Keep OSNews alive by becoming a Patreon, by donating through Ko-Fi, or by buying merch!

macOS Archive

Multiple Security Vulerabilities Found In Apple’s Disk Image Software

The 'Month of Kernel Bugs' project has found two unpatched security vulnerabilities in the way Mac OS X handles .dmg files. The first vulnerability, rated 'highly critical' by security-firm Secunia, can lead to privilege escalation, denial of service, and system access by a remote user (if Safari's open 'safe' files option is checked). The second issue is similar in nature, in that a corrupted UDTO HFS+ .dmg can lead to a denial of service condition. A workaround for both issues is to disable Safari's option to open 'safe' files after downloading, and to not open any .dmg file from a source you do not trust.

Apple Strengthens Mac OS X 10.5 Leopard with New Build

Apple this week delivered to developers Mac OS X 10.5 Leopard build 9A303, the latest in an extremely limited series of pre-release builds of its next-generation operating system. People familiar with the new distribution of the software, labeled Mac OS X 10.5 Leopard build 9A303, say one of its primary objectives of the release is to knock out several 'performance related bugs' that were present in 9A283.

Why Are Mac Users So Defensive?

"Yesterday, I read what I consider to be a provoking piece at ZDNet. It pointed out that while there is no question that Macs are not the malware targets that Windows machines are, they're most certainly not immune to an attack of the right variety. It went on to backup its point with a real world scenario in which a University of New South Wales Mac server had been hit by malware. Disturbingly, the server had apparently been running the latest updates from Apple and still managed to get hit. It mentioned that, in the author's opinion, Apple was 'misleading people' into believing that their OS was more secure than it really is. Whether or not that is true is frankly immaterial to me. It should be noted that no OS is 100 percent bulletproof, and I believe this is what it was driving home at. Unfortunately, some people within the Mac community felt differently."

OS.X Macarena ‘Virus’: No Viable Threat Posed

"OS.X Macarena poses no viable threat as currently conceived. Although we don't have our hands on the virus source code, according to Symantec (who initially publicized the virus last week) OSX.Macarena can infect neither PowerPC-exclusive binaries, nor Universal binaries. It can only affect binaries that are Intel-specific. That would include various system files, but since OSX.Macarena can only infect files in its own directory and has no means of gaining the privileges necessary to escalate into directories where most system files are stored, the the threat level is mitigated."

‘Macarena’ Virus Targets Macs

Source code for a Mac virus has gone public, a security company warned Friday, and although the original doesn't carry a malicious payload, more dangerous variants can be expected. The virus, dubbed 'OSX.Macarena' by Symantec, targets some, but not all, Mac OS X Mach-O executables. "Although methods of infecting Mach-O binaries have been publicly available for some time, this marks the first known fully functional Mach-O file infecter virus," Symantec noted in an alert to customers of its DeepSight threat network on Friday. "The source code for this virus is publicly available and as such it is possible that variants may be trivially developed to extend the virus's functionality."

Exploit Released for Airport Drivers

Metasploit founder HD Moore has released an exploit for an unpatched vulnerability in the Apple Airport driver that ships with some PowerBook and iMac computers. Moore said the exploit is not related to the Wi-Fi driver flaws discovered and discussed in Aug. 2006 by researchers David Maynor and Jon Ellch at the Black Hat Briefings. Moore, who is collaborating with Ellch on Wi-Fi flaw research, named the exploit after Daring Fireball, a Mac blogger who doubted the Black Hat findings and issued a public challenge to Ellch and Maynor.

Working with the WebKit Nightly Builds

"One of the main benefits of an open source WebKit is allowing developers to download nightly browser builds from the WebKit Open Source Project page. Nightly builds allow you as a developer to prepare for changes before they wind up on your users' desktops. This article describes how you can leverage WebKit nightly builds to determine how changes in the framework may affect your web content, Dashboard widgets, or WebKit-based application in future versions of Mac OS X."

Mac OS X 10.4.8 Runs on Generic x86 – Sort of

Mac OS X 10.4.8 will now run on any generic x86-based PC. Well, almost. Kernel coder Semthex has posted what he claims is an entirely legal release of the Mac operating system's foundation layer. The only snag: you can't boot into the familiar GUI. To date, the version of Mac OS X for x86 processors has relied on kernel add-ons to anchor the software to Apple's own hardware through the machines' Trusted Platform Module. Much of the core code is independent of it, however, and available for access to all and sundry via Apple's own source code licence. What Semthex has claimed to do is produce code that essentially bypasses the TPM stuff yet stays within the Apple licence.

