Andy Greenberg, writing for Wired:At today's Ekoparty security conference, security firm Duo plans to present research on how it delved into the guts of tens of thousands of computers to measure the real-world state of Apple's so-called extensible firmware interface, or EFI. This is the firmware that runs before your PC's operating system boots and has the potential to corrupt practically everything else that happens on your machine. Duo found that even Macs with perfectly updated operating systems often have much older EFI code, due to either Apple's neglecting to push out EFI updates to those machines or failing to warn users when their firmware update hits a technical glitch and silently fails. For certain models of Apple laptops and desktop computers, close to a third or half of machines have EFI versions that haven't kept pace with their operating system system updates. And for many models, Apple hasn't released new firmware updates at all, leaving a subset of Apple machines vulnerable to known years-old EFI attacks that could gain deep and persistent control of a victim's machine.

Apple today released the newest version of its operating system for Macs, macOS High Sierra, to the public. macOS High Sierra is a free download, and offers a range of new features and improvements including the new Apple File System, and support for High Efficiency Video Encoding (HEVC) for better compression without loss of quality, and HEIF for smaller photo sizes. Zack Whittaker, reporting for ZDNet: Patrick Wardle, a former NSA hacker who now serves as chief security researcher at -- Synack, posted a video of the hack -- a password exfiltration exploit -- in action. Passwords are stored in the Mac's Keychain, which typically requires a master login password to access the vault. But Wardle has shown that the vulnerability allows an attacker to grab and steal every password in plain-text using an unsigned app downloaded from the internet, without needing that password.

Apple is ditching Bing and will now use Google to power the default search engine for Siri, Search within iOS (iOS search bar), and Spotlight on Mac. From a report: TechCrunch reported Monday that Apple users will now see search results powered by Google, instead of Bing, when using those tools. For example, when an iPhone user asks Siri a question that needs a search engine result, the voice assistant will now pull from Google, not Bing. Apple will still use Bing for image search queries using Siri or Spotlight on Mac, TechCrunch reported. Apple said the move was done for consistency; its Safari browser uses Google as the default search engine. In a statement, the company told TechCrunch that "we have strong relationships with Google and Microsoft and remain committed to delivering the best user experience possible." Google is reportedly paying Apple $3 billion this year to remain as the default search engine on iPhones and iPads.

AmiMoJo shares a report from Mac Rumors: Over the last day or two, several Mac users appear to have been locked out of their machines after hackers signed into their iCloud accounts and initiated a remote lock using Find My iPhone. With access to an iCloud user's username and password, Find My iPhone on iCloud.com can be used to "lock" a Mac with a passcode even with two-factor authentication turned on, and that's what's going on here. Affected users who have had their iCloud accounts hacked are receiving messages demanding money for the passcode to unlock a locked Mac device. The usernames and passwords of the iCloud accounts affected by this "hack" were likely found through various site data breaches and have not been acquired through a breach of Apple's servers. Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details.

An anonymous reader quotes a report from VentureBeat: Mozilla today released Firefox 9.0 for iOS and updated Firefox Focus for Android. The iOS browser is getting tracking protection, improved sync, and iOS 11 compatibility. The Android privacy browser is getting tabs. You can download the former from Apple's App Store and the latter from Google Play. This is the first time Firefox has offered tracking protection on iOS, and Nick Nguyen, vice president of product at Mozilla, notes that it's finally possible "thanks to changes by Apple to enable the option for 3rd party browsers." This essentially means iPhone and iPad users with Firefox and iOS 11 will have automatic ad and content blocking in Private Browsing mode, and the option to turn it on in regular browsing. This is the same feature that's available in Firefox for Android, Windows, Mac, and Linux, as well as the same ad blocking technology used in Firefox Focus for Android and iOS.

At its Ryzen Pro event in New York City last month, AMD invited a French company called Qarnot to discuss how they're using Ryzen Pro processors to heat homes and offices for free. The company uses the Q.rad -- a heater that embeds three CPUs as a heat source -- to accomplish this feat. "We reuse the heat they generate to heat homes and offices for free," the company says in a blog post. "Q.rad is connected to the internet and receives in real time workloads from our in-house computing platform."

