MacRumors

Apple has confirmed that it will issue a software update "very soon" to patch the security flaw found in OS X that allows attackers to capture or modify data protected by the SSL/TLS protocols in Safari, reports Reuters. The vulnerability of OS X to the bug was detailed by security firm CrowdStrike and a Google engineer last Friday, and came right after Apple released iOS 7.0.6 to fix the SSL-related issues on iOS.

However, the security flaw, which has been termed "GoToFail" by security specialists due to the improperly used "goto" command that triggers it, may be affecting more than just Safari. Independent privacy researcher Ashkan Soltani has pointed out on his Twitter (via Forbes) that Apple's vulnerable SSL library is also used by apps including FaceTime, iMessage, Twitter, Calendar, Keynote, Mail, iBooks, Software Update, and more.

Currently, users can check whether or not their computers are affected by the vulnerability by visiting gotofail.com in Safari. As users wait for a fix to the flaw, CrowdStrike recommends avoiding untrusted and unsecured WiFi networks while traveling. The site also recommends that users update to iOS 7.0.6 if they have not yet installed it on their iOS devices.

Samsung today unveiled its new line of Gear 2 smart watches, which follows the release of its Galaxy Gear smart watch last year. Like its predecessor, the flagship Gear 2 features a 1.63-inch touchscreen, 4GB of internal storage, 512MB of RAM, and mobile speakers, but also now contains a built-in IR blaster and a camera that has been moved from the wristband to the front of the device. Meanwhile, the cheaper Gear 2 Neo is lighter than its higher-end counterpart, and does not feature a camera.

The Gear 2 is said to include a 300 mAh battery that provides anywhere from 2-3 days of typical usage, as well as a heart rate sensor and pedometer for fitness tracking.

The ability to monitor health-related metrics will reportedly be one of the main features of Apple's iWatch, which is in development and could be released later this year. Throughout the past year, Apple has hired a number of health experts in fields related to health metrics, and also is said to be developing a "Healthbook" app for iOS 8. It was also reported last week that Apple is interested in acquiring health wearable maker Basis, which currently integrates many advanced health-centric technologies into its current products.

Samsung will be releasing the Gear 2 and Gear 2 Neo in various colors, with both devices receiving Charcoal Black and Wild Orange options. Additionally, the Gear 2 will be released in a Gold Brown option while the Gear 2 Neo will be offered a Mocha Grey colorway.

The Gear 2 and Gear 2 Neo will be available internationally starting April, with pricing to be announced soon. The company is also expected to unveil its flagship Galaxy S5 smartphone at its Unpacked 2014 event during Mobile World Congress 2014 later this week, with recent reports suggesting that the device will feature an integrated fingerprint sensor.

Yesterday's iOS 7.0.6 update provided a fix for an SSL connection verification issue, which turned out to be a major security flaw in the operating system. In a support document, Apple noted the patch repaired a specific vulnerability that could allow an attacker with a "privileged network position" to capture or modify data protected by SSL/TLS.

In other words, iOS was vulnerable to a man-in-the-middle attack where an attacker could pose as a trusted website to intercept communications, acquiring sensitive information such as login credentials and passwords, or injecting harmful malware.

According to security firm CrowdStrike, OS X may be vulnerable as well, because it exhibits the same authentication flaw. OS X users are open to an attack on any shared wired or wireless network as SSL/TLS verification routines can be bypassed.

To pull off the attack an adversary has to be able to Man-in-The-Middle (MitM) network connections, which can be done if they are present on the same wired or wireless network as the victim. Due to a flaw in authentication logic on iOS and OS X platforms, an attacker can bypass SSL/TLS verification routines upon the initial connection handshake.

This enables an adversary to masquerade as coming from a trusted remote endpoint, such as your favorite webmail provider and perform full interception of encrypted traffic between you and the destination server, as well as give them a capability to modify the data in flight (such as deliver exploits to take control of your system).

The bug, which has been detailed by Google software engineer Adam Langley, may have been introduced in OS X 10.9. According to Hacker News users, it remains unclear whether the issue is fixed with the latest version of the software, OS X 10.9.2, which is currently only available for developers. Users can check whether or not their computers are affected by the vulnerability by visiting gotofail.com in Safari.

It is likely that Apple plans to release a fix for OS X in the near future to repair the vulnerability, but in the meantime, CrowdStrike recommends avoiding untrusted WiFi networks while traveling. The site also recommends an immediate update to iOS 7.0.6 for users who have not yet installed the newest version of the operating system on their iOS devices.

Update: Apple has told Reuters that it is aware of the issue and has a software fix that will be released "very soon."

