Home Blog Page 3831

Utilizing PreviewModifier to construct a previewing atmosphere – Donny Wals


Revealed on: July 10, 2024

Xcode 16 and iOS 18 include a function that permits us to construct elaborate preview environments utilizing a brand new PreviewModifier protocol. This protocol permits us to outline objects that may create a single context or atmosphere that’s cached and used throughout your SwiftUI previews.

That is helpful as a result of it implies that you possibly can, for instance, populate a database with a bunch of mock knowledge that’s then utilized in your previews.

You can too use PreviewModifier to use particular styling to your previews, to wrap all of them in a particular wrapper, and extra.

Basically, they’re a software that permits you to configure your previews constantly throughout the board.

Adorning views utilizing PreviewModifier

The PreviewModifier protocol specifies two strategies which you can implement:

  • A static makeSharedContext technique
  • An occasion technique known as physique

The physique occasion strategies is handed the view that’s being previewed and a Context. This context can both be an object that you just created in makeSharedContext or Void should you don’t implement makeSharedContext.

For this instance, let’s assume that you just went forward and didn’t implement makeSharedContext. In a scenario like that, we will use PreviewModifier to brighten a view for our previews. For instance, we might wrap it in one other view or apply some styling to it.

I’m fairly positive that you just’re extra artistic than me so I’m simply going to go forward and present you the way you’d apply a orange background to your previewed view. Yeah, I do know… very artistic. The purpose is to indicate you the way to do that so as to do one thing a lot smarter than what I’m describing right here.

struct OrangeBackground: PreviewModifier {
    func physique(content material: Content material, context: Void) -> some View {
        content material
            .padding()
            .background {
                RoundedRectangle(cornerRadius: 16)
                    .fill(.orange)
            }
    }
}

#Preview(traits: .modifier(OrangeBackground())) {
    Textual content("Good day, world!")
}

Let’s have a look at the PreviewModifier first, after which I’ll clarify how I utilized it to my preview.

The modifier is outlined as a struct and I solely carried out the physique operate.

This operate is padded Content material which is no matter view the #Preview macro is getting used on (on this case, Textual content), and it receives a context. On this case Void as a result of I didn’t make a context.

The content material argument could be styled, modified, and wrapped nevertheless you want. It’s a view so you are able to do issues like give it a background, remodel it, alter its atmosphere, and far rather more. Something you are able to do with a view inside a View physique you are able to do right here.

The primary distinction is that you just’re receiving a totally instantiated occasion of your view. Meaning you possibly can’t inject new state or bindings into it or in any other case modify it. You’ll be able to solely apply view modifiers to it.

This brings us to our subsequent function of PreviewModifier making a context to supply mocked knowledge and extra.

Utilizing PreviewModifier to inject mock knowledge

To inject mock knowledge into your previews by means of PreviewModifier all you have to do is implement the makeSharedContext technique from the PreviewModifier protocol. This technique is static and is named as soon as for all of your previews. Which means the context that you just create on this technique is reused for your entire previews.

In follow that is good as a result of it means you get constant mock knowledge in your previews with out the overhead of recreating this knowledge incessantly.

Right here’s what a pattern implementation for makeSharedContext appears to be like like:

struct MockDataSource {
    // ...
}

struct OrangeBackground: PreviewModifier {
    static func makeSharedContext() async throws -> MockDataSource {
        return MockDataSource()
    }
}

On this case, I’m creating an occasion of some knowledge supply in my makeSharedContext technique. This MockDataSource would maintain all mocks and all knowledge for my views which is nice.

Nevertheless, the one approach for us to essentially use that mock knowledge in our view is by including our knowledge supply (or the mocked knowledge) to our previewed view’s atmosphere.

struct OrangeBackground: PreviewModifier {
    static func makeSharedContext() async throws -> MockDataSource {
        return MockDataSource()
    }

    func physique(content material: Content material, context: MockDataSource) -> some View {
        content material
            .atmosphere(.dataSource, context)
    }
}

Since we will’t make a brand new occasion of our content material, we will’t inject our mock knowledge supply instantly into the view by means of its initializer. The one approach we will get the info supply to the view is by including it to the atmosphere.

This isn’t very best for my part, however the design is sensible.

