iPad, why it's interesting

Yesterday, as everyone -- including me -- expected, Apple introduced their first big foray into the tablet computing market (if you don't count the iPhone as a tablet) called the iPad.

Which, even I, as an Apple fan, has to admit-- is a stupid name.  iSlate, or even "Tablet" would have been better, but, whatever.  (Plus, Fujitsu owns the "iPad" trademark, so we'll see what it winds up being -- remember "iTV" changed to "Apple TV" at launch.

Am I interested in one?  Yes.  I am interested because it's just enough for me to NOT have to carry around my laptop bag anymore.  Potentially eliminating the need to carry anything outside of a jacket. (Using a jacket like the Scottevest line: http://www.scottevest.com/ -- which is just handy, all those pockets.)  90% of my work could be done a device like this, and I'm just happy about that.

I don't think people are overwhelmed by it right now in this iteration because people feel it's just a big iPod Touch.  Well, fine.  I have to kind of agree with that idea, but look at how far the iPod Touch has come along since it's release.  It's not about the platform people, it's the APPS.  We'll see what happens in 60 days before it's release.  We'll see what happens in a year.

There is going to be a completely different class of Apps developed for this thing.  I fully expect even people like Microsoft to develop a version of Office (or maybe use the online office) for this thing.

Think of the possibilities for a couple markets:

A) Schools.  Imagine school children, colleges, high schools, etc with this thing as a standard issue device.  Think of what is going to come about as far as accessibilities to text books, not having to carry them around anymore.  Think about taking your quizzes and tests online, doing your homework online.  The elimination of the wasteful use of paper is coming in a big way.

B) Medical application.  Think of a doctor being able to walk around a hospital, every patients records, xrays, results, insurance cards, everything.  Accessible with their fingers.  Think about the Doctors being able to make notes right into the patients online chart.

These are just a couple examples I can think of off the top of my head about the possibilities for a device like this.

Security

Now, how should we treat this device from a security perspective?  It's a mobile device, but it's not a phone, it can't make phone calls.  (Native phone calls, not through Skype.)  It's not a laptop, it's more mobile than that.

I would have to say that'd we'd need to treat this device as a phone.  For the most part, it's a platform that has near ubiquitous access to the internet.  Any Starbucks, Barnes and Nobles, etc.  Then with the cheap 3G access available on it, I think there is going to be a whole class of people (maybe the sub-20 year old demographic) that would use this as a computer.  They don't need anything else for the most part.  My wife doesn't need anything more than this device.  Will you be able to print from it?  Probably not, but that's really the only thing I see that needs to be added from a software point of view for this to replace most computers.  My parents would use this instead of regular computer, most people would, if all they did was process email and read web pages on it.

This is the perfect couch device, this is the perfect "train" or "plane" device. There are a ton of possibilities for this thing, not necessarily at launch, but in a year/two years from now, this may be the computing platform that we are all using.

I'm really only disappointed in one thing.  No face forward video camera for teleconferencing?  Hm.  Well, let's think of this thing sitting on your lap.  Ideally the camera would need to be up higher, level with your face, otherwise people on a video conference with you would be looking up your nose the whole time.  Yes of course you could prop it up, but that's not going to happen all the time.  That's really my only disappointment.

We'll see..

iPhone 2.1 actually lists its updates?!

Very uncharacteristic for Apple, but the update screen for 2.1 actually lists its updates.

Wow.

• Decrease in call set-up failures and call drops
• Significantly improved battery life for most useres
• Dramatically reduced time to backup to iTunes
• Improved email reliability, notably fetching email from POP and exchange accounts.
• Faster installation of 3rd party applications.
• Fixed bugs causing hangs and crashed if you have lots of 3rd party applications
• Improved performance in text messaging
• Faster loading and searching of contacts
• Improved accuracy of the 3G signal strength display
• Repeat alert up to two additional time for incoming text messages
• Option to wipe data after ten failed passcode attempts
• Genius playlist creation.

Thanks for letting us know all these things Apple, please keep up the straightforwardness in updates!

Subscribe in a reader

iPhone 2.1 is out, and here it is

iPhone v2.1

• Application Sandbox

CVE-ID: CVE-2008-3631

Available for: iPhone v2.0 through v2.0.2

Impact: An application may be able to read another application's files

Description: The Application Sandbox does not properly enforce access restrictions between third-party applications. This may allow a third-party application to read files in another third-party application's sandbox, and lead to the disclosure of sensitive information. This update addresses the issue by enforcing the proper access restrictions between application sandboxes. Credit to Nicolas Seriot of Sen:te and Bryce Cogswell for reporting this issue. This issue does not affect iPhone versions prior to v2.0.

