iOS, The Future Of macOS, Freedom, Security And Privacy In An Increasingly Hostile Global Environment

This post by a security researcher who prefers to remain anonymous will elucidate concerns about certain problematic decisions Apple has made and caution about future decisions made in the name of “security” while potentially hiding questionable motives. The content of this article represents only the opinion of the researcher. The researcher apologises if any content is seen to be inaccurate, and is open to comments or questions through PGP-encrypted mail.

⛔️iOS subliminally and constantly collects sensitive data, links it to hardware identifiers almost guaranteed to link to a real identity

⛔️iOS forces users to “activate” devices (including non-cellular) which sets up a remote UUID-linked (also collecting registration IP) database for a given device with Apple for APNS/iMessage/FaceTime/Siri, and then Apple ID, iCloud etc. Apple ought be open to users about “activation” and allow users to avoid it.

⛔️Apple Activation servers are accessed via Akamai, which means sensitive data may be cached by Akamai and its’ peering partners' which includes many global ISPs and IXPs

⛔️Risk that macOS could be iOS-ified in the near future in the name of “security” while ignoring significant flaws in iOS’ design wrt privacy, forcing users to unnecessarily trust Apple with potentially sensitive data in order to even simply use devices.

⛔️Controversial, draconian surveillance laws being implemented worldwide which could take advantage of Apple’s data collection and OS design choices, notably in, but not limited to, China, one of Apple's largest markets.

❗️If iOS is to really be considered a secure OS, and if vanilla macOS is to become more secure, independent end-user control must be considered. Increased low-level design security at the cost of control, and the ability to prevent leaking data, cannot be considered a real improvement in security.

Much more info and source: https://gist.github.com/iosecure/357e724811fe04167332ef54e736670d

#iOS #macOS #freedom #security #privacy

Apple Accidentally Approved Malware to Run on MacOS

The ubiquitous Shlayer adware has picked up a new trick, slipping past Cupertino's “notarization” defenses for the first time.

For decades, Mac users had to worry less about malware than their Windows-using counterparts, but over the last few years that's begun to change. In an attempt to crack down on growing threats like adware and ransomware, in February Apple began "notarizing" all macOS applications, a vetting process designed to weed out illegitimate or malicious apps. Even software distributed outside of the Mac App Store now needs notarization, or users wouldn't be able to run them without special workarounds. Seven months later, though, researchers have found an active adware campaign attacking Mac users with the same old payloads—and the malware has been fully notarized by Apple.

https://www.wired.com/story/apple-approved-malware-macos-notarization-shlayer

#Apple #MacOS #malware

Linux, macOS, and Windows running simultaneously on a 1st generation Core i5 and 8GB RAM

This is my Thinkpad T410 with a 1st generation Intel Core i5 and 8 GB of RAM. It runs Arch Linux with Xfce.

The macOS Mojave (chosen over Catalina or Big Sur for it’s lower resource usage) VM works surprisingly well with 3GB RAM, but even when the Windows VM was allocated that much, it was very sluggish.

The Windows installation was very easy. All you have to do is download the ISO from Microsoft, and fill in your username, password, and product key in the “Express Installation” feature of Gnome Boxes.

https://lukesempire.com/2021/04/11/vms

#linux #macos #windows #installation
📡 @nogoolag 📡 @blackbox_archiv

FYI:
In case you are using #MacOS and you still have not purchased Little Snitch, your next best ( free & easy option ) to stop this process from scanning your #photos is:

https://objective-see.org/products/lulu.html

#apple

Don't install #signal app for #macOS, it is not secure.

I carried out this small experiment:

- I wrote a simple Python script that copies the directory of Signal's local storage to another location (to mimic a malicious script or app)
- I ran the script in the Terminal and got a copy of my Signal data on my Mac
- I booted a fresh macOS installation in a virtual machine
- I transferred the copy of Signal's data to the VM and placed it where Signal expects it: ~/Library/Application\ Support/Signal
- I installed Signal and started it
- Signal started and restored my session with all the chat histories 😳
- I exchanged a couple messages with a contact from the VM and it worked 😳
- Then, I started Signal on the Mac
- I got three sessions running in unison: Mac, iPhone, and VM 😳

Messages were either delivered to the Mac or to the VM. The iPhone received all messages. All of the three sessions were live and valid. Signal didn't warn me of the existence of the third session [that I cloned]. Moreover, Signal on the iPhone still shows one linked device. This is particularly dangerous because any malicious script can do the same to seize a session.

Perhaps this flaw is what makes some users think that Signal has a "backdoor" as it is easy for sophisticated attackers to target a victim who's using the Mac app and see their chats. (The same may be also true for the Windows app)

https://x.com/mysk_co/status/1809287118235070662

Targeted iPhone attacks in the wild.

#Apple just patched 2 new zero-days—bringing 2025’s total to 5 actively exploited flaws.

→ One lets hackers run code via malicious audio files
→ Another bypasses Pointer Authentication using memory tricks

Update now: #iOS 18.4.1, #macOS Sequoia 15.4.1, #tvOS, #visionOS

@thehackernews