Apple Hardens Security with Mac OS X 10.7.4 and Safari 5.1.7

TidBITS Safe Computing: Apple Hardens Security with Mac OS X 10.7.4 and Safari 5.1.7:

What a fantastic idea.

From the article:

Safari will now check the version of Flash you are running and disable it if it is not capable of updating itself to a current version. Flash versions 10.1.102.64 (yes, that’s a version number, not an IP address) and older don’t include the capability to update themselves to new releases, requiring users to update manually. Newer versions will self-update as Adobe releases fixes, which minimizes the chances a user will be exposed to Flash-related security issues.

It also fixes this error:

Mac OS X 10.7.4 fixes a security error introduced in 10.7.3 that exposed a user’s password if they upgraded to Lion while leaving the legacy version of FileVault enabled. The flaw was due to a developer leaving debugging code enabled, which logged the user’s password in plain text. This problem affected only the older version of FileVault that encrypted a user’s home directory, as opposed to the FileVault 2 feature enabled in Lion that encrypts the entire disk. To be exposed, you would have had to upgrade a legacy FileVault system to Lion and keep the older FileVault in place.
Although this extremely serious bug essentially negated any password security on affected systems, relatively few users were likely exposed. 

I believe this pcap to be bad.


Alerts (2.9.2.2, dump-1.pcap)
1:18275:9 FILE-IDENTIFY HyperText Markup Language file download request Alerts: 1
1:16425:15 FILE-IDENTIFY Portable Executable binary file download request Alerts: 3
1:21860:1 SPECIFIC-THREATS Phoenix exploit kit post-compromise behavior Alerts: 4
1:21042:4 BLACKLIST URI possible Blackhole post-compromise download attempt - .php?f= Alerts: 1
1:21492:12 SPECIFIC-THREATS Blackhole landing page with specific structure - prototype catch Alerts: 3
1:21347:3 BLACKLIST URI possible Blackhole URL - .php?page= Alerts: 1
1:13245:2 BACKDOOR troya 1.4 runtime detection - init connection Alerts: 2
1:21646:6 SPECIFIC-THREATS Blackhole landing page with specific structure - prototype catch Alerts: 2
1:11192:12 FILE-IDENTIFY download of executable content Alerts: 2
120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE Alerts: 1
1:20494:6 FILE-IDENTIFY PDF file magic detected Alerts: 1
1:21583:4 FILE-PDF Possible malicious pdf detection - qwe123 Alerts: 1
1:21556:3 POLICY-OTHER Microsoft Windows 98 User-Agent string Alerts: 4
1:648:12 SHELLCODE x86 NOOP Alerts: 3
1:21548:1 BOTNET-CNC Cutwail landing page connection attempt Alerts: 1
1:15306:16 FILE-IDENTIFY Portable Executable binary file magic detected Alerts: 2
1:21418:1 BOTNET-CNC Trojan.FareIt outbound connection Alerts: 1
1:22041:2 SPECIFIC-THREATS Blackhole landing redirection page Alerts: 1


I could be wrong. Don't think I am.

---

Please leave comments below.

8 Simple Tips to Secure a Mac from Malware, Viruses, & Trojans

8 Simple Tips to Secure a Mac from Malware, Viruses, Trojans:

As much as it pains me to put this on my blog, here is a link to a article over at OSX Daily.  Any article that recommends uninstalling Adobe, I'm down with.

Take a look.

Safari 5.1.4 now available

Safari 5.1.4 now available, fixes issues and improves performance | TUAW - The Unofficial Apple Weblog:

• Improve JavaScript performance
• Improve responsiveness when typing into the search field after changing network configurations or with an intermittent network connection
• Address an issue that could cause webpages to flash white when switching between Safari windows
• Address issues that prevented printing U.S. Postal Service shipping labels and embedded PDFs
• Preserve links in PDFs saved from webpages
• Fix an issue that could make Flash content appear incomplete after using gesture zooming
• Fix an issue that could cause the screen to dim while watching HTML5 video
• Improve stability, compatibility and startup time when using extensions
• Allow cookies set during regular browsing to be available after using Private Browsing
• Fix an issue that could cause some data to be left behind after pressing the "Remove All Website Data" button

Path uploads your entire iPhone address book to its servers

Path uploads your entire iPhone address book to its servers

I guess my appropriate reaction here would be..

Well. WTF!?

Don't use anything by Path.

Let's make TCP faster - The official Google Code blog

Let's make TCP faster - The official Google Code blog

Interesting Article here.

Latest Snort provides alarm for industrial control systems

Latest Snort provides alarm for industrial control systems - The H Security: News and Features
:

Nice publicity for Snort 2.9.2. as result of years of work.

If you are having problems with your flowbits

I moved this post over to the Snort.org blog:

http://blog.snort.org/2011/12/if-you-are-having-problems-with-your.html

iOS code suggests Apple could bring iChat to iPhones and iPads

AppleInsider | iOS code suggests Apple could bring iChat to iPhones and iPads

From the "duh" department. Apple would be stupid not to combine iChat, Facetime, and iMessage.

