Security

The lengths Apple will go to catch leakers…

Recently, more tidbits about forthcoming Apple products have been coming from its offices in Cupertino, California, than from the company's vast supply chain in Asia.

That's according to Outline's William Turton, who has watched a video of an hour-long briefing held by former NSA investigators in order to educate about 100 top Apple employees on how confidential information gets leaked out to the press.

Titled “Stopping Leakers—Keeping Confidential at Apple,” the presentation was led by Apple's Director of Global Security David Rice, Director of Worldwide Investigations Lee Freedman and Jenny Hubbert, who works on Apple's Global Security communications and training team.

The presentation educated employees on the ways to “prevent information from reaching competitors, counterfeiters and the press.” Apple’s Global Security team employs an undisclosed number of investigators around the world, with some members embedded on certain Apple product teams to help employees keep secrets.

“When I see a leak in the press, for me, it’s gut-wrenching,” one Apple employee said. “It really makes me sick to my stomach.” Another employee said that when an Apple employee does leak confidential information, they're “letting all of us down.”

“It’s our company, the reputation of the company, the hard work of the different teams that work on this stuff,” said the employee. Tim Cook publicly promised in 2012 that Apple would double-down on secrecy. So, how has that worked out?

According to Greg Joswiak, Apple’s Vice President of iOS product marketing:

This has become a big deal for Tim. Matter of fact, it should be important to literally everybody at Apple that we can't tolerate this any longer. I have faith deep in my soul that if we hire smart people they’re gonna think about this, they’re gonna understand this, and ultimately they’re gonna do the right thing and that’s to keep their mouth shut.

Apple is actively going after leakers who would spoil its “One More Thing” surprises.

According to Jenny Hubbert:

So you heard Tim say, ‘We have one more thing.’ So what is that one more thing? Surprise and delight. Surprise and delight when we announce a product to the world that hasn’t leaked. It’s incredibly impactful, in a really positive way. It’s our DNA. It’s our brand. But when leaks get out, that’s even more impactful. It’s a direct hit to all of us.

In recent months, Apple clamped down on supply chain leaks, so much so that more confidential information now gets leaked out from Apple’s campuses in California than its factories abroad.

“Last year was the first year that Apple campuses leaked more than the supply chain,” Rice told the gathered employees. “More stuff came out of Apple campuses last year than all of our supply chain combined.”

This is a notable achievement given that Apple's contract manufacturers employ up to three million people when the company ramps up production, and all of these people need to be checked every time they enter and exit the factory.

The iPhone maker has been “busting its ass” to prevent supply chain leaks, with Rice describing the efforts as “trench warfare non-stop,” especially with “very talented adversaries” and black market sellers offering “top dollar” for Apple parts.

A product's housing is the most sough-after part. “If you have a housing, you pretty much know what we're going to ship,” Rice says, adding that the stolen parts often end up in Huaqiangbei, one of the biggest electronics markets in the world, located in Shenzhen, Southern China.

“There’s a whole slew of folks that can be tempted because what happens if I offer you, say, three months’ salary?’ In some cases we’ve seen up to a year’s worth of salary being rewarded for stealing product out of the factory,” said Rice.

2013 was a particularly painful year for Apple as the company had to buy back about 19,000 stolen enclosures before the iPhone 5c announcement and then an additional 11,000 before the phones were shipped to customers. “So we're buying as fast as we possibly can to try to keep it out of every blog on Earth,” Rice said.

Here's how many Apple enclosures were stolen since 2013:

2014—387 enclosures stolen 2015—57 enclosures stolen, 50 of which were lifted on the announcement night 2016—4 enclosures stolen

A few years ago, Apple began removing traces of unreleased products from iOS builds.

Its renewed focus on preventing leaks is on full display with virtually no iPhone 8 component leaks as of yet, unlike in years past when new iPhone parts would leak out of Asian factories for months in advance.

Not even Bloomberg's Mark Gurman, formerly with 9to5Mac, could obtain iPhone 8 parts. Rice “gleefully recounted” a blog post by Daring Fireball's John Gruber, in which he criticized Gurman for not having details on Apple’s new HomePod speaker before it was released.

Like many other manufacturers, Apple has long been using special cases to conceal iPhone prototypes during testing in the wild. Still, no security is perfect so leaks remain a fact of life. Security always comes down to the human factor, as we saw with the iPhone 4 leak.

For an in-depth overview of Apple's commitment to corporate secrecy, I wholeheartedly recommend Adam Lashinksy’s book “Inside Apple”, available on iBooks Store for $14.99.

Spice up your Lock screen’s passcode capabilities with Callisto Pro

Whether you’re using Touch ID or a passcode to secure your device, a new jailbreak tweak dubbed Callisto Pro (iOS 10) by iOS developer ijapija00 provides a host of new features for customizing the passcode-entry experience.

It's jam-packed with both aesthetic and functional features, letting you not only customize the way your passcode keypad looks and feels, but also the way it keeps your device protected.

This tweak brings an iOS 11-inspired passcode keypad to iOS 10

Among the slew of interface changes iOS 11 brings to the table, one of first things you’ll notice after picking up a device with the new operating system installed on it is the redesigned passcode keypad.

If you like the way it looks, but you won’t be upgrading this Fall in order to keep your jailbreak, a new free jailbreak tweak dubbed Creamy (iOS 10) by iOS developer ijapija00 can be used to mimic the aesthetics of the iOS 11 passcode keypad on your jailbroken device.

WikiLeaks: CIA has been hacking wireless routers for years

A new batch of confidential “Vault 7” documents, leaked by the non-profit whistleblower organization WikiLeaks, has revealed that the United States Central Intelligence Agency has been hacking routers from major brands for years, turning them into surveillance devices.

