Developer James Laird said that he had discovered that the Airport Express streaming solution hid a private key, and extracted it after his girlfriend had had trouble connecting the two.

Laird posted the RSA private key on the VLC development newsgroup, and then the “ShairPort” software on his own private blog. It currently stands at version 0.03, after Laird discovered problems with IPv6.

“My girlfriend moved house, and her Airport Express no longer made it with her wireless access point,” Laird wrote. “I figured it’d be easy to find an ApEx emulator – there are several open source apps out there to play to them. However, I was disappointed to find that Apple used a public-key crypto scheme, and there’s a private key hiding inside the ApEx. So I took it apart (I still have scars from opening the glued case!), dumped the ROM, and reverse engineered the keys out of it.”

The AirPort Express, now several years old, is an 802.11g access point. More importantly, however, it serves as a means for Express users to wirelessly stream music from their Mac and iTunes to other places in the home, including speakers. Cracking the wireless key means that other developers may be able to tie into ShairPoint into their own private services, allowing them to receive iTunes music from remote locations.

Apple users have wanted wished for their music to be stored in iTunes and then streamed for years. In January 2010, MP3.com’s Michael Robertson claimed such a feature was coming from Apple and its Lala.com service. Instead, Apple launched the iPad.

Apple does allow limited iTunes streaming; the recent release of iTunes 10.2.1 – seemingly identical to the 10.2 version of iTunes – includes an improved version of Home Sharing that lets users stream content from their iTunes library between computers to an iPad, iPad 2, iPhone 3GS, iPhone 4 (GSM), or iPod touch (third and fourth generation), as long as the device is running iOS 4.3.

While there’s no indication that a hardware manufacturer would build in ShairPort, other apps (an Android app that connected to iTunes?) might be able to build it in.

Other root keys have also been leaked. Sony has been the most recent victim, with the root key guarding the PlayStation 3 recently leaking. Sony, however, partially covered up the hole by settling with hacker George Hotz, which includes an injunction against posting details of the hack, or, presumably, the root key.

A more serious breach occurred last September, when the HDCP master key protecting Blu-ray discs was cracked and posted to the Web.

Source

Citing unnamed sources, Engadget reported late yesterday that the iPad 2 won’t launch with a high-resolution display or with an SD card slot. Apple initially planned on delivering those two features in the updated tablet, Engadget said, but apparently “engineering issues” caused the company to modify its plans at the last minute.

Earlier reports suggested that the iPad 2 could feature the Retina Display, Apple’s high-resolution screen found in the iPhone 4.

As with any Apple-related rumor, it’s important to take Engadget’s claims with a grain of salt. Apple is one of the more secretive companies in the tech industry, and rumors surrounding its products run rampant for months prior to a big announcement.

In fact, Engadget’s report follows several others claiming the tablet will come with a more-powerful processor and a thinner body. Yet other rumors claim the device will feature both front- and rear-facing cameras and won’t be available until June.

For its part, Apple isn’t talking. The company did not immediately respond to CNET’s request for comment. But we should find out everything we want to know about the iPad 2 at an Apple event on Wednesday.

Source

The Wall Street Journal has a full report on the whole scheme. Turns out one of the men indicted today, Walter Shimoon, worked for Flextronics, a supplier to Apple. In the papers unsealed today, the FBI caught Shimoon on tape allegedly relaying super-secret details about the yet-to-be-released iPhone last year as well as the internal code name for the project that turned into the iPad. Fortune found the details in the 39-page indictment, and called them out today.

Last month an FBI investigation resulted in the arrest of an executive of an “expert network” called Primary Global Research who was accused of selling or providing important, non-public information about high-profile tech companies to investors. More indictments were revealed today, resulting in more arrests. Those indicted were consultants of Primary Global Research that helped clients like hedge funds and mutual funds get information about their investment companies.

It’s not wholly unsurprising that the most-secretive company in the technology world was one of the alleged victims of this scheme. Analysts, investors–not to mention bloggers–are desperate to get any nugget of information about what Apple is up to, whether it’s timing of a new product or sometimes a single spec change on a gadget.

The indictment notes that the Flextronics employee was recorded by the FBI in October 2009 allegedly telling someone about third-quarter iPhone sales figures over the phone, and that Apple’s next iPhone would have two cameras, “a five-megapixel auto-focus camera and it will have a VGA forward-facing videoconferencing camera.” That was eight months before the iPhone 4, with cameras of those exact specifications, was introduced.

