Could Apple be getting back into the car business? A rumored alliance with a car company suggests that it’s possible. The next generation of ChatGPT was announced as OpenAI continues to push the uncanny envelope. And are zombie photos and other presumed-deleted files reappearing on Apple devices?
If you like the Intego Mac Podcast, be sure to follow it on Apple Podcasts, Spotify, or Amazon.
Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you’re ready to buy.
Get Apple security news delivered straight to your inbox, for free. Intego’s twice-monthly newsletter will keep you informed about Apple-related privacy and security, along with tips and tricks for getting the most out of your Mac or iPhone. Subscribe for free—no strings attached.
Voice Over 0:00
This is the Intego Mac Podcast—the voice of Mac security—for Thursday, May 16 2024.
This week’s Intego Mac Podcast security headlines include: A rundown of the security fixes in Apple’s recent OS updates. Could Apple be getting back into the car business? A rumored alliances with a car company suggest it’s possible. The next generation of ChatGPT was announced as OpenAI continues to push the uncanny envelope. And are zombie photos and other presumed-deleted files reappearing on Apple devices? Now, here are the hosts of the Intego Mac podcast. Veteran Mac journalist, Kirk McElhearn. And Intego’s. Chief Security Analyst, Josh Long.
Kirk McElhearn 0:50
Good morning, Josh. How are you today?
Josh Long 0:52
I’m doing well. How are you, Kirk?
Kirk McElhearn 0:55
I’m doing just fine. Today is the Ides of May. And you know what happened today?
Josh Long 1:00
What did happen today?
Kirk McElhearn 1:01
People started getting new iPads, the iPad Pro and the iPad Air and the Apple Pencil. They started shipping today. So people around the world have already started receiving new Apple stuff today.
Josh Long 1:13
Because you’re in the UK, you actually already got your iPad Pro. Right?
Kirk McElhearn 1:17
Exactly. I got mine three hours ago. Before you were even awake, Josh.
Josh Long 1:22
Yep. And my wife is supposed to be getting an iPad Air today. So that should be coming sometime later this morning. Hopefully.
Kirk McElhearn 1:29
We’ll talk about the new iPads next week after I’ve had some time to play with mine. But I gotta say that display is really something else. The OLED display, what do they call the retina
Josh Long 1:39
…into Molex direction? Yeah, something XDR.
Kirk McElhearn 1:44
I don’t know, super extra magic, RetinA XDR, or something like that. But the combination of that display and the audio on this thing, it’s really impressive. I watched a bit of the movie, Argyle on Apple TV. Plus, in the beginning, there’s this chase scene. And the spatial audio that comes out of the four speakers is really impressive. Now you don’t buy an iPad Pro just to do that. We’ll talk about it more next week when we’ve had some time to get to know my iPad Pro, and you’ll get to know your wife’s iPad Air. But you know, there’s something new about iPads. There are no more logo stickers in iPad boxes.
Josh Long 2:14
That’s right. Yeah, I don’t think we talked about that last week. This is part of Apple’s green initiative, right, and making sure that all of the products they’re releasing, have as little environmental footprint as possible. And so one of those steps is getting rid of the thing that a lot of people just throw away, or supposedly, that’s what people do. I don’t know, I collect them. But I don’t really ever do anything with them. They just like sit there in a bag. And I’m like, What do I do with these Apple stickers, I don’t know.
Kirk McElhearn 2:45
I’ve always left them in boxes. And I probably got two dozen of them upstairs in my room where all my Apple boxes are. Another thing is there’s no more shrink wrap around the box. And when I took the box out of the package, I was like, Wait, someone opened this, because used to have shrink wrap first. But it has those Apple taro strips on both ends of the box on the bottom. So you can tell it hasn’t been open. But it was surprising to open it and not have shrink wrap. Same is true for the Apple Pencil, which I also got.
Josh Long 3:11
Yeah, I actually liked that pull tab better. I think that it’s cleaner, you know, you don’t have to have that extra layer on top of it. And you still know if it’s been tampered with, which is a nice thing.