Wozniak: Apple Didn’t Need NeXT, OS 9 More Secure Than OS X

Apple co-founder Steve Wozniak says that Apple did not need NeXT, the company that provided the foundation for Mac OS X; he argues that System 7 wasn't nearly as bad as it was made out to be. Wozniak also says that Mac OS 9 was more secure than OS X is now: Mac OS X is built in Unix and is therefore more prone to attacks because people are familiar with the holes in Unix, explained Woznaik. "Some of the holes in Unix are well known. So keeping Firewalls on is more important. And we keep announcing, even our own security fixes, not as many as Microsoft but still we never really had those in the OS 9 days."

Security Analysts: Mac Attacks Rare But May Rise

"Apple computers have long been prized for being relatively virus-free. But as more people use Apple products, experts say the company is increasingly becoming a target for cyber pranksters and criminals writing viruses and other forms of malware. Oliver Friedrichs, director of security response at Symantec, a leading anti-virus software vendor, said 72 vulnerabilities were discovered in the Mac's OS X operating system in 2006, up from 19 in 2004." Please consider the source, though.

Understanding Apple’s Binary Protection in Mac OS X

"With the advent of Intel-based Macintosh computers, Apple was faced with a new requirement: to make it non-trivial to run Mac OS X on non-Apple hardware. The 'solution' to this 'problem' is multifaceted. One important aspect of the solution involves the use of encrypted executables for a few key applications like the Finder and the Dock. Apple calls such executables apple-protected binaries. In this document, we will see how Apple-protected binaries work in Mac OS X."

Apple Lists Dev Enhancements in 10.5, Launches Faster MacBook Pros

Apple has just released a new web page with developer information concerning Mac OS 10.5, Leopard. Among other things, the list includes: OpenGL 2.1, resolution independence, the adoption of the Mandatory Access Control framework from TrustedBSD, Code signing, and much more. And yes, boys and girls, there are screenshots as well. Update: Apple also launched faster MacBook Pros today. Update II: Screenshots of Leopard from ThinkSecret.

The Leopard Report: The Alleged Rush to Beat Vista to Market

"If you can believe what some of the online tech prognosticators tell you, Apple's real 'Top Secret' plan is to have Mac OS 10.5 Leopard out by Macworld Expo in January, or perhaps shortly thereafter. If true, it would give Apple a chance to trounce Windows Vista, at least in times of mind share as opposed to market share, assuming the latter indeed comes out around the same time. I think some of the folks who expect an early release ought to reconsider what they're smoking or drinking."

Apple Seeds Mac OS X 10.5 Leopard Build 9A283

Apple Computer this week released to developers the first pre-release update of its next-generation Leopard operating system since the initial preview in early August. Build 9A283 delivers "Significant user interface changes to iCal" and "Basic editing in Preview," according to the report. It also adds "new Parental Controls for content filtering, apps, and curfews" and "3D audio cues to indicate locations of items on the screen in the VoiceOver screen reader."

Apple Patent Posits ‘Home’ Folder iPods

Normally we don't report on every fart that gets patented by the big companies, but the following patent by Apple is actually pretty interesting: Apple has patented a method to store a user's ~/ directory (home directory) on external storage (the iPod?), making it portable. This will enable users to carry all their settings, programs, and files with them, so they can load up any Mac in the world with their own settings, programs, and files. Obviously, this is 'just' a patent, and by no means a definitive feature of Leopard or Leopard+1, but interesting nonetheless. Is this Apple's answer to Google's OS?

Turn Your Mac Into a HD PVR with EyeTV Hybrid

Lunapark reviews the EyeTV Hybrid, and concludes: "If you own a Mac Mini and have it in your living room, the EyeTV Hybrid is something you should run out to buy immediately (I mean right now). For MacBook, MacBook Pro and Mac Pro owners - if want your tv fix on the Mac or you want an easy way to transfer television shows to your ipod, EyeTV Hybrid is a great choice. Personally I love the EyeTV Hybrid and would enthusiastically recommend it without any hesitation."

Mac OS X 10.4.8 Appears To Be Ready for Release Soon

Users of Apple Computer's Mac OS X Tiger are soon to receive a handout from the Cupertino, Calif-based company - a new software update to the operating system that will offer increased stability and some performance enhancements. Under development since the summer, Mac OS X 10.4.8 Update will represent the eighth such maintenance release issued to users of Tiger since the system made its debut in late April of 2005.