A warning about dangerous materials being used in Apple watch bands, the FBI has been able to quietly remove malware from computers remotely, and it’s not the first time we try to make sense of the TikTok situation in the United States, and the latest Apple updates for beta testers contain more Apple intelligence features, but how many users will opt out.
If you like the Intego Mac Podcast, be sure to follow it on Apple Podcasts, Spotify, or Amazon.
Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you’re ready to buy.
Get Apple security news delivered straight to your inbox, for free. Intego’s twice-monthly newsletter will keep you informed about Apple-related privacy and security, along with tips and tricks for getting the most out of your Mac or iPhone. Subscribe for free—no strings attached.
Voice Over 0:00
This is the Intego Mac podcast—the voice of Mac security—for Thursday, January 23 2024. This week’s Intego Mac podcast security headlines include a warning about dangerous materials being used in Apple watch bands, the FBI has been able to quietly remove malware from computers remotely, and it’s not the first time we try to make sense of the TikTok situation in the United States, and the latest Apple updates for beta testers contain more Apple intelligence features, but how many users will opt out. Now here are the hosts of the Intego Mac podcast. Veteran Mac journalist Kirk McElhearn and Intego’s chief security analyst, Josh Long.
Kirk McElhearn 0:49
Good morning. Josh, how are you today? I’m doing well. How are you, Kirk, I’m doing just fine. We had some updates to Apple operating systems yesterday, but not for everyone.
Josh Long 0:58
Right We got the release candidate for iOS, 18.3 that just came out. And I think there were some other release candidates as well that all came out yesterday, as of when we’re recording this, which was Tuesday.
Kirk McElhearn 1:11
All the dot three release candidates. So macOS, iOS, iPadOS, watchOS, I think TVOS as well, I’m not sure, because I don’t install TVOS betas. So this is a big deal because is, this is the next dot release of features that Apple announced last June. In other words, actually, there’s not much new in this, in terms of Apple intelligence. But as we’ve been seeing since the dot zero released into September, each additional dot release. So dot one, dot 2.3, has added more features in Apple intelligence. One of the interesting new features in the dot three is that Apple intelligence is enabled and you have to turn it off. You have to opt out to disable this. Previously it was not enabled, you’d have to go into the settings, which says Apple intelligence in Siri, you have to turn it on. After that, you have to download the necessary software for it, which we’ll talk about in a minute. But now it’s requiring an opt out. And this is kind of, I mean, for a couple reasons, this is bad. First of all, they’re still calling it a beta, so you don’t make people opt into a beta by default.
Josh Long 2:19
Well, yeah, it’s, it’s, it’s not letting them opt in. It’s opting them in, which is, yeah, that’s kind of a weird practice for for a beta. So that’s a little bit awkward. But I mean, you can still turn it off, like, if you really don’t want to use it. And again, as we mentioned many times, not everybody actually gets Apple intelligence. So on the iPhone, if you have a 15 Pro or any of the 16 models, then you get Apple intelligence, and it will be on by default in iOS 18.3 if you have any other iPhone model besides those, when you get iOS 18.3 you’re not going to get Apple intelligence on it. So it’s not something you need to worry about one way or the other.
Kirk McElhearn 2:59
There’s one reason why you might want to turn this off on my iPhone, 16 plus 16 Pro plus 16 pro Max. Sorry, I get confused with all these weird naming conventions of Apple. It takes up almost six gigabytes. Now, on the 16 Pro, it starts with 256 but on the basic 16 models, it starts with 128 gigabytes. You might not have space to add an extra six gigabytes of system software to your phone.
Josh Long 3:24
It is something you need to be aware of, and Apple does tell you how much space it’s going to require to install the update. So presumably, this Apple intelligence that will now be included by default and no longer a separate download, will be rolled into the requirements on how much space you need in order to install the update.