The reported "Cherry Blossom" tool can modify a router's firmware without a victim's knowledge, giving the attacker a wide range of capabilities like eavesdropping on network traffic, gathering passwords, scanning for email addresses and phone numbers and more.

The attacker even has the power to redirect an unsuspecting user to a particular website, including government-created webpages used for phishing purposes.

Once infected, the backdoor remains functional even after a router is updated to a newer firmware version, so long as it has not changed its underlying hardware or operating system.

The hack cannot be deployed remotely. Instead, the CIA can install it on a target router using its Claymore tool or by side-loading a compromised firmware using supply chain tactics (intercepting the target device between the factory and the end user).

ZDNet reports that the documents reveal that the “Cherry Blossom” hack supports more than two-dozen router models from major manufacturers.

Among the compromised router brands are the devices from Asus, Belkin, Buffalo, Dell, Dlink, Linksys, Motorola, Netgear, Senao and US Robotics. However, Apple's AirPort devices don't seem to be among them, but the fact they're not listed doesn't mean that the CIA hasn't hacked Time Capsule and AirPort devices.

Make unlocking non-Touch ID devices quicker with Accelerated Unlock

Devices that don’t support Touch ID or just aren’t utilizing the feature typically resort to passcodes as the next best form of security. On the other hand, there tends to be a rather annoying delay after pressing the Home button before the passcode interface finally appears.

A new free jailbreak tweak dubbed Accelerated Unlock by iOS developer Youssef Mikhail does away with this unwanted delay and makes unlocking your device seem faster.

iOS 11 and macOS High Sierra automatically update your Apple ID to use Two-Factor Authentication

If you haven't upgraded your Apple ID from Apple's older Two-Step Verification system to the more secure Two-Factor Authentication, iOS 11 and macOS High Sierra will do that for your when you install either operating system on your devices.

Apple communicated the change in an email to customers with Two-Step Verification enabled for their Apple ID. Here's the full text of the email communique, as obtained by MacRumors:

If you install the iOS 11 or macOS High Sierra public betas this summer and meet the basic requirements, your Apple ID will be automatically updated to use two-factor authentication. This is our most advanced, easy-to-use account security, and it's required to use some of the latest features of iOS, macOS, and iCloud.

Once updated, you'll get the same extra layer of security you enjoy with two-step verification today, but with an even better user experience. Verification codes will be displayed on your trusted devices automatically whenever you sign in, and you will no longer need to keep a printed recovery key to make sure you can reset a forgotten password.

Significantly improving the security of your Apple ID, Two-Factor Authentication requires both your Apple ID password and a one-time code when you sign in to a new device or browser with your Apple ID.

TUTORIAL: How to protect your Apple ID with Two-Factor Authentication

Unlike Two-Step Verification, which sends a six-digit verification code via SMS, Two-Factor Authentication is deeply integrated in iOS 9, OS X El Capitan, watchOS 2 and tvOS or later and features a mechanism that automatically delivers verification codes via push notifications to all trusted devices registered to a given Apple ID.

If you're not using either system to protect your Apple ID, you're wholeheartedly recommended to enroll your devices in Two-Factor Authentication. If your account isn't eligible for two-factor authentication, you can still use two-step verification to protect your Apple ID information.

One way or another, anyone installing Apple's latest OS updates this fall shall be asked to upgrade their Apple ID to the more modern Two-Factor Authentication system. Two-Factor Authentication is available in more than a hundred countries, listed in Apple's support document.

AppLocker lets you secure apps with a password

AppLocker by iOS developer Ori Kadosh, is one of the most popular app security jailbreak tweaks in Cydia, and it has been updated this week with full support for iOS 10.

AppLocker lets you create a password that you will use to access your apps; it's requested every time you launch an app, and if you can’t provide it, you can't use the app.

QuickTrust makes it easier to trust sideloaded app certificates

Depending on how advanced of an iOS user you are, you may sideload apps from time to time.

In many circumstances, sideloading third-party apps via Impactor or Xcode involves trusting a certificate – a process you should be familiar with if you've jailbroken with Yalu102 or Pangu for iOS 9 – but iOS doesn’t make the trusting process easy or straightforward out of the box.

Here to fix that problem is a new free jailbreak tweak called QuickTrust by iOS developer 1GamerDev, which adds a “Trust” button directly to the certificate pop-up alert, as shown above.

LastLocked puts the last time your device was locked on the Lock screen

In April, we showed you a tweak dubbed LastTimeUnlocked that replaced the ‘press home to unlock’ text on the Lock screen with an indicator of when your device was most recently unlocked, and now a new free jailbreak tweak called LastLocked by iOS developer NeinZedd9 is taking on the opposite end of the spectrum.

Rather than displaying when your device was last unlocked, LastLocked displays the last time your device was most-recently locked.

This tweak hides your web search history from Spotlight

Whenever you search for stuff using Spotlight on your iPhone, a history of what you’ve searched for is kept just below the Siri app suggestions.

If you’re concerned about the privacy of your web search history via Spotlight, then you might want to download a new free jailbreak tweak dubbed Spotlight No Suggest by iOS developer ichitaso.

Allow guests to sign into your iPhone or iPad with Guest Mode 2

If you have a jailbroken iOS device that you share with guests or other family members, then Guest Mode 2 by iOS developer Ian Burns is a jailbreak tweak that might be worth installing.

This tweak lets guests use your device without knowing your passcode, but securely and with limited privileges, similarly to that of the guest user on macOS.