Shimoon also allegedly told his contact (who is not named) about a new product in the works for Apple. He is accused of saying, “It’s totally … It’s a new category altogether… It doesn’t have a camera, what I figured out. So I speculated that it’s probably a reader…Something like that. Um, let me tell you, it’s a very secretive program…It’s called K, K48. That’s the internal name. So, you can get, at Apple you can get fired for saying K48.” A little over three months later, Steve Jobs introduced the iPad.

The information peddling was not limited to Apple. Inside information was provided about AMD, Dell, and Flextronics, according to the court documents.

Arrested in the scheme and charged with wire fraud and conspiracy to commit wire fraud today were: James Fleishman, Primary Global vice president and sales manager; Shimoon, senior director of business development at Flextronics; Mark Anthony Longoria, AMD supply chain manager; and Manosha Karunatilaka, account manager at Taiwan Semiconductor Manufacturing.

Source

The site was quickly revised to show a notice saying only that the download was “Coming soon,” the same message that has been posted on Apple’s U.S. site since Jobs introduced the operating system upgrade and touted its new features last week.

Along with new functionality included with iOS 4.1 — ranging from “high dynamic range” (HDR) photography that produces more detail in over- and under-exposed areas, to the launch of Apple’s Game Center multi-player online network — Jobs also promised that the update would fix some of the bugs in iOS 4.0 that users have been complaining about since that version’s June 21 debut.

Source

The patent, titled “Systems and Methods for Identifying Unauthorized Users of an Electronic Device,” describes several ways a device could sense who is using an iPhone or iPad. Among the methods considered are voice print analysis, photo analysis, heartbeat analysis (!), hacking attempts, or even “noting particular activities that can indicate suspicious behavior.”

If the various analyses detect someone who is not authorized to use the device, it could set off a number of automated features designed to protect the device’s data, suss out the offending party, and alert the device owner. Sensitive data could be backed up to a remote server and the device could be wiped. The device could automatically snap pictures of the unauthorized user and record the GPS coordinates of the device, as well as log keystrokes, phone calls, or other activity. That information could be sent along with an alert to any useful service, such as e-mail, voicemail, Twitter, Facebook, or a “cloud service” like MobileMe.

As AppleInsider notes, Apple apparently experimented with enabling the iPad to recognize different authorized users and automatically change some settings for that particular user. Such a feature could be somewhat useful on iPads, which are sometimes shared among family members in homes and among several users in schools and businesses.

This proposed patent takes the capability one step further, by effectively locking out snoopers and thieves altogether, and alerting the device user of possible improprieties. The features would no doubt be welcome to enterprise users, who need safeguards around data that may be on a mobile device.

Source

But the big story isn’t a vulnerability in iOS, hardly the first or last. This is the first vulnerability on the iPhone to be exploited, although not maliciously, in the wild. [Correction: I have been reminded that the very first iPhone jailbreak was based on an unpatched vulnerability in the libpng library.] The way it works proves that drive-by malware can be done on the iPhone and there’s almost nothing to stop it.

No doubt there are many more vulnerabilities like the ones at issue here. Software that parses complex data formats like PDF files is prone to such vulnerabilities, and Apple has fixed scores of them in OS X in the last few years. At least on OS X you can get antivirus and IPS software to protect against known attacks, but things are different on the iPhone.

Remember, in case you thought otherwise, that PDF is an open standard and, in fact, an ISO standard. Anyone can implement it and Adobe is out making sure that everyone knows that they didn’t write the vulnerable code in iOS.

The problem is that it’s impossible to secure a device, any device, but including an iPhone, without some sort of manageable endpoint security software on the device. All the other mobile platforms have such products, but even though the iPhone as 1.3 zillion apps, it has no endpoint security software. I asked Mikko Hypponen of F-Secure about this. F-Secure has long been aggressive about moving into mobile device protection anticipating, as we all do, that it would some day turn into a real problem. Mikko said “Antivirus vendors can’t build a realtime antivirus system for iPhone without Apple’s help. So far, Apple has not been interested.”

This is completely in line with Apple’s general attitude that security is someone else’s problem. It’s why they take an appallingly long time to fix so many critical vulnerabilities (although researchers tell me they do listen and they do, eventually, fix the problems). But it also means that the “window of vulnerability” is long on the iPhone and on OS X, and that gives a big advantage to attackers.

I’m getting a feeling about this episode, that it could be the bootstrap for the real beginning of the Apple malware problem. Like mobile malware generally, it has been expected for ages because it just makes sense, but it hasn’t happened. Perhaps the answer is that the Apple malware writers will skip the Mac altogether and write their malware for the iPhone. It just makes sense.

Source

The iPhone 4, which boasts video chat, high-definition video and sharper screen resolution, hit Britain, France, Germany and Japan before going on sale in the United States on Thursday morning.

At Apple’s flagship New York store on Fifth Avenue, hundreds of people had gathered.

“I’m not preregistered, I’m just walking in,” said 19-year-old Kunal Patel, who staked out a spot by the store at 9:00 pm on Wednesday (0100 GMT Thursday).

“I’m just walking in. I hope to buy one and sell the old one,” he told AFP.

Jesus Hernandez said he had registered for a phone online to make sure he would get one on the first day in stores.

“I am so eager to see the higher resolution, HD video, all of that,” he said.

In Paris, Senegalese businessman Bassirou Gueye joined some 350 people queuing before the opening of Apple’s flagship store in the city, located in the chic underground shopping mall of the Louvre museum.

“I made a special trip to Paris to buy the iPhone 4. I’m interested in its high-tech features,” said Gueye, a self-avowed Apple aficionado who already owns half a dozen brandname devices.

In Germany, there were long queues at Apple stores in Berlin, Munich, Frankfurt, Cologne and Hamburg and phone company Deutsche Telekom complaining it did not have enough handsets to meet demand.

In Berlin, the main outlet opened its doors at midnight (2200 GMT) while in other cities eager buyers had to wait until 7:00 am (0500 GMT).

“There were hundreds of people waiting (in Berlin). It took us until 4:30 am (0230 GMT) to clear the queue,” Deutsche Telekom spokesman Dirk Wende said.

“By lunchtime iPhones in the high tens of thousands have already been sold. In Munich we have sold out.”

Some 500 customers waited in line outside Apple’s flagship Regent Street store in London when it opened its doors at 7:00 am (0600 GMT) — far more than those who queued for the launch of the iPad tablet last month.

First in the doors was Ben Paton, a 23-year-old student, who had queued for 16 hours. He described the feeling of holding the new phone in his hands “absolutely incredible, amazing.

“It’s a once in a lifetime opportunity. I’d love to do it again,” he said.

Japan’s eastern time zone put it first in line to sell the phone and hundreds braved sweltering humidity outside Apple’s store in the Ginza district to get their hands on the smartphone.

Ryoichi Hoshino was the first to emerge triumphantly clutching the new handset after Apple staff gave a loud countdown ahead of the release.

“I love this design, it’s going to beat my expectations 110 percent,” he enthused. “I’m going to use it to watch movies and use Twitter,” he said, referring to the micro-blogging site.

The original iPhone launched in 2007 brought smartphones to the masses. Apple has sold more than 50 million of the handsets in the past three years.

But its latest version enters a crowded market full of rivals boasting bigger screens and running on Google’s open-source Android operating system, which is more accessible to developers than Apple’s tightly guarded system.

The launch of the latest iPhone has been beset by various problems culminating in the white model being delayed to the second half of July because of unspecified manufacturing difficulties.

Carriers in the United States and France were also forced to suspend early orders because of heavy demand. Apple said it had received a single-day record 600,000 orders for the new smartphone.

The new iPhone will be available in 18 other countries in July and 24 more in August.

Source

Apple announced Tuesday that it would offer a “special one-day Apple shopping event” the day after Thanksgiving, but provided few other details.

The company unveiled its sale Web site Friday morning, and the most notable discount is $101 off the new 13-inch MacBook. The 2GHz MacBook usually runs $1,299 but is now available for $1,198. Prices on the 2.4GHz MacBook dropped from $1,599 to $1,498.

Apple also dropped $51 from the price of the white 13-inch MacBook, from $999 to $948, and the iMac 20-inch, with prices now ranging from $1,148 to $2,098.

On the Nano front, Apple is offering an $11 discount on the new, colorful 8GB and 16GB iPod Nanos, and $21 off the silver and black 120GB iPod Classics. The iPod Touch also gets a $21 discount on the 8GB, 16GB, and 32GB versions.

Looking to try out Apple TV? The device is also $21 off – with the 40GB version priced at $208 and the 16GB available for $308.

Cheap iPhone prices were nowhere to be found, though a few iPhone accessories are up for grabs. Save $5 on an iPhone 3G dock, $11 on an iPhone Bluetooth headset, $24 on iPhone cases, and $12 on docks and chargers.

Apple also has deals on games, speakers, carrying cases for Macs, iPod Touch and Nano cases, headphones, chargers, and software.

The discounts are available on the Apple Web site and in Apple retail stores until midnight on Friday.