Tag Archive for AAPL

| July 31, 2010
Comments Off on Apple Has Most Holes

Apple Has Most Holes

Apple Has Most HolesSecurity company Secunia is reporting that Apple (AAPL) software has the most security vulnerabilities. According to the recent Secunia Half Year Report 2010 (PDF) Apple has displaced Oracle as the company with the most security vulnerabilities in its software over the first half of 2010. Microsoft retains its third-place spot.

WiredApple logo points out that this does not necessarily mean that Apple’s software is the most insecure in practice. The report takes no consideration of the severity of the flaws, it points at a growing trend in the world of security flaws: the role of third-party software. Many of Apple’s flaws are not in its operating system, Mac OS X, but rather in software like Safari, QuickTime, and iTunes. Vendors like Adobe (with Flash and Adobe Reader) and Oracle (with Java) are similarly responsible for many of the flaws being reported. The top ten third-party applications, ranked by total number of reported vulnerabilities:

1. Mozilla Firefox
2. Apple Safari
3. Sun Java JRE
4. Google Chrome
5. Adobe Reader
6. Adobe Acrobat
7. Adobe Flash Player
8. Adobe AIR
9. Apple iTunes
10. Mozilla Thunderbird

Secunia logoTo illustrate this point, ars technica says the report includes cumulative figures for the number of vulnerabilities found on a Windows PC with the 50 most widely used programs. Five years ago, there were more first-party flaws (in Windows and Microsoft’s other software) than third-party. Since about 2007, the balance shifted towards third-party programs. Secunia predicts that third-party flaws will outnumber first-party flaws by two-to-one by the end of 2010.

Secunia also makes a case that effectively updating third-party software is much harder to do; because Microsoft’s Windows Update and Microsoft Update systems will offer protection for around 35% of reported vulnerabilities, patching the rest requires the use of 13 or more updating systems. Some vendors—Apple, Mozilla, and Google, for example—do have decent automatic update systems, but others require manual intervention by the user.

Steve Jobs

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , ,
| June 18, 2010
Comments Off on Full AV Needed for MacOS

Full AV Needed for MacOS

The Mac antivirus vendor Intego has identified a new malware threat for MacOS. On the Mac Security Blog, the firm calls the threat, OSX/OpinionSpy, a “high risk.” According to their blog, the main distribution channel for the malware through screen saver programs downloadable from reputable download sites including MacUpdate, VersionTracker, and Softpedia. The malicious code does the typical malware things like scan files, record user activity, create a backdoor, and send stolen data to remote servers.

SeacrchSecurity quotes security expert and SANS Institute instructor, Rob VandenBrink, writing on the SANS Internet Storm Center Diary, who said the malware is a simple bolt-on to other freely downloadable applications. “The neat thing about this malware is that it passes most static scan tests – the downloaded software itself is clean, the malware is downloaded as part of the installation process,” VandenBrink wrote. “This highlights the requirement for an on-access virus scanner for your OSX computers.”

rb-

Many people have long-held that macOS is more secure than Windows. macOS and its underlying *NIX OS have their own issues. The recent announcement by Google to increase its use of non-Windows OS’s (here and here) has made macOS security thru obscurity mute. Mickey Boodaei, CEO of security vendor Trusteer, told SC Magazine, “Mac and Linux are not more secure than Windows. They’re less targeted. There is a big difference.”

This announcement weakens the theory that using MacOS computers is the best way to secure online financial transactions. For the time being, a * NIX-based live CD is probably the safest bet to secure your online financial transactions.

macOS users should get a real anti-malware package that includes an on-access scanner.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
| May 11, 2010
Comments Off on Microsoft Security Report

Microsoft Security Report

Microsoft Security ReportMicrosoft (NASDAQ MSFT) released the latest Microsoft Security Intelligence Report (SIRv8) on April 26, 2010. Data for SIRv8  came from 500 million PCs across the globe between July and December 2009 and for the first time separates enterprise user and consumer user malware trend data. The data included in the 250-page report says that enterprises and consumers each suffer from different types of malware threats.

Microsft security goog news

Microsoft logoThe good Microsoft security news from the SIR 8 report is that newer operating systems and up-to-date applications are the most secure. Windows 7 and Vista Service Pack 2 have the lowest infection rates per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. (pg. 85). Microsoft runs the Malicious Software Removal Tool before installing Windows updates.

Windows OSPC's cleaned/1,000 MSRT
XP SP121.7
XP SP214.5
Win 7 32-bit2.8
Vista SP2 32-bit2.2
Vista SP2 64-bit1.4
Win 7 64-bit1.4

The report shows that the more recent versions of Microsoft Windows are less vulnerable to attack. Cliff Evans, Microsoft UK’s head of security and privacy says only about 5% of the vulnerabilities are in Microsoft software. This has led to a shift in emphasis to targeting third-party programs and utilities. In XP, around 45% of attacks exploited third-party (i.e. non-Microsoft) code, with Vista and Windows 7 it’s around 75% according to an article in the Guardian.