Kirk McElhearn 3:22
So this week, we had a lot of updates, and part of the reason for the updates was for the new iPads. So we have iOS and iPadOS 17.5. We have macOS Sonoma 14.5. We have WatchOS 10.5 TVOS 17.5. HomeOS, does it have a number? I don’t even know.
Josh Long 3:38
Did we get a HomeOS update? Yeah, I don’t know, Apple doesn’t include them in the list of things that get security updates, which is interesting, because I think it’s actually based on TVOS, if I’m not mistaken. That seems to be what I recall, is because it has the same build numbers as TVOS,
Kirk McElhearn 3:55
I did get updates from my HomePods. When I was updating all of my devices, I opened the Home app to check. And it immediately says downloading. So for HomePods, they will update automatically when they get around to it at some time. But if you open the Home app, that should trigger it. And if it doesn’t, you press and hold on the title for HomePod. And then that will start to download.
Josh Long 4:19
Yep. And then of course, you can update all of your other operating systems just the normal way you can go into the Settings app and check for updates there on iOS, iPadOS, macOS, and even WatchOS, TVOS as well. So all of those operating systems got updates.
Kirk McElhearn 4:37
So tell us about the security updates. There seem to be a lot and I’m looking at your numbers in the show notes, 15 security updates in iOS, iPadOS 22 and macOS etc. That seems like big numbers.
Josh Long 4:47
Yeah, not not too bad. It’s not it’s not the record setting number by any means. But there were some interesting vulnerabilities. None of them were what Apple now calls exploited. What they used to say was actively exploited, ie in the wild known to have been used in real world attacks, there were none of those listed in the updates this time around. However, there were a couple of really interesting vulnerabilities. The one that seemed like the most serious vulnerability was one that could allow an app to execute arbitrary code with kernel privileges. So this is almost as bad as it gets. The only thing worse than that would be like a remote code execution vulnerability, meaning that somebody without having physical access to your device could potentially exploit a vulnerability or infected. So this is not quite that bad. But nevertheless, when you have arbitrary code vulnerabilities, especially with kernel privileges, meaning like it runs at the same level as the operating system itself, those are pretty darn serious. And one of those vulnerabilities got patched for all of those Apple operating systems that we just mentioned. And this particular vulnerability is kind of interesting, because the researcher who found it was not able to get a bug bounty for it, Apple said it’s not eligible. And so he probably in part, because he was pretty upset at Apple about this, decided to release proof of concept code online. So make sure that you install those patches soon, because the bad guys might be trying to exploit this vulnerability in the near future.
Kirk McElhearn 6:25
So wait a second, the security researcher who found this, he’s made the code public, even though he knows that people aren’t going to be updating their devices instantly.
Josh Long 6:34
Anytime that any update comes out, there are a lot of people who don’t install the updates right away, they just wait until Apple prompts them which might in some cases be within days, sometimes it’s even takes weeks. And even when you get the prompt, sometimes people ignore it for months.
Kirk McElhearn 6:51
Well, some people may not have enough storage on their device to be able to do it.
Josh Long 6:55
Yep, very common problem, actually, where people have a whole bunch of videos, a bunch of pictures and a bunch of apps installed, and they just run out of space.
Kirk McElhearn 7:05
It’s interesting that Apple will give you temporary iCloud storage if you’re buying a new device, but they won’t do it when you’re doing a system upgrade. And it seems like something that should be standard that if there’s any system upgrade, at least with security fixes that you should have a thing? Well, first of all, they should let you delete all that other storage that you see when you look at the storage of a device because you can’t delete it. It’s a lot of its cache and temporary files and stuff. But they should give you temporary storage to be able to update something that’s an urgent update like that. But I just want to go back to the fact that the researcher has released the code. So basically, he’s putting everyone at risk. Because he’s angry, he’s hurt that Apple wouldn’t pay him for finding something.
Josh Long 7:49
Well, yeah, I don’t know if that was the only reason why he decided to release the proof of concept code. But it certainly didn’t help that, you know, I mean, this is how a lot of researchers actually make a living, and he should have gotten a pretty decent payout. If he had gone to a third party, he could have gotten a lot more money for this. But he tried to do the most responsible thing by taking it directly to the vendor taking it to Apple. And then Apple said, it doesn’t qualify, and they wouldn’t explain why it didn’t qualify. It clearly does fall under Apple’s requirements. But Apple says that it doesn’t. And so it’s like, well, what are you going to do?
