MacRumors

During the Black Hat USA conference in Las Vegas, researchers demonstrated a Face ID bypass method that used glasses and tape to unlock and infiltrate the iPhone of an "unconscious" victim.

According to a report from Threatpost (via iMore), researchers from Tencent aimed to fool the "liveness" detection feature in biometrics, which is meant to distinguish "real" from "fake" features on people.

Liveness detection, said the researchers, detects background noise and response distortion or focus blur, allowing it to make sure that a face is a real face and not a mask. This liveness detection is used by ‌Face ID‌, and Apple even has an "Attention Aware" feature that makes sure your ‌iPhone‌ doesn't unlock unless you're looking at it.

To trick ‌Face ID‌, the researchers created prototype glasses with black tape on the lenses and white tape inside the black tape to emulate the look of an eye. When putting the glasses over a sleeping victim's face, they were able to access his ‌iPhone‌ and send themselves money through a mobile payment app.

This method worked because the researchers found that liveness detection works differently with glasses and essentially doesn't extract 3D information from the eye area when glasses are worn.

They discovered that the abstraction of the eye for liveness detection renders a black area (the eye) with a white point on it (the iris). And, they discovered that if a user is wearing glasses, the way that liveness detection scans the eyes changes.

"After our research we found weak points in FaceID... it allows users to unlock while wearing glasses... if you are wearing glasses, it won't extract 3D information from the eye area when it recognizes the glasses."

An attacker attempting to use this method in the real world would need a victim that's sleeping or unconscious, access to that victim's ‌iPhone‌, and then glasses would need to be placed over the eyes without waking the person up. It's worth noting that this isn't a situation most people are likely to run into, and there's also no secondary research on this alleged method this time.

To mitigate the eye detection loophole in the future, researchers suggested biometrics manufacturers add identity authentication for native cameras and "increase the weight of video and audio synthesis detection."

Apple has designed ‌Face ID‌ with easy access disabling measures for situations where a person might be coerced or forced into unlocking an ‌iPhone‌ with facial recognition. Pressing on the sleep/wake button of a Face ID-enabled ‌iPhone‌ five times in rapid succession brings up an emergency SOS screen that automatically disables ‌Face ID‌ and requires a passcode to be entered before ‌Face ID‌ works again. Pressing and holding the side/top button and a volume button also works on the ‌iPhone‌ and the iPad Pro.

Apple is introducing an expanded bug bounty program that covers macOS, tvOS, watchOS, and iCloud as well as iOS devices, Apple's head of security engineering Ivan Krstić announced this afternoon at the Black Hat conference in Las Vegas.

Apple introduced its bug bounty program for iOS devices in August of 2016, allowing security researchers who locate bugs in iOS to receive a cash payout for disclosing the vulnerability to Apple. Prior to now, non-iOS devices were not included, a move that has previously been criticized by the security community.

Apple's lack of a macOS bug bounty program made headlines earlier this year when a German teenager initially refused to hand over details of a major macOS Keychain security flaw because Apple didn't have a payout. While he did ultimately provide the info to Apple, he said that he hoped his refusal would inspire Apple to expand its bug bounty program, which the company has indeed done.

With the launch of the new macOS bug bounty program, Apple is opening its bug bounties up to all researchers later this year and it is increasing the maximum size of the bounty from $200,000 per exploit to $1 million depending on the nature of the security flaw. A zero-click kernel code execution with persistence will earn the maximum amount.

Researchers who discover vulnerabilities in pre-release software before general release can qualify for up to a 50 percent bonus payout on top of the base bug bounty amount.

As reported earlier this week, Apple also plans to provide vetted and trusted security researchers and hackers with "dev" iPhones, aka special iPhones that provide deeper access to the underlying software and operating system that will make it easier for vulnerabilities to be discovered.

Apple is providing these iPhones as part of its new iOS Security Research Device Program, launching next year. Apple's aim with these new bug bounty efforts is to encourage additional security researchers to disclose vulnerabilities, ultimately leading to more secure devices for consumers.

(Thanks, SecuritySteve!)

Apple today released the fifth public betas of iOS 13 and iPadOS to its public beta testing group, one week after seeding the fourth public betas and a day after seeding the sixth developer beta.

