New Magic Keyboard brings Touch ID to all M1 Macs
Apple's newly announced Magic Keyboard for Mac, which comes equipped with a Touch ID sensor, is compatible with all macOS machines running an M1 chip. For now, it's only available with iMac.Unveiled alongside a revamped 24-inch iMac on Tuesday, the Magic Keyboard is Apple's first wireless Mac peripheral to incorporate Touch ID authentication for logging in to macOS, purchasing items with Apple Pay, interacting with third-party apps and more.As noted by blogger Rene Ritchie, the keyboard can be used by other M1 Macs, enabling Touch ID security for Mac mini and extending the capabilities of MacBook Air and the 13-inch MacBook Pro. Though the two Apple Silicon laptop models sport Touch ID integrated into their respective power buttons, there has yet to be a comparable replacement for the feature in clamshell mode. Read more...

Read more »

Apple’s new Siri Remote lacks U1 locator to help find it in your couch
Apple's new Siri Remote lacks a U1 chip that could've acted as a locator to help find it in your couch cushions, Apple confirmed today… The post appeared first on MacDailyNews.

Read more »

Lost AirTag can be read by any other NFC-enabled iPhone or Android device
After numerous rumors, Apple finally introduced AirTag during today’s special event. Apple’s item tracker works based on the ultra-wideband U1 chip and relies on the Find My network to work even offline. However, an interested detail that wasn’t mentioned during the keynote is that even Android users can identify an AirTag in Lost Mode. more… The post appeared first on 9to5Mac.

Read more »

Apple launches new MagSafe cases and wallet colors for spring
During its "Spring Loaded" event, Apple took took the opportunity to update its own MagSafe cases and wallet with new spring colors.(From left to right) Pistachio, Cantelope, Capri Blue, and Amethyst MagSafe silicone cases For iPhone 12 users, Apple's silicone case now comes in Pistacho green, Cantalope, Capri Blue, and Amethyst purple. The leather case now comes in Deep Violet. Read more...

Read more »

Apple Card Family extends credit card access to teens
Apple Card holding parents can soon give their teenagers access to the credit card. Adults can share a card and teens can be allowed limited usage thanks to the upcoming Apple Card Family feature. Benefits for adults “We designed Apple Card Family because we saw an opportunity to reinvent how spouses, partners, and the people […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple restricts offensive AirTag engravings, including emoji combinations
As is Apple's wont, the company is restricting customers from engraving AirTag with potentially offensive text or emoji characters, lest the unwashed masses sully its sterling reputation.Like other Apple products, AirTag can be custom engraved from the factory for easy identification. The option is a welcome addition for a device that will likely find its way onto a variety of commonly lost items, from bags to keychains.AirTag is big enough to accommodate up to three emoji or four text characters, but as The Verge points out, Apple restricts users from deemed inappropriate content. For example, a horse with a "pile of poo" emoji is prohibited, while other animal-poo combinations are allowed. Read more...

Read more »

iOS 14.5 and iPadOS 14.5 bring an array of new features ‘next week’
Apple revealed on Tuesday that iOS 14.5 and the iPad equivalent will reach customers iPhones and tablets some time “next week.” These include a rush of new features, like unlocking an iPhone with an Apple Watch. And a controversial change that make it harder for apps to track users for ads. To help make the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Ransomware group attempts to extort Apple with supposed leaks from supplier Quanta
In an attempt to capitalize on the timing of Apple's "Spring Forward" event on Tuesday, a ransomware group posted on the dark web claiming it has obtained stolen schematics for upcoming products from Apple supply partner Quanta Computer.Via @CryptoInsaneThe so-called "REvil" group cited Apple's keynote presentation in its ransom letter, demanding that Apple "buy back the available data by May 1," as reported by The Record. Read more...

