Slashdot Mirror
Intego's "Year In Mac Security" Report
david.emery notes the release of Intego's "Year In Mac Security" report (PDF), adding: "Mac OS X and iPhones that haven't been jailbroken fare pretty well (although vulnerabilities exist, there's not been a lot of exploitation). Apple does come in for criticism for 'time to fix' known vulnerabilities. Jailbroken iPhones are a mess. The biggest risk to Macs are Trojan horses, often from pirated software."
...and let Software Update do it's thing with Security Updates.
Don't go online as Root, and really try not to open email attachments that claim to be "Nude Photos of (insert female athlete name here)"
Really, how hard is that?
Guaranteed! This comment 100% Anthrax free!
Should it be any surprise that unmoderated software could introduce security vulnerabilities? All a CPU does is execute instructions, so "jailbreaking" a phone just gives you the opportunity to run more software which may contain malicious payloads.
When 20/20 took a look at dangerous "exploding" trucks, it was found that if you put a small amount of explosive near the crash area, that you could indeed cause a truck to explode in an accident. But does that mean that the truck company should be found at fault for a usage scenario that is not supported?
Analyze the security of this phone in terms of its default use. It burns up (literally), it causes network packet flooding, and does a bunch of other unwanted things, but don't blame it for something that its users do in direct violation of their TOS.
Installing Windows.
Apple doesn't care enough about security.
As much as Intego wants to present the state of malware on the Mac, the truth is that even Intego works pretty much like any other AV engine which tries to detect malware based on its signature or heuristics (behavioral), that they receive either from someone sending them a sample or collected with their honeypots around the world.
The bots/trojans/RATs that are written for specific targets, do not have a signature, thus, are undetected. Then it becomes obvious that Antivirus solutions are not enough. You also need to control the apps that are reverse connecting (phone home), with products like (Little Snitch).
What they don't address are the vulnerabilities that exists in every day applications, which subject to a stack buffer overflow, will execute code in memory with the same level of permissions as the application/daemon that is running. Antivirus doesn't provide any protection for exploits in software.
On a side note, Intego mentions a "crack" for CS4 which is actually a Trojan, but doesn't mention that Adobe's own CS4 install tries to phone home.
See, that's why it's called karma. Your previous posts clearly shows that you're an immature idiot without anything to say except to waste everyones time.
c++;
This is basically 7 total pages:
* first couple pages on installing bitorrent'd software
* Page 4 and 5 about people who installed openssh on their jailbroken iphones and didn't change their passwords
* last page has citations back to their own blog
The meat of it is about PDF, Java -- surely those have a more widespread effect right? But they spend a lot less words on those topics. Note that all the visuals have to do with the stupid ssh-admin-password and bittorent'd malware.
Skip to the concluding paragraph -- they just have to emphasize the iphone again.
I was going to say "I declare this posting unfit for Slashdot" but the good I see is that we can pick it apart to sort out the fluff.
My rating system on severity overall on the entire population of apple products:
1) pdf/java (5 stars)
2) I-enabled-ssh-w/o-a-password (1 star - you're fault for being a retard)
3) Charles Miller iphone vuln (5 stars when it wasn't patched)
lose/lose (from the article) seems like a fun game to play right before installing Debian.
We need an economist to explain us how the us, by privatizing gains and socializong losses turned into a fascist state.
And an English teacher to straighten out that sentence.
Sig Battery depleted. Reverting to safe mode.
And an English teacher to straighten out that sentence.
I think it's Korean.
You forgot to mention the shiny shiny screenshots of the product!
Surely something with a button that big and red must be awesome.
If you think someone isn't free to have a different definition of "freedom" you may be a tyrant.
"* last page has citations back to their own blog"
*lol* it's like when some breaking story (ie, any story) hits the news, but perhaps controversial or unconfirmed, and they say "it has been reported that blah blah blah" and then you flick over the channel and they're saying "blah blah has reported that blah blah blah", and it doesn't take long to notice that all people are telling you is that people are telling you what they're telling you.
Someone somewhere get tipped off about some rumour, phones someone he knows in another network says "have you heard about blah blah" and they have, as they received the same tip off. So guy on other end of phone mouths over too his boss saying "it's whatshisname over at thingy, they're going with the blah blah story" so the boss says "we'll go with it, put it on the 10 bullitin after the bit about the elephant who only has a monkey sized head". "Yeah we're going with the story" he says back, so now the first person says to his boss "yeah they're already going with it" and so gets it on their 10 o'clock bullitin too.
I can prove that it happens - check out the replies to this comment here
The revolution will not be televised... but it will have a page on Wikipedia
"any potential problem a Mac might possibly have A: is actually a feature B: is actually your own fault or C: doesn't matter"
Macs are just weird... on my windows machine, both A: and B: are redundant as it doesn't have a floppy drive and C: really does matter cuz the bootloader's there. Like Chalk 'n iCheese.
The revolution will not be televised... but it will have a page on Wikipedia
The ability to jailbreak is a security hole. Last I knew the techniques people use are remote code execution.