Beta testers who have signed up for Apple's beta testing program will receive the iOS 13 beta update over-the-air after installing the proper certificate on an iOS device.

Those who want to join the beta testing program can sign up on Apple's beta testing website, which gives users access to iOS, macOS, and tvOS betas. Before installing a beta, make sure to create a full encrypted iTunes backup or an iCloud backup.

iOS 13 is a major update to the iOS operating system that runs on the iPhone and the iPad, but this year, iOS 13 and iPadOS, the version of iOS 13 that runs on the ‌iPad‌, are separate downloads as they've been split up.

iPadOS is identical to iOS 13 in almost every way, though there are some iPad-specific features such as new multitasking capabilities. For the most part, the two operating systems share the same features.

iOS 13 introduces a long list of new features. Dark Mode changes the entire look of the operating system, shifting it from light to dark, while an overhauled Photos app makes it easier to relive your memories with new Days, Months, and Years viewing options.

There's a new photo editing interface that makes it easier to edit photos than ever before, plus there are new tools to work with and options to edit the intensity of the built-in filters. You can edit video right in the ‌Photos‌ app for the first time, and on the newest iPhones, there's a new High-Key Mono lighting effect and an option to adjust the intensity of Portrait Lightning effects.

iOS 13 adds a less obtrusive volume HUD, a new Find My app that combines ‌Find My‌ ‌iPhone‌ and ‌Find My‌ Friends and lets you track your devices even with they don't have an LTE or WiFi connection. A Sign In with Apple feature (not yet active) gives you a convenient and data safe way to sign into apps and websites, providing an alternative to Facebook and Google sign in options.

Maps has a new street-level "Look Around" mode and a Collections feature for making lists of places, Reminders has been entirely overhauled to make it more functional, there's a profile feature in Messages along with new Memoji and Animoji stickers, and Siri has a new voice.

There are a ton of additional new features and changes coming in iOS 13, and for a full rundown of what you can expect, make sure to check out our iOS 13 roundup.

Each new beta brings new features and changes to iOS 13, and the sixth developer beta, which corresponds to the fifth public beta, added a ‌Dark Mode‌ toggle to Control Center, changes to folder transparency, updates to some privacy warnings, new splash screens, and more.

Apple's HomePod accounted for just 5 percent of the estimated 76 million smart speaker installed base in the United States in the second quarter of 2019, according to new data shared today by Consumer Intelligence Research Partners (CIRP).

Amazon continues to be the number one smart speaker vendor in the U.S., followed by Google. Amazon Echo devices accounted for 70 percent of smart speakers in the United States during the quarter, while Google Home devices accounted for 25 percent.

The smart speaker market has seen strong growth, with the U.S. installed base of 76 million speakers up nine percent from 70 million units in the March 2019 quarter. Growth is also up significantly compared to last June, when there were an estimated 50 million smart speakers in the United States.

"While the biggest growth in the market for smart speakers is in the holiday fourth quarter, Amazon Echo and Google Home continues to grow their installed bases in the past couple of quarters," said Josh Lowitz, Partner and Co-Founder of CIRP. "The market grew by 9% in the second quarter, and more than 50% year over year. Including Apple HomePod, all three major producers have maintained steady shares of the market in the past year. Continued aggressive pricing of the entry-level models seems to continue to encourage new customers to try a smart speaker and existing owners to consider adding more devices to their home.

Most people who own smart speakers have less expensive models like the Echo Dot and the Google Home Mini, with these units accounting for more than 50 percent of smart speakers in the U.S. during the quarter.

Though Apple has dropped the price of the HomePod from $349 to $299, the smart speaker is still significantly more expensive than speaker options from Google and Amazon, which has left Apple struggling to gain a foothold in the market.

Amazon's Echo Dot, for example, is priced at $50, but it is often available at even lower prices during sales and promotions. The same goes for the Google Home Mini, which is also priced at $49.

Rumors have suggested that Apple is considering a more affordable version of the ‌HomePod‌ that could be priced as low as $150, but it's not clear if and when Apple might release such a speaker.

CIRP's data is estimated and is based on a survey of 500 U.S. owners of Amazon Echo, Google Home, and Apple ‌HomePod‌ devices surveyed from July 1 to July 10 who owned one of the devices as of June 30, 2019.

Apple's rumored 16-inch MacBook Pro will be released in the third quarter, aka early fall, according to Taiwanese research firm TrendForce.

