Mac malware Crisis as Apple lets slip its Mountain Lion
Miscreants have developed a sophisticated multi-platform attack dog designed to maul Windows and Mac OS X computers.
The malware comes bundled in an Java Archive file which pretends to be Adobe Flash Player, named AdobeFlashPlayer.jar. Inside the malicious archive is a .class file named WebEnhancer, and two files named win and mac. The WebEnhancer applet decides if a user opening the file is running either Microsoft Windows or Apple Mac OS X before pushing the corresponding software nastie.
If run on an OS X system the malware drops multiple components, reconfigures system settings and installs a backdoor and rootkit combination onto infected machines. The Mac OS X component of the malware – called Crisis or Morcut – arrives on the eve of Apple's release of Mac OS X Mountain Lion, but this is probably a coincidence. The new operating system build goes on sale today. Read more...
Mac OS X leaking passwords of FileVault users
Users of older Mac OS X versions who upgraded to the current Mac OS X 10.7.3, "Lion" and opted to stick with the older version of the FileVault encryption system, may have a problem. It appears that Apple developers enabled a debug option in 10.7.3 which makes the user's password appear, in clear text in a log file, whenever the user mounts the encrypted folder. The problem was identified by security expert David I. Emery who reported the issue on a security mailing list.
The problem appears to only affects users who upgraded from Snow Leopard to Lion and did not activate the new FileVault encryption on Lion which switches to encrypting the whole hard disk rather than just the user's home directory. New users and new installations of Mac OS X Lion are not believed to be exposed to this risk. Read more...
Apple updates Lion, patches 51 bugs in Mac OS X
Apple on Tuesday patched 51 vulnerabilities in Mac OS X, most of them critical, in 2012's first security update.
Both Mac OS X 10.7, aka Lion, and 10.6, better known as Snow Leopard, were updated with fixes. The two operating systems were last updated in mid-October 2011.
Some Lion users reported post-update catastrophes. In a quickly-growing thread on the Apple support forum, users said that after updating, every application crashed when launched.
Among the patches were a pair that addressed a vulnerability in SSL (secure socket layer) 3.0 and TLS (transport layer security) 1.0 that was demonstrated last September by researchers who crafted a hacking tool dubbed BEAST, for "Browser Exploit Against SSL/TLS." Read more...
The end of both the desktop OS and mobile OS is upon us
Investment banking firm Jefferies stated the obvious this week when it issued a report predicting that iOS and Mac OS X will be one operating system by 2016. Nearly a year ago, Apple CEO Steve Jobs said that was his goal in what I playfully dubbed his MiOS strategy. Jobs had just previewed Mac OS X Lion, touting the user interface capabilities it was borrowing from iOS. The forthcoming iOS 5 also takes some UI concepts first released in Lion, but as I'm under NDA with Apple, I can't tell you which ones.
iOS is based on a subset of Mac OS X, so in a very real sense, they always have been the same operating system. As horsepower has improved in mobile devices, Apple has enlarged iOS to take on more of what the desktop Mac OS X could handle, such as more multitasking and more complex graphics and video processing. At the same time, Apple has been steadily pushing gesture-based peripherals -- not just its laptops' gesture-capable touchpads, but also its Magic Mouse and Magic Trackpad that bring gesture savvy to any Mac -- in a gentle but persistent reeducation of its Mac users. Read more...
Apple vanishes MySQL from Mac OS X Lion Server
Apple has removed MySQL from the latest version of Mac OS X server, replacing it with PostgreSQL.
The previous version of the OS – Snow Leopard Server – offered access to MySQL from both the GUI and the command line, but the open source database has disappeared entirely from Mac OS X Lion Server, released last week. Postgres is there, but it's available only from the command line.
EnterpriseDB – the outfit that has commercialized the open source PostgreSQL – says it was unaware of the change until Lion hit the Apple Store, and the company indicates that it has had no involvement with Apple when it comes to the inclusion of Postgres with Mac OS X Lion. "We weren't working with them directly on this," vice president of business development Sean Doherty tells The Reg. Read more...
Mac OS X surges in business, thanks to the iPad
Global Equities Research analyst Trip Chowdhry is not known for mincing words -- or holding back his opinion. For example, back in March, he lambasted the weak sales of the Motorola Xoom tablet and called the Google Android 3.0 "Honeycomb" OS a "mess" at a time when most analysts were being circumspect.
Now Chowdhry says his research shows that Apple is growing significantly in the enterprise as more companies offer it as an option to employees -- and as most employees take up the offer: "Probably about 35 percent of Fortune 500 companies are giving Apple as a choice to its employees, and the majority are preferring Apple over Windows."
It's a sign of the BYOD (bring your own device) times -- or at least the employee-choice times -- that the iPhone and now iPad have engendered. Read more...
Apple warned of phishing attack threat for Mac OS X, iOS developers
Apple's website for Mac OS X, iPhone, and iPad developers has a vulnerability that could lead to phishing attacks, according to a hacker group.
The Apple website vulnerability could allow an attacker to specify a link to another site through a "redirect," which could simplify phishing attacks, claims the YGN Ethical Hacker Group. The outfit, dedicated to finding website security flaws, is said to operate from the country of Myanmar.
Unless Apple fixes the alleged vulnerability, the group says it plans to release information publicly in the next few days via the Full Disclosure security mailing list.
This is the practice that the group followed in March when it was frustrated by what it considered a slow response by security firm McAfee about vulnerability issues it found in its website. After public disclosure by the group, McAfee acknowledged the problems. Read more...