MacRumors

A new iOS trojan has been found in the wild that's able to infect non-jailbroken iOS devices through PCs without the need to exploit an enterprise certificate. Named "AceDeceiver," the malware was discovered by Palo Alto Networks and is currently affecting iOS users in China.

AceDeceiver infects an iOS device by taking advantage of flaws in FairPlay, Apple's digital rights management (DRM) system. According to Palo Alto Networks, it uses a technique called "FairPlay Man-in-the-Middle," which has been used to spread pirated iOS apps in the past by using fake iTunes software and spoofed authorization codes to get the apps on iOS devices. The same technique is now being used to spread the AceDeceiver malware.

Apple allows users purchase and download iOS apps from their App Store through the iTunes client running in their computer. They then can use the computers to install the apps onto their iOS devices. iOS devices will request an authorization code for each app installed to prove the app was actually purchased. In the FairPlay MITM attack, attackers purchase an app from App Store then intercept and save the authorization code.

They then developed PC software that simulates the iTunes client behaviors, and tricks iOS devices to believe the app was purchased by victim. Therefore, the user can install apps they never actually paid for, and the creator of the software can install potentially malicious apps without the user's knowledge.

From July of 2015 to February of 2016, three AceDeceiver iOS apps were uploaded to the official iOS App Store, posing as wallpaper apps and providing attackers with a fake authorization code to use in the AceDeceiver attacks.

A Windows iPhone management app called "Aisi Helper" that claimed to provide services like system backup and cleaning was installed by users in China, and it went on to install malicious iOS apps on connected devices. The apps were designed to be third-party App Stores with free content to bait users into using them and submitting their Apple IDs and passwords. Apple ID information was then uploaded to the AceDeceiver server.

Though Apple removed the original AceDeceiver iOS apps from the App Store in February (the ones used by the hackers to obtain the authorization codes), the attack remains active because attackers still have the authorization codes necessary to install fake apps on iOS devices. AceDeceiver only affects users in China, but Palo Alto Networks believes the AceDeceiver trojan or similar malware could spread to additional regions in the future. AceDeceiver is especially insidious as it has not been patched (and could work on older versions of iOS even when patched), installs apps automatically from an infected computer, and does not require an enterprise certificate.

Palo Alto Networks has a full rundown of AceDeceiver, its history, and how it works on the Palo Alto Networks website. It's well worth reading for anyone who wants more information about the malware.

Medical smartphone accessory company AliveCor today announced that it will bring "the first medical-grade EKG band" to the Apple Watch with the "Kardia Band," in addition to a new smartphone app for users of its heart-rate reading devices. The company already sells a few "mobile EKG" products in its online store, including cases for the iPhone 6/6s and iPhone 5/5s that have users place their fingers on metallic plates to get sufficient heart-rate readings.

The Kardia Band for Apple Watch will function in a similar way, with a small, integrated metal sensor in the band communicating with the company's new app to take wrist-worn EKG readings. All users will have to do is navigate to the Apple Watch-compatible Kardia app, start a reading, place their thumb on the sensor, and wait for the 30-second analysis to complete. During this time, users can also speak into the Apple Watch's microphone to detail any palpitations, shortness of breath, or dietary habits that could be linked to heart-rate fluctuations.

Users can record a single-lead EKG by simply touching Kardia Band’s integrated sensor that communicates with the Watch app, Kardia by AliveCor™. The Atrial Fibrillation (AF) Detector then uses Kardia’s automated analysis process (algorithm) to instantly detect the presence of AF in an EKG, the most common cardiac arrhythmia and a leading cause of stroke.

Also included is the Normal Detector, which indicates whether your heart rate and rhythm are normal, and the Unreadable Detector, which tells you when to retake an EKG so physicians receive only the highest quality recordings.

The collected recordings are stored and can be viewed in the iPhone version of the Kardia app, and even sent to a patient's preferred doctor if any suspicious activity is gathered during a reading. AliveCor said that the app can also connect to Apple's stock Health app, so users can integrate their EKG readings into established fitness data like step count and calorie intake to further bolster an overall assessment of their well-being.

AliveCor encourages those interested to sign up on its website to be the first to know when the Kardia Band will be for sale and at what price.

Following a rumor that Apple may sell an iPhone 7 Plus with 256GB storage, Italian website HDblog has shared pictures of a SanDisk 256GB NAND flash memory chip that could be appropriate for the next-generation smartphone.

SanDisk has managed to reduce the size of its 256GB flash memory chip to be smaller than its 64GB counterpart, which makes it a viable option given rumors that the iPhone 7 lineup could be up to 1mm thinner with a larger 3,100 mAh battery.

It remains unclear if the iPhone 7 Plus will still have 16GB base storage, which has been a highly contested option in recent years, or if Apple will opt for larger storage sizes such as 32GB, 128GB, and 256GB at existing price points.

