MacRumors

Senior FBI forensic examiner Stephen R. Flatley spoke at the International Conference on Cyber Security yesterday, and during the talk he discussed Apple and the FBI's differing opinions on the topic of smartphone encryption. According to Motherboard, Flatley described the company as "jerks" and "evil geniuses" for creating iOS device encryption that is so powerful as to prevent Apple itself from entering users' iPhones.

Flatley said that recent updates to Apple device encryption have made password guesses slower, by increasing hash iterations from 10 thousand to 10 million, "making his and his colleagues' investigative work harder." This extended brute force crack time from a few days to two months, leading to Flatley stating that Apple is "pretty good at evil genius stuff." No detailed context was given regarding his "jerks" comment.

That means, he explained, that “password attempts speed went from 45 passwords a second to one every 18 seconds,” referring to the difficulty of cracking a password using a “brute force” method in which every possible permutation is tried. There are tools that can input thousands of passwords in a very short period of time—if the attempts per minute are limited, it becomes much harder and slower to crack.

"Your crack time just went from two days to two months," Flatley said. “At what point is it just trying to one up things and at what point is it to thwart law enforcement?" he added. "Apple is pretty good at evil genius stuff."

Flatley's comments come nearly two years after the Apple-FBI dispute began, when a federal judge ordered Apple to help the FBI enter the iPhone owned by Syed Farook, one of the shooters in the December 2015 attacks in San Bernardino. The FBI said it wanted Apple's help to enter just Farook's iPhone 5c, but Apple explained that the software it was asked to create could become a "master key" and be able to get information from any iPhone or iPad.

For this reason, Apple denied the request and CEO Tim Cook penned an open letter describing the potential for setting a "dangerous precedent" if the company did go along with the order. The battle eventually ended a few months later after the government discovered an alternative way of entering Farook's iPhone 5c, reportedly with the help of Israeli firm Cellebrite.

Flately mentioned Cellebrite as well during the security conference, describing the firm as "another evil genius" that counters Apple's encryption and can help the FBI when it needs to enter a smartphone. The forensic examiner was described as not clearly stating Cellebrite's name, but "facetiously coughing" at the same time to somewhat obscure the comment.

Although the Apple-FBI dispute has ended, debates over smartphone encryption have remained ongoing the past few years. In October 2017, a report came out stating that the FBI was unable to retrieve data from 6,900 mobile devices it had attempted to gain access to over the previous 11 months. That number accounted for half of the total devices the FBI tried to get into, and FBI Director Christopher Wray described the FBI's inability to retrieve information from these devices as a "huge, huge problem."

At the end of the case in 2016, Apple issued a statement explaining that the company will continue to assist the FBI when it can, but not at the expense of the data protection, security, and privacy of its customers: "Apple believes deeply that people in the United States and around the world deserve data protection, security, and privacy. Sacrificing one for the other only puts people and countries at greater risk."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

iPhone 6 Plus users hoping to take advantage of Apple's discounted $29 battery replacements may have to wait a few months.

Apple says iPhone 6 Plus replacement batteries are in short supply and won't be available until late March to early April in the United States and other regions, according to an internal document distributed to Apple Stores and Apple Authorized Service Providers this week and later obtained by MacRumors.

Apple's internal document quotes a shorter wait of "approximately two weeks" for iPhone 6 and iPhone 6s Plus battery replacements, and adds that batteries for all other models like the iPhone 6s, iPhone 7, iPhone 7 Plus, and iPhone SE are expected to be available "without extended delays" in most countries.

Apple noted that lead times may vary in some regions, including the Middle East, Africa, Latin America, Russia, and Turkey.

MacRumors has already received a few emails from readers with an iPhone 6 Plus who were quoted a late March to early April timeframe for the replacement service to be completed at Apple Stores in New York and North Carolina, in line with the information outlined in Apple's document.

A reliable source at an Apple Authorized Service Provider indicated that they recently received a package with dozens of replacement batteries, the majority of which were for iPhone 7 and iPhone 7 Plus models.

