MacRumors

Just a week after new WireLurker iOS malware surfaced, there's yet another vulnerability in iOS that can potentially be used to install malicious third-party apps. Called Masque Attack for its ability to emulate and replace existing legitimate apps, the flaw was discovered by security research company FireEye.

Masque Attack works by luring users to install an app outside of the iOS App Store, by clicking a phishing link in a text message or email. For example, in a demo video, an SMS message with a link attached was sent with the following text "Hey, check this out, the New Flappy Bird."

Once clicked, the link directs to a website, which prompts the user to install an app. The app in the video isn't Flappy Bird, but a malicious version of Gmail that installs directly over the legitimate version of Gmail downloaded from the App Store, making it virtually undetectable.

Masque Attack can be used to install fake versions of apps over legitimate App Store versions using iOS enterprise provision profiles, which are used for beta testing or by companies to distribute apps to employees without the need for the official App Store.

As explained in a blog post, as long as both the existing App Store app and the malicious imposter app use the same bundle identifier (a unique identifying number), the fake version will replace the actual app in a way that's very difficult for the user to detect. The hidden malicious app is able to upload email messages, SMS messages, phone calls, and more, which is possible because "iOS doesn't enforce matching certificates for apps with the same bundle identifier."

While the attack cannot replace stock Apple apps like Safari and Mail, it is able to affect apps that have been installed via the App Store, and has the potential to be much more dangerous than other vulnerabilities like WireLurker.

Masque Attacks can pose much bigger threats than WireLurker. Masque Attacks can replace authentic apps,such as banking and email apps, using attacker's malware through the Internet. That means the attacker can steal user's banking credentials by replacing an authentic banking app with an malware that has identical UI. Surprisingly, the malware can even access the original app's local data, which wasn't removed when the original app was replaced. These data may contain cached emails, or even login-tokens which the malware can use to log into the user's account directly.

FireEye has gotten the attack to work on iOS 7.1.1, 7.1.2, 8.0, 8.1, and the 8.1.1 beta. The company notified Apple about the vulnerability on July 26, but iOS users can protect themselves by not installing apps from third-party sources other than the official App Store, avoiding clicking on "install" popups in SMS messages or third-party websites, and avoiding apps/uninstalling apps that give an "Untrusted App Developer" alert.

iOS 7 users can check to see if they've been the victim of an attack by going to Settings --> General --> Profiles to see what provisioning profiles are installed. iOS 8 devices do not show installed provisioning profiles, making it more difficult to detect an attack.

Rumors have suggested that Apple is aiming to open a new research and development facility in Cambridge, England, over the coming weeks, and it appears the company has also made some hires in the area.

According to TechCrunch, Apple has hired five employees that created the Pin Drop mapping app. The hires are not part of an acquisition of the Pin Drop technology, but have included multiple former Pin Drop employees.

Pin Drop was a map app that allowed users to drop custom created tags and pins that could be shared with others to point out interesting landmarks and spots to visit. Pins could be kept private, shared with friends, or shared with the community. Pin Drop's service was shut down on October 31 and the app was removed from the App Store. On Facebook, the app's creators said they were unable to secure the necessary funding to "turn Pin Drop in to the world changing app we envisaged."

An initial Pin Drop blog post mentioned the core Pin Drop team had acquired their "dream jobs" ahead of the shutdown, and one former employee tweeted that he had been hired by Apple, though both hints of new jobs were later deleted. Currently, five former Pin Drop developers are listed as Apple employees, with the following jobs: Senior Product Designer, Software Engineer, Software Engineer, iOS Software Engineer, and Maps Data Analyst.

All of the former Pin Drop employees who now work at Apple continue to be located in London and have not moved to Apple's Cupertino headquarters, suggesting they could eventually be housed in the company's upcoming Cambridge office. It is unclear what their specific roles include, but at least one employee is working on Apple's Maps team.

Apple has worked hard to improve Maps over the last two years, acquiring several mapping companies including C3 Technologies, Broadmap, Embark, Hopstop, WifiSlam, and Locationary. Some major Maps improvements are said to be in the works, like transit directions and indoor mapping, both of which could come in a future iOS 8 update.

Apple's assembly partner Pegatron is boosting its production capacity in order to help Apple increase inventory of the popular iPhone 6, reports Nikkei. According to local press sources, Apple may also be turning to Pegatron to supplement production of the iPhone 6 Plus, which has seen tight supplies as Foxconn has struggled to meet demand.