Read more »

Moment debuts various mounts for Apple AirTag tracker
Moment is among a bevy of third-party accessory makers to announce their own spin on accessories or Apple AirTag.First is the Moment Stretch Fabric Mount which has a "premium bonded powermesh" material on the outside that is soft and flexible. It can be affixed using a proprietary adhesive to nearly any fabric, meaning you can put AirTag on a coat, sweater, purse, backpack or other item. The mount is double-hemmed for a secure hold around the edge and AirTag can be removed at any time.Then there is a hard shell case. AirTag is inserted into the back of the mount which has a hardened exterior. This can be mounted with its adhesive on rugged or outdoor devices that may take a beating. Read more...

Read more »

Roundup: Everything Apple announced at its ‘Spring Loaded’ event
Apple today officially held its first event of the year with the tagline “Spring Loaded.” During the event, the company unveiled updates for the iPad Pro, iMac, its AirTag item trackers, and much more. Read on as we recap everything Apple announced during today’s event. more… The post appeared first on 9to5Mac.

Read more »

Apple Updates Apple TV 4K; Introduces New Siri Remote
After years of benign neglect, Apple has unveiled a second-generation Apple TV 4K with a beefier processor and enhanced video capabilities. More interesting, though, is the redesign of the Siri Remote.

Read more »

New Siri Remote lacks U1 chip for precise Find My integration
Apple on Tuesday confirmed that its new Apple TV Siri Remote does not integrate a U1 chip, meaning it can't be located with pinpoint accuracy through Apple's Find My network. The latest iPad Pro models also appear to lack the locator.Rumors leading up to today's announcement suggested Apple would integrate Find My functionality to a next-generation Siri Remote, a logical addition considering remote controls are commonly lost in couch cushions. Those rumblings, however, appear to be incorrect.Apple's specifications sheet shows the device does not integrate a U1 chip, a component that plays a key role in the company's Ultra Wideband device-locating technology. The tech giant confirmed U1's absence in a statement to The Verge. Read more...

Read more »

Apple Announces New Apple TV 4K With Redesigned Siri Remote
The new Apple TV sports a more powerful A12 Bionic chip that lets it play HDR video at higher frame rates. It also comes equipped with a redesigned Siri remote. The Verge reports: The new Siri remote has an iPod-style scroll wheel, a five-way click pad, touch controls, a mute button, and a power button that can turn your TV on and off. Meanwhile, the Siri button is now on the side of the remote, and Apple says that the voice assistant now works on Apple TV in Austria, Ireland, and New Zealand, in addition to the 13 countries where it was already supported. Finally, the new Siri remote's enclosure is made out of 100 percent recycled aluminum. You'll get the new remote with the new $179 4K set-top box, or it's available separately for $59. As well as being compatible with the new Apple TV 4K, it also works with the 2017 model and Apple TV HD. Apple will also sell the remote bundled with the Apple TV HD for $149. Other features of the Apple TV 4K include support for 60fps Dolby Vision playback over AirPlay from a compatible iPhone, and the ability to optimize the colors of your TV screen using the light sensor on an iPhone. Read more of this story at Slashdot.

Read more »

9to5Mac Daily: April 20, 2021 – Apple ‘Spring Loaded’ event recap
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Appfigures: To get the latest scoop on the newest apps and games, sign up for the Appfigures ‘This Week in Apps’ newsletter right here. more… The post appeared first on 9to5Mac.

Read more »

Comparison: 24-inch M1 iMac Pro vs 21.5-inch and 27-inch Intel iMac Pros
The iMac has undergone some major changes in 2021, with a refreshed appearance and the addition of Apple Silicon, but how much of an upgrade is it from the previous generation? We look at the specifications.Apple's refresh of its iMac lineup at its "Spring Loaded" event was expected in a number of ways. Rumors about a refresh had circulated for quite some time with some close to the event suggesting not only would there be a physical change to the lineup, but also a colorful twist.The company's push to bring Apple Silicon to all Mac models is also another reason to have expected the new launch. With a two-year timeline for the transition from Intel to chips of its own design, and following after initial launches of the M1 Mac mini, MacBook Air, and 13-inch MacBook Pro, the iMac range seemed to be the most likely candidate for a follow-up launch. Read more...

