icloud
Latest
iOS flaw tricks you into giving up your iCloud password (updated)
Successful hack attacks often happen not because of tricky coding, but plain old "social engineering" -- ie, conning people. A Github researcher called "jansoucek" has discovered an iOS exploit that works on that principal to steal people's iCloud passwords. The latest version of iOS, 8.3, apparently fails to filter out potentially dangerous HTML code embedded in incoming emails. The researcher's proof-of-concept code takes advantage of that by calling up a remote HTML form that looks identical to the iCloud log-in window. It could easily trick someone into entering their iCloud username and password, then hide the dialog after the user clicks "OK."
Apple's Photos app is now available to all OS X Yosemite users
You no longer have to be a beta tester (or work at Apple) to give the new Photos app a spin. The Cupertino crew has released the finished version of its OS X Yosemite 10.10.3 update, which centers around the more powerful and iOS-friendly picture management hub. Yes, you can now kick iPhoto to the curb and rely on iCloud Photo Library to sync your images. There are also a few things you might appreciate even if you're not a shutterbug, such as support for more diverse emoji and Spotlight suggestions in Look Up. While this isn't a gigantic update, it's definitely worth grabbing if you think that the Mac's official photo software is overdue for a tune-up.
Office for iOS can store your files in iCloud
Until you, if you'd wanted to use Microsoft Office on iOS, you'd have been stuck using Dropbox, OneDrive or SharePoint to store your files online. For some reason, Apple's home-grown storage service was a notable absentee, but thankfully one that has been now remedied. In the most recent update, Microsoft has enabled users to save their documents, spreadsheets and presentations to iCloud, so long as they're running iOS 8. Unfortunately, it's not as simple as with the other platforms, since you have to dig into the "More" section before you can select the option. Still, better than nothing, eh?
Apple salvages its US job plans by turning a factory into a data center
Apple has long had dreams of bringing more manufacturing to the US, but the reality has been harsh at times -- the Arizona sapphire plant it helped build went down the tubes last year after its key partner, GT Advanced, went bankrupt. However, the tech giant has at least managed to salvage something out of this messy situation. Apple tells Bloomberg that it's converting the failed factory into a solar-powered "command center" for its worldwide networks. The effort will see it pour $2 billion into the facility (one of Apple's biggest investments yet, the company claims) and create 150 direct jobs, not to mention 300 to 500 related positions in construction and support. It's not clear when the data center will be ready, but GT has control of the place until the end of 2015.
Hacking your iCloud files just got easier, even with two-step enabled
An update to Elcomsoft's Phone Breaker software now makes it easier for bad guys to bypass Apple's vaunted new two-factor authentication to steal your iCloud stuff. As before, the hackers would need some information to start with -- either your Apple ID/password plus a two-factor code, or a digital token stolen from, say, your laptop. That would give them access to your account anyway, but here's the kicker: The Phone Breaker app can then create a digital token granting intruders permanent access without a two-step code until you change the password. It also allows someone to view all your iCloud files at a glance, making it easier to pick and choose which to steal. The tool is used legitimately by law enforcement to access lawbreakers' phones, but was also recently implicated in a celebrity phone hack.
PSA: Don't lose your Apple ID recovery key if you are using two-factor authentication
Apple's two-factor authentication may protect you from a hacking attack, but the extra layer of security has one major "gotcha" that could trip you up. As related by The Next Web's Owen Williams, the security feature uses a recovery key that you should never ever lose. If you misplace this key, you may be locked out of your Apple account permanently. Williams faced this unfortunate situation when he was the target of an unsuccessful hacking attempt. His Apple ID was locked due to security reasons following the hack, and Williams could not unlock his account using his user name and password or even a trusted device. Williams needed his recovery key, which was lost somewhere in the shuffle of his files and devices. Let Williams' experience be a cautionary tale -- if you decide to use two-factor authentication, then you should take extra care to store your recovery key in a safe place. Print and store it in a trusted location or take a picture of the key and store it in locally on another drive. You can even upload it to Dropbox, Google Drive or some other storage service as long as they are secure. If you already have two-factor authentication configured and you discover you have lost your recovery key, then you can replace it at any time by following the steps below. Go to My Apple ID (https://appleid.apple.com/account/home) Select Manage your Apple ID and sign in with your password and trusted device Select Password and Security Under Recovery Key, select Replace Lost Key When you create a new key, your old Recovery Key is no longer usable. This restoration option is only available if your account is accessible and not locked for security reasons. You can read more two-factor authentication on Apple's support website. Be sure to revisit William's cautionary tale of how easy it its to lose control of your Apple ID if you are not careful.
