Apple: 'Opener' Not a Virus or Worm
615895
Apple has officially downplayed concerns over the "Opener" malware program designed for Mac OS X, rejecting reports by antivirus companies. Opener, also called Renepo, cropped up in late October after a Mac Web site posted details of its malicious tact to disable the OS X firewall and copy user information to a publicly shared folder.
690423
A new security update is available for Mac OS X users running the program that's part of iLife 08.
251655
(InfoWorld) - Hackers may successfully unlock an iPhone in as soon as three to seven days, according to a representative of one effort that aims to unlockÂ Apple's new handset. "We believe it will be easy. We are privately aware many of the iPhone engineers came from other handset manufacturers, and we understand their design techniques fairly well," said gj, speaking in an interview conducted using IRC (Internet Relay Chat). He requested that his real name not be used. "Easy to us means inside one week," he said, offering an estimate of three to seven days. Unlocking the iPhone means users will be able to use the handset with other service providers, not just AT&T, which has an exclusive deal to sell the phone in the U.S. By Tuesday night, U.S. time, hackers succeeded in cracking the iPhone's activation process, a minor step towards unlocking the iPhone but a significant technical challenge. The activation process uses a software token that is sent from the phone via iTunes to Apple, which signs the token and returns it to the phone. When that process is completed, iTunes tells the phone to activate. Hackers developed tools for both Windows and MacOS that allow users to activate their phones without iTunes. But users will have to use a token from an activated iPhone, which can be used to activate multiple phones. The hackers are not providing a token with the tools. "If you don't have a known token (which does contain identifying information) you won't be able to use the tool," gj said. At least one other hacker found a way to activate the iPhone without using iTunes. Jon Lech Johansen -- better known as DVD Jon, a hacker who helped develop the DeCSS tool for decrypting DVDs -- released a tool that can activate the iPhone without iTunes on his blog. "The iPhone does not have phone capability, but the iPod and Wi-Fi work," Johansen wrote. Cracking the activation process brings hackers one step closer to their goal of unlocking the iPhone. The phone requires iTunes to activate functions such as its camera and music player. But the process also requires signing up for a two-year data plan with AT&T. "Activating the phone really just makes the device more 'usable' for those who want to use it as a Wi-Fi device, for instance," gj said. With the activation process cracked hackers turned their focus to unlocking the iPhone, a challenge that is expected to be easier than cracking the activation process. "Unlocking is a function of the radio and the radio's interaction with the SIM (Subscriber Identity Module) logic, and these are mostly standards based," gj said. A rumored software update for the iPhone, expected to be released on July 5, could undo some of the progress hackers made towards unlocking the phone. "If Apple releases an update on July 5th that includes 'fixes' for our efforts so far, it will be a setback," gj said. "I don't know if it will be a permanent one." Hackers working together to unlock the iPhone don't belong to a specific group, and don't plan to claim credit for their work, gj said. "We just want to see the hardware freed. We accept that others will exploit those works but hopefully it will be a lesson to Apple," he said. "They're such a great company, it's a real shame for them to lock everything down like this. The design is top notch," he said. "They would win far more business by setting an example for the industry."
629732
Apple has released its first security updates of the new year, fixing bugs in its QuickTime media player and iPhone and iPod touch devices.As with previous updates, the iPhone 1.1.3 software patch sent those who had installed the unauthorized Jailbreak software -- used to run third-party applications on the iPhone -- scrambling to get their phones up and running. That&#39;s because Apple&#39;s updates have so far always rendered Jailbreak unusable, forcing users to go through a complex re-installation process.According to the Unofficial Apple Weblog, it is possible to run third-party software following this latest update, but the process is complex. A simpler Jailbreak 1.1.3 script is expected to be posted eventually at the iPhone Wiki, which is the hub of much iPhone hacking.The iPhone update fixes two flaws in the Safari browser, including a critical bug that could be exploited to run unauthorized software on the device. A third bug could let an unauthorized user bypass Passcode Lock and launch iPhone applications. The iPod touch is susceptible to the Safari bugs, Apple said.These updates will be rolled out to customers over the next week via the devices&#39; iTunes update mechanism.The QuickTime 7.4 update fixes four critical flaws in the software that could be exploited by attackers to crash the media player or even run unauthorized software on a victim&#39;s computer. The update is available for both the Windows and Mac OS X operating systems.However, the software does not fix a serious flaw in the player that was disclosed over the weekend.Security experts are particularly concerned over this flaw because attack code showing how it can be exploited has also been published. Apple is still working to fix the vulnerability, which has to do with QuickTime&#39;s use of the Real-Time Streaming Protocol.