• CoreGraphics

CVE-ID: CVE-2008-1806, CVE-2008-1807, CVE-2008-1808

Available for: iPhone v1.0 through v2.0.2

Impact: Multiple vulnerabilities in FreeType v2.3.5

Description: Multiple vulnerabilities exist in FreeType v2.3.5, the most serious of which may lead to arbitrary code execution when accessing maliciously crafted font data. This update addresses the issue by incorporating the security fixes from version 2.3.6 of FreeType. Further information is available via the FreeType site at http://www.freetype.org/

• mDNSResponder

CVE-ID: CVE-2008-1447

Available for: iPhone v1.0 through v2.0.2

Impact: mDNSResponder is susceptible to DNS cache poisoning and may return forged information

Description: mDNSResponder provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow a remote attacker to perform DNS cache poisoning attacks. As a result, applications that rely on mDNSResponder for DNS may receive forged information. This update addresses the issue by implementing source port and transaction ID randomization to improve resilience against cache poisoning attacks. Credit to Dan Kaminsky of IOActive for reporting this issue.

• Networking

CVE-ID: CVE-2008-3612

Available for: iPhone v2.0 through v2.0.2

Impact: Predictable TCP initial sequence numbers generation may lead to TCP spoofing or session hijacking

Description: TCP initial sequence numbers are sequentially generated. Predictable initial sequence numbers may allow a remote attacker to create a spoofed TCP connection or insert data into an existing TCP connection. This update addresses the issue by generating random TCP initial sequence numbers. This issue does not affect iPhone versions prior to v2.0.

• Passcode Lock

CVE-ID: CVE-2008-3633

Available for: iPhone v2.0 through v2.0.2

Impact: An unauthorized user may bypass the Passcode Lock and launch iPhone applications

Description: The Passcode Lock feature is designed to prevent applications from being launched unless the correct passcode is entered. An implementation issue in the handling of emergency calls allows users with physical access to an iPhone to launch an application without the passcode by double clicking the home button in emergency call. This update addresses the issue through improved handling of emergency calls. Credit to Matthew Yohe of The University of Iowa's Department of Electrical and Computer Engineering for reporting this issue. This issue does not affect iPhone versions prior to v2.0.

• WebKit

CVE-ID: CVE-2008-3632

Available for: iPhone v1.0 through v2.0.2

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: A use-after-free issue exists in WebKit's handling of CSS import statements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of document references.

Subscribe in a reader

iPhone 2.1 actually lists its updates?!

Very uncharacteristic for Apple, but the update screen for 2.1 actually lists its updates.

Wow.

• Decrease in call set-up failures and call drops
• Significantly improved battery life for most useres
• Dramatically reduced time to backup to iTunes
• Improved email reliability, notably fetching email from POP and exchange accounts.
• Faster installation of 3rd party applications.
• Fixed bugs causing hangs and crashed if you have lots of 3rd party applications
• Improved performance in text messaging
• Faster loading and searching of contacts
• Improved accuracy of the 3G signal strength display
• Repeat alert up to two additional time for incoming text messages
• Option to wipe data after ten failed passcode attempts
• Genius playlist creation.

Thanks for letting us know all these things Apple, please keep up the straightforwardness in updates!

Subscribe in a reader

iPhone 2.1 is out, and here it is

iPhone v2.1

• Application Sandbox

CVE-ID: CVE-2008-3631

Available for: iPhone v2.0 through v2.0.2

Impact: An application may be able to read another application's files

Description: The Application Sandbox does not properly enforce access restrictions between third-party applications. This may allow a third-party application to read files in another third-party application's sandbox, and lead to the disclosure of sensitive information. This update addresses the issue by enforcing the proper access restrictions between application sandboxes. Credit to Nicolas Seriot of Sen:te and Bryce Cogswell for reporting this issue. This issue does not affect iPhone versions prior to v2.0.

• CoreGraphics

CVE-ID: CVE-2008-1806, CVE-2008-1807, CVE-2008-1808

Available for: iPhone v1.0 through v2.0.2

Impact: Multiple vulnerabilities in FreeType v2.3.5

Description: Multiple vulnerabilities exist in FreeType v2.3.5, the most serious of which may lead to arbitrary code execution when accessing maliciously crafted font data. This update addresses the issue by incorporating the security fixes from version 2.3.6 of FreeType. Further information is available via the FreeType site at http://www.freetype.org/

• mDNSResponder

CVE-ID: CVE-2008-1447

Available for: iPhone v1.0 through v2.0.2

Impact: mDNSResponder is susceptible to DNS cache poisoning and may return forged information

Description: mDNSResponder provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow a remote attacker to perform DNS cache poisoning attacks. As a result, applications that rely on mDNSResponder for DNS may receive forged information. This update addresses the issue by implementing source port and transaction ID randomization to improve resilience against cache poisoning attacks. Credit to Dan Kaminsky of IOActive for reporting this issue.