I’m additionally fairly positive that Apple designed this API with mocking SwiftData databases in thoughts and it will work nice for that.

On high of getting to make use of the atmosphere, the PreviewModifier solely works in tasks that focus on iOS 18 or later. Not an enormous drawback however it will have been good if utilizing Xcode 16 was ok for us to have the ability to use this helpful new API.

New macOS Malware “Cthulhu Stealer” Targets Apple Customers’ Information

0


Aug 23, 2024Ravie LakshmananEndpoint Safety / Information Privateness

New macOS Malware “Cthulhu Stealer” Targets Apple Customers’ Information

Cybersecurity researchers have uncovered a brand new info stealer that is designed to focus on Apple macOS hosts and harvest a variety of knowledge, underscoring how menace actors are more and more setting their sights on the working system.

Dubbed Cthulhu Stealer, the malware has been out there underneath a malware-as-a-service (MaaS) mannequin for $500 a month from late 2023. It is able to focusing on each x86_64 and Arm architectures.

“Cthulhu Stealer is an Apple disk picture (DMG) that’s bundled with two binaries, relying on the structure,” Cato Safety researcher Tara Gould mentioned. “The malware is written in Golang and disguises itself as professional software program.”

Among the software program applications it impersonates embody CleanMyMac, Grand Theft Auto IV, and Adobe GenP, the final of which is an open-source instrument that patches Adobe apps to bypass the Artistic Cloud service and prompts them with no serial key.

Cybersecurity

Customers who find yourself launching the unsigned file after explicitly permitting it to be run – i.e., bypassing Gatekeeper protections – are prompted to enter their system password, an osascript-based approach that has been adopted by Atomic Stealer, Cuckoo, MacStealer, and Banshee Stealer.

Within the subsequent step, a second immediate is offered to enter their MetaMask password. Cthulhu Stealer can be designed to reap system info and dump iCloud Keychain passwords utilizing an open-source instrument referred to as Chainbreaker.

The stolen information, which additionally includes internet browser cookies and Telegram account info, is compressed and saved in a ZIP archive file, after which it is exfiltrated to a command-and-control (C2) server.

macOS Malware

“The principle performance of Cthulhu Stealer is to steal credentials and cryptocurrency wallets from varied shops, together with sport accounts,” Gould mentioned.

“The performance and options of Cthulhu Stealer are similar to Atomic Stealer, indicating the developer of Cthulhu Stealer most likely took Atomic Stealer and modified the code. Using osascript to immediate the consumer for his or her password is comparable in Atomic Stealer and Cthulhu, even together with the identical spelling errors.”

The menace actors behind the malware are mentioned to be not lively, partly pushed by disputes over funds which have led to accusations of exit rip-off by associates, leading to the principle developer being completely banned from a cybercrime market used to promote the stealer.

Cthulhu Stealer is not notably subtle and lacks anti-analysis strategies that would permit it to function stealthily. Additionally it is wanting any standout characteristic that distinguishes it from different related choices within the underground.

Cybersecurity

Whereas threats to macOS are a lot much less prevalent than to Home windows and Linux, customers are suggested to obtain software program solely from trusted sources, steer clear of putting in unverified apps, and preserve their programs up-to-date with the most recent safety updates.

The surge in macOS malware hasn’t gone unnoticed by Apple, which, earlier this month, introduced an replace to its subsequent model of the working system that goals so as to add extra friction when making an attempt to open software program that is not signed accurately or notarized.

“In macOS Sequoia, customers will not be capable of Management-click to override Gatekeeper when opening software program that is not signed accurately or notarized,” Apple mentioned. “They will want to go to System Settings > Privateness & Safety to assessment safety info for software program earlier than permitting it to run.”

Discovered this text fascinating? Observe us on Twitter and LinkedIn to learn extra unique content material we publish.



Finest knowledge restoration apps for iPhone: Save misplaced or deleted recordsdata

0



virtualization – The best way to set up macOS Catalina on a 2013 iMac in VirtualBox?

0


I personal a 21.5-inch, late 2013 iMac (with a pair {hardware} upgrades, particularly RAM and exhausting drive) operating macOS Catalina 10.15.7 (that is the most recent macOS suitable with my specs).