660602
The security features introduced in Apple&#39;s Leopard operating system need work. That&#39;s according to security experts who have been putting the new version of Mac OS X through its paces since&#160;the upgrade was introduced&#160;last Friday.Leopard introduces a number of important security features to the Mac, but they are often implemented incompletely, leaving users vulnerable to attack, said Thomas Ptacek, a researcher at Matasano Security, who Monday wrote a detailed assessment of Leopard&#39;s security.&quot;They&#39;ve done a really good job of robbing Microsoft advocates of their talking points,&quot; he said. But, &quot;I don&#39;t see anything that they&#39;ve done out of the box, where it&#39;s really any more resistant to attack than Tiger was,&quot; he added, referring to the previous update to Apple&#39;s operating system.According to Ptacek, two of Apple&#39;s key security enhancements -- Sandboxing and Library Randomization -- are great ideas that are imperfectly applied within Leopard.Take Library Randomization. It&#39;s a new feature that&#39;s supposed to make it hard for some of the most commonly used computer attacks like buffer overflows, where the attacker takes advantage of a software bug to place code somewhere in the computer&#39;s memory where he knows it will be run. Microsoft developed a similar technology for Vista, called Address Space Load Randomization. Library Randomization makes it much harder, if not impossible, for the attacker to know where to place this code, reducing the risk of attack.The problem is that Apple did not randomize all of the parts of the operating system that it should have, according to Ptacek. In particular, Apple&#39;s Dynamic Link Library has not been randomized.Security researcher Dino Dai Zovi said he&#39;s used this library in several of the Mac exploits he&#39;s written over the past few years. He has taken advantage of the fact that this library is not randomized, he agreed with Ptacek&#39;s assessment that this feature, as it&#39;s implemented in Leopard, would simply make things a little more difficult for attackers.Sandboxing is another feature that could ultimately make Mac OS X more secure. Sandboxing restricts software running on Mac OS so that even if it&#39;s hacked, it can&#39;t do things that it shouldn&#39;t, such as add new software to the computer. The problem is that Apple hasn&#39;t sandboxed many of the most commonly attacked applications such as the browser, mail client, or instant messaging software, Ptacek said.And the programs that have been sandboxed have not been walled off as thoroughly as they should be, he added.For example, the Quick Look file viewer has been sandboxed, but only to restrict network access. The software can still be misused to write malicious files where they will be automatically launched, Dai Zovi said. &quot;Most of the things that were sandboxed were network services,&quot; he said. &quot;Increasingly these days IM, e-mail and Web surfing are where most of the attacks are coming from, not directly on your network.&quot;Independent consultant Rich Mogull said that his biggest problem was with the Leopard firewall, which he said suffered from a confusing interface that made it very difficult to control access to individual services on the Mac. &quot;It was very complicated and very hard to get the right settings,&quot; he said.Worse, when he installed Leopard, he found himself suddenly without a firewall. &quot;It turned off my firewall when I upgraded, despite that being a default setting.&quot; he said.Like Ptacek and Dai Zovi, Mogull said he had been expecting more from Apple with the Leopard release, but he agreed that the new security features were a step in the right direction. &quot;I think that Apple has started down the right path but they are not as far as they communicated that they would be,&quot; he said. &quot;The firewall is the big negative; they really messed that up.&quot;Apple declined to comment in detail on its new security features. Company spokesman Anuj Nayar said via e-mail that &quot;Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users.&quot;Ptacek said that it is great that Apple has begun adding these security features even when the Mac has not been the target of a widespread worm or virus outbreak. &quot;I&#39;m impressed that when they didn&#39;t have to do it, they went after low-level features that no one will understand,&quot; he said. &quot;I like the direction they&#39;re headed. I&#39;m just saying that they&#39;ve got a long way to go to catch up with Microsoft.&quot;&#160;
385754
Blog: It turns out Apple's new device wasn't the culprit for wireless network outages at Duke University, as reports alleged earlier this week.