• Networking

CVE-ID: CVE-2008-3612

Available for: iPhone v2.0 through v2.0.2

Impact: Predictable TCP initial sequence numbers generation may lead to TCP spoofing or session hijacking

Description: TCP initial sequence numbers are sequentially generated. Predictable initial sequence numbers may allow a remote attacker to create a spoofed TCP connection or insert data into an existing TCP connection. This update addresses the issue by generating random TCP initial sequence numbers. This issue does not affect iPhone versions prior to v2.0.

• Passcode Lock

CVE-ID: CVE-2008-3633

Available for: iPhone v2.0 through v2.0.2

Impact: An unauthorized user may bypass the Passcode Lock and launch iPhone applications

Description: The Passcode Lock feature is designed to prevent applications from being launched unless the correct passcode is entered. An implementation issue in the handling of emergency calls allows users with physical access to an iPhone to launch an application without the passcode by double clicking the home button in emergency call. This update addresses the issue through improved handling of emergency calls. Credit to Matthew Yohe of The University of Iowa's Department of Electrical and Computer Engineering for reporting this issue. This issue does not affect iPhone versions prior to v2.0.

• WebKit

CVE-ID: CVE-2008-3632

Available for: iPhone v1.0 through v2.0.2

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: A use-after-free issue exists in WebKit's handling of CSS import statements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of document references.

Subscribe in a reader

Wow, Um, So hey, how you doing?

Haven't Blogged in awhile, I've been working on some other stuff as well over at dearcupertino.com.

For those of you that haven't seen, here's a bit of mac news, Apple released iTunes 8, a new set of iPod Nano's (going back to the more vertical shape), updated and dropped the price on the iPod Touch, as well as refreshing the iPod Classic line.

Basically, for the holiday shopping season. Good stuff.

They also released an update to the iPod Touch software (2.1), and it has some nifty features in it (like the Genius feature from iTunes 8.0). Reports are also, that it is faster. The iPhone update 2.1 is supposed to hit today, so I might blog again with some updates about that.

Otherwise, for those who know me, and know that i have been on a single customer site for the past year+, I have 12 days left (including weekends.)

Subscribe in a reader

Internet Storm Center Podcast Episode 10 posted

Just a quick note to let everyone know that we put out Podcast Episode 10.

iTunes users, go here to subscribe.
Non-iTunes users, go here to download.

As always we are looking for listener feedback, be sure and write in!

Subscribe in a reader

Internet Storm Center Podcast Episode 10 posted

Just a quick note to let everyone know that we put out Podcast Episode 10.

iTunes users, go here to subscribe.
Non-iTunes users, go here to download.

As always we are looking for listener feedback, be sure and write in!

Subscribe in a reader

iPhone Update 2.0.2

Hot on the heels of Apple's 2.0.1 update, they post 2.0.2.  (Kinda quick wasn't it?)  In true Apple fashion, they don't tell you what they fixed other than "bug fixes" (gee thanks).    I'd like to see my 3G reception fixed!

I live in a 3G area, and normally get great reception, but sometimes, when it's down to one bar, and the phone doesn't switch over to Edge like it should in that case...  It'll just drop signal totally.

But reports are coming in that faster browsing is taking place, typing lag may be reduced (thank you!), and the transition from music list to Coverflow is different now.

Thank you to AppleInsider for the ideas on what has been fixed.

 Subscribe in a reader

iPhone Update 2.0.2

Hot on the heels of Apple's 2.0.1 update, they post 2.0.2.  (Kinda quick wasn't it?)  In true Apple fashion, they don't tell you what they fixed other than "bug fixes" (gee thanks).    I'd like to see my 3G reception fixed!

I live in a 3G area, and normally get great reception, but sometimes, when it's down to one bar, and the phone doesn't switch over to Edge like it should in that case...  It'll just drop signal totally.

But reports are coming in that faster browsing is taking place, typing lag may be reduced (thank you!), and the transition from music list to Coverflow is different now.

Thank you to AppleInsider for the ideas on what has been fixed.

 Subscribe in a reader

iPhone 3G review

Okay, so I have had my iPhone 3G with iPhone 2.0 software for a solid week now.  

