Slashdot Mirror
Intego's "Year In Mac Security" Report
david.emery notes the release of Intego's "Year In Mac Security" report (PDF), adding: "Mac OS X and iPhones that haven't been jailbroken fare pretty well (although vulnerabilities exist, there's not been a lot of exploitation). Apple does come in for criticism for 'time to fix' known vulnerabilities. Jailbroken iPhones are a mess. The biggest risk to Macs are Trojan horses, often from pirated software."
...and let Software Update do it's thing with Security Updates.
Don't go online as Root, and really try not to open email attachments that claim to be "Nude Photos of (insert female athlete name here)"
Really, how hard is that?
Guaranteed! This comment 100% Anthrax free!
Installing Windows.
Apple doesn't care enough about security.
Really, the main problem is that jailbreak processes don't try to change your default root password. So the vulnerability is that Apple supplied a default root password (that isn't workable without jailbreak), and the haxx0rs remove the protection but fail to force user to change or randomize (and remember/show to user) that password.
Nothing bizarre about that.
Make sure everyone's vote counts: Verified Voting
This is basically 7 total pages:
* first couple pages on installing bitorrent'd software
* Page 4 and 5 about people who installed openssh on their jailbroken iphones and didn't change their passwords
* last page has citations back to their own blog
The meat of it is about PDF, Java -- surely those have a more widespread effect right? But they spend a lot less words on those topics. Note that all the visuals have to do with the stupid ssh-admin-password and bittorent'd malware.
Skip to the concluding paragraph -- they just have to emphasize the iphone again.
I was going to say "I declare this posting unfit for Slashdot" but the good I see is that we can pick it apart to sort out the fluff.
My rating system on severity overall on the entire population of apple products:
1) pdf/java (5 stars)
2) I-enabled-ssh-w/o-a-password (1 star - you're fault for being a retard)
3) Charles Miller iphone vuln (5 stars when it wasn't patched)
lose/lose (from the article) seems like a fun game to play right before installing Debian.
We need an economist to explain us how the us, by privatizing gains and socializong losses turned into a fascist state.
And an English teacher to straighten out that sentence.
Sig Battery depleted. Reverting to safe mode.
And an English teacher to straighten out that sentence.
I think it's Korean.
in a safe manor
My security guards keep my manor safe.
Please don't bash 20/20. Their scientific methodology might have been a little bit off, but their motives were in the right place. They were just trying to show that a major car manufacturer was corrupt...this is the media's job, isn't it? To expose corruption? Unless you can show that the car manufacturer has lily-white hands (and none of them do) please stop the bashing. These are educated, dedicated people who are doing a tough job under very difficult circumstances, and it's hard to get the stories to come out the right way 100% of the time.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
"but doesn't mention that Adobe's own CS4 install tries to phone home"
Riiight... cuz that's what trojans are famous for isn't it... checking to make sure that you're allowed to run then. My god I do wish trojans actually did do that, and better than other software does it. I'll admit on here, I don't legally own any trojans at all, which means all I have to do is make sure that they can phone home to verify this, and never have to worry about them again! Ahh... pleasant thoughts.
The revolution will not be televised... but it will have a page on Wikipedia
The ability to jailbreak is a security hole. Last I knew the techniques people use are remote code execution.
For example as I recall the 1st gen jailbreak was to get a specially crafted TIFF file that exploited a buffer overflow when a page was loaded in Safari. Stop and think about that for a minute. This is the kind of behavior you don't want to be possible. Yet in the reality distortion field, it's a great thing suddenly. Users are totally unconcerned about this.
I'm not sure if the exploit mechanism has changed since then, but... Personally, I stopped paying attention to iPhone when I witnessed that.
If Apple didn't put such draconian limits on what a person could do with their own property, perhaps there wouldn't be the need to "jailbreak" it.
Back in 2004 Intego's big complaint about the Mac was that because it's based on UNIX, if you could get it to execute a shell script you could do anything on the computer, and that Applescript wasn't sandboxed. They never noticed that the same was true of CMD.EXE and VBscript on Windows, DCL on VMS, and every other native scripting environment on every OS, ever, anywhere.
Intego's business model appears to be FUD.
Apple either supplies a default root password or it has to build in a backdoor. Otherwise there is no way to upgrade the OS. Which way do you think is more secure?
The jail break issue isn't Apple's problem. It is a problem with people doing things they don't understand.
Looks like the jail break is just another way to root kit a computer (phone).
Actually, the 'single sheet aluminium case' being a non-user serviceable part thing is a myth. My MacBook Pro came with printed instructions in a little booklet telling my how to open the back panel and replace the hard drive. It did have strict instructions not to attempt to replace the battery, but when I opened the case the battery was right there next to the hard drive so I'm not really sure why they say that.
When people point out something the Iphone can't do, we hear "Oh it can, but you just have to jailbreak it". When we get stories about security holes, we hear "Oh that doesn't count, you just have to not jailbreak it".
So er, which is it?
The problem is that the Iphone is the only phone where "jailbreaking" is necessary to get basic functionality working (e.g., tethering, running applications that Apple don't like).
Consider, do you ever hear people talking about "jailbreaking" in the context of any other phone?
My 5800 works fine, not had a virus (indeed on any of my phones), never needed to hack it.
"The problem is that the Iphone is the only phone where "jailbreaking" is necessary to get basic functionality working"
Correct. Something as simple as deleting a call is not possible on the iPhone without jailbreaking, which is shocking because on every cellphone I've used in the past 10 yrs I've had the ability to delete a phone call from the call log and it's a feature iPhone owners have been asking for since 2007. If you want to remove a single call you have to delete the entire phone call log
Honestly I don't know how anyone can use their iPhone without jailbreaking it, unless they're not really using it as a smartphone so they're not installing applications, using data, etc.
my karma will be here long after I'm gone
What? The jailbreak exploit has nothing to do with jailbreaking itself but the fact that most people that used the process installed SSH onto their iPhones and didn't change the default password on SSH. It had nothing to do with what Apple supplied on the phone but what 3rd parties modified the phone.
Well, there's spam egg sausage and spam, that's not got much spam in it.