Wipe your iPhone before selling it, because if you don't you might get your data stolen: "Even if you can't use your phone, you can safeguard your data. For instance, Apple does let you remotely wipe everything using Find My iPhone from another iOS device. That has to be enabled: if you've never switched on Find My iPhone or you've actively switched it off, you can't remote wipe."

The moral of the story is: turn on Find my iPhone.

Labels: app security, security fail

Apple drops requirement for apps to use HTTPS by 2017 • The Register: "App Transport Security (ATS) arrived in 2015 iOS and OS X in 2015, in Apple's own words, “improves privacy and data integrity by ensuring your app’s network connections employ only industry-standard protocols and ciphers without known weaknesses.” Which in practical terms means apps have to use HTTPS.

Pushing you to push the envelope.

Labels: app security

Report: Application security continues to be a problem - SD Times: "Application security continues to be a problem"

Don't try to read this article in Google Chrome.

Labels: app security

Browsers nix add-on after Web of Trust is caught selling users' browsing histories • The Register: "Updated A browser extension which was found to be harvesting users' browsing histories and selling them to third parties has had its availability pulled from a number of web browsers' add-on repositories."

Things that go hmmm in the night. As if seeing advertisements derived from the contents of your Amazon shopping card wasn't creepy enough.

Labels: app extensions, app security, security policy

The arms race to protect apps from cracking | Cult of Mac: "App developers put a lot of time and effort into preventing their apps from being cracked or pirated. But for every coder taking a step toward making an app more secure, there’s someone on the march to crack it. The integrity of any app is subject to an ongoing arms race."

The downward spiral...

Labels: app security

To bypass code-signing checks, malware gang steals lots of certificates | Ars Technica "There are lots of ways to ensure the success of an advanced hacking operation. For a gang called Suckfly, one of the keys is having plenty of stolen code-signing certificates on hand to give its custom malware the appearance of legitimacy.

Since 2014, the group has used no fewer than nine separate signing certificates from nine separate companies to digitally sign its hacking wares, according to a blog post published Tuesday by security firm Symantec.

Probably the only thing worse than "no security" is the illusion of security.

Labels: app security, codesigning

“Huge” number of Mac apps vulnerable to hijacking, and a fix is elusive | Ars Technica Camtasia, uTorrent, and a large number of other Mac apps are susceptible to man-in-the-middle attacks that install malicious code, thanks to a vulnerability in Sparkle, the third-party software framework the apps use to receive updates.

I've never been a fan of auto-updates. I mean, have you seen any of the Terminator movies? A huge network of unix machines with the ability to patch their own software? That's a recipe for disaster.

Labels: app security

A Look Inside the Ask Toolbar Installed with Java for Mac | The Mac Security Blog: "Java and Ask Toolbar Installation Process At the beginning of the installation process, the Java installer creates a temporary helper, com.oracle.JavaInstallHelper, in /Library/PrivilegedHelperTools/"

The battle for your desktop from a language technology nobody wants on the desktop (except Android devs).

Labels: android, android vs. ios, app security, security flaw

Apple's Safari among browsers taken down at Pwn2Own day 2: "South Korean security researcher Jung Hoon Lee toppled Safari with a use-after-free vulnerability, according to Threatpost. Lee was then able to bypass Safari's sandbox thanks to an uninitialized stack pointer, with the combined exploits netting him some $50,000 in prize money."

It's unfortunate, but the lazy code of browser-writers penalize everyone else who must spend months reworking application software to work within the confines of increasingly restrictive security sandboxes.

It's the browser. And apps that thinly wrap the browser (read: Facebook).

Labels: app security, security flaw

Apple reportedly cracks down on antivirus apps from iOS App Store, many apps pulled | 9to5Mac: "One casualty of the removal is Intego’s VirusBarrier, which claims that this takedown was not specific to its product with Apple deciding the entire category of antivirus products is now off-limits."

I like the fact that Apple is fairly lax about editorializing App Store content, but it would be good if the app store became organized around search because otherwise in the long term, Google will be used to find apps in the store.

Labels: app security, app store

SanDisk launches portable storage drive with built-in Lightning connector: "The iXpand Flash Drive comes in capacities of 16, 32 and 64 gigabytes and is compatible with any iOS device with a Lightning port running iOS 7 or later. File transfers and backups are accomplished through the SanDisk iXpand Sync app available for free on the App Store."

I'm actually quite curious as to what entitlements this app is using.

Labels: app security, app store

Chinese Mac and iOS users targeted by new ‘WireLurker’ malware capable of infecting non-jailbroken devices | 9to5Mac: "The New York Times reports that a security firm called Palo Alto Networks has uncovered a new form of Apple-focused malware that is capable of infecting non-jailbroken iOS devices. Typically when such software pops up, as it does from time to time, one of the key factors that allows the malicious code to run on iOS is whether the device is jailbroken. The new ‘WireLurker’ malware, however, is installed on the mobile device over USB by an infected Mac."

Dang!

Labels: app security, app store

genkiyooka/MacRuntimeSandboxDetection · GitHub: "For CFPlugIn and AudioUnit developers - how to check Mac App Store sandbox capabilities at runtime."

Apologies for the delay, but just checked in bug fixes for detecting Mac OS X sandbox capabilities at runtime. I'm using this in production code now, and I believe it is stable and working correctly on 10.6-10.9.

This code is quite useful when building solutions that may be DeveloperID or Mac App Store and/or sandboxed. If you discover any cases that are not correctly handled, please let me know.

Labels: app security, secure coding mac

BBC News - Gmail smartphone app hacked by researchers: "This shared memory is used by all apps, and by analysing its use the researchers were able to tell when a user was logging into apps such as Gmail, giving them the opportunity to steal login details and passwords."

Sounds like everyone is going to have zero memory when it's deallocated.

Labels: app security

Who Is Paunch? — Krebs on Security
“As I have done before, I am asking all the users as well as IT Security professionals to disable all plug-ins and add-ons in their browsers,” Fedotov warned forum members. “Do not think that if you are not users of Internet money (web money), there is no danger of being infected. In this case, the infected PCs are turned into socks proxies, spam/ddos bots and all the bad activity is done under your name, so that law enforcement can place all the blame on your shoulders. Safe surfing and good luck to you.”

I think this means you.

Labels: app security, security

British spy agency said to target Apple's iPhone with remote surveillance exploit kit - A fifth plugin — dubbed "Porus" — is referred to as providing "kernel stealth" capabilities. This could mean that the spyware is embedded in a manner similar to a rootkit, and might re-install itself automatically after being wiped.

The line between the good guys and bad guys is getting pretty blurry.

Labels: app security

NSA worked on iPhone spyware to remotely monitor users, leaked documents show - Der Spiegel asserts specialized NSA Tailored Access Operations (TAO) teams intercept incoming device shipments, carefully open packages and install spyware before sending the "bugged" units along to end users.

Makes a great case for walking into an Apple store and buying a new phone that way.

Labels: app security

Apple’s iOS 7 Update Causing Trouble for Some School iPad Deployments - John Paczkowski - News - AllThingsD - Apple did not realize that installing iOS 7 would remove our (and thousands of organizations across the country) safety protection measure, which now makes the iPad devices unfiltered when accessing the Internet away from school.

Hopefully it should be obvious that everything that is not a phone should not be treated like a fashion accessory. Including the Mac.

Labels: app security

Swrve Says New Fraud Filter Fights Fake In-App Purchases - Eric Johnson - Commerce - AllThingsD: "Pirates! That is, players who spend nothing and get everything a game can offer, by circumventing the in-app store. "

Avast! Pirates!

Labels: app security, in-app purchase, validation