iPhone XS and XS Max in silver, space gray, and gold.
Mac Security In Spotlight - MacBook Air Hacked, Apple Patch Times
A MacBook Air running an up to date installation of Mac OS 10.5 Leopard was the first laptop to fall in last week's CanSecWest PWN2OWN contest, casting the spotlight once again on the Mac's security.
The contest pitted a MacBook Air against a Vista laptop and a Ubuntu Linux laptop, all fully patched. While all 3 laptops did not fall the first day which only allowed attacks against the base OS for a prize of $20,000 (+laptop), the MacBook Air reportedly took only 2 minutes to fall on day 2 when conference rules were relaxed to include all OS-bundled software for a prize of $10,000 (+ laptop).
While details of the exploit are under non-disclosure while Apple works on the issue, the attack was levied against Safari, after the user was directed to a specially crafted website (as allowed by the rules). The exploit has been reported to be an overflow bug in Webkit.
The remaining two laptops survived the rest of the second day, but the Vista laptop fell the following day when Adobe Flash player was installed as the rules were further relaxed to allow for attack of popular 3rd party applications. The Linux laptop was not exploited.
While Apple is aware of and working on the vulnerability, a recent study has claimed that Apple's response time to such 0-day vulnerability patches lags significantly behind that of Microsoft.
The study, conducted by the Swiss Federal Institute of Technology, analyzed 658 vulnerabilities affecting Microsoft products and 738 affecting Apple, all of which were high and medium risk according to the National Vulnerability Database.
A spot-check of security firm Secunia's statistics show that 6% of 113 bugs found in Apple's Mac OS X operating system from 2003 to 2008 remain unpatched.
The contest pitted a MacBook Air against a Vista laptop and a Ubuntu Linux laptop, all fully patched. While all 3 laptops did not fall the first day which only allowed attacks against the base OS for a prize of $20,000 (+laptop), the MacBook Air reportedly took only 2 minutes to fall on day 2 when conference rules were relaxed to include all OS-bundled software for a prize of $10,000 (+ laptop).
While details of the exploit are under non-disclosure while Apple works on the issue, the attack was levied against Safari, after the user was directed to a specially crafted website (as allowed by the rules). The exploit has been reported to be an overflow bug in Webkit.
The remaining two laptops survived the rest of the second day, but the Vista laptop fell the following day when Adobe Flash player was installed as the rules were further relaxed to allow for attack of popular 3rd party applications. The Linux laptop was not exploited.
While Apple is aware of and working on the vulnerability, a recent study has claimed that Apple's response time to such 0-day vulnerability patches lags significantly behind that of Microsoft.
The study, conducted by the Swiss Federal Institute of Technology, analyzed 658 vulnerabilities affecting Microsoft products and 738 affecting Apple, all of which were high and medium risk according to the National Vulnerability Database.
"Apple was below 20 [unpatched vulnerabilities at disclosure] consistently before 2005," [said researcher Stefan Frei]. "Since then, they are very often above. So if you have Apple and compare it to Microsoft, the number of unpatched vulnerabilities are higher at Apple." [...]
"We think that Apple had fewer vulnerabilities early on, and they were just surprised or not as ready or not as attentive," Frei said. "It looks like Microsoft had good relationships earlier with the security community."
Over the past few years, Microsoft has tried to cultivate a closer relationship with the security community in order to encourage researchers to give it a heads-up about software problems. Apple, however, doesn't appear to have that same sort of engagement yet, and, "based on our findings, this is hurting them," Frei said.
A spot-check of security firm Secunia's statistics show that 6% of 113 bugs found in Apple's Mac OS X operating system from 2003 to 2008 remain unpatched.
[ 247 comments ]
In iOS 12, Apple's digital health push includes a couple of special new features for iPhone and iPad users who want to cut down on their app usage: App Limits and Downtime. In this article,...
Jon M. Chu, best known for directing hit movie "Crazy Rich Asians," was provided with one of Apple's new iPhone XS Max models by WIRED, which he used to shoot a short film in 4K to test...
In iOS 12, Apple has given users the tools to cut down on disturbances to get more time away from their devices if desired, and one of these new tools is an expanded set of Do Not Disturb options.
...
Following the release of iOS 12, which brought a few new Apple Music features, Apple has updated its Apple Music app for Android to introduce feature parity.
Today's update brings support...
Apple's watchOS 5 update includes a new Siri feature that eliminates the need to say "Hey Siri" or push the Digital Crown to activate the personal assistant.
Instead, you can raise...
One of the new features in iOS 12 is an augmented reality app called Measure, which Apple has designed to make it easier for you to measure various real-world objects using 3D spatial detection...
In iOS 12, Apple has introduced some new features to the Photos app that aim to make it easier for you to search, share, and enjoy your photo collection. Here's how to make the most of them.
...
Apple's watchOS 5 update, out now for all Apple Watch models with the exception of the original Apple Watch, introduces a fun new feature that mimics old school walkie talkies. With...