An excerpt from TrendForce's press release on notebook market share:

According to the 3Q outlook for notebook shipments, demand for Chromebooks remains strong thanks to the back-to-school period; at the same time, we see new products hitting shelves, such as Apple's 16-inch MacBook, Dell's products with 16:10 aspect ratio, Asus's dual-screen laptop, as well as various gaming laptops in increasingly hot demand.

The report describes the notebook as a 16-inch MacBook, but this very likely refers to the 16-inch ‌MacBook Pro‌, as all other reports have indicated.

TrendForce is at least the fifth source to claim that a 16-inch ‌MacBook Pro‌ is coming in the fall, alongside TF International Securities analyst Ming-Chi Kuo, IHS Markit analyst Jeff Lin, DigiTimes, and the Economic Daily News, but reports have been conflicting about a September or October release month.

In the fall, Apple typically unveils new Macs in October. The company has hosted Mac- or iPad-centric media events in October in five of the past seven years, including 2016 and 2018, allowing it to focus on the iPhone, Apple Watch, and sometimes the Apple TV and accessories at its September event.

The 16-inch ‌MacBook Pro‌ will feature an all-new design, including a more reliable scissor mechanism keyboard, according to ‌Ming-Chi Kuo‌. The notebook is also rumored to feature narrower bezels, perhaps allowing the 16-inch display to fit in a notebook with a similar physical size as the current 15-inch model.

Meanwhile, Jeff Lin believes the 16-inch ‌MacBook Pro‌ will feature a 3,072×1,920 resolution and be powered by Intel's 9th-generation Coffee Lake Refresh processors, suggesting the notebook will be configurable with up to an 8-core Core i9 processor in line with the latest 15-inch ‌MacBook Pro‌.

Last year, Apple hosted its Mac and iPad Pro event on October 30, so we could be two to three months away from the 16-inch ‌MacBook Pro‌ reveal.

Samsung has spent years releasing ads that mock Apple's decision to remove the 3.5mm headphone jack from the iPhone, a move that began with the ‌iPhone‌ 7 in 2016. Now that Samsung has removed the headphone jack from the Galaxy A8 and Galaxy Note 10, the company has quietly deleted these mocking ads from some of its YouTube channels.

As discovered by Business Insider, the commercial "Growing Up" has now been removed from the main Samsung YouTube channel and the Samsung Mobile USA channel. The ad was released by Samsung in November 2017 as push back against the ‌iPhone‌ X and to promote the Galaxy Note 8, and similar anti-dongle ads released in 2018 have also disappeared this year. This can be seen in the dead links on our article for the "Ingenious" ads from July 2018.

The original "Growing Up" ad is still available on the Samsung Malaysia channel, however, and can be seen below. The ad depicts the life of a young man who finally decides to switch from Apple to Samsung, with one of the main points of contention being the lack of a 3.5mm headphone jack.

Samsung has historically used a mocking strategy when it comes to advertising its own products, taking to pointing out the downsides of its competition in an effort to sell Galaxy smartphones. The company has also made fun of iPhones for their speed, Apple's Genius Bar, the Apple Pencil, and much more.

Samsung just announced the Note 10 and Note 10+ yesterday, including an AMOLED Cinematic Infinity Display (the Galaxy Note 10+ features the largest display yet in a Note device). The Cinematic Infinity Displays are nearly bezel free and include a small chin at the bottom and a single hole punch camera cutout. There is also an ultrasonic fingerprint sensor, face recognition, and -- of course -- no headphone jack.

Apple this week disclosed that 88 percent of active iPhone, iPad, and iPod touch devices are running iOS 12, as measured by the App Store on August 6, 2019. iOS 12 adoption continues to outpace iOS 11, which was installed on 85 percent of active devices as of September 3, 2018, according to Apple.

The updated stats, highlighted by Rene Ritchie, also reveal that seven percent of active devices continue to run iOS 11, with five percent using an earlier version. This includes older devices that are incompatible with the latest iOS versions.

iOS 12 outpacing iOS 11 in adoption is not much of a surprise, as iOS 11 was plagued by several problems last year, including at least three bugs that could crash the entire system, a HomeKit vulnerability, an iPhone camera autofocus issue, autocorrect bugs, the iPhone X glitching in cold weather, and more.