BLUF:  I like it.

Now, I live in a 3G area.  Which means I get the full capabilities of the speed, and it's nice.  Browsing the internet is faster, Mail is faster, everything is nice and quick.  Even the apps I use.  The truth is, I was considering not getting one, but the touchscreen stopped working on my old iPhone about a month ago, and therefore, I had to upgrade (oh darn).

iPhone 2.0 software

--

This is the greatest feature about the new iPhone (and the old iPhone too) is the apps.  Now that you can have apps, it's awesome.  I hacked my phone in the past but there were no apps that I was excited about and I really didn't care to do it again.  There were really three apps I wanted on my old iPhones software.  

1) something to manage my to-do's

2) some kind of music buying app

3) Instant messenger.

Well, now I have Omnifocus for the iPhone (and the mac, and it's great, everything syncs up..  awesome.  Although I do have to call Omnigroup out on something.  They say that their databases sync via "MobileMe".  Now, if I said that to you, that would imply you have to-do syncing through the cloud right?  Well, not really.  All that happens is your Omnifocus DB is stored on your iDisk, and your devices have to sync to iDisk, so while technically true, it's ill worded...anyway..  Omnifocus is great, I recommend it, little high in price, but... yeah)  So that takes care of my to-do's.

2)  Some kind of music buying app.  Well iPhone has had the iTunes store for a while, and it has been great.  But there are occasions that you didn't know what the song was that you heard on the radio and you wanted to know.  Well now my iPhone has an app called Shazam, that will listen to the song I am listening to and tell me what the song is.  Awesome.

3)  Instant Messenger, well I got my AOL IM, but it's just not as polished as I think it should be.  It should be iChat'ish.  Come on Apple, do your thing.

Of course I have some other apps on there as well, games, facebook, pownce, twitter..etc..  and I use them, but they are just add ons.  Not must haves.

The GPS is awesome, quick too.  While it doesn't TELL you where to make turns, it WILL follow where you are at on Google Maps, and you can just get your directions through there.  So it works just fine for a GPS phone.  I'd like to replace my Car GPS with the iPhone, which requires two things.  A touch bit better GPS turn-by-turn software, say from Tom-Tom or Garmin, and a Car Charger.  No car charger yet.  Let's go!

All in all..  Excellent phone, I highly recommend it for people who live in a 3G area.  If you don't live in a 3G area, then don't worry about it, because the speed won't help you.  Get your software update.  

However if you live in a 3G area, or you like the 'flush headset jack' idea, or the fact that it fits better in your hand (with the rounded back), then get it.  The iPhone 3G FEELS thinner.  But in fact it's a 0.2 mm thicker in the middle.  But you probably won't notice.

 Subscribe in a reader

iPhone 3G review

Okay, so I have had my iPhone 3G with iPhone 2.0 software for a solid week now.  

BLUF:  I like it.

Now, I live in a 3G area.  Which means I get the full capabilities of the speed, and it's nice.  Browsing the internet is faster, Mail is faster, everything is nice and quick.  Even the apps I use.  The truth is, I was considering not getting one, but the touchscreen stopped working on my old iPhone about a month ago, and therefore, I had to upgrade (oh darn).

iPhone 2.0 software

--

This is the greatest feature about the new iPhone (and the old iPhone too) is the apps.  Now that you can have apps, it's awesome.  I hacked my phone in the past but there were no apps that I was excited about and I really didn't care to do it again.  There were really three apps I wanted on my old iPhones software.  

1) something to manage my to-do's

2) some kind of music buying app

3) Instant messenger.

Well, now I have Omnifocus for the iPhone (and the mac, and it's great, everything syncs up..  awesome.  Although I do have to call Omnigroup out on something.  They say that their databases sync via "MobileMe".  Now, if I said that to you, that would imply you have to-do syncing through the cloud right?  Well, not really.  All that happens is your Omnifocus DB is stored on your iDisk, and your devices have to sync to iDisk, so while technically true, it's ill worded...anyway..  Omnifocus is great, I recommend it, little high in price, but... yeah)  So that takes care of my to-do's.

2)  Some kind of music buying app.  Well iPhone has had the iTunes store for a while, and it has been great.  But there are occasions that you didn't know what the song was that you heard on the radio and you wanted to know.  Well now my iPhone has an app called Shazam, that will listen to the song I am listening to and tell me what the song is.  Awesome.

3)  Instant Messenger, well I got my AOL IM, but it's just not as polished as I think it should be.  It should be iChat'ish.  Come on Apple, do your thing.

