iOS 7’s Activation Lock Feature Approved From San Francisco District Attorney

In big cites like New York, smartphone thefts have been on the rise, few days ago, San Francisco District Attorney George Gascón and New York Attorney General Eric T. Schneiderman unveiled that they were about to test new (APPL) anti-theft smart phone measures.

This feature was put to test by San Francisco district attorney George Gascón last week, along with similar features from other smartphone manufacturers like Samsung. He noted that “Clear improvements” have been made at combating smartphone theft.

From the S.F. Examiner:

Last week, representatives from Apple and Samsung brought anti-theft technology they are developing to the District Attorney’s Office for review by technical experts.

Apple’s Activation Lock and Samsung’s Lojack for Android were tested during a Thursday meeting. Gascón said he could not discuss the technologies that were examined, as the products are not finalized, but he did say Apple told him it’s planning to release anti-theft technology in the fall.

“I’m very optimistic that they came and were willing to share their technology with us,” Gascón said.

Apple’s earlier solution to iPhone thefts was “Find my iPhone” which let iOS users remotely track the location of their lost device, and securely wipe it, if needed. But even with those measures, a thief could easily erase the device and resell it. With the new Activation Lock, once a device has been marked as lost, and then erased, it can only be used after the owner’s iTunes credentials are entered.

Announced at WWDC, Activation Lock is set to be included in iOS 7, which is expected to be released to consumers this fall.

Read More

Security Researcher Responsible for Apple Developer Website Exploit

Security researcher Ibrahim Balic has come forward and claimed responsibility for this weekend’s Apple developer website exploit.

Apple notified developers yesterday that hackers had forced their way in to the Apple developer portal. It was believed that the hackers did not have access to any sensitive material such as source code for applications, but that mailing addresses, names, and email addresses had been compromised. In a comment on TechCrunch Ibrahim Balic claimed that it was in fact he who had gained access to this data:

In total I have found 13 bugs and have reported through http://bugreport.apple.com. The bugs are all reported one by one and Apple was informed. I gave details to Apple as much as I can and I’ve also added screenshots.

One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example.

White hat hackers do tend to operate like this: they hack in to systems, and then notify the company of exploitable holes in the security system. It’s a grey area of the law, though many would argue that he was doing it in good faith.

Read More

Apple joins alliance of tech companies in push for better NSA transparency

Apple is reportedly teaming up with Google, Facebook, Microsoft and a number of other tech companies that will demand dramatically increased transparency from the US government regarding surveillance by the NSA and other agencies.

In a letter to be published tomorrow, the alliance—which includes 63 companies, investors, and non-profit orgs—will call upon President Obama and congressional leaders to allow them to report more specifically on security requests…

AllThingsD has obtained a copy of the letter and posted the following excerpt:

“Basic information about how the government uses its various law enforcement–related investigative authorities has been published for years without any apparent disruption to criminal investigations,” a copy of the letter obtained by AllThingsD reads. “We seek permission for the same information to be made available regarding the government’s national security–related authorities. … Just as the United States has long been an innovator when it comes to the Internet and products and services that rely upon the Internet, so too should it be an innovator when it comes to creating mechanisms to ensure that government is transparent, accountable, and respectful of civil liberties and human rights.”

Specifically, the companies are asking that they be allowed to report the number of government requests for info on their users and of individuals, accounts, or devices. They are also asking that the government issue its own request report.

As the site notes, this is easily the largest push we’ve seen for greater government disclosure of digital communications monitoring since a slew of slide leaks regarding a secret PRISM program exposed the National Security Agency’s capabilities.

Apple was one of the 12 companies listed on the slide as a ‘willing participant’ in the PRISM program, but has said that it doesn’t provide any government agency with direct access to its servers, and any requests for its info must be court-ordered.

Read More

‘PatternUnlock’ brings Android inspired security to iOS

PatternUnlock isn’t the first jailbreak tweak to hit Cydia that features an Android-like pattern unlock pattern, but it is, perhaps, the best. Other jailbreak tweaks like AndroidLockXT can lay claim to being the first, and some may prefer the vast amount of options offered with that tweak.

