macOS Sierra Addresses Dropbox Security Concerns by Explicitly Asking for Accessibility User Permission

Following Dropbox-related security concerns that surfaced earlier this month, developer Phil Stokes has confirmed that macOS Sierra now explicitly requires apps to ask for user permission to access Accessibility (via Daring Fireball). Users can give access to an app, or click “not now” to deny the request.

Concerns were raised after it was demonstrated that Dropbox appears in System Preferences > Security & Privacy under Accessibility, despite the fact that users were never prompted to grant access to the features. More details can be found in our previous coverage and in a Dropbox support document.

Let’s assume for the sake of argument that Dropbox never does any evil on your computer. It remains the fact that the Dropbox process has that ability. And that means, if Dropbox itself has a bug in it, it’s possible an attacker could take control of your computer by hijacking flaws in Dropbox’s code. Of course, that’s entirely theoretical, but all security risks are until someone exploits them. The essence of good computer security and indeed the very reason why OSX has these kinds of safeguards in place to begin with is that apps should not have permissions greater than those that they need to do their job.

At the time, Dropbox said it was working with Apple to reduce its dependence on elevated access in macOS Sierra, and would respect when people disable the app’s Accessibility permissions, but now a much-needed safeguard exists regardless.

In a new blog post, Dropbox still recommends that Mac users running macOS Sierra update their Accessibility permissions, if needed, to ensure smooth syncing and access to certain features of the cloud storage service.

Advanced Dropbox collaboration features, such as the badge, require Accessibility permissions. You’ll be prompted to grant these permissions when you install the Dropbox desktop app on macOS Sierra. To do so, follow the instructions on screen. The same will apply for older versions of OS X in the coming weeks. For more information on Dropbox Mac permissions, visit our help center.

macOS Sierra was publicly released today as a free update on the Mac App Store.

Related Roundup: macOS Sierra
Tags: Dropbox, security, accessibility
Discuss this article in our forums

Recap: macOS Sierra Launch Day

It’s been a busy day of macOS Sierra news following the public launch, so we’ve put together a quick rundown of all of our coverage to make it easy for everyone to find everything all in one place.

– Apple Releases macOS Sierra With Siri, Apple Pay, Apple Watch Unlock, Universal Clipboard, and More

Feature Highlights and How Tos

– macOS Sierra: How to Use Apple Pay on the Web
– macOS Sierra: Save Disk Space With the New ‘Optimize Storage’ Option
– macOS Sierra and iOS 10: Universal Clipboard for Cross Device Copy/Paste
– macOS Sierra: Photos Gains ‘Memories’ and Messages Adds Rich Links, Tapback, and Large Emoji
– macOS Sierra: Picture in Picture Mode for Safari and iTunes Videos
– macOS Sierra: How to Unlock Your Mac With Your Apple Watch
– macOS Sierra: Apps Gain Safari-Style Tabs
– macOS Sierra: iCloud Drive Syncs Desktop Files and Documents Across Devices

Other Sierra-Related News

– Tweetbot for Mac Updated With Support for macOS Sierra and Extended Tweets
– iWork Apps for macOS Sierra Updated With Real-Time Collaboration
– Safari 10 Now Available for OS X El Capitan and OS X Yosemite
– macOS Server Updated for Sierra With New Setup Assistant Options and More
– macOS Sierra Addresses Dropbox Security Concerns by Asking for Accessibility User Permission

For more on macOS Sierra, make sure to check out our dedicated roundup and visit our macOS Sierra forum to discuss all of the new features and changes.

Related Roundup: macOS Sierra
Discuss this article in our forums

Hackers were able to remotely control a moving Tesla Model S

A team of researchers from China’s Keen Security Lab were able to remotely hack into a Tesla Model S by exploiting the vehicle’s in-car web browser. While the Keen group worked closely with Tesla’s own security team to fix the vulnerability before it could be put to any nefarious use, the hackers showed it was possible to control many functions of Tesla’s flagship sedan — including the brakes and the sunroof — from miles away.