Read more »

New iPad Pros Boast M1 Chips and Liquid Retina XDR Display
Apple has unveiled new iPad Pro models that don’t look all that different but build in significant upgrades. Most notable is the inclusion of the same M1 chip used in recent Macs. The 12.9-inch iPad Pro also boasts display technology derived from Apple’s Pro Display XDR.

Read more »

Ransomware gang claims to have breached Apple contractor Quanta, threatening to release Mac product details
While we were all focused on Apple’s special event today, the company was facing an unusual situation. The group behind the REvil ransomware claims to have confidential information about the engineering of Apple’s products, threatening the company for money in order to not release these files. more… The post appeared first on 9to5Mac.

Read more »

iPad Smart Folios and Smart Covers refreshed with two new Spring colors
In addition to updates to the MagSafe iPhone cases and Apple Watch bands, the company has also released two new colors for the iPad Smart Folio and Smart Covers. These new colors are “Electric Orange” and “Mallard Green.” They are available for all current iPad models. more… The post appeared first on 9to5Mac.

Read more »

Everything Apple announced at its April 20 ‘Spring Loaded’ event
Apple just got done with its big ‘Spring Loaded’ event, and it was chock full of new products and announcements. You can watch the whole thing on Apple’s site, but here’s a quick summary of what went down, with links to our coverage. Apple Card updates Apple started off its event by re-capping its commitment […]

Read more »

Apple Watch ECG feature debuts in Australia and Vietnam with watchOS 7.4
Apple is set to debut Apple Watch's ECG feature in Australia and Vietnam with an upcoming update to the watchOS operating system, according to a report on Tuesday.Apple continues to gain regulatory approval for its Apple Watch ECG feature, a technology first introduced in select regions with Apple Watch Series 4 in 2018.According to 9to5Mac, users in Australia and Vietnam will soon be able to take electrocardiogram readings and receive irregular rhythm notifications on their wrist. The health features are set to launch with the release of watchOS 7.4. Read more...

Read more »

Talk about ‘Spring Loaded’: Apple event sets my head spinning
Wow, that was the speediest, most jam-packed Apple event in recent memory. It was so quick-moving, we all got whiplash. There was barely time to catch your breath between announcements: Here’s a new purple iPhone. Fuggedaboutit, here’s a new Apple TV, and new AirTags. Oh, and hers’s new iMacs — and iPads!! In an hour, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

All of the songs used in today’s Apple’s special event and product introductions
Apple events and product introduction videos are well known for using excellent music. They fill up many of our music libraries. The company does an incredible job curating the perfect tunes. Instead of having to Shazam each song from today’s special event or going over to Apple’s YouTube channel, you can find all of the music that Apple used today directly below! more… The post appeared first on 9to5Mac.

Read more »

M1 iMac relocates the headphone jack to the side; here’s why
The new M1 iMac features an all-new design with seven different colors from which to choose. One of the more subtle changes is that the headphone jack has been relocated from the back of the iMac to the side, and as it turns out, there’s a specific reason for that. more… The post appeared first on 9to5Mac.

Read more »

Man sues Apple for terminating Apple ID with $24K worth of content
Apple has been hit with a lawsuit alleging that its media services terms and conditions, which permit the company to terminate an Apple ID, are "unlawful" and "unconscionable."Credit: AppleThe complaint, filed on Tuesday in the U.S. District Court for the Northern District of California, goes after an Apple services clause that states a user with a terminated Apple ID cannot access media content that they've purchased. Read more...

Read more »

watchOS 7.4 adds Apple Watch ECG feature to Australia and Vietnam
Apple is further expanding the ECG application with watchOS 7.4, set to release next week. When watchOS 7.4 is released, the ECG app will come to users in Vietnam and Australia. This comes more than a month after the Australian government’s Therapeutic Goods Administration approved the feature. more… The post appeared first on 9to5Mac.

