As noted in this article, “a security researcher has disclosed a new flaw that undermines a core macOS security feature designed to prevent apps, or malware, from accessing a user’s private data, webcam or microphone without their explicit permission.” Recent privacy protections, expanded in the Mojave version of the Macintosh operating system, were meant to make it more difficult for malicious apps to get access to the user’s private information, unless the user allows access through a pop-up dialog.
However, these protections weren’t as good as Apple previously believed. This bug is the result of a whitelist of approved applications that are allowed to create “synthetic clicks” to prevent them from breaking. This includes the popular video playing application VLC, which the researcher showed could access a user’s camera, microphone, and other Macintosh computer services, through a plug-in that performed malicious actions.
This is a reminder that users should be aware anytime an application asks for permission to download and/or load additional software. In this case, any application that requires a download and installation of a plug-in would require closer scrutiny. This is especially true for anyone who attempts to access files through something like torrent services, which could potentially request to download a plug-in to view the downloaded file (or else the file that is downloaded through the torrent file could also be a payload with malicious intent, even if not requiring a plug-in).
If you’d like to discuss further, please let us know!
As mentioned in this article, Apple has posted a new article on its website that details how a user can implement Full Mitigation for a “theoretical” speculative attack that targets Intel CPUs (central processing units). Full Mitigation is mostly for users that are at heightened risk for an attack, such as government workers or high-ranking business executives.
Enabling this mitigation results in an approximate 40% drop in performance. However, as previously mentioned, most users won’t need to enable this level of mitigation, as the attack is theoretical at this point and there are no known attacks in the wild for this.
macOS 10.14.5 includes the most relevant patches for users, although there have been reported issues from Mac users with some methods of file sharing over macOS. As always, it is the best practice to only download trusted software from the Apple App Store.
If you have further questions or would like to discuss, let us know!
Most users know that it’s possible to add items to the macOS dock by dragging and dropping an icon onto the Dock. However, there’s another way that you can add anything instantly to the Dock on macOS with a keyboard shortcut.
Here’s the process:
- Navigate to the item you want to add to the Dock in the Finder
- Select the item to add to the Dock in Finder
- Now hit the keyboard shortcut: Control+Shift+Command+T
If you’d like to know other time-saving tips, let us know!
We previously notified our readers of a breach involving Microsoft Outlook email. Users of Cryptocurrency are now coming forward to indicate that this Outlook breach led to a theft by hackers of their Cryptocurrency from various Cryptocurrency Exchanges, as detailed in this follow-up article.
Keeping anything online, whether it be email or items like Cryptocurrency, leaves a user open to potential hacks. It is wise to copy email to a folder on the user’s computer vs. leaving it online in an inbox or the like for hackers to gain access to. When stored in a folder on a personal computer, it’s much harder to access.
Also, enabling verification items like 2fa (Two-factor authorization), where a user is required to verify log-ins and other procedures using an application on their phone, are wise to use to prevent access to user accounts. As one user indicated in the article, they did not have 2fa enabled on their account, so it allowed the hackers easier access.
If you’d like to discuss further on ways you can protect yourself online, please let us know!
For the first three months of 2019, Microsoft has admitted that hackers had access to some details of certain Outlook.com email accounts. As this article states, Outlook.com is the web version of Microsoft’s email service, and this online service was previously known as Hotmail. Per Microsoft, “this unauthorized access could have allowed unauthorized parties to access and/or view information related to your email account …but not the content of any emails or attachments.”
While it appears no actual emails were read or attachments were accessed, this is an important reminder that being online brings its share of risks to user data. It’s a smart idea to use an actual email application to view email, in companion with a web browser, and to store as much email off-line as possible. This will help in prevention of potential data access in the event your email account gets hacked.
In relation to this, and as has been mentioned before, it is important to ensure the safeguarding of passwords, for email and other sites. It is good practice to change passwords periodically throughout the year. By doing so, there’s less of a chance that the current password is in the hands of hackers if it is changed more often, in the event an account is compromised. Also, never send password or login information via email, as this just opens user’s data to easily being compromised.
As always, please contact us if you have questions or would like to discuss further!
As noted on a number of complaints across Apple related sites, the newest update of macOS (10.14.4), which was released a few days ago, causes issues with authentication when attempting to sign into a user’s Gmail account. Users are reporting receiving an endless loop, bouncing between macOS and Google’s sign-in page in Safari.
Because of this, it is recommended not to upgrade to OS 10.14.4 if you use Gmail within your Mail application until Apple releases an update and it’s verified as a fix for the issue.
It appears this is a verified issue per discussions on the Apple Support site. Attempting to use a different browser such as Chrome does not succeed as a work-around, as the Mail application interacts directly with Safari in this process.
Apple Mail can also exhibit other intermittent issues for some users, such as not showing a message as replied-to where a user had just replied. If you are noticing any odd issues such as this, restart your Mail application.
You can read more about the Mail/Gmail 10.14.4 issue here. As always, if you need assistance, we’re here to help!
The latest version of the Mozilla browser Firefox can now block auto-play videos with sound. Chrome has previously introduced this ability, but Firefox’s has the ability to block more videos in a more user-friendly manner of setup. It can also be configured to exclude only certain sites, and include others. More can be read here.
Features such as this are good for those on limited download plans. If you’d like assistance with configuring this feature, just let us know!
Due to a security vulnerability, Google is urging users of their Chrome web browser to update to the latest version. As the article mentions in the first link below, Chrome updates are usually automatically performed.
To see the current version of Chrome on a Mac, you can access the Chrome menu in the top left while in the browser and choose “About Google Chrome”. The second of two links below explains how to check if on a Windows-based PC.
This is another example of ensuring that your software is kept up to date.
Earlier in February, it was reported by multiple sites that some MacBook Pro owners had an issue with Adobe Premiere Pro CC “blowing” the speakers due to a software bug. Adobe has confirmed this issue and introduced an update to address it. The below link explains the problem and resolution.
Issues like this show the positive results of making sure software is kept up to date. For users with slower connections that prohibit quickly downloading updates and other files, ask us how we can assist with getting the most out of what you already have.
A quick summary from the article of steps to take in regards to browser extensions that can be installed for Chrome and other similar Web browsers:
- Don’t install software that you cannot read and asks for intrusive permissions.
- If something seems off, it probably is. Evaluate what might cause your user journey to change.
- Periodically evaluate what extensions you have on your browser — remove those you don’t use anymore.
- If you have an extension on your browser that you use, seek an open-source version/alternative or disable automatic updates from the Chrome store — make sure you audit the code or find someone reliable and trustworthy to.