PSA: Safari Security Flaw 'Actively Exploited,' Update Your Apple Devices Now

[planteater]

Here in the US zip, nada, nothing. The cat and mouse for vulnerabilities is nothing anybody raises an eyebrow about anymore.

Apple may lose 3 sales in the UK if that —- imo.

Here in the US even one of the major banks I use is warning about it.

 

[planteater]

You can't make this stuff up!

“One is something called ‘The Colonel,’” he said. “Think about The Colonel as the heart and brains of every Apple device – that a fundamental flaw in it could allow any external attacker, used by a nation-state intelligence agency, the ability to access your entire device.”

Quoted from:

Security expert: You should update your Apple devices 'immediately'

It’s time to update your Apple (AAPL) devices – and do it now, according to BlackCloak CEO Chris Pierson (video above).

finance.yahoo.com

Well if the patches are good enough for The Colonel, they’re good enough for me. I feel safer with Yahoo finance providing such informative info.

 

[adib]

Good questions.

I'm concerned about Mojave because it's the last "official" Mac operating system for my upgraded 2010 Mac Pro. My machine continues to work just fine while I wait for the Apple Silicon Mac Pro, but its operating system needs a little help from Apple to keep it secure while I wait.

When I moved all of my business and family devices to Apple a dozen years ago, privacy and security were important factors. They still are, and I've happily paid Apple's premium margins on the many products I've purchased from them because I believed they understood this and would always act accordingly.

If Apple "orphans" my Mojave Mac Pro, just months before the Apple Silicon Pro is available, it will send a clear message that my commitment to the Apple ecosystem was misplaced. If that's the case, it's fine and I'll live, but it will also be fine for me to explore other options for my computer purchases going forward.

I explained this to Tim Cook in a polite note to his public email at tcook@apple.com. If you have similar concerns, it might be good to send Tim an email, before the short-sighted bean counters screw this up beyond all recognition.

Have a look at these two threads and see if you can install Monterey on your Mac Pro.

• https://forums.macrumors.com/threads/installing-monterey-on-mac-pro-5-1.2331952/
• https://forums.macrumors.com/threads/macos-12-monterey-on-unsupported-macs-thread.2299557/

 

[Lihp8270]

I only go to known websites and I don’t click on any links in my email. I’ll be fine on iOS 14.8.1

Do any websites serve adverts?

Adverts are a known and common attack vector as the user has little control over which are displayed.

 

[I7guy]

Here in the US even one of the major banks I use is warning about it.

Yes, I even saw it in the news. However the genesis of why I said that was an op declared this was an embarrassment.

 

[Kimmo]

Have a look at these two threads and see if you can install Monterey on your Mac Pro.

• https://forums.macrumors.com/threads/installing-monterey-on-mac-pro-5-1.2331952/
• https://forums.macrumors.com/threads/macos-12-monterey-on-unsupported-macs-thread.2299557/

Thanks, adib.

I've been tracking the Open Core developments on the Mac Pro forum and I might have to go in that direction.

My preference would be to hang in there with a supported Mojave machine until the Apple Silicon Mac Pro is available.

Apple only dropped support for Mojave last fall, and while I can understand the thinking behind it, it wasn't a great long-term decision when it comes to those customers who purchased the company's most expensive computer in the past and are on the sidelines waiting to purchase what will likely be Apple's most expensive device in the near future.

After having passed on the 2013 Mac Pro for reasons that even Apple admitted (years later) were pretty well-founded, I thought I'd be buying a 2019 Mac Pro. It's a great computer, with the expandability advantages of my 5,1, that runs the latest Apple software. Unfortunately, Apple announced the transition to Apple Silicon just six months after the 7,1 became available. That raised a host of issues about support for the 2019 Intel model going forward.

I just hope that I and others who are in the same leaking Mojave boat can convince Tim and his team that patching Mojave is a good idea. It's a good idea for customers and a good idea for Apple who will benefit from the good will and (very likely) some high-dollar / high-margin computer purchases in the not too distant future.

One again, Tim's public email is tcook@apple.com. 🙂

 

[w7ay]

Well if the patches are good enough for The Colonel, they’re good enough for me. I feel safer with Yahoo finance providing such informative info.

Seems Yahoo Finance does not distinguish Kentucky Fried Chicken from Orville Redenbacher. 🙂

 

[MysticCow]

Safari 15.6.1 for macOS Big Sur and macOS Catalina

Meanwhile, those running below Big Sur or Catalina are...

 

[Jayson A]

Do any websites serve adverts?

Adverts are a known and common attack vector as the user has little control over which are displayed.

I don’t get ads because I use AdGuard so I have no idea.

 

[adib]

the sidelines waiting to purchase what will likely be Apple's most expensive device in the near future.

After having passed on the 2013 Mac Pro for reasons that even Apple admitted (years later) were pretty well-founded, I thought I'd be buying a 2019 Mac Pro. It's a great computer, with the expandability advantages of my 5,1, that runs the latest Apple software. Unfortunately, Apple announced the transition to Apple Silicon just six months after the 7,1 became available. That raised a host of issues about support for the 2019 Intel model going forward.

Don't hold your breath.

Apple Silicon's architecture is not expandable beyond Thunderbolt. Its memory would need to be soldered on to the chip. The main drive may be upgradeable, but so far there's little hope on that seeing its implementation on Mac Studio. External GPU is still a no-go after M2's announcement; hence any GPU expansion is unlikely.

The most likely development would be a tower Mac Pro with built-in slots for Thunderbolt SSD and RAID arrays. That would be it.

The best bet is to buy a Mac Studio and a matching cabinet to place a drive array and fan-out port below it. Because that's the future of Mac Pro, but in a single enclosure.

 

[UnknownIdaho]

[I guess I hadn’t updated the webpage and now notice several pages of additional comments, this may have already been stated]

Unfortunately you cannot avoid it by simply not using Safari, it is an issue within WebKit which unfortunately Apple embeds in the OS:
‘The CVE-2022-32893 vulnerability therefore potentially affects many more apps and system components than just Apple’s own Safari browser, so simply steering clear of Safari can’t be considered a workaround, even on Macs where non-WebKit browsers are allowed.’

Evidently, as of Big Sur, MacOS is allowing Safari updates, though I don’t see it on my MacBook, I have never updated my OS and generally don’t unless there is a needed feature only on a newer version.

I really think security updates should (as much as possible) be completely separate from OS updates.

Unfortunately, Safari/WebKit is embedded in iOS so you must update to 15.6.1.

Interestingly: Apple has released iOS12.6 for older iPhones with a security update! Unheard of!

 

[Johnny Jackhammer]

While the security fixes are always important and appreciated, I’ve moved to Edge, which work far far better than Safari has been lately on my M1 fleet.

I just tried edge after seeing this. All the Microsoft click bait turns me off. Infinite scrolling click bait. Most of it feels like Fox News propaganda. No thanks!