Read more »

Are we high?!? 10 ways Apple blew our minds on 4/20
It’s 4/20 and Apple’s big iMac and iPad Pro launch event was a total trip. The new Mac desktop comes in a rainbow of colors, and the M1 processor in the latest tablet will blow you away. And there’s AirTag too, at long last. Grab some snacks then get ready to find out what the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV gets AppleCare+ for first time
With the launch of a second-generation Apple TV 4K on Tuesday, Apple also introduced an option for new buyers to purchase an AppleCare+ extended warranty to protect their investment.The new service was quietly added to Apple's dedicated AppleCare webpage shortly after today's "Spring Loaded" event.Like other AppleCare+ products, the commitment for Apple TV extends the usual one-year limited warranty and 90 days of technical support to three years after purchase date. In addition, customers receive up to two incidents of accidental damage every 12 months, with each claim costing $15 plus tax. Priority access to technical support is also included. Read more...

Read more »

Touch ID Magic Keyboard only available with iMacs but compatible with all M1 Macs
As Apple has done in the past with refreshed Magic Keyboards, the new version with Touch ID is only available with the new iMac – at least for the time being. But the useful new keyboard with built-in biometrics will work with any M1 Mac. more… The post appeared first on 9to5Mac.

Read more »

Apple’s AirTag Promises to Help You Find Your Keys
Apple’s long-rumored AirTag has finally arrived to help Apple users find their car keys via the familiar Find My app. You can track down one of the little metal discs in your couch via Bluetooth and Ultra Wideband. Elsewhere in the world, you can find an AirTag using Apple’s vast Find My network, which leverages nearly a billion in-use Apple devices to relay a tag’s location across town or the globe.

Read more »

Tile wants U.S. Congress to take a closer look at Apple’s new AirTag trackers
Now that Apple’s lost item finder AirTag has been officially unveiled, competitor Tile is going on record ahead of its Congressional… The post appeared first on MacDailyNews.

Read more »

Note to Self: Create Non-Exhaustive List of Competitors
What was the best news you heard so far this month? Mine was learning that KrebsOnSecurity is listed as a restricted competitor by Gartner Inc. [NYSE:IT] -- a $4 billion technology goliath whose analyst reports can move markets and shape the IT industry.

Read more »