Local press reports suggest Apple may also tap Pegatron to produce the iPhone 6 Plus since Foxconn has been struggling to cope with demand. Pegatron officials did not comment directly on the media speculation.

Pegatron's Chief Executive Jason Cheng confirmed in a recent earnings conference call that the company has invested more than $200 million this year in capital expenditures to boost production output, with an additional $300 million planned for 2015.

Pegatron repeatedly has benefitted from strong iPhone sales with an increasing amount of revenue coming from its communications products division, which is responsible for smartphone and tablet production. Though the company's overall Q3 2014 revenue fell due a dip in its computer assembly business, revenue from its communications division increased 10 percent year-over-year.

Pegatron is a long-time manufacturing partner for Apple, serving as a supplementary assembler for previous iPhone and iPad models. The company took a lead manufacturing role for the first time in the assembly of Apple's iPhone 5c, which was introduced alongside the iPhone 5s last year.

Barclaycard last week announced a revamped version of its credit card partnership with Apple, the Barclaycard Apple Rewards Visa, offering a new Apple rewards program and financing deals (via AppleInsider).

The new reward card offers three points per dollar spent at the Apple Store (iTunes and App Stores do not qualify), two points spent in restaurants, and one point on all other purchases. Once a customer breaks 2,500 points, they receive a $25 Apple Store gift card.

Within the first thirty days of opening an account, users can also finance purchases made through Apple with deferred interest. Purchases under $498 can be financed for six months, $499-$998 for twelve months, and $999 and over for eighteen months.

The last Barclaycard with iTunes Rewards didn't have a triple-points reward tier for customers. It started at paying out two points for every dollar spent at the Apple Store or iTunes Store, and one point for every dollar spent everywhere else. Instead of an Apple Store gift card, the payout at 2,500 points was an iTunes gift card.

The card isn't yet confirmed to work with Apple Pay, but is expected to as both Visa and Barclaycard are participating partners. The new card also supports Chip & Pin security, not Chip & Signature like most other new cards in the United States, with an embedded EMV Chip for security.

The Barclaycard Apple Rewards Visa can be applied for today on Barclaycard's Official Website. Apple is also promoting the new card, touting its reward and financing options, on the company's online store.

Apple is planning to open a new facility that includes research and development operations in Cambridge, England within the next few weeks, reports Business Weekly (via MacGeneration).

The company's new offices are said to be located at 90 Hills Road, which is described as a prestigious corporate building and is located near the likes of headquarters belonging to Microsoft and Sony. More than 1000 technology companies have established offices in Cambridge since 1998, with the region earning the nickname of "Silicon Fen" in reference to Silicon Valley. Other companies including microprocessor manufacturer ARM and wireless communications company Broadcom also have campuses in Cambridge.

According to the report, Apple is aiming to start with 20 employees in its new offices, and will look to grow to a total of 40 employees in the coming year. The UK was also said to be working hard for the past 25 years to persuade Apple to establish an office in Britain. Apple has numerous R&D centers around the world, including buildings in Israel, Shanghai, Taiwan, and more.

Apple today released a new web tool for users to deregister their phone number from iMessage in the event they switched to a non-Apple device. To deregister a phone number from iMessage, users simply enter their phone number in Apple's web tool, receive a free text message containing a code, and submit the code to complete the process. Users who still have their original iPhone can also transfer their SIM card back to the device and go to Settings -> Messages to turn iMessage off.

Users switching from an iPhone to another device were often unable to receive SMS messages from another iPhone due to their phone number still being linked to iMessage. These specific errors with iMessage have been a well-known issue since 2011, which is when the messaging service debuted with iOS 5. They were also made even more apparent this past May, where a server glitch caused widespread message delivery problems. Apple was even sued over the matter in a California court, although the company claimed that it was aware of the issue and could not provide a fix.

Apple's web tool for deregistering phone numbers from iMessage is available now.

The Pangu development team today updated its jailbreak for iOS 8 and 8.1, bringing full support for the Mac. The update comes a week after the program saw an update for Windows that brought an automatic installation of Cydia and support for the English language.

Pangu's jailbreak tool for iOS 8 is the first that is compatible with any device running iOS 8.0 to iOS 8.1, including newer devices such as the iPhone 6, iPhone 6 Plus, iPad Air 2, and iPad mini 3. The jailbreak method allows users to install content like themes, tweaks, and apps from other sources than the App Store. The Pangu development team recommends that users backup their iPhones, iPads, and iPod touches before using the tool, and notes that devices upgraded over-the-air may need to be restored before being jailbroken.

Cydia administrator Jay Freeman noted on his Twitter that the Pangu jailbreak is "stable enough" and said that developers on Cydia are now able to mark their own apps as iOS 8 compatible. Members on our forums are also maintaining an active list of which Cydia apps are compatible with iOS 8 and Pangu's jailbreak, and interested users should look there for more specific information.

Pangu can be downloaded for OS X and Windows as an untethered jailbreak, meaning that users only have to apply the method once. The release of the tool follows an announcement by the Electronic Frontier Foundation yesterday stating that a new petition was filed with the Librarian of Congress to extend an exemption that allows jailbreaking to be legal. The exemption was last renewed in 2012 and created by the U.S. Congress in 2010.

As forecasted, the third calendar quarter of 2014 was a stellar quarter for Mac shipments, with Apple gaining ground on its competitors in the US. According to IDC's quarterly PC tracker (via Re/code), Apple reached its highest PC market share ever reported, a metric that accounts only for Mac shipments and does not include the iPad.

The company gained ground with 13.4 percent of the US PC market, edging out Lenovo (10.7 percent) to grab the number three spot behind HP (27.7 percent) and Dell (24 percent). Shipments in the US climbed to more than 2.26 million in the third calendar quarter of 2014.

Globally, Apple's market share climbed 5.7 percent year over year, with the company selling a record-breaking 5.5 million units in the just ending quarter. Apple now sits in the number five spot when it comes to global PC shipments, behind Lenovo, HP, Dell and Acer.

Apple refreshed its MacBook Air and Retina MacBook Pro earlier this year with updated processors and other minor improvements. The company also dropped prices on some models and heavily promoted the desktops during the back-to-school season with a $100 gift card along with a discounted purchase price for both students and educators.

Next year may see even stronger Mac sales as Apple prepares to update its Mac lineup with Intel's Broadwell processors. A 12-inch MacBook with an ultra thin chassis, a Retina display, and an Intel Core M chip may be one of the first Broadwell machines to ship in the new year.

The first Beats product to be released under Apple's guidance has been unveiled in documents recently submitted to the FCC, suggesting Apple will soon be releasing a pair of Beats Solo2 headphones that include wireless Bluetooth functionality.

As seen in diagrams, the design of the new wireless Solo2 headphones is nearly identical to Beats' existing Solo2 line. The Solo2 headphones are the company's newest product, released in May, just a day after Apple's Beats acquisition became official.

The Beats Solo2 headphones will contain Bluetooth and BLE radios, allowing them to function wirelessly. Beats currently offers a wireless version of its more expensive Studio headphones, but its Solo2 line is somewhat more affordable. The company's current non-wireless Studio headphones retail for $300 while the wireless version retails for $379, suggesting Solo2 wireless headphones could sell for approximately $279 if it uses the same markup.

At $3 billion, Apple's Beats acquisition is its largest in history, and Beats' line of successful headphones was said to be one of the driving factors behind the purchase. Beats' aggressive marketing tactics and clever advertising campaigns have skyrocketed its headphones to popularity, and they are very popular with athletes and the younger demographic. A survey released shortly after the acquisition was finalized suggested that a large percentage of students believed Beats would make Apple more "cool."

The new Solo2 wireless headphones remain under FCC review for the time being and a potential release date is unknown.

Though Apple and GT Advanced fought to keep documents related to their sapphire agreement sealed after GT's bankruptcy filing, a judge recently ruled that the documents did not contain trade secrets and would be largely unsealed.

One of those documents, an unedited affidavit from GT Advanced COO Daniel Squiller, gave insight into the terms of the deal between the two companies, but another, the original privacy agreement that GT Advanced signed, gives a rare look into how Apple does business with its suppliers.

According to the documents, Apple and GT's sapphire deal was known internally as "Project Onyx," and was subject to strict confidentiality agreements. GT employees were forbidden from referring to Apple or the project by anything other than code names, and they were also required to undergo training regarding confidentiality and security in addition to signing extensive non-disclosure agreements. Only employees who needed to know about the project were given information, in order to keep the deal as quiet as possible.

GT was required to establish a qualified security team and adhere to strict guidelines that called for 24/7 surveillance, credential screening, tracking of all confidential supplies, and the secure destruction of all scrap materials to prevent potential leaks.

As part of the agreement, Apple was able to audit records, inspect facilities, and interview personnel to ensure compliance, and any evidence of non-compliance with the non-disclosure agreement would result in a $135,000 "Security Fee" to pay for the cost of the audit and an increase in Apple's security efforts.

In addition to agreeing to Apple's strict access restrictions, GT Advanced was required to maintain liability insurance, and comply with Apple's Supplier Code of Conduct, which demands safe working conditions for employees. GT was also required to fulfill orders for replacement goods for seven years after "the date Apple designates as end-of-life" for the Apple product featuring sapphire, as well as maintain an "adequate stock" of materials for Service Units.

The privacy agreement that GT Advanced was required to sign is likely similar in nature to the agreements that Apple gives to all of its suppliers, giving us a glimpse of the lengths Apple goes to in order to maintain secrecy. Despite Apple's privacy efforts, the company still sees extensive product leaks. For example, ahead of the iPhone 6 and 6 Plus release, hundreds of part leaks divulged information on nearly every aspect of the two devices, and a handset was even seen in the wild days before its official release.

Apple and GT Advanced fought to keep key documents related to their sapphire agreement out of the public eye after the latter company filed for Chapter 11 Bankruptcy protection, but earlier this week, a judge ruled that the documents did not contain trade secrets or confidential information, and would thus be largely unsealed.

As of today, those previously sealed documents are now available for public inspection, including an unedited affidavit [PDF] from GT Advanced COO Daniel Squiller. Squiller submitted a revised affidavit on October 28, which gave some insight into the deal between Apple and GT Advanced, but the newly available unedited version expresses much stronger negative feelings towards the partnership and places more of the blame for GT's failure on Apple.

According to Squiller, Apple used a "bait-and-switch" strategy, offering GT Advanced "an onerous and massively one-sided deal" in 2013. He says that Apple initially drew GT in with the promise of a huge deal, originally agreeing to purchase sapphire furnaces and let GT operate them, but eventually demanding a "fundamentally different deal" requiring GT to purchase the furnaces itself.

The new structure, as a contract matter, shifted all economic risk to GTAT, because Apple would act as a lender and would have no obligation to purchase any sapphire furnaces, nor did it have any obligation to purchase any sapphire material produced by GTAT.

GT gave into Apple's new terms because it had "invested months negotiating a sale contract with Apple while being effectively locked out of pursuing other opportunities with Apple's competitors." During "extensive and all-consuming" negotiations with Apple, GT ceased speaking to other companies about its furnaces due to the lure of Apple's large offer.

Apple reportedly told GT not to bother attempting to negotiate because it "does not negotiate with its suppliers." GT was required to agree to all of Apple's terms or risk losing the deal, and as has been previously noted, the contract was highly favorable to Apple, requiring GT to produce sapphire that Apple was not obligated to buy. Squiller alleges that when GT execs balked at the terms, Apple said "Put on your big boy pants and accept the agreement."

As Squiller previously described, the company's relationship with Apple became "unsustainable" after Apple refused to take responsibility for cost overruns and expenses that it caused due to its control over operations. Apple also reportedly selected fabrication equipment that "could not economically produce a product that Apple would accept" and then refused to permit equipment changes that would allow the company to produce an acceptable product.

Squiller accuses Apple of "embedding" itself in GT's operations so deeply that GT was forced to "divert an inordinate amount of its cash and corporate resources" into the Mesa facility, affecting GT's continued viability as a whole.

Apple, in documents asking that Squiller's affidavit remain sealed, said his statements were "untrue, irrelevant and defamatory," stating that Squiller's declaration "goes far beyond what was reasonably necessary to describe the Debtors' current financial situation and instead includes gratuitous characterizations of Apple's motives, negotiating tactics and business practices."

Apple and GT Advanced have already reached an agreement to officially end their partnership, nullifying the terms of the original deal. Under the terms, GT will repay its loans to Apple by selling off its sapphire furnaces, and it has already begun shutting down its Mesa, Arizona plant and laying off employees.