Some great work by Google researcher Dr. Elie Bursztein has led to Apple increasing security on its iOS App Store. Last July, Elie reported a number of vulnerabilities in the App Store to Apple. As of January, they have been fixed. It appears that certain areas of the App Store were not using HTTPS, and as a result, it was possible for attackers to execute a number of different exploits on users.
HTTPS is a protocol widely used to secure web traffic. By using HTTPS, companies employ an added layer of security to their users’ web traffic. When properly implemented, HTTPS helps ensure that when a user communicates with a server, that the server is indeed who they say they are (and not a malicious third party) and that the contents of their conversation stays private and unmodified. Without HTTPS, not only is it possible for a third party to view your traffic, but it is also possible for a third party to modify the traffic that you are sending and receiving without your knowledge.
In the case of Elie’s exploits, it was shown that due to the lack of HTTPS in certain areas of the App Store, it was possible for a third party to perform a number of attacks: stealing App Store passwords, installing an app other than the one the user was requesting, installing fake upgrades, preventing users from installing certain apps, and even obtaining a list of all apps a user has installed on their device. This was accomplished with scripts that Elie wrote to intercept the HTTP request and alter the responses sent back to his device. While an iPhone might request an app like Angry Birds, the response could be modified to instead serve up Real Racing to the device.
This isn’t the first time we’ve seen a company forget to secure all of their sensitive URLs with SSL and it certainly won’t be the last. Fortunately there don’t seem to be any reports of these vulnerabilities being exploited in the wild (though that’s not to say no attacks occurred and simply went unnoticed) prior to Apple’s fix. It’s also important to note that such attacks would have required a user to be on an unencrypted network with an attacker; this isn’t something that would be done while connected to an encrypted wifi network at your home, or while using your data plan with your cell provider.
Another reminder for users to remain vigilant in good security practices, and not connect their devices to unknown or unsecured networks.

Music MiniPlayer brings some 2007 iTunes nostalgia to your modern Mac
Fans of the classic iTunes Mini Player are in for a treat because someone came to our rescue and brought it to the Music app on modern macOS.

Apple begins notifying the winners of its WWDC22 Swift Student Challenge
Apple has begun to email winners of its WWDC22 Swift Student Challenge, with some taking to Twitter to share the news of their success.

Review: Multi-device charging has never looked so good with this power bank
Take the Excitrus Power Bank along when you have a lot of devices on-hand and not enough juice. This battery pack can charge four devices at once, including a MagSafe-compatible iPhone and a MacBook.

Yes, your iPhone 13 Pro can look super cute with the right case
The iPhone 13 Pro's colorways might be neutral, but it can still be an amazing and outfit-enhancing accessory with one of these cases.