Google reveals Mac security holes before Apple’s fix is ready
Microsoft isn’t the only big tech firm grappling with surprise security flaw disclosures these days. Google’s Project Zero security unit revealed at least two unpatched vulnerabilities in OS X (Yosemite appears to have mitigated a third) that theoretically help attackers take control of your Mac. The search company says it privately notified Apple about the holes back in October, but automatically published the details after Project Zero’s usual 90-day cutoff period. Apple’s usual policy is to decline comment on exploits like this until it has a solution. However, relief is at least relatively close — iMore reports that an upcoming Yosemite update (10.10.2) is expected to tackle these flaws. The main question is whether or not Apple can deliver its fix before malware writers find a way to use those bugs for sinister purposes.
Filed under: Internet, Software, Apple, Google
Via: CNET
Source: Google Security Research (1), (2), (3)
Apple ‘Excited’ About HomeKit Partners Despite Slow Rollout
It’s been more than six months since Apple first introduced HomeKit at its June 2014 Worldwide Developers Conference, but HomeKit-compatible products have yet to hit store shelves and may not do so until this spring, almost a year after Apple first detailed its home automation system.
HomeKit’s launch has gone slower than expected, and according to sources that spoke to Re/code, the two major reasons were a “slower-than-expected” launch of the HomeKit MFi program, which began in November, and the late launch of chip specifications, which weren’t sent out to chip makers until October. Apple’s high performance standards for hardware manufacturers and chip makers are also said to be a factor.
Elgato’s upcoming line of HomeKit-compatible products
January’s Consumer Electronics Show saw the debut of several HomeKit-compatible products, including the iDevices smart plug, Elgato’s range of connected home devices, and the Schlage Sense smart lock, all of which may begin hitting store shelves in a few months. Apple gave a statement to Re/code on the upcoming HomeKit products, expressing the company’s excitement.
“We are excited to have a growing number of partners committed to bringing HomeKit products to market, including several announced at CES,” said Apple spokesperson Trudy Muller. “HomeKit offers a set of common protocols making it easier for customers to control HomeKit-enabled accessories using Siri or iOS apps. HomeKit is built on a secure foundation with end-to-end encryption which provides customers a secure connection between their iPhone or iPad and HomeKit accessory. “
HomeKit was announced more than six months ago, but many details about the home automation platform remain murky on the consumer end. It is not quite clear if and how it will interface with existing products or if consumers will be expected to purchase all new connected home items to take advantage of HomeKit. Details about the HomeKit MFi specification that leaked out earlier this week, however, suggest few existing products will be able to be used with HomeKit. 
Apple’s OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google’s Project Zero
Google’s security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple’s OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. […]
Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.
As the 90-day deadline hit during the week, the group began posting its findings online. Google’s notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.
But as pointed out by iMore, Apple’s incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
[B]ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.
Google’s Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that’s left users’ systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.
‘GMT Bug’ in iOS 8 Calendar Syncing Causing Time Zone Confusion for Users [iOS Blog]
A growing number of users on Apple’s support forums are reporting an issue with iOS 8 and the time zones of synced calendar events, reports Forbes. Known by users as the “GMT bug,” the issue is causing confusion as calendar events sometimes see a secondary time zone (frequently GMT) added on.
The issue is documented in a lengthy thread on Apple’s support forums that was started shortly after iOS 8 was released, and it has continued to gain significant attention since that time. According to user reports, calendar events created in one time zone are converted to another timezone possibly when they sync across a server.
Most of the affected appointments originate from either Google or Microsoft Exchange calendars that are linked to the default iOS calendar app. While the appointment remains at the correct time for the user, the actual time setting becomes defined in GMT rather than the user’s local time zone, which can cause issues if the user edits the entry without realizing the different time zone.
There are conflicting reports, however, over whether this behavior is indeed a bug or not. Apple support representatives reportedly have confirmed to at least one user that the company is aware of the issue and working on a fix, while others have been told this is expected behavior.
The issue may in fact be related to a “Time Zone Override” setting in iOS 8 that allows users to maintain a consistent time zone for their calendars even while traveling to different time zones, but even if the GMT addition is intended behavior the implementation is clearly causing confusion for many users.
Apple last updated iOS to version 8.1.2 in December with a fix for disappearing ringtones. A minor iOS 8.1.3 update is in testing with Apple engineers and retail staff, with a public launch expected soon. Developers are now also using iOS 8.2 betas, the fourth of which was released in last week. None of the public or beta versions of iOS are yet confirmed to contain a provision to address this issue.
Apple’s iTunes Radio, Beats, and Others Hit With Unpaid Royalty Suits Over Pre-1972 Music [Mac Blog]
Following a lengthy lawsuit that pitted Sirius XM Radio against members of classic rock band The Turtles in a fight over royalties for music recordings made before 1972, new class action lawsuits have been filed against Apple, Sony, Google, and Rdio over their streaming music services (via The Recorder). As noted by Law360, Beats Music has also been hit with a suit.
