Funny Sign

This should be at the entrance to every Apple store.

source:  defectivebydesign.org

Growing List of Security Threats to Mac OS X Lion

from PCMag.com

Long gone are the days when Apple lovers could take pride in their virus-free Macs while snickering at PC owners' constant worries about security. Apple's brand new Mac OS X Lion operating system is already acquiring an unhealthy list of reported vulnerabilities less than a week after its official release.

Some Lion vulnerabilities are carry-overs from Snow Leopard, like the "Mac Defender" class of scareware that first surfaced in May. Apple's recent software update to prep Macs running Snow Leopard for Lion installation includes identification and removal of known variants of the malware.

Like Mac Defender, another newly identified OS X threat called the Olyx backdoor appears to be a variant of Microsoft Windows-targeting malware that's simply been tweaked to go after Macs.

Researchers say the remote-controlled Trojan application resembles 2009's GhostNet malware, a threat to Windows-based PCs. And as with the various strains of Mac Defender, some of the most knowledgeable and quickest responses to this latest backdoor threat are coming from Apple's longtime rival Microsoft.

Another threat to Lion (and earlier versions of OS X) that's been identified by password recovery software vendor Passware is a vulnerability that enables passwords to be recovered from Macs via Firewire's use of Direct Memory Access (DMA). Yet another is a laptop battery chip vulnerability—that doesn't appear to have been addressed in any OS X 10.7 updates as of yet—which securityresearcher Charles Miller of Accuvant Labs says can be exploited to "brick" batteries in several Applelaptops.

Apple's success at gaining market share for OS X (not to mention its leadership in mobile operating systems with iOS) has clearly not come without a cost—whereas malware developers generally ignored Macs when they made up a fraction of the market, now they have every reason to target Apple.

-----------------------

I'm sure the Apple fans will somehow blame Adobe for this!

Security Flaws Found on Mac Retail Packaging

from ZDNet.com

...On the outside of the shipping box for the Mac mini server (and I presume this is the case for other Apple products), the serial number of the server was prominently displayed. This means that everyone in the shipping chain between Apple and my home had access to the serial number of my new computer.

Most Fedex people are very cool people, but you never know much about the people who carry your packages. Since we get a lot of deliveries here at Camp David, our regular Fedex guy is always just a little too curious about our daily business.

While I don’t like that curiosity, I don’t think he’s a risk. Besides, the property is heavily protected and monitored, with both active and passive defenses. So he doesn’t worry me.

But others who get deliveries might not want their Mac serial numbers available to their delivery people, who already know their addresses.

Even so, that’s not the biggest flaw I discovered. That’s just the appetizer.

Let’s talk WiFi security for a moment. WiFi security generally has three layers of protection. The simplest is simply not broadcasting the SSID. In this way, unless someone knows the name of your network, he or she won’t be able to find your network (unless that person is actively engaging in wireless sniffing, of course).

A second way to protect your network is through encryption. That’s why we always recommend you set up encryption on your WiFi network, and give it a unique key. Encryption is difficult to crack, but not impossible. It’s definitely a good defensive tactic.

But the third layer of protection is actually quite valuable. That’s MAC address filtering. Each network device has (or should have) a unique MAC (Media Access Control) address, essentially a network serial number. If you tell your router to only let in devices that have certain specific MAC addresses, it’s much harder for someone spying on your network to connect.

Of course, if someone technically astute knew one of your MAC addresses, it’d be much easier to gain access to your network. All that person would have to do is spoof the MAC address, and your router wouldn’t be able to tell that the spoofing device wasn’t the one that was authorized on the network. Once allowed onto the network, the intruder would simply have to begin the process of cracking your encryption.

It’s always better to keep intruders off your network in the first place. MAC address filtering does that.

So, now, imagine you’re someone shopping at, say, a Best Buy or Apple store and you want to buy a Mac. Perhaps the store clerk helping you takes what seems an unhealthy interest in you. Perhaps it’s someone you knew in high school who’s been interested in you for years. Or perhaps it’s someone who wants to date you (and you don’t share the attraction). Or perhaps it’s someone who knows your buying patterns and thinks you might make an interesting target for criminal activity.

I’m not saying that all Best Buy and Apple store clerks are trouble. But I am saying that not all people have your best interests at heart.

Now, let’s extend this scenario a notch. When you make a large purchase at someplace like an Apple store, you have to present identification, often a credit card, sometimes a driver’s license, often your home address and phone number. Essentially, you’re telling the clerk a lot about yourself when you make a purchase.

If the clerk had bad intentions in mind, you’ve already given him or her your home address, phone number, and credit card information. In other words, you’re now easy to find.

Thanks to Apple, if you bought a Mac mini (and probably their other products), you’ve also given the clerk your new MAC address. This is essentially one more key to gain access to your network and, for some incredibly short-sighted reason, Apple prints this information on the outside of the box.

