MacRumors

Apple paid out $75,000 to a hacker for identifying multiple zero-day vulnerabilities in its software, some of which could be used to hijack the camera on a MacBook or an iPhone, according to Forbes.

A zero-day vulnerability refers to a security hole in software that is unknown to the software developer and the public, although it may already be known by attackers who are quietly exploiting it.

Security researcher Ryan Pickren reportedly discovered the vulnerabilities in Safari after he decided to "hammer the browser with obscure corner cases" until it started showing weird behavior.

The bug hunter found seven exploits in all. The vulnerabilities involved the way that Safari parsed Uniform Resource Identifiers, managed web origins and initialized secure contexts, and three of them allowed him to get access to the camera by tricking the user to visit a malicious website.

"A bug like this shows why users should never feel totally confident that their camera is secure," Pickren said, "regardless of operating system or manufacturer."

Pickren reported his research through Apple's Bug Bounty Program in December 2019. Apple validated all seven bugs immediately and shipped a fix for the camera kill chain a few weeks later. The camera exploit was patched in Safari 13.0.5, released January 28. The remaining zero-day vulnerabilities, which Apple judged to be less severe, were patched in Safari 13.1, released on March 24.

Apple opened its bug bounty program to all security researchers in December 2019. Prior to that, Apple's bug bounty program was invitation-based and non-iOS devices were not included. Apple also increased the maximum size of the bounty from $200,000 per exploit to $1 million depending on the nature of the security flaw.

When submitting reports, researchers must include a detailed description of the issue, an explanation of the state of the system when the exploit works, and enough information for Apple to reliably reproduce the issue.

This year, Apple plans to provide vetted and trusted security researchers and hackers with "dev" iPhones, or special iPhones that provide deeper access to the underlying software and operating system that will make it easier for vulnerabilities to be discovered.

These iPhones are being provided as part of Apple's forthcoming iOS Security Research Device Program, which aims to encourage additional security researchers to disclose vulnerabilities, ultimately leading to more secure devices for consumers.

Apple has added an anti-eavesdropping feature to the 2020 iPad Pro that ensures the microphone hardware is disabled when a case is attached to the iPad and closed.

The security feature was first introduced in 2018 in MacBook models using Apple's T2 security chip, which includes a hardware microphone disconnect feature that disables the mics when the notebook's lid is closed.

As spotted by 9to5Mac, an updated version of Apple's Platform Security document makes clear that the anti-eavesdropping is also available on all 2020 ‌iPad Pro‌ models when using an MFi-compliant case.

iPad models beginning in 2020 also feature the hardware microphone disconnect. When an MFi compliant case (including those sold by Apple) is attached to the iPad and closed, the microphone is disconnected in hardware, preventing microphone audio data being made available to any software—even with root or kernel privileges in iPadOS or in case the firmware is compromised.

Apple updated the 11-inch and 12.9-inch ‌iPad Pro‌ models last month with a faster A12Z Bionic chip, a new 10MP Ultra Wide camera to complement the traditional 12MP camera, and a LiDAR depth scanner for improved augmented reality experiences.

For some 2018 ‌iPad Pro‌ owners at least, these updates are relatively modest, but the new security features outlined in Apple's documentation may be enough to tempt more privacy-conscious users.

Apple today informed employees that its Apple retail stores in the United States will remain closed until early May, and Apple employees will continue to work from home until then.

In a memo to employees, excerpts of which were shared by Bloomberg, Apple's retail chief Deirdre O'Brien said that Apple is "continuing to monitor local conditions for every Apple facility on a daily basis" and that reopening decisions will be made on after "thorough, thoughtful reviews and the latest guidance from local governments and public health experts."

For now, Apple's flexible work arrangements "will remain in place for all offices, and all retail stores will remain closed, until early May."

In Santa Clara County, where Apple Park, Infinite Loop, and many other corporate offices and retail stores are located, there is a shelter in place order that will remain in effect until May 3. It prevents all nonessential businesses from being open and requires employees to work from home. Apple's corporate offices will not be able to reopen until that order is lifted.

