Google says Apple employee found a zero-day, but did not report it

Google fixed a zero-day in Chrome that was found by an Apple employee, according to comments in the official bug report. While the bug itself is not newsworthy, the circumstances of how this bug was found and reported to Google are, to say the least, peculiar.

According to a Google employee, the bug was originally found by an Apple employee who was participating in a Capture The Flag (CTF) hacking competition in March. But that Apple employee did not immediately report the bug, which at the time was a zero-day — meaning Google wasn’t aware of the bug and no patch had been issued yet. The bug was instead reported by someone else who also participated in the competition, didn’t actually find the bug themselves and wasn’t even on the team that found the bug.

“This issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022,” the Google employee wrote.

After this story first published, TechCrunch viewed a Discord channel where someone claiming to be the Apple employee who originally found the zero-day explained their side of the story, particularly the reason why they didn’t report the bug immediately, in response to Sisu, the person who reported the bug to Google.

“It took me 2 weeks working on it full time to root cause, write [the] exploit [Proof of Concept] and writeup the issue such that it can be fixed,” the person, who goes by Gallileo, wrote on July 6.

“It was reported on June 5th, through my company. Yes it was late, there are multiple reasons for that. I first had to find the person responsible, the report had to be signed off by people and then the person responsible was OOO. It’s commendable that chrome decided to fix it asap, but I think there wasn’t any real urgency. Only you and my team was aware of it and the issue is likely not that great in a real world scenario (doesn’t work on Android, pretty visible since it freezes the Chrome GUI for a few seconds),” Gallileo wrote.

Gallileo and Sisu did not respond to a request for comment.

Apple did not respond to a request for comment.

Google spokesperson Ed Fernandez told TechCrunch in an email that “our understanding is public in the bug.”

“We recommend reaching out to Apple for any further details,” Fernandez wrote.

It’s not uncommon for CTF teams and CTF players to find zero-days during competitions, especially in challenges of this type and competitions that are “high profile,” according to Filippo Cremonese, a researcher who participates in CTF competitions with the Italian team mhackeroni, which incidentally may be the best hacker team name ever.

What makes the story of this bug interesting is that it was apparently found by an Apple employee in a Google product, and — for some reason — that Apple employee decided not to report the bug at the time.

In the original report on March 26, the person who reported it said that the bug was found by someone on the team COPY during a CTF organized by the team HXP. The person, whose name is not disclosed in the report, said they decided to report it even if they didn’t find it themselves because they were “not 100% sure it was reported to the chromium team.”

“So I wanted to be safe,” the person wrote.

“Since you are the one disclosing this issue and there are no duplicates, it seems that the team that discovered this issue has chosen not to disclose it to us?” the Google employee wrote in another comment to the bug report.

The bug was fixed on March 29, according to the bug report. Google decided to award $10,000 as a bug bounty to the person who reported it, who, again, was not the one who found it.

UPDATE, July 20, 2:30 p.m. ET: This story was updated to include Discord messages posted by the person who claims to have found the bug originally.

UPDATE, July 24, 12:09 p.m. ET: Added clarification on twelfth paragraph.

UPDATE, July 24, 12:017 p.m. ET: On Friday, Sisu, who identified as Martin Radev, and is the person who first reported the bug to Google, published a timeline explaining his side of the story. Radev said that the Apple employee reported the bug in June. They also said they are in touch with the Apple employee to figure out what to do with the $10,000 bounty they received from Google. Radev wrote that “a donation is to be made.”

Microsoft: No Windows 11 Updates If CPU Does Not Meet Requirements

Over the last couple of weeks, Microsoft has made clear its hardware requirements to run Windows 11, while also reaffirming customers whose PCs don’t meet the standard that it won’t leave them in the lurch just like that, saying they will still be able to install the OS via an ISO.

Now it appears that the company is having a Mr. Hyde moment and telling all who do the latter that there is a catch: while users can install the Windows 11 via ISO, it will withhold the Windows Update feature if it detects that PC’s components are not up to its specifications.