Of course I have some other apps on there as well, games, facebook, pownce, twitter..etc..  and I use them, but they are just add ons.  Not must haves.

The GPS is awesome, quick too.  While it doesn't TELL you where to make turns, it WILL follow where you are at on Google Maps, and you can just get your directions through there.  So it works just fine for a GPS phone.  I'd like to replace my Car GPS with the iPhone, which requires two things.  A touch bit better GPS turn-by-turn software, say from Tom-Tom or Garmin, and a Car Charger.  No car charger yet.  Let's go!

All in all..  Excellent phone, I highly recommend it for people who live in a 3G area.  If you don't live in a 3G area, then don't worry about it, because the speed won't help you.  Get your software update.  

However if you live in a 3G area, or you like the 'flush headset jack' idea, or the fact that it fits better in your hand (with the rounded back), then get it.  The iPhone 3G FEELS thinner.  But in fact it's a 0.2 mm thicker in the middle.  But you probably won't notice.

 Subscribe in a reader

Podcast Episode Seven has been posted

The publishment (like that word don't you) of Podcast Episode Seven of the Internet Storm Center Podcast.

I'd like to thank all the viewers that were live on the show while broadcasting, it was great having you, maybe next time we'll be able to get more?  We had about 20 I believe (I didn't count) at one point.  It would be great if we could increase this count, as I'd like to do a live Q&A via the listeners.  (Couple new segments I'm working on)

We had Paul Asadoorian of PaulDotCom Security Weekly as a guest, and it's probably our best podcast yet!

Go grab it through iTunes, and for those of you that are not listeners of PaulDotCom, please subscribe to that one too!

 Subscribe in a reader

Podcast Episode Seven has been posted

The publishment (like that word don't you) of Podcast Episode Seven of the Internet Storm Center Podcast.

I'd like to thank all the viewers that were live on the show while broadcasting, it was great having you, maybe next time we'll be able to get more?  We had about 20 I believe (I didn't count) at one point.  It would be great if we could increase this count, as I'd like to do a live Q&A via the listeners.  (Couple new segments I'm working on)

We had Paul Asadoorian of PaulDotCom Security Weekly as a guest, and it's probably our best podcast yet!

Go grab it through iTunes, and for those of you that are not listeners of PaulDotCom, please subscribe to that one too!

 Subscribe in a reader

In a World of Apple news, Quicktime 7.5 is out.

In case you didn't catch it yesterday amongst all the other Apple News that was floating around, Quicktime got a security update yesterday to 7.5.    The next version of OSX (Snow Leopard)  will have a totally new version of Quicktime, called Quicktime "X".  I guess Apple is getting tired of fixing the legacy code of Quicktime and is killing it and making a better one.

 Subscribe in a reader

In a World of Apple news, Quicktime 7.5 is out.

In case you didn't catch it yesterday amongst all the other Apple News that was floating around, Quicktime got a security update yesterday to 7.5.    The next version of OSX (Snow Leopard)  will have a totally new version of Quicktime, called Quicktime "X".  I guess Apple is getting tired of fixing the legacy code of Quicktime and is killing it and making a better one.

 Subscribe in a reader

Podcast Episode Four released

Morning everyone,

Just a quick note to let everyone know that we put out Podcast Episode 4 this morning. Just a few announcements at the beginning, and then I put the audio for May's Monthly "Reboot Wednesday" Podcast that we do through SANS on after that. We'll be recording Episode five next week. We'll let you know when it's out!

iTunes users, go here to subscribe.

Non-iTunes users, go here to download.

Thanks!

 Subscribe in a reader

Podcast Episode Four released

Morning everyone,

Just a quick note to let everyone know that we put out Podcast Episode 4 this morning. Just a few announcements at the beginning, and then I put the audio for May's Monthly "Reboot Wednesday" Podcast that we do through SANS on after that. We'll be recording Episode five next week. We'll let you know when it's out!

iTunes users, go here to subscribe.

Non-iTunes users, go here to download.

Thanks!

 Subscribe in a reader

News on the Podcast

I've received alot of positive feedback on the podcast.  Thanks for listening, apparently we're doing something right, Apple has featured us on the "New and Notable" list on iTunes.  So I am sure we might pick up some subscribers on that.  That's awesome.  I'm glad to see that it's being so well received.

 Subscribe in a reader

News on the Podcast

I've received alot of positive feedback on the podcast.  Thanks for listening, apparently we're doing something right, Apple has featured us on the "New and Notable" list on iTunes.  So I am sure we might pick up some subscribers on that.  That's awesome.  I'm glad to see that it's being so well received.

 Subscribe in a reader