According to O'Brien, Apple is "working on options" to ensure that parents have the flexibility to adjust their schedules as necessary as many are also looking after children who are no longer able to school.

Apple had previously planned to begin reopening some stores in the first half of April, and that could still be the plan for some of its stores outside of the U.S. At the current time, all stores outside of China are closed and have been shuttered since March 14.

Another clue has surfaced to suggest that Apple's rumored lower-cost iPhone SE successor will likely be released soon.

Earlier today, a product listing for a Belkin screen protector on Apple's online store was updated to reflect compatibility with not only the iPhone 7 and iPhone 8, but also the iPhone SE. Given the original iPhone SE was a 4-inch device, and the iPhone 7 and iPhone 8 are 4.7-inch devices, this is likely a reference to the rumored 2020 model of the iPhone SE.

The product listing does not reveal any further details about the device, which was previously dubbed the iPhone SE 2 or iPhone 9, beyond supporting rumors that it will have a 4.7-inch display. The device is also expected to have an A13 chip, 3GB of RAM, and 64GB to 256GB of storage, with pricing estimated to start around $399 in the United States.

MacRumors reader Gijs Van Laer alerted us to this product listing earlier today and it has since been shared by Aaron Zollo and others on Twitter.

Apple's new low-cost iPhone is set to launch as early as Friday, April 3, according to a new report from 9to5Mac that cites a tip from a "highly trusted reader." The site says that while it can't be certain about the launch date, "Apple could reveal and begin taking orders for the new ‌iPhone‌ as soon as tomorrow."

Apple is said to be planning to call the new ‌iPhone‌, which is expected to be priced somewhere around $399, the "‌iPhone‌ SE" just like the 2016 ‌iPhone‌ SE, which was also positioned as a low-cost device.

The 2020 ‌iPhone‌ SE is expected to come in white, black, and PRODUCT(Red) color options, and Apple will offer 64, 128, and 256GB storage capacities.

Prior rumors have suggested that the low-cost 2020 ‌iPhone‌ SE will be identical to the 4.7-inch ‌iPhone‌ 8 when it comes to design, featuring thick top and bottom bezels and a Touch ID Home button. It will have a single-lens rear camera, NFC support, and the same A13 chip that's in the ‌iPhone‌ 11 and 11 Pro.

Today is Autism Acceptance Day, and as it has done in the past, Apple is recognizing the occasion by highlighting top apps, accessibility tips, and education resources, while also sharing art created by individuals on the spectrum.

In the Today section of the App Store, Apple is offering a collection of apps that are designed to support neurodiversity and people with autism spectrum disorder.

These apps include Proloquo2Go for those who can't speak or need help being understood, Speech Blubs language therapy app, Streaks to-do app, Calm meditation app, and more.

Apple has dozens of apps that can be accessed through the Autism Acceptance section of the App Store, organized into categories like Communication, Life Skills, Games and entertainment, and Apple Watch tools.

To assist with remote learning, Apple Education is offering support resources for teachers and parents, including one-on-one virtual coaching sessions with Apple Professional Learning Specialists. There's also a collection of Learn and Study From Home apps that families can take advantage of, and Apple's website has a section on customizing the iPad to make learning more accessible.

In addition to these resources, throughout the month of April, Apple will celebrate artistic talent from individuals on the spectrum, highlighting their art and sources of inspiration.

Apple is collaborating with the Art of Autism nonprofit for a "Created on iPad" online exhibit that features 15 emerging artists who identify as autistic.

Apple also plans to feature Kayla Cromer, who stars in Freeform comedy show "Everything's Gonna Be Okay." Cromer is one of the first people on the spectrum to play the role of a character on the spectrum in a major series, and she will share films that have inspired her passion for acting.

Apple has accidentally referenced its widely rumored AirTags item tracking tags in a video that it uploaded to its Apple Support channel on YouTube today. The video was first spotted by the blog Appleosophy and has quickly been removed.