Tim Cook meets with Chinese authorities over iCloud attacks
What do you do when you're the CEO of Apple and hackers are targeting Chinese users of your iCloud service? You set up a meeting with the vice premier of the country, Ma Kai, to discuss what can be done to protect the data of users and how to strengthen communication between your company and the Chinese government. Reuters (via AppleInsider) reported today that Tim Cook met with the vice premier in Zhongnanhai (the government complex in Beijing) to discuss the attacks that began last weekend. Those attacks were initially reported by activist group GreatFire.org, which has been accusing the Chinese government of being involved in the man-in-the middle hack. iCloud user data is being gathered by spoofing the iCloud.com site, forcing Apple to take some measures to help out users. Those measures included publishing a guide on how users can verify how they're on the official iCloud.com site while using Safari, Chrome and Firefox web browsers, and GreatFire.org reports that Apple appears to be rerouting user data to fend off future attacks. It's good to see Cook getting hands-on with regard to issues that could jeopardize the company's standing with users in what may soon become the company's biggest market.
Apple acknowledges iCloud attack, says servers were not affected
Following reports yesterday that China was secretly collecting data from iCloud users, Apple has confirmed to Dow Jones that it is aware of network attacks on its service. The iPhone maker said it knows about "intermittent organized network attacks" on people who were trying to access iCloud.com, although the company failed to mention China specifically in the statement to Dow Jones. Apple did say these recent attacks had not compromised its servers, and added that iOS and desktop users (who running the latest version of OS X) should not be worried -- it appears this issue was limited to the iCloud website. We've reached out to Apple for comment and will keep you in the loop should any more details emerge soon. Update: Below is Apple's official statement on the matter, along with a link to some browser security instructions.
China allegedly using iCloud to secretly collect user data
Notorious for the constant surveilling and censorship of its people, the Chinese government appears to be at it again -- this time with Apple iOS users. According to a report from GreatFire.org, a website that focuses on privacy matters, China has secretly started collecting iCloud data through what's known as a "man-in-the-middle" intrusion; basically, the attacker eavesdrops by independently connecting to the user and making it seem as if it's a private connection, when, in fact, it isn't. Chinese Security expert Zhou Shuguang suggests that the network service providers are likely being told by the authorities to use fake trust certificates, making it rather easy for them to conduct these attacks.
Macworld runs down everything you need to know about iCloud security
If you've been a bit confused over the various iCloud security tweaks and alterations that have cropped up over the past few months, you're absolutely not alone. Apple's two-factor authentication, the company's recent security tweak that pushes more notifications of account activity to your various devices, and the introduction of app-specific passwords has left even experienced users with spinning heads, but Macworld's Glenn Fleishman lays it all out in a great new explainer that is definitely worth a read. The key takeaways here are that yes, you should absolutely be using Apple's two-factor authentication -- here's how to set it up, by the way -- especially now that it offers extended protection to iCloud and your backups. Despite any fear mongering you may have heard or read about the risk of losing your account forever due to misplaced passwords or broken devices, the chances of this actually happening by accident are so slim as to be trivial, and your personal security should outweigh this concern.
Apple enables unique passwords for apps that tap into iCloud
Do you use third-party apps like Outlook that access Apple's iCloud but don't support two-factor authentication? You'll now be forced to enter a specific password for each one. Following a notorious celebrity hack, Apple updated iCloud with an extra security layer used to protect accounts by sending a four-digit code to your personal device. However, many third-party calendar, contact and email apps that access iCloud don't support two-factor, and could therefore expose your iCloud password -- and all your personal data -- to hackers. Apple said that if you're signed in to one of those apps when the change goes through today, you'll be signed out and forced to generate and enter a new password. To see how, check after the break or click here for more.
Apple launches tool to check Activation Lock status of an iOS device
Apple today launched a utility on its website that allows anyone to check the activation lock status of an iPhone handset. Users will be required to provide the IMEI or serial number of the device they wish to test. The tool will be useful for customers who are buying a used iPhone, iPad or iPod touch on popular reseller sites such as eBay or Craigslist. Prospective buyers will be able to confirm the phone has been removed from iCloud and is ready for use by a new owner before purchasing used hardware. Activation Lock is a theft deterrent feature of Find My iPhone in iOS 7/8. It requires a user to enter the Apple ID and password of the original owner before resetting the phone or disabling iCloud on the device. The feature is turned on automatically when Find My iPhone in enabled on a device running iOS 7 or later. Though useful for iOS device owners concerned about theft, the feature can be a problem for used phone buyers who inadvertently acquire a device with activation lock enabled. To use these locked devices, the new owner must obtain the Apple ID account credentials of the previous user before enabling iCloud on the device or resetting their newly purchased phone. This new utility will allow a buyer to check the status of a device before purchasing it. It also makes it easy for the original owner to confirm that Activation Lock has been successfully disabled before selling a device. You can check out the new Activation Lock tool on Apple's website. [Via iDownloadblog]
Apple's new iCloud tool can show if a used iPhone is stolen
The market for used iPhones is fraught with risk, because you may end up paying hundreds of dollars for a locked off device, or worse -- one that appears legit but can't make calls. However, Apple has just revealed an iCloud tool that lets you check a device's activation lock status. All you'll need is the iPhone's IMEI or serial number, and if you're the rightful owner, you'll get info on how to disable any activation locks before selling. Meanwhile, buyers will be shown how to remove the previous account (with the seller's permission). The tool will be particularly useful at sussing out "doulCi" devices, which bypass iCloud to enable activation but won't actually connect to a cell network. That'll prevent you from being fooled by a stolen or lost iPhone that appears to work, but is effectively... an iPod.
Equil Smartpen 2 captures notes, sketches with a real pen
For a lot of people, there's no substitute for taking notes with a pen and piece of paper. You can draw, annotate, write, and organize your information in a real notebook. The problem comes when you want to get some of that information into a computer, at which time you usually have to transcribe your handwritten notes and then try to recreate your drawings or scan them. Well, the Equil Smartpen 2 (US$169, pre-order on Indiegogo) wants to change all that by giving you a comfortable ballpoint pen that captures all of your writing and sketching on plain paper, moving it to either a Mac app (Equil Note, free) or one of several free iOS apps (Equil Note HD for iPad, Equil Note for iPhone, Equil Sketch HD for iPad, and Equil Sketch for iPhone. Design The Equil Smartpen 2 reminds me of some pens that I've received as handout promotional items ... and I mean that in a good way. It's triangular in shape, wider than your usual "stick ballpoint pen", and has a good feel to it. The point where your fingers hold the pen is made of a translucent white plastic that tapers down to the pressure sensitive tip, while the rest of the body is made of a white plastic. Looking close up at the pen, you notice several things that clue you to the fact that this is not just a plastic pen. There's a small grey rectangular button on one side, and near the top you'll find a glowing white LED and a pair of charging contacts. The entire pen fits into what's called a "Charging Cradle and Convenience Case" that holds not only the charger for the device, but the receiver for the pen. That receiver is a small 3-inch long rectangular box that slides out like a drawer from the charging cradle. Folding around the triangular charging cradle is a magnetically-secured cover similar to Apple's Smart Covers. There's even a pop-out cap for the pen, which should help the pens last longer as they won't dry out. It's a very attractive package. Equil will be selling the devices singly or in two-packs; we received a two-pack (two pens) for the review. Functionality For me, the real test of the Equil Smartpen 2 was going to be on how well it worked. I've tried a lot of "smart pens" over the years, and to be honest I was pretty skeptical about how well this device would capture text and sketches. My first test was with my iMac, which is running OS X Yosemite beta. Upon pulling the little receiver out of the charging cradle, I noticed a previously hidden switch for setting modes. It has three positions: one marked with the Bluetooth symbol for shutting off Bluetooth and just capturing pen motion with the pen alone, one marked "Other" for Mac OS X, Windows, and Android, and another marked iOS. The receiver is clipped to the top of the page of whatever you're writing on. If you happen to be using something like a Field Notes notebook or Moleskine, you can just clip it to the page, write and draw, turn the page, and clip it onto the top of that page. That receiver is able to determine the bounds of the page and tells you when you're getting too close to the top or the bottom by flashing a red light. I believe it's using some sort of infrared connection with the pen, as there is a function in the Mac app to determine if you're getting either radio frequency or infrared