Hot answers tagged

95

Physical access is total access, right? How is this any worse than a boot CD or yanking the hard drive and popping it into another system? Not that I'm a fan of OSX or this particular feature, but if someone has physical access to a computer with an unencrypted disk, they have access to everything on that disk anyway, so single user mode doesn't make that ...


62

Yes. Android devices have the capabality to act as basically any USB device. This opens up gates for all kind of Bad USB attacks like Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device). Then it could act as a network device and setup MITM These two are ...


59

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide this kind of direct access. But it has other problems like the ability to unexpectedly emulate devices like a keyboard, see BadUSB.


55

(Note: This answer is from 2013. A lot has changed in Bluetooth since then, especially the sharp rise in BLE popularity, new attacks, deprecated features. Having that said, most of it is still applicable.) Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I'...


49

There is no clear evidence that third party anti-malware security software (AV software) is more effective than Apple's own security solutions to protect Macs. Rich Mogull on the Mac TidBITS blog explains: Far less malware exists for Macs, but even there we see limited effectiveness across tools. For example, in a recent test by Thomas Reed, even the ...


39

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be proper shell commands injected. You could use argument -e of cat for safe operation, see man cat. -e equivalent to -vE -E, --show-ends display $ at end of each line -v, --show-nonprinting ...


36

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program. Any method of triggering Bash execution ...


34

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. The current version of a popular terminal emulator has this problem, resulting in user-assisted ...


32

This is a little long but this exact argument has been rehashed for the last 14 years. I want to put it to bed. I worked for Apple Tech support from 1992-2001 and have been an Apple developer since. So, I have a very good historical view of Apple ecosystem malware security. My conclusion? 3rd party anti-malware software on the Mac is unnecessary and as ...


29

If FileVault is enabled, then you would need the FVDE credentials for one of the FVDE users in order to access single-user mode, even if you move the solid-state drive to a new machine. However, if you are trying to prevent an end user from accessing an Administrator account (and/or the root account), FileVault is not sufficient because of single-user mode. ...


28

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have ...


28

There's a misconception about this. The problem actually isn't the single-user mode. For example consider the following scenario: Someone gets hands on your laptop. No harddrive-encryption and no BIOS-password. Now he has several options. Just to name two of them: Get the harddrive out of the laptop and simply use it from another PC. Getting around any ...


27

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


25

I'll answer in the form of an anecdote. Back in 2003, I was working in tech support for a Mac-based organisation. We were essentially a government contractor and, as such, nearly all our money came from sending Microsoft Word documents to the government to document what we had done and what we should be paid for. Someone managed to bring a Word macro virus ...


25

Despite the common wisdom, I would not recommend running anti-virus for two reasons: Anti-virus does not really work. Though it might catch trivial or well-known viruses, it mostly just gives you a false sense of security. Anti-virus can cause problems. In order to function, anti-virus programs have to situate themselves quite low on the computer ...


23

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much different. The same security practices that apply to your PC also applies to your VMs. Although OSX does not run the same malicious apps that run on ...


22

Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it. There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...


22

Macs do get viruses, the main reason why there were historically so few viruses around for Mac is because their market share was so small. When someone writes a virus, most of the time they want to infect as many targets as possible. So 10 years ago this would result in almost only Windows viruses since they had such large market share. Recently, however, ...


16

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.) The smartphone pretty much acts like an usb stick. So every security risk you get with ...


15

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have ...


14

For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick. Example of Get-FileHash usage: C:\Windows&...


13

Answer: Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished. IT Services is correct here. Prevention: To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams. How it Happened: A lot of attackers will use shortened URLs or legitimate ...


12

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf /usr/bin/curl....


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


12

OS X is based on a BSD derivative, Darwin, which does not typically use GNU libc. So my expectation is that the answer is "no". That the _gethostbyname_r function, defined by glibc, is not available on OS X reinforces this hunch. Let's see if some basic inspection of the library can help. On a CentOS host: $ strings /lib64/libc.so.6 | grep -i gnu ...


12

There are fewer attacks and malware on Mac OS X systems for a variety of reasons, almost none of which having any relation with the notion of "software quality": There are fewer OS X systems than Windows systems (right now, about 7.5% of computers involved in Internet browsing use OS X, according to StatCounter), making OS X a less interesting target for ...


11

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


11

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37. From man pmset: destroyfvkeyonstandby - Destroy File Vault Key when ...


11

Compared to Windows, Mac OS X has: Smaller user base: Means it is less interesting to malware creators, thus fewer viruses. Although there are viruses for Mac OS X, they're not as much as Windows malware. In the past few years, this has been changing, and it's backfiring. Because people think they're less prone to malware, they tend to develop bad usage ...



Only top voted, non community-wiki answers of a minimum length are eligible