Other rumored iPhone 7 series changes include a faster TSMC-built A10 chip, Smart Connector, dual-lens camera, stereo speakers, Intel 7360 LTE modem, no 3.5mm headphone jack, waterproofing, wireless charging, relocated antenna bands, and more. iPhone 7 Plus models could have 3GB of RAM.

Apple is working to further harden iCloud security so that even it won't be able to access user information stored on its data servers, The Wall Street Journal has reported.

According to yesterday's report, which cites "people familiar with the matter", Apple executives are actively considering how to bolster iCloud encryption without inconveniencing users.

Currently, encrypted data kept on the cloud service is accessible by Apple using a key, which is used for restoring account information if, for example, a user forgets their password. Apple's access also allows the company to provide relevant information it has to law enforcement agencies that approach it with proper, legal requests.

However, Apple appears to be concerned that keeping a copy of the key means it could be compromised by hackers or that the company could be legally compelled to turn it over to governments.

The news contrasts with a report earlier this month suggesting that Apple viewed privacy and security issues differently between physical devices that can be lost and its iCloud service.

However, according to The Wall Street Journal, an Apple spokesperson pointed to comments made by senior VP of software engineering Craig Federighi in reference to the company's fresh concerns. "Security is an endless race—one that you can lead but never decisively win," he wrote in a March 6 opinion piece in The Washington Post. "Yesterday's best defenses cannot fend off the attacks of today or tomorrow."

iCloud backups contain user iMessages and texts, content purchase history, photos and videos, device settings, app data, voicemail password, and health data. Any steps Apple takes to close off access to these backups are likely to further antagonize law enforcement authorities, especially given the company's current fight with the FBI over the latter's demand for help to unlock the iPhone at the center of the San Bernadino shooter investigation.

A court hearing to address the iPhone backdoor issue is scheduled for next Tuesday, March 22, the day after Apple's media event, where it is expected to introduce a new 4-inch "iPhone SE" and a new 9.7-inch iPad, as well as make additional announcements.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Following the U.S. government's filing last week once again urging the court to compel Apple to assist the FBI in unlocking the iPhone of San Bernardino shooter Syed Farook, a document Apple general counsel Bruce Sewell called a "cheap shot," Apple today filed its response arguing that the government's reliance on the All Writs Act dating back to 1789 as justification for the request is an attempt to "rewrite history by portraying the Act as an all-powerful magic wand rather than the limited procedural tool it is."

Today's filing, shared by Business Insider, outlines Apple's arguments as to why the All Writs Act should not apply in this situation and reiterates a number of positions the company has previously described, including belief that this issue needs to be settled legislatively and that the imposition of the order would cause "unprecedented and offensive burdens" and violate both Apple's First Amendment rights and the Due Process Clause.

This case arises in a difficult context after a terrible tragedy. But it is in just such highly-charged and emotional cases that the courts must zealously guard civil liberties and the rule of law and reject government overreaching. This Court should therefore deny the government’s request and vacate the order.

Apple goes on to outline its arguments as to why the All Writs Act is not applicable, noting that Congress had previously declined to expand the Communications Assistance for Law Enforcement Act (CALEA) to include scenarios such as this and that the government's request usurps the legislative authority exercised by Congress.

CALEA’s legislative history makes clear the sound policy reasons behind its specific limitations on when decryption services can be required. During congressional hearings on CALEA, then-FBI director Louis Freeh assured Senator Leahy that CALEA would not impede the growth of new technologies. When Senator Leahy asked whether CALEA would inhibit the growth of encryption, he responded “this legislation does not ask [companies] to decrypt. It just tells them to give us the bits as they have them. If they are [en]crypted, that is my problem.”

In its conclusion, Apple argues that "the government’s motivations are understandable, but its methods for achieving its objectives are contrary to the rule of law, the democratic process, and the rights of the American people."

A court hearing to address the issue is scheduled for next Tuesday, March 22, the day after Apple's media event where it is expected to introduce a new 4-inch "iPhone SE" and a new 9.7-inch iPad, as well as make a few additional announcements.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Apple today opened up its Apple News Format to all publishers, giving independent publishers and individuals tools to offer rich media content within the Apple News app for iOS 9, as noted by Vanity Fair.

Apple News launched as part of iOS 9, offering a one-stop location for users to keep up on news on various topics from a number of different sources. Any publication with an RSS feed could apply to be included in Apple News, but initially only a select group of major publications was given access to the Apple News Format that allowed for much richer content to be included in their feeds.

Since Apple launched the app in September, it has attracted more than 100 major publishers as partners, including this magazine’s Web site. What the new launch means is that anyone—from individual bloggers to smaller, independent news organizations—will be able to edit and deliver their stories, videos, galleries, and audio in the Apple News format, with Apple News’s reach.

As highlighted by Wired, Apple is also rolling out a new analytics dashboard for Apple News publishers, giving them access to data on users viewing their content on the platform.

