes some 2000s and 2010s events that made headlines regarding privacy, such as Google's Street View cars recording private Wi-Fi networks and Instagram's aim to use user photos in its ads, as well as Google's privacy policy move to combining user data across services. Apple went on to compare how its products handle privacy differently from Google and others.

The presentation culminates in the full-page statement [...] where Apple says that "Android is a massive tracking device." The slideshow is partially redacted and abridged, which leaves out the context of this statement, but it's certainly a bold way to talk about a competitor. Of course, all mobile devices do a whole lot of tracking, whether it's Android or iOS.

Privacy

Brave Responds To Bing and ChatGPT With a New 'Anonymous and Secure' AI Chatbot (theverge.com) 11

The Brave browser is rolling out a privacy-focused AI assistant named Leo, which the company claims provides "unparalleled privacy" compared to AI chatbot services likes Bing Chat, ChatGPT, Google Bard and others. The Verge reports: Following several months of testing, Leo is now available to use for free by all Brave desktop users running version 1.60 of the web browser. Leo is rolling out "in phases over the next few days" and will be available on Android and iOS "in the coming months."

The core features of Leo aren't too dissimilar from other AI chatbots like Bing Chat and Google Bard: it can translate, answer questions, summarize webpages, and generate new content. Brave says the benefits of Leo over those offerings are that it aligns with the company's focus on privacy -- conversations with the chatbot are not recorded or used to train AI models, and no login information is required to use it. As with other AI chatbots, however, Brave claims Leo's outputs should be "treated with care for potential inaccuracies or errors."

The standard version of Leo utilizes Meta's Llama 2 large language model and is free to use by default. For users who prefer to access a different AI language model, Brave is also introducing Leo Premium, a $15 monthly subscription that features Anthropic's AI assistant, Claude Instant -- a faster and cheaper version of Anthropic's Claude 2 large language model. Brave says that additional models will be available to Leo Premium users alongside access to higher-quality conversations, priority queuing during peak usage, higher rate limits, and early access to new features.

Cloud

Matic's Robot Vacuum Maps Spaces Without Sending Data To the Cloud (techcrunch.com) 24

An anonymous reader quotes a report from TechCrunch: A relatively new venture founded by Navneet Dalal, an ex-Google research scientist, Matic, formerly known as Matician, is developing robots that can navigate homes to clean "more like a human," as Dalal puts it. Matic today revealed that it has raised $29.5 million, inclusive of a $24 million Series A led by a who's who of tech luminaries, including GitHub co-founder Nat Friedman, Stripe co-founders John and Patrick Collison, Quora CEO Adam D'Angelo and Twitter co-founder and Block CEO Jack Dorsey.

Dalal co-founded Matic in 2017 with Mehul Nariyawala, previously a lead product manager at Nest, where he oversaw Nest's security camera portfolio. [...] Early on, Matic focused on building robot vacuums -- but not because Dalal, who serves as the company's CEO, saw Matic competing with the iRobots and Ecovacs of the world. Rather, floor-cleaning robots provided a convenient means to thoroughly map indoor spaces, he and Nariyawala believed. "Robot vacuums became our initial focus due to their need to cover every inch of indoor surfaces, making them ideal for mapping," Dalal said. "Moreover, the floor-cleaning robot market was ripe for innovation." [...] "Matic was inspired by busy working parents who want to live in a tidy home, but don't want to spend their limited free time cleaning," Dalal said. "It's the first fully autonomous floor cleaning robot that continuously learns and adapts to users' cleaning preferences without ever compromising their privacy."

There are a lot of bold claims in that statement. But on the subject of privacy, Matic does indeed -- or at least claims to -- ensure data doesn't leave a customer's home. All processing happens on the robot (on hardware "equivalent to an iPhone 6," Dalal says), and mapping and telemetry data is saved locally, not in the cloud, unless users opt in to sharing. Matic doesn't even require an internet connection to get up and running -- only a smartphone paired over a local Wi-Fi network. The Matic vacuum understands an array of voice commands and gestures for fine-grained control. And -- unlike some robot vacuums in the market -- it can pick up cleaning tasks where it left off in the event that it's interrupted (say, by a wayward pet). Dalal says that Matic can also prioritize areas to clean depending on factors like the time of day and nearby rooms and furniture.
Dalal insists that all this navigational lifting can be accomplished with cameras alone. "In order to run all the necessary algorithms, from 3D depth to semantics to ... controls and navigation, on the robot, we had to vertically integrate and hyper-optimize the entire codebase," Dalal said, "from the modifying kernel to building a first-of-its-kind iOS app with live 3D mapping. This enables us to deliver an affordable robot to our customers that solves a real problem with full autonomy."

The robot won't be cheap. It starts at $1,795 but will be available for a limited time at a discounted price of $1,495.
Facebook

Facebook and Instagram To Offer Subscription for No Ads in Europe (fb.com) 69

Meta, in a blog post: To comply with evolving European regulations, we are introducing a new subscription option in the EU, EEA and Switzerland. In November, we will be offering people who use Facebook or Instagram and reside in these regions the choice to continue using these personalised services for free with ads, or subscribe to stop seeing ads. While people are subscribed, their information will not be used for ads.

People in these countries will be able to subscribe for a fee to use our products without ads. Depending on where you purchase it will cost $10.5/month on the web or $13.75/month on iOS and Android. Regardless of where you purchase, the subscription will apply to all linked Facebook and Instagram accounts in a user's Accounts Center. As is the case for many online subscriptions, the iOS and Android pricing take into account the fees that Apple and Google charge through respective purchasing policies.