The idea is that anyone in the world can send heavy workloads over the cloud to a Q.rad and have it render the task and heat a person's home in the process. The two industries that are targeted by Qarnot include movies studios for 3D rendering and VFX, and banks for risk analysis. Qarnot is opting in for Ryzen Pro processors over Intel i7 processors due to the performance gain and heat output. According to Qarnot, they "saw a performance gain of 30-45% compared to the Intel i7." They also report that the Ryzen Pro is "producing the same heat as the equivalent Intel CPUs" they were using -- all while providing twice as many cores.

While it's neat to see a company convert what would otherwise be wasted heat into a useful asset that heats a person's home, it does raise some questions about the security and profitability of their business model. By using Ryzen Pro's processors, OS independent memory encryption is enabled to provide additional security layers to Qarnot's heaters. However, Q.rads are naturally still going to be physically unsecured as they can be in anyone's house.

Further reading: The Mac Observer, TechRepublic

After updating its website for the iPhone launch event, Apple has confirmed that macOS High Sierra will be released on September 25th. TechCrunch provides a brief rundown of the major changes, most of which are under the hood: The Photos app is still receiving some new features to keep it up to date with the iOS version. There are more editing tools, you can reorganize the toolbar and you can filter your photos by type. If you're a Safari user, my favorite change is that there is a new feature in the settings that lets you automatically block autoplaying videos around the web. Many websites have abused autoplaying video, it's time to stop it. And then, there's a new file system that should make your Mac snappier if you're using an SSD. Mail is compressing messages, Metal 2 should take better advantage of your GPU, Spotlight knows about your flight status, etc. The free update to macOS High Sierra will be available in the Mac App Store.

Google announced in a blog post today that the Google Drive app for desktop will be shut down. The Verge reports: Support will be cut off on December 11th and the app will shut down completely on March 12th, 2018. Users who are still running the Drive app will start seeing notifications in October that it's "going away," and the company will steer customers towards one of two replacements depending on whether they're a consumer or business user. Google Drive the service isn't going anywhere. You can still access it from the web, smartphone apps, and either of the software options mentioned below. Google now has two fairly new software tools for backing up your data and/or accessing files in the cloud. There's Backup and Sync, the all-encompassing consumer app that replaces both the standalone Google Drive and Google Photos Uploader apps. It offers essentially the same functionality as Drive and works much the same way. And on the enterprise side, Google has rolled out Drive File Streamer, which saves space on your local drive while providing access to "all of your Google Drive files on demand, directly from your computer."

The latest version of Google Chrome has launched, bringing a host of new developer features like JavaScript modules and WebUSB support. An anonymous Slashdot reader shares a report from VentureBeat: Google has launched Chrome 61 for Windows, Mac, and Linux. Additions in this release include JavaScript modules and WebUSB support, among other developer features. You can update to the latest version now using the browser's built-in silent updater or download it directly from google.com/chrome. Google also released Chrome 61 for Android today. In addition to performance and stability fixes, you can expect two new features: Translate pages with a more compact toolbar and pick images with an improved image picker.

Chrome now supports JavaScript modules natively via the new element, letting developers declare a script's dependencies. Modules are already popular in third-party build tools, which use them to bundle only the required scripts. Native support means the browser can fetch granular dependencies in parallel, taking advantage of caching, avoiding duplications across the page, and ensuring the script executes in the correct order, all without a build step. Google recommends these two blog posts for more information: ECMAScript modules in browsers and ES6 Modules in Depth. Speaking of JavaScript, Chrome 61 also upgrades the browser's V8 JavaScript engine to version 6.1. Developers can expect performance improvements and a binary size reduction. The WebUSB API meanwhile allows web apps to access user-permitted USB devices. This enables all the functionality provided by hardware peripherals such as keyboards, mice, printers, and gamepads, while still preserving the security guarantees of the web.

