Link

Malwarebytes Reveals it Was Hacked by Nation State Behind ‘SolarWinds’

Andrew Orr ·

Malwarebytes co-founder and current CEO Marcin Kleczynski reveals the company was hacked. He believes it was the same nation state actor behind the SolarWinds attack. The state is believed to be Russia.

After an extensive investigation, we determined the attacker only gained access to a limited subset of internal company emails. We found no evidence of unauthorized access or compromise in any of our internal on-premises and production environments.

Crazy stuff, and we’ll probably hear of the fallout for a long time.

Link

AirPods Max Headbands Could be Interchangeable

Andrew Orr ·

iFixit published a tear down of the AirPods Max and it reveals, among other things, that the headband could be interchangeable.

It was rumored that Apple wanted to design the AirPods Max headband to be easily-swappable like its magnetic ear cups. That feature was thought to be missing from the final design, but this joint is so complex it just might have one more thing up its sleeve…despite the joint’s complexity, you can detach the entire headband from AirPods Max with just a SIM card removal tool or paperclip, without even opening the ear cup.

Link

Bug Lets Audio, Video be Transmitted Without Consent in Apps Like Signal

Andrew Orr ·

Google’s Project Zero security team found a bug that lets audio and video be transmitted without user interaction in five messaging apps. These are Signal, JioChat, Mocha, Google Duo, and Facebook Messenger. All bugs have been fixed.

I investigated the signalling state machines of seven video conferencing applications and found five vulnerabilities that could allow a caller device to force a callee device to transmit audio or video data. All these vulnerabilities have since been fixed. It is not clear why this is such a common problem, but a lack of awareness of these types of bugs as well as unnecessary complexity in signalling state machines is likely a factor.

Apple Homepage Marks Martin Luther King Day
Cool Stuff Found

Apple Homepage Marks Martin Luther King Day

Charlotte Henry ·

Apple’s homepage has been updated to honour Martin Luther King day. The usual images have gone and there is a black-and-white photograph of the civil rights leader. The page also features a quote from him –  “true peace is not merely the absence of tension; it is the presence of justice.”

Link

Where are the Safari 14 WebExtensions?

Andrew Orr ·

In 2020 Apple announced it would support browser extensions that used the WebExtensions API. But as Jason Snell points out, we haven’t seen many yet. One developer listed possible barriers for entry:

Limited time, lack of access to Apple hardware, unfamiliarity with Apple’s developer tools, Safari’s incompatibility with some existing extension-development tools, and the requirement to make some code changes in order to fit inside Apple’s security model.

I think another barrier is probably the US$99/year developer program fee. It makes sense if you’re already in the program to build an extension if it makes sense for you, but I don’t think many outside of the program will pay that just to release a new extension. Then again, it’s still in the early days of this new support.

Apple Fitness Boss Jay Blahnik Talks Fitness+
Cool Stuff Found

Apple Fitness Boss Jay Blahnik Talks Fitness+

Andrew Orr ·

A short interview with Apple’s senior director of fitness Jay Blahnik was shared on the Healthy-ish podcast. They talk about Fitness+, health and fitness in general, and why it’s time to rethink our mentality of working out. “Jay Blahnik is the Senior Director of Fitness Technologies at Apple, so it goes without saying that he knows a thing or two about what gets people up and moving. He shares how Apple Fitness+ taps into this, and also why it might be time to rethink where, when and even how you work out. Because, the world has changed. And your gym membership with it.”