Mac-User Sites SHUTDOWN ! Oh No !

[sybil]

Ya just gotta remember that Digital Millennium Copyright Act nowdays ! Even the TOS(terms of service) agreement of a message forum should cite it
so that the members are warned as to the limits of their
freedoms. That is if they wish to discuss manipulating code in an major intellectual property, such as an operating system or program.



Mac-User Sites Shut for Possible Violation

Source:

news.yahoo.com/s/ap/20060218/ap_on_hi_te/apple_hacker_crackdown;_ylt=AtgJz0hkDQWybkq20M1Vxn.s0NUE;_ylu=X3oDMTA3cjE0b2MwBHNlYwM3Mzg-


SAN JOSE, Calif. - Two busy Web sites that focus on Apple Computer Inc.'s Mac OS X operating system went silent Friday just days after they featured links to information on how to hack the software and run it on non-Apple PCs.

The OSx86 Project Web site stated Apple had served it with a notice on Thursday citing violations of the 1998 Digital Millennium Copyright Act, and the site was reviewing all of its discussion forum postings as a result. The site has always aimed to adhere to copyright laws and is working with Apple to ensure no violations exist, according to a statement by the site administrator.

The other Web site, Win2OSX.net, was completely shut down. Administrators there could not be immediately reached for comment.

An Apple spokesman declined to comment Friday on the DMCA-based notices. The federal law prohibits anyone from distributing software or hardware that can circumvent copy protection mechanisms. The law has been criticized at times as being unconstitutional and too broad.

Apple does not authorize the use of its Mac OS on machines other than its own, and earlier this week, the sites posted links to the Web site of a hacker who claimed his software patches could be used to run a version of the Mac OS on a non-Apple machine.

The hacking endeavors are, for now, relegated to a small, technically savvy set, but it underscores a risk Apple faces if a pirated, functional version eventually becomes as accessible and straightforward as installing other software on a computer.

It's a risk that became more apparent after Apple decided to make a historic transition from Power PC chips to Intel Corp.-based chips, the same type that its rivals use in predominant Windows-based PCs.

Apple so far has two Intel-based computers on the market and plans to migrate the rest of its Macs to the Intel platform by the end of the year.

The Mac maker had anticipated some people would try to crack its new Intel-compatible OS X operating system and deeply embedded some warnings to would-be hackers in the software, including one written in the form of a poem.

The OSx86 Project Web site, which was formed after Apple announced its switch to Intel in June 2005, was among the many Mac-user sites that posted a copy of the poetic warning earlier this week.

End


Hmmm, how many would consider going back to OS 9+
and just stay there ? Or see Mac leave Unix alltogether
and produce their OS as their own propriety. Microsoft and Unix/Linux managed to disenfranchised many of the people that helped them get on their feet in years past.
Since those days they have spawned a culture of viruses that war against them. Perhaps a poem of warning for them from those virus writers should state, "beware, the toes 10.0 you step on today may be connected to the asses 1.0 you may have to kiss tomorrow".

[sybil]

This Reuters news item appeared Tuesday/21 just after noon. A new worm called "OSX.Inqtana.A" spreads thru the OSX os thru the Bluetooth wireless connection. Last week 2/14/06 the "OSX/Leap-A" virus began to spread thru the iChat IM which will also work with those
who use AOL's AIM IM. It is not a high level threat yet.

Second Apple worm targeting Macs found

A new computer worm targeting Apple Computer's Macintosh computers has been identified for the second time in one week, security experts said.

The new worm, called OSX.Inqtana.A, spreads through a vulnerability in Apple's OS X operating system via Bluetooth wireless connections, antivirus company Symantec said.

"We have speculated that attackers would turn their attention to other platforms, and two back-to-back examples of malicious code targeting Macintosh OS X ... illustrate this emerging trend," said Vincent Weafer, senior director at Symantec Security Response.

The latest virus follows OSX/Leap-A, which was identified last week and believed to be the first such virus targeting the Mac platform. That worm attempts to spread via Apple's iChat instant messaging program, which is compatible with America Online's popular AIM instant messaging program.

Symantec said the latest worm attempts to use Bluetooth connections to spread by searching for other Bluetooth-using devices that will accept requests for a connection when the computer is restarted.

