Mac OS X is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc.

learn more… | top users | synonyms

3
votes
1answer
110 views

How can I view images in forwarded packets on (current) Mac OS X?

How can I view reassembled images on a Mac being used as a router? I'd like to do this as a demonstration of how HTTP doesn't provide privacy. I've done some research, and on Linux there's a tool ...
3
votes
0answers
37 views

Where could the iOS security key be stored on the hard drive, *if printed* when enabling 2 Factor?

Apple allows people to print out their recovery key when enabling two factor. Taking the assumption that the local spooler may not do a great job of protecting, secure erasing, and eliminating traces ...
5
votes
1answer
473 views

Is Adobe Flash Player installer redirect due to a malware?

When I go to http://get.adobe.com/flashplayer/ 'Install Now' will redirect me to their homepage without downloading the update or any explanation. What could be going on? Is some malware ...
6
votes
4answers
557 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
2
votes
1answer
48 views

What full-disk secure erase solutions exist for SSDs (OS X)? [duplicate]

I want to back up the contents of my Macbook before encrypting it, but after I'm done, I would like to sanitize the SSD that I have backed up my files to, since it will be unencrypted (no point ...
1
vote
0answers
23 views

How do I stop MacBook port scanning & fragment packet attacks

How can I stop OSX El Capitan from port scanning and stop fragmented packet attacks?
1
vote
0answers
37 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
0
votes
1answer
18 views

What is the accessibility of a process's environment on OS X?

Are the environment variables of a process running on a modern OS X system accessible to other processes? If so, is this information accessible only to the same user and root? This answer from Gilles ...
1
vote
2answers
108 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
7
votes
1answer
819 views

OSX HomeBrew Security Risks

I've been trying to harden my OSX 10.11 computer and one of the guides suggested installing Homebrew to get updates to things such as OpenSSL. While updates are great, it seems like Apple should be ...
1
vote
2answers
352 views

Spoofing TCP/IP stack OS Fingerprinting attacks in OSX

We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks. For Windows machines there are tools/guides for doing that, but can't find ...
0
votes
0answers
376 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
-2
votes
1answer
204 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
8
votes
3answers
521 views

Secure cleaning of deleted files

So I know how to secure delete files. But at our company, we have a laptop which had many important documents, which now have been deleted, but not in a secure way. We can't perform a full format of ...
1
vote
0answers
1k views

How do I view the signature of an iOS application?

OSX had an issue where the certificate was expired and several apps could not be opened after that date. The command above illustrates how this could have been detected. Does iOS have a similar ...
3
votes
1answer
60 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
1
vote
1answer
3k views

Single user mode for Windows

I am familiar with single user mode on OSX. By holding down Command-S, you can boot into a terminal as root. Resetting the PRAM with Command-Option-P-R will disable any firmware protection that would ...
3
votes
1answer
295 views

How safe is the encryption offered by Mac OS X's Finder?

If you plug in a USB drive, open it in Finder and right-click the Finder window, you get the option to encrypt the drive. What methods does Finder use to encrypt the drive and how safe is it ...
3
votes
1answer
85 views

FileVault and Sleeping mode

I have FileVault activated on 10.10. (Mid 2012 MacBook Pro - MPB) I relaized already that there are different sleep modes. autopoweroff and normal Standby. Whenever the MBP goes into Hypernate mode, I ...
1
vote
0answers
198 views

Is checking out network traffic for suspected malware useless if the malicious actor is in a different timezone? [closed]

I had recently upgraded from OS X 10.10 (Yosemite) to OS X 10.11 (El Capitan) from a bootable drive that the Genius Bar of one of the my city's Apple stores has, and I installed the 10.11.1 update ...
3
votes
1answer
294 views

Upgrade shell to meterpreter behind NAT

I've been playing around with Metasploit the past week, and am successfully able to obtain a basic shell of the victim over the internet. I've currently: Created a DDNS that points to my public IP ...
2
votes
0answers
91 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
8
votes
1answer
205 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
3
votes
3answers
677 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, dis-...
2
votes
1answer
5k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed out)...
0
votes
2answers
222 views

How do I find the source of network traffic from a specific host?

My firewall identifies an unusual amount of traffic to 8.8.4.4 from host 192.168.76.22 (a Mac OS X Server). Within that server, the network connections are defined with a primary DNS pointing to my ...
2
votes
1answer
87 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
7
votes
4answers
3k views

Why are Macs more secure? [closed]

People often say that Macs are more secure than say Windows. Which is why many Mac users don't have antiviruses. But why is this? Is it because of the need for a password for sudo commands, like ...
2
votes
1answer
67 views

apparmor alternative for MacBook [closed]

Does anyone know an alternative to apparmor for Mac? Every time I use winebottler my MacBook gets Windows viruses. Wanted to protect my Mac from it.
3
votes
1answer
5k views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration (SHA-...
3
votes
2answers
209 views

How to track down and remove Mac malware that is calling out? [duplicate]

Little Snitch periodically brings up a dialog that says: Terminal via node wants to accept an incoming connection from X on port 3000 (remoteware-cl). X are different IPs in eastern europe. A full ...
3
votes
1answer
137 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
0
votes
1answer
131 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
5
votes
2answers
248 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
3
votes
1answer
1k views

How is Facebook accessing my iPhone texts in order to recommend friends?

I have noticed that Facebook has been recently recommending people who have texted me. It has been able to connect their number (I believe most of these people are using iPhone) and connect their ...
1
vote
1answer
86 views

Patching Mac DMA attack

I want to know a few things about the blackhat attack that attacks thunderbolt. Is there anyway to wipe or patch a currently infected computer? I am not versed per se in THAT level of security. I was ...
7
votes
4answers
2k views

Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?

I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault". Does the FBI/NSA or other government agencies have access to my data or can ...
0
votes
2answers
114 views

If there is a malicious attack on one partition, is the other one safe?

I recently have used Bootcamp to set up a new partition and run Windows 7. About half of my HDD is designated to my OS X partition and the other half is allocated to the new Windows 7 partition. If ...
3
votes
5answers
451 views

Enforcing personal firewall for OS X

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
5
votes
2answers
439 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
1
vote
1answer
360 views

How to determine which program accessed the Mac Camera?

The green light on my laptop's camera just flashed on and then off after 1 second. I am extremely concerned about this since I am not running any programs which could have enabled the camera. I ...
2
votes
0answers
410 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
9
votes
2answers
716 views

How does the DYLD privilege escalation vulnerability work on OS X?

Just reading about the DYLD privilege escalation vulnerability reported by Stefan Esser at https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html I understand this allows anyone to ...
3
votes
1answer
605 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
2
votes
1answer
430 views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
1
vote
1answer
261 views

CryptoAPI to CommonCrypto with RC4

I have cryptographic code used in the Windows platform, which uses the Crypto API functions and need to convert this to using Common Crypto on OS X. Essentially the original code is this, with error ...
1
vote
2answers
661 views

Macbook pro, rootkithunter

I've never really tried to understand rootkit enough, I'm too much paranoid... I recently reinstalled mountain lion, but my EFI might be infected. I have a macbook pro, it was really slow at some ...
1
vote
2answers
6k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...
22
votes
7answers
5k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
0
votes
0answers
77 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...