Application attacks continue to increase. Running updated software decreases the attack surface and increases Microsoft security robustness. The report shows that attackers target Internet Explorer 6 (IE 6) up to four times more often than the newer version IE 7 (pg.33). Matt Thomlinson, general manager of product security in Microsoft’s Trustworthy Computing group told DarkReading, “With Internet Explorer, IE 6 is four times more targeted in drive-by attacks.” Thomlinson says SIR 8 provides the first real results to illustrate this.

Browser attacks

The Microsoft security report says that nearly 75% of the browser-based exploits encountered in 2H09, were third-party applications, including Adobe Reader, RealPlayer, Apple QuickTime, and AOL software (pg.26). This means Windows Update is not enough to protect users, who must also install updates from Adobe, Apple, and other software suppliers.

Attacks against Microsoft Office make use of older vulnerabilities that have mostly been fixed and can easily be avoided by keeping the software suite up to date. The majority of Office file format attacks can be avoided by applying service packs (pg. 43). For example, 75.8% of the attacks on Microsoft Office files exploited a single vulnerability (CVE-2006-2492, the Malformed Object Pointer Vulnerability in Microsoft Office Word), which was found in 2006.

The report found that enterprise users contract more worms, “In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms,” Thomlinson told DarkReading. “This is the first time we’ve had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]” Worms were found in 32 percent of enterprise PCs.

ThreatPresent %
Worms32
Miscellaneous Trojans18
Unwanted software16
Trojan down-loaders and droppers13
Password-stealers and monitoring tools7
Backdoor programs 5
Viruses 4
Exploits 3
Adware3
Spyware1

Rogue anti-virus attacks

Windows in both the enterprise and the consumer markets were hit hard by rogue anti-virus attacks last year. Rogue security software was found on 7.8 million up 46% from 5.3 million in the second half of last year. The most detected rogue security software family, Win32/FakeXPA, was also the third-most prevalent overall threat detected by Microsoft worldwide in 2H09. Three other rouge software families were also widely detected:

  • Win32/Yektel,
  • Win32/ FakeSpypro, and
  • Win32/Winwebsec.

MSFT claims that attacks are now motivated by financial gain, with a “black economy” of malware authors, botnet herders, and other criminals working together to exploit vulnerabilities in Windows PCs. “We’re seeing that the criminals are more professional and organized,” Thomlinson says. “This is really about criminals in shirts and ties, not with tattoos.” Criminals are becoming more specialized in different aspects of cybercrime. They are then coordinating with criminals with other specialties. He says. “Threats are being packaged together and sold as commodities and kits,” he says. “It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of many machines to do that. This is the ‘black cloud’ of computing.”

rb-
The next report will be interesting as attackers focus their attention on Win7 as it becomes wider deployed. The takeaway from the report is:
  • Keep your installed software patched to current levels.
  • Running old versions of operating systems, browsers, and application software exposes companies to additional unnecessary risks (Ask Google).
  • Invest into initiatives that get systems upgraded to the newest technology available.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , ,
| March 13, 2010
Comments Off on Mobile Botnet

Mobile Botnet

Mobile BotnetTwo researchers from TippingPoint’s Digital Vaccine Group duped thousands of smartphone users into joining a mobile botnet by spreading a seemingly innocuous weather application. Kelly Jackson Higgins at DarkReading writes that Derek Brown and Daniel Tijerina created a smartphone application called WeatherFist. Over 8,000 users downloaded WeatherFist, which grabbed users’ PII. The info they grabbed included GPS coordinates and telephone numbers, before displaying local weather information.

TippingPointThe researchers did not distribute their application via the official iPhone and Android application stores. Rather, they distributed the WeatherFist application via third-party app markets like Cydia, SlideME, and Modmyi. The apps could only be installed on jailbroken iPhones or Android devices where users had specifically given permission for non-approved applications to be run. “We wanted people to feel comfortable using the application and putting it on their phone so we would have permission to do a lot of things like pass GPS coordinates, write to the file system, and surf,” Brown told DarkReading.