Apple lowered its battery replacement fee to $29 last month for any customer with an iPhone 6 or newer as part of an apology over its lack of transparency about slowing down some older iPhone models to prevent unexpected shutdowns. Apple noted that initial supplies of some batteries may be limited.

As with any supply-demand situation, availability of replacement batteries will likely vary by location. Keep in mind that many Apple Authorized Service Providers like MacMedics and ComputerCare are able to replace iPhone batteries, so this may be an option worth considering beyond an Apple Store.

A source adds that Apple Authorized Service Providers are permitted to set their own prices for out-of-warranty parts and repairs, so some third-party repair shops are charging more than $29 for battery replacements, even if Apple might not prefer it, to ensure they are being fairly compensated.

Also keep in mind that Apple's discounted rate is available until December 31, 2018, so unless you absolutely need a battery replacement now, you may wish to consider waiting until later in the year to initiate the process.

If you are replacing your iPhone's battery for the first time, the $29 price is available regardless of whether the device passes or fails Apple's battery diagnostic test. To be eligible for any additional replacements at the discounted rate, however, the device must explicitly fail the test or the standard $79 applies.

To get started, read our guide on how to get your iPhone's battery replaced with an appointment at an Apple Store or Apple Authorized Service Provider. There's also a mail-in option, but we've heard that Apple's repair center may only be replacing batteries that fail a diagnostic test, and sending back devices that pass.

Apple's Tim Cook on Wednesday joined over 100 other CEOs in urging the U.S. Congress to pass a bill to protect young immigrants before the Deferred Action for Childhood Arrivals (DACA) program expires. For those unfamiliar with the program, DACA gives about 800,000 illegal immigrants who entered the U.S. at age 16 or younger work permits and protection from deportation by two-year deferral. Many of those protected by DACA have been in the United States for most of their lives.

In an open letter to House and Senate leaders, the group called on lawmakers to introduce legislation supporting so-called Dreamers by Friday, which is the deadline for Congress to pass a bill for government funding to avert a shutdown. The DACA program actually expires on March 5, but the CEO signatories say the government needs time to implement a new program before that deadline.

"We write to urge Congress to act immediately and pass a permanent bipartisan legislative solution to enable Dreamers who are currently living, working, and contributing to our communities to continue doing so," the letter reads. "The imminent termination of the DACA program is creating an impending crisis for workforces across the country."

Facebook's Mark Zuckerberg, Microsoft president Brad Smith, Amazon’s Jeff Bezos, and Verizon CEO Lowell McAdam were additional signatories of the letter, which cited a CATO Institute study that found ending the DACA program could cause a $215 billion decline in the gross domestic product.

"In addition to causing a tremendous upheaval in the lives of DACA employees, failure to act in time will lead to businesses losing valuable talent, cause disruptions in the workforce, and will result in significant costs," the group wrote. "While delay or inaction will cause significant negative impact to businesses, hundreds of thousands of deserving young people across the country are counting on you to work in a bipartisan way to pass permanent legislative protection for Dreamers without further delay."

Tim Cook has been consistent in his support for a legislative solution to protect those affected by the end of the DACA program. Following U.S. President Donald Trump's September announcement that DACA would be phased out over six months, Cook sent an email to employees saying Apple would try to help Congress find a solution and would be working with impacted Apple employees to provide support, including access to immigration experts. Apple employs 250 "Dreamers", Cook previously revealed in a tweet.

In December, Cook teamed up with Koch Industries CEO Charles Koch to write an opinion piece in The Washington Post about DACA, asking Congress to work quickly to come up with a solution before the end of the year. That never happened, and the government's stance on the issue now appears to be mired in confusion.

On Tuesday, a federal judge in California issued a nationwide injunction ordering the Trump administration to maintain the DACA program on a nationwide basis while legal challenges to the president's decision go forward.

In another development this week, concerns grew among hardliners after Trump met with lawmakers during a freewheeling televised session, in which he signaled he was open to compromise and seemed to express support for a number of legislative options to legalize Dreamers.

