Apple Has a Virus? Congratulations!
473494
Hackers wouldn&#39;t bother writing malicious code to infect the Macintosh unless those computers actually mattered. By Eric Hellweg.
241738
DECEMBER 28, 2004 (IDG NEWS SERVICE) - Two new versions of a computer virus that affects mobile phones were discovered yesterday, with new features that allow them to spread more quickly among vulnerable devices, an antivirus company reported.
723386
It's possible that in the coming months that security-minded computer professionals will finally have a conclusive answer as to whether low malware attack rates for the Mac are due to the platform's low rate of adoption. Some experts believe that as adoption rates rise, so will attacks.
699687
Computer viruses aren't just for wreaking havoc on global networks. They're also an art form. That's the take of an upcoming exhibit that focuses on malicious scripts, hacker films and the aesthetic charms of programming code. By Michelle Delio.
364594
As infected images plant back doors on PCs, experts see possibility of virus too.
63097
Also: Windows worm travels with Tetris [News.com Extra]
76646
Blog: Various people hiding behind pseudonyms are fueling news about a supposed worm for Mac OS X.
679761
Looks like the time has come when mobile users would have to seriously consider getting some protection for their devices. Mobile viruses are coming out pretty regularly now and trend seems to be pointing towards a frantic future.
476280
TechWeb - Unlike Microsoft and other vendors, Apple doesn't rank or rate the vulnerabilities it patches, but about two-thirds of the bugs could result in an attacker hijacking an unpatched Mac.
576338
(InfoWorld) - Apple's iPhone is a toughÂ target for hackers, but a security researcher warned Friday that there are ways the sleek device could potentially be compromised. TheÂ iPhoneÂ has no security software, but Apple doesn't let people load third-party programs on the device, reducing the risk of infection from malicious software. But when the iPhone is connected to the Web, possibilities emerge, said Marius van Oers, a security researcher with McAfee's AVERT Labs in Amsterdam. He doesn't claim to have uncovered a specific security hole in the device, but listed several ways thatÂ determined hackersÂ could use the Web to try to find a way in. Apple is relying on developers to create rich Web-based applications that will be accessed through the mobile version of the company's Safari Web browser. Browser flaws are a proven way for hackers to get unauthorized code running on a system, van Oers said. "It's fairly easy to send someone an SMS (Short Messaging Service) or an e-mail with a Web link," he said. "And once you go to the Web link, then that server can inject code into the iPhone, and if that happens, [a hacker] can have full control." That's what happened with aÂ Safari flawÂ found by Independent Security Evaluators, a company that detailed its findings at the Black Hat security conference in August. By constructing a malicious Web site, the researchers injected code into the iPhone and pilfered recent text messages, phone numbers and e-mail. Apple has since patched the flaw. "Once you get access to the system, it's all over," van Oers said. He presented his view ofÂ iPhone securityÂ Friday at the Virus Bulletin security conference in Vienna. Although he is based in Europe, he examined an iPhone purchased in the U.S. His view of the iPhone's security is more cautionary and speculative, but rooted in the well-known ways that hackers work. Apple also allows the use of JavaScript when the iPhone interacts with Web pages, a programming language that has been used to exploit software problems, van Oers said. Further, Apple's multimedia application QuickTime has been prone to trouble, and there are several proof-of-concept exploits circulating the Web now for version 7, van Oers said. How that proof-of-concept code could affect QuickTime on the iPhone remains to be seen. Nonetheless, with the iPhone already popular in the U.S. and due toÂ go on sale in EuropeÂ in about six weeks, Apple can expect more aggressive attempts by malicious hackers to meddle with it. Hacking mobile devices is less prevalent than hacking desktop computers. But interesting malicious programs have been written for mobiles, including some that repeatedly autodial or send text messages to a premium number. The number is owned by the hackers, who collect the revenue. The chance of those kinds of malicious software affecting the iPhone today is probably low, but "that's the future. Let's hope it will not come to that," van Oers said. Â
594271
In this age of worms, zombies, and botnets, mobile computers themselves are a kind of Trojan horse. Do you know where that computerâs been? No, you really donât.
769408
In 1980, I signed a deal with a company to market a product I was developing. The contract required me to turn over the source code, which I did. One day I went to a meeting at the office of the company, and there on the product manager's desk, right next to a door that opened to the outside, was a floppy labeled "Dave Winer's source code" in big letters.  If you own a Mac you may soon find out what that felt like. It's amazing to me that the tech blogosphere doesn't treat Apple's policy re broken hard disks as the huge gaping security hole that it is.  Think about it. We worry about bad people getting their hands on little pieces of data that, when added together, give them the power to be you in banking and credit transactions.  Think about what you would do if your laptop was stolen. Well, if you own a Mac and its hard disk goes bad, and you make the mistake of bringing it to Apple for service, you will turn over all that data to Apple. Not "may" or "might" but "will." What Apple in turn does with that data is none of your affair. They don't sign anything or offer any guarantees that they won't sell the disk to a data miner. Think it can't happen or that it's unlikely? I don't gain much comfort from your feeling of security. I've been writing about this issue since December 22. Usually when I write something critical of Apple, the results are mixed. Some people are supportive, but far more people attack. This time the ratio is very different. Almost everyone who has commented gets that there's a huge problem here. Can we solve this problem? Of course we can.  Some say that other vendors do this too. That gives me less comfort, not more. That means there's no escaping this crazy way of treating user's confidentiality. Ultimately it hurts the vendors because people can't use their computers for things the manufacturers say we can.  Further, it's got to be an issue for the banks, brokerage firms, credit agencies. If you are a newspaper and you employ reporters and they use a computer, how exactly are you guarding the confidentiality of your sources? If you're a confidential source, don't you have an interest when the reporter gives their computer manufacturer all their data to do with as they please? Imagine what you would do if it turned out there was a bug in a Netgear or Linksys router that allowed, under special circumstances, a mailicous person to gain access to the full content of your hard disk at any time. Would you have a problem with that? This is worse than Microsoft's neglect of malware that got me to stop using their computers. In that case it was Microsoft being neglegent. This time Apple itself is the cause of the problem. It's as if they planted a virus in their operating system that entitled them, under special circumstances, completely out of the user's control, to gain access to everything on your disk, with as much time as they want, with no way for you to prevent or even detect the intrusion.  See also: My letter to Steve Jobs.