With Apple's Mac lineup beginning to show signs of aging, consumers are no doubt starting to wonder when they can expect updated models to hit the market. Apple's product update cycles are in large part driven by availability of new processors, so it pays to take a look at Intel's roadmap to see what might be coming when to give Apple new options for upgrades.

The MacBook Air is currently the older of Apple's two current notebook lines (setting aside the non-Retina MacBook Pro that has been reduced to a single 13-inch model and hasn't been updated since June 2012). Apple's ultrathin notebook currently offers a choice of two low-power 15-watt Haswell chips to help achieve remarkable all-day battery life. Entry-level models include a 1.3 GHz i5-4250U chip, while higher-end models bump up to a 1.7 GHz i7-4650U processor. Both chips include Intel's "Iris 5000" integrated graphics that offers reasonable everyday performance in a power-efficient design.

According to an Intel roadmap leaked by VR-Zone [Google Translate], a successor to the current low-end chip is set to launch in the third quarter in the form of an i5-4260U Haswell refresh, presumably carrying just a small speed bump compared to the current chip. Another alternative for Apple could be the 1.4 GHz i5-4350U or its just-announced successor 1.5 GHz i5-4360U. The 4350U chip has been available since last year, but Apple elected not to use it in the current MacBook Air. The high-end MacBook Air situation is less clear, as leaked roadmaps have not yet shown a direct successor to the current i7-4650U chip.

➜ Click here to read rest of article...

Apple has purchased Burstly, the company behind the popular iOS beta testing platform TestFlight, according to TechCrunch. The site says its sources have "pointed in Apple's direction" and that though it's just a rumor at this point, it would make a good fit.

TestFlight said on Wednesday that it would be discontinuing its Android product and it will no longer take new customers for its beta testing SDK -- existing customers can continue using TestFlight, however.

Odder still is how these product announcements – which greatly impact the company’s mobile developer user base – have been handled so far. There’s been no mention of them on the TestFlight changelog, for example, no company blog post, no emails, and no mention of them on social media channels – that is, unless you count the replies to confused developers from @testflightapp, the company’s main Twitter account. Developers are being asked to reach out directly to the company via an email form instead of being given a more useful public reply.

There are a number of different beta testing iOS platforms, including TestFlight and HockeyApp, though a number of larger developers have created their own testing platforms through Apple's Enterprise distribution program.

Update: Apple confirmed the purchase to Re/code, but did not disclose pricing.

Apple today released iOS 7.0.6 for iPhone, iPad, and iPod touch, a minor update that includes a fix for SSL connection verification. iOS 7.0.6, which carries a build number of 11b651, is available as an over-the-air-update and weighs in at 35.4MB on an iPhone 5s.

According to an Apple Support Knowledge Base article, the SSL vulnerability allowed a hacker to capture or modify data in supposedly secure sessions.

iOS 7.0.6

Data Security

Available for: iPhone 4 and later, iPod touch (5th generation), iPad 2 and later

Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS

Description: Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps.

iOS 7.0.6 comes three weeks after the release of iOS 7.0.5, which was available only for a limited number of devices and more than three months after the release of iOS 7.0.4, a minor bug-fix update.

Apple has also released iOS 6.1.6 (build 10b500) for the iPhone 3GS and fourth-generation iPod touch.

In light of recent reports stating that Apple is hard at work on an Apple TV refresh, Amazon is allegedly readying a new Web TV box that would compete with Apple's set-top box and the Roku, according to Re/code. The report states that Amazon's new media streaming device could be available as soon as March.

Similar to rumors that surfaced last year, this latest information claims Amazon's set-top box will tie into the company's Instant Video service and may support third-party content providers in a manner similar to the Apple TV and Roku.

A box is also a logical move for Amazon, which is investing heavily to build up a Web video catalog, and is starting to produce its own shows as well. An Amazon box will allow its customers to easily watch that stuff on their TVs; it should also give other content providers a chance to serve up their stuff via apps, in the way that Roku and Apple TV boxes do.

Sources tell me Amazon’s box is will be powered by Google’s Android operating system, which is also not a surprise — Amazon’s Kindle Fire tablets use a “forked” version of Android.

Re/code also speculates that Amazon's set-top box could contain a gaming component, noting that the company is looking to expand its Amazon Games Studio by hiring game developers who can "break down technology barriers and deliver experiences people have never seen before." This follows another recent rumor from VG247 that suggests the online retailer is working on an Android gaming console similar to the Ouya.

Amazon has stepped up its streaming content offerings in the past year, producing 14 original television pilots and using feedback to decide which get made into full shows, as well as spending significant amounts of money to secure exclusive rights to popular shows like Downton Abbey and The West Wing.