I would prefer to run macOS Catalina 10.15.7 inside a digital machine on my iMac. I would like to make use of VirtualBox because the digital machine as a result of, not like Parallels VirtualBox is cross-platform and free-of-charge, and in contrast to VMWare Fusion I’m really capable of finding VirtualBox on-line and obtain it. (Ever since VMWare has been subsumed by Broadcom, it has turn into very troublesome to discover a downloadable hyperlink to VMWare Fusion.)

As a primary step, I adopted the hyperlink below the Use the App Retailer title on this web page so as to obtain the official Catalina installer.

Then, due to this reply, I ran the script in this mission so as to convert Catalina’s set up file right into a bootable ISO file.

I then adopted the directions below the The best way to set up macOS in VirtualBox heading from this web page to arrange a digital machine in my VirtualBox occasion (v. 7.0.20).

I used the next configurations: 1) 8192 MB reminiscence dimension, 2) 64 GB drive dimension, 3) 2 processors.

I adopted all of the steps as much as and together with step 15. I did not know what do in step 16, and I additionally was somewhat apprehensive to comply with it, as a result of I did not perceive what it did.

So as a substitute of following step 16, I closed the VirtualBox occasion, after which reopened it, and hit the Begin button to start out the Catalina digital machine.

The next display of textual content messages appeared, and that is it. Nothing extra occurred.

Installing Catalina in a new VirtualBox virtual machine

How can I proceed from right here? How can I set up macOS Cataline in VirtualBox?
Wouldn’t it be simpler to put in it in VMWare Fusion? In that case, the place can VMWare Fusion be downloaded from?

There’s a publish much like this one right here, but it surely’s 4.5 years outdated, and I am unable to determine from the solutions what I am presupposed to do.

On Hearth Drills and Phishing Exams


Within the late nineteenth and early twentieth century, a sequence of catastrophic fires briefly succession led an outraged public to demand motion from the budding fireplace safety {industry}. Among the many consultants, one preliminary focus was on “Hearth Evacuation Exams”. The earliest of those assessments targeted on particular person efficiency and examined occupants on their evacuation velocity, generally performing the assessments “without warning” as if the hearth drill have been an actual fireplace. These early assessments have been extra prone to end in accidents to the test-takers than any enchancment in survivability. It wasn’t till introducing higher protecting engineering – wider doorways, push bars at exits, firebreaks in development, lighted exit indicators, and so forth – that survival charges from constructing fires started to enhance. As protections advanced through the years and enhancements like necessary fireplace sprinklers grew to become required in constructing code, survival charges have continued to enhance steadily, and “assessments” have advanced into introduced, superior coaching and posted evacuation plans.

On this weblog, we’ll analyze the fashionable follow of Phishing “Exams” as a cybersecurity management because it pertains to industry-standard fireplace safety practices.


Fashionable “Phishing assessments” strongly resemble the early “Hearth assessments”

Google presently operates below laws (for instance, FedRAMP within the USA) that require us to carry out annual “Phishing Exams.” In these necessary assessments, the Safety group creates and sends phishing emails to Googlers, counts what number of work together with the e-mail, and educates them on learn how to “not be fooled” by phishing. These workouts sometimes gather reporting metrics on despatched emails and what number of workers “failed” by clicking the decoy hyperlink. Normally, additional schooling is required for workers who fail the train. Per the FedRAMP pen-testing steering doc: “Customers are the final line of protection and must be examined.

These assessments resemble the primary “evacuation assessments” that constructing occupants have been as soon as subjected to. They require people to acknowledge the hazard, react individually in an ‘acceptable’ approach, and are informed that any failure is a person failure on their half quite than a systemic concern. Worse, FedRAMP steering requires corporations to bypass or get rid of all systematic controls throughout the assessments to make sure the chance of an individual clicking on a phishing hyperlink is artificially maximized.

Among the many dangerous negative effects of those assessments:

  • There isn’t a proof that the assessments end in fewer incidences of profitable phishing campaigns;

    • Phishing (or extra generically social engineering) stays a prime vector for attackers establishing footholds at corporations.