Kirk McElhearn 3:44
Is that what they’re saying? Because when I downloaded the release candidates, I just saw the size of it as, I don’t know, seven gigabytes, which is probably what a release candidate is, or maybe that included the Apple intelligence with the update to the Apple intelligence software. See before what happened is it didn’t download until you turned it on. So maybe the reason that they are forcing people to opt in is to make sure they download it so they don’t have to wait to download it if they do turn it on, but it’s on if they turned it off and then turned it on. You see my point?
Josh Long 4:13
Yeah. So I guess that is a question I and I haven’t seen whether, because, of course, my device that I’m using the release candidate on is actually not an Apple intelligence compatible device. I have not put the release candidate yet on my main device, which does support Apple intelligence, and I already have Apple intelligence enabled on all my devices that are capable of it. So I don’t really have, like, a test device that I can see whether there’s an additional download that still happens after you do the update, if you had it turned off previously. So I guess there is a question about that.
Kirk McElhearn 4:49
It makes me wonder, as they update the Apple intelligence models, will this require large updates? And the problem again, for people who don’t have a lot of storage on the device that might not be able to install the updates.
Josh Long 5:01
Well. And you know, to be fair, you do have to have at least 128 gigs of storage on your device, because Apple intelligence doesn’t is not compatible with any phones that have less than 128 right? Probably the same, I think, for iPads, I would guess, as well. And on the Mac, of course, you don’t ever really have 128 gigs of storage. You always have more than that.
Kirk McElhearn 5:25
Well, I think in recent years, the smallest was 512 if you go back to the m1 the early M1 Macs, you could get 512 gigabytes. On my iMac, it takes up only around five gigabytes, so almost a gigabyte less than it does on the iPhone. This is because the iPhone has the visual intelligence, right, which isn’t on the Mac. So there’s probably the Apple intelligence software depends on the device and the features it has, so my iPad is too far away for me to reach, but it probably uses less space than my iPhone does. Anyway, it will take up more space if you don’t want to use Apple intelligence, turn it off so you’re not annoyed when you press and hold the wrong button and something pops up. One other thing that changes in the dot three is that Apple has turned off temporarily notification summaries for news and entertainment categories, and this is because we talked about this a couple times recently, there have been some really weird notifications that notifications that sort of combine things and make it looks like something happened that didn’t happen. If I look on my iPhone settings, notifications. Summarize notifications. Here are the apps where it’s marked temporarily unavailable for notifications. Game Pass, because it’s an entertainment app, Mubi, which is a streaming service, the mute apples, music app, Netflix, NET News Wire, which is an RSS reader, New York Times, The Guardian, Sonos, which really the notifications aren’t, you know, it plays music, but that’s it. Steam and Xbox. So all of these are just because of the two categories, entertainment and news. I don’t know that entertainment apps had a problem with notifications, at least not that I heard about.
Josh Long 7:07
That one surprises me too, and it’s really specifically news that I’m aware of as being something that a lot of people have been reporting on as problematic. But maybe there are some entertainment news apps that categorize themselves as entertainment, and maybe that’s why. But in any case, Apple has chosen those two categories news. I’m not surprised about entertainment. That one is surprising to me too. I agree.
Kirk McElhearn 7:31
Okay, this isn’t strictly Apple news, but I did want to mention this because the Guardian had an article that surprised me recently. Smart watch bands can contain major levels of toxic PFAs. Study Finds PFAs are per and polyfluoroalkyl substances which are considered to be carcinogenic. And a group did a study of watch bands for smart watches, and found that the levels detected in some of these bands were much higher than most PFAs we have seen in consumer products. Now, Apple has a number of different bands for the Apple Watch. The only one that’s concerned here, as far as I can tell, is the Sport band, which is made of fluoroelastomer the solo loop is what they call liquid silicone. These are actually terms of art in the synthetic rubber industry. This liquid silicone is actually a term. It Apple didn’t make it up. It sounds like Apple made it up. The ocean band is elastomer, so it looks like the only one that could be affected is the Sport band. But this is a problem, because these, these are called Forever chemicals, because they’re hard to get rid of, and the Guardian article says it’s commonly used on clothing, carpet, paper and insecticides, and is linked to liver disease. So I don’t want to say that if you’re using an Apple Sport band, you should get rid of it right now. The Guardian article does say that watches with silicone bands are a safer alternative, so that means the solo whoop or any of the textile versions of Apple watch bands, like the one you have, Josh, any of the metal bands are fine, you know, the Melanie’s loop and all those. But maybe be careful, because you’re wearing this. Some people wear it almost 24 hours a day. If they track their sleep, you’re sweating on it, so the salt in your sweat might do something to get the chemicals to leach into your skin.
