Hot answers tagged

140

At some point, your network assigned StaceysiPhone6s an IP address. Then, your laptop got that IP address. Your Mac then looked up the DHCP logs to find out who 'owned' that IP and found "StaceysiPhone6s". So, it used that info to set the local hostname value. Example: https://apple.stackexchange.com/questions/30552/os-x-computer-name-not-matching-what-...


99

Updated dramatically after 69 upvotes, see answer history for original answer. Thanks to @JimmyJames for the discussion. First, let's talk about threat model: what are you trying to stop the potential attacker from doing? Threat model: identity theft / ransomeware on a single-user system Generally for end-user systems the de facto threat model is identity ...


97

Physical access is total access, right? How is this any worse than a boot CD or yanking the hard drive and popping it into another system? Not that I'm a fan of OSX or this particular feature, but if someone has physical access to a computer with an unencrypted disk, they have access to everything on that disk anyway, so single user mode doesn't make that ...


73

Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because: The password gets saved to the command history (~/.bash_history) as a part of the command. Note: This can be avoided by adding a space in front of the command before running it (provided you ...


70

(Note: This answer is from 2013. A lot has changed in Bluetooth since then, especially the sharp rise in BLE popularity, new attacks, deprecated features. Having that said, most of it is still applicable.) Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I'...


61

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide this kind of direct access. But it has other problems like the ability to unexpectedly emulate devices like a keyboard, see BadUSB.


60

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. rxvt-unicode (versions 2.7—9.19, patched in 9.20) allows read/write access to X window ...


57

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


51

There is no clear evidence that third party anti-malware security software (AV software) is more effective than Apple's own security solutions to protect Macs. Rich Mogull on the Mac TidBITS blog explains: Far less malware exists for Macs, but even there we see limited effectiveness across tools. For example, in a recent test by Thomas Reed, even the ...


48

At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from the user's password using a KDF like PBKDF2 or Argon2 and then used to encrypt the DEK. When changing the password, the DEK is simply encrypted with a new KEK ...


47

Yes. New add 2020-01-25: From time I've switched from LATIN-1 encoding to UTF-8 as default encoding in most of my systems, I've found some interresting features around this (there are now two lenght for one string)... For sample, as I like to play with bash, I've asked why bash localization won't work with multilines strings. This bash feature present a ...


35

This is a little long but this exact argument has been rehashed for the last 14 years. I want to put it to bed. I worked for Apple Tech support from 1992-2001 and have been an Apple developer since. So, I have a very good historical view of Apple ecosystem malware security. My conclusion? 3rd party anti-malware software on the Mac is unnecessary and as ...


35

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program. Any method of triggering Bash execution ...


35

Your data is probably* safe if the following three criteria are met: You have FileVault turned on (full disk encryption). Your laptop requires a password on boot and every time you open the lid (auto screen lock). Your password is not well known (easy to guess). TL;DR; If you don't have FileVault turned on, then your data is in plaintext and anyone can ...


30

If FileVault is enabled, then you would need the FVDE credentials for one of the FVDE users in order to access single-user mode, even if you move the solid-state drive to a new machine. However, if you are trying to prevent an end user from accessing an Administrator account (and/or the root account), FileVault is not sufficient because of single-user mode. ...


29

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have a ...


28

There's a misconception about this. The problem actually isn't the single-user mode. For example consider the following scenario: Someone gets hands on your laptop. No harddrive-encryption and no BIOS-password. Now he has several options. Just to name two of them: Get the harddrive out of the laptop and simply use it from another PC. Getting around any ...


26

In most situations, requiring a password with sudo is sufficiently enough protection. The primary difference between suing to another account and sudoing to gain privileges is that with sudo you enter the same password you used to log in. If your threat model assumes that an attacker has your account password, then you're already in pretty deep trouble, ...


25

I'll answer in the form of an anecdote. Back in 2003, I was working in tech support for a Mac-based organisation. We were essentially a government contractor and, as such, nearly all our money came from sending Microsoft Word documents to the government to document what we had done and what we should be paid for. Someone managed to bring a Word macro virus ...


25

Despite the common wisdom, I would not recommend running anti-virus for two reasons: Anti-virus does not really work. Though it might catch trivial or well-known viruses, it mostly just gives you a false sense of security. Anti-virus can cause problems. In order to function, anti-virus programs have to situate themselves quite low on the computer ...


24

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much different. The same security practices that apply to your PC also applies to your VMs. Although OSX does not run the same malicious apps that run on windows ...


22

Macs do get viruses, the main reason why there were historically so few viruses around for Mac is because their market share was so small. When someone writes a virus, most of the time they want to infect as many targets as possible. So 10 years ago this would result in almost only Windows viruses since they had such large market share. Recently, however, ...


19

I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account password. We worked out who owned the laptop previously, called her, and to my utter surprise, she said she threw it in the bin. It was an older laptop and about ...


17

By default, echo leaves a trailing newline. So you need to do: echo -n Hello | md5sum 8b1a9953c4611296a827abf8c47804d7


17

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.) The smartphone pretty much acts like an usb stick. So every security risk you get with ...


16

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37. From man pmset: destroyfvkeyonstandby - Destroy File Vault Key when ...


16

There are fewer attacks and malware on Mac OS X systems for a variety of reasons, almost none of which having any relation with the notion of "software quality": There are fewer OS X systems than Windows systems (right now, about 7.5% of computers involved in Internet browsing use OS X, according to StatCounter), making OS X a less interesting target for ...


16

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have ...


15

I completely agree with AndrolGenhald's high-level answer. In case you are interested in a complementary low-level walk-through of Android's storage encryption implementation: Android can do File-Based Encryption (FBE) and Full-Disc Encryption (FDE), with "disc" referring to the /data partition. I will focus on FDE to illustrate the principle. The set-up is ...


Only top voted, non community-wiki answers of a minimum length are eligible