Vulnerability Summary for the Week of April 12, 2021
Original release date: April 19, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges to NT SYSTEM. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 7.2 CVE-2020-13532 MISC fluidsynth -- fluidsynth FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can result in arbitrary code execution or a denial of service (DoS) if a malicious soundfont2 file is loaded into a fluidsynth library. 2021-04-13 7.5 CVE-2021-28421 MISC MISC google -- android In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a malicious NFC packet with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-178725766 2021-04-13 10 CVE-2021-0430 MISC indionetworks -- unibox_u50_firmware Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device. 2021-04-09 9.3 CVE-2020-21884 MISC MISC MISC indionetworks -- unibox_u50_firmware Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover. 2021-04-09 9 CVE-2020-21883 MISC MISC MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28480 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28481 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28483. 2021-04-13 9 CVE-2021-28482 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28482. 2021-04-13 7.7 CVE-2021-28483 MISC microsoft -- windows_10 Azure AD Web Sign-in Security Feature Bypass Vulnerability 2021-04-13 7.5 CVE-2021-27092 MISC microsoft -- windows_10 Windows Hyper-V Denial of Service Vulnerability 2021-04-13 7.8 CVE-2021-26416 MISC online_book_store_project -- online_book_store SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication. 2021-04-09 7.5 CVE-2020-23763 MISC MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27236 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27235 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27234 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27233 MISC rust-lang -- rust In the standard library in Rust before 1.53.0, a double free can occur in the Vec::from_iter function if freeing the element panics. 2021-04-14 7.5 CVE-2021-31162 MISC MISC sonicwall -- email_security A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. 2021-04-09 7.5 CVE-2021-20021 CONFIRM sonicwall -- global_management_system A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. 2021-04-10 10 CVE-2021-20020 CONFIRM trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25250 N/A N/A N/A trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25253 N/A N/A N/A trendmicro -- apex_one An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-28645 N/A N/A N/A windriver -- vxworks An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client. 2021-04-13 7.5 CVE-2021-29998 MISC windriver -- vxworks An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server. 2021-04-13 7.5 CVE-2021-29999 MISC zerof -- expert The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. 2021-04-13 7.5 CVE-2021-30176 MISC MISC zerof -- web_server ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. 2021-04-13 7.5 CVE-2021-30175 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accessally -- accessally In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required. 2021-04-12 5 CVE-2021-24226 CONFIRM atlassian -- data_center The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. 2021-04-09 5 CVE-2020-36287 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 with weak privileges which can lead to privilege escalation when used. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 6.8 CVE-2020-13534 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs in and uses the application. 2021-04-09 4.4 CVE-2020-13533 MISC fortinet -- fortiadc A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files. 2021-04-12 4 CVE-2021-24024 CONFIRM google -- android In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171221090 2021-04-13 5.4 CVE-2021-0433 MISC google -- android In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-152064592 2021-04-13 4.4 CVE-2021-0438 MISC google -- android In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790 2021-04-13 4.4 CVE-2021-0432 MISC google -- android In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174768985 2021-04-13 4.6 CVE-2021-0442 MISC google -- android In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174243830 2021-04-13 4.6 CVE-2021-0439 MISC google -- android In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176168330 2021-04-13 4.6 CVE-2021-0437 MISC google -- android In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175074139 2021-04-13 4.6 CVE-2021-0429 MISC google -- android In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174485572 2021-04-13 4.6 CVE-2021-0426 MISC google -- android In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174150451 2021-04-13 5 CVE-2021-0435 MISC google -- android In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174149901 2021-04-13 5 CVE-2021-0431 MISC google -- android In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174488848 2021-04-13 4.6 CVE-2021-0427 MISC google -- chrome Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21195 MISC MISC google -- chrome Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21194 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21196 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21197 MISC MISC google -- chrome Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21199 MISC MISC google -- chrome Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2021-04-09 4.3 CVE-2021-21198 MISC MISC ibm -- collaborative_lifecycle_management IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422. 2021-04-12 5 CVE-2020-4965 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198441. 2021-04-12 4.3 CVE-2021-20519 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419. 2021-04-12 4 CVE-2020-4964 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396. 2021-04-12 4.3 CVE-2020-4920 XF CONFIRM intelliants -- subrion Cross Site Scripting (XSS) vulnerability in subrion CMS Version

Read more »

Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?
On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy.

Read more »

How to Encrypt and Password Protect Files on Your Mac
Encrypting folders and files on your Mac is a good idea. This ultimate guide covers how to encrypt files using Apple’s built-in password protection features. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI Remote Code Execution
This Metasploit module exploits a command injection vulnerability in the /admin/monitoringplugins.php page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows an authenticated admin user to achieve remote code execution as the apache user by uploading a malicious plugin. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both running on CentOS 7.

Read more »

500 Million More Reasons to Talk About Facebook – Intego Mac Podcast Episode 183
Scammers have a new technique for delivering malware: using online contact forms. A couple of browsers are nixing Google's FLoC ad tracking technology. The FBI has been playing white hat hacker. And e talk about Facebook, and especially the "off-Facebook activity" that tracks you across the internet. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI getprofile.sh Remote Command Execution
This Metasploit module exploits a vulnerability in the getprofile.sh script of Nagios XI versions prior to 5.6.6 in order to upload a malicious check_ping plugin and thereby execute arbitrary commands. For Nagios XI 5.2.0 through 5.4.13, the commands are run as the nagios user. For versions 5.5.0 through 5.6.5, the commands are run as root. Note that versions prior to 5.2.0 will still be marked as being vulnerable however this module does not presently support exploiting these targets. The module uploads a malicious check_ping plugin to the Nagios XI server via /admin/monitoringplugins.php and then executes this plugin by issuing a HTTP GET request to download a system profile from the server. For all supported targets except Linux (cmd), the module uses a command stager to write the exploit to the target via the malicious plugin. This may not work if Nagios XI is running in a restricted Unix environment, so in that case the target must be set to Linux (cmd). The module then writes the payload to the malicious plugin while avoiding commands that may not be supported. Valid credentials for a user with administrative privileges are required. This module was successfully tested on Nagios XI 5.3.0 and Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before 5.5.0, it may take a significant amount of time for the payload to get back (up to 5 minutes). If exploitation fails against an older system, it is recommended to increase the WfsDelay setting (default is 300 seconds).