Bluetooth is a wireless technology used to transmit data among devices at short distances.

The worm spreads via a vulnerability in the OS X operating system called the Apple Mac OS X BlueTooth Directory Traversal Vulnerability.

If a Bluetooth connection is made, the worm attempts to send itself to those remote computers. However, the worm itself does not appear to pose an immediate threat.

"While this particular worm is not fully functional, the source code could be easily modified by a future attacker to do damage," Weafer said, adding that Mac users should install available software patches to their operating systems to prevent such attacks.

The latest worm was identified on Friday. Both worms are ranked a Level 1 threat on a scale of 1 to 5, with 5 being the most severe, Symantec said.

Perhaps many hackers still hold a gruge with Linux/Unix from back in the late 90's when there was a grass roots movement to build a better OS. As I remember it was free and those who could contribute were doing so, and suddenly the sweet ride came to an end and it was instantly for sale for $30. Many promising computer geeks felt betrayed or robbed then and that was eight or more years ago.

[sybil]

From Wired News 2/22/06

Within five days the smoke begins to settle on the Mac-virus story. Tec-Journalist are now looking deeper into the story:

Mac Attack a Load of Crap

Is the sky falling in on our smug little Mac universe?

On Tuesday, there was news of a security hole in Apple's Safari web browser that allows a system to be compromised by merely visiting a website. And last week, the first worm to pose a serious threat to Mac OS X, Leap-A or Oompa Loompa, raised its ugly little head.

These security woes prompted a rant from one of our editors in a daily story meeting.

Mac security-threat stories are annoying, he said, because they play off misconceptions -- held with a fervor bordering on the religious -- that the Mac platform is inherently more secure than Windows. Not so, he insisted. Microsoft has done some stupid things that exposed its customers to unnecessary risks compared to Mac users. But all systems are theoretically vulnerable, so it's inevitable that the Mac citadel will eventually be breached.

The Mac has had no viruses to date, he said, primarily because of its small market share. It's got a superior track record compared to Windows, but it's not invulnerable; rather, no one has bothered to spend much time trying to attack it. Now that hackers are taking more notice, life will get harder for Mac owners. He suggested I tackle this "wake up call" in this column.

Naturally, I agreed. "You're right," I said. "The Mac is sure to become a target now it is becoming more popular, and by definition, no system is 100 percent secure."

So, imagine his reaction when he sees this:

I'm not going to be running any anti-virus software anytime soon, just as I haven't run it for many years.

Also, I'm not going to turn off any preferences that make my daily computing habits any less convenient (the browser takeover is protected against by disabling the "Open safe files after downloading" preference in Safari).

The smuggest of smug Mac users is right: the platform is more secure, and these new security threats are no more threatening that a paraplegic kitten.

The Leap-A malware was a poorly-programmed Trojan horse that relied on "social engineering," or trickery to perform its nasty function. There's a simple way to protect against this kind of threat -- common sense -- and in testament to this, a lot of people didn't fall for it.

I'm not going to catch a virus this way any more than I'm going to send money to the honorable Dr. Mobuntu, head of the Central Bank of Nigeria.

When it comes to Leap-A, I'll continue practicing the same common-sense precautions I take when using a Windows machine, like not opening any "nude pictures" of Britney Spears I get in e-mail.

As for the Safari hole, it's a vulnerability, not an exploit, and there are probably dozens of these in OS X, maybe more.

The same is true of Windows and other platforms -- there are dozens of potential ways in, according to the SANS Institute, but a vulnerability does not an exploit make.

These Mac security holes are a storm in a teacup. They've inspired hundreds of stories in the press and even the national network news, but if they were Windows holes, no one would have blinked.

That's because holes in Windows are routine, business as usual, while it now appears the Mac is under attack thanks to Apple's brand-new high profile. But this isn't the case.

Last month, there were four "massive" virus attacks on Windows, according to Commtouch, an antispam and antivirus vendor. Indeed, viruses are now so aggressive, they routinely outpace attempts by antivirus companies to distribute protective signatures.

This state of affairs is now so common, I hadn't noticed -- and I work for a technology news site. "Virulent computer virus infects millions worldwide, other non-news at 11."