WTF Apple?

WTLet me repeat that: Apple prints MAC address information, along with the machine’s serial number, on the outside of the box. In fact, Apple prints your WiFi MAC address (what they call AirPort ID), your wired MAC address, and even your new computer’s Bluetooth network address!

This is a very dangerous risk.

Now the clerk has access to not only your credit card information, possibly your driver’s license information, your home address and your phone number, but the MAC address that’s one of the layers used to keep people out of your network.

Courtesy of Apple, you’ve just handed over one of the only keys safeguarding your digital domain to a complete stranger.

I call on Apple to change this practice immediately.

I can understand how picking and packing might be easier with an easily visible serial number, but there’s absolutely no reason network security codes need to be displayed on the outside of retail packaging for all to see.

Adobe Software Breaks Down on Mac OS X Lion

from PCWorld.com

More than a dozen Adobe products are not working properly on Mac OS X Lion, Apple's new desktop operating system, continuing Adobe's struggles to make its software compatible with Apple products.

The issues -- listed by Adobe on its website -- aren't as cut and dried as the problem with Flash on iOS, which is that Apple blocks use of Flash on iPhones and iPads.

But Adobe says many of its products are missing functionality under Lion, which was released earlier this week. In addition to the fact that Lion drops support for older PowerPC applications, the Adobe issues may be enough for some users to delay upgrading.

Software often has to be rewritten to continue working properly on new versions of operating systems, or to take advantage of an OS's new features. But Adobe and Apple have a contentious history, with Apple refusing to support Adobe's widespread Flash technology on mobile devices due to concerns about battery life, security and performance.

Adobe doesn't suggest any deliberate attempt by Apple to cripple Adobe products on Lion, but Adobe Senior Product Manager Jody Rodgers blogs, "The cat is out of the bag! Mac OS X 10.7 aka Lion is roaming the streets and you brave Mac IT admins have been deemed Lion Tamers by the public at large. Or at least by me. I've managed a few OS compatibility assessments in my past and it is no easy task to gather up all the necessary info from the software publishers that are used in your environment, run/coordinate testing, etc."

Known issues in Lion affect Adobe software such as Acrobat, Adobe Drive, Contribute, Dreamweaver, Fireworks, Flash Builder, Flash Catalyst, Flash Player, Lightroom, LiveCycle, Photoshop and Premiere Pro.

Adobe initially said, "Flash Player may cause higher CPU activity when playing a YouTube video [on Lion.] Possibly related to disabled hardware acceleration," but later retracted this issue, saying, "Lion provides the same support for Flash hardware video acceleration as Mac OS X Snow Leopard."

Still, other Flash problems remain. For example, some users may find the "Flash Player settings dialog does not respond to mouse clicks," and "custom native mouse cursors are not animating properly on Mac 10.7."

Other problems:

• Flash Catalyst CS5 does not work on Lion and Adobe does not intend to update the product for the new OS. Catalyst CS5.5, the current version, is "generally compatible" with Lion but issues that degrade user experience caused Adobe to say, "We do not recommend that [Catalyst CS5.5] customers upgrade to Mac OS X 10.7."

• In LiveCycle, "workflows that are dependent on Adobe Reader plug-in will not function."

• "Adobe Reader plug-in and Acrobat plug-in are not compatible with the Safari 5.1 browser, which will ship with Mac OS X 10.7 and for 10.6 in July 2011. Adobe Reader and Acrobat will continue to work as standalone applications on Mac OS X 10.7 and 10.6, and will render PDF documents outside of the browser."

Adobe also updated an FAQ on its Creative Suite to discuss compatibility with Lion.

Lion was unveiled to generally good reviews, with users praising the OS for trackpad gestures that allow iPad-like manipulation of applications, and new Launchpad and Mission Control features that provide more convenient views of applications.

However, some users complain that Lion has slowed their Macs down. The problem is apparently caused by the Spotlight search function re-indexing the contents of the computer, which slows down the computer for a few hours after installation. In general, Lion will perform better on newer Macs, particularly those with at least 4GB of RAM and solid state disks.

-------------------

A Mac that cannot run Photoshop properly?  What is this world coming to?

Apple MacBooks Vulnerable To Battery Firmware Hacks

from CRN.com

Charlie Miller, Apple (NSDQ:AAPL) security expert with the consulting firm Accuvant, found a new way to hack into Apple's MacBook computers -- with the battery.
If exploited, Miller’s newly discovered hack could force battery overheating, or render it inoperable, transforming the computer into an expensive paperweight. The exploit could even allow hackers to run malware via the battery that could potentially be used to access or steal data.
“I started looking at what I could do that anyone would understand,” Miller said. “What’s something that people would understand? Could bad guys break into your computers, and make batteries blow up?”
Miller said that Apple’s Lithium Polymer batteries are shipped from the factory in a sealed state, preventing anyone from making changes to them. He subsequently embarked on the process of tinkering with the batteries -- reverse engineering the firmware and disabling some of the their safety features. Throughout the entirety of the hacking process, Miller went through a total of seven batteries -- although he emphasized that he “never blew anything up.”
Ultimately, Miller found that batteries in modern laptops, such as Macbook Airs and Mabook Pros, contain an embedded chip that serves as a conduit for communication between the operating system and the battery. The battery chip essentially enables the battery to report what it needs to the operating system, whether it needs more charge, whether it’s overheating or has too much of a charge and when to power down or completely off.