Josh Long 9:16
One of the experts that they cite in this article says, at the very end. I don’t need someone to rush to throw away their Christmas gifts, but next time you buy one, move away from those with PFAs. So that’s the advice from from the expert. It’s not that you necessarily need to get rid of these immediately, but they are considering banning this particular chemical in the EU and so it may also be a chemical that eventually gets banned in other countries as well.
Kirk McElhearn 9:42
I haven’t seen Apple say anything about this yet. Maybe they’ll say something. Maybe they won’t. We want to talk about how the FBI hacked computers to hack malware, and this always makes me uncomfortable. Like, okay, we hacked into your computer because it had malware. But if you could hack into my computer, if you’re the FBI. You could hack into my computer? What else could you do?
Josh Long 10:01
Well, that’s exactly the concern, and one would hope that the FBI is only going to use this hacking capability for, you know, positive purposes, right? Where they’re only going to be removing malware. They’re never going to be installing malware through these hacking attempts.
Kirk McElhearn 10:20
But not even installing malware. If they can get into my computer, what can they read? What sort of data can they collect? I mean, the FBI hasn’t always been trustworthy in the past.
Josh Long 10:30
Well, yeah, and I think that’s that’s the big concern here. When you see a headline like, FBI hacked 1000s of computers, it doesn’t really matter what comes after that. It automatically puts people on alert. Like, wait, hold on. Wait, what they did, what to make malware uninstall itself? Is like, Well, okay, I mean, like, I guess maybe the ends justify the means, but but at the same time, like, if it were my computer that had malware on it, I don’t know how comfortable I would feel with some intelligence agency hacking into my computer, why not just let me know so that I can clean up the infection? But I guess the idea in this case was that this was widespread enough that they felt it was in the public interest to take action on their own. Now this in this particular case, there were 4200 infected devices in the US that they say was infected with state sponsored malware from hackers in China. That’s according to the the subheading on this article.
Kirk McElhearn 11:30
Oh, so they were just uninstalling TikTok ?
Josh Long 11:33
No, not TikTok, no. This was like, actual malware, not like, you know, okay, potential sort of spyware. But okay, yeah, no, no, this. This was the kind of attacks, sort of like we’ve talked about Pegasus in the past, which many countries use to hack into the phones of people who are suspected terrorists, or, unfortunately, sometimes journalists and others who have not necessarily committed egregious crimes, but are just people of interest that a government wants to track. So this was a big deal that these computers had been attacked with nation state spyware or malware in the first place. So the FBI was doing something good by cleaning that off of these systems. The concern is that the FBI hacked computers in order to do that.
Kirk McElhearn 12:26
Didn’t they do something like this a couple years ago, I seem to remember we discussed a similar situation.
Josh Long 12:31
Yeah, this does happen from time to time. It’s definitely not the first time that we’ve ever seen something like this, where an intelligence agency hacks in order to remove malware, and we’ve definitely seen this before, also, I think, with routers and other things like that as well. So it’s not just computers. There are lots of internet connected devices that can be infected, and sometimes they will stay pretty much permanently infected unless somebody takes action. In this time, it was the FBI that decided to take action.
Kirk McElhearn 13:00
Okay, we’re going to take a break. When we come back, we’re going to talk about more malware. We’re going to talk about TikTok and more.
Voice Over 13:08
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Download the free trial of Mac Premium Bundle X9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the special discount link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.
Kirk McElhearn 14:19
Okay, more malware, more fake Google Ads Homebrew. This is your kind of story, isn’t it, Josh?