I prefer PatternUnlock, however, because of its ease of use, design, and impeccable documentation. It’s a tweak that plays nice with stock iOS, and compliments the standard experience instead of making it feel obtuse and disjointed. Take a look inside as I go hands-on with PatternUnlock on video.

The first thing you’ll notice about PatternUnlock is its settings. The preferences for PatternUnlock are laid out in a logical and easy to follow manner. The first option at the top of the tweak’s preferences allows you to enable or disable PatternUnlock altogether. Beneath that, once again in a logical order of appearance, lies the option to change the pattern passcode.

Just like the stock iOS passcode, you can require the patten to be entered immediately upon unlock, or set an interval based delay ranging from 1, 2, 5, or 15 minutes, or 1, 2, or 4 hours. For those of you who wish to involve haptic feedback on the Lock screen, then you’ll be happy to find a vibrations section in PatternUnlock’s preferences. Here you can set vibration to happen when touching a point, or on a successful unlock. There are also two different sliders for each section dedicated to adjusting the vibration duration and intensity.

A few additional supplementary features are included with PatternUnlock’s settings. You’ll find the ability to enable an option bar for accessing the emergency call button (iPhone’s only), and a setting to enable the device’s block mode when too many incorrect unlock attempts are made.

PatternUnlock comes bundled with five different themes, and includes detailed documentation on how to develop your own themes. I found that the themes in PatternUnlock were designed in a way that truly compliments the iOS Lock screen. In my opinion, AndroidLockXT, while a good tweak, doesn’t fit in with iOS the way PatternUnlock does from a design perspective. AndroidLockXT’s stock themes seem too Android-ish for iOS, whereas PatternUnlock doesn’t seem to force the issue. Of course, there are a plethora of 3rd party themes available for AndroidLockXT, so that’s something that you need to consider.

When it comes to options, that’s where AndroidLockXT is simply more robust. PatternUnlock features options, but they are all tightly involved with the basic functionality of the tweak. AndroidLockXT goes the extra mile with all sorts of additional goodies, such as the ability to remain unlocked while on a specific Wi-Fi network.

Those extras are nice and all, but once again, PatternUnlock gets the basic stuff right. For instance, the way that PatternUnlcok works together with stock passcodes shows a lot of forethought on the part of developer, Jonas Gessner. While on the Lock screen, PatternUnlock includes a button in the upper-right hand corner that allows you to switch to traditional passcode mode. This lets you use both forms of security interchangeably, and also ensures that your device won’t be compromised in the event that the tweak is disabled or uninstalled.

I also need to mention that way that the lines of the patterns “snap” into place. This snapping feature makes it much easier to enter complex patterns using PatternUnlock when compared to the competition. PatternUnlock is more forgiving when it comes to unlocking your device, and this makes using it less tedious. This feature shouldn’t be understated. Watch the video for a visual description of what I mean.

If you’re looking for an alternative to the stock passcode unlock in iOS, then look no further than PatternUnlock. To me, it’s the best pattern unlocking alternative present on Cydia, and it’s well worth the $1.99 asking price. I believe that AndroidLockXT is a good choice as well, but if I had to select between the two, PatternUnlock would be my choice for the reasons mentioned above. What do you think? Share your thoughts in the comment section below.

Read More

Accessory vendor bypasses iOS 7 Lightning check

One of the little-known features of iOS 7 that not many people will like is its background check of whether or not a third-party accessory is hooked up to the your iPhone, iPod touch or iPad using a non-certified Lightning cable.

We’ve know Apple has tightened its MFi program rules (MFi stands for ‘Made for iDevice’) and iOS 7 seems to be stepping up a cat and mouse game between Apple and non-MFi vendors….

Connecting an accessory to an iDevice running iOS 7 through a non-certified Lightning cable produces a prompt saying “This cable or accessory is not certified and may not work reliably with this iPhone”.

It’s just a prompt meant to push folks into buying pricier Apple-sanctioned Lightning accessories. At any rate, it’s interesting how the firm has opted against blocking non-certified accessories from functioning (upcoming betas could change that).