While it is clear that the existence and function of Windows Update will certainly divide the room, one cannot argue that withholding the program means that said PCs will lack the ability to automatically download and install important security updates from the parent company over time. Even if some of us are perfectly content with having the feature disabled and turned off.

At this point, there is really no reason for Microsoft to act this way, especially if Microsoft intends for wider adoption of Windows than what it already has. However, as The Verge puts it, this could just be a “cover-your-ass” measure, aimed at discouraging the masses from thinking that it would offer a warranty or technical support for PCs that fail to meet the requirements.

Mind you, this isn’t Microsoft outrightly saying that its withholding updates for Windows 11 altogether; in theory, users adamant about sticking with systems running on CPUs older than Intel’s 8th generation Coffee Lake or AMD’s 1st generation Zen architecture can still get the update, albeit by manually downloading and installing said updates, on a per release basis.

Ultimately, Microsoft’s “selfish” act of withholding the updates can be viewed from a couple of viewpoints. The first is that the company would rather threaten its customers indirectly, rather than backtrack and make changes to the system requirements for Windows 11. The second? The move is Microsoft’s not-so-subtle way of pressuring PC owners into updating their systems with the latest hardware currently on the market.

Tech Experts Sign Open Letter Asking Apple To Not Implement Child Safety Plan

A few days ago, Apple announced that its new feature called neuralMatch would be used to scan devices and the iCloud for child abuse imagery. This was quite the surprise for the company that went against the FBI’s request to unlock a terror suspect’s iPhone. The blowback for this new move in the name of child safety was expected, to say the least. And now, that blowback has manifested in the form of an open letter to the Cupertino company.

The Apple Privacy Letter is a very straightforward one. It, and its signatories, as that the iPhone maker will not go ahead with its child safety plan. The open letter has over 4000 signatories at the time of writing.

The letter also explains why Apple’s plans on the matter is problematic. For one, because the neuralMatch tech is done on device, it circumvents end-to-end encryption. This introduces a backdoor to the system, even if Apple has claimed that this will not be the case.

Another key argument is that the tech, while well-meaning, is prone to being mutated to serve more nefarious means of surveillance. For example, the open letter quotes Dr Nadim Kobeissi, a Security & Privacy researcher, as saying that the tech may be modified to scan for homosexuality or offences against the monarchy, leading to abuse and persecution.

Ultimately, the Apple Privacy Letter asks for two things. One is that Apple doesn’t deploy the content monitoring tech. The other is so that the iPhone maker reaffirms its commitment to user privacy. After all, it has been a key point that the company won’t stop shouting about in nearly all of its announcements.

Takuya Kimura’s Talent Agency May Be The Reason Why Judgment Is Not On PC

Almost the entirety of the Yakuza series has made its way to PC. So it’s strange that the spin-off series Judgment is still locked behind the confines of consoles. But now we may know the reason why, and it’s likely because of Takuya Kimura’s talent agency.

Japanese showbiz news site Nikkan Taishu reports that the talent agency, Johnny & Associates, and Sega could not come to an agreement over which platform the actor’s likeness can appear on. For context, Takuya Kimura is a very highly rated actor, to say the least, and plays the Judgment series lead Takayuki Yagami.

The report says that the agency is very strict when it comes to which platform its actors’ likeness can appear on. The agency also is particularly prickly when it comes to images of its actors being online. And for whatever reason, the agency has decided that this would be a problem if the Judgment series was available on PC, but not consoles from which screenshots are shared around just the same. Maybe inappropriate mods is a concern, but it’s the sort of lack of awareness that the agency seems to be projecting to the audience.

All this is bad news for both Sega and fans of the spin-off series. This is simply because Sega has decided that it’s not good for business if it can’t publish the game series on PC. Makes sense, because it is effectively cut off from a major revenue stream. But as such, Lost Judgment will likely be the last entry in the series.

The actor himself, Takuya Kimura, also expresses regret, as the report claims. It’s said that he enjoyed playing Takayuki Yagami a lot, and wants to do more of that, but expressed disappointment when he learned that it would be unlikely.