Kirk McElhearn 8:25
I bet I know what this guy’s going to do the next time he finds a vulnerability.
Josh Long 8:30
Well, it’s possible he won’t submitted to Apple directly next time. Did they just take it to a third party? I think that’s a lot of times what they end up doing is they’re like, Well, fine, if Apple’s not going to patch it. I’ll sell it to the highest bidder then.
Kirk McElhearn 8:42
So do they sell these on eBay or something?
Josh Long 8:46
There are vulnerability broker companies that they go to. Some of them are a little bit grayer than others. But yeah, there are companies out there that will buy up vulnerabilities. Often they’ll report them to the original vendor, but you’ll get a payout from the company first. So it’s a crazy world. One more quick note about this is that they although there were updates for iPadOS and iOS 16, and macOS, Ventura, and Monterey, they did not include a patch for that really serious vulnerability we were just talking about, and in fact that they only were two or three updates per operating system as opposed to the 15 or 22 in the current versions of those operating systems. So make sure that you’re running the latest operating system. If your devices cannot run the latest iOS, iPadOS or macOS and OMA, then it’s time to upgrade your devices.
Kirk McElhearn 9:46
Oh, no. So Apple is doing their planned obsolescence. Again, I’m going to link to an article from the Intego Mac security blog where we talk about that. So it’s the fifth month of the year. And that means that Google has patched its 50 zero day vulnerability of the year for Chrome.
Josh Long 9:59
Yes. Another zero day vulnerability has been discovered in Google Chrome, which of course means that it affects other browsers that are also based on the Chromium code base. That includes Microsoft Edge. Opera, Vivaldi, Brave is another one. Basically, most of the third party browsers if they’re not Firefox, they are probably based on the Chromium source code. And they are probably vulnerable and need updates.
Kirk McElhearn 10:27
Okay, very briefly, we want to talk about Apples crush iPad Pro as the day after the last Apple event. A lot of people started talking about this about here’s Apple destroying all these things and saying that all these creative tools, this piano, these paintbrushes, and easels, these radios, these musical instruments are worthless. And all you need is a really thin iPad Pro to do everything. Now I understand the concept. But even when I was watching this, before the outrage started, I was thinking, it reminded me there was some artists who dropped a piano from a helicopter into a lake right to make a statement. And I was thinking, there are some schools that could use that piano, right, a piano is not a cheap musical instrument. It I found it really offending that they’re crushing all this stuff. And at first, I thought it might be CGI, but it’s not. There are some bits of CGI that little faces where the eyes pop out at the end, which is really creepy when you think about it. But a lot of creative people have been very critical of this. Now, Apple knows how to handle a crisis at least better than back in the day when the iPhone was slippery. And so Steve Jobs said you’re holding it wrong. They immediately came out, I believe, two days after so the event was on a Monday and on Wednesday morning, they announced we’re sorry, we didn’t read the room, right or something like that. And we’re pulling the end, we’re not going to run it on TV. I don’t know if they ever planned to run on TV. It shows that Apple knows it’s not worth controversy over these things. But it really was tone deaf. Well, yeah,
Josh Long 12:01
it’s interesting. So like, there’s a lot of different angles, you could take on this and we don’t want to spend too much time on it. But it was really mostly the creative types who were getting upset about this. And there were a bunch of other things that were crushed. And you know, in this ad with a hydraulic press, although Apple said we’re not going to run it on TV, they haven’t pulled it down from YouTube, they haven’t pulled it down from social media. So honestly, this has been even though it was a little bit negative, it was still press like it got people paying attention to the fact that there’s a new iPad Pro that just got released that they made a controversial commercial about so you know what Apple I think still definitely got its money’s worth out of the production of this advertisement.
Kirk McElhearn 12:44
Okay, we’re gonna take a break. When we come back, we’ve got some more news to discuss.