Josh Long 14:24
Yeah, this is something that we’ve been tracking for a while. In fact, we wrote an article about something called Cuckoo this was a malware family that was in the news last May, and how Intego had discovered some new variants of this Cuckoo Mac malware that was mimicking the Homebrew website. Homebrew is a package manager for Mac that basically allows you to install command line utilities that are really popular on Unix, like operating systems like Linux and things like that. In fact, macOS even has many of these types of utilities. Built in that you can run from the command line. Homebrew often will offer you newer, more up to date versions of some of these things we’ve mentioned before in the past, that Apple includes a lot of open source command line software that unfortunately doesn’t always get updated to the latest version very quickly. So Homebrew is sort of an alternative way to do that, the real Homebrew that is the problem here is that threat actors have created these fake Homebrew websites that look nearly identical to the official Homebrew site, and because of the way that Homebrew is installed, it’s a little bit unusual. You copy and paste a string of text from the website and you paste it into the terminal app on your Mac in order to install it. Now, that should raise some red flags, because normally you don’t want to copy and paste anything into your terminal. This can, of course, be potentially malware if you don’t know the original source, so the official, real Homebrew site, that’s a totally legitimate way to install that software. The problem is, what the bad guys are doing is they’re buying up Google ads, so they show up at the very top of Google results. In the sponsored link at the very top of Google search results, it shows that it’s going to take you to brew.sh which is the official Homebrew web page, but if you click on that ad, it actually takes you to a malware distribution site. If you copy and paste from there, you’re going to actually be installing malware onto your Mac.
Kirk McElhearn 16:37
So wait a second. How does Google get away with this? How is how are they not responsible for this sort of thing?
Josh Long 16:44
That’s a great question. Kirk, I would love to know the answer to that, because this has been ongoing for literally years at this point.
Kirk McElhearn 16:50
But most of these ads don’t have the actual URL of the site that they’re imitating, right?
Josh Long 16:56
Yes, and that’s exactly the problem, because the ad will show you that it’s going to take it looks exactly like a legitimate ad would look for the software. It literally tells you that it’s going to take you to brew.sh the real website, but it doesn’t take you there. And it’s shocking to me that Google is still allowing, after years of allowing malware makers to do exactly this thing. They’re still allowing this to happen in 2025 like, How is this even still happening?
Kirk McElhearn 17:30
I hate to say it, the only way they’re going to change is if they’re forced to change. And the only way that would happen is if there’s some sort of class action suit or something. And since most of the people this happens to don’t really notice it until after the fact, it’s hard to hold them to account. The problem is, anyone can make a Google ad. It’s not reviewed by a human it’s probably reviewed by some sort of filter that looks for keywords, if not even an AI, right? The way Google Ads work is it’s kind of an auction. You say how much you’re willing to spend for specific keywords that people search for, and you have competitors, and so you put a higher price, and so the malware people are putting the highest price, so they always get the ads, or get them often enough. But this whole system is just designed to scam both advertisers and users.
Josh Long 18:18
And in fact, if it’s something that nobody else is advertising for that keyword, like maybe, if somebody’s searching for Homebrew, this is just open source software, they’re probably not buying up ads on Google. And so this is an opportunity for the malware makers to come in and buy ads for something that nobody else is buying ads for. So they can always just show up at the top of results. Now I say always. That doesn’t necessarily mean that every single time you do a search for Homebrew, it’s going to come up with a malicious ad. This is something that can happen, and so if you go and search for it right now, you may or may not actually see an ad for Homebrew that’s going to take you to a malicious website. But this is a possibility, because over the past several weeks we’ve seen this happen with multiple different websites. Now it’s it’s not just one website. It’s not just once that this has happened. It’s been at least two different sites that I know of off the top of my head, just over the past week and a half.