These Mac "threats" are only news because of their novelty, not the threat level they pose.

I'm so confident in my Mac's security, here's my IP address in case any hackers want to take potshots at my machine....

Just kidding. I'm not that dumb.

Source: www.wired.com/news/columns/0,70257-0.html?tw=rss.partnerfeed

[sybil]

More second day stories follow from Apple

Mac OS X Hit by Third Vulnerability

On Tuesday, security experts announced the discovery of another vulnerability in Apple's Mac OS X operating system. It is the third vulnerability found in less than a week. Security and antivirus firms have issued advisories classifying the flaw as "extremely critical."

Discovered by Michael Lehn, a graduate student and research assistant at the University of Ulm in southern Germany, the flaw affects Apple's Safari Web browser and could allow attackers to disable a Mac computer after tricking users into accessing a phony Internet site containing malicious code.

Apple has confirmed that it is aware of the problem and has indicated that it is working on a fix "so that this doesn't become something that could affect customers."

Don't Unzip It

The flaw has been classified as a critical vulnerability because the Safari browser is configured by default to run or open certain file types -- photos, movies, and compressed files -- that have been marked "safe" by Mac OS X.

Compressed .ZIP files are just one of the supposedly safe files in question. Attackers can exploit the vulnerability when a Mac user visits a Web site containing malicious software that has been disguised to look like a normally safe file. Users who download the files run the risk of opening their computers to any number of nasty, virulent programs.

According to Dave Cole, director of Symantec Security Response, Symantec has given the flaw a fairly severe rating of 8.3 out of 10 and an urgency rating of 7.3 out of 10. "We would rate this as a severe vulnerability, to put it succinctly," he said.

Unlike many other vulnerabilities that are theoretical in nature, this Safari flaw has proof-of-concept exploit code already published. However, Symantec has not seen any attempts by attackers to exploit the vulnerability as of yet. But it could happen, said Cole, who pointed out that the vulnerability is critical because attackers could easily perform an attack and "install whatever they want without a whole lot of trouble."

"We've seen plenty of instances where this has happened in the Windows world," Cole said. "Where a new vulnerability came out in a Web browser, such as Internet Explorer, and when the bad guys see that, they use it to foist whatever type of software they can -- usually some form of adware -- onto someone's machine. The possibility of someone doing this to Safari users is fairly high."

DIY Flaw Correction

Although Apple has said it is working to correct the problem, a simple change can protect Mac users from any potential exploits without waiting for a new patch, Cole explained. All a Mac user has to do is uncheck the "open safe files after downloading" option under the "general" section in Safari's preferences.

Doing so will eliminate the biggest area of risk for Mac users, Cole said. "In general, opening random .ZIP files and trying to download .ZIP files from the Internet is a pretty bad practice to begin with unless you really know what [the file] is."

Cole said that it is reasonable to expect to see some attack activity from malicious hackers attempting to exploit this vulnerability, but he emphasized that it is easy for Mac users to protect themselves from these attacks.

"With a little bit of Internet street smarts and just simply unchecking this option, it is not difficult to protect yourself," Cole said.

Apple in the Crosshairs

It is fairly unusual to see three vulnerabilities hit the Mac OS in less than a week, Cole said. It might indicate that there is a much higher level of curiosity over Mac OS X. That could be due, he said, to more people playing around with the operating system or a new interest by Internet criminals in exploiting it.

The two viruses discovered last week, "Leap" and "Inqtana," are relatively harmless in contrast to the the newly revealed vulnerability, Cole said. "The worms Inqtana and Leap are low distribution and there is fairly low risk of anyone getting these."

These attacks against Apple not only underscore the importance for every computer user to run antispyware and antivirus security software, but also the need for computer users in general to have Internet street smarts and common sense.

"[Users should] absolutely use security software and make sure they are paying attention to alerts they get," Cole advised. "But, at the end of the day, a lot of this stuff can be avoided by not opening suspicious attachments and not downloading things where you don't know how trusted the Web site is."

No one, Cole said, should feel as though they are impervious to these types of attacks -- spyware, adware, or malicious code -- just because they use a particular type of operating system or software

And..............