Voice Over 12:51
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Best of all, it’s compatible with macOS Sonoma, and the latest Apple Silicon Macs. Download the free trial of Mac Premium Bundle X9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the special discount link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.
Kirk McElhearn 14:05
Okay, in other news, there are some rumors about the Apple car being resurrected that Apple could partner with Rivian. I’ve said from the beginning that I couldn’t imagine Apple selling a car where would they put them in the Apple Stores? Right? selling a car is just something that’s not for them yet the operating system for a car makes total sense. Now, I guess they were trying to make a car because they laid off hundreds of people it costs billions of dollars, etc. But they’ve got the tech, they’re not going to throw it away. It does make sense for Apple to partner with some carmaker. The question is do you partner with one or do you license it to a bunch or like all of the brands of a particular large carmaker or one small brand Rivian Who makes electric vehicles but who isn’t that big, but maybe a partnership could help boost Rivian and Apple could buy out Rivian or work with them or something like that?
Josh Long 14:55
Yeah, Apple actually has announced some partnerships with existing car manufacturers related to CarPlay. But yeah, it would be really interesting to see something more in depth, a tighter integration. And so anyway, it’s just a rumor. Rivian is a big competitor to Tesla and a lot of other electric car companies. So maybe that could happen sometime in the future.
Kirk McElhearn 15:17
Okay, Apple made a press release yesterday, May 14, that the App Store stopped over $7 billion in potentially fraudulent transactions in four years. Now, what they don’t say is how many fraudulent transactions it didn’t stop and how many fraudulent apps they didn’t block. And, you know, the number that really got me is when you get down to talking to App Review. And they say that they have a team of 500 experts who evaluates every single app submission. Now, the team reviews, approximately 132,500 apps per week, do the math, that’s a lot of apps per person, how many apps can you review seriously, if you have 1000s of apps to do a week?
Josh Long 15:55
Okay, so let’s actually do the math, let’s figure out how many they’re having to review on a given day. So if they have 132,500 apps a week divided by 500 experts, that’s 265 per expert per week, and you divide that out by five days that they’re working a week, so that’s 53 a day and divide that by eight hours. So they’re approving about six apps every hour. Okay. So that doesn’t actually sound like a ton of apps to review. Like it, basically, they’ve got almost 10 minutes, you know, nine to 10 minutes.
Kirk McElhearn 16:32
And that doesn’t count the time they’re spending at the water cooler in the bathroom, talking to their friends, etc. They’re not working eight hours a day.
Josh Long 16:39
So okay, Let’s call it eight or nine minutes, then to review each app. Right? Yeah. So that’s still not a lot like that’s, it feels like that’s more time than you probably need necessarily for just like reviewing apps. But you know, at the same time, I’m very confused about this, right? Because you’ve also got these things that get submitted to the App Store that turn out to include a whole bunch of pirated content, you get things like a fake LastPass app that somehow got approved and put in the App Store, whichever one of these 500 so called experts that’s evaluating every single app, not you know, whatever one happened to be reviewing that last pass, didn’t realize that there’s a password manager called Last Pass that with almost exactly the same logo, like how to how can they call these people experts. I’m so I’m so frustrated.
Kirk McElhearn 17:34
Yeah. And we’ve talked a bit about the scam apps, we’ve talked about scam blown apps and Indian other countries. It’s one thing that they can stop fraud by blocking automated accounts, and stolen credit card numbers. And all that is just, you’ve got a computer running in the background, that box accounts, they talk about the terminating 118,000 developer accounts, which was a decrease from 14 to 28,000, the prior year. But this was thanks to continued improvements to prevent the creation of potentially fraudulent accounts in the first place. And that’s good, okay, that’s good, that they’re keeping some bad developers out. But there are so many more who are getting through, this is standard PR, they came up with a good number of $7 billion in four years sounds really good. But it hides all of the rest that we’ve talked about. And it doesn’t have to be 1000s of fraudulent or scam apps, even though there are it only takes a handful to defraud people. Now the press release also talks about 38,000 app submissions that were rejected for containing hidden or undocumented features. I know a bunch of developers whose apps were rejected for containing hidden or documented features, often at the stage of an update after the app had been in the store for years and years and years, and they did tiny update, and all of a sudden someone’s Well, you shouldn’t be doing this. I’ve been doing it for five years, but you shouldn’t have. So how many of these submissions that were rejected were really malicious, or just reviewers or the review process that flagged things that shouldn’t have been flagged?