42231
More a prank than a threat Hackers have created Trojan horse malware targeted at Apple's much-hyped iPhone device.â¦
633805
First, thanks for the great comments on yesterday's post about Apple and the hard disk of my MacBook. People were universally positive and helpful, and I can say I really learned some really important things as a result of the discussion. First, the cost of the data on the hard disk swamps the value of the value of the disk and even the value of the computer. There was source code on the computer, and other information, which if it fell into the wrong hands, could cause some serious problems for me. I have no agreement with Apple that covers the security or privacy of the data. As far as I know they think they own the contents of the disk as well as the disk itself. The experience I had with them actually makes me think they probably do feel its theirs. This from a company that takes the security of its own private information very seriously, they seem to have almost no regard for the security of its customers' information. You have no control over when a hard disk will crash, or any foreknowledge of when it's even likely to crash. So there's no way to protect against this kind of security issue. And that's what it is. What kind of sense does it make to invest in firewalls, and of what value is Apple's claim that Macs are inherently more secure, when all the data on one of my computers is now completely out of my control forever? I'm not so concerned about the privacy issues, but I could imagine that other people might be. And if identity thieves are not aware of this backdoor way to get access to private information, how long before they are? Security experts always warn us that obscurity is not a good strategy for security. So what to do?  Basically I've given up on trying to get Apple to do the right thing and give me my disk back. Some people at the Emeryville store are well-itentioned, and are just naive about the problems that can come when you trust people with all your data. Others just don't care. Either way it seems unlikely that I'm going to get it back, and even if I do, it's been out of my control for too long.  I'm going to go through the tedious job of changing the passwords on all my sensitive online accounts. That was overdue anyway. And next time a laptop blows its hard disk, I'm either going to replace it myself and shred the old disk, the same way I'd shred any sensitive documents before throwing them out, or just throw away the whole computer. I know this isn't green, but there seems to be no other course that's anything close to secure. And always be aware that you could lose a laptop, or it could be stolen. So far it seems that this is not yet an identity theft concern, but you can't be sure, and it won't be long before it is.  Thanks again for all the good info, advice and vibe.
619128
(InfoWorld) - The anonymous researcher who claims to have crafted a Mac OS X worm said Tuesday that he or she will report his findings to Apple Inc., but added that the Cupertino, Calif. company "has a very long way to go" on security. Identified only as the researcher behind the Information Security Sell Out blog, he or she on Sunday announced that a still-unpatched bug in mDNSResponder, a component of Apple's Bonjour automatic network configuring service, could be exploited by a worm. Apple's May security update, dubbed 2007-005, included a fix for the mDNS bug. "[My worm] is in the same code base, obviously, but that is where the similarity to the recently patched issues ends," said the Info Sec researcher in an e-mail interview. "When Apple fixed the previous issues, they did not take care of the entire code base and there are a lot of bugs there...some are exploitable, like the one I am using, while others are not. But the fact remains that Apple did a horrible job in fixing this package." According to Info Sec, the worm is fully automated and ready to use. "It would be considered a fully weaponized exploit and fully automated," said the researcher. "This is really no different than other worms we have seen [on the Windows platform]. Other than that, I am not able to give any more details." Another researcher, however, questioned whether Info Sec crafted the worm in only a few hours, as claimed. "Writing the exploit in one day...unlikely for anything other than a stack overflow," said Dave Aitel, the chief technology officer at Immunity Inc., the Miami Beach, Fla.-based security company best known for its CANVAS penetration testing ("pentest") software. "So most likely he found a stack overflow in mDNS, which is perfectly possible. It is open source, after all." Info Sec didn't detail the vulnerability, but did emphasize that writing the exploit was a breeze. "The hard part is finding the bug," he or she said. "Once you have found it, it is very easy to exploit. The Bonjour (mDNS) service is UDP [User Datagram Protocol, one of the core Internet protocols] Universal as well, making it even more fun for things like worms." But like other researchers who have grown tired of claims that Mac OS X is more secure than rival operating systems, Info Sec saved a last shot for Apple. Although he/she will report the new-found vulnerability to Apple at some point, there is no timetable for the moment. "I do believe in being responsible and working with vendors," said Info Sec, "but I also feel that some vendors need to be treated like children and learn lessons the hard way. Apple has a very long way to go when dealing with security issues in their products." Aitel leaned a bit the same way. In a posting to his DailyDave mailing list Monday in which he pointed out the Info Sec exploit, Aitel said: "I note that 'Infosecurity Sellout' is claiming there is another bug in mDNS which is wormable. This is obviously untrue, since there are no more remote bugs in OS X." That last line was firmly tongue in cheek, Aitel clarified today in an e-mail. "No, I'm just being funny. OS X is horribly insecure," he said. In an e-mailed statement, Apple spokesman Anuj Nayar rebutted. "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users," he said.
265712
Blog: Apple enthusiasts can perhaps become a bit too evangelical....
56222
Hot Fuzz Security hunters have discovered numerous bugs in a Windows version of Safari, hours after Apple released a beta version of the browser into the wild.â¦