Analysts: Mac OS X malware merits education, caution

LEAP-A. Inqtana-A. Safari preference flaw. It’s been a tough week for stalwart Mac supporters who crow about the platform’s security compared to Windows. While the Mac remains a very secure and stable platform, these issues demonstrate the need for increased user awareness, education and protection, according to several security analysts polled by Macworld. And the motivation behind these recent security incidents is money, some said

“This is all tied to the issue of cybercrime for profit,” said Stacey Quandt, research director for technology-research firm Aberdeen Group. “We’re seeing cybercrime as the driver, and I think that no platform is safe from that.”

Online criminals, Quandt contends, are only too happy to exploit any vulnerability they can find in order to gain access to information that they can use to turn a profit.

“Organizations have firewalls and corporate anti-virus software already in place,” Quandt said. “But consumers may not have the necessary protection. Cybercriminals will try to exploit the weakest link in the chain.”

To that end, it’s wise to add antivirus software, she added. “Consumers need to take some protection and be aware of the risks,” Quandt added.

Mac OS X has been a relatively safe environment with many users who aren’t as inured to security issues as their PC counterparts. As a result, Mac users may be especially susceptible to malware that depends on what’s known as “social engineering”—that is, taking advantage of a user’s trust — rather than any specific exploits in the operating system.

That’s what happened with the Leap-A malware, a potentially malicious program that comes disguised as an image file. Once users expand the compressed archive and double-click it, Leap-A launches and installs itself on users’ systems.

Education is key

“This falls into the category of what we call ‘user education and awareness issues,’” explained Scott Carpenter, director of security labs for Secure Elements, a firm specializing in enterprise vulnerability management.

“A large factor of this is the growing marketshare for the Mac. Is it being targeted? Yes,” he said.

Carpenter agrees with Quandt’s assessment that the ultimate driver for this is cybercrime — criminals attempting to exploit security flaws or user naivety in order to gain access to personal information that they can then sell or use to their own ends.

Carpenter said that recent examples of Mac OS X exploits are “only the tip of the iceberg.” Carpenter recognizes that Apple will probably release a patch to fix the recently documented problem with Safari in which a preference setting can lead to the execution of a malicious shell script. But he said that users can do more to protect themselves.

“You need to have tools on your system that protect against viruses, you need to have updated patches for the system and you need user education. When you have all three, you’ll be able to cut back on the problems,” Carpenter said.

“The worst mistake Macintosh users could make would be to become complacent in their security practices deluding themselves into thinking that the Mac OS has no vulnerabilities. It does,” said Neil MacDonald, vice president and distinguished analyst for information security, privacy and risk at Gartner Research, a company whose client list includes anti-virus software makers. “More will be found and more exploits will appear.”

“Best practices for patching should apply on the Mac as surely as on any Windows machine. The same is true for personal firewall and antivirus software configuration. E-mail and Web traffic needs to be filtered for malicious attachments and end-users need to be trained not to download and install unknown software from unknown sources,” MacDonald said.

‘Dancing in the aisles’

Andrew Jaquith, senior analyst for the Yankee Group, has a decidedly different perspective.

“I don’t know if this is the shape of things to come or not. I’m sure the antivirus industry is dancing in the aisles about this, but it doesn’t really take a hell of a lot of ingenuity to come up with what’s been done so far,” Jaquith said.

“The Mac has a good security model—you don’t have the wide open administrative privileges turn on by default like you do on Windows. I suspect that these recent exploits will cause Apple and others to improve Mac OS X security even further,” he added.

Should you run out and buy anti-virus software for the Mac? Jaquith thinks not.

“There just aren’t that many pieces of malware for the Macintosh,” he said. “If anything, you’ll probably see more attempts to target security software in the future, rather than the actual operating system.”

It’s simple math from Jaquith’s perspective.

“The Windows platform has something like 150,000 documented examples of malware — viruses, Trojan horses, worms and so on. Presuming the Mac has five percent of the market, you’d expect to see about 7,500 if there were equivalent security problems. It’s so rare on the Mac, it’s an infinitesimally smaller sample size. You simply can’t predict a trend based on that small a number of data points,” Jaquith said.