For example as I recall the 1st gen jailbreak was to get a specially crafted TIFF file that exploited a buffer overflow when a page was loaded in Safari. Stop and think about that for a minute. This is the kind of behavior you don't want to be possible. Yet in the reality distortion field, it's a great thing suddenly. Users are totally unconcerned about this.
I'm not sure if the exploit mechanism has changed since then, but... Personally, I stopped paying attention to iPhone when I witnessed that.
don't jaibreak your iphone, don't trust bittorrent, don't visit suspect sites, don't click on emailed links that are not from trusted sources - well DUH!
If Apple didn't put such draconian limits on what a person could do with their own property, perhaps there wouldn't be the need to "jailbreak" it.
Back in 2004 Intego's big complaint about the Mac was that because it's based on UNIX, if you could get it to execute a shell script you could do anything on the computer, and that Applescript wasn't sandboxed. They never noticed that the same was true of CMD.EXE and VBscript on Windows, DCL on VMS, and every other native scripting environment on every OS, ever, anywhere.
Intego's business model appears to be FUD.
I recall reading this (URL:http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/) last year but never heard any follow up from Apple. Does anyone know if there was actually any firmware release for this to close this potential security hole? It appears the likelihood of this getting exploited is rather small (requiring local access at this time) but it still warrants a response from Apple IMO.
I would think that would be obvious.
We need an economist to explain us how the us, by privatizing gains and socializong losses turned into a fascist state.
And an English teacher to straighten out that sentence.
No you dont need an english teacher here.
The meaning is still there and I can see what the person is thinking.
I just have no idea what prompted this passage as we are talking about computers getting viruses/hacked right?
The particular problem is the false claim in their adverts of PCs getting viruses, since you could just run Linux (not to mention that Macs are PCs anyway). If they were comparing to Windows, it would be fair enough, but they don't. Possibly it's to avoid getting sued, which makes me suspect that they have no confidence in their claims in the first place (if the claims were true, it wouldn't be a problem to mention Windows).
i see what you did there.
The vast majority of computer users aren't aware that 'PC' does not mean 'x86/x64 based architecture running Microsoft Windows'.
Trying to cram too much information into a 15 or 30 second spot is just asking for fail. Commercials (for anything) need to be kept simple.
I ran a Windows computer at work. And I had one at home. Never had a problem.
Then I went to another office. We had to spend a fair amount of time researching on the Web. All it took was one person landing on an illicit web site, and the shit hit the fan. All of a sudden, one after another, everybody's hit with trojans and God knows what else. No IT guy to run the thing, so I became the informal computer guy. Several computers are taken out and got the OS rebuilt. The only way to protect against the exploit that hit us is to update the OS. I do so, everything's fine with my machine. One computer after another gets hit with "You may be the victim of pirated software." Uh-oh. Turns out the boss bought the licenses for the software we used with Windows 2000. So then he upgraded to XP, but before the Microsoft Malicious Software (?) removal tool, nobody knew. Now it's picking up the proprietary program, reading the license, and going uh-uh. Can't upgrade. The new licenses would be about $8,000 per computer per year. (From the third-party software vendor. They only sell their program with the support, which costs that much. And they urge you to upgrade to the new version, which is another $13 grand.)
But we're going into recession. Not going to happen. So we have to go back to IE6 and Windows 2000 on some computers. They get hit again with web-based malware. It infects other software on the network. Could a good IT guy have fixed this? Yeah. We had 8 employees, and suddenly the phone wasn't ringing with the big contracts.
In the meantime, the Mac we had on the network for graphics and video conversions -- running like a top. Sure, I know. There are warning signs that show up on Security experts' blogs. Never, since I got a Mac in 1986, had an actual piece of malware. I realize I was a bit lucky in the early days, but I didn't exchange floppies with idiots, so I didn't get those old viruses.
Some fan guy modded you flamebait but, I guess you mean installing boot camp or a virtual machine (hypervisor) and running it just like OS X, without antivirus/firewall and giving it access to OS X file structure.
IMHO Apple made a huge mistake by allowing (SL Bootcamp) Windows to see (read only though) OS X drives. That is not a favour, it is a huge security risk especially for Mac only people not knowing the extent of Windows threats/trojans/data leakage.
Fix? "My Computer", "Manage", "Disk Management", remove drive letter of the OS X drives. At least 99.9999 malware which isn't very modern will fail to find the personal files to steal.
To the "my virtual machine resets itself each boot" guys: If some real mean thing hits you, have fun explaining why your IP/computer was involved in some child porn distribution network "until it rebooted". Run some antivirus, it is NOT Mac once it runs Windows.
So, original Adobe CS4 user who paid more than $1000 and gave his credit card number, home address and telephone should be protected from "evil Adobe" from checking updates or trying to figure which parts of software is used anonymously?
Well, Intego and couple of other companies offer a application firewall but, obviously if you use original/activation system software, it will fail to work if it can't access to net. Solution is GIMP but, it would be a bit unrealistic.