Hot answers tagged

94

Physical access is total access, right? How is this any worse than a boot CD or yanking the hard drive and popping it into another system? Not that I'm a fan of OSX or this particular feature, but if someone has physical access to a computer with an unencrypted disk, they have access to everything on that disk anyway, so single user mode doesn't make that ...


49

(Note: This answer is from 2013. A lot has changed in Bluetooth since then, especially the sharp rise in BLE popularity, new attacks, deprecated features. Having that said, most of it is still applicable.) Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. ...


49

There is no clear evidence that third party anti-malware security software (AV software) is more effective than Apple's own security solutions to protect Macs. Rich Mogull on the Mac TidBITS blog explains: Far less malware exists for Macs, but even there we see limited effectiveness across tools. For example, in a recent test by Thomas Reed, even the ...


39

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be proper shell commands injected. You could use argument -e of cat for safe operation, see man cat. -e equivalent to -vE -E, --show-ends display $ at end of each line -v, --show-nonprinting ...


36

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program. Any method of triggering Bash execution ...


34

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. The current version of a popular terminal emulator has this problem, resulting in user-assisted ...


32

This is a little long but this exact argument has been rehashed for the last 14 years. I want to put it to bed. I worked for Apple Tech support from 1992-2001 and have been an Apple developer since. So, I have a very good historical view of Apple ecosystem malware security. My conclusion? 3rd party anti-malware software on the Mac is unnecessary and as ...


29

If FileVault is enabled, then you would need the FVDE credentials for one of the FVDE users in order to access single-user mode, even if you move the solid-state drive to a new machine. However, if you are trying to prevent an end user from accessing an Administrator account (and/or the root account), FileVault is not sufficient because of single-user mode. ...


28

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have ...


28

There's a misconception about this. The problem actually isn't the single-user mode. For example consider the following scenario: Someone gets hands on your laptop. No harddrive-encryption and no BIOS-password. Now he has several options. Just to name two of them: Get the harddrive out of the laptop and simply use it from another PC. Getting around any ...


25

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


25

I'll answer in the form of an anecdote. Back in 2003, I was working in tech support for a Mac-based organisation. We were essentially a government contractor and, as such, nearly all our money came from sending Microsoft Word documents to the government to document what we had done and what we should be paid for. Someone managed to bring a Word macro virus ...


25

Despite the common wisdom, I would not recommend running anti-virus for two reasons: Anti-virus does not really work. Though it might catch trivial or well-known viruses, it mostly just gives you a false sense of security. Anti-virus can cause problems. In order to function, anti-virus programs have to situate themselves quite low on the computer ...


23

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much different. The same security practices that apply to your PC also applies to your VMs. Although OSX does not run the same malicious apps that run on ...


22

Macs do get viruses, the main reason why there were historically so few viruses around for Mac is because their market share was so small. When someone writes a virus, most of the time they want to infect as many targets as possible. So 10 years ago this would result in almost only Windows viruses since they had such large market share. Recently, however, ...


21

Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it. There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...


14

For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick. Example of Get-FileHash usage: ...


13

Answer: Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished. IT Services is correct here. Prevention: To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams. How it Happened: A lot of attackers will use shortened URLs or legitimate ...


12

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


12

OS X is based on a BSD derivative, Darwin, which does not typically use GNU libc. So my expectation is that the answer is "no". That the _gethostbyname_r function, defined by glibc, is not available on OS X reinforces this hunch. Let's see if some basic inspection of the library can help. On a CentOS host: $ strings /lib64/libc.so.6 | grep -i gnu ...


12

There are fewer attacks and malware on Mac OS X systems for a variety of reasons, almost none of which having any relation with the notion of "software quality": There are fewer OS X systems than Windows systems (right now, about 7.5% of computers involved in Internet browsing use OS X, according to StatCounter), making OS X a less interesting target for ...


11

Compared to Windows, Mac OS X has: Smaller user base: Means it is less interesting to malware creators, thus fewer viruses. Although there are viruses for Mac OS X, they're not as much as Windows malware. In the past few years, this has been changing, and it's backfiring. Because people think they're less prone to malware, they tend to develop bad usage ...


11

What you'd need to do is determine which processes are running bash. On Linux systems, one vulnerability seems to possibly be in how DHCP requests are handled. You could look at using execsnoop to spot what runs bash and then try doing some normal things - like connecting to a wifi network or browsing webpages that require external helpers (say something ...


11

First, you don't need to do this unless you are are offering web services to the public internet from your Mac. If you are not, wait until there is an official security update from Apple. However, if you are offering web services, you might want to update. Official Patch Apple has released an Official Bash Security Update Here Checking whether you are ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

is there anyway that my colleagues can access my computer information and my personal files? Many ways. From just looking over your sholder when you are not paying attention to installing a hardware key logger to intercepting your network traffic. Someone there probably has administrative access to your machine. Whoever has administrative access can ...


10

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37. From man pmset: destroyfvkeyonstandby - Destroy File Vault Key when ...


9

In a mixed Windows/Unix environment, what I use for common cryptographic algorithms is: OpenSSL for many calculations, especially hashes (but not HMAC) and X.509 certificate manipulations. Python's hashlib and hmac for SHA and HMAC. Unfortunately, neither is provided with Windows, they require a separate installation. Here's a simple one-liner to ...



Only top voted, non community-wiki answers of a minimum length are eligible