“The main brains of this operation are the battery chip,” Miller said. “The computer can’t tell when there’s too much charge. (The chips) main mission is to make sure things are safe.”
However, during his experimentation, Miller discovered that the Achilles heel of the battery chip in MacBooks and other computers was that they shipped with a default password that enables hackers to unseal and open up full access to it. By figuring out the default password, miscreants could potentially obtain control of the battery and take control -- to a degree -- of the computer’s operability.
“By looking to see what that password is, you can start to make changes,” Miller said. “If you have full access mode to the battery, you can do anything with it.”
Once hackers have this kind of control, they could launch exploits to ruin the battery’s firmware, causing overheating or “bricking” so the batteries, and the computers they’re powering, are rendered useless. The exploit could be used to alter code on the battery’s chip to prevent it from charging or cause it to block the computer from communicating with the battery. A more dramatic battery firmware hack could potentially cause the batteries to catch fire or explode.
In addition, hackers who successfully exploited the vulnerability could change the code that runs on the chip to host malware. Hackers could then use the malware embedded on the chip to attack the OS from the battery.
In a worst case attack scenario, the malware implanted on the chip could be used to infiltrate the OS to steal or alter data, cause the computer to crash or take control of the affected system. However Miller said that the hackers would have to exploit a vulnerability in the way the operating system talks to the battery for this kind of successful attack.


In addition, the battery firmware attacks could be conducted remotely, without requiring hackers to have the computers in their possession for successful execution.
“A remote exploit gets you onto the computer and you can start to make changes,” Miller said. “You can make all of these changes while the battery is plugged into the computer.”
What’s more, because a computer’s battery is an unlikely source of infection, an attack could potentially remain undetected by IT administrators, allowing the malware to be used in repeated attacks.
Miller plans to expose the battery firmware exploit during the Black Hat USA hacker conference in Las Vegas during the first week of August. During his presentation, he will also be releasing a tool, known as Caulkgun, that users can download allowing password randomization on the battery's chips.
While Miller tested the hack on a variety of Macbooks--Macbook Pro, Macbook Air-- he said that the exploit could be applied to any operating system. Miller added that he notified Apple (NSDQ:AAPL) of the vulnerability in its battery chips, but has yet to hear back from Cupertino on the status of the fix.

However, Miller added that a typical cyber criminal intent on obtaining credit card and other financial information would likely not use a battery firmware hack for financial gain.
A more likely scenario would be ruining the battery or rendering the computer inoperable and then extorting the owner with the use of their own computer, Miller said.
“The worst thing they would probably do is trash the battery so it doesn’t work anymore,” Miller said. “There’s really not any way you can make money from this.”

OSX Lion: Not the Fix For Wi-Fi Woes

From iLounge.com

We began to track reports of Wi-Fi disconnection issues back when we upgraded one of our iMacs to a brand new 2011 model and started to experience daily Wi-Fi signal drop-offs—across-the-board disconnections of everything from iChat to Twitter and Safari. It wasn’t an isolated issue: plenty of people on Apple’s Discussion Forums were having the same problem , and hoping that 10.6.8 would fix it. When that didn’t happen, the hopes shifted to Lion.

Now that Lion’s out, it’s clear that the problem wasn’t fixed—it’s actually become even worse on our iMac, which has started to lose its Wi-Fi connection multiple times a day. The same problem is being reported by numerous Apple Discussions users, in threads such as Wifi Constantly Dropping in Lion , Wifi Problems After Installing Lion , Lion WiFi Connection Problem , and New MacBook Pro 2011 weak and dropping wireless connection .

Based on testing, we get the impression that the issues stem (at least in part) from some mismatched or messed up settings saved by the Mac relating to specific wireless networks it has connected to before. Some people believe that there are wireless network settings with incorrect disk permissions; others think that there are corrupted files. Solutions that have been offered include:

(1) Deleting a system preferences file called com.apple.aif.plist, then restarting the machine to rebuild it. This is inside Macintosh HD > Library > Preferences, which is now harder to find in Lion’s Finder because Apple has hidden your hard drive by default in the Sidebar’s list of Devices. You can use Finder’s Preferences to add Hard Drives back to the Sidebar, but based on our experiences, deleting this file doesn’t work to fix the problem.