26877
The iPhone and Apple Inc.'s   desktop computers may be vulnerable to hackers due to a flaw in  their Web browser, according to a security firm, which said it  found a way to hack into the iPhone.
757260
(InfoWorld) - Apple on Thursday unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities, but fewer than one-third of them could lead to hackers injecting their own code into a compromised system. Thursday's release also marked the first time this year that an operating system security update from Apple did not patch a vulnerability disclosed by the January Month of Apple Bugs project. If Apple sorted bugs by a ranking system -- as do other vendors, including Microsoft Corp. -- most of the bugs fixed by Security Update 2007-005 would be rated less than critical. In eight out of the 17, for example, exploits could do no more damage than to generate a denial of service of, or crash, the affected component. Microsoft typically pegs such vulnerabilities as "important" rather than "critical." Only five of the patched vulnerabilities could result in an attacker executing his own code. Among the serious bugs is one in how Mac OS X 10.4, known as Tiger, handles PDF files. "By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution," Apple's advisory said. Attacks sporting this strategy, although rare on Macs, are common threats faced by Windows users, who have had to learn -- sometimes unsuccessfully -- to be wary of unexpected file attachments. Another dangerous flaw fixed Thursday exists in the code that maps ports on home networks in iChat, Apple's instant messaging service and software. An attacker need only send a malformed packet to trigger a buffer overflow, which could then be used to add malicious code to the Mac. The hacker, however, must have access to the local network to exploit the bug. Other parts of Mac OS X that were patched Thursday include BIND (Berkeley Internet Name Domain), the de facto standard Domain Name System server software, which was patched against four vulnerabilities; the Ruby CGI library (two vulnerabilities); and Fetchmail (one vulnerability). Although Thursday's update pushed Apple's year-to-date patch total to over 100, there was a bright side: It included fixes for fewer flaws thanÂ last monthÂ (25) and the month before (45). The security update can be downloaded from theÂ Apple siteÂ or using Mac OS X's built-in update service.
713098
The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.The latest security updates fix 11&#160;bugs in the Mac operating system, including eight bugs in the recently released Mac OS X 10.5, known as &quot;Leopard.&quot; Apple released the security fixes in conjunction with an 10.5.2 update to Leopard, which includes dozens of other updates.Some of the security flaws are extremely serious, and could be exploited by hackers to run unauthorized software on a victim&#39;s computer, although Apple did not report any incidents of this occurring.The patches include fixes for Safari, Mail, Launch Services, the Mac OS Directory Services, Open Directory and Parental Controls. There are also patches for several Unix components that ship with Apple&#39;s software, including a recently patched flaw in the Samba file-and-print software.&quot;The Samba bug was expected, since all the open-source distributions released fixes a while ago,&quot; said Andrew Storms, nCircle&#39;s director of security operations, via instant message.It&#39;s been a busy time for software developers working on some widely used software products.Apple&#39;s patches come a day before&#160;Microsoft is set to issue a massive set of updates&#160;itself. Last week, the software vendor said it expected to release 12 security updates for a variety of products including critical updates for Windows, Internet Explorer and Office.Last week other&#160;critical patches were also released for Adobe Reader&#160;and Apple&#39;s QuickTime media player.&#160;
410966
MacCentral - Apple Computer Inc. on Thursday released its third security update in recent days. Security Update 2004-09-16 fixes a security issue with Apple's iChat application that allowed Remote iChat participants can send "links" that can start local programs if clicked.
570759
Blog: This rare, tenth update of an Apple OS includes a networking security patch.
216029
AppSnapp opens both the iPhone and iPod touch, then installs another program, Installer.app, which in turn can install unauthorized, non-Apple programs.
583119
Debate rages over whether the Mac operating system is inherently safer than Windows. Part of a series on hot security topics.