An anonymous reader quotes a report from Mac Rumors: Investigators for Major League Baseball believe the Boston Red Sox, currently in first place in the American League East, have used the Apple Watch to illicitly steal hand signals from opposing teams, reports The New York Times. The Red Sox are believed to have stolen hand signals from opponents' catchers in games using video recording equipment and communicated the information with the Apple Watch. An inquiry into the Red Sox' practice started two weeks ago following a complaint from Yankees general manager Brian Cashman, who caught a member of the Red Sox training staff looking at his Apple Watch in the dugout and then relaying information to players. It's believed the information was used to determine the type of pitch that was going to be thrown. Baseball investigators corroborated the claim using video for instant replay and broadcasts before confronting the Red Sox. The team admitted that trainers received signals from video replay personnel and then shared them with some players.

"The Red Sox told league investigators said that team personnel scanning instant- replay video were electronically sending the pitch signs to the trainers, who were then passing the information to the players," reports The New York Times. [...] "The video provided to the commissioner's office by the Yankees was captured during the first two games of the series and included at least three clips. In the clips, the team's assistant athletic trainer, Jon Jochim, is seen looking at his Apple Watch and then passing information to outfielder Brock Holt and second baseman Dustin Pedroia, who was injured at the time but in uniform. In one instance, Pedroia is then seen passing the information to Young."

On Saturday, Chinese mobile maker Huawei unveiled its first artificial intelligence smartphone chipset, which it hopes will lure customers away from Apple's upcoming range of new iPhones and towards the Asian company's "most powerful handset yet," the Mate 10, which is set to debut next month. Mac Rumors reports: Huawei touted the Kirin 970 AI mobile chipset's built-in "neural processing unit" at the IFA consumer electronics trade show in Berlin, claiming that the technology is "20 times faster" than a traditional processor. The world's third largest smartphone maker claimed that mobile devices powered by the Kirin 970 will be able to "truly know and understand their users," by supporting real-time image recognition, voice interaction, and intelligent photography with ease. According to Nikkei, the Kirin 970 integrates 5.5 billion transistors in a single square centimeter about the size of a thumbnail, which includes an octa-core central processing unit, a 12-core graphics processing unit, a dual-image signal processor, a high-speed 1.2Gbps Cat.18 modem, and AI mobile computing architecture. The Kirin 970 is said to be based on the same 10-nanometer technology as Apple's existing A10X Fusion processor and the A11 processor that will power its new iPhone range, set to debut this month. The Mate 10 is said to be a bezel-less all-screen handset with a 6-inch, 2:1 display and a 2,160 x 1,080 resolution. Like Apple's so-called "iPhone 8," the Mate 10 is also expected to feature some form of facial recognition and improved cameras.

About four million Time Warner Cable records containing details of its customers were found unsecured on an Amazon server last month, tech website Gizmodo reported on Friday. From a report: The files, more than 600GB in size, were discovered on August 24 by the Kromtech Security Center while its researchers were investigating an unrelated data breach at World Wrestling Entertainment. Two Amazon S3 buckets were eventually found and linked to BroadSoft, a global communications company that partners with service providers, including AT&T and TWC. The 4 million TWC records are not all tied to unique customers, meaning 4 million individual people were not exposed by the breach. Due to the sheer size of the cache, it was not immediately clear precisely how subscribers were affected. The leaked data included usernames, emails addresses, MAC addresses, device serial numbers, and financial transaction information -- though it does not appear that any Social Security numbers or credit card information was exposed.

According to recent warnings issued by Avira, CSIS Security Group, and Kaspersky Lab, a virulent spam campaign has hit Facebook Messenger during the past few days. "The Facebook spam messages contain a link to what appears to be a video," reports Bleeping Computer. "The messages arrive from one of the user's friends, suggesting that person's account was also compromised." From the report: The format of the spam message is the user's first name, the word video, and a bit.ly or t.cn short-link. Users that click on the links are redirected to different pages based on their geographical location and the type of browser and operating system they use. It's been reported that Firefox users on Windows and Mac are being redirected to a page offering a fake Flash Player installer. Kaspersky says this file installs adware on users' PCs. On Chrome, the spam campaign redirects users to a fake YouTube page pushing a malicious extension. It is believed that crooks use this Chrome extension to push adware and collect credentials for new Facebook accounts, which they later use to push the spam messages to new users.

