MySpace to Apple: Fix that worm
683252
After worm spreads on social-networking site, MySpace asks Apple to update its QuickTime media player.
76646
Blog: Various people hiding behind pseudonyms are fueling news about a supposed worm for Mac OS X.
111724
Blog: Underground sites fuel interest in breaking Apple's mobile security.
629732
Apple has released its first security updates of the new year, fixing bugs in its QuickTime media player and iPhone and iPod touch devices.As with previous updates, the iPhone 1.1.3 software patch sent those who had installed the unauthorized Jailbreak software -- used to run third-party applications on the iPhone -- scrambling to get their phones up and running. That&#39;s because Apple&#39;s updates have so far always rendered Jailbreak unusable, forcing users to go through a complex re-installation process.According to the Unofficial Apple Weblog, it is possible to run third-party software following this latest update, but the process is complex. A simpler Jailbreak 1.1.3 script is expected to be posted eventually at the iPhone Wiki, which is the hub of much iPhone hacking.The iPhone update fixes two flaws in the Safari browser, including a critical bug that could be exploited to run unauthorized software on the device. A third bug could let an unauthorized user bypass Passcode Lock and launch iPhone applications. The iPod touch is susceptible to the Safari bugs, Apple said.These updates will be rolled out to customers over the next week via the devices&#39; iTunes update mechanism.The QuickTime 7.4 update fixes four critical flaws in the software that could be exploited by attackers to crash the media player or even run unauthorized software on a victim&#39;s computer. The update is available for both the Windows and Mac OS X operating systems.However, the software does not fix a serious flaw in the player that was disclosed over the weekend.Security experts are particularly concerned over this flaw because attack code showing how it can be exploited has also been published. Apple is still working to fix the vulnerability, which has to do with QuickTime&#39;s use of the Real-Time Streaming Protocol.
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
406616
Insecurity through obscurity Apple has released updates for two widely distributed products that harbored a raft of security vulnerabilities, some of which were actively being exploited by miscreants. Unbelievably, the company isn't presenting either as a security fix to mainstream users despite the risk the bugs pose for its millions of users.â¦
647033
There's a fascinating debate today going on about Scoble and his Facebook data. Here's the story so far. Plaxo, on behalf of Scoble, ran a screen scraper on his Facebook account to download information about at least some of his Facebook friends. Facebook detected the scraper and turned off his account, with an email explaining that he had violated their terms of service. The debate: Who is right -- Scoble or Facebook? While there are certainly arguments that Facebook has some rightness, most of it, imho, is with Scoble. Sure, some of the data may "belong" to his friends, like their birthday and mail address. Technically of course the data doesn't belong to anyone, it's data about them, and many organizations have this data. Are bloggers really saying that organizations have more rights than people? Isn't blogging all about a level playing field? My bank knows my birthday and my email address. Why shouldn't Scoble? (Maybe he shouldn't.) Scoble called a few minutes ago. I asked what the consensus was. He said it was about 70 percent in his favor, 30 percent in Facebook's. I think we can win over the 30 percent by saying that there should be a system whereby people can decide how much information they want to share with Scoble, or people like Scoble, or me, or people like me, or BofA or the DEA, KGB or CIA. Further, that system is not Facebook, unless they change.  Now, I think there's a pretty good chance that Facebook will change and give Scoble his data and turn his account back on. I think Facebook wants to give us access to our data, but if they just turned the feature on, there would be a shitstorm, kind of like the one that's raging right now. Except this time Facebook has defenders, which they must find refreshing, because every time there's been a shitstorm around Facebook they've always been seen as 100 percent evil by most people. (Not by me, btw.) Maybe they're getting smart there over at Facebook. Maybe they will relent, kind of admit they were wrong, and secretly be happy that they got to open their network up some more.  However, if Facebook doesn't open up and allow people a system to say who can access what information, we still have to create that system somehow. Google could have done it, but they didn't. Same with Yahoo or Microsoft. These companies don't want to empower the users, but if they studied history, they'd see that the evolution of computers always comes in fits and starts. A period when the technology is new and people are snowed by the companies and let them have full control. Gradually people understand what's going on, and figure out they're being screwed but they accept it. And then explosively the whole thing disintegrates in a new layer of technology.  It's a big effin loop we're in. One of these times around one of the companies that feels (incorrectly) that they have a lock on their users, will voluntarily give it up and be a leader in Generation N+1. I've never seen it happen, but in theory I think it could.  In other words, Apple and Microsoft could have invented the web instead of TBL. DEC and Data General could have invented the personal computer instead of Apple and Microsoft (I know this is a simplification, there were lots of individuals and small companies that did it.) And IBM could have invented the minicomputer instead of DEC and Data General. And btw, the NY Times and CNN could have invented blogging and RSS.  So Facebook has the opportunity to be a crossover company, part of the next generation -- or a last gasp of the generation that's about to run out of gas. It's their choice. And it's fitting somehow that Scoble is the poster child for users in this cycle.