All in all, it sounds like the people calling the shots at Johnny & Associates have been left behind by the blazing progress of technology. And as a result of them not being able to keep up, gamers are going to be deprived of more entries into a great spin-off series. Sega is also being cut off of a reliable source of income, and a star actor is unable to play a role he enjoys.

US does not support Taiwan independence

U.S President Joe Biden's point man on Asia is "astonished" by China's determination to play the leading role on the global stage and will "step up" its engagement in Southeast Asia to hold back such a trend. But the administration does not support Taiwan independence and understands the sensitivities involved, Indo-Pacific Coordinator Kurt Campbell said Tuesday.

Campbell's remarks at the Asia Society, are his first public comments since President Xi Jinping's July 1 speech celebrating the 100th anniversary of the founding of the Communist Party, in which the Chinese leader called the reunification of Taiwan "a historic mission and an unshakable commitment" of the party.

"We support a strong unofficial relationship with Taiwan. We do not support Taiwan independence," Campbell said in response to a question from the moderator asking "how much love is too much?" when it comes to stronger relations with the island.

"We fully recognize and understand the sensitivities involved here," he said. "We do believe that Taiwan has a right to live in peace. We want to see its international role, particularly in areas like vaccines and issues associated with the pandemic, they should have a role to play here, they should not be shunned in the international community."

The Biden administration, meanwhile, will "step up our game substantially" with regards to Southeast Asia diplomacy, understanding that engagement with that region is key to successful Indo-Pacific policy, Campbell said.

See also

"We recognize fully that really for an effective Asia strategy, for an effective Indo-Pacific approach, you must do more in Southeast Asia," Campbell said.

The administration's Southeast Asia game plan has been hampered by the cancellation of the Shangri-La Dialogue, which draws top level military officials, diplomats and weapons makers from around the world, and that other regional summits later in the year look to be held virtually, Campbell noted. But, he said that through vaccine gifting and new funding for infrastructure, the U.S. seeks to engage in a sustained way.

"We've taken it on board with our own vaccine programs, but also working with the Quad. We are deeply engaged to ensure that we will provide vaccines in 2022 to Southeast Asia and the Pacific. We think this is the most important contribution that we can make in the next little while," he said.

National Security Council Indo-Pacific Coordinator Kurt Campbell speaks to the Asia Society on July 6.
On infrastructure, Campbell said, "We're looking carefully at how we apply elements of the Build Back Better World set of commitments made in Europe last month," pointing to the infrastructure initiative U.S. President Joe Biden and fellow leaders of the Group of Seven rich nations launched at the Cornwall, U.K., summit.

He said that will include leveraging new finance arrangements for infrastructure at the U.S. International Development Finance Corporation.

"You will see later this year when the president hosts the Quad leaders in Washington, you'll see some commitments that will be, I hope, exciting, I think, decisive with respect to not only continuation of vaccine diplomacy, but infrastructure as well," he said pointing to the Quadrilateral Security Dialogue between the U.S., Japan, India and Australia.

On the threat China poses, Campbell said, "Coming back in, I was astonished by some of the things I read, saw and experienced and have had diplomatic engagements about. And one of them is just undeniable: A very assertive determined China that wants to play the leading role on the global stage, and has really quite unsentimental views of United States and really wants to reshape the operating system of Asia."

To counter this challenge, the Biden administration has made Asia the center of its regional focus, Campbell said. "You'll see this movement from the Middle East, and it will be painful, in all likelihood. We'll see some real challenges in places like Afghanistan, but a much greater focus on the Indo-Pacific."

Campbell said the challenge for the U.S. would be to come up with a strategy that presents China with opportunities, but also a response if it takes steps "antithetical to the maintenance of peace and stability."

Asked when he expected a first meeting between Biden and Chinese leader Xi Jinping and whether this could come at the G-20 summit in October, Campbell replied: "My expectation will be that we'll have some sort of engagement before too long."