Read more »

Microsoft Patch Tuesday, April 2021 Edition
Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server -- the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild.

Read more »

ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users
Someone is selling account information for 21 million customers of ParkMobile, a mobile parking app that's popular in North America. The stolen data includes customer email addresses, phone numbers, license plate numbers, hashed passwords and mailing addresses.

Read more »

Facebook, Google, and Stolen iPhones – Intego Mac Podcast Episode 182
Facebook leaks 500 million user records, Google is testing a new replacement for cookies to track users, and we explain how to check if that used iPhone you want to buy is stolen. The post appeared first on The Mac Security Blog.

Read more »

How to remove GPS location data from photos on iPhone or Mac
Your photos can store the location where you shot them, but you don't always want them to, especially if you share them. Here's how to remove location data from photos on iOS and Mac. The post appeared first on The Mac Security Blog.

Read more »

Apple is blowing out clearance 2020 13″ Intel-based MacBook Pros in their Certified Refurbished store, now only $899
In addition to refurbished 13″ M1 MacBook Pros starting at $1099, Apple has dropped prices on Certified Refurbished 2020 13″ 1.4GHz 4-Core Intel-based MacBook Pros with models now available starting at $899 and up to $460 off original MSRP. These are the cheapest MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/256GB Space Gray 4-Core MacBook Pro (MXK32LL/A): $899 $400 off MSRP – 13″ 1.4GHz/512GB Space Gray 4-Core MacBook Pro (MUHP2LL/A): $1039 $460 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core MacBook Pro (MXK52LL/A): $899 $400 off MSRP – 13″ 1.4GHz/512GB Silver 4-Core MacBook Pro (MXK72LL/A): $1039 $460 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

New at Apple: Buy any iPad with WiFi + Cellular and get up to $200 back with carrier activation
Apple has a new, and rate, offer for cellular iPad users. Buy any new iPad with WiFi + Cellular at Apple, and get up to $200 back with carrier activation via AT&T, T-Mobile/Sprint, or Verizon. Offer valid for a limited time. Here are the details for each carrier: AT&T: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get $150 in bill credits ($5/mo. over 30 months) after you activate your new iPad on an eligible AT&T wireless plan (min. $10/mo. and excludes Prepaid). T-Mobile/Sprint: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get a $200 virtual gift card after you activate your new iPad on an eligible T-Mobile or Sprint data plan. Verizon: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get a $200 Verizon e-gift card after you activate your new iPad on an eligible Verizon data plan. Apple’s offer is live on their site right now. See their site for → Read More...

Read more »