Josh Long 19:02
Right? That’s actually a really good point. A lot of legitimate apps are included in this 38,000 rejections for allegedly, you know, hidden are undocumented features. Meanwhile, you’ve got again, like things like piracy apps that are getting approved, like how how exactly does that happen? It’s so frustrating to me to see Apple call these 500 people experts, maybe some of them are experts, but to say that they’re all experts and really know what they’re doing. This is real PR work here. I mean, this is on Apple’s newsroom, right so like it’s very intentional PR, but Apple’s giving themselves a little too much credit here.
Kirk McElhearn 19:44
Okay, we want to mention briefly a bug in the latest iOS update now according to The Verge, iPhone owners say the latest iOS update is resurfacing deleted nudes. Okay, it’s not just resurfacing deleted news. Apparently the person who started a Reddit thread talked about Add some Not Safe For Work photos they had deleted years ago that were back on their iPhone. And some other people said this is true as well. But it’s not just nudes that are being resurfaced. One user said that photos from 2016 showed up as new images, but that they didn’t think they’d ever deleted them. So it’s not clear. Now, I haven’t seen any deleted images come back. But the first thing I thought of is, well, that means if these deleted images and come back, that means that when you delete images, they don’t get deleted, right?
Josh Long 20:30
That certainly seems to be the case. Yeah. So what exactly is happening when you delete an image? Is it actually getting deleted from iCloud? Or does it just go to some limbo state where you can’t see it, but Apple is actually still holding on to it. I wonder what actually went on behind the scenes here. Maybe what happened is that Apple had some decommissioned old server that they put back into use, and it happened to have some old pictures stored on it. And maybe that’s how these things accidentally got reintroduced. Apple hasn’t said what exactly went on here, behind the scenes, and they probably won’t say anything about it. But it does make you wonder, like what really happens when you delete your pictures?
Kirk McElhearn 21:17
Well, one speculation in the Verge article is, and I quote, this could be more innocent than it sounds. Computer data is never actually deleted until it’s overwritten with new ones and zeros operating systems simply cut off references to it. So yes, when you delete an item on your device, you’re basically deleting the catalog information to that file. But I can’t imagine an iPhone for years. Even if you migrate from one old iPhone to a new one and copies everything, I can’t imagine that it would still have remnants of a bunch of photos on the phone like that. Now, you could get this with an old hard drive, there are tools you can use to recover files on hard drives. Now another user on Twitter pointed out that voicemails he’d already listened to or deleted had reappeared before the update, he says I had only one unheard voicemail, but now I have 26. So this sounds more like Apple service. It doesn’t sound like the voicemails are hanging out on your phone. Still entirely possible. But every time you’re adding more stuff, and you’re doing operating system updates, and you’re migrating to a new phone doesn’t sound possible. What it does say is that this stuff is never deleted, when you think it is and that someone somewhere may have that photo of you doing what you were doing.
Josh Long 22:31
And although this was just someone on Twitter saying this apparently beta testers also said the same thing about earlier betas of iOS 17 About voicemails coming back. So this is an issue. We don’t know exactly how widespread it is. But at least some people have experienced this.
Kirk McElhearn 22:48
Before we finish we have to talk about OpenAI as GPT four Oh, so it’s number four letter O stands for Omni. This is pretty creepy. This is a new version of GPT. It’s a chatbot that can use your camera and look at things through your phone and speak to you and answer questions. And we’re going to link to the videos from OpenAI and they’re creepy. If you’ve ever seen that movie Her with Scarlett Johansson, this is what it’s like the Chatbot has that same kind of loyalty, female voice very friendly, very, I don’t want to say seductive, but very open and helpful and all of that. And I want to say it sounds scripted, but I think it wasn’t scripted. And this is just really the way this Chatbot is going to work. And I hope they license Scarlett Johansson’s is voice for it.