    • Analysis exhibits that these assessments don’t successfully stop individuals from being fooled. This research with 14,000 members confirmed a counterproductive impact of phishing assessments, exhibiting that “repeat clickers” will persistently fail assessments regardless of latest interventions.

  • Some (e.g, FedRAMP) phishing assessments require bypassing current anti-phishing defenses. This creates an inaccurate notion of precise dangers, permits penetration testing groups to keep away from having to imitate precise fashionable attacker ways, and creates a threat that the allowlists put in place to facilitate the check may very well be by chance left in place and reused by attackers.

  • There was a considerably elevated load on Detection and Incident Response (D&R) groups throughout these assessments, as customers saturate them with hundreds of pointless stories. 

  • Staff are upset by them and really feel safety is “tricking them”, which degrades the belief with our customers that’s needed for safety groups to make significant systemic enhancements and once we want workers to take well timed actions associated to precise safety occasions.

  • At bigger enterprises with a number of unbiased merchandise, individuals can find yourself with quite a few overlapping required phishing assessments, inflicting repeated burdens.


However are customers the final line of protection?

Coaching people to keep away from phishing or social engineering with a 100% success price is a possible not possible process. There is worth in educating individuals learn how to spot phishing and social engineering to allow them to alert safety to carry out incident response. By making certain that even a single consumer stories assaults in progress, corporations can activate full-scope responses that are a worthwhile defensive management that may shortly mitigate even superior assaults. However, very similar to the Hearth Security skilled world has moved to common pre-announced evacuation coaching as an alternative of shock drills, the knowledge safety {industry} ought to transfer towards coaching that de-emphasizes surprises and methods and as an alternative prioritizes correct coaching of what we wish employees to do the second they spot a phishing electronic mail – with a specific deal with recognizing and reporting the phishing risk.

Briefly – we have to cease doing phishing assessments and begin doing phishing fireplace drills.

A “phishing fireplace drill” would goal to perform the next:

  • Educate our customers about learn how to spot phishing emails

  • Inform the customers on learn how to report phishing emails

  • Permit workers to follow reporting a phishing electronic mail within the method that we would favor, and

  • Acquire helpful metrics for auditors, akin to:

    • The variety of customers who accomplished the follow train of reporting the e-mail as a phishing electronic mail

    • The time between the e-mail opening and the primary report of phishing

    • Time of first escalation to the safety group (and time delta)

    • Variety of stories at 1 hour, 4 hours, 8 hours, and 24 hours post-delivery

When performing a phishing drill, somebody would ship an electronic mail asserting itself as a phishing electronic mail and with related directions or particular duties to carry out. An instance textual content is supplied beneath.

Hiya!  I’m a Phishing E mail. 

It is a drill – that is solely a drill!

If I have been an precise phishing electronic mail, I’d ask you to log right into a malicious web site along with your precise username or password, or I’d ask you to run a suspicious command like . I’d strive any variety of methods to get entry to your Google Account or workstation.

You’ll be able to study extra about recognizing phishing emails at and even check your self to see how good you might be at recognizing them. Whatever the kind a phishing electronic mail takes, you possibly can shortly report them to the safety group whenever you discover they’re not what they appear.

To finish the annual phishing drill, please report me. To do this, .

Thanks for doing all your half to maintain protected!

  1. Difficult. Phish, Ph.D

You’ll be able to’t “repair” individuals, however you can repair the instruments.

Phishing and Social Engineering aren’t going away as assault strategies. So long as people are fallible and social creatures, attackers can have methods to govern the human issue. The simpler strategy to each dangers is a targeted pursuit of secure-by-default techniques in the long run, and a deal with funding in engineering defenses akin to unphishable credentials (like passkeys) and implementing multi-party approval for delicate safety contexts all through manufacturing techniques. It’s due to investments in architectural defenses like these that Google hasn’t needed to severely fear about password phishing in almost a decade.

Educating workers about alerting safety groups of assaults in progress stays a helpful and important addition to a holistic safety posture. Nevertheless, there’s no have to make this adversarial, and we don’t acquire something by “catching” individuals “failing” on the process. Let’s cease partaking in the identical outdated failed protections and comply with the lead of extra mature industries, akin to Hearth Safety, which has confronted these issues earlier than and already settled on a balanced strategy.