Campbell's statement on Taiwan independence is in line with what he has said in past speeches and does not indicate a change of policy. But they will be interpreted in Beijing as a commitment to the status quo, coming after Xi's July 1 speech.

Under the "One China" policy, which the U.S. has maintained since 1979, Washington "acknowledges the Chinese position" that there is but one China and that Taiwan is part of China. The U.S. recognizes the government of the People's Republic of China as the "sole legal government of China" but does not explicitly recognize Chinese sovereignty over Taiwan.

This is distinct from Beijing's "One China" principle, which considers Taiwan a Chinese province and part of its sovereign claim.

 

Intel-Powered Macs Reportedly Will Not Be Getting Live Text And Other Monterey Features

If you watched Apple’s WWDC 2021 keynote, you’ll know that the fruit company’s newly announced macOS Monterey comes with a ton of new and exciting features. Sadly, it seems that not all of the OS’ new features will be available for its Intel-based Mac machines, as some features will be exclusive to Macs running on the new M1 Apple Silicon chip.

If you’re running an Intel-powered Mac and don’t plan on upgrading anytime soon, here are some of the features that you’ll be missing out on:

• FaceTime Portrait Mode
• Live Text, which lets you interact with text in photos (e.g. being able to copy and paste an address on a sign)
• Interactive globe in Maps
• Detailed new city experience in Maps
• Neural text-to-speech voice in more languages for Siri, including in Swedish, Danish, Norwegian, and Finnish
• On-device keyboard dictation without a time limit (dictation was previously limited to 60 seconds)

As a quick recap, M1-powered Macs officially hit the market back in November last year. However, when the company from Cupertino announced its transition to its own silicon chips last June, they said that it would “continue to support and release new versions of macOS for Intel-based Macs for years to come.”

Obviously, this bit of news runs contrary to the company’s initial promise, so little wonder that some Mac users have taken to social media, accusing Apple of planned obsolescence.

Certain Apple iPad Models Rumoured To Be Fitted With OLED, Not LED Displays

The iPad already received a significant glow up (literally) this year with its 12.9-inch model debuting Apple’s mini-LED display. Now there are rumours that Apple is planning to adopt OLED displays for some of next year’s iPad models.

According to a report by ETNews, Apple and multiple display companies have agreed on the production and delivery of OLED iPad displays starting in 2022 as “the small and medium-sized OLED market is expected to enter the second growth phase”. This is in line with the contents of the research note from reliable Apple analyst Ming-Chi Kuo in March that said that the 2022 iPad Air will feature an OLED display.

Kuo pointed out that although Apple would adopt Mini-LED displays for the new iPad Pro, other tablet models would switch to OLED displays, beginning with the iPad Air next year. Mini-LED and OLED panels are similarly revered for their ability to display deeper blacks, though the former does not suffer from the issue of burn-in, such as the latter. Kuo stated that it is for that specific reason that Apple has no plans to bring OLED to its productivity devices.

Since the OLED displays for the upcoming iPad will be flat — unlike the custom iPhone panels folded at the bottom — it will cost less than the expensive mini-LED panels. It should be noted that while the new iPad’s mini-LED display tops out at 1,600 nits peak brightness, the iPhone 12 Pro’s OLED only reaches 1,200 nits.

WhatsApp Details Restrictions For Not Accepting Privacy Policy

Following backlash to the initial privacy policy change, WhatsApp said in February that users can voluntarily accept it before 15 May. Though if you don’t, you’ll slowly get its usability limited. It looks like the company has detailed what will happen if you don’t agree to it sharing data with Facebook.

BleepingComputer found a new WhatsApp FAQ page that details exactly what sort of functionality you will lose. Though not all of it is new. To start, post 15 May, those who have not accepted the new terms will start getting persistent reminders to do so.

Following that, continued refusal will see you losing access to your WhatsApp chat. You can still accept calls but calling back missed calls can only be done via notifications. The same goes for replying to texts; you can get them, but replying is only possible via notifications. A version of this was detailed back in February, with some variations.

But what happens after that? The new FAQ page says after a few weeks of this limited functionality, WhatsApp will stop sending you anything altogether. No calls, texts, or even notifications.