But Apple’s protection seems to have been circumvented.

It has come to our knowledge via reader Marcel that iPhone5mod, a third-party accessory company, has successfully found a workaround to Apple’s built-in Lightning detection in iOS 7.

“We have cracked chips that bypass iOS 7 authentication functions,” the company says on its web store which offers the iOS 7 Lightning cable for less than seven bucks.

iPhone5mod was the first company to crack Apple’s Lightning authentication chips and  the video has them using their own Lightning cable in order to bypass the software check on the iOS 7 side.

Watchful readers would be quick to point out that iPhone5mod sells unofficial Lightning cables, docks, adapters and mod kits, often priced at half of what Apple-sanctioned accessories cost.

Of course, we don’t know whether or not Apple will in fact enforce tighter rules and cripple unofficial Lightning accessories in iOS 7 come this Fall.

Technically speaking, iOS 7 could easily prevent unsanctioned Lightning accessories from functioning properly. I’m hoping Apple won’t go there because even though I’m sure jailbreakdevelopers would see to that, the amount of bad press and chastising it would no doubt receive just won’t be worth it.

By the way, the iOS 7 prompt isn’t a new thing as iOS 6 also warns you about using cheap unofficial 30-pin dock cables, chargers and other accessories.

Read More

Preview: PatternUnlock

PatternUnlock is an upcoming jailbreak tweak that brings Android inspired Lock screen security to the iPhone. It features user customizable unlock patterns and various Lock screen themes that can be user customized as well.

The tweak, which will sell for $1.99 on Cydia’s BigBoss repo, is due to touch down some time this weekend. For now, check out our brief preview video of the tweak inside.

We’ll have a full breakdown of PatternUnlock when it launches. Stay tuned for more coverage.

Read More

Default iOS hotspot passwords can be cracked in under a minute

You may want to reconsider using a default password iOS provides for hotspot functionality as researchers at a German university warn of the weaknesses that let attackers crack any default iOS hotspot password in under a minute. Although Windows Phone uses even weaker passwords and some Android vendors weaken their device’s security by modifying the Wi-Fi-related components, Apple’s problem is that iOS generates “random” hotspot passwords using a dictionary of only 1,842 different entries…

Michael Lee, writing for ZDNet, points to the disturbing findings by researchers at the University of Erlangen in Germany who found iOS creates default hotspot passwords using a dictionary of 52,500 words from the Scrabble game.

Although Apple appends randomly generated numbers to the words from this dictionary, this isn’t stopping attackers from cracking the weak passwords.

The researchers explain:

This list consists of around 52,500 entries, and was originated from an open-source Scrabble crossword game. Using this unofficial Scrabble word list within offline dictionary attacks, we already had a 100 percent success rate of cracking any arbitrary iOS hotspot default password.

Cracking those passwords requires some serious oomph: the researchers used a GPU cluster consisting of four AMD Radeon HD 7970s. After capturing the Wi-Fi connection handshake, the researchers used the AMD hardware to iterate over all items in the list, including the permutations of additional numbers..

This hardware can crack default iOS hotspot passwords in under just 50 seconds.

It isn’t helping that Apple appears to be using only 1,842 words from the scrabble dictionary.

“Consequently, any default password used within an arbitrary iOS mobile hotspot is based on one of these 1,842 different words,” the research note explains.

It’s even worse on Windows Phone and Android, with the latter generating default hotspot passwords that consist of only eight-digit numbers. And even though Android generates strong passwords, “some vendors modified the Wi-Fi-related components utilised in their devices and weakened the algorithm of generating default passwords”.

The issue fuels serious security concerns, especially when users connect their MacBook, iPad or other device to a hotspot created on an iOS device.

In order to strengthen your security and prevent any potential eavesdropping, you’re advised not to accept default hotspot passwords iOS randomly generates.

Instead, use Settings > Personal Hotspot to replace the default password with your own uniquely generated strong password that should not contain birthday dates, spouse names and other commonly used and easily guessed terms.

Read More