Indeed, the president appeared to suggest that the details of a legislative solution didn't matter to him, telling congressional leaders that he would approve whatever they sent him. "I will be signing it," Trump said towards the end of the meeting. "I'm not going to say, 'Oh, gee, I want this or I want that.' I'll be signing it."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple's announcement on Wednesday that its iCloud services in mainland China will be handed over to a Chinese company has already run into controversy, after it emerged that accounts registered overseas are being swept up in the migration.

Apple said yesterday that customers based in China had been contacted and advised to examine new terms and conditions, which include a clause that both Apple and the Chinese firm will have access to all data stored on iCloud servers, which will be transferred from February 28. Customers living in mainland China who did not want to use iCloud operated by GCBD had been given the option to terminate their account.

However, according to some users who spoke to TechCrunch, in the data to be handled by local partner Guizhou-Cloud Big Data (GCBD), Apple is including iCloud accounts that were opened in the U.S., are paid for using U.S. dollars, and/or are connected to U.S.-based App Store accounts.

When asked for comment, Apple pointed to its terms and conditions site, which explains that it is migrating iCloud accounts based on the settings of the user's device, not where an iCloud account is registered or billed to.

The operation of iCloud services associated with Apple IDs that have China in their country or region setting will be subject to this transition. You will be notified of this transition via email and notifications on your devices. You don’t need to take any further action and can keep using iCloud in China.

After February 28, 2018, you will need to agree to the terms and conditions of iCloud operated by GCBD to keep using iCloud in China.

As it stands, this could result in thousands of users temporarily living in China to study or work having their data migrated to servers under the control of GCBD, which is owned by the Guizhou provincial government in southern China.

The situation is said to have left many users feeling trapped into the migration, but one user has discovered an apparent opt-out. This involves switching an iCloud account back to China before signing out of all devices. The user then switches their iPhone and iCloud settings to the U.S., and after signing back into iCloud, their account should no longer be part of the migration.

"What will Apple do when the Chinese authorities request a backdoor to access data that is encrypted?" Charlie Smith, founder of censorship monitoring site Great Fire, told TechCrunch. "Will they continue to adhere to local laws and regulations and submit to the request? Or are they leaving this decision squarely in the hands of GCBD, their local partner?"

Updated: Apple says a very small number of customers whose Apple ID country is not China received this notice by mistake, as noted by TechCrunch. Apple says no changes have been made to these users' iCloud accounts.

You recently received an email from us notifying you about an upcoming change for iCloud services in China. This email was sent in error. No changes have been made to your iCloud account.

We are very sorry that you received this email. This email was intended only for customers whose Apple ID country is China. A very small number of our customers who Apple ID country is not China also received this email by mistake.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple has been snapping up multiple TV shows in recent months, and its newest straight-to-series order is for a drama called "See," which was written by "Peaky Blinders" creator Steven Knight and will be directed by Francis Lawrence, known for his work on "The Hunger Games: Catching Fire" and "Mockingjay."

According to Deadline, the show is an epic world-building drama set in the future.

Little additional information is available on the series at this time, but it comes from Peter Chernin's Chernin Entertainment and Endeavor Content, which are also behind "Are You Sleeping" another upcoming Apple TV show.

"See" joins several other scripted TV shows that Apple has in the works, including a revival of 1985 Steven Spielberg sci-fi series "Amazing Stories," an untitled space drama developed by Ronald D. Moore, known for "Battlestar Galactica," an untitled "morning show drama" starring Reese Witherspoon and Jennifer Aniston, and "Are You Sleeping," a psychological thriller starring Octavia Spencer that focuses on a podcast that reopens a murder case.

Apple has also inked a deal for a docuseries called "Home," which will offer a never-before-seen look inside some of the world's most extra ordinary houses.

