The Mac Security Blog

iPhone Update Doles Out Ten Security Fixes

Apple has released the iPhone 1.1.1 update, which contains, in addition to bug fixes and improvements for the phone itself, ten security fixes. This update corrects vulnerabilities in the phone’s Bluetooth software, its Mail software, and a vulnerability that could cause you to unwittingly dial numbers that arrive in your e-mail or that are displayed on web pages with “tel:” phone number links. Other fixes patch weaknesses in Safari and JavaScript. Make sure to update your iPhone immediately, using iTunes – if you’re a Mac user, iPhone updates don’t appear in the Software Update preference pane.

Note that reports say that some “unlocked” phones – those iPhones that have been hacked to work with carriers other than AT&T – do not work after the update. If you’ve hacked your iPhone in this manner, use at your own risk.

You can get more information and details about all the security fixes on this Apple web page.

Laptops and Security

With Apple’s laptop market share now exceeding 17% in the US, it’s clear that the MacBook and the MacBook Pro are the computers of choice for today’s mobile generation. This sales figure has been growing steadily for some time, and will certainly continue. More and more people want Macs they can take with them on the road, between their home and office, and use more comfortably in all situations. Apple’s laptops are perfect for this, with nice wide screens, and low prices.

However, if you have a laptop, you need to think twice about security; maybe even three or four times. First, think about your data. If you’re carrying your Mac with you, and have all your photos, music and personal files on it, you will need to back up these files regularly, using, for example, Intego Personal Backup. Not only does this protect your data, and make backing up easy, and even automatic, but if you have more than one Mac – a home desktop and a laptop – you can synchronize your files between the two Macs.

You also need to ensure that you have adequate network security. Every time you connect to an open hotspot with your MacBook or MacBook Pro, you’re at risk from hackers and vandals. You need to protect your Mac with a personal firewall, such as Intego NetBarrier, to ensure that no one can get at your data when you’re surfing in the wild.

So enjoy your laptop, but make sure to take the necessary precautions.

MacBook and MacBook Pro Update For Safer Computing

Apple today issued the Macbook, MacBook Pro Software Update 1.0, which fixes a little-known feature that was not enabled on some of these portable Macs. Today’s Macs use “file system journaling” by default. As Apple says:

Journaling is recommended for all Macintosh computers as a preventative measure against file corruption.

What journaling does is keep a record of everything your hard disk does, so if you have a crash, the journal can update your disk’s catalog when you restart. You can check whether journaling is enabled for your hard disks by running Disk Utility, selecting a disk, then checking at the bottom of the window in the section that provides disk information. If your MacBook or MacBook Pro does not have journaling enabled, follow the instructions in the Apple technical article linked above to repair the disk and make sure the journal updates correctly.

In the meantime, check the Software Update preference pane to download this update, if you have a MacBook or MacBook Pro.

When You Send Your Mac for Repairs, Think About Security

An Apple Store in Seattle, Washington, was recently burglarized, the thieves walking away a number of laptops that had been in the store for service. Some of these laptops probably contained personal information: who knows what people had on their Macs. What do you store on your laptop? User names and passwords; serial numbers; maybe even credit card numbers?

Whenever you send a computer out for service or repairs, you should remove all personal information, and securely delete all the free space on its hard drive. Even if the computer isn’t stolen or lost in transit, can you really trust the many people who may handle it during repairs?

To do this, start by deleting all the personal files you have on the computer being serviced. (First, you should back up all these files with Intego Personal Backup.) Next, open Disk Utility; this program is in the Utilities folder, found in your Applications folder. Click on the disk or volume that contained your personal files, click the Erase tab, then click Erase Free Space.

A sheet displays offering three options:

You can choose to Zero Out Deleted Files, or you can use a 7-pass or 35-pass erase. These latter methods are much more secure, but take longer. While the default option, Zero Out Free Space, might still allow spies to get at your data, the 7-pass option is more than safe enough for all but budding James Bonds.

When you have done this, you can send your Mac in for service without worrying about anyone finding any personal data on it.

Happy Birthday Computer Viruses!

This year, some computer users may want to celebrate a peculiar anniversary: the computer virus is 25 years old. While viruses have become everyday occurrences, it’s easy to ignore that the first computer virus that got into the wild is as old, in computer years, as Methusalah.

It was called Elk Cloner, and it was the work of a 15-year old high school student named Rick Skrenta. He developed a boot sector virus – the kind that hides in parts of a disk that contain no actual files – that he circulated via floppy disks in his school and a local computer club. While we are more familiar with the vast number of viruses that target Windows computers, it is interesting to note that this first virus affected only Apple II computers.

Fortunately, this virus did no harm, but rather displayed a “poem”:

Elk Cloner: The program with a personality
It will get on all your disks

It will infiltrate your chips

Yes it’s Cloner!
It will stick to you like glue

It will modify RAM too
Send in the Cloner!

When Skrenta was asked about this virus in 2007, he said it was “some dumb little practical joke.”

For more on the history of computer viruses, you can check out this CNet article that looks at the evolution in self-replicating computer code, from the first worm (1975) to the more recent plague of computer viruses, and this Wikipedia timeline of computer viruses. And while you’re at it, make sure to keep your copy of Intego VirusBarrier X4 up to date to make sure your Mac won’t get infected.

iTunes 7.4 Update Includes Security Fix

Apple today updated it iTunes music software to version 7.4, mostly to provide support for new iPods, but also to fix a security issue. This fix, for both Mac OS X and Windows, protects against an exploit where album cover art could lead to crashes or “arbitrary code execution”. As always, update iTunes from Software Update (if you’re on a Mac), or by choosing iTunes > Check for Updates, on Windows.

More information about this security fix is avaliable on this Apple web page.