Apple drops prices on clearance, Certified Refurbished, 13″ Intel-based MacBook Airs, now blowing out models for only $719
Apple has dropped prices on clearance, Certified Refurbished, 2020 13″ Intel-based MacBook Airs with models now available starting at only $719 and up to $370 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Silver: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Gold: $719 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Space Gray: $929 $370 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Silver: $929 $370 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Gold: $929 $370 off MSRP The dual-core model is the cheapest MacBook for sale today at Apple. Check their site for the latest stock status, and note that Apple may sell out at any time. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Apple introduces new iPad Pro with M1 Apple CPU
Apple today introduced a new iPad Pro with Apple’s M1 Apple CPU. Main features include: – M1 CPU – 8-Core CPU – 50% faster performance, 75X faster than original iPad Pro – 8-Core GPU with 40% faster performance, 1500% faster than original iPad Pro – All day battery life – New 2TB storage option – USB C port with Thunderbolt, 4X more bandwidth – Support for 6K external displays and many accessories – 5G cellular connectivity – Improved cameras – New ultrawide 12MP camera with Center Stage – 600 nit brightness display in 11″ model – 12.9″ model features Liquid Retina XDR mini-LED display with 1000 nits brightness Available April 30th and shipping the second week of may, the new 2021 M1 iPad Pros will start at $799 for the 11″ model and $1099 for the 12.9″ iPad Pro. We’ll be updating our iPad Pro Price Trackers with the latest prices & sales from Apple and its resellers as information → Read More...

Read more »

Apple introduces new 24″ M1 iMac in multiple colors
Apple today introduced the new 2021 24″ M1 iMac. The new iMac features a single sheet of glass with a small chin, seven different colors, aluminum stand, thin bezels, and Apple’s M1 processor. The new 24″ display occupies the same area as the previous 21″ display. Main features include: – 11.5mm thickness with a flat profile – 24″ 4.5K retina display – 500 nits brightness – True tone. – 1080p Facetime HD camera – Studio grade microphone & 6 improved speakers – Apple claims the best sound system ever in any Mac – 85% faster performance than the previous 21″ iMac – Up to 2X faster GPU performance, up to 50% faster graphics – 3X faster machine learning performance – Up to 4 USB C ports, support for 6K displays – Magnetic power cord connection – Power supply with incorporated ethernet – New Magic Keyboards with available emoji icons and Touch ID The new 24″ M1 iMac will be available April 30th with deliveries in the second half of May 2021. iMac starts at $1299 in 4 colors and an 8-Core CPU/7-Core GPU. A $1499 model with be available with an 8-Core CPU/8-Core GPU in 7 colors. We’ll be updating our iMac Price Tracker with prices & information on the new models as information comes in from Apple and → Read More...

Read more »

Apple updates 4K Apple TV
Apple today updated the 4K Apple TV with a new siri remote, better color balance, and better high fidelity. Sold for $179 32GB or $199 for 64GB, the updated models will be available in the second half of → Read More...

Read more »

Apple introduces AirTags to work with their FindMy network to find your stuff
Apple today introduced AirTags, a $29 accessory available starting 4/30/21 to work with Apple’s FindMy network to find your stuff. A 4-pack with sell for $99. AirTags work especially well with iPhones using Apple’s U1 chip, allowing on screen directions to an AirTag. AirTags will also support → Read More...

Read more »

Is Apple Looking To Its Past For Inspiration With The Designs Of Its New Macs?
FEATURE: 04.20.21 – Apple seems to be getting a bit nostalgic over the Mac when it comes to updating its design… back to the late 1990s and early 2000s to be exact. The first Apple Event of 2021 — teased as a, “Spring Loaded” special event — is predicted to see the unveiling of a brand new iMac with Apple silicon inside. While the exact details of its expected design overhaul are not yet known (could it hearken back to the spring-loaded floating display of the iMac G4 from 2002?), one thing’s for sure. Will a new Apple silicon-based iMac sporting a wide array of metallic color finishes, reminiscent of the “fruit-flavored” iMacs of the late 1990s as seen photographed above, be announced at the first Apple Event of 2021? (Photo: Apple, Inc.) No matter what new hardware and/or devices are announced by Apple at the “Spring Loaded” special event, there’s evidence that the Cupertino, California-based company may be going backwards in time and looking to its past (as opposed to springing forward, as it were) with the future product designs of its upcoming Macs. **AD: No matter what new products may be announced by Apple at its “Spring Loaded” special event? Before you pull out your Apple Card (or whatever form of payment you have on hand) and spring for one, or all, of the company’s newest hardware and devices, point your browser to MacPrices.net and consult our exclusive and award winning price trackers for the lowest prices, best deals, and latest discounts offered at Apple’s online and retail stores (as well as Apple Authorized Resellers, too). Pricing updated daily, seven days a week! iMacs With Color? ‘Yum.’ Back in February of this year, iMore — a website whose “authoritative team” helps people to get the most out of life from their Apple products — reported that Apple is expected to replace the iMac with an updated model later this year. Citing a report from Jon Prosser → Read More...

