Slashdot: AppleNews for nerds, stuff that mattersTwo Trojans For Mac OS X- June 25, 2008 I Don't Believe in Imaginary Property writes "F-Secure is reporting that there are two new Mac OS X trojans. The first is just a proof-of-concept from the MacShadows people that takes advantage of the unpatched ARDAgent vulnerability to get root access when run by the user. The second relies on social engineering: it's a poker game that requests the user's password, claiming to have detected a 'corrupt preference file.' It then takes control of the computer. Now that the source of the...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/319516847/article.pl How to Save Mac OS X From Malware- June 24, 2008 eXchange writes "Well-known hacker Dino Dai Zovi has written an article at ZDNet discussing last week's discovery of a critical threat to Mac OS X, and another announcement of a Trojan horse exploiting this discovery. He suggests that Snow Leopard, or Mac OS X 10.6, should integrate more robust means of preventing malware attacks. Some of the suggestions he has include mandatory code-signing for kernel extensions (so only certified kernel extensions can run), sandbox policies for Safari, Mail,..http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/318980154/article.pl Safari "Carpet Bomb" Attack Still a Risk- June 21, 2008 SecureThroughObscure writes "Just a short time after Apple's recent acknowledgment of and patch for the Safari Carpet Bomb 'blended' IE flaw, Microsoft researcher Billy Rios shows that Safari is still useful in a blended attack, this time with Firefox 23. (ZDNet's Nate McFeters also spread the word.) Rios claimed that he is able to use Carpet Bomb, despite the recent patch, to steal arbitrary files from victims who also have Firefox 23 installed. Both Rios and McFeters pointed out that Apple,...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/317098157/article.pl Foundations of Mac OS X Leopard Security- June 20, 2008 jsuda writes "At least a half-dozen times in the book 'Foundations of Mac OS X Leopard Security' the authors state that there is a misconception that the Macintosh computer is immune from security problems. That allegation may explain why there are very few books published (and nearly none in recent years) about security for the Mac. This book is meant to change all that. The authors acknowledge that the Mac OS X software has had little of the security problem experience of Windows (and other...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/318862825/article.pl Apple Fixes Safari "Carpet Bomb" Windows Vulnerability- June 20, 2008 Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."Read more of this story at Slashdot.http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/316213553/article.pl Mac OS X Root Escalation Through AppleScript- June 18, 2008 An anonymous reader writes "Half the Mac OS X boxes in the world (confirmed on Mac OS X 10.4 Tiger and 10.5 Leopard) can be rooted through AppleScript: osascript -e 'tell app "ARDAgent" to do shell script "whoami"'; Works for normal users and admins, provided the normal user wasn't switched to via fast user switching. Secure I think not." On the other hand, since this exploit seems to require physical access to the machine to be rooted, you might have some other security concerns to deal with...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/314885779/article.pl The Impact of Low Salaries At Apple- June 17, 2008 orenh writes "Recent data indicate that Apple engineers have significantly lower salaries than their Silicon Valley peers: $89,000 at Apple, versus $105,000 at Yahoo and $112,000 at Google. Paying lower salaries had a major impact on Apple's bottom line when it was struggling in the market up until 2004. But now that Apple is highly profitable, these lower salaries are no longer a factor in Apple's success. Will Apple have to raise salaries to match the market rate, or face defections"Read more.http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/314155195/article.pl Apple's SproutCore, OSS Javascript-Based Web Apps- June 17, 2008 99BottlesOfBeerInMyF writes "AppleInsider is running an article about Apple's new SproutCore Web application development framework, utilizing Javascript and some nifty HTML 5 to offer a 'Cocoa-inspired' way to create powerful Web applications. Apple built on the OSS SproutIt framework developed for an online e-mail manager called 'Mailroom.' Apple used this framework to build their new Web application suite (replacing .Mac) called MobileMe. Since SproutCore applications rely on JavaScript, it...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/313437312/article.pl OS X Snow Leopard Details- June 13, 2008 JD-1027 writes in to kick off a discussion of OS X Snow Leopard. Apple's stated goal: "Taking a break from adding new features, Snow Leopard — scheduled to ship in about a year — builds on Leopard's enormous innovations by delivering a new generation of core software technologies that will streamline Mac OS X, enhance its performance, and set new standards for quality." The technologies: Grand Central to get better use of multiple processors and multicore chips, OpenCL to tap the...http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/311284910/article.pl ZFS Confirmed In Mac OS X Server Snow Leopard- June 11, 2008 number655321 writes "Apple has confirmed the inclusion of ZFS in the forthcoming OS X Server Snow Leopard. From Apple's site: 'For business-critical server deployments, Snow Leopard Server adds read and write support for the high-performance, 128-bit ZFS file system, which includes advanced features such as storage pooling, data redundancy, automatic error correction, dynamic volume expansion, and snapshots.' CTO of Storage Technologies at Sun Microsystems, Jeff Bonwick, is hosting a discussion.http://rss.slashdot.org/~r/Slashdot/slashdotApple/~3/309914049/article.pl |