Josh Long 23:38
Yeah. So this, there’s one particular video that will link to in the notes again, there’s nothing like overtly like sexual or anything like that. But it’s just like the way that this chat bot talks to this, you know, again, with a female voice, by the way, it talks to this man who is working for he says in the video that he’s applying for a job at OpenAI is what he claims. And so he’s having this conversation with the chat bot and asking about, you know, Am I dressed, okay, and she gives them a response. But there’s a lot of giggling going on. And it’s very, like playful. And and many people responded to this by saying that it was like flirtatious. And a lot of people felt really uncomfortable with how the chat bot was talking to him.
Kirk McElhearn 24:32
The one that I think is really cool. It’s a real time translation where there’s an American and a Spanish speaker talking to each other, and the chat bots translating in real time. And it sounds pretty good. That I think is very cool. And that is a really useful tool. You know, imagine that you’re on vacation someplace in a country. You don’t speak the language and you pick up your phone and you talk. You’ve already got apps that can do this, right? They can give you the words but you don’t know how to pronounce them and maybe the apps can pronounce them with that Stephen has Looking type voice or a little bit better, but this is like, this is like a real time interpreter going from one language to the other.
Josh Long 25:07
Yeah, and I actually have seen people do something very similar just using Google Translate. When I traveled to Romania, once I had a cab driver, who had his android phone mounted in the car, and he was chatting back and forth with me using Google Translate. So I would say something in English, it would translate it into Romanian for him and vice versa. So the technology is similar technology has already existed. But now, what’s different about this is that you can have a real time, basically a translator doing this for you, because you can have it in always listening mode and give them the instructions. Hey, anytime that you hear a prompt in this language, translate it immediately into this language. And anytime you hear that language translated back into my language, and there have been a couple of demonstrations of that they did one live and other was also a pre recorded video as well. It’s pretty impressive technology. But remember, this could potentially put some people out of business, just like a lot of AI tools these days, are a little bit concerning for some creative types. And now in this case, not necessarily a creative, but just somebody who has language knowledge. That’s not to say that these things are actually going to do a better job than a real world translator because they will understand nuances of languages, possibly better than OpenAI is tools. But it is yet another bit of AI that might be taking away people’s jobs.
Kirk McElhearn 26:38
I worked as a translator for many years when I lived in France. And I knew a number of people who worked two simultaneous interpreters. So that’s the person who stands between two people and translate back and forth, these people are going to be able to work now. You may not hire open a eyes, iPhone app to translate at the United Nations. You may hire it when there’s a business receiving people from China or Japan and needs real time translation on the spot. And there is another tool that was just announced I forget who did it that can do that can take a video, do translation and dubbed the video in the voice of the actor with the correct mouth movements for that actor speaking another language. So this is people who do voice over work for dubbing for TV series and films are going to be out of work as well. It’s buggy whips. There’s a lot of buggy whips that are going to go into here with these new tools.
Josh Long 27:32
One more interesting thing from the OpenAI announcements is that they released a Mac app. It’s not necessarily widely available yet when I went to look for it on their website yesterday, there was no download link for it. You can find download links. If you look around, there are people who’ve shared the link. Be careful about that though, because you don’t want to download a malicious app that pretends to be the OpenAI app. So be aware of that. If you do use ChatGPT. Then once the new four Oh model rolls out to you, you’ll have access to it and they will give you a link to download the Mac app at that point in time. But it’s interesting that OpenAI is releasing this app for Mac first not for Windows, even though OpenAI has a big partnership with Microsoft kind of a fun fact.
Kirk McElhearn 28:22
Well, one of the rumors about Apple’s WWDC which starts on June 10 Is that Apple will be announcing a partnership with OpenAI. We’ll find out in four weeks. Until next week, Josh stay secure.
Josh Long 28:33
All right, stay secure.
Voice Over 28:36
Thanks for listening to the Intego Mac podcast, the voice of Mac security with your host, Kirk McElhearn and Josh Long. To get every weekly episode, be sure to follow us on Apple Podcasts, or subscribe in your favorite podcast app. And, if you can, leave a rating, a like or review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com. The Intego website is also where to find details on the full line of Intego security and utility software. intego.com.
