contact us

Use the form on the right to contact us.

 


Naperville, IL 60565
USA

630-639-7372

iPhone-XS-photo.jpg

Blog

Apple Starts Releasing Rapid Security Responses for the iPhone, iPad, and Mac

Rowena

Apple Starts Releasing Rapid Security Responses for the iPhone, iPad, and Mac

By now, you’ve probably seen a new form of update for iOS, iPadOS, and macOS: the Rapid Security Response. Early in May, Apple released the first instances of these updates, which the company had promised for iOS 16, iPadOS 16, and macOS 13 Ventura when those operating systems were first announced. Let’s answer some of the questions we’ve been hearing.

What are Rapid Security Responses?

Rapid Security Responses are security updates that Apple wants to distribute as quickly and broadly as possible. Users often delay installing standard operating system updates because they’re huge downloads, interrupt work for a long time while installing, and occasionally cause new problems.

To address these concerns, Rapid Security Responses are much smaller, install far more quickly (sometimes without a restart), and can easily be removed if they cause problems.

What security vulnerabilities do Rapid Security Responses address?

Apple released no security notes for its first set of Rapid Security Responses, and we don’t anticipate that changing for future releases. The point of a Rapid Security Response is to block a serious vulnerability that’s likely being exploited in the wild, and Apple doesn’t describe such fixes until it has patched vulnerable operating systems, including older versions, tvOS, and watchOS, none of which can take advantage of Rapid Security Responses. If this last set of updates is any indication, Apple will identify the Rapid Security Response fixes in security notes for the next full operating system update, which will also include the same fixes.

How do I install a Rapid Security Response?

Rapid Security Responses use the same software update mechanism as Apple’s other operating system updates. You can and generally should let Rapid Security Responses install automatically. That’s the default, but check to make sure.

●     iOS/iPadOS: Go to Settings > General > Software Update > Automatic Updates, and look at “Security Responses & System Files.”

●     macOS: Go to System Settings > General > Software Update, and click the ⓘ next to Automatic Updates. Then look at “Install Security Responses and system files.”

On recent iPhones and Macs, the installation time was quick, with the device being ready to use again within 2–4 minutes, including a restart. Older devices took longer, and future Rapid Security Responses may take more or less time.

How can I revert if a Rapid Security Response causes a problem?

Apple makes this easy in both iOS/iPadOS and macOS, with the amount of time being roughly similar to how long the Rapid Security Response took to install:

  • OS/iPadOS:Go to Settings > General > About > iOS/iPadOS Version, tap Remove Security Response, and confirm the action.

  • macOS: Go to System Settings > General > About, click the ⓘ next to the macOS version, click Remove & Restart, and confirm the action.

How can I tell if I’m running a Rapid Security Response?

With this first Rapid Security Response, iOS and iPadOS both posted a notification informing the user of the update; macOS did not.

More generally, devices updated with a Rapid Security Response will have a letter after their version number, such as 16.4.1 (a), and the letter will disappear with the next full update, such as iOS 16.5. To determine what version your devices are running:

●     iOS/iPadOS: Go to Settings > General > About, and look at the iOS/iPadOS Version line.

●     macOS: Choose About This Mac from the Apple menu, and look at the macOS line.

Given what we know now, we recommend that everyone install Rapid Security Responses as soon as they’re available. If you notice a problem afterward, you can remove it. The only caveat is that if your employer manages your device, they may prefer to delay the Rapid Security Response installation until they’re comfortable with the changes.

(Featured image by iStock.com/champpixs)


Social Media: In an effort to protect users from security vulnerabilities that are being actively exploited, Apple has introduced Rapid Security Responses, which are security updates that are quick to download, quick to install, and easily removed if necessary.


Apple Is Shutting Down My Photo Stream—Switch to iCloud Photos

Rowena

Apple Is Shutting Down My Photo Stream—Switch to iCloud Photos

Apple has quietly announced that it is shutting down the My Photo Stream service, the company’s first iCloud-based effort at helping users sync photos between devices. My Photo Stream had numerous limitations but was free and didn’t count against iCloud storage quotas. If you’re still using My Photo Stream, note that photos will stop uploading as of June 26, and all My Photo Stream photos will be removed from iCloud on July 26; they’ll remain on your individual devices. Apple is encouraging all remaining My Photo Stream users to switch to iCloud Photos, which is more capable in every way but might require you to pay for additional iCloud+ storage to hold your photo library. Those who don’t want their photos in the cloud might check out Mylio Photos+. Contact us if you need assistance migrating to iCloud Photos or ensuring all your various photos are backed up securely.

(Featured image by iStock.com/mpiokpee)


Social Media: Still using My Photo Stream to sync photos between your Apple devices? Apple is shutting down the service in late June, and the path of least resistance is to switch to iCloud Photos, though that might require an iCloud+ subscription.


“Juice Jacking” Returns to the News but Still Hasn’t Happened

Rowena

“Juice Jacking” Returns to the News but Still Hasn’t Happened

Much has been made in the media about a recent FBI warning about “juice jacking,” the theoretical act of installing malware on or stealing data from an iPhone connected to a public charging station. Researchers first demonstrated juice jacking in 2011 at the Defcon security conference.

There’s no harm in following the FBI’s advice, but why raise the topic now? When questioned by the fact-checking site Snopes, the Denver office of the FBI said it was a standard public-service announcement tweet.

More importantly, there’s no indication that there’s any reason to worry. The security site Krebs On Security quoted one of the original juice jacking researchers as saying that he isn’t aware of any public accounts of a juice jacking kiosk existing in a public place outside of a security conference.

Making the risk of juice jacking even less concerning are security changes that Apple has made to iOS and iPadOS. Now, when you connect a device to a USB charger or device that does anything beyond providing power, you’ll see a prompt asking if you trust it. Given that there are no documented instances of juice jacking outside of a demonstration, it’s highly improbable that you’d get such a prompt when connecting to a public charging station, but if that were to happen, tap Don’t Trust and unplug your device immediately.

To block all possibility of juice jacking, you could:

l  Bring your own USB charger and plug it into a standard wall outlet.

l  Charge your iPhone from a battery pack and recharge the battery from a public charger.

l  Use a public wireless Qi charger. No cables, no worries.

l  Connect a USB data blocker to the end of your charging cable when using a public charger.

l  Rely on a special USB cable that can only charge, not carry data.

But honestly, just as with warnings about poisoned Halloween candy, these juice-jacking warnings don’t seem to be based on any documented instances. Our take? It’s sensible to bring a USB charger when traveling and carry a battery pack as a backup, but there’s no reason to worry about security when using a public charger. Amusingly, while we were editing this article, Ars Technica published a lengthy piece expanding on everything we’ve just said.

(Featured image by iStock.com/ClaireLucia)


Social Media: Juice jacking—malware installation or data theft after you plug a phone into a public charger—is in the news again. While the recommended precautions aren’t onerous, there are no documented instances of juice jacking happening in the wild.