Currently, Amazon's Instant Video service is available on iPads and iPhones, the Xbox 360, the Nintendo Wii, the Sony Playstation 3, smart televisions from LG, Panasonic, Samsung, Sony, and Vizio, TiVo, the Roku box, as well as a number of Blu-ray players.

The United States Postal Service today approved a commemorative Steve Jobs stamp that will be printed as part of a collectible series next year, according to The Washington Post (via Engadget).

The former Apple CEO's stamp is still in the design stages and will be released at some point in 2015.

Jobs, who passed away in 2011 after a battle with pancreatic cancer, has also been posthumously honored for his visionary achievements with a special Grammy Merit Award and a Disney Legends Award. He was also inducted into the Bay Area Business Hall of Fame, has had a building at Pixar named after him, and was featured in an exhibit at the U.S. Patent Office Museum.

The Washington Post has also revealed several other future postage-stamp subjects approved for coming years, including Johnny Carson, John Lennon, and Michael Jackson.

(Image courtesy of Engadget)

Google today launched Project Tango, an experimental smartphone and developer kit that incorporates 3D sensors able to map indoor and outdoor environments. Designed as a 5-inch phone containing custom hardware and software, the first Project Tango prototype makes more than a quarter million 3D measurements each second, tracking three-dimensional motion to create a visual 3D map of the space around itself.

Google describes Project Tango primarily as a mapping tool, automatically capturing the world around each user to provide directions, dimensions, and environmental maps.

What if you could capture the dimensions of your home simply by walking around with your phone before you went furniture shopping? What if directions to a new location didn't stop at the street address? What if you never again found yourself lost in a new building? What if the visually-impaired could navigate unassisted in unfamiliar indoor places? What if you could search for a product and see where the exact shelf is located in a super-store?

The company also pictures Project Tango as the first step towards fully immersive augmented reality games that merge gameplay with real world locations.

Imagine playing hide-and-seek in your house with your favorite game character, or transforming the hallways into a tree-lined path. Imagine competing against a friend for control over territories in your home with your own miniature army, or hiding secret virtual treasures in physical places around the world?

According to TechCrunch, Project Tango utilizes a vision processor called the Myriad 1, from Movidius, which is incredibly power efficient compared to other 3D-sensing chips on the market. The power necessary for 3D chips to function has thus far been one of the major issues preventing the technology from being incorporated into a smartphone, but because it functions like a co-processor much like Apple's own M7 motion co-processor, it is able to draw less power.

Project Tango's three-dimensional mapping capabilities are similar to technology developed by PrimeSense, a company that Apple acquired last year. PrimeSense developed the technology used in Microsoft's original Kinect and went on to create motion-sensing mobile chips capable of scanning an environment in full 3D. PrimeSense imagined the technology could be used for interactive gaming, indoor mapping, and more, much like Project Tango.

It isn't clear how Apple plans to use PrimeSense's technology in future devices or whether it has plans to release a smartphone that supports a 3D chip, but Project Tango demonstrates some of the potential capabilities of 3D sensing built into mobile devices that Apple could replicate should it choose to go in that direction. Apple has expressed interest in 3D indoor mapping in the past, having acquired indoor mapping company WiFiSlam in early 2013.

Google is recruiting professional developers to create apps for Project Tango and wants work to begin as soon as March. The company is distributing 200 prototype dev kits, inviting developers to describe what they would build using the technology. Google plans to give out prototype kits for developers interested in navigation/mapping, single/multiplayer games that use physical space, and new algorithms that use processing sensor data.

Apple has completed the rollout of two-step verification in several new countries, reports 9to5Mac. As noted on Apple's website, these new locations include Canada, France, Germany, Japan, Italy, and Spain. Reports from at least one German user suggests Germany already had two-step verification, but lacked the verification through SMS feature, which was enabled today.

Last May, Apple expanded its two-step verification system to several countries in North America, South America and Europe. This feature apparently was launched prematurely and disappeared shortly after it was enabled.

While it’s always possible the feature might disappear like last time, this time around things look more official with users having full SMS support through local carriers and Apple listing the new countries on its support sites. Apple also has a list of supported carriers for receiving SMS messages by country here that was just updated.

Two-step verification is an optional security feature that requires Apple users to verify their identity before making purchases or logging into their Apple ID account. This extra layer of protection requires users to enter a 4-digit verification code sent to a trusted device via Find My iPhone or SMS. Once enabled, this system replaces the standard security questions.

Apple introduced this security feature in March 2013 to users in the U.S., U.K., Australia, Ireland, and New Zealand.