Hot answers tagged macosx
19
First there was one...
Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs.
Why do all the security guys have ...
17
Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it.
There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...
14
Introduction
I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...
12
Answer:
Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished.
IT Services is correct here.
Prevention:
To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams.
How it Happened:
A lot of attackers will use shortened URLs or legitimate ...
10
is there anyway that my colleagues can access my computer information and my personal files?
Many ways. From just looking over your sholder when you are not paying attention to installing a hardware key logger to intercepting your network traffic. Someone there probably has administrative access to your machine. Whoever has administrative access can ...
10
Linuxios can already answered this but I'll see if I can explain in more detail. It's not always obvious why Physical Access = Game Over:
It is not a "flaw" because if an attacker has physical access to your computer, the login password cannot protect it.
If your data is not encrypted, an attacker with physical access to your computer will just remove the ...
9
Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like.
As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...
8
sudo cp /usr/bin/curl /usr/bin/curl.bin
sudo vim /usr/bin/curl.wrapper
here is the wrapper:
#!/bin/sh
date >> /var/tmp/curl_ppid.log
ps -f -p $PPID >> /var/tmp/curl_ppid.log
exec curl.bin "$@"
and then:
sudo chmod 755 /usr/bin/curl.wrapper
sudo touch /var/tmp/curl_ppid.log
sudo chmod a+w /var/tmp/curl_ppid.log
sudo ln -sf ...
8
Oh man, you're in for a treat this evening!
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Absolutely. Windows message processing is really complicated. It works a bit like this:
LRESULT CALLBACK WndProc( HWND hwnd, UINT msg, WPARAM wParam, ...
7
In a mixed Windows/Unix environment, what I use for common cryptographic algorithms is:
OpenSSL for many calculations, especially hashes (but not HMAC) and X.509 certificate manipulations.
Python's hashlib and hmac for SHA and HMAC.
Unfortunately, neither is provided with Windows, they require a separate installation.
Here's a simple one-liner to ...
7
Having done the same mistake myself a couple of years ago:
Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all.
For LDAP, however, the common case is that the ...
7
Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30.
Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent ...
7
This is really two questions and aren't really handled well by a single program.
The antivirus question is easy, you'll be wanting ClamX. It is an OSX port of the venerable ClamAV engine. It is widely considered to be the default AV for Unix/Linux systems.
For your other question, free utilities that have good Mac integration may be hard to come across. ...
7
The computer is not yours anymore, it is probably his.
You cannot trust that he did not actually compromise your box further than you currently know about.
He could have compromised the kernel, binaries or virus scanner on your box and you would never know.
I would recommend wiping and re-installing from known good media.
Then scan your current hard ...
7
When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself.
A more appropriate way to resolve this though, would be to ask: ...
7
This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware.
...
7
Is he using your credit? If so contact Apple.
If he's not, then he just might have the same name as you and he's not really doing anything wrong. What you can do is send an email to apple making them aware of the problem so they can force the user to choose a new email address. Since you do not own the apple account, it's not really your right to change ...
7
"You have new mail" in a terminal is a very old Unix behaviour: the shell (the software which interprets the commands you type in the terminal) regularly checks whether the file /var/mail/username (where username is, you guess it, the name of the current user) has been modified (precisely, whether its last modification time is ulterior to its last reading ...
6
According to this table, the software update goes through the same port than the HTTP protocol, so you really just need to open up port 80. Additionally to port 80, I would suggest the following:
443 -> HTTPS
22 -> SSH
115 -> SFTP (don't use regular FTP if you can help it. If you are that paranoid, stick to
SFTP. Otherwise, use 20*)
587 -> Authenticated ...
6
To directly answer your question: Type last at a command prompt and it will show you user names and timestamps of successful login attempts (this doesn't do much good if they pulled your hard drive out to browse your files).
Although you shouldn't do your personal stuff on your work computer (legal reason.. something about the company owning any documents ...
6
You could create big files until the disk is full. Something like this:
dd if=/dev/zero bs=8192 of=junkfile
# ... wait for the disk to fill up, at which point this command exits
sync
rm junkfile
The sync command makes sure that all the zeros in the new file make it to the disk. Then, the rm gives you back your disk space. You should run these commands as ...
6
There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both.
I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that.
The problem with a rootkit is ...
6
Device security is limited to the type of device.
What are the security risks of Bluetooth and what technologies and
best practices should be used to protect my device?
Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...
5
The one tool that comes to mind, particularly for Unixes (or however you're supposed to pluralise that) is openssl:
openssl dgst -sha256 path/to/file
The openssl dgst command provides a lot of common hashing options, and openssl is installed on most Unix systems by default and is also available for Windows. I believe it ships with OSX too. I agree, it is ...
5
See How can files be deleted in a HIPAA-compliant way?
For OS X, the system includes a way to wipe all free space in the Disk Utility program, but that does not take care of slack space (the space between the end of a file and the end of its block). BCWipe can take care of slack space.
HFS+ reserves chains of filesystem space before writes in order to ...
5
Try using Wireshark to do a packet capture and see whats data is being sent out.
Then you should at least be able to tell if its anything to worry about.
Alternatively try using the netstat -p command that will list what programs are currently listing on ports and you can see if there is anything strange.
5
I don't see the quoted instruction on that Apple KB article; the closest I see is:
After completing a task as the root user, you should log out of Mac OS X and log back in using a normal or administrator account. You should disable root access if you do not use it often.
Which seems (to me) like reasonable advice. Having the root account enabled is not a ...
5
I'd normally suggest netstat -n -p in linux, but the Mac/BSD version doesn't associate with connections with processes unlike the linux version.
So maybe try to see if sudo lsof -lnP +M -i4? sudo in case its not your user id thats running it, -lnP to not convert UIDs/ip addresses/ports to usernames/domain names/common services, +M for portmapper ...
5
Yes, OS X is still vulnerable to the Cold Boot Attack, because the encryption keys are kept in memory while the machine is powered on (i.e., from you enter your password on boot until your machine is completely powered off). This is a problem for all software full-disk encryption tools, and not specifically related to FileVault 2.
Depending on the version ...
5
Passwords on desktop computers are meant to:
protect against casual attackers who cannot or do not wish to fiddle with hardware (e.g. your low-tech colleagues or siblings);
protect against remote attacks (passwords are used to authenticate remote logins);
honour a long-standing tradition of typing a password before using the system (even though this does ...
Only top voted, non community-wiki answers of a minimum length are eligible