The video was titled "How to erase your iPhone." AirTags were mentioned in Settings > Apple ID > Find My > Find My iPhone under Enable Offline Finding, with fine print indicating that "offline finding enables this device and AirTags to be found when not connected to Wi-Fi or cellular."

AirTags will compete with Tile, helping users keep track of their personal belongings, such as their keys, wallets, and backpacks.

MacRumors uncovered evidence of AirTags within iOS 13 code last year. The tags will be closely integrated with the new Find My app, which will be getting an "Items" tab. Users will receive a notification when they are separated from a tagged item, and if necessary, they can set an AirTag to start making sounds to help locate the lost item.

MacRumors shared exclusive screenshots of the under-development "Items" tab with AirTags (codenamed "B389") integration in the Find My app last year:

In January, analyst Ming-Chi Kuo said AirTags were slated to launch in the first half of 2020 with Ultra Wideband support, but this timeframe could have changed since then.

The popular video conferencing company Zoom has been under scrutiny over the past few days for the method used to install the Mac version of its app, which essentially abused a "preflight" compatibility check to install the app without the user needing to explicitly grant installation permission, as highlighted by developer Felix Seele earlier this week.

Zoom CEO Eric Yuan responded to Seele, noting that while the installation method was "implemented to balance the number of clicks given the limitations of the standard technology," he recognized the issue and promised to "continue to improve."

Zoom has now updated its Mac app installer to no longer use the preflight installation method, instead using a traditional installation authorization process, as noted by The Verge.

“They completely removed the preinstall stuff, so you now need to click through the installer as it ought to be,” explains Seele in a message to The Verge. The fake prompt has also been removed so users have to specifically click through and install Zoom. “I must say that I am impressed,” says Seele. “I expected them to maybe change the dialog, but since the ‘zero-click’ aspect was so important to them, I thought they would stick with the preinstall-trick.”

The Mac app installation issue is hardly Zoom's first controversy, with the company seeing increased attention as its popularity has boomed amid self-isolation. Other recent controversies over just the past week have included its integration with a Facebook SDK that was sending Zoom user data to Facebook and misleading claims of end-to-end encryption.

The U.S. Patent and Trademark Office today published a new Apple patent application that describes a facial recognition system like Face ID being used to automatically update the orientation of a device like an iPhone or iPad, as noted by AppleInsider.

The patent notes that the portrait or landscape orientation of a mobile device is currently determined using accelerometers or other sensors that determine the position of the device relative to gravity. However, this does not always work perfectly, forcing the user to move the device to get content to display in the proper orientation.

Face ID would be a solution to this issue, with the patent explaining that the position of a user's face would be detected and automatically switch an iPhone or iPad into portrait or landscape orientation as necessary.

Face ID orientation could greatly reduce the need to enable Portrait Orientation Lock. There are many settings where this could be particularly useful, such as when using an iPhone or iPad on a flat surface or while laying in bed.

"I love using my phone in bed, so my rotation is usually locked so it doesn't change to landscape on everything," wrote Reddit user ProTomahawks back in 2018. "It would be good if iOS could see which way you’re viewing your screen from so it [stopped] rotating if you're laying down. Not a big deal but a good quality of life fix."

The patent application was filed in September 2018 and published this week. Whether the idea ever comes to fruition remains to be seen.

Apple, Laurene Powell Jobs, Leonardo DiCaprio, and the Ford Foundation have partnered to launch America's Food Fund, an initiative aimed at helping to ensure that all people have reliable access to food in the United States.

The initiative is being hosted by fundraising platform GoFundMe and will benefit the non-profit hunger-relief organizations World Central Kitchen and Feeding America. Apple, Powell Jobs, DiCaprio, and the Ford Foundation have donated a combined $12 million to kickstart the fund, with further donations being accepted from the public.

World Central Kitchen is led by world-renowned chef José Andrés, who recently spoke with Oprah Winfrey and Feeding America CEO Claire Babineaux-Fontenot about this initiative on her free-to-watch Apple TV+ series "Oprah Talks COVID-19."