According to the suits, filed yesterday by Zenbu Magazines Inc., streaming services like iTunes Radio, Beats, and Google Play Music have been making money off of pre-1972 music recordings without paying any royalties to the owners of the original recordings.
Zenbu owns the copyrights to many songs in question and is represented by The Law Office of Jack Fitzgerald in San Diego. The lawsuit seeks to create a certified “class of all owners of recordings made before February 15, 1972, whose recordings appear on streaming services.”
While musical compositions have been protected under U.S. copyright law since 1831, sound recordings were only added to the federal copyright act in 1972. That’s meant that the holders of copyrights to pre-1972 compositions—largely music publishers—have been paid royalties for public performances while those holding the copyrights to recordings—largely record labels—have not.
As noted by The Recorder, last year a judge in Los Angeles decided to extend ownership rights for pre-1972 recordings to include public performances. Similarly, in that case of Sirius XM versus owners of the sound recordings made by The Turtles in the 1960s, U.S. District Judge Philip Gutierrez ruled against Sirius.
The lawsuits come at a time when Apple is working behind the scenes for an upcoming relaunch of the Beats Music streaming service, rumored to include integration into iTunes and iOS in general. “The streaming services don’t have a good idea of what their total liability is going to be,” noted Santa Clara law professor Tyler Ochoa, with the lawsuits against the numerous streaming music services “inevitable”, following the Sirius XM case.
Due to the growing popularity of streaming services worldwide, Ochoa sees some of the companies perhaps pulling those pre-1972 songs to avoid further liability, with record labels falling in line with their own lawsuits against the services for better royalty deals.
Tetris-Like Puzzle Game ‘Shades’ Named Apple’s Free App of the Week [iOS Blog]
The “super simple, surprisingly challenging” puzzle game Shades, by developer UOVO, has been named by Apple as this week’s App of the Week. Launched last year, and also featured in the App Store’s “Best New Games” section, the game usually costs $1.99 to download.
The game takes inspiration from Tetris, with falling blocks of varying color hues – instead of shapes – needing to be slotted into the correct position by the player. Matching hues make darker colors, resulting in chain moves that can knock out entire rows of blocks.

A mesmerizing, calming, zen-like experience that quickly evolves into a devilishly challenging puzzler. Meditation + Panic. It’s a fantastic combo.
A very simple game that will challenge you to think very fast.
“Surprisingly difficult!” ~ The guys who made it.
Features:
– Simple rules
– Intuitive gameplay
– Difficult to master
– 3 modes of play. Easy. Medium. Hard.
– Beautiful, colorful, minimalist design.
– Sound design by ONBC
The longer players spend in the game and the better they become, the quicker the game evolves into a frantic rush to slot blocks into the correct position as they fall faster and faster.
The game currently sits at a solid 4.5 star rating in the App Store, with one review calling it “Tetris meets 2048” and many others praising its addictiveness alongside the challenging nature the game slowly builds up to. Shades: A Simple Puzzle Game can be downloaded for free for the next week from the App Store. [Direct Link]
Photos of 12-Inch MacBook Air Display Show Black Glass Cover, Polished Apple Logo
Just days after a report claiming Apple supplier Quanta Computer has begun ramping up production of the upcoming 12-inch MacBook Air, Chinese site iFanr shares some photos [Google Translate] of what it says is the display assembly for the machine (via SlashGear).
The photos depict the claimed display and metal shell from the upcoming 12-inch machine alongside both a 13-inch MacBook Pro and a 9.7-inch iPad, with its sizing appearing to measure up to previously reported dimensions. The display does, however, have two noticeable differences from current MacBook Air. First, instead of a backlit Apple logo on the back of the display assembly as is typically seen on Apple’s notebooks, there is a polished metal logo more like those seen on iPads, with iFanr speculating the change could be tied to the device’s thinness.
Additionally, the display lacks the grey bezels current MacBook Air models have, instead opting for an apparently all-glass edge-to-edge cover for the display as seen on Retina MacBook Pro models. Paired with black bezels underneath, it is difficult to see where the display ends and the bezels begin unless the screen is turned on. Earlier renderings of the 12-inch MacBook Air based on information from within Apple had shown gray bezels similar to those seen on the current MacBook Air.
Claimed 12-inch MacBook Air display assembly with 13″ MacBook Pro
The 12-inch MacBook Air will reportedly have roughly the same footprint as the 11-inch MacBook Air, relying on smaller bezels to compensate for a larger display size. The comparison photos shown by iFanr demonstrate the significantly smaller footprint for the 12-inch machine compared to a 13-inch MacBook Pro
Claimed 12-inch MacBook Air display assembly with 9.7-inch iPad
The next-generation MacBook Air is expected to feature a high-resolution display (perhaps classified as Retina) and new Broadwell Core M processors that will enable a thin, fanless design. Other reports have claimed the 12-inch MacBook Air will do away with nearly all the ports typically found on Apple’s line of MacBooks, offering only a headphone jack, a pair of microphones, and a USB Type-C port that may handle both charging and external connectivity.