Mobile Botnet

At the 2010 RSA Security Conference the researchers claimed they also wrote a malicious version of their mobile botnet, which they dubbed WeatherFistBadMonkey. According to DarkReading, the malicious app behaves more like traditional botnet code, stealing information and capable of distributing spam. “We could enable or disable system services [with a malicious app],” Brown says. The TippingPoint researchers told DarkReading they wanted to prove how an app could behave like much of the traditional Windows malware which, steals information, and allows hackers to gain remote control of hijacked devices.

rb-

Smartphones are a part of today’s network and Brown and Tijerina claim that this research shows a security hole in networks. Some of the ways to plug these new holes are to:

  1. Update policies for the  proper use of smartphones
  2. Prohibit unsafe modifications of smartphones
  3. Allow apps only from reputable app stores
  4. Provide training on smartphone application usage
  5. Lockdown the Wi-Fi network settings to keep smartphones from ‘phoning home’ any information that shouldn’t leave the firm.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
| December 5, 2009
Comments Off on Techs Add Ads In Everything

Techs Add Ads In Everything

The New York Times is reporting that Apple Computers has filed an application with the U.S. Patent and Trademark Office to patent to puts ads in everything. They  are working on a technology called “Advertisement in Operating System.” Advertisement in Operating System will display advertising on almost anything that has a screen of some kind: computers, phones, televisions, media players, game devices, and other consumer electronics.

The patent application claims the distinctive feature of the patent is it that doesn’t simply invite a user to pay attention to an ad — it also compels attention. Apple’s (AAPL) technology, according to the NYT, can freeze the device until the user clicks a button or answers a test question to prove that he or she has dutifully noticed the commercial message. Because this technology would be embedded in the innermost core of the device, the ads could appear on the screen at any time, no matter what one is doing.

Within this new technology, Apple has developed what it calls an “enforcement routine” that makes people watch ads they may not want to watch. What the application calls the “enforcement routine” entails administering periodic tests, like displaying on top of an ad a pop-up box with a response button that must be pressed within five seconds before disappearing to confirm that the user is paying attention.

These tests “can be made progressively more aggressive if the user has failed a previous test,” the application says. One option makes the response box smaller and smaller, requiring more concentration to find and banish. According to the NYT,  the system can require that the user press varying keyboard combinations, the current date, or the name of the advertiser upon command, again demonstrating “the presence of an attentive user.” The system also has a version for music players, inserting commercials that come with an audible prompt to press a particular button to verify the listener’s attentiveness.

The Apple inventors, including Apple CEO Steve Jobs, whose name is the first listed on the application, say the advertising would enable computers and other consumer electronics products to be offered to customers free or at a reduced price. In exchange, recipients would agree to view the ads (rb- and give their personal data). If down the road, users found the advertisements and the attentiveness tests unendurable, they could pay to make the device “ad-free” on a temporary or permanent basis.

Google logoThe Download Squad points out that over at Google (GOOG), a “highly praised” feature of the newly announced Chrome OS‘s “totally new” approach to security sounds similar to Apple’s plan for forced ads. Chrome OS is reported to be self-healing. If the OS detects something it does not like, a “verified boot” will restore files to their previous state as if nothing ever happened. Since it is Google’s OS they get to decide what is or isn’t malicious. It is easy to imagine that anything which interferes with the delivery of Google-powered content would be considered malicious. Applications like AdBlock or AdSweep which block Google ads may not be allowed. Chrome OS will put Google in complete control over the delivery platform its audience is using.

Microsoft logoMicrosoft (MSFT) has experimented with ads in software since June 2007 with Microsoft Works. Now Microsoft is working on placing advertisements in a more conspicuous location next year with a free version of Office. Office Starter 2010 is a free version of Office that is pre-installed on some PCs. It will include a small Microsoft display ad in the lower-right corner of the screen and offers versions of Word and Excel with fewer functions than the regular paid ones.

In Office Starter 2010, Microsoft is not seeking revenue from advertising. They are using the ads only to promote the full-featured, commercial versions of Office. The company plans to take customers “along a journey to educate them about the product,” said Bryson Gordon, a director on Microsoft’s Office team said in the NYT piece. Microsoft will use a gentle approach to the up-sell. Customers can ignore the ads, which will sit passively in the corner of the screen,

rb-

The tech world is moving backward taking cues from Free-PC and ZapMe because the public is cheap. Apple, Google and MSFT are counting on the fact their product are so “insanely great” and integrated into our lives that we as consumers can’t live without Gmail or iTunes. Now that we are all junkies of cheap tech, the tech firms are going to exploit this. The price of free starts with a text ad then it will be a banner ad then a pop-up and then a full video where you have to interact with the device to use it.

MSFT, Apple, and Google have huge organizations to run, CEO’s and Wall $treet bankers that need their bonuses so the move to monetize all their services has just begun. The big question is how far will this go? Will the pillars of tech add so many clicks, surveys, ads, and forced interactions to eventually make their products unwieldy and useless. Look where FreePC and ZapMe are today.

Forced advertising is not some new idea lots of malware force their victims to view web pages they did not request.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , ,
« Older Entries   Recent Entries »