MacRumors

Apple has already patched serious vulnerabilities in the WPA2 Wi-Fi standard that protects many modern Wi-Fi networks, the company told iMore's Rene Ritchie this morning.

The exploits have been addressed in the iOS, tvOS, watchOS, and macOS betas that are currently available to developers and will be rolling out to consumers soon.

Using a key reinstallation attack, or "KRACK," attackers can exploit weaknesses in the WPA2 protocol to decrypt network traffic to sniff out credit card numbers, usernames, passwords, photos, and other sensitive information. With certain network configurations, attackers can also inject data into the network, remotely installing malware and other malicious software.

Because these vulnerabilities affect all devices that use WPA2, this is a serious problem that device manufacturers need to address immediately. Apple is often quick to fix major security exploits, so it is not a surprise that the company has already addressed this particular issue.

Websites that use HTTPS offer an extra layer of security, but an improperly configured site can be exploited to drop HTTPS encryption, so Vanhoef warns that this is not a reliable protection.

Apple's iOS devices (and Windows machines) are not as vulnerable as Macs or devices running Linux or Android because the vulnerability relies on a flaw that allows what's supposed to be a single-use encryption key to be resent and reused more than once, something the iOS operating system does not allow, but there's still a partial vulnerability.

Once patched, devices running iOS, macOS, tvOS, and watchOS will not be able to be exploited using the KRACK method even when connected to a router or access point that is still vulnerable. Still, consumers should watch for firmware updates for all of their devices, including routers.

Ahead of the release of the update that addresses the vulnerabilities, customers who are concerned about attacks should avoid public Wi-Fi networks, use Ethernet where possible, and use a VPN.

While the iMac Pro doesn't launch for another six weeks or so, possible benchmarks for the computer may have already surfaced on Geekbench. The results provide us with an early look at just how powerful Apple's $4,999-and-up desktop workstation will be when it is released in December.

Interestingly, the iMac Pro models benchmarked appear to have custom, downclocked Xeon chips that Intel hasn't publicly announced yet. There is a benchmark result for a model with a 3.2GHz 8-core Xeon W-2140B processor, while a third listing exists for a model with a 3.0GHz 10-core Xeon W-2150B chip.

All of the models are identified as "AAPJ1371,1," and unlike other Xeon chips, the processors have a "B" suffix. A few of the benchmark results are from late August, while the rest are from October.

MacRumors spoke with Geekbench founder John Poole, who speculated that the iMac Pro may require chips with lower thermal design power, and thus lower frequencies, due to its all-in-one form factor. He noted that the other chips in the Xeon Processor W family have relatively high TDPs of up to 140W.

The multi-core Geekbench score for the 8-core model averages out to 23,536, which is the highest performance of any iMac ever. It's nearly 22 percent faster than the latest 5K iMac equipped with a maxed-out 4.2GHz quad-core Core i7 processor, which has an average multi-core score of 19,336.

The higher-end 10-core iMac Pro has a multi-core score of 35,917, which is roughly 41 percent faster than the latest Mac Pro maxed out with a 2.7GHz 12-core Xeon E5 processor. Even its single-core score of 5,345 is faster than all but the highest-end 5K iMac released earlier this year.

All in all, the benchmarks point to the iMac Pro being unsurprisingly powerful from top to bottom. And that's not even looking at the 18-core iMac Pro, which hasn't been benchmarked yet and will surely blow every other Mac out of the water—at least until the modular Mac Pro is ready.

Apple said the iMac Pro will also feature top-of-the-line Radeon Pro Vega graphics, up to 4TB of SSD storage, and up to 128GB of ECC RAM. The computer will share the same design as the standard iMac, but with an all-flash architecture, a new thermal design, and four Thunderbolt 3 ports.

Apple today seeded the third beta of an upcoming iOS 11.1 update to developers, one week after releasing the second iOS 11.1 beta and a month after releasing the iOS 11 update to the public.

Registered developers can download the iOS 11 beta from Apple's Developer Center or over-the-air once the proper configuration profile has been installed from the Developer Center.

iOS 11.1 introduces a range of new Unicode 10 emoji like crazy face, pie, pretzel, t-rex, vampire, exploding head, face vomiting, shushing face, love you gesture, brain, scarf, zebra, giraffe, fortune cookie, pie, hedgehog, and more.

Several emoji have also seen some small design changes in iOS 11.1, including the dolphin, octopus, bee, snail, and whale characters, among others. The new designs are more detailed and realistic than existing designs.

The update also brings back the 3D Touch App Switcher gesture that has been missing from iOS 11 since its release. With the return of the gesture, iPhone users can once again 3D Touch at the left edge of the display to bring up the multitasking App Switcher interface.