Kirk McElhearn 19:14
Okay, time to talk about TikTok. Everyone’s talking about TikTok, aren’t they? TikTok has been banned. There was a bill that went through Congress. It was signed by President Biden. It went to the Supreme Court. The ban was supposed to take effect on the 19th of January, which is coincident with the last day of the Biden administration. The ban went into effect, and yet, apparently it’s not banned, sort of maybe because the new president said, Well, don’t worry, you’re not going to get in trouble. But when you look at the legal process, a bill through Congress, Supreme Court, it’s not like a president can just say, Don’t worry, we’re not going to prosecute you. So TikTok went back into service in the US about 12 hours later, but Apple and Google are. Smart enough to know that they’re not going to put it on the App Store in case they end up getting fined, because this is there were fines in the bill, and the Supreme Court validated this, etc. This is a very strange situation.
Josh Long 20:11
One of the things that I think is interesting about this is that, well, first of all, Apple actually put out a support article about this. Talking about the article is actually called about availability of TikTok and bytedance Limited apps in the United States. We didn’t mention last week that other apps, including cap cut, are affected. Cap cut is a popular video editing app that many people who use TikTok use it, but you know, even if you’re creating Google shorts or any other kind of vertical, short form content you might be using cap cut that also now is part of this ban on apps created by or distributed by bytedance. So the interesting thing about this is, even though TikTok is now operating again, if you search for TikTok in the app store in the US, you will get a notification at the top that says, TikTok and other bytedance apps are not available in the country or region you’re in. Learn more that will take you to the support article that we just talked about. So what could happen here potentially is that if the TikTok app, if some vulnerability were found in the TikTok app or cap cut and they wanted to push out an update, they couldn’t get that update to you because Apple is now and Google as well. They’re doing the same thing. They’re not allowing anybody to download that app from the App Store, and that means that you’re also not getting updates to those apps anymore. So although if you already had the app downloaded, you can continue to use it again, you can’t get the app and you can’t get updates for the app. So that is potentially problematic.
Kirk McElhearn 21:51
One thing you were surprised about is the Marvel snap app. I don’t know what this is, but there’s a Marvel app that’s made by bytedance Regarding updates. It’s actually kind of interesting, because if you are not from the United States, and you go to the United States, according to Apple, you are unable to download update or make in app purchases and new subscriptions inside bytedance Limited apps while within the land or maritime borders of the United States. Now this is interesting, because when you’re traveling, you can update apps that come from an account in the country you’re from, or the region that your Apple device is set in. So why should they prevent you if you have, let’s say, a UK account, and you travel to United States, why should they prevent you from updating or downloading an app? That seems to be a bit harsh, but maybe that’s what the law says, that they’re just not allowed to offer it in any way. You would, at least for updates, for security updates, it would make sense. But on the other hand, couldn’t bytedance say it’s a security update and add new features like, you know, more spyware and location tracking and all that that they don’t want. So this is a real mess, in the sense that this is involved Congress, the Supreme Court and two presidents, and it’s not going away anytime soon.
Josh Long 23:05
By the way, I will mention that if there were, like a zero day vulnerability, like something where somebody could exploit this, some vulnerability in this app on your device, I do think that in that situation, Apple could pull its trigger to actually remove an app from your device or prevent it from launching. I don’t know. I’m trying to remember any specific scenarios where Apple has done this in the past, but they did say when they first implemented the App Store that they do have a kill switch that they can remove apps from iPhones if there ever is a situation where an installed app is known to be malicious, they can actually remove it from from devices.
Kirk McElhearn 23:49
Can you imagine the controversy if Apple did that to TikTok right now?
Josh Long 23:53
And that’s exactly why I think there’s a slim number of scenarios where that might actually happen. It would have to be a really serious vulnerability for Apple to pull the trigger like that.
