MacRumors

Apple Watch will bring the world's latest breaking news and headlines to your wrist from a wide variety of publications and sources in the United States and abroad, including the Associated Press, ABC News, Bloomberg, Breaking News, CNN, CNBC, CBC News, Circa News, Fresco News, De Telegraaf, South China Morning Post, The Economist, The Guardian, The New York Times, The Washington Post, USA TODAY and Yahoo News Digest.

Many of the Apple Watch news apps will provide breaking news notifications and bite-sized headlines through Glances, while some provide additional functionality such as expanded views and personal feeds of news stories, reviews, opinions and more. As the Apple Watch becomes more widely adopted, and launches in additional countries, more apps from well-known news publications should begin to surface on the App Store.

Over the past few days a handful of reports have been accumulating in regards to two security flaws, one affecting roughly 1500 iOS apps and a second affecting OS X users despite Apple having tried to patch the vulnerability on OS X 10.10.3.

The first security flaw is making about 1500 iPhone and iPad apps vulnerable to hackers who could leverage the vulnerability to steal passwords, bank account information, and a handful of other sensitive information, according to Ars Technica. Discovered by security analytics firm SourceDNA last month, the "man-in-the-middle" attack was fixed in a 2.5.2 update to AFNetworking, the open-source code which housed the vulnerability.

Unfortunately, some developers have yet to update to the newest version of the code, leaving those 1500 apps open and vulnerable to the attack, which "can decrypt HTTPS-encrypted data" and essentially allows anyone generating a fake Wi-Fi hotspot access to a user's data on that same Wi-Fi connection. As a result, SourceDNA scanned and analyzed most apps on the App Store for the security flaw, and even created a search tool to discover if a particular app is under risk.

The day the flaw was announced & patched, a quick search in SourceDNA showed about 20,000 iOS apps (out of the 100k apps that use AFNetworking) both contained the AFNetworking library and were updated or released on the App Store after the flawed code was committed. Our system then scanned those apps with the differential signatures to see which ones actually had the vulnerable code.

The results? 55% had the older but safe 2.5.0 code, 40% were not using the portion of the library that provides the SSL API, and 5% or about 1,000 apps had the flaw. Are these apps important? We compared them against our rank data and found some big players: Yahoo!, Microsoft, Uber, Citrix, etc. It amazes us that an open-source library that introduced a security flaw for only 6 weeks exposed millions of users to attack.

Some of the known apps currently vulnerable to the man-in-the-middle attack includes Citrix OpenVoice Audio Conferencing [Direct Link], Alibaba's mobile app [Direct Link], and even Movies by Flixster with Rotten Tomatoes [Direct Link]. SourceDNA urges users to check their most used apps in its search tool for the security flaw, and promises to remove apps that have been fixed and add ones discovered to be vulnerable as time goes on.

The other flaw, called "Rootpipe", dates back to 2011 and has been known for some time. Apple intended to patch the Rootpipe vulnerability in OS X 10.10.3 earlier this month, although older versions of OS X were left vulnerable. But as reported by Forbes, former NSA agent Patrick Wardle has discovered the flaw to still be present on Macs running OS X 10.10.3, as well as older versions.

Apple put additional access controls to stop attacks, but Wardle’s code was still able to connect to the vulnerable service and start overwriting files on his Mac. “I was tempted to walk into the Apple store this [afternoon] and try it on the display models – but I stuck to testing it on my personal laptop (fully updated/patched) as well as my OS X 10.10.3 [virtual machine]. Both worked like a charm,” Wardle told FORBES over email. In a blog post, he’d said his exploit was “a novel, yet trivial way for any local user to re-abuse Rootpipe”.

Discovered last October, the Rootpipe flaw essentially allows a hidden backdoor to be created on a particular system, opening up root access of a computer to a hacker after they obtain local privileges on the device. Physical access or previously granted remote access to the target machine is required in order for the vulnerability to be exploited.

Most recently, Apple faced the "FREAK" security flaw in its systems, making everything from an Apple TV to an iPod touch vulnerable to stolen sensitive information. The company issued a few security updates on all platforms in the weeks following the discovery of the security flaw, beefing up security and working to assuage public concerns. In regards to the man-in-the-middle iOS and re-emerging Rootpipe flaws, the company has yet to comment.