A few other small features are included in the iOS 11.1 beta. The built-in keyboard in iOS 11.1 now offers up multiple emoji symbols when using an emoji-related word like "cake" or "happy," with each of the suggestions displayed at the end of the predictive text suggestions.

There's also an updated camera icon under Restrictions, a new animation when tapping the status bar to scroll upwards, and a faster unlock animation.

iOS 11 marks a major update to the operating system with systemwide design tweaks, a new Lock screen experience, a revamped Control Center, ARKit, new app features, and an entirely new interface for the iPad that includes a Dock, Drag and Drop support, and a redesigned App Switcher for better than ever multitasking.

Update: Today's beta fixes a Reachability bug that prevented the iOS 11 Cover Screen with Notifications from being accessible in the middle of the iPhone's display. Apple engineering chief Craig Federighi recently said a fix for the issue, which has been present since iOS 11 launched, would be coming soon.

Update 2: The new beta is now available for public beta testers.

VirnetX today announced that the United States District Court for the Eastern District of Texas has denied all of Apple's motions in a longstanding FaceTime-related patent lawsuit between the two companies.

The court also granted all of VirnetX's motions in the retrial and increased the royalty rates that Apple owes during the infringement period, resulting in a revised final judgment amount of $439.7 million.

"We are elated with the Court's Final Judgement of $439 million in that not only did it affirm the jury's verdict of $1.20 per infringing iPhone, iPad and Mac Product, but also added for willful infringement, interest and attorney fees. This is the third time a jury has ruled in our favor against Apple," said Kendall Larsen, VirnetX CEO.

VirnetX originally sued Apple in 2010 over allegations that FaceTime's peer-to-peer connection technology infringed upon its patents. VirnetX won its case in 2012, and Apple was hit with a $368.2 million judgment, but the appeals and retrial process has dragged on for over seven years until now.

Of note, the United States District Court for the Eastern District of Texas is a hotbed for patent infringement lawsuits given several favorable outcomes for patent holding entities like VirnetX. Some would even call the company a patent troll, although it does appear to offer at least one product of some kind.

A spokesperson for Apple confirmed that it plans to appeal this final judgment, according to TechCrunch. It noted that the motions can still be appealed even if the original case was already appealed and lost.

Just over a decade after the iPhone launched, and six years after Steve Jobs passed, some critics believe that Apple's pace of innovation has slowed. Unsurprisingly, Apple's services chief Eddy Cue doesn't share that opinion.

"I disagree vehemently with that and I think we've been incredibly innovative," said Cue, in a recent interview with Indian publication Livemint.

Cue pointed out that both the iPad and Apple Watch launched after the iPhone, while noting that revolutionary products take time. He also believes that Apple's work on Mac, macOS, and iOS has led the market.

Apple historically has a track record of coming out with industry-defining products, whether it's the Mac or iPhone or iPod. But over the past decade, there's a been perception that the pace of innovation and the pace at which Apple has come out with game-changing, breakthrough products has slowed somewhat. What do you have to say about that?

No way! First of all, the iPhone is 10 years old. That is the last decade. The iPad came after that and the Watch came after that. So, I disagree vehemently with that and I think we’ve been incredibly innovative. That doesn’t even take into account the work that has been done on the Mac, iOS and MacOS, from that standpoint where I think we’ve led the market. When you think of the products that we’ve built over time, you own a lot of them. And you just assume that every year was a new product. But it wasn’t. You can’t do revolutionary new products, every two months or six months or whatever. They take time.

The rest of the interview was primarily focused on Apple's roadmap for India, which Cue described as a "very long-term opportunity."

Cue said Apple is focused on three areas in India, including the App Store, Apple Maps, and a bundle of other services such as iCloud and Apple Music. Of note, he said Apple is "working on" bringing Apple Pay to India.

The digital payments business is widely being seen as the biggest battleground in India now and in the near future. What are Apple's plans on that front?

Our head of Apple Pay, Jennifer Bailey, is here with me. And Apple Pay is something that we definitely want in India. The challenge with payment mechanisms is that there isn't really a lot of global scale. You deal with individual markets at a time … but India is one of those markets where we hope to bring Apple Pay to.

Cue said Apple doesn't have an exact launch date to announce for Apple Pay in India at this point since it's not "a 100 percent" yet.

In the full-length interview, Cue also reflects upon the leadership styles of past and present Apple CEOs Tim Cook and Steve Jobs, and on Apple's increasing efforts to produce original content.

Mathy Vanhoef, a postdoctoral researcher at Belgian university KU Leuven, has discovered and disclosed major vulnerabilities in the WPA2 protocol that secures all modern protected Wi-Fi networks.

Vanhoef said an attacker within range of a victim can exploit these weaknesses using so-called KRACKs, or key reinstallation attacks, which can result in any data or information that the victim transmits being decrypted. Attackers can eavesdrop on network traffic on both private and public networks.