Your account will, in effect, become practically deactivated. That being said, the page was not clear if this constitutes as actually being inactive, and thus being subject to the 120-day deletion rule, since your device can still connect to the internet with WhatsApp running.

It’s probably worth reminding that, following the initial uproar, the company did remind users that the data sharing with Facebook only applies when messaging applicable businesses. But whether or not this changes anything, it’s still up to each individual user to decide.

Sega: Lost Judgment Not Coming To PC At This Time

Lost Judgment was announced just recently, and PC was not listed among its launch platforms. Not entirely surprising, since the first game didn’t make its way to PC either. But publisher Sega has confirmed that it won’t be available on PC, at least not for awhile.

Yakuza fan site Tojo Dojo spotted code in the Sega Japan website that suggested that the game was planned to some extent to be on Steam. At the very least, the mention of the Steam logo was found in the page’s code.

But whatever the initial plan was, it looks like it has been changed. In a statement to PC Gamer, a Sega representative said that the company “has no plans to bring Lost Judgment to PC at this time”. And that “at this time’ bit is a bit cruel to fans of the spin-off series.

While it took awhile, but the mainline Yakuza series finally has a strong PC presence. Even the latest entry, Like a Dragon, launched simultaneously on PC and consoles. So it’s a little strange that Judgment series isn’t getting the same treatment. But for whatever it’s worth, Sega did say “at this time”, so things may change in the coming years.

Shopping Malls and Retail Industry Not Happy With The HIDE List and Closure Directive

Three trade associations that are said to represent shopping malls and retail industries in Malaysia have publicly urged the government to stop releasing the daily list of high-risk locations as detected by the Hotspot Identification by Dynamic Engagement (HIDE) COVID-19 early warning system.

Through a joint statement, the Malaysia Shopping Malls Association (PPKM), Malaysia Retailers Association (MRA), and Malaysia Retail Chain Associations (MRCA) said the first HIDE list which was published yesterday published incomplete information and didn’t provide an accurate picture of the real-life situation.

The statement pointed out that HIDE does not include premises and operations that did not adhere to proper SOPs including the implementation of MySejahtera check-in. Hence, they would not appear as a hotspot in the system even though they could be one in real life.

The trade associations also insist that shopping malls have adhered to all SOP requirements and have also performed enhanced cleaning as well as sanitisation in a frequent manner to make sure that they are safe to visit. They also cited the recent analysis by Code Blue which said that only 4.78% of COVID-19 cases from late February to early April came from shopping areas as opposed to factories that covered 48.06% of the cases.

Through the same statement, PPKM, MRA, and MRCA have also opposed the closure order announced by Senior Minister for Defence, Ismail Sabri Yaakob. They collectively said that the directive is premature and will cause “irreversible damage” to businesses.

Despite the protest though, premises that have been listed by HIDE including the well-established large shopping malls such as Pavilion Kuala Lumpur, Suria KLCC, Mid Valley Megamall, and Sunway Pyramid did adhere to the directive from the government even though it was imposed on such a short time frame.

(Source: PPKM [pdf]. // Do note that the main image was not captured today, but instead, it was taken on 10 May 2020.)

Microsoft Will Not Adjust Xbox Store Revenue Split

Microsoft has announced that it will be taking only a 12% cut from games sales via the Microsoft Store starting 1 August. But it looks like this is exclusive to games on the PC store. So come August, Xbox game prices will not see any change to the amount game devs get per sale.

The Verge reports that a partially redacted Microsoft document from January indicated the 12% cut change. The document states that the change would come to the Microsoft Stores of both PC and Xbox. You can see this on page nine of the document.

Microsoft has since denied that it will be changing the revenue share rate on Xbox. That being said, the company did not specify if the document was inaccurate, or plans have changed since then.

The document in question also mentions the importance of the revenue split changes for games on the PC Microsoft Store. In exchange for the Epic Games Store-like 88/12 split, game devs would also need to grant the company streaming rights.

