Andrew Orr's photo

Andrew Orr

Since 2015 Andrew has been writing about Apple, privacy, security, and at one point even Android. You can find him most places online under the username @andrewornot.

Get In Touch:

Check Out These Colorful X-Ray Wallpapers for Your iPhone

The Basic Apple Guy (via 9To5Mac) created a series of colorful iPhone wallpapers based on the X-ray images from iFixit. These iPhone 13 Pro | Pro Max schematics are a fun way to let you know the details hiding underneath your display. “Ten different designs have been created: Black, Xray, Sunset, Slate, Neon Blue, M1, Card, Blueprint, Rainbow Bloom, & Rainbow . And as a special treat, I’ve also added three additional designs: 3021, R08135, & DF, which celebrate figures in the community I admire. I plan on creating other colour patterns to release over the next few months, with these 11 being the first of many to come.”

Explaining 'log4j' and Why it's a Serious Cybersecurity Threat

In early December a cybersecurity threat was discovered with the popular “log4j” utility. The Post has a good piece on the exploit, explained in non-jargon.

The fact that log4j is such a ubiquitous piece of software is what makes this such a big deal. Imagine if a common type of lock used by millions of people to keep their doors shut was suddenly discovered to be ineffective. Switching a single lock for a new one is easy, but finding all the millions of buildings that have that defective lock would take time and an immense amount of work.

Wi-Fi Gateway From Airangel Affects Hundreds of Hotels

Security researcher Etizaz Mohsin says that the Airangel HSMX Gateway, used by many hotels to offer Wi-Fi to guests, contains hardcoded passwords that are easy to guess.

With those passwords, which we are not publishing, an attacker could remotely gain access to the gateway’s settings and databases, which store records about the guest’s using the Wi-Fi. With that access, an attacker could access and exfiltrate guest records, or reconfigure the gateway’s networking settings to unwittingly redirect guests to malicious webpages, he said.

Ledger Adds Polygon (MATIC) Support in Ledger Live

Owners of a Ledger cryptocurrency wallet can now manage, buy, and swap MATIC through the Ledger Live app. Polygon (MATIC) is a full-stack Ethereum scaling platform allowing fast transactions and low fees.

You can now create a MATIC account in your Ledger Live app, buy MATIC with our partners (MoonPay), swap them (1inch or Paraswap) and send them through your Ledger Live app, with no need for another wallet! It’s convenient and safe.

'Dashlane' Password Manager Updates With New Menu, Quick Actions

Dashlane has updated its iOS app to help users save time. The way the Dashlane iOS app was structured, items in your vault, like passwords, personal and payment info, Secure Notes, and IDs, all required two taps to get to. Now, those key items are just a tap away thanks to the new horizontal menu sitting at the top of the main screen.  Dashlane has added something they call “quick actions” to items. By tapping the three dots on the right hand side of each item listed in the user’s vault, it will bring up a mini-menu that will allow users to copy different parts of their credentials or personal data, share or delete the item, or open the corresponding website. Dashlane has moved the notifications to the bottom menu of the app, right next to the home button. Now, users can’t miss security alerts, sharing invites, or product updates.

Sennheiser Leak Exposed 55GB of Data for Thousands of Customers

Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a cache of data from audio company Sennheiser. It appears to be from an old cloud account that’s been dormant since 2018. Over 28,000 Sennheiser customers were exposed, with sensitive private data leaked.

While it’s unclear how all this data was collected, it appears to be from customers and businesses requesting samples of Sennheiser products.

Examples of entries: Full names, Email addresses, Phone numbers, Home addresses, Names of companies requesting samples, Number of the requesting company’s employees

Here's What Coinbase and Intel Think About the 'Metaverse'

“The Metaverse” has been hyped in the news recently by companies such as Facebook/Meta. Brian Armstrong, CEO and cofounder of crypto exchange Coinbase, as well as Raja Koduri, Senior vice president and General manager of the Accelerated Computing Systems and Graphics Group at Intel, both recently shared their thoughts.

From Mr. Koduri: “Truly persistent and immersive computing, at scale and accessible by billions of humans in real time, will require even more: a 1,000-times increase in computational efficiency from today’s state of the art.”

From Mr. Armstrong: “The Metaverse is the distant evolution of Web3. In its most complete form, it will be a series of decentralized, interconnected virtual worlds with a fully functioning economy where people can do just about anything they can do in the physical world.”

'Pixelmator Photo' Launches for iPhone With 50% Off Introductory Deal

Previously only available for iPad, Pixelmator has released the Pixelmator Photo app on iPhone. It features over 30 desktop-class color adjustments, support for over 600 RAW image formats, including Apple ProRAW, deep integration with the Photos app and iCloud Photos, tools powered by groundbreaking machine learning technologies, and much more. It even includes the company’s ML Super Resolution tool, a way to scale up your images using AI. So far I haven’t seen any actions for Pixelmator Photo within Shortcuts. The price says that the deal is US$3.99, but it downloaded for free on my iPhone because I already had Pixelmator.

US Logistics Company 'D.W. Morgan' Leaks Data Through Amazon S3

A report from Website Planet reveals D.W Morgan left an Amazon S3 bucket unprotected, resulting in the exposure of over 2.5 million files.

An Amazon S3 bucket owned by D.W. Morgan was left accessible without authorization controls in place, exposing sensitive data relating to shipments and the company’s clients.

As a market leader, D.W. Morgan provides services to some of the biggest companies in the world and there are major Fortune 500 organizations with data exposed on the open bucket.

Google's Project Zero Deep Dives into NSO Group 'FORCEDENTRY' Exploit

Google’s Project Zero security team published a deep dive into FORCEDENTRY, a zero-click exploit in iMessage used by NSO Group. Apple’s Security Engineering and Architecture (SEAR) group collaborated on the analysis.

Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we’ve ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.

The vulnerability discussed in this blog post was fixed on September 13, 2021 in iOS 14.8 as CVE-2021-30860.