Privacy

iPhones Have Been Exposing Your Unique MAC Despite Apple's Promises Otherwise (arstechnica.com) 69

Dan Goodin reports via Ars Technica: Three years ago, Apple introduced a privacy-enhancing feature that hid the Wi-Fi address of iPhones and iPads when they joined a network. On Wednesday, the world learned that the feature has never worked as advertised. Despite promises that this never-changing address would be hidden and replaced with a private one that was unique to each SSID, Apple devices have continued to display the real one, which in turn got broadcast to every other connected device on the network. [...]

In 2020, Apple released iOS 14 with a feature that, by default, hid Wi-Fi MACs when devices connected to a network. Instead, the device displayed what Apple called a "private Wi-Fi address" that was different for each SSID. Over time, Apple has enhanced the feature, for instance, by allowing users to assign a new private Wi-Fi address for a given SSID. On Wednesday, Apple released iOS 17.1. Among the various fixes was a patch for a vulnerability, tracked as CVE-2023-42846, which prevented the privacy feature from working. Tommy Mysk, one of the two security researchers Apple credited with discovering and reporting the vulnerability (Talal Haj Bakry was the other), told Ars that he tested all recent iOS releases and found the flaw dates back to version 14, released in September 2020. "From the get-go, this feature was useless because of this bug," he said. "We couldn't stop the devices from sending these discovery requests, even with a VPN. Even in the Lockdown Mode."

When an iPhone or any other device joins a network, it triggers a multicast message that is sent to all other devices on the network. By necessity, this message must include a MAC. Beginning with iOS 14, this value was, by default, different for each SSID. To the casual observer, the feature appeared to work as advertised. The "source" listed in the request was the private Wi-Fi address. Digging in a little further, however, it became clear that the real, permanent MAC was still broadcast to all other connected devices, just in a different field of the request. Mysk published a short video showing a Mac using the Wireshark packet sniffer to monitor traffic on the local network the Mac is connected to. When an iPhone running iOS prior to version 17.1 joins, it shares its real Wi-Fi MAC on port 5353/UDP.

Security

Hackers Can Force iOS and macOS Browsers To Divulge Passwords (arstechnica.com) 29

Researchers have devised an attack that forces Apple's Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices. From a report: iLeakage, as the academic researchers have named the attack, is practical and requires minimal resources to carry out. It does, however, require extensive reverse-engineering of Apple hardware and significant expertise in exploiting a class of vulnerability known as a side channel, which leaks secrets based on clues left in electromagnetic emanations, data caches, or other manifestations of a targeted system. The side channel in this case is speculative execution, a performance enhancement feature found in modern CPUs that has formed the basis of a wide corpus of attacks in recent years. The nearly endless stream of exploit variants has left chip makers -- primarily Intel and, to a lesser extent, AMD -- scrambling to devise mitigations.

The researchers implement iLeakage as a website. When visited by a vulnerable macOS or iOS device, the website uses JavaScript to surreptitiously open a separate website of the attacker's choice and recover site content rendered in a pop-up window. The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox -- when a target is logged in -- and a password as it's being autofilled by a credential manager. Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.

Games

Google Play Games for PC is Getting Support for 4K and Some Console Game Controllers (theverge.com) 13

Google is adding some new features to the Google Play Games Beta on PC, its service that lets you play Android games on a PC, including support for 4K screen resolution on "supported monitors" and for popular console gaming controllers. From a report: Google detailed the updates in a blog post from Arjun Dayal, Google Play Games' director of product. With the new support for 4K, you can now pick your screen resolutions while in game. "Simply press Shift + Tab in any game to select from a menu of supported resolutions," according to Dayal. The game controllers that are now supported include the Xbox Series X / S controller, the Xbox One controller, Sony's DualSense controller for PS5, and its DualShock controller for PS4. Google isn't the only company that's making it easier to use your other controllers on its platform; Apple added iOS support for the DualSense and Xbox Series X controllers with iOS 14.5, while Valve rolled out DualSense support in Steam in 2020.
AI

Inside Apple's Big Plan to Bring Generative AI To All Its Devices (bloomberg.com) 52

An anonymous reader shares a report: Apple was caught flat-footed when ChatGPT and other AI tools took the technology industry by storm. But the company is now preparing its response and plans to develop features for its full range of devices. One of the most intense and widespread endeavors at Apple right now is its effort to respond to the AI frenzy sweeping the technology industry. The company has some catching up to do. Apple largely sat on the sidelines when OpenAI's ChatGPT took off like a rocket last year. It watched as Google and Microsoft rolled out generative AI versions of their search engines, which spit out convincingly human-like responses to users' queries. Microsoft also updated its Windows apps with smarter assistants, and Amazon unveiled an AI-enhanced overhaul of Alexa. All the while, the only noteworthy AI release from Apple was an improved auto-correct system in iOS 17.

Apple's senior vice presidents in charge of AI and software engineering, John Giannandrea and Craig Federighi, are spearheading the effort. On Cook's team, they're referred to as the "executive sponsors" of the generative AI push. Eddy Cue, the head of services, is also involved, I'm told. The trio are now on course to spend about $1 billion per year on the undertaking. Giannandrea is overseeing development of the underlying technology for a new AI system, and his team is revamping Siri in a way that will deeply implement it. This smarter version of Siri could be ready as soon as next year, but there are still concerns about the technology and it may take longer for Apple's AI features to spread across its product line. Federighi's software engineering group, meanwhile, is adding AI to the next version of iOS. There's an edict to fill it with features running on the company's large language model, or LLM, which uses a flood of data to hone AI capabilities. The new features should improve how both Siri and the Messages app can field questions and auto-complete sentences, mirroring recent changes to competing services.

Slashdot Top Deals