The high-profile iPhone performance management controversy also likely had an adverse impact on iOS 11 upgrade rates.

In January 2018, multiple reports claimed that Apple delayed several new features planned for iOS 12 to focus on performance, stability, and bug fixes, and the software update has indeed proven to be much more reliable.

Looking ahead, Apple is now in the latter stages of beta testing iOS 13, which will be publicly released in September.

Apple has activated a "dormant software lock" on its latest iPhones to discourage battery replacements that aren't undertaken by Apple, according to iFixit.

The teardown group has discovered that an iPhone XS, ‌iPhone‌ XR, or ‌iPhone‌ XS Max that has had its battery swapped by anyone other than Apple or an Apple authorized service provider will now display a message saying their battery needs servicing.

If you replace the battery in the newest iPhones, a message indicating you need to service your battery appears in Settings > Battery, next to Battery Health. The "Service" message is normally an indication that the battery is degraded and needs to be replaced. The message still shows up when you put in a brand new battery, however. Here's the bigger problem: our lab tests confirmed that even when you swap in a genuine Apple battery, the phone will still display the "Service" message.

[...]

Put simply, Apple is locking batteries to their iPhones at the factory, so whenever you replace the battery yourself—even if you're using a genuine Apple battery from another iPhone—it will still give you the “Service” message. The only way around this is—you guessed it—paying Apple money to replace your iPhone battery for you.

The message appears in both iOS 12 and iOS 13 beta, and prevents the user from accessing the Battery Health features. Instead they see an "Important Battery Message" which reads: "Unable to verify this ‌iPhone‌ has a genuine Apple battery. Health information not available for this battery."

iFixit notes that the message doesn't appear to affect the functionality of the battery, but makes it harder to know when a replacement battery installed by a third-party needs to be replaced.

YouTube channel The Art of Repair has discovered the source of the message to be a Texas Instruments microcontroller installed on the battery itself, which authenticates the battery as an Apple one and provides the ‌iPhone‌ with information about battery capacity and temperature.

Apple and other authorized service providers likely use Apple's own RepairCal diagnostics software to reset the "Service" status when it undertakes an ‌iPhone‌ battery replacement – an in-house procedure that's obviously not available to a third-party.

iFixit says the message appears designed to deter battery replacements using third-party repair kits, like the one sold by iFixit, and to discourage customers from getting a third-party repair shop to swap out their ‌iPhone‌ battery.

Apple would probably argue it is doing it out of safety concerns surrounding the replacement of swollen or damaged batteries. Nonetheless, it places further restrictions on the options available to ‌iPhone‌ users looking to get their battery replaced by anyone except Apple.

The practice harks back to a more damaging third-party ‌iPhone‌ repair controversy: Error 53, widely publicized in 2016, caused some ‌iPhone‌ 6 users who had the Home buttons on their iPhones fixed by a non-Apple technician using non-original parts to see their iPhones bricked following a software update.

When the error code first surfaced, Apple said that error 53 was a protective security feature meant to prevent "malicious" third-party components from potentially compromising a user's ‌iPhone‌.

However, after public outcry, Apple released a software update restoring functionality to bricked iPhones. Following the software update to unbrick iPhones, Apple claimed that the error 53 issue was meant to be a factory test and never should have impacted consumer devices.

Update: According to an Apple service document obtained by MacRumors, Battery Health info is unavailable for any ‌iPhone‌ XS, XS Max, and XR that has a non-genuine battery and is running iOS 12.1 or later.

Apple has partnered with pharmaceutical company Eli Lilly and health startup Evidation to determine whether data collected from the iPhone and Apple Watch can be used to detect early signs of dementia.

A research paper published this week and shared by CNBC lists researchers from Eli Lilly, Apple, and Evidation Health. The paper, called "Developing Measures of Cognitive Impairment in the Real World from Consumer-Grade Multimodal Sensor Streams," explores whether sensor data and activity info from smart watch devices can be mined for "physiological and behavior signatures of cognitive impairment."

The ubiquity and remarkable technological progress of wearable consumer devices and mobile-computing platforms (smart phone, smart watch, tablet), along with the multitude of sensor modalities available, have enabled continuous monitoring of patients and their daily activities. Such rich, longitudinal information can be mined for physiological and behavioral signatures of cognitive impairment and provide new avenues for detecting MCI in a timely and cost-effective manner.