It would be awesome.

FILE_DATA_PORTS error in Snort, SOLVED

I'm basically putting this post up for Google to index it and maybe it'll help some people solve the problem in the future.

PortVar Lookup failed on '$FILE_DATA_PORTS'

If you came to this blog post by searching for the above error, or if you have the above error in Snort, you should read this post on the VRT blog that we wrote.  It'll help solve your problem:

http://vrt-blog.snort.org/2011/11/say-hello-to-file-identify-category.html

There. Check that out.

Yield Thought, this guy swapped his MacBook for an iPad+Linode

Yield Thought, I swapped my MacBook for an iPad+Linode:

This guy is nuts. I could never do this. Even though 99% of my work is done via screen @ work as well.

Interesting though.

(whoops)

A Sister’s Eulogy for Steve Jobs - NYTimes.com

A Sister’s Eulogy for Steve Jobs - NYTimes.com

Great read. I've never read her writing. But she's good.

Snort.org Blog: Snort 2.9.1.2 has been posted!

Snort.org Blog: Snort 2.9.1.2 has been posted!: Snort 2.9.1.2, a minor bug fix, has just been posted to the Snort.org website.

Check out the blog post there!

MacOSX Flashback Trojan is covered by ClamAV

So called because it looks like an Adobe Flash Installer. There seems to be a ton of news around this Trojan on various Mac-related websites. http://www.tuaw.com/2011/10/19/trojan-variation-disables-mac-malware-protection/ for instance.

We wrote protection for this in ClamAV about 5 days ago.  I know a lot of Mac users run ClamAV, so I just thought I'd throw this out there.

---

Please leave comments below.

Apple - Remembering Steve Jobs

Apple - Remembering Steve Jobs:

One more thing...

Apple today put up a "Remembering Steve" site. Where you can basically go and read emails from the people that wrote in at rememberingsteve@apple.com.

Nice tribute. Apparently today the Apple employees are attending a "remembrance" service for Steve. Apparently this won't be broadcast to the world. Too bad, I am sure many would have watched it.

---

Please leave comments below.

E-mail improvements in iOS 5 - iPhone J.D.

E-mail improvements in iOS 5 - iPhone J.D.:

Sorry, a link to another interesting iOS 5 article. Sorry if I am not adding a bunch of color commentary to each of these articles. I am blogging them because I think they are of interest to the readers of my blog. (Which, according to the stats, most of you run OSX.)

I am sure some of my friends will accuse me of trying to draw hits to my blog instead of twittering about the article directly. Here's the truth to that: When I post to my blog, Twitter picks up the article and tweets it immediately. If I don't post to my blog and only to twitter, the readers of my blog through direct links and RSS feeds won't get the article.

So it's a loss either way. So I post on the blog, and it goes to both.

Anyway... read the article. ;)

---

Please leave comments below.

My Dinner With Android - Four months with Android: reflections, grievances and some tenuous metaphors bundled up into a weighty tome

My Dinner With Android - Four months with Android: reflections, grievances and some tenuous metaphors bundled up into a weighty tome:

Interesting article, no matter if you are an Android user or an iOS user. He makes a couple interesting points in the article. One being, you can't approach Android like you are using iOS, it just doesn't work like that. Vise Versa as well.

I have a friend that has had an Android phone for awhile, and recently moved to the iPhone 4S. We were talking yesterday and he mentioned to me that it was very strange. I answered him saying that you can't approach iOS like you do with Android.

Another quote from the article that is pointed:

"Fans of Android, let’s not tiptoe around this: Android exists because it is a rip off of iOS. Sure, it has grown into its own in a lot of ways, but its roots are decidedly placed at the introduction of iOS in 2007. Consider the before and after that caused a stir last year. Things changed when the iPhone came out. Apple changed the mobile phone game, and Google did a one-eighty to realign with what they recognized to be a better direction."

Steve Jobs narrates The Crazy Ones

Steve Jobs narrates The Crazy Ones:

One of my favorite Steve Jobs "things".

---

Please leave comments below.

Bad-Lip Reading

Tremendous work.



More here

---

Please leave comments below.

Steve Jobs

Over the next few days, there will be countless specials, news casts, and thrown together documentaries about Steve Jobs and Apple.

Everyone will be focusing on his products. The iPod, iPhone, the personal computer, and the iPad. This was a part of his legacy, but not his genius.

His genius was how all the products worked together in a single coherent strategy (iCloud is a perfect example). Making everything work together seamlessly. Simply.

So that my two year old could operate it, as well as my 75 year old Dad.

You could interact with any of the products without an instruction book.

I think the best example of that is Siri. Being able to interact with your devices in a natural language way.

His genius was how everything was simple. The packaging, the website, the buying experience, the product, the operation, the genius bar. The way Apple itself functioned.

This was his genius. He was a visionary in the best way.

Call me a fanboy all you want.

He was smart. He demanded brilliance. He settled for nothing less than awesome.

RIP.