Questions tagged [macos]

macOS (formerly Mac OS X and OS X) is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc.

Filter by
Sorted by
Tagged with
88
votes
1answer
11k views

Mac OS X terminal prompt displaying foreign hostname (or: What is Stacey's iPhone doing in my Terminal?)

I opened my Terminal today and saw this: StaceysiPhone6s:~ jcz$ Who is Stacey? Why is she in my Terminal? What happened? What should I be worried about? How do I fix it?
79
votes
7answers
11k views

Can “cat-ing” a file be a potential security risk?

I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've ...
78
votes
8answers
10k views

Should the sole user of a *nix system have two accounts?

Should the sole user of a *nix (particularly Linux and MacOS) have two accounts, one with sudo privileges and one without? Years ago I read that on your personal computer you should do your daily ...
61
votes
5answers
92k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
53
votes
8answers
15k views

Should I get an antivirus for my Mac?

There are some people saying that people should use an antivirus software on Mac. And there are thousands of people claiming that Macs don't get viruses (under this term I mean spyware / malware as ...
53
votes
6answers
11k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
50
votes
4answers
11k views

Isn't OS X's Single-User Mode a bad idea?

Recently, I had a Mac which fried its video logic board. Luckily, Apple had concluded that this was a design flaw and was fixing the affected models for free (see more here). However, I did not find ...
44
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
37
votes
2answers
25k views

How secure is “Secure Keyboard Entry” in Mac OS X's Terminal?

I've been using Terminal under Mac OS X for years but somehow missed to spot this feature: I'm now wondering how does this actually work, and is it 100% safe? If it isn't, what technique could be ...
34
votes
3answers
5k views

Is it insecure to send a password in a `curl` command?

Here’s an example request we can make to the GitHub API: curl 'https://api.github.com/authorizations' --user "USERNAME" This will prompt for the account password, to continue: Enter host password ...
28
votes
2answers
5k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
25
votes
1answer
11k views

Mac OS X from an IT Security Practitioners' Perspective? [closed]

What does the Mac OS X offer that it has been recently attracting users with IT security focus? There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
24
votes
6answers
21k views

How secure is FileVault 2 while the computer is in sleep mode?

How secure is Apples disk encryption FileVault 2 when someone has physical or network access while the computer in sleep mode or is running a screen saver? Are there ways to circumvent FileVault 2 ...
21
votes
7answers
7k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
20
votes
7answers
6k views

How can I protect my computer from my potentially malicious colleagues?

So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
19
votes
1answer
902 views

Keyboard firmware hack - Linux vulnerable?

I see that Apple patched OS X to mitigate against K. Chen's famous Apple keyboard firmware hack. However: Apple keyboards can be used with computers running other operating systems; and in any case, ...
16
votes
3answers
15k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
15
votes
2answers
10k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
15
votes
2answers
3k views

Mac OSX: What is the safest way to access an unknown USB storage?

Let's say a friend gives me a SD-card which I'm not sure is safe (i.e. it may contain malware), what is the safest way to access this card on a Mac OSX? E.g. is it possible to create a sandbox in ...
14
votes
1answer
5k views

Does the GHOST vulnerability affect Macs?

Although the vulnerability targets Linux, I have read that it is really a glibc vulnerability, and some sites suggest that one should install a fix on any platform. I know that there are a lot of ...
12
votes
2answers
5k views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
12
votes
1answer
620 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure Apple'...
11
votes
4answers
2k views

What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?

I don't want this to be subjective, so I'll try to make the requirements as clear as possible. On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY: Using the internet ...
11
votes
4answers
14k views

Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?

I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault". Does the FBI/NSA or other government agencies have access to my data or can ...
11
votes
3answers
1k views

Reading keystrokes of other applications

Is it possible for other application running in the OS to read the keystrokes that my application uses? What about mouse events and window handles? Is there any security wall that the OS uses to ...
11
votes
3answers
54k views

How do I detect malware on Mac OS X?