Apple CEO Tim Cook in a statement shared by Deadline:

No one can be well if they're not well fed, and we can only overcome this crisis if we make sure that every person has the essentials that they need to care for themselves, their families and the vulnerable people in their lives. World Central Kitchen and Feeding America do heroic work, and if there is any lesson in this time that we must spend apart, it's that we are stronger and more resilient when we support one another.

Prior to the ongoing pandemic, America's Food Fund says more than 37 million people struggled to know where their next meal might come from on a daily basis, a number that it says is now rising at an exponential rate. Donate here.

Intel today announced the launch of its latest 10th-generation Core processors for high-end notebooks, potentially including the next 16-inch MacBook Pro. The batch of 45W chips, part of the Comet Lake family, are built on Intel's 14nm++ architecture.

The new H-series chips have the same base clock speeds as the 9th-generation chips in the current 16-inch MacBook Pro, but Turbo Boost speeds now exceed 5GHz for the first time. For example, the new highest-end Core i9 chip still clocks in at 2.4GHz, but its maximum Turbo Boost frequency has increased from 5.0GHz to 5.3GHz.

Intel promotes the fact that its new Core i9 chip is the "world's fastest mobile processor" and the first to exceed the 5GHz frequency barrier. However, not everyone is impressed with the year-over-year performance improvements as a whole.

The new 10th-generation processors also support Wi-Fi 6, aka 802.11ax. The newer standard delivers faster speeds, greater network capacity, improved power efficiency, lower latency, and connectivity improvements in areas with several Wi-Fi devices. Wi-Fi 6 devices must support WPA3, a Wi-Fi security protocol with improved cryptographic strength.

Apple added Wi-Fi 6 to its latest iPhone and iPad Pro models, but the 16-inch MacBook Pro and the new MacBook Air still have Wi-Fi 5.

The existing 16-inch MacBook Pro launched in November 2019, so it is still relatively early for the notebook to receive an update. In the near term, it is more likely that the 13-inch MacBook Pro will be updated with a Magic Keyboard and faster processors, with the next 16-inch MacBook Pro refresh likely to come later in the year.

Keep in mind that last month, analyst Ming-Chi Kuo said Apple's first Mac notebooks with its own custom-designed Arm-based processors will launch in the fourth quarter of 2020 or the first quarter of 2021. Kuo said Apple plans to launch several Arm-based Macs by the end of 2021, including notebooks and desktops, marking a transition away from Intel.

Spotify now supports Siri voice commands on any Apple Watch running watchOS 6, as spotted by 9to5Mac.

With the latest version of the app, rolling out on the App Store, Apple Watch users can say "Hey Siri, play music on Spotify" or any other voice command with "on Spotify" to control Spotify playback without opening the app directly.

Spotify gained Siri support on iPhones and iPads as of iOS 13 after Apple opened up its SiriKit framework to third-party music, podcasts, audiobooks, and radio apps.

In a support document, LG has indicated that it plans to add AirPlay 2 and HomeKit support to some of its 2018 smart TVs by October 2020, including LCD models with "SK" or "UK" in the name and OLED models with "B8" through "Z8" in the name.

AirPlay 2 and HomeKit will be rolled out with a software update in most countries, with exceptions being China, Iran, Sudan, Syria, and Venezuela.

AirPlay 2 will enable users to stream videos, music, podcasts, and more directly from an iPhone, iPad, or Mac to a compatible LG smart TV, with no Apple TV necessary. And with HomeKit support, users can easily control the TV's power, volume, source, and more using Siri or the Home app on iPhone, iPad, and Mac.

LG initially said that AirPlay 2 and HomeKit would be limited to its 2019 and newer TV models since it could not "guarantee" a "seamless user experience" on older models, resulting in over 20,000 people petitioning the company to reconsider.

LG previously said that select 2018 TVs will also gain access to the Apple TV app later this year.

(Thanks, Devon!)