Tag Info

Hot answers tagged

42

There is no clear evidence that third party anti-malware security software (AV software) is more effective than Apple's own security solutions to protect Macs. Rich Mogull on the Mac TidBITS blog explains: Far less malware exists for Macs, but even there we see limited effectiveness across tools. For example, in a recent test by Thomas Reed, even the ...


37

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be proper shell commands injected. You could use argument -e of cat for safe operation, see man cat. -e equivalent to -vE -E, --show-ends display $ at end of each line -v, --show-nonprinting ...


36

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program. Any method of triggering Bash execution ...


28

This is a little long but this exact argument has been rehashed for the last 14 years. I want to put it to bed. I worked for Apple Tech support from 1992-2001 and have been an Apple developer since. So, I have a very good historical view of Apple ecosystem malware security. My conclusion? 3rd party anti-malware software on the Mac is unnecessary and as ...


24

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have ...


23

Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...


23

Despite the common wisdom, I would not recommend running anti-virus for two reasons: Anti-virus does not really work. Though it might catch trivial or well-known viruses, it mostly just gives you a false sense of security. Anti-virus can cause problems. In order to function, anti-virus programs have to situate themselves quite low on the computer ...


21

Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it. There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...


20

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. The current version of a popular terminal emulator has this problem, resulting in user-assisted ...


20

Macs do get viruses, the main reason why there were historically so few viruses around for Mac is because their market share was so small. When someone writes a virus, most of the time they want to infect as many targets as possible. So 10 years ago this would result in almost only Windows viruses since they had such large market share. Recently, however, ...


17

I'll answer in the form of an anecdote. Back in 2003, I was working in tech support for a Mac-based organisation. We were essentially a government contractor and, as such, nearly all our money came from sending Microsoft Word documents to the government to document what we had done and what we should be paid for. Someone managed to bring a Word macro virus ...


13

Answer: Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished. IT Services is correct here. Prevention: To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams. How it Happened: A lot of attackers will use shortened URLs or legitimate ...


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


11

Compared to Windows, Mac OS X has: Smaller user base: Means it is less interesting to malware creators, thus fewer viruses. Although there are viruses for Mac OS X, they're not as much as Windows malware. In the past few years, this has been changing, and it's backfiring. Because people think they're less prone to malware, they tend to develop bad usage ...


11

What you'd need to do is determine which processes are running bash. On Linux systems, one vulnerability seems to possibly be in how DHCP requests are handled. You could look at using execsnoop to spot what runs bash and then try doing some normal things - like connecting to a wifi network or browsing webpages that require external helpers (say something ...


10

is there anyway that my colleagues can access my computer information and my personal files? Many ways. From just looking over your sholder when you are not paying attention to installing a hardware key logger to intercepting your network traffic. Someone there probably has administrative access to your machine. Whoever has administrative access can ...


10

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


9

Apparently was turning on "Find My Mac" that turned on the guest account: https://discussions.apple.com/thread/4145011?start=0&tstart=0


9

Linuxios can already answered this but I'll see if I can explain in more detail. It's not always obvious why Physical Access = Game Over: It is not a "flaw" because if an attacker has physical access to your computer, the login password cannot protect it. If your data is not encrypted, an attacker with physical access to your computer will just remove the ...


9

First, you don't need to do this unless you are are offering web services to the public internet from your Mac. If you are not, wait until there is an official security update from Apple. However, if you are offering web services, you might want to update. Official Patch Apple has released an Official Bash Security Update Here Checking whether you are ...


8

Is he using your credit? If so contact Apple. If he's not, then he just might have the same name as you and he's not really doing anything wrong. What you can do is send an email to apple making them aware of the problem so they can force the user to choose a new email address. Since you do not own the apple account, it's not really your right to change ...


8

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


8

Having done the same mistake myself a couple of years ago: Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all. For LDAP, however, the common case is that the ...


8

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37. From man pmset: destroyfvkeyonstandby - Destroy File Vault Key when ...


8

No, as far as I can tell, ordinary OS X desktops are not. OS X DHCP is not vulnerable. These days it doesn’t even invoke a shell at all, and in the versions that used a bootpd that did invoke a shell, that shell was not Bash; some sites have suggested that it would have been tcsh that was executed, but I think it would actually have been /bin/sh, which ...


7

The computer is not yours anymore, it is probably his. You cannot trust that he did not actually compromise your box further than you currently know about. He could have compromised the kernel, binaries or virus scanner on your box and you would never know. I would recommend wiping and re-installing from known good media. Then scan your current hard ...


7

Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30. Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent ...



Only top voted, non community-wiki answers of a minimum length are eligible