Which makes sense, considering the way xCloud is such an important part of the company’s games ecosystem. But for now it’s not known whether the condition is part of the announcement over the weekend.

Inter-District Travel Permission Is Not Required For Vaccination Appointments

Senior Minister for Security Cluster, Ismail Sabri Yaakob earlier today announced that the government will impose the Movement Control Order (MCO) in six Selangor districts. The directive will be enforced from 6 to 17 May 2021 in the affected districts comprising of Hulu Langat, Petaling, Gombak, Klang, Kuala Langat, and Sepang.

As part of the implementation, interstate and inter-district movements are prohibited within these districts. Hence, members of the public who reside in the affected districts expressed their concern on whether they would be able to obtain their AstraZeneca vaccine if the Vaccine Administration Centre (PPV) is located outside of their own district.

The Co-Chairman of the Special Committee on COVID-19 Vaccine Supple (JKJAV), Minister Khairy Jamaluddin has swiftly addressed the issue by obtaining confirmation from Minister Ismail that those who are affected by the upcoming MCO implementation in Selangor are not required to obtain inter-district travel permission from the police to receive their vaccine.

All they need to do is to show proof of their vaccination appointment either on MySejahtera, JKJAV’s website, or SMS. Involving more than 250,000 individuals, the AstraZeneca vaccine distribution for Selangor and Kuala Lumpur will kick off from tomorrow onwards until early June 2021, while the government is already looking into expanding the vaccine’s reach to other parts of the country soon.

Kaspersky Lab Survey: Over Half Of Cybersecurity Professionals Not Allowed To Share Findings

A survey by Kaspersky Lab found that over half (52%) of IT and cybersecurity professionals are barred by company rules from sharing their findings with outsiders. This may have major cybersecurity implications and in many ways, preventing hacks, discovering vulnerabilities, and securing systems are all harder to do if professionals aren’t exchanging knowledge.

Worryingly, the survey also pointed out that only 44% of respondents have actually made their discoveries public. In companies where external sharing is allowed, 77% of cybersecurity analysts did so. But when it isn’t allowed, only 8% did – presumably in a clandestine manner and at the risk of being terminated.

Kaspersky experts noted that company-mandated secrecy is driven by worries that cybercriminals may react and adapt if they know they’ve been detected. Sergey Soldatov, head of Kaspersky Lab’s Security Operations Center, emphasised the need for balance.

“Any information about a threat will help your peers to investigate an attack and plan an effective response,” he said, but added, “until you know whether a response’s actions will be successful or not, you can’t reveal that a company is doing something, since attackers will easily understand that they were detected and go underground.”

The results from the survey which is titled IT Security Economics 2020 were based on correspondence with over 5,200 IT professionals across 31 countries in June 2020. The final report is rather long but if you want to have a go with it yourself, check out Kaspersky Lab’s blog right here.

Google Phasing Out Cookies; Promises Not To Track Users For Advertising

Google announced in a blog post yesterday it would not adopt or build other tools to track users individually once it phases out third-party cookies from its Chrome browser next year, Reuters and CNBC said. Tracking individual users across the Internet via cookies has long been a mainstay of online advertising for the company.

Instead, Google will opt for alternatives that “hide individuals within large crowds of people with common interests.” In short, you’ll be served ads based on interests you share with other anonymous people, and not based on your individual browsing habits.

The company believes this approach achieves the right balance between preserving user privacy and meeting the needs of advertisers. Unlike some other tech firms, it explicitly rejected the idea that individual tracking was required to reap the benefits of online advertising.

Google, which still derives most of its revenue from advertising, declared in January last year that it would be ending support for third-party cookies by early 2022. In this latest blog post, the company said it would begin testing its new approach to advertising later this month via Chrome.

Over the past few months, online privacy has risen to the forefront of public debate. Popular platforms like Facebook and WhatsApp have attracted heated criticism for their practices regarding user data. Facebook is particularly irrate that Apple would require apps on its iOS platform to obtain user permission for tracking.

So funnily enough, with this move, Google may be finding itself on the same page as rival Apple.