Billly Gates writes: Microsoft recently released Visual Studio 15.3 for Windows and Visual Studio 7.1 for Mac with .NET core 2.0. In addition to porting Microsoft Code and SQL Server to Linux, they have ported .NET. Redhat will bundle .NET in their software offerings instead of relying on Mono. .NET core is Microsoft's open-source .NET platform which is not based off Mono and available for Linux, Mac, and Windows here.

On Tuesday, ZDNet reported that popular weather app AccuWeather was sending location-identifying information to a monetization firm, even when a person had disabled location data from the app. In a response, AccuWeather said today "if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user." But it is misleading people. John Gruber of DaringFireball writes: The accusation has nothing to do with "GPS coordinates." The accusation is that their iOS app is collecting Wi-Fi router names and MAC addresses and sending them to servers that belong to Reveal Mobile, which in turn can easily be used to locate the user. Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash. The accusation comes from Will Strafech, a respected security researcher who discovered the "actual information" by observing network traffic. He saw the AccuWeather iOS app sending his router's name and MAC address to Reveal Mobile. This isn't speculation. They were caught red-handed. GPS information is more precise, and if you grant the AccuWeather app permission to access your location (under the guise of showing you local weather wherever you are, as well as localized weather alerts), that more precise data is passed along to Reveal Mobile as well. But Wi-Fi router information can be used to locate you within a few meters using publicly available databases. Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website, and there's good chance it'll pinpoint your location on the map. "Other data, such as Wi-Fi network information that is not user information, was for a short period available on the Reveal SDK, but was unused by AccuWeather," the company writes. In what way is the name and MAC address of your router not "user information"? And saying the information was "unused by AccuWeather" is again sleight of hand. The accusation is not that AccuWeather itself was using the location of the Wi-Fi router, but that Reveal Mobile was. Here are Reveal Mobile's own words about how they use location data.

"Back in June, Sony told Eurogamer that the company did not have 'a profound philosophical stance' against letting PS4 users play games with those on other platforms," reports Ars Technica. "That said, the company's continued refusal to allow for cross-console play between PS4 and Xbox One players has become an absolute and unmistakable trend in recent months." The latest game to be denied by Sony for cross-console play is Ark: Survival Evolved, which comes out of a two-year early access period next week on Windows, Mac, PS4, and Xbox One. From the report: In a Twitter response posted over the weekend, Ark lead designer and programmer Jeremy Stieglitz said that cross-platform play between PS4 and Xbox One is "working internally, but currently Sony won't allow it." This isn't a huge surprise, considering that the developers of Rocket League, Minecraft, and Gwent have made similar statements in recent months. Since Microsoft very publicly opened Xbox Live to easy cross-platform play back in March, Sony has said that it's "happy to have a conversation" about the issue, but it has failed to follow through by allowing any linkage between the two competing consoles (cross-platform play between the PS4 and PC has been available in certain games since the PS4's launch, though).

The question continues to be why, exactly, Sony seems so reluctant to allow any games to work between its own PlayStation Network and Microsoft's Xbox Live. Speaking with Eurogamer in June, Sony's Jim Ryan suggested that, in the case of Minecraft, Sony was wary to expose that game's young players to "external influences we have no ability to manage or look after." Ryan also told Eurogamer that cross-platform decisions were "a commercial discussion between ourselves and other stakeholders." That suggests there may be some financial issues between the parties involved that are preventing cross-console play from moving forward. Perhaps Sony wants someone else to pay for the work required to get its network talking to Microsoft's? The bottom line, though, might be that Sony just doesn't want to partially give away its sizable advantage in console sales by letting Microsoft hook into that vast network of players.

Zack Whittaker, reporting for ZDNet: Popular weather app AccuWeather has been caught sending geolocation data to a third-party data monetization firm, even when the user has switched off location sharing. AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name. But what the app doesn't say is that it sends sensitive data to a firm designed to monetize user locations without users' explicit permission. Security researcher Will Strafach intercepted the traffic from an iPhone running the latest version of AccuWeather and its servers and found that even when the app didn't have permission to access the device's precise location, the app would send the Wi-Fi router name and its unique MAC address to the servers of data monetization firm Reveal Mobile every few hours. That data can be correlated with public data to reveal an approximate location of a user's device. We independently verified the findings, and were able to geolocate an AccuWeather-running iPhone in our New York office within just a few meters, using nothing more than the Wi-Fi router's MAC address and public data.