Update: Alamofire Software Foundation has posted a response to the controversy over the AFNetworking issue, refuting SourceDNA's claims about the number of apps affected by noting that even if an app used a vulnerable version of AFNetworking, it would not be susceptible to attack as long as communication is handled over HTTPS with SSL pinning.

If your app communicates over HTTPS and enables SSL pinning, it is not vulnerable to the reported MitM attacks

A significant proportion of apps using AFNetworking took the recommended step of enabling SSL certificate or public key pinning. Those applications are not vulnerable to the reported MitM attacks.

Alamofire's Mattt Thompson tells MacRumors that there is simply no way to tell whether or not an app is vulnerable without trying to to initiate a man-in-the-middle attack, which SourceDNA did not do. Regardless, all developers using AFNetworking in their apps should update to version 2.5.3 immediately.

Apple Watch order statuses have begun changing from "Processing Items" to "Preparing for Shipment" as Apple gets ready to send out the first Apple Watch orders to customers who pre-ordered their devices on Friday, April 10. Apple Watch orders that have changed to "Preparing for Shipment" are still listing prospective delivery dates of 4/24 to 5/8, but the first orders are expected to begin arriving on Friday April 24, the official launch date of the Apple Watch. Now that order statuses have shifted, customers should begin receiving shipment emails in the near future.

The change to customer order statuses comes just minutes after Apple began charging credit and debit cards for Apple Watch purchases. As we have previously mentioned, bulk shipments of the Apple Watch have already been arriving at central distribution centers across the United States from China, where the Apple Watch was manufactured. Apple Watch orders will ship out from these central distribution centers via Fedex and UPS, so despite the late shipping date, many devices will arrive on Friday.

With the iPhone 6, Apple also shipped hundreds of thousands of devices to central distribution centers before updating customers on the status of their orders. iPhones began shipping out on Monday and Tuesday for a Friday delivery, and it's likely Apple Watch orders will follow the same general timeline.

Deliveries could come from any of the major shipping hubs in the United States, which include Memphis, Tennessee; Louisville, Kentucky (UPS' WorldPort location); Indianapolis, Indiana; Newark, New Jersey; and Oakland, California. Many orders are likely to pass first through Anchorage, Alaska, where both UPS and FedEx have logistics centers, before heading out to other distribution sites.

The earliest Apple Watch pre-orders listed ambiguous delivery dates of 4/24 to 5/8, but Apple's head of retail Angela Ahrendts stated in a memo to employees last week that "customers who pre-ordered will start receiving deliveries next Friday as planned," so customers who managed to pre-order in the minutes before shipping dates started slipping will see deliveries this week.

Once an order changes to Preparing for Shipment, customers may be able to track by reference number using a phone number on the UPS and FedEx websites to get tracking information before a shipping email even goes out.

According to dozens of tweets and emails received by MacRumors, Apple has just begun charging customers who pre-ordered the Apple Watch for their purchases. The charges suggest that early Apple Watch orders will soon shift from "Processing Items" to "Preparing for Shipment" as Apple gears up to begin sending devices to customers ahead of the Apple Watch's Friday April 24 launch date.

As we shared earlier today, bulk shipments of the Apple Watch have already begun arriving at central distribution centers across the United States and are ready to begin heading to customers over the next few days. We haven't seen word of shipments happening yet, but status changes should happen within the next few hours.

Apple Watch pre-orders began selling out within minutes as orders came up on April 10, but those who managed to place an order shortly after 12:01 a.m. Pacific Time will likely receive an April 24 delivery date. Even the earliest Apple Watch pre-orders offered delivery estimates of April 24 to May 8, but Apple retail chief Angela Ahrendts suggested the first Apple Watch orders would arrive on April 24 in a memo shared with employees last week.

Customers who were not lucky enough to pre-order within the first few hours that the Apple Watch was available will likely be waiting for several more weeks to receive their devices, but Apple executives did tell one MacRumors reader that those orders could arrive sooner than expected as supplies ramp up. Apple Watch pre-orders placed today offer shipping estimates that range into June and beyond.

A number of notable apps have been updated with Apple Watch support to start off the week, including Shazam, Microsoft OneDrive, Porsche Car Connect, FIFA 15 Ultimate Team by EA SPORTS, Epicurious, Nick Jr, ESPN, Avea, JetBlue and Letterpad. The updates should be rolling out on the App Store today prior to the Apple Watch launch on April 24.