By connecting the car to a malicious WiFi hotspot, the Keen team was able to access the vehicle’s control systems through the CAN bus by way of the web browser. As the team showed off in a video, they were able to remotely search for a destination on the car’s GPS, control the entertainment and instrument screens, pop the trunk and even hit the brakes while the vehicle was in motion twelve miles away. A little less harrowing: they were also able to adjust the seats and open the sunroof from afar.

The Verge notes, that the conditions for the exploit are fairly specific, but it’s not hard to see the danger it would have presented if a bad actor could connect your ride to some bad WiFi. Thankfully, Tesla patched the exploit within 10 days of receiving the report from the Keen Security Lab, which is a division of Chinese internet behemoth Tencent.

“The issue demonstrated is only triggered when the web browser is used, and also required the car to be physically near to and connected to a malicious wifi hotspot,” Tesla said in a statement. “Our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly.”

While the Keen Security Lab team is withholding additional details on the hack, it’s important to note that this is not something current owners should be worried about at this point. As is common practice in White Hat hacking circles, security exploits like this are generally not discussed publicly until they are patched or the exploited company has a chance to respond.

For their part, Keen praised Tesla’s “proactive attitude” while Tesla’s own statement went on to say: “We engage with the security research community to test the security of our products so that we can fix potential vulnerabilities before they result in issues for our customers. We commend the research team behind today’s demonstration and plan to reward them under our bug bounty program, which was set up to encourage this type of research.”

Via: The Register, The Verge

Source: Keen Security Lab/YouTube

Canon makes big strides with its fast-focusing mirrorless M5

Canon’s 24.2-megapixel M5 is its best mirrorless camera yet, but is that enough? The company is playing to its strengths by giving the new model classic Canon DSLR-like styling and, finally, a 2.36 million dot electronic viewfinder. It’s also got a new image processor and “Dual Pixel” AF that focuses five times quicker than before. However, the M5 is yet more proof that it entered the mirrorless camera game much too late.

Unlike Panasonic and Sony models in the same price range, it lacks 4K video and makes do with 1080p, 60fps shooting instead. The DSLR-like body style is not its strong point either, compared to nicer-looking options from Fujifilm and Olympus. Still, it should appeal to Canon owners, who can use their existing lenses with an optional adapter, and it’s interesting enough to at least give mirrorless buyers pause. However, Canon is going to need to advance its mirrorless program, stat, or it risks staying behind fast-advancing rivals.

Aaron Souppouris contributed to this report.

We’re live all week from Cologne, Germany, for Photokina 2016. Click here to catch up on all the news from the show.

macOS Sierra: iCloud Drive Syncs Desktop Files and Documents Across Devices

With macOS Sierra, Apple is aiming to make it easier to access all of your content across multiple devices, expanding iCloud Drive to encompass the desktop and documents folder of every Mac.

This feature puts all of the files stored either on the desktop or in the documents folder in iCloud, making them available on iOS devices, Macs, and iCloud.com for easy access to your most recent files wherever you are.

Turning on the new iCloud feature is done when setting up macOS Sierra. When you install the new operating system, Apple will ask if you want to enable iCloud storage for the desktop and documents folder and will let you know how much iCloud storage space it will take up.

If you have a lot of files on your desktop or in the documents folder, it can take up a significant amount of space, so you might need to do some file cleanup before enabling it.

If you want to enable the feature later or turn it off at some point, you can do so by going to System Preferences –> iCloud –> iCloud Drive –> Options —> and checking or unchecking “Desktop & Documents Folders” in the list of apps allowed to upload data to iCloud Drive.

On Macs and iOS devices, the contents of the desktop and documents folder can be accessed through the iCloud Drive app. On iCloud.com, the files can be accessed through the iCloud Drive folder that’s available once you’re signed in. If you have a Windows machine, your Mac files will be able to be downloaded through the iCloud for Windows app.