Apple Aiming for 19 Hours of Apple Watch Battery Life With ‘Mixed Usage’
One of the biggest mysteries about the upcoming Apple Watch is its battery life. Previous rumors have hinted that it will need to be charged once a day, and Apple CEO Tim Cook himself said that users will want to charge it on a daily basis, but concrete battery life information has yet to be revealed.
New details on the Apple Watch’s possible battery life have now surfaced from inside sources that spoke to 9to5Mac, revealing information on the battery life Apple was aiming for and what it may actually be able to achieve.
As of 2014, Apple was reportedly aiming for 2.5 to 4 hours of active application use with 19 hours of active/passive use, plus 3 days of pure standby time and four days if the watch was sleeping. That’s somewhat in line with early rumors, which suggested Apple was targeting a three to five day battery life for the device. While Apple was aiming for three to four days of standby time, two to three days, and while it’s aiming for 19 hours of mixed usage, it “may not hit that number in the first generation version.”
The Apple Watch is equipped with a tiny but powerful S1 chip, and its performance is similar to that of the A5 processor from the iPhone 4s and the iPad 2. It also has a 60-FPS Retina-class display, which, along with the S1 chip, results in a significant amount of power usage.
Apple has also been stress-testing the Apple Watch’s battery life with pre-bundled and third-party applications. Our sources say that Apple is targeting 2.5 hours of “heavy” application use, such as processor-intensive gameplay, or 3.5 hours of standard app use. Interestingly, Apple expects to see better battery life when using the Watch’s fitness tracking software, which is targeted for nearly 4 hours of straight exercise tracking on a single charge.
As Apple is positioning the Apple Watch as a timepiece, the company has conducted numerous tests to determine how long it can run purely in time-keeping modes. We’re told that the Watch should be able to display its clock face for approximately three hours, including watch ticking animations, if nothing else is done with the device.
These usage numbers make it sound like the Apple Watch will need to be charged multiple times a day, but it’s unlikely that Apple Watch users will use apps and games continuously for hours, allowing the Apple Watch to last for approximately a day before needing to be charged. When not in active use, the Apple Watch goes into a battery-preserving sleep mode.
Apple originally hoped to launch the Apple Watch in late 2014, but delays with software optimization ultimately caused the company to push back the release of the device until 2015, giving it time to eek out as much battery life as possible. Apple is also said to be perfecting the Apple Watch’s MagSafe charger, improving its recharging time.
Current rumors suggest the Apple Watch could launch in March of 2015, at the tail end of “early 2015.” While complete pricing remains unknown, the entry-level model will sell for $349.
T-Mobile’s ‘Smartphone Equality’ Program Ends Credit Score Requirement for Loyal Paying Customers
T-Mobile today announced a new program that makes it easier for customers with poor credit to receive discount pricing on devices and other deals previously only available to credit-worthy customers. CEO John Legere kicked off the new “Smartphone Equality” promotion with a video blog that explains the rationale behind the program.
Legere notes that half of Americans do not qualify for most carrier-advertised phone deals due to poor credit or a lack of credit history, and T-Mobile aims to change that by “putting our relationship with you above some number pumped out by a credit bureau, some huge faceless bureaucracy.”
With its new “Smartphone Equality” program, T-Mobile is emphasizing the customer’s relationship with the carrier instead of their credit score. As part of the initiative, customers who have paid their wireless bill on time for 12 months will be eligible for discounted pricing, including the carrier’s popular zero down and no credit check programs. The “Smartphone Equality” program will be available starting next week to eligible customers.
T-Mobile has been shaking up the cellular industry with its ongoing Un-carrier promotions, which broke new ground by removing the cellular contract from a smartphone purchase and offering generous early termination bonuses for customers who switch to T-Mobile. Recently, the wireless carrier introduced its Un-carrier 8 initiative, which includes a new “Data Stash” program that rolls over unused monthly data and makes it available for the following 12 months.
Longtime Apple Board Member Mickey Drexler to Retire in March [Mac Blog]
Mickey Drexler, who has served on Apple’s Board of Directors since 1999, will retire at the end of his current term, according to a new shareholders filing. Drexler’s term ends at the annual shareholder’s meeting, on March 10, 2015. A replacement for Drexler has not yet been chosen.
On January 16, 2015, Millard “Mickey” Drexler, 70, who has served on the Board since 1999, notified the Board of his intention to retire at the end of his current term, which will expire at the Annual Meeting. The Board has not yet nominated an individual to fill the vacancy that will be created by Mr. Drexler’s departure from the Board.
Drexler is the CEO of JCrew and was formerly the CEO of Gap, where he’s widely credited for the chain’s popularity during the 1990s. Jobs brought Drexler in to help define Apple’s retail store goals at a time when its retail push was just beginning. Ron Johnson was hired during the same time period, and the first Apple Stores launched in 2001.
Drexler is the second longtime board member to leave the Apple Board of Directors in recent months, with Bill Campbell retiring back in July of 2014. He was replaced by BlackRock’s Susan Wagner.
(Image courtesy of BU Today)