Shazam for Apple Watch will enable you to discover which artist, song and lyrics you are listening to from your wrist in seconds. You will also be able to see your past Shazams at a Glance with a simple swipe up gesture, turn on Auto Shazam to continue discovering music automatically and use Handoff on Apple Watch and iPhone to buy songs on iTunes, watch videos and more. Shazam is free on the App Store.

Microsoft recently released an update for the OneDrive app to view your photos and albums stored on the cloud storage service on an Apple Watch. You can view your most recent photos, delete photos you don't want to keep, find photos by tag and view your albums directly from your wrist using the latest version of the app. OneDrive is free on the App Store with tiered storage plans available.

EA Sports has introduced new Apple Watch features for FIFA 15 Ultimate Team that help you assemble and manage the ultimate soccer team from your wrist. FIFA 15 Ultimate Team for Apple Watch lets you manage your top five player transfers and get instant game-related notifications. FIFA 15 Ultimate Team by EA SPORTS is free on the App Store with in-app purchases available.

➜ Click here to read rest of article...

Apple Watch pre-orders are being sent to centralized distribution points across the United States as couriers prepare the shipments to be delivered ahead of the wrist-worn device's launch on April 24, according to a source for MacRumors that has provided accurate information in the past.

Apple retail chief Angela Ahrendts confirmed earlier this month that Apple Watch pre-order deliveries will begin on April 24 as scheduled, although many customers have received shipping estimates of 4-6 weeks or later and it remains unknown how many Apple Watch pre-orders will be delivered on day one.

iPhone 6 and iPhone 6 Plus pre-orders began switching from "Processing Items" to "Preparing for Shipment" on the Apple Online Store for several customers on the Monday prior to Friday delivery, so customers that pre-ordered the Apple Watch early should see their order status change soon. Due to limited stock and the wide 4/24—5/8 delivery estimate for launch day pre-orders, however, there is a possibility that pre-order statuses may take longer to change.

To date, we've not seen any reports of pre-orders changing or credit cards being charged, but our source assures us bulk shipments have begun, so we should see movement on individual order statuses very soon. In the meantime, Apple has begun charging credit cards and preparing to ship Apple Watch accessories such as the charging cable and AppleCare+ Protection Plans.

Apple Watch pre-orders were available on April 10 at 12:01 AM Pacific through the Apple Online Store in the United States, Australia, Canada, China, France, Germany, Hong Kong, Japan and United Kingdom, and sold out completely in less than six hours. The company also began taking Apple Watch try-on appointments the same day at Apple retail stores and select fashion boutiques such as Selfridges in London, Isetan in Tokyo and Galeries Lafayette in Paris.

Update: In line with this report, Apple is beginning to charge credit cards and Apple Watch pre-order statuses are changing to "Prepare for Shipment."

Apple on Monday shared its 2015 Environmental Responsibility Report that reflects on the company's environmental progress during the 2014 fiscal year. The report focuses on Apple's commitment to climate change, renewable resources, finite resources, and toxins, and outlines the company's 2014 carbon footprint and other usage information.

iMac shipping estimates have slipped to 3-5 business days on the Apple Online Store in the United States for all models aside from the entry-level 21.5-inch option with a 1.4GHz dual-core Intel Core i5 processor. The high-end 15-inch Retina MacBook Pro is also now showing an estimated shipping date of 1-2 weeks. Both the iMac and 15" Retina MacBook Pro were previously listed as in stock.

Earlier today the Apple Watch went on display at Milan's Salone Del Mobile Design, with Apple SVP of worldwide marketing Phil Schiller and design consult Marc Newson in attendance. Now, it appears that Jony Ive also made it to the event, revealing exclusive sport band colors for the Apple Watch at the same time.

Developer demand for Apple's annual Worldwide Developers Conference always exceeds ticket supply, so Apple holds a lottery to determine which developers will win the chance to go to the conference. This year, Apple accepted lottery entries from April 14 until today, April 17, at 10 a.m. Pacific Time.

Former Apple iOS chief turned Snapchat advisor Scott Forstall has taken on a new project, according to his first ever tweet on Twitter. Forstall is co-producing the upcoming Broadway musical Fun Home, a show that opens this Sunday.