Read more »

No trade-in? AT&T still offers Apple iPhones to new and existing customers starting at only $5 per month
AT&T is offering Apple’s previous-generation 64GB iPhone 11 for $10 per month, for new or existing customers, no trade-in required. Discount is applied via monthly bill credits over a 30 month period. The fine print: “Get the iPhone 11 64GB for $10/mo., 128GB for $15/mo., or 256GB for $20/mo. for 30 mos. when you buy it on a qualifying installment agreement with eligible wireless. No trade-in required.” The same no trade-in deal is offered with a couple of other iPhone models as well: – iPhone SE: 64GB for $5/mo., 128GB for $10/mo., and 256GB for $15/month. – iPhone XS: 64GB for $5/mo., 256GB for $10 per month. AT&T’s offers are live on their site now. For the latest prices & deals, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

This wireless carrier has the Apple iPhone SE on sale for only $249, $150 off MSRP
Boost Mobile is offering Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249. 128GB models are offered at a $50 discount: $399. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is one of the cheapest no-contract 2020 iPhones we’ve seen available anywhere. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

Amazon drops prices on iPad Pros before Apple’s special event on the 20th, offers models from only $729
Apple is widely expected to introduce new iPad Pros during their spring 2021 special event on April 20th. In front of this event, Amazon has dropped prices on 2020 11″ and 12″ iPad Pros by up to $100 off Apple’s MSRP. These are the same iPad Pros sold by Apple in its retail and online stores. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free. Note that some sale prices may be restricted to either Space Gray or Silver colors: – 11″ 128GB WiFi iPad Pro: $729.99 $70 off – 11″ 256GB WiFi iPad Pro: $799.99 $100 off – 11″ 512GB WiFi iPad Pro: $999.99 $100 off – 11″ 1TB WiFi iPad Pro: $1199 $100 off – 11″ 128GB WiFi + Cellular iPad Pro: $879.99 $70 off – 11″ 256GB WiFi + Cellular iPad Pro: $949.99 $100 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $100 off – 11″ 1TB WiFi + Cellular iPad Pro: $1349.99 $100 off – 12″ 128GB WiFi iPad Pro: $929.99 $70 off – 12″ 256GB WiFi iPad Pro: $999 $100 off – 12″ 512GB WiFi iPad Pro: $1199 $100 off – 12″ 1TB WiFi iPad Pro: $1399.99 $100 off – 12″ 128GB WiFi + Cell iPad Pro: $1079.99 $70 off – 12″ 256GB WiFi + Cell iPad Pro: $1149.99 $100 off – 12″ 512GB WiFi + Cell iPad Pro: $1349 $100 off – 12″ 1TB WiFi + Cell iPad Pro: $1549.99 $100 off Keep an eye on our 11″ iPad Pro Price Tracker and our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Sunday Sale: 13″ M1 MacBook Pros for $200-$230 off MSRP, Certified Refurbished, at Apple
Apple has a full line of 2020 13″ M1 MacBook Pros available Certified Refurbished, starting at only $1099 and up to $230 off original MSRP. These are the cheapest M1 MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Pro/256GB SSD/Space Gray: $1099 $200 off MSRP – 13″ M1 MacBook Pro/512GB SSD/Space Gray: $1269 $230 off MSRP – 13″ M1 MacBook Pro/256GB SSD/Silver: $1099 $200 off MSRP – 13″ 13″ M1 MacBook Pro/512GB SSD/Silver: $1269 $230 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »