Apple Outlines Steps for Developers to Validate Xcode Following Malware Attack

Following last week’s disclosure of new iOS malware called XcodeGhost, which arose from malicious versions of Xcode hosted on third-party servers, Apple has outlined instructions for developers to ensure the version of Xcode they are using is valid.

When downloading Xcode from the Mac App Store, or Apple’s website so long as Gatekeeper is enabled, OS X automatically checks the app’s code signature and validates it against Apple’s code. If you must obtain Xcode elsewhere, follow these steps:

To verify the identity of your copy of Xcode run the following command in Terminal on a system with Gatekeeper enabled:
spctl –assess –verbose /Applications/Xcode.app

where /Applications/ is the directory where Xcode is installed. This tool performs the same checks that Gatekeeper uses to validate the code signatures of applications. The tool can take up to several minutes to complete the assessment for Xcode.

The tool should return the following result for a version of Xcode downloaded from the Mac App Store:
/Applications/Xcode.app: accepted
source=Mac App Store

and for a version downloaded from the Apple Developer web site, the result should read either
/Applications/Xcode.app: accepted
source=Apple

or

/Applications/Xcode.app: accepted
source=Apple System

Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode. You should download a clean copy of Xcode and recompile your apps before submitting them for review.

Apple issued a statement in response to XcodeGhost over the weekend, noting that it has removed all infected apps it is aware of from the App Store and is working with developers to ensure they are using a legitimate version of Xcode.

“We’ve removed the apps from the App Store that we know have been created with this counterfeit software. We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps.”

XcodeGhost affected dozens, and possibly hundreds, of App Store apps. iPhone, iPad and iPod touch users should read what you need to know about XcodeGhost to learn more about the malware and how to keep yourself protected.

Office 2016 for Mac Now Available as One-Time $150 Purchase

Microsoft has announced that Office 2016 for Mac is now available for a one-time $149.99 purchase without an Office 365 subscription. Office Home & Student 2016 includes Word, Excel, PowerPoint and OneNote for home use on one Mac. Office 2016 for Mac requires Mac OS X 10.10 or later.

The standalone version of Office 2016 for Mac features offline storage and 15GB of OneDrive cloud storage, but lacks Outlook, Publisher, Access, tablet and phone support, 60 minutes of Skype calling, instant updates and technical support included with the Office 365 version.

Office Home & Business 2016 for Mac is also available for $229.99 and includes Word, Excel, PowerPoint, OneNote and Outlook on one Mac. Comparatively, subscription-based Office 365 Personal and Office 365 Home cost $69.99 per year and $99.99 per year respectively.

Office Home & Business 2016 for Windows is also now available through Office 365 for between $69.99 and $99.99 per year, or as a one-time $229.99 purchase. Office Professional 2016 for Windows is also available with Publisher and Access for $399.99. Windows 7 or later is required.

The $1 million iOS bug bounty is bad for security research

The public perception of the black-hat hacker is of a lone person sitting in a dark room creating malware and unleashing it on the world and reaping the profits of their exploit. The reality is a bit more complicated and far more financially lucrative. Nothing shines a light on this more than the Zerodium publicity stunt of offering $1 million for iOS 9 zero-day exploits. Founder Chaouki Bekrar has a history of selling exploits to the highest bidder instead of disclosing the issue to the maker of the compromised product. It flies in the face of responsible disclosure of exploits by security researchers and means that anyone with enough cash will have the ammunition to ruin the digital life of anyone with an iPhone.

Unlike corporate bug-bounty programs that pay researchers to share exploits found in products so that a company can squash those problems, Zerodium doesn’t want these exploits closed. At least not until it can resell the exploit for a profit. Lance Cottrell, chief scientist of security firm Ntrepid told Engadget that these exploits are “almost certainly going to be used against people’s best interests.”

That’s if the bounty is ever collected. This seems more like good PR than an actual call to arms. On the black market certain zero-days can fetch up to six figures. Throwing down a million dollars certainly caught the attention of a lot hackers and media. Adding Apple just makes it all the more enticing. “Any story that can use Apple’s brand can attract more attention,” said Cottrell.

Bekrar seems sure that the bounty will be paid. In fact, his company is offering to pay for up to three exploits. He told Engadget, “there are many experienced researchers working on iOS exploits or stockpiling iOS zero-days for various reasons, and we believe that many of these talents will be attracted by the bounty and will definitely succeed.”

Scum. RT @Zerodium: Breaking News: We offer one million US dollars ($1,000,000) for iOS9 exploits/jailbreak: https://t.co/Th5XxNbJjB

— comex (@comex) September 21, 2015

Collected or not, in the security researcher world, this type of bounty is frowned upon. “It does not promote the general security of internet or the population. It does a lot of harm,” according to Cottrell. Most researchers will notify a company and work with them or at least give them time to patch the issue before going public with their findings. Even when a vulnerability is disclosed before talking to the company, at least its out in the public. The parties involved and the public have a chance to see what’s happening and fix the situation or at least call for action.

Bekrar doesn’t see any issues with how his company deals with exploits, “if morality is giving to a multi-billion dollar company such as Apple or Google advanced security research for free or for a ridiculous bug bounty, many researchers do not agree to follow such a morality.”

Zerodium instead shares the exploit’s it purchases with its client base. While it won’t share that list or how much it charges for its wares, there’s a good possibility that some of the company’s inventory will end up in the hands of a government entity like the United States.

Andrew Crocker, EFF staff attorney told Engadget that the exploit will presumably be snatched up by a government to be used as an offensive tool. The US routinely buys and collects these vulnerabilities and deploys or discloses them as they see fit. Crocker has been working for more government transparency on how that system works. He recently acquired the the United States’ VEP (Vulnerabilities Equities Process) policy via a FOIA request. The heavily redacted document at high level describes the government handles vulnerabilities including those purchased from private companies.

Meanwhile companies like Zerodium will buy and sell exploits that can be potentially used against us. Well not all of us. When you spend over a million dollars for a backdoor into a system you’re going to be stingy with it. A wide-scale attack will make bring a lot of attention to the vulnerability and which would alert the vendor to fix the problem. Instead the customer, whether it be corporate or government will target certain individuals: criminals, heads of state, dissidents, business rivals. It’ll get the information it needs without raising too many alarms.

Like the process of finding zero-days, the way they will be used will be methodical and highly targeted. If everything goes as planned they won’t find out. No one will find out. It’ll be research conducted in a secrecy for profit that benefits only a few entities and leaves the rest of us vulnerable.

Apple did not reply to Engadget’s queries concerning this article. We will update the article when it does.

Source: Zerodium

Apple Gives Roundhouse Music Venue ‘Environmental Makeover’

As the Apple Music Festival continues at London’s Roundhouse performing arts and concert venue, Apple environmental head Lisa P. Jackson announced that the company has given the historical venue an “environmental makeover“.

We’re making major upgrades to the lighting, plumbing, and HVAC systems; installing recycling and composting bins; arranging to turn used fryer oil into biofuel; buying renewable energy credits to cover the Roundhouse’s September electricity use; and offering reusable water bottles instead of plastic ones.

Apple says they expect the changes to reduce Roundhouse’s annual emissions by 60 tons, save 60,000 gallons of water a year and divert more than 1,600 kilograms of waste from landfills. Apple has continually noted that one of its goals is to “leave the world better than they found it”, which Jackson echoes in her tweet highlighting the renovation. The company has also continually highlighted its own environmental responsibility with annual reports.

The Apple Music Festival continues until September 28, with performances from The Weeknd, One Direction, Pharrell and Florence + The Machine still to come.

WatchOS 2 hands-on: What Apple Watch should have had from the start

Ignoring the mixed reviews, common sense and the usually wise advice that you should avoid first-gen products at all costs, I bought an Apple Watch last June. Honestly, I’m still surprised by that. I backed the original Pebble crowdfunding campaign, and I’ve tested a few Android Wear devices, but as a whole smartwatches have always left me wanting. If I was going to wear anything on my wrist, I typically preferred a dedicated fitness tracker. But after hearing about what Apple had planned for watchOS 2 (the software that powers the Watch), I felt compelled to snap up a 42mm Apple Watch Sport. Now, a little more than five months after the Watch’s launch, that long-awaited update is here. And while it doesn’t fix all of the Apple Watch’s flaws, it’s a significant improvement for the crazies like me who bought one already. Slideshow-322291

Upgrading to watchOS 2 took over an hour, including a surprisingly lengthy download. (Pro-tip: Make sure you’ve got your charging puck ready, as the upgrade won’t start without it.) There weren’t any major changes once my Watch finally rebooted, though I noticed that the animated jellyfish watch face stayed on the screen much longer than before. It’s a minor thing, but it makes it easier to show off what the Apple Watch is capable of to friends. Similarly, you can now have your Watch keep its display on for 70 seconds, not just 15.

The biggest addition to watchOS 2 is something that would sound familiar to early iPhone users: native apps. Previously, third-party Apple Watch apps relied on your iPhone to do just about everything, making for interminably long delays. You’d probably spend more time staring at the circular loading screen than whatever you were looking for from an app — not exactly what you’d want for a new flagship Apple device. With watchOS 2, developers can now have their apps run directly on the Watch, which should speed things up considerably. Those apps also have access to more of the device’s features, including the Digital Crown, “taptic” feedback and health tracking.

As of today, there seem to be only a handful of Watch apps built specifically for WatchOS 2, though I’d expect that to change over the next few weeks. Citymapper was one of the first native Watch apps to appear on my phone, and it certainly feels zippier than before. The app loads in about a second, and it lets you easily plan a trip from your current location to your home or other saved address (which you have to add from the iPhone app). You can also view nearby bus and subway stops, and, surprisingly, even locations for NYC’s Citibike stops. The big takeaway: It actually feels like an iOS app now, rather than a mere shell of an app.

There are also a slew of other updates throughout watchOS 2 that makes it a better overall experience. Apple’s Siri virtual assistant is a bit smarter now — it can even direct you to specific locations within apps. For example, you ask Siri to “start a running session” and it’ll open up Apple’s fitness app with a choice of available running workouts. Siri can also pull up “Glances,” the informational screens that appear alongside the clock app, on its own, instead of pushing you to search for things on your iPhone. Apple says Siri’s responsiveness has also been improved, but in my short testing the “Hey Siri” command hasn’t really improved. It still takes me a few tries sometimes before Siri actually starts listening for commands.

Of course, there are also a handful of new watch faces, including time-lapses of cities like New York, Hong Kong, and Paris, photos and albums. It can also take advantage of the new “live photo” feature on the iPhone 6S and 6S Plus, which displays short video segments from before and after you shoot a photo. You can also add more “complications” (the watch industry term for features, which seems wildly out of place when referring to smartwatches) to the watch face from third-party apps. There isn’t much room to work with, but at least you have the freedom to make tiny bits of news stories or flight details one of the first things you see on your Apple Watch.

A new feature called “Time Travel” also lets you wind the Digital Crown back or forth to see calendar events or even the upcoming weather. Previously, you could wind the Crown to interact with some watch faces, but it didn’t display any useful information. There’s also a night stand mode that reorients the watch face sideways so you can charge your watch on its side.

For the most part, watchOS 2 is more about what it enables, rather than any immediate features. But just like when Apple kicked off the App Store on iOS, it portends some fundamental shifts in the way the Apple Watch works. The big problem? Apple doesn’t have much of an excuse for not delivering most of watchOS 2’s features when the Apple Watch launched. It’s not as if Apple is unaware of the benefits of a strong app ecosystem.

In our original review, we called the Apple Watch a “status symbol for iOS devotees.” That’s still the case today, but watchOS 2 shows that Apple is learning from its mistakes. And who knows, maybe next year I’ll actually be able to recommend the Apple Watch without hesitation.

Jon Fingas contributed to this report.