As explained by Ars Technica, the primary attack exploits a four-way handshake that is used to establish a key for encrypting traffic. During the third step, the key can be resent multiple times. When it's resent in certain ways, a cryptographic nonce can be reused in a way that completely undermines the encryption.

As a result, attackers can potentially intercept sensitive information, such as credit card numbers, passwords, emails, and photos. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

Note that the attacks do not recover the password of any Wi-Fi network, according to Vanhoef. They also do not recover any parts of the fresh encryption key that is negotiated during the four-way handshake.

Websites properly configured with HTTPS have an additional layer of protection, but an improperly configured site can be exploited to drop this encryption, so Vanhoef warned that it is not reliable protection.

Since the vulnerabilities exist in the Wi-Fi standard itself, nearly any router and device that supports Wi-Fi is likely affected, including Macs and iOS devices. Android and Linux devices are particularly vulnerable since they can be tricked into installing an all-zero encryption key instead of reinstalling the real key.

This vulnerability appears to be caused by a remark in the Wi-Fi standard that suggests to clear the encryption key from memory once it has been installed for the first time. When the client now receives a retransmitted message 3 of the 4-way handshake, it will reinstall the now-cleared encryption key, effectively installing an all-zero key.

As a proof-of-concept, Vanhoef executed a key reinstallation attack against an Android smartphone. In the video demonstration below, the attacker is able to decrypt all data that the victim transmits.

Fortunately, the vulnerabilities can be patched, and in a backwards-compatible manner. In other words, a patched client like a smartphone can still communicate with an un-patched access point like a router.

Vanhoef said he began disclosing the vulnerabilities to vendors in July. US-CERT, short for the United States Computer Emergency Readiness Team, sent out a broad notification to vendors in late August. It is now up to device and router manufacturers to release any necessary security or firmware updates.

Despite the vulnerabilities, Vanhoef says the public should still use WPA2 while waiting for patches. In the meantime, steps users can take to mitigate their threat level in the meantime include using a VPN, using a wired Ethernet connection where possible, and avoiding public Wi-Fi networks.

Vanhoef is presenting his research behind the attack at both the Black Hat Europe and Computer and Communications Security conferences in early November. His detailed research paper (PDF) is available today.

Starting in early October, Apple corporate employees in the United States began testing Apple Pay Cash internally in the iOS 11.1 beta, suggesting the person-to-person Apple Pay feature could be introduced in iOS 11.1 despite its current absence from the iOS 11.1 developer beta.

Apple has now expanded its internal Apple Pay Cash feature to its retail employees, making it available to a much wider range of people for testing purposes.

Retail employees gained access to the feature today and have been asked to install both the iOS 11.1 beta and an additional internal-only beta profile to unlock the Apple Pay Cash feature. According to the retail employee who spoke to MacRumors, Apple is also requiring iCloud accounts to be whitelisted to use Apple Pay Cash.

The Apple Pay Cash setup process can be seen in the screenshot below -- it asks customers to verify their identity with name, address, and social security number.

Apple Pay Cash works through the Messages app and is designed to allow for quick person-to-person money transfers, much like Square Cash or Venmo. It's available as a dedicated iMessage app in the built-in Messages app, with cash transferred through iMessage transactions. Though most Apple Pay Cash coverage has focused on the iPhone, money can also be sent using an Apple Watch.

When sending cash, it can be sent from a linked debit or credit card, while received cash is stored in an Apple Pay Cash card in Wallet that can be used for purchases or sent to a bank account. Sending cash through a credit card incurs a 3% fee, while sending cash from a debit card is free.

The Apple Pay Cash card available in Wallet is being made available through a partnership with Green Dot, a company that offers prepaid Discover cards.

For Apple Pay Cash to work, both parties need to have the feature enabled and activated. Money can only be sent in a one-on-one message, with Apple Pay Cash not available in group messages.

On the Apple Watch, the interface requires you to scroll past the Scribble icon in the Messages app to access the Apple Pay button. Tapping on it allows users to enter a dollar amount using the Digital Crown or on-screen buttons. Payment is then confirmed via a double click on the Digital Crown, but scrolling down allows for users to choose a different payment source than the default.

Apple first announced person-to-person Apple Pay as an iOS 11 feature at its Worldwide Developers Conference in June, but it was not implemented in any of the iOS 11 betas and towards the end of the beta testing period, Apple confirmed it would be coming in a future iOS 11 update.

Apple Pay Cash is not present in the current iOS 11.1 beta available to developers and public beta testers, but given the expanded internal beta test, it appears Apple is nearly finished with the feature and is gearing up to release it as part of the iOS 11.1 update.