In this work, we present a platform for remote and unobtrusive monitoring of symptoms related to cognitive impairment using several consumer-grade smart devices. We demonstrate how the platform has been used to collect a total of 16TB of data during the Lilly Exploratory Digital Assessment Study, a 12-week feasibility study which monitored 31 people with cognitive impairment and 82 without cognitive impairment in free living conditions. We describe how careful data unification, time-alignment, and imputation techniques can handle missing data rates inherent in real-world settings and ultimately show utility of these disparate data in differentiating symptomatics from healthy controls based on features computed purely from device data.

According to the abstract, 31 people with cognitive impairment and 82 without cognitive impairment were monitored over a 12-week period, with 16TB of data collected. The study claims that the data was able to be used to differentiate people with early signs of cognitive impairment from those who were healthy.

People who had symptoms of cognitive decline typed more slowly, typed less regularly, relied more heavily on support apps, and sent fewer text messages. The study did not reach long-term conclusions as more analysis is needed.

In a statement to CNBC, Evidation co-founder Christine Lemke said that data collected from the ‌iPhone‌, Apple Watch, and Beddit sleep monitors was used for the study. Apple acquired the company behind the Beddit sleep monitor back in 2017.

"With this research, we looked at how everyday behavior data, such as those captured by iPhones, Apple Watches, and Beddit sleep monitors, may be effective in differentiating between individuals with mild cognitive impairment and early Alzheimer's disease, and those without symptoms."

Early detection of dementia is important because an early diagnosis can allow for better management of symptoms and quality of life improvements even though the progression of the disease can't be stopped. According to the World Health Organization, 50 million people around the world have dementia, with close to 10 million new cases surfacing every year.

Apple is facing a class action lawsuit [PDF] for employing contractors to listen to and grade some anonymized Siri conversations for the purpose of quality control and product improvement.

Apple's ‌Siri‌ practices were highlighted in a recent report where one of the contractors claimed that Apple employees evaluating ‌Siri‌ recordings often hear confidential medical information, drug deals, and other private information when ‌Siri‌ is activated accidentally.

The lawsuit, filed in a Northern California court today (and shared by CNBC's Kif Leswing), accuses Apple of "unlawful and intentional recording of individuals' confidential communications without their consent," violating California privacy laws when accidental ‌Siri‌ activations are recorded and evaluated by humans.

Siri Devices are only supposed to record conversations preceded by the utterance of "Hey Siri" (a "wake phrase") or through a specific gesture, such as pressing the home button on a device for a specified amount of time. California law prohibits the recording of oral communications without the consent of all parties to the communication.

Individuals who have purchased or used Siri Devices and interacted with Siri have not consented to Apple recording conversations where "Hey Siri" was not uttered or where they did not otherwise perform a gesture intending to activate Siri, such as pressing and holding down the home button on a device for a certain period of time.

As outlined in its privacy policies, Apple collects some anonymized ‌Siri‌ recordings for the purpose of improving ‌Siri‌ and, presumably, cutting down on accidental ‌Siri‌ activations. These recordings are analyzed by humans and can include details recorded when ‌Siri‌ mishears a "Hey ‌Siri‌" trigger word.

The lawsuit claims that Apple has not informed consumers that they are "regularly being recorded without consent," though it also highlights Apple's privacy policy where Apple does state that such data can be used for improving its services.

The plaintiffs in the case, one of whom is a minor, claim to own an iPhone XR and an ‌iPhone‌ 6 that they would not have purchased had they known that their ‌Siri‌ recordings were stored for evaluation. The plaintiffs are seeking class action status for all individuals who were recorded by a ‌Siri‌ device without their consent from October 12, 2011 to the present.

The lawsuit asks for Apple to obtain consent before recording a minor's ‌Siri‌ interactions, to delete all existing recordings, and to prevent unauthorized recordings in the future. It also asks for $5,000 in damages per violation.

Apple has suspended its Siri evaluation program right now as it reviews the processes that are in place in light of the contractor's claims. Prior to the suspension of the program, Apple said that a small, random subset (less than 1%) of daily ‌Siri‌ requests are analyzed for improving ‌Siri‌ and dictation, with requests not associated with a user's Apple ID.