584858
(InfoWorld) - The beta build of Mac OS X 10.5 "Leopard" that Apple handed out to developers June 11 at its Worldwide Developers Conference (WWDC) has leaked to the Internet and is being downloaded by users of PirateBay, the Swedish torrent tracker. Last Monday, CEO Steve Jobs spent most of this 90-minute WWDC keynote address touting the upcoming OS, which is set for release in October. Eight days later, the beta labeled build "9A466" was uploaded to PirateBay. The first upload on Tuesday didn't take -- there was only one "seeder," the term for a computer that has a complete copy of the torrent file -- but the second yesterday is being downloaded and assembled, according to comments left by numerous users. As of late yesterday, only four seeders were available, with 181 "leechers," or computers that have downloaded only part of the complete torrent. By 3 p.m. today EDT, however, the numbers had climbed to 44 seeders and more than 1,500 leechers. The beta was also posted to the private, invitation-only torrent tracker Oink yesterday, according to CrunchGear, a tech blog. But when CrunchGear exposed the leak, Oink pulled the beta. That sent downloaders into a verbal rage during which they vented their collective spleens at the blogger who outed Oink. "Go [expletive deleted] yourself you [expletive deleted] rat," ranted one. Based on the PirateBay listing, the Leopard 9A466 beta weighs in at a bit more than 6GB. But the exact byte count worried a user tagged as "konelli." "It's definitely not my intention to spoil the party, but how do we know that this is the real thing? Last time I checked, the WWDC version was supposed to be 6.94GB (or 7,450,640,384 bytes). This is, well, less. Has anybody finished downloading who could confirm that this is genuine?" Apple was asked if it planned to pursue the person or persons who leaked the build to BitTorrent, or what actions it might take against PirateBay. It did not immediately respond with comment, however. The first question is especially important in light of past history. The last time an under-development version of Mac OS X ended up on BitTorrent, the Cupertino, Calif.-based computer maker brought out its lawyers. In December 2004, Apple sued three men, as well as 25 others identified only as "Does," for releasing a developer preview of Tiger, Mac OS X 10.4, via the BitTorrent file-sharing network. All three were members of the company's own Developer Connection, Apple claimed, and had illegally leaked their copies of Tiger. But after several Apple notables, including co-founder Steve Wozniak, pleaded for leniency in blogs and other online postings, Apple backed off a bit. During a 10-month span from March to December 2005, Apple signed a settlement with the three named defendants: students Vivek Sambhara, David Schwartzstein, and David Steigerwald. Each promised to never again release information about the company or its products, while media accounts reported that Schwartzstein and Steigerwald also distributed repentant statements and paid damages to Apple. "We are pleased that Mr. Steigerwald has taken responsibility for his actions and that we can put this lawsuit behind us," Apple spokesman Steve Dowling told the Associated Press in March 2005 after the company settled with David Steigerwald, then a 22-year-old North Carolina college student.
451531
Code that takes advantage of a Safari flaw could leave an iPhone open to attack.
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.
462043
Nasty ActiveExploit Security flaws in an ActiveX control used in MySpace upload images onto the social networking sites leave users open to attack. Facebook users may also be at risk.â¦
494470
Apple rolls out four patches as Microsoft scrambles to head off a zero-day attack. Also: Routers at risk.
600062
Google&#39;s Orkut social networking site appeared to have been hit by a relatively harmless worm, but one that demonstrated the continuing vulnerability of Web applications.Some Orkut users received an e-mail telling them they had been sent a new scrapbook entry -- a type of Orkut message -- on their profile from another Orkut user.They only had to view their profile to become infected by the worm, which added them to an Orkut group, &quot;Infectados pelo V&#237;rus do Orkut,&quot; wrote the blogger Kee Hinckley on his site TechnoSocial.The name of the group, in Portuguese, roughly translates to &quot;infected by the Orkut virus.&quot;&#160;Orkut is popular in Brazil, as well as&#160;India, but has not caught on as well outside those countries compared to MySpace and Facebook.The description of the group reveals that the worm was designed to show Orkut could be dangerous to users even if they do not click on malicious links, Hinckley wrote. The worm apparently did not try to steal any personal data.The worm was also noted by Orkut Plus, a site that offers Orkut security tips, and discussed in Google&#39;s Orkut help group.At one time the infected group was adding new members at a rate of 100 per minute, and had reached a few hundred thousand members, according to various postings, but the problem appears now to be fixed, Hinckley wrote.Orkut&#39;s scrapbook feature allows people post messages that contain HTML code, but it may lack a filter to strip out malicious JavaScript, Hinckley wrote.&quot;It does not appear at first glance that the worm does anything more dangerous than pass itself on to one or more of your friends,&quot; he wrote. &quot;I think it unlikely that it would be able to steal your password, although it could potentially access other private information.&quot;&#160;
618610
Could this be an end to broken links? New software replaces and updates links on Web pages.