(2) Reset your Mac’s PRAM and NVAM. This was suggested by an Apple Discussions user, and is explained in this Apple Knowledgebase document. Most reports do not suggest that this works.

(3) Reset your Mac’s System Management Controller Another suggestion from an Apple Discussions user, explained here . Again, most reports do not suggest that this works.

Based on past experiences in trying to fix major issues such as this one, we know that it’s rare that one solution works for everyone, and that readers often come up with great ideas for how to get things working again. We’re going to keep hunting for answers to this, and will update this article when we have one that works for us—did one of these ideas, or something else, work for you? Post in the comments section below.

--------------------------------

"It just works" huh?  Sounds to me like it "just makes things worse."

Germany warns of Apple software Security Hole

from www.mercurynews.com

BERLIN -- The software running Apple's iPhones, iPads and the iPod Touch has "critical weaknesses" that could be used by criminals to gain access to confidential data on the devices, Germany's IT security agency warned Wednesday. Clicking on an infected PDF file "is sufficient to infect the mobile device with malware without the user's knowledge" on several versions of Apple's iOS operating system, the Federal Office for Information Security said. The same could occur when opening a website that carries an infected PDF file, possibly opening the device to criminals spying on passwords, planners, photos, text messages, emails and even listen in on phone conversations. "The weak points allow possible attackers to gain administrator rights and get access to the entire system," it said. The problem may occur on all devices -- iPhone 3GS, iPhone 4, iPad, iPad 2 and the iPod Touch -- with software versions including iOS 4.3.3, and it "cannot be excluded" that other iOS versions have the same weakness, it said. Apple has yet to offer a patch to fix the problem, the agency added. Apple Germany spokesman Georg Albrecht told the Associated Press he was aware of the warning, adding that Apple would not comment on it. The agency said it was in contact with the firm regarding the security hole. No attacks taking advantage of it have been reported so far, "but it must be expected that attackers will soon exploit the weak points," it said. The agency urges the devices' users to refrain from opening PDF files of unknown origin, be it as an email attachment or those opening through websites. "Possible scenarios for attacks by cyber criminals include the extraction of confidential information (passwords, online banking data, calendars, e-mails, SMS or contacts), accessing the device's cameras, the user's GPS data as well as listening in on phone conversations," the statement said. The Bonn-based institution reported a similar security hole last year, for which Apple soon afterward presented a software upgrade fixing it.

Hackers Hit Apple

Hackers this weekend targeted Apple, claiming yet another victim in their tour of duty against major worldwide corporations and governments.

AntiSec, a fusion of hacktivists Anonymous and the now-defunct LulzSec, tweeted Sunday that it broke into an Apple server, collecting 26 administrative user names and passwords. The anonymous hackers claim they accessed the Cupertino, Calif.-based company's systems through a security flaw in third-party software.

"Apple could be target, too," the group tweeted. "But don't worry, we are busy elsewhere."

AntiSec formed when LulzSec and Anonymous hackers pledged to unite against major financial institutions and governments worldwide. The resulting group has been active ever since, striking out at various online bastions with distributed denial-of-service attacks.

Apple declined to comment about the breach, but it can't be happy about falling victim to hackers just like so many other companies and governments in the last several months.

Apple got off easy, it seems, compared to Citigroup with its embarrassing $2.7 million breach. The bank is scrambling to restore customer confidence in the wake of this attack, while entertainment giant Sony finally restored its systems after an 11-week spell without service.

Sony in April suffered the biggest recorded data breach, with 100 million user accounts and tens of thousands of credit card numbers stolen. The International Monetary Fund and Epsilon didn't fare much better and are also struggling to discover who broke into their systems over the last months.

Along political lines, hacktivist group Anonymous stands out with its history of online activism against what it says are restrictions on free speech. The group first became famous when it shut down Visa, MasterCard and Amazon for refusing to process WikiLeaks payments. Anons then targeted Egyptian, Tunisian and Libyan regimes, among others, during the Arab Spring, going on to hit Turkish government sites after the country announced it would restrict Internet freedoms starting in August.

Google, too, suffered a political breach when Chinese hackers conducted a spear-phishing expedition against high-profile journalists, diplomats and activists.

If Anonymous is the poster child for politically motivated hacks, its former sister LulzSec represents the "for the lulz" side of hacking. The group's colorful narratives and snarky illustrations characterized their hacking spree until the group disbanded last week. LulzSec pranks include downing FBI, CIA and U.S. Senate websites "for fun" besides posting a fake story to the PBS site that deceased rapper Tupac Shakur is alive and well in New Zealand.

With all of these major hacks making headlines, Apple's incident seems small by comparison. But in the online jungle, no one is safe, and the company may see further attacks unless it bolsters its security systems.
----------------------------

The almighty Apple can be hacked just like everyone else.