Kirk McElhearn 24:03
Okay, we talked about AI Apple intelligence. Microsoft has added their Copilot feature now to all Microsoft Office subscription I’m sorry they’re calling it Microsoft 365 now they change so often. Two things are going on. One is they’re raising the price of these subscriptions whether or not you want to use Copilot, which is Microsoft intelligence, right? The second thing is, it’s really hard to turn it off. And a few days ago, I saw a lot of people on social media, I guess when they got the latest update to the apps complaining about this. And we’ll put a link in the show notes to explain how to turn it off. The problem is, when you turn it off, you still see the Microsoft Copilot logo in your documents waiting to be clicked on. And you know how it is that you see a icon right next to text in Word, you just have to go see what it’s saying, and it’s telling you, well, you can’t do this because your settings are wrong. So click here to change your settings. This is kind of evil. Now, to be fair, Google. It’s the same thing in Google Docs, and we do our show notes in Google Docs, and we have a shared document, and I’m looking at it now, and in the margin there are four icons. One says, help me write. One says, suggest edit. So those are the AI tools that come from. Was it Google Gemini? I kind of feel this is getting out of hand, because most people don’t really want these features, don’t really see the need to have these features. And Microsoft charging more for features that you may not even use is a bit they’re really pushing it with this. I think.
Josh Long 25:31
Yeah, this is one of those things that like it’s sort of not everybody’s going to be concerned about this, right? And some people are not really going to worry about it .
Kirk McElhearn 25:40
Well, until they renew their Microsoft 365 subscription and they’re paying $20 more.
Josh Long 25:45
Well, right? That’s, I guess, where this is potentially problematic. But we’re seeing this kind of thing, something similar to this happening across multiple industries. You know, for example, Disney plus and Netflix have recently announced huge price hikes. I mean, you know, it’s a couple of bucks, but when you’re talking about the percentage, you know, of the total cost of it, it’s, it’s not an insignificant price hike. And this is largely because they’re deciding that they’re now going to be bundling some sports content, you know, for example. And I think Apple TV plus is now doing the same thing as well. They’re bundling sports content, and so that likely means that with all of these services, as they continue to add new things that you may or may not actually want to use, they’re going to continue to get more expensive. And it’s the same thing with Amazon spending a ton of money on TV series that you may or may not be interested in watching, but now the whole service is going to cost more money, so Copilot, I kind of understand raising the price for something like that, because Microsoft has had to invest a lot of money in open AI to get access to GPT four technology that now Copilot is based on, right?
Kirk McElhearn 26:58
Yeah, but Microsoft is the master of having multiple adjective versions. I mean, why can’t they have the Microsoft 365 Family Edition without Copilot?
Josh Long 27:06
Yeah, I suppose, I suppose they could do that.
Kirk McElhearn 27:12
What about for the enterprise? For businesses who don’t want to use this, who absolutely don’t want this on their computers?
Josh Long 27:18
That’s a fair point, because I do think there is a case for that. I know that there are some businesses that have decided we are not an AI business, right, like, as long as AI is potentially snarfing up our data, our proprietary information, and using it to train itself, we don’t want any part of that, because either they’re in an industry where they have to be really, really careful about that, for example, in the medical industry, right where there’s HIPAA and or other laws in other countries that have really strict protections on what is allowed to happen with any sort of patient related data. And so there are scenarios and industries where they have to be extremely careful about AI and what can be trained based on what they’re working with, right? So I think in a business environment, there’s definitely a case to be made for giving users an option, or enterprises an option to shut that off completely.
Kirk McElhearn 28:22
Okay, we have a story that’s a couple weeks old that I wanted to talk about, about Samsung rolling out a smartphone subscription, because I think this is something Apple is going to do at some point. Samsung, as we speak, is doing their Galaxy unpacked live event where they will probably talk about this. So next week, we’ll discuss smartphone subscriptions. If Samsung does indeed do this, I like the idea you pay a subscription for your phone, for your Apple Care protection, or whatever Samsung care, or whatever it is. You’ve got your cloud storage, you put it all in one little box, and you have a monthly fee. I’ve been thinking that Apple should do this for a long time. Anyway, we’ll talk about that next week when we know more about Samsung until next week. Josh, stay secure.
Josh Long 29:03
All right, stay secure.
Voice Over 29:06
Thanks for listening to the Intego Mac podcast. The voice of Mac security with your hosts, Kirk McElhearn and Josh Long. To get every weekly episode be sure to follow us in Apple podcasts or subscribe in your favorite podcast app, and if you can leave a rating, a like or a review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com. The Intego website is also where to find details on the full line of Intego security and utility software. intego.com.