The new iCloud storage options in Sierra bring Macs more in line with iOS devices, which use iCloud Drive for all file storage purposes. macOS Sierra is available for free starting today.

Related Roundup: macOS Sierra
Discuss this article in our forums

PS4 vs PS4 Slim vs PS4 Pro: Which should you buy?

Which PlayStation 4 should I buy?

By the time family members roll into stores to buy their loved ones a PlayStation 4 this holiday season, there will be three options that look very similar. You’ve got the original PlayStation 4, the new slimmer PlayStation 4 with the exact same branding on the box, and the soon to be released PlayStation 4 Pro. It’s confusing by anyone’s standards, so your best bet is to know what you need before you head into the store.

What’s the difference?

Sony has a history of releasing a “slim” version of the PlayStation a couple of years after its initial release. In the past, those consoles have been labeled a little differently at launch to make it easier to tell the new version apart from the old one. These slimmer versions typically offer more a physical difference than a functionality difference, and this year is no different. The significant feature and performance difference comes with the PlayStation 4 Pro, and even then the difference isn’t huge.

The biggest functional difference between the original PS4 and the new slimmer PS4 is power consumption. Sony claims the new PS4 has a max power draw of 165 watts, which sounds impressive next to the original 250w max of the first PS4 until you see most benchmarks. The original PlayStation 4 had an average power draw of 150w during its heaviest gameplay sessions, and never pushed anywhere near that 250w max. It is slightly smaller though, so there’s that.

As you can see, Sony is using the same CPU and a GPU that’s a little more than twice the performance in the new PlayStation 4 Pro. There’s also an updated version of the HDMI standard in the PS4 Pro, but there’s no immediate difference in performance out of the box for video output. PlayStation 4 Pro exists to offer 4K video streaming and enhanced graphics on supported titles. Game developers will have the option to offer higher quality graphics to PlayStation 4 Pro gamers, but it’s not yet clear how many will take advantage of this or how significant those differences will be.

Bundles and sales

The default pricing for these consoles can and frequently are augmented by sales and bundles. Each of the PlayStation 4 consoles comes with a single game, usually marked with a giant photo on the packaging, so you have everything you need to get started. Many retailers have already placed the original PlayStation 4 on sale, so it’s just under the $299 slim PlayStation 4 in order to help get rid of the older stock. The $399 PlayStation 4 Pro will of course also come with a game.

Is the PlayStation 4 Pro $100 better than the PlayStation 4 or its slimmer brother? Only if you have a 4K television or are planning to purchase one soon. If you’re happy with your existing television and have no plans to upgrade, you aren’t going to see any significant difference between the PlayStations 4.

Many retailers like to create their own bundles as we get closer to the holiday season, combining extra gamepads or recently discounted games to the package to help you feel like you’re buying everything you need. A big part of this year’s offering will no doubt include PlayStation VR. There are plenty of people who already own a PlayStation 4, but if you’re looking to go all in for the first time and get everything you need, expect those same retail stores to have everything you need to get going.

Which should I buy?

Now that you know everything you need to know about the differences between these consoles, lets break it down!

• PlayStation 4 — This is the PS4 most likely to be included in some kind of extra bundle with more accessories and games. This is also the only PlayStation 4 that comes in white right now. If you’re looking for a PS4 and price is a big point of concern, you probably want to stick with the original.

See on Amazon

• Slim PlayStation 4 — This is the PS4 you will see the most of on shelves this year, and it’s the nicer looking of the three. If you care about that sort of thing, or you’re just rushing in to grab a PS4 and nothing else, this is the version you want.

See on Amazon

• PlayStation 4 Pro — If you own a 4K television, or you plan to own one before long, this is the PlayStation 4 you want. It’ll last the longest, and be able to offer the most over time.

See on Amazon