Don't make an iOS of yourself – Apple's patched its OSes, you know the drill
- Reference: 1639468814
- News link: https://www.theregister.co.uk/2021/12/14/apple_os_updates/
- Source link:
Full details of Apple's bugs aren't available at the time of writing, but plenty of them sound more than worthy of rapid remediation.
CVE-2021-30986, for example, means a device running macOS Monterey "may be passively tracked by its Bluetooth MAC address". That is not good.
[1]
CVE-2021-30957 and 30958 describe flaws that mean processing a maliciously crafted audio or image file can lead to arbitrary code execution. The two flaws are present in macOS, iOS, iPadOS, and even WatchOS.
[2]
[3]
CVE-2021-30960, present on all Apple platforms, means "Parsing a maliciously crafted audio file may lead to disclosure of user information."
Yes: your smartwatch can leak user information if it plays a poisoned song. Your music choices may say a lot about you, but they shouldn't say that much.
[4]Apple wins Epic court ruling: Devs will pay up for now as legal case churns on
[5]Why your external monitor looks awful on Arm-based Macs, the open source fix – and the guy who wrote it
[6]AWS adds another Arm CPU to its cloud: Apple's M1
On macOS alone, 14 fixes address the potential for malicious applications to do nasty things.
A whopping 21 flaws in iOS and iPadOS allow arbitrary code execution.
[7]
We could go on, but you get the idea: installing these updates is a very sensible idea.
There's an upside to the latest Apple OS releases, too.
iOS 15.2 adds information on apps' use of permission-restricted resources including your microphone and camera. The keypress to make an SOS call has been simplified (but also overlaps with the screenshot keypress).
[8]
Apple's [9]"Digital Legacy" feature also debuts in this release and lets iThing owners designate someone who can access their data after they die.
Digital Legacy also applies to macOS, which in Monterey 12.1 gains better media sharing features.
Details of Apple's updates can be found [10]here . Apple devices usually nag their owners to install updates and offer passable instructions on how to get it done. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ybh5XoS8ZEWmO24hb-Up5AAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybh5XoS8ZEWmO24hb-Up5AAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ybh5XoS8ZEWmO24hb-Up5AAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2021/12/09/apple_app_commissions/
[5] https://www.theregister.com/2021/12/03/apple_m1_drivers/
[6] https://www.theregister.com/2021/12/03/aws_m1_macs_ec2/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ybh5XoS8ZEWmO24hb-Up5AAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ybh5XoS8ZEWmO24hb-Up5AAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://digital-legacy.apple.com/
[10] https://support.apple.com/en-us/HT201222
[11] https://whitepapers.theregister.com/
Not these days. I simply don't have the energy any more.
"Take note that if Apple can allow "someone" to access your stuff after you are dead, Apple can also obey a court order to allow that same access while you are alive."
Not necessarily. Any new keys would need to be generated by a device or person with the original key. I'm no encryption expert, but you would need to be able to decrypt the data to generate a new key. If encryption didn't work that way, you'd be able to generate a key for any encrypted data you saw.
Now, there is nothing physically stopping Apple generating their own key at the time the user's key is generated and using that later, but I think if Apple did that, there are enough experienced hackers who *hate* apple, it would be discovered and leaked onto websites all over the world before Apple's lawyers even got started.
Not saying Apple wouldn't do that, but if they did, they run the risk of losing a *lot* of sales and like any good capitalist entity, they exist to make money.
Digital Legacy
For those interested in the details - it requires your *designated* contact to have two things:
1) An access key that is generated when you choose the contact (you are able to choose more than one). - presumably this is protecting your data.
2) Your death certificate.
The data is limited to iCloud stored data, and includes:
photos, notes, mail, contacts, calendars, reminders, iMessages, call history, iCloud Drive files, health data, voice memos, safari bookmarks/reading list, and your iCloud backups.
Excluded:
Licenced media, in-app purchases, payment info/apple pay, iCloud Keychain (inc. passwords).
You can choose to text message your designated user(s) a code, or print a copy to include in your estate documents. It *does not* require the user to have an iOS/MacOS device.
Re: Digital Legacy
"2) Your death certificate."
Or a court order.
"lets iThing owners designate someone who can access their data after they die."
Take note that if Apple can allow "someone" to access your stuff after you are dead, Apple can also obey a court order to allow that same access while you are alive.
Not that I think any ElReg comentards are doing anything illegal, immoral or fattening with their computers, of course.