interference. Pairing the device to my Mac was simple - it just required holding down a power button until a tiny blue LED flashed, then using the OS X System Preferences to complete the pairing. At that point, I fired up the Equil Note app. The app design is flat and very "Yosemite-like", with individual documents combined in collections. The piece of paper you're writing on is represented by a blank piece of "paper", and there are on-screen buttons for changing the ink width and color, switching between a pen, brush and highlighter, selecting or "lassoing" a section of transcribed writing or drawing in order to delete or move it, a tool for typing notes or annotations onto the page from your Mac keyboard, a tool for grabbing a small photo of yourself to insert into the notes, and another tool for selecting the color of virtual paper you want to write on. For any note, you can add as many pages as you want. You can select the paper size (Letter, A4, A5, B5, B6 or custom), add tags to a note, name the note, or share it with a number of services. Equil Note has built-in integration to Evernote, and devices can be synched via either Dropbox or iCloud as well. One interesting in-app purchase for Equil Note is the addition of handwriting recognition packages for a number of languages. Those packs run $5.99 each, or all languages can be installed for a single $19.99 purchase. I did seem to have some issues with getting the receiver to stay paired and connected with my iMac - I'm not sure if that's an issue with OS X Yosemite or if the app just isn't happy with my Mac, but twice I had to eliminate a pairing and re-pair to get things working again. After trying out the Mac app for a while, I switched over to the iPhone version of Equil Note to give it a try. It's similar, and the app is very well done. I actually had an easier time getting the iPhone app to pair with the device and then connect to the app then I did with the Mac app, but both worked equally well, providing almost instantaneous "reflection" of my writing and drawing on the screen of the Mac and the iPhone. What I was able to ascertain during my testing of the Equil Smartpen 2 is that it works, and it works very well. Most of the other devices I've tried either required expensive special paper, had a pen that didn't actually write on the piece of paper, or were so slow in transmitting the pen strokes to the computer or device that they were worthless. Not so with the Equil Smartpen 2. One thing I really find to be useful is that you can shut off the Bluetooth connection altogether and just capture your writing with the pen and receiver. Later, when you're near an iPad, iPhone or Mac (or those other devices...), you can sync up the receiver to them and transfer the captured writing to your computer for sharing. I was not able to test the handwriting recognition, so I don't have any idea of the accuracy of the software that's used. There are some gestures that can be turned on in the software to make your life a bit easier; one lets your double-tap the wake button on the pen to get a new blank page started, while two others let you navigate back and forth between pages by holding down the button and circling the pen clockwise or counterclockwise. Right now, as part of the Indiegogo funding campaign, you can get an Equil Smartpen 2 for $60 off of the regular retail price of $169. For $109, you're getting a single pen with the very cool charging/receiver dock. They also have a $199 special that gets you the 2-pack, so you'll always have a pen charged up and ready to write. By the way, the pen is supposed to last about 8 hours on a charge. Conclusion The Equil Smartpen 2 is the first pen-to-computer input device that I'd actually consider purchasing. Between the well-designed and implemented hardware and the incredibly well-done Mac and iOS apps, it's obvious that a lot of hard work and thought went into the creation of this accessory. There are a few small annoyances with Bluetooth pairing that should get fixed, but otherwise, this is a solid product right out of the starting gate. Rating: 3-1/2 stars out of 4 stars possible
Developer claims Apple was warned of iCloud security issue in March
A software developer in London warned Apple of iCloud's vulnerability to a brute-force attack months before the service was implicated in the leaks of hundreds of explicit photos and videos of celebrities. As reported by The Daily Dot, Ibrahim Balic brought the security hole to Apple's attention in a series of emails that began this past March. Balic provided emails to an Apple official as evidence that the company knew well ahead of the photo scandal. In the correspondence, Balic notes the ability to bypass the account lockout feature which is supposed to kick in after a large number of incorrect login attempts. Without this safety feature in place, Balic's testing attempted over 20,000 password tries in rapid succession. This type of attack is a common way to gain access to user accounts on a variety of platforms, which is why many companies place a hard restriction on the number of times a login can be attempted before the account is locked. Balic's emails didn't fall entirely on deaf ears, as a response from Apple notes that they investigated the vulnerability and determined that "it would take an extraordinarily long time" to breach an account in this way. Balic also submitted a formal bug report using Apple's developer portal. In the wake of the photo leaks, Apple tweaked its security to patch brute-force vulnerability, and expanded two-factor authentication. For the record, the company's carefully-worded statements on the matter deny that a breach of any Apple service occurred, or was to blame for the celebrity photo leaks.
Apple gives PCs access to iCloud Drive before Macs
iOS 8 might working its way to iPhones and iPads, but Apple's long-awaited desktop refresh, Yosemite, is still receiving the final tweaks before it launches to the public. One element that features prominently between both platforms is iCloud Drive, Apple's own version of Dropbox. It's now available to mobile users, but Mac users can't enjoy its file-syncing features if they're using older versions of OS X. However, and this doesn't happen often, Windows users can get in on the action before their Mac-toting counterparts. In an updated version of the iCloud for Windows, Apple has added full support for iCloud Drive, letting PC owners interact with their files and documents from the comfort of their desktop. Mac users, of course, will enjoy additional iCloud features when Yosemite launches in the coming weeks, but for now, Windows users with iPhones and iPads can enjoy a very rare period of privileged access.
Tim Cook lays out Apple's security policies as iOS 8 arrives
Whatever you think of Apple's commitment to its user's security as of say... two weeks ago, CEO Tim Cook seems to be following up on his promise to bring more clarity to the company's efforts. Tonight he posted a letter to Apple customers on the company's website, launching a new section focused solely on "Apple's commitment to your privacy." There you'll find information information on how to use tools like two-factor authentication, recognize security threats and info on picking a strong password. Also included is the publicly available data on government requests and a little chest thumping on what Apple says it does to protect users that other companies (they mean Google) might not. [Image credit: AP Photo/J. Scott Applewhite]
Setting up two-step verification for Apple ID and iCloud security
Since you're probably moving to iOS 8 soon -- if not as soon as possible after it goes live -- you might want to start thinking about security as well. In particular, Apple has recently enabled two-step verification for iCloud. What's two-step authentication? As Apple describes it on this web page, "Two-step verification is an additional security feature for your Apple ID that's designed to prevent anyone from accessing or using your account, even if they know your password." Considering the recent issues involving nude celebrity photos that were pulled from iCloud, it's great to see that Apple added one more level of security. Basically, two-step verification requires you to verify your identity using one of your devices before you can sign into My Apple ID to manage your account, sign in to iCloud on a new device or at iCloud.com, make an iTunes, iBooks or App Store purchase from a new device, or get Apple ID related support from Apple. I recently set up two-step verification for my Apple ID, and the process isn't that difficult. To begin with, sign into My Apple ID using your Apple ID and password. Once you're in, go to the Password & Security tab on the left side of the My Apple ID page and click it. Under two-step verification, select Get Started, and then follow the simple onscreen instructions. Note that this doesn't all happen in one day. You'll actually have to wait a few days for an email to arrive: Now what will happen is that each and every time you log in to make changes to your account, make a purchase, or connect from a new device, you'll have to verify your identity from one of your devices. This requires you to receive a 4-digit random code on one of your trusted devices that must be entered in to verify that you're coming in from that trusted device. Just yesterday, Apple sent out an update email to two-step authentication users letting them know that the service also protects iCloud. The email, seen below, also includes information about the requirement for app-specific passwords starting on October 1, 2014. That's a big deal. If you use iCloud to store data from any third party apps and you're using two-step verification, remember that you will need to get an app-specific password in order to make it work starting on October 1, 2014.
PSA: Do not upgrade to iCloud Drive during iOS 8 installation
Today is the day Apple is making iOS 8 available to the public. The latest version of iOS has several new features like widgets and third-party keyboards that make it a must-have upgrade for most iPhone owners. If you are upgrading to iOS 8, there is one "gotcha" during the upgrade process that you must avoid and that is iCloud Drive. We cannot stress enough how important this is -- if you make a mistake with this iCloud Drive option, you may lose the ability to sync all your files stored in iCloud with your Mac and iOS 7 devices. We are not the only ones warning you -- developers such as Realmac and Day One are issuing similar advisories. Background on iCloud Drive iCloud Drive is Apple's new and improved iCloud syncing and file storage feature that allows you to share documents between your iOS 8 devices and your Mac running OS X 10 Yosemite. When you upgrade to iOS 8 and enable iCloud Drive, your documents are migrated from Apple's older iCloud "Documents and Data" sync service to the company's new iCloud Drive service. iCloud Drive may be a wonderful addition to Apple's ecosystem, but it is NOT COMPATIBLE with older versions of iOS (iOS 7 or earlier) or older versions of OS X (OS X 10.9 Mavericks or earlier). This presents a major problem for iPhone owners with an older iOS device that can't run iOS 8 or those with a Mac as OS X Yosemite is not available publicly yet. This iCloud Drive option has the greatest potential to trip up Mac owners as many owners are still on OS X Mavericks as it is the most current public release. OS X Yosemite is available only to Mac developers and to users who are participating in Apple's Yosemite Beta program. What version of OS X am I running? If you are unsure which version of OS X you are using, then click on the  icon in the upper left corner of your menu bar and select "About This Mac." A dialog box will appear that shows the basic details about your Mac, including the version of OS X that you are running. If you are running OS X Yosemite Beta, it will be stated clearly in the dialog box. If it does not say "OS X Yosemite Beta," then you are still running OS X Mavericks or earlier and should not upgrade to iCloud Drive in iOS 8. Do not upgrade to iCloud Drive If any of your devices are running iOS 7 or earlier or your Mac is on OS X 10.9 Mavericks or earlier, then do NOT UPGRADE to iCloud Drive as you will lose the ability to sync your documents that are currently installed in iCloud. If you are not sure, then play it safe by refusing the iCloud Drive upgrade. If you accidentally upgrade, there is no going back and you will not be able to sync your iCloud documents with your Mac until OS X Yosemite debuts later this fall. What to do during the iOS 8 upgrade During the upgrade process for iOS 8, you will see an option for iCloud Drive as shown below, please select "Not Now." Once you select, "Not Now" all your iCloud data will remain accessible and all your iCloud-enabled apps will continue to sync data between all your iOS and OS X machines. When OS X Yosemite is released later this fall, you then can safely start using iCloud Drive. Until then, avoid it like the plague. What to do if you accidentally upgrade to iCloud Drive If you accidentally upgrade to iCloud Drive, don't panic. You cannot go back to the older iCloud "Documents and Data" sync feature , but all is not lost. You have two options -- you can do without iCloud syncing, use your apps on one platform and wait until OS X Yosemite debuts. In this scenario, you could use the Clear task manager on your iPhone and not use the Mac version of the app until Yosemite is available publicly. Most people, though, can't do without iCloud syncing and need to restore the feature as soon as possible. These users should apply for Apple's OS X Yosemite Beta program and update their Mac to the beta version of OS X as soon as possible. They also should upgrade all their iOS devices to iOS 8 so they can sync data between their iPhones and iPads. Once all devices are running OS X Yosemite and iOS 8, then syncing across platforms should be back up and running.
Apple iCloud backups are finally protected by two-factor authentication (update)
Need another reason to activate two-factor authentication on your Apple device? Ars Technica and Apple Insider report that the security check now extends to cover iCloud device backups too, something it didn't do before. That means if someone gets your password, or is able to reset it, they could pull down the data with a tool like Elcomsoft Phone Password Breaker and have access to anything stored there -- it's thought that many of the stolen personal photographs of celebrities recently posted online were obtained by this method. With two-factor authentication, they'd need access to your trusted device to generate a four digit code to get in. Another security tweak Apple just turned on is a notification that lets users know when their account has been accessed, to make sure it's for legit reasons. Before your new iPhone and Watch show up to handle your selfies, payments and anything else better kept private -- hit Apple's website and turn the extra level of security on. Update: Tonight Apple sent out an email to Apple ID accounts detailing the change. It also mentions that beginning October 1st, app-specific passwords will be necessary for third-party apps that don't support two-factor (like Outlook or Thunderbird) to access iCloud. If you have an account it should be in your inbox, or you can check out the text after the break.