Apple has been aggressively pursuing original content since June of 2017, which is when it hired former Sony executives Zack Van Amburg and Jamie Erlicht to form a new video unit. Van Amburg and Erlicht, who produced shows like "Breaking Bad," "The Crown," and "Better Call Saul," are running Apple's video programming efforts on a worldwide scale under iTunes chief Eddy Cue.

It's not yet clear when the first of Apple's original TV shows will premiere, but it's possible at least one series will debut later in 2018.

Apple recently began selling the Linksys Velop Mesh Wi-Fi System both online and in its retail stores, marking the first router the company has offered aside from its own rather outdated AirPort Extreme, AirPort Express, and AirPort Time Capsule.

Apple has not updated the AirPort Time Capsule or the AirPort Extreme since June of 2013, and it's been even longer since the AirPort Express was last updated -- 2012. A late 2016 rumor even suggested Apple had stopped development on its line of AirPort base stations entirely, disbanding its AirPort team and moving engineers to other projects.

Though Apple has not updated the AirPort line in years and is now selling a third-party WiFi system, the company appears to be planning to continue to offer AirPort options for the foreseeable future. In a statement provided to 9to5Mac, an Apple spokesperson said the Linksys Velop is an option being provided to people with larger homes alongside the AirPort.

People love our AirPort products and we continue to sell them. Connectivity is important in the home and we are giving customers yet another option that is well suited for larger homes.

While Apple is continuing to offer its AirPort base stations for now, the devices won't last forever sans update. Given Apple's move to sell a third-party Wi-Fi product, it's looking like the company does not have plans to update the lineup going forward.

The AirPort base stations provide several unique benefits that are not available with third-party options like built-in Time Machine backup support in the Time Capsule and AirPlay functionality for the AirPort Express. It's possible Apple has plans to incorporate these features and Wi-Fi networking functionality into a future product, but if so, there are no rumors suggesting that's the case at this point.

The Linksys Velop that Apple is offering is designed to create a tri-band high-range mesh network able to provide a strong Wi-Fi signal throughout the home, putting an end to areas where Wi-Fi signal is weak. The Velop consists of multiple Nodes used to create an extended Wi-Fi network. Each of the Nodes is able to increase Wi-Fi range by up to 2,000 square feet, and because it increases range wirelessly, there are no wires to deal with.

Apple sells the Velop in two configurations, with either two or three nodes, for $349 or $499.

The last major CES 2018 event, ShowStoppers, took place last night and there were hundreds of companies showing off their newest wares. Much of what was at ShowStoppers was available at other shows, so MacRumors videographer Dan hunted down some of the more obscure and interesting products that were being demoed this time around.

First up was the Nanoleaf Remote, which is designed to work with the Nanoleaf Light Panels and other HomeKit accessories. The Nanoleaf Remote is a dodecahedron with built-in LEDs and support for touch gestures to activate scenes. Each side represents a different HomeKit scene, and whichever side is facing upwards is the scene that's displayed. It's a nifty little accessory that will be available for $50 later this year.

For kids, the Playbrush attaches to any manual toothbrush and turns brushing into a game, while a new game, Beasts of Balance, turns real-world towers into fantasy worlds on your iPad. It's a sort of modern-day Jenga with appealing visuals and a fun digital component.

Gaming company GameSir was demoing a customizable controller for iOS devices with a trackpad and a unique button layout, Neo, a company that makes smart pens, was showing off its latest offering, and audio company iZotope demoed its Spire Studio, designed to allow musicians to mix and record music while on the go.

Make sure to stay tuned to MacRumors for additional CES coverage, because we're hitting up the show floor over the course of the next couple of days. We're highlighting new products and accessories relevant to Apple users over the course of the week, so check out our CES 2018 hub to see all of our coverage.

A bug report submitted on Open Radar this week has revealed a security flaw in the current version of macOS High Sierra that allows the App Store menu in System Preferences to be unlocked with any password.

MacRumors is able to reproduce the issue on macOS High Sierra version 10.13.2, the latest public release of the operating system, on an administrator-level account by following these steps:

• Click on System Preferences.
• Click on App Store.
• Click on the padlock icon to lock it if necessary.
• Click on the padlock icon again.
• Enter your username and any password.
• Click Unlock.