Apple in the future plans to release a software update that will let ‌Siri‌ users opt out of having their ‌Siri‌ queries included in the evaluation process, something that's not possible at the current time. All collected ‌Siri‌ data can be cleared from an iOS device by turning ‌Siri‌ off and then on again, while accidental recordings can be stopped by disabling "Hey ‌Siri‌."

Update: We were able to go hands-on with the new Galaxy Note 10 and Galaxy Note 10+, so make sure to check out our video for a closer look at Samsung's newest flagship devices.

Samsung this afternoon unveiled its newest flagship smartphones, which are in the Galaxy Note family. The Galaxy Note 10, for the first time in a Note device, is available in two sizes: 6.3 (Galaxy Note 10) and 6.8 inches (Galaxy Note 10+).

Both of the smartphones feature an AMOLED Cinematic Infinity Display (2280x1080 for Note 10 and 3040x1440 for Note 10+), with the Galaxy Note 10+ featuring the largest display yet in a Note device. The Cinematic Infinity Displays are close to bezel free, with a small chin and the bottom and a single hole punch camera cutout. There is an ultrasonic fingerprint sensor for biometric authentication, plus Samsung's face recognition, and no headphone jack.

The Samsung DeX feature that makes it easier for Samsung users to swap between a phone and a PC or Mac now allows for files to be dragged and dropped between devices when connected via USB. Mobile apps can be used with a mouse and keyboard through DeX, and the Galaxy Note 10 also has a feature for a one click connection to a Windows 10 PC.

The Galaxy Note 10 features new S Pen technologies, including a redesigned, streamlined look for the pen itself. A new handwriting to text feature lets users write notes that can be converted to digital text in the Samsung Notes app, and Air actions are supported, allowing for customizable gesture-based controls with the S Pen.

Samsung added a triple-lens camera to the Note 10 and a quad camera to the Note 10+. The Note 10 features a 16-megapixel ultra wide-angle camera, a 12-megapixel wide-angle camera, and a 12-megapixel telephoto camera. The Note 10+ has the same lenses but also adds a new DepthVision Camera.

There are new photo and video capabilities in the Galaxy Note 10, including a Live Focus Video option that adds depth-of-field adjustments to video and a Zoom-In Mic for amplifying audio. An improved super steady mode better stabilizes footage to cut down on shakiness.

A Screen Recorder feature captures what's on the screen for gamers, and a picture-in-picture feature can be used to add reactions while the S Pen can be used for annotations. Night mode, which brightens up dark photos, now works with the 10-megapixel front-facing camera.

An AR Doodle feature lets Note 10 users customize their photos with dynamic drawings, effects, and animations, while the new 3D Scanner (Note 10+) can take a scan of an object and turn it into a movable 3D rendering.

The smartphones are equipped with 7-nanometer 64-bit Octa-core processors, with the Note 10 offering 8GB RAM and 256GB of internal storage. The Note 10+ features 12GB RAM and up to 512GB internal storage. Samsung says the Note 10 devices are equipped with "the world's slimmest vapor chamber cooling system" for better gameplay performance.

There's a 3,500mAh battery in the Galaxy Note 10, and a 4,300mAh battery in the Galaxy Note 10+.

Other features include super fast charging with 45W wired charging capability for the Note 10+, Wireless PowerShare for charging other Qi-based wireless chargers with the Galaxy Note 10, and 5G options for fast speeds. The Galaxy Note 10+ is available in a 5G variant for those who want 5G speeds, and the LTE models offer up to 2Gb/s download speeds and 150Mb/s upload speeds.

Samsung is offering the Galaxy Note 10 and Note 10+ in Aura Glow, Aura White and Aura Black. The Galaxy Note 10 is priced starting at $949.99, while Galaxy Note 10+ pricing starts at $1099.99. Samsung will begin selling the Galaxy Note 10 and 10+ on August 23, with pre-orders set to kick off on August 8. The Galaxy Note 10+ 5G, priced at $1,299.99, will be a Verizon exclusive at launch. Samsung's livestream showing off the features of the new devices is available below.

Samsung's Galaxy Note 10 will compete with Apple's upcoming 2019 iPhones, which are set to offer triple-lens camera setups, bilateral wireless charging, faster processors, and more.