I have a computer running OS X, and I want to know if there's malware (e.g. a keylogger, or something that lets an attacker control my computer, or something that stops me from installing whatever I ...
11
votes
1answer
2k views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
11
votes
1answer
845 views

Universal clipboard iOS10 and macOS. How secure?

New iOS10 and macOS Sierra has a feature called universal clipboard. You can copy something (text, image) on one device and paste it on another. How secure is it and does that mean that everything ...
11
votes
2answers
2k views

Is using Touch ID with FileVault full disk encryption secure?

I recently purchased a Macbook Pro (late 2016) which now includes Touch ID, like the iPhones have been for a while. Although this is a very convenient addition, I am wondering how this affects the ...
10
votes
2answers
1k views

How does the DYLD privilege escalation vulnerability work on OS X?

Just reading about the DYLD privilege escalation vulnerability reported by Stefan Esser at https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html I understand this allows anyone to ...
10
votes
2answers
3k views

Rootkits on Mac OS X

Is there known existence of rootkits for Mac OS X, and can you please provide examples? What software would you recommend to detect rootkits on OS/X? From a software developer's perspective, can you ...
9
votes
7answers
5k views

Safe to connect to external drive?

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
9
votes
2answers
6k views

OSX HomeBrew Security Risks

I've been trying to harden my OSX 10.11 computer and one of the guides suggested installing Homebrew to get updates to things such as OpenSSL. While updates are great, it seems like Apple should be ...
8
votes
2answers
745 views

macOS and .ssh/id_rsa security

My super crucial private key is stored at ~/.ssh/id_rsa with a chmod of "-rw-------" I run a lot of applications on my Mac. For example: Bash scripts .app binaries (For example, Sketch.app) Ruby ...
8
votes
3answers
3k views

Who (which process) is calling curl?

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server. Basically I installed little Snitch and find out that "somebody" is using curl periodically. ...
8
votes
3answers
596 views

Secure cleaning of deleted files

So I know how to secure delete files. But at our company, we have a laptop which had many important documents, which now have been deleted, but not in a secure way. We can't perform a full format of ...
8
votes
2answers
1k views

Using FileVault on a Mac with existing data

I have recently got a Mac which I have started using already without any encryption while looking for the best solution. I have come to the conclusion that using Mac's own file encryption technology ...
8
votes
1answer
665 views

How can I secure my log files?

I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
8
votes
4answers
2k views

Verify Mac firmware is not hacked…how to do?

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards. Normally, Little Snitch will report every app that uses the internet. Every ...
8
votes
2answers
9k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting itself at times. When looked at its logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
8
votes
4answers
1k views

What FDE (with hardware encrypted drives) for OS X works?

I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration ...
8
votes
1answer
2k views

What encryption method is used by the zip program in macOS?

In order to send a file securely I am going to encrypt/password protect a zip file. (Why I am doing this). I am using macOS Sierra 10.12.6 and through my research I have concluded that encrypting a ...
8
votes
1answer
497 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
8
votes
3answers
709 views

How secure is OS X's Keychain access control?

On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access. Supposedly, the system saves not only the binary path, but also its hash in ...
7
votes
4answers
9k views

Why are Macs more secure? [closed]

People often say that Macs are more secure than say Windows. Which is why many Mac users don't have antiviruses. But why is this? Is it because of the need for a password for sudo commands, like ...
7
votes
4answers
764 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
7
votes
4answers
505 views

Freaked out by “impossible click” in logs

I was staging an isolated production environment and accessing it's remote PHP script from my local mac on http://example.com/XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0 I saw my click in the log as ...
7
votes
8answers
14k views

MacOS Ransomware with EFI Lock

Problem Description Yesterday my mother called me that she got a message on her iPhone, that it was stolen (iCloud Find My Phone). She then had to enter security codes (two-factor authentication) ...
7
votes
3answers
10k views

How to patch Bash on OSX in wake of “shellshock”? [duplicate]

My Mac is vulnerable, as this test shows: x='() { :;}; echo VULNERABLE' bash -c : (source) I am using the version of bash that came with it. I also use Homebrew. What is the preferred way to patch ...