Apple should be updating its News Publisher portal shortly with details on how publishers can take advantage of the new format for maximum impact.

Apple today seeded the seventh beta of an upcoming OS X 10.11.4 update to developers for testing purposes, just over a week after seeding the sixth OS X 10.11.4 beta and more than a month after releasing OS X 10.11.3. OS X 10.11.4 has been in testing since January 11.

The seventh OS X 10.11.4 beta, build 15E64a, can be downloaded through the Apple Developer Center or via the Software Update Mechanism in the Mac App Store. The update is also available to members of Apple's public beta testing program.

OS X 10.11.4 offers a couple of new features, such as Live Photos support in Messages, the ability to password protect notes in the Notes app, and an option to import notes from Evernote, but like the recent OS X 10.11.3 update, it appears to focus primarily on under-the-hood bug fixes and performance improvements. Almost all of Apple's OS X updates to date have been smaller updates that improve performance rather than introduce new features.

We'll update this post with any features or significant changes that are discovered in the seventh beta of OS X 10.11.4. OS X 10.11.4 is likely to see a spring release alongside iOS 9.3, tvOS 9.2, and watchOS 2.2, with the new software coming as early as March 21, the date of Apple's planned spring event.

The first possible real photo of the iPhone 7 Plus has surfaced on Chinese website Bastille Post (via user Cmmig at the PhilMUG forums), providing a closer look at the design of the upcoming smartphone.

The most notable change is the inclusion of a much-rumored dual-lens camera with a protruding, pill-shaped enclosure, as opposed to two separate circular camera openings depicted in some online renderings.

Rumors are conflicting about whether the iPhone 7, iPhone 7 Plus, or both smartphones will have dual cameras, but it now appears that at least one model may not have a completely flush camera as originally expected.

➜ Click here to read rest of article...

Apple has announced a new partnership with Dubset Media Holdings to stream thousands of remixed songs and DJ mixes, both based on original recordings, that were previously unavailable due to copyright issues. Apple Music will be the first streaming music service to provide access to these previously unlicensed tracks, according to Billboard.

Dubset will use a technology called MixBank to analyze a remix or DJ mix file, identify existing recordings within the file, pay the necessary rights holders, and distribute the mix through Apple Music and other streaming services. The process can take about 15 minutes for a 60-minute recording.

But licensing remixes and DJ mixes, both based on original recordings, is incredibly complex. A single mix could have upward of 600 different rights holders. According to CEO Stephen White, a typical mix has 25 to 30 songs that require payments to 25 to 30 record labels and anywhere from two to ten publishers for each track. […]

MixBank matches the recordings used in the remix or DJ mix against a database of three-audio snippets from Gracenote, where White was CEO prior to joining Dubset. He says fingerprinting is a “brute force” tool that can provide MixBand with up to 100 possible matches for each three-second match.

The rise in popularity of the EDM genre has resulted in an increasing number of user-generated remixes, mash-ups, and DJ mixes of popular songs, and this partnership will help bring those underground tracks to Apple Music and potentially "all 400 distributors worldwide" in the future, said White.

Dubset will retain a percentage of revenue for providing in-house licensing and pay the DJ or remixer a share of that amount. The service "allows everyone to make money on this content for the first time," according to White. The digital distributor has agreements with over 14,000 labels and publishers.

In related news, Beats 1 recently announced that popular EDM artist deadmau5 will host his own show this Friday at 3:00 p.m. Pacific.

Apple today seeded the seventh beta of an upcoming iOS 9.3 update to developers and public beta testers for testing purposes, one week after seeding the sixth iOS 9.3 beta and more than three months after the public release of iOS 9.2, the last major update to iOS 9. iOS 9.3 has been in testing since January 11.

The seventh iOS 9.3 beta is available as an over-the-air update and through the iOS section of the Apple Developer Center (developers only).

As a major update to the iOS 9 operating system, iOS 9.3 introduces several new features. There's a Night Shift mode to reduce the amount of blue light iOS users are exposed to in the evening by shifting the iPad or iPhone display to a warmer (yellower) color spectrum, and there are several features designed to improve the iPad for Education program, such as multi-user login. Multi-user login, while an appealing feature, is limited to MDM customers and is not available to the general public.

Apple Music for CarPlay offers "New" and "For You" sections for better music discovery in iOS 9.3, and a Nearby Feature in CarPlay Maps offers more information about points of interest that are close by. Paired with watchOS 2.2, an iPhone running iOS 9.3 is able to support multiple Apple Watches, and for iPhone 6s users, there are new Quick Actions for Weather, Settings, Compass, Health, App Store, and iTunes Store.

This is likely to be one of the last betas of iOS 9.3 we'll see before it is released to the public. Apple is planning to launch iOS 9.3 in the spring, perhaps following an event that is scheduled to take place on March 21.