As mentioned in the radar, we can confirm that the App Store preferences login prompt does not accept an incorrect password with a non-administrator account, meaning there is no behaviour change for standard user accounts.

We also weren't able to bypass any other System Preferences login prompts with an incorrect password, with any type of account, so more sensitive settings such as Users & Groups and Security & Privacy are not exposed by this bug.

Apple has fixed the bug in the latest beta of macOS 10.13.3, which currently remains in testing and will likely be released at some point this month. The bug doesn't exist in macOS Sierra version 10.12.6 or earlier.

On the current macOS 10.13.2, the bug gives anyone with physical, administrator-level access to a Mac the ability to disable settings related to automatically installing macOS software, security, and app updates.

This is the second password-related bug to affect macOS High Sierra in as many months, following a major security vulnerability that enabled access to the root superuser account with a blank password on macOS High Sierra version 10.13.1 that Apple fixed with a supplemental security update.

Following the root password vulnerability, Apple apologized in a statement and added that it was "auditing its development processes to help prevent this from happening again," so this is a rather embarrassing mishap.

We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.

It's worth noting that the App Store preferences are unlocked by default on administrator accounts, and given the settings in this menu aren't overly sensitive, this bug is not nearly as serious as the earlier root vulnerability.

Apple will likely want to fix this bug sooner rather than later, so it's possible we'll see a similar supplemental update released at some point, or perhaps it will fast track the release of macOS High Sierra version 10.13.3. Apple did not immediately respond to our request for comment on this matter.

In the meantime, if you keep your App Store preferences behind lock, you'll want to be more diligent in ensuring that you log out of your administrator account when you are away from your Mac. Alternatively, until macOS 10.13.3 is released, users can use a standard account rather than an administrator one.

While this bug isn't as dangerous as the root password vulnerability, being able to bypass a login prompt with any password is something that obviously shouldn't be possible and is an embarrassing oversight for Apple.

Private and secure messaging app Confide is gaining an interesting new feature that will successfully prevent its users from taking a screenshot within the app, and the team behind Confide is also planning to release the anti-screenshot technology as an SDK that can be used by other app developers.

Called ScreenShieldKit, the new SDK prevents screenshots, screen recording, QuickTime recording, Screen mirroring, Xcode screenshots, and viewing an app's contents in the App Switcher on both the iPhone and the iPad.

There is no dedicated API to stop screenshots from being taken in iOS like there is in Android, so ScreenShieldKit is using a whiteout feature instead. In an app that has ScreenShieldKit enabled, screenshots taken are a blank aside from a single status bar at the top. The same goes for recordings.

Apple does have a feature that prevents screenshots from being taken in apps that stream video content from a server, such as Netflix and iTunes, but since Confide does not stream from a server, Confide's developers tell us it took quite a bit of tweaking and work to develop ScreenShieldKit.

The Confide team used a "collection of technologies" to get ScreenShieldKit to work, and they believe they're the first to come up with this screenshot proofing concept on iOS devices. ScreenShieldKit uses only public APIs, and no private APIs, and it's a seamless experience for end users.

The current version of the Confide confidential messaging app already protects against screenshots by revealing just one line of text at a time, but the new ScreenShield feature is being implemented into the app to provide even more robust screenshot protection.

In the Confide app, ScreenShield will make it so any screenshot captured will show no message content. Confide also already uses end-to-end encryption and erases messages after they've been viewed to provide a secure messaging platform.

While Confide's ScreenShield feature will prevent on-device screenshots, there is, of course, no way to stop people from taking a photo of an iPhone's screen with a secondary device. Still, for on-device use, it's a solid solution that many developers may be interested in adopting.

Confide is offering the ScreenShieldKit feature to developers, with more information available on the ScreenShieldKit website.

The Confide app, with ScreenShield built in, can be downloaded from the App Store for free. [Direct Link]