A new feature baked into iOS 11 lets you quickly disable Touch ID, which could come in handy if you're ever in a situation where someone (a cop) might force you to unlock your device. Cult of Mac reports: To temporarily disable Touch ID, you simply press the power button quickly five times. This presents you with the "Emergency SOS" option, which you can swipe to call the emergency services. It also prevents your iPhone from being unlocked without the passcode. Until now, there were other ways to temporarily disable Touch ID, but they weren't quick and simply. You either had to restart your iPhone, let it sit idle for a few days until Touch ID was temporarily disabled by itself, or scan the wrong finger several times. The police, or any government agency, cannot force you to hand over your iPhone's passcode. However, they can force you to unlock your device with your fingerprint. That doesn't work if your fingerprint scanner has been disabled.

Electron, a popular framework that allows developers to write code once and seamlessly deploy it across multiple platforms, has been a topic of conversation lately among developers and users alike. Many have criticised Electron-powered apps to be "too memory intensive." A developer, who admittedly uses a high-end computer, shares his perspective: I can speak for myself when I say Electron runs like a dream. On a typical day, I'll have about three Atom windows open, a multi-team Slack up and running, as well as actively using and debugging my own Electron-based app Standard Notes. [...] So, how does it feel to run this bloat train of death every day? Well, it feels like nothing. I don't notice it. My laptop doesn't get hot. I don't hear the fan. I experience no lags in any application. [...] But aside from how it makes end-users feel, there is an arguably more important perspective to be had: how it makes software companies feel. For context, the project I work in is an open-source cross-platform notes app that's available on most platforms, including web, Mac, Windows, Linux, iOS, and Android. All the desktop applications are based off the main web codebase, and are bundled using Electron, while the iOS and Android app use their own native codebases respectively, one in Swift and the other in Kotlin. And as a new company without a lot of resources, this setup has just barely allowed us to enter the marketplace. Three codebases is two too many codebases to maintain. Every time we make a change, we have to make it in three different places, violating the most sacred tenet of computer science of keeping it DRY. As a one-person team deploying on all these platforms, even the most minor change will take at minimum three development days, one for each codebase. This includes debugging, fixing, testing, bundling, deploying, and distributing every single codebase. This is by no means an easy task.

Favicon -- or its lack thereof, to be precise -- has remained one of the longest running issues Safari users have complained about. For those of you who don't use Safari, just have a look at this mess I had earlier today when I was using Safari on a MacBook. There's no way I can just have a look at the tabs and make any sense of them. John Gruber, writing for DaringFireball: The gist of it is two-fold: (1) there are some people who strongly prefer to see favicons in tabs even when they don't have a ton of tabs open, simply because they prefer identifying tabs graphically rather than by the text of the page title; and (2) for people who do have a ton of tabs open, favicons are the only way to identify tabs. With many tabs open, there's really nothing subjective about it: Chrome's tabs are more usable because they show favicons. [...] Once Safari gets to a dozen or so tabs in a window, the left-most tabs are literally unidentifiable because they don't even show a single character of the tab title. They're just blank. I, as a decade-plus-long dedicated Safari user, am jealous of the usability and visual clarity of Chrome with a dozen or more tabs open. And I can see why dedicated Chrome users would consider Safari's tab design a non-starter to switching. I don't know what the argument is against showing favicons in Safari's tabs, but I can only presume that it's because some contingent within Apple thinks it would spoil the monochromatic aesthetic of Safari's toolbar area. [...] And it's highly debatable whether Safari's existing no-favicon tabs actually do look better. The feedback I've heard from Chrome users who won't even try Safari because it doesn't show favicons isn't just from developers -- it's from designers too. To me, the argument that Safari's tab bar should remain text-only is like arguing that MacOS should change its Command-Tab switcher and Dock from showing icons to showing only the names of applications. The Mac has been famous ever since 1984 for placing more visual significance on icons than on names. The Mac attracts visual thinkers and its design encourages visual thinking. So I think Safari's text-only tab bar isn't just wrong in general, it's particularly wrong on the Mac.