467342
(InfoWorld) - Apple Computer Inc. has fixed a number of flaws in the software that ships with its personal computers, including a bug in its AirPort wireless drivers that was disclosed earlier this month. The AirPort flaw was disclosed on Nov. 1 by security researcher HD Moore. It affects Proxim Wireless Corp. Orinoco wireless cards used by PowerBook and iMac computers built between 1999 and 2003, he said. These cards, which were branded AirPort by Apple, shipped with eMac, iBook, iMac, PowerBook G3, PowerBook G4 and Power Mac G4 systems, Apple said in a note on the updates , posted Tuesday. The issue does not affect systems that use the AirPort Extreme cards, Apple said. Apple warned that this flaw could be used by an attacker to run unauthorized software on a victim's computer, but Moore's exploit code could only be used to cause a computer to crash, the security researcher said. Security researchers have been paying a lot of attention to wireless device drivers since August, when researchers David Maynor and Jon Ellch reported that they'd discovered a number of significant flaws in wireless drivers, including one that affected Apple's computers. Maynor and Ellch were later criticized because they demonstrated these flaws using a third-party wireless card rather than the one that ships with Apple's MacBook, and because the two hackers have not published the code used in their attack. Nevertheless, Apple patched a number of vulnerabilities in its wireless drivers last September, saying that these were discovered in an internal audit of the company's software. Apple's Tuesday update also fixes several issues in products that ship with OS X, including flaws in the ClamAV antivirus software, Perl, PHP (PHP Hypertext Preprocessor) and Samba. In total, 22 patches were released in this update, named 2007-007 by Apple. Â
313471
Finnish security firm F-Secure has discovered what is believed to be the first adware application built specifically for Mac OS X. The program does not require administrative privileges in order to install itself on the user's computer.
563842
Just days after its beta release of Safari 3 for Windows became a zero-day nightmare with a number of exploitable vulnerabilities, Apple has rushed out version 3.01 to fix three security flaws. The problems only affect Windows, not the Mac OS X release.
402174
(InfoWorld) - Apple Computer will soon be a member of the "month of bugs" club. On Jan. 1, two security researchers will begin publishing details of a flood of security vulnerabilities in Apple's products.Â Their planÂ is to disclose one bug per day for the entire month, they said Tuesday. The project is being launched by an independent security researcher, Kevin Finisterre, and a hacker known as LMH, who declined to reveal his identity. Some of the bugs "might represent a significant risk," LMH said in an e-mail interview. "Others have a lower impact on security. We are trying to develop working exploits for every issue we find." The two hackers plan to disclose bugs in the Mac OS X kernel as well as in software such as Safari, iTunes, iPhoto and QuickTime, LMH said. Some of the bugs will also affect versions of Apple's software designed to run on Microsoft Corp.'s Windows operating system, he added. LMH was one of the brains behind the recent Month of Kernel Bugs project, which exposed flaws at the core of several different operating systems. It was inspired by an earlier effort, called the Month of Browser Bugs, which was kicked off in July. This latest Apple project is being launched to raise awareness of security vulnerabilities in Apple's products and to "stomp smugness," Finisterre said via e-mail. While the Macintosh is generally considered to be more secure than the Windows PC, many security researchers believe that this reputation is not attributable to any superior security practices on the part of Apple. They say attackers have been deterred by the Mac OS X's more secure Unix kernel and the product's less widespread adoption. Apple enthusiasts and security researchers have been at odds since last August, when David Maynor and Jon Ellch claimed to have discovered a flaw that affected Apple's wireless device drivers. They played a video at the Black Hat conference demonstrating how this flaw could be used to run unauthorized code on a MacBook. However, their claims have been slammed because the demonstration used a third-party wireless card rather than the one that ships with the MacBook, and because the two hackers still have not published the code used in their attack. LMH said the Apple community's negative response to Maynor and Ellch's claims played a role in the decision to launch the Month of Apple bugs. "I was shocked with the reaction of some so-called 'Apple fans,'" he said. "I can't understand why some people react badly to disclosure of issues in their system of choice. ... That helps to improve its security." A similar effort to disclose flaws in Oracle's software had to be abandoned before it was ever launched last month. The man behind the Week of Oracle bugs, Cesar Cerrudo, of Argeniss Information Security, said he pulled the plug when it became clear that the project could damage the relationship between one of his customers and Oracle. "This customer realized that they could have had serious business problems, so they changed their mind and asked to cancel it," he said via instant message on Tuesday. LMH said he didn't expect any legal problems from Apple. "I keep talking to a guy from the Apple security team and I'm willing to help whenever necessary," he said. "I'm far away from any illegal activity." Apple, for its part, did not seem to be upset with the project. "WeÂ always welcome feedback on how to improve security on the Mac," said Anuj Nayar, an Apple spokesman. Â