The IT Security Attaché

His life, profiles, work, aspirations, agenda and schedule.

Browsing Posts tagged Apple

Greetings my readers,

I can truly say that after spending the past two days hammering out the features, functionality and usability of the two devices side by side, I am much more confident, comfortable and relaxed with the HTC Touch Pro 2 than my iPhone (which I only have for testing and comparative reasons anyway) as a professional, music connoisseur and just being able to have it manage my day to day activities, planning and scheduling. As a person that lives religiously off his calendar, I must feel comfortable in the device I carry and its ability to keep me on track.

Once Microsoft opens up the app like store I’m sure this will push the usability and functionality levels even higher and I can’t wait. My only fears, and I do mean fear, is that the upcoming Windows Mobile v.6.5 may bring changes to this setup that may not work best for me and so I will be making a backup of my existing setup before upgrading to WinMo v.6.5.

So now I prepare for WinMo v.6.5 and I will complete my full review of the device on the existing WinMo v.6.1Professional and post it shortly. Until then, I’m just all over the touching.

Have a great day,

~Brett A. Scudder~

  • Share/Bookmark

25 March 2009

Apple Mac users warned of web-based malware threats RSPlug-F Mac Trojan horse distributed via HDTV website

IT security and control firm Sophos is warning Apple Mac users to be on their guard against websites hosting malicious code designed to infect their systems. The advice follows the discovery of a new version of the OSX/RSPlug Trojan horse that is being distributed via a legitimate-looking website offering HDTV software.


Apple Mac malware: Caught on camera from Sophos Labs on Vimeo.

“There is much less malware for the Apple Mac than there is for Windows, but that doesn’t mean that Apple fans can hide their head in the sand like ostriches,” said Graham Cluley, senior technology consultant for Sophos. “Mac users are no different to Windows users when it comes to falling for social engineering tricks like this – they are just as likely to install and run this program on their computer if they believe it will help them watch high definition TV.”

Sophos notes that the criminal gang behind this malware attack is targeting Windows computers as well as Mac OS X.

“Windows users shouldn’t be feeling smug about this attack against Mac users. If you visit the website from a Windows computer, it will serve up a malicious Windows executable from the Zlob family of malware rather than the RSPlug-F Mac OS X Trojan horse. By targeting both platforms with their malicious website, the hackers can kill two birds with one stone,” explained Cluley. “Once a piece of malware like this is in place on your computer, it can do whatever the hacker wants it to do. Mac users are gambling with the security of their data if they believe they are somehow magically immune from threats that Windows users have lived with everyday for years.”

Sophos experts have determined that the RSPlug-F Trojan horse changes DNS Settings on Apple Mac computers, meaning users may find they are taken to bogus websites which may attempt to steal personal information, display revenue-generating adverts, or install further malware.

The article was posted here http://www.sophos.com/pressoffice/news/articles/2009/03/mac-malware.html?_log_from=rss

  • Share/Bookmark

Original URL: http://www.theregister.co.uk/2009/03/19/pwn2own_day1/

A grim day for browser security at hacker contest

Safari, IE and Firefox all down for the count

Free whitepaper – Trend Micro delivers security cloud

CanSecWest Internet browser security took a beating during Day 1 of an annual hacking competition, with Apple’s Safari, Microsoft’s Internet Explorer and Mozilla’s Firefox all being felled in a matter of hours.

The uncontested champion of the contest was a University of Oldenburg (http://www.uni-oldenburg.de/), master’s candidate, who managed to fell Safari, IE 8 and Firefox at the Pwn2Own contest at the CanSecWest security conference in Vancouver, British Columbia. He joined security researcher Charlie Miller, who was able to successfully hack Safari with a separate remote-execution exploit.

“It’s not as easy as a few years ago,” said Nils, the University of Oldenburg student, referring to the difficulty of piercing the many built-in protections of Safari, IE and Firefox. “Still, browsers have a lot of problems. It’s really a lot of codes that are exposed to the internet.” The computer science student declined to give his last name.

The Pwn2Own contest has thrived at proving to the world that with the proper financial incentive, virtually any internet-facing software can be proven vulnerable to real-world exploits. Amid the awe that took hold as four exploits materialized before spectators’ very eyes was this sad realization: Despite the formidable resources of the world’s biggest software organizations, browser users remain susceptible to drive-by attacks that can install keylogging software, rootkits and other software parasites with little or no warning.

Perhaps more remarkable than watching hackers in one room make mince meat of three of the world’s most popular browsers was the realization that they were willing to do so for well under the going rate. According to some researchers, a reliably exploitable IE vulnerability now fetches $100,000 on the black market. Yet Nils was willing to accept just $5,000 and a new Sony Vaio for his attack.

The contest is sponsored by security firm TippingPoint, which for several years now has paid a bounty to researchers for exploits that target commonly used programs.

“If this competition hadn’t existed, I never would have found this bug,” said Miller, who is principal analyst at Independent Security Evaluators, referring to the Safari flaw he exploited this year. He exploited a separate vulnerability (http://www.channelregister.co.uk/2008/03/28/mac_hack/) last year that allowed him to pwn a brand new Mac Book Air running a fully patched version of Leopard. The challenge was enough to motivate him to dust off a separate Safari bug he had been sitting on for more than 12 months for this year’s competition.

“If it wasn’t for the competition, there’d still be these two bugs from this year and last year,” he added. “Apple gets free bugs, I get money and people’s computers get fixed.” ®

  • Share/Bookmark
Powered by WordPress Web Design by SRS Solutions © 2010 The IT Security Attaché Design by SRS Solutions