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
769408
In 1980, I signed a deal with a company to market a product I was developing. The contract required me to turn over the source code, which I did. One day I went to a meeting at the office of the company, and there on the product manager's desk, right next to a door that opened to the outside, was a floppy labeled "Dave Winer's source code" in big letters.  If you own a Mac you may soon find out what that felt like. It's amazing to me that the tech blogosphere doesn't treat Apple's policy re broken hard disks as the huge gaping security hole that it is.  Think about it. We worry about bad people getting their hands on little pieces of data that, when added together, give them the power to be you in banking and credit transactions.  Think about what you would do if your laptop was stolen. Well, if you own a Mac and its hard disk goes bad, and you make the mistake of bringing it to Apple for service, you will turn over all that data to Apple. Not "may" or "might" but "will." What Apple in turn does with that data is none of your affair. They don't sign anything or offer any guarantees that they won't sell the disk to a data miner. Think it can't happen or that it's unlikely? I don't gain much comfort from your feeling of security. I've been writing about this issue since December 22. Usually when I write something critical of Apple, the results are mixed. Some people are supportive, but far more people attack. This time the ratio is very different. Almost everyone who has commented gets that there's a huge problem here. Can we solve this problem? Of course we can.  Some say that other vendors do this too. That gives me less comfort, not more. That means there's no escaping this crazy way of treating user's confidentiality. Ultimately it hurts the vendors because people can't use their computers for things the manufacturers say we can.  Further, it's got to be an issue for the banks, brokerage firms, credit agencies. If you are a newspaper and you employ reporters and they use a computer, how exactly are you guarding the confidentiality of your sources? If you're a confidential source, don't you have an interest when the reporter gives their computer manufacturer all their data to do with as they please? Imagine what you would do if it turned out there was a bug in a Netgear or Linksys router that allowed, under special circumstances, a mailicous person to gain access to the full content of your hard disk at any time. Would you have a problem with that? This is worse than Microsoft's neglect of malware that got me to stop using their computers. In that case it was Microsoft being neglegent. This time Apple itself is the cause of the problem. It's as if they planted a virus in their operating system that entitled them, under special circumstances, completely out of the user's control, to gain access to everything on your disk, with as much time as they want, with no way for you to prevent or even detect the intrusion.  See also: My letter to Steve Jobs.
613037
(InfoWorld) - An anonymous security researcher claimed this weekend to have created a worm that exploits a vulnerability in the Mac OS X operating system which Apple missed in a May round of patches. A poster on theÂ Information Security Sell OutÂ blogÂ said Sunday that he or she had written a proof-of-concept worm "in a few hours" that exploits a variation of a vulnerability patched in May by Apple. According to the researcher (actually, in one posting, "writers" is used so there may be more than one contributing), he or she exploited a still-unpatched bug in mDSNResponder, a component of Apple's Bonjour automatic network configuring service, in the worm's code. "This vulnerability, as with the ones fixed, gives remote root access," the researcher said. Apple'sÂ May security update,Â 2007-005, included a fix for the mDSN bug. Info Sec's blogger(s) said the worm was also "very 'customer' specific" and crafted for cash. "[It] could easily be changed to be more malicious," said the researcher. The same blogger made aÂ minor stirÂ in April when, after a $10,000 security conference contest concluded, he or she claimed to have grabbed the exploit from the conference wireless network and reverse-engineered the vulnerability. Conference organizers, however, denied that the wireless network had been cracked. When asked to back up his or her claims, the Info Sec blogger only replied: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not." In the same comment thread, the Info Sec blogger also promised to post the captured packets and other information "Once this bug is patched by Apple and I am satisfied that I would not be adding additional risk." Apple patched theÂ QuickTime vulnerabilityÂ May 1. The Info Sec blogger has not yet, however, posted the nicked network traffic. Attempts to reach the Info Sec blogger via e-mail were unsuccessful.