Another Mac OS X Server Hack?

In a recent article, we reported on Tom Yager, a journalist for InfoWorld, who suspected that his Mac OS X server was hacked. Tom has since written about a root exploit he discovered, and now continues discussing this exploit and the effects it has had, turning his server into a spam zombie. Intego’s researchers believe this is the result of an OpenSSH vulnerability that has just been discovered, which affects multiple Unix- or Linux-based platforms. We would recommend that, until Apple patches this flaw, users keep an eye open, especially on their servers. Yager’s articles give a good idea what to look for.

And the Winner Is: Intego VirusBarrier

The latest issue of MacFormat Magazine, the UK’s leading Mac publication, has a no-holds-barred test of six Mac antivirus programs, and guess who comes up the winner? Intego VirusBarrier X5! The editors tested six aspects of a half-dozen Mac virus protection program (such as ease of installation, ease of use, level of protection, ease of updating), and came up with a clear winner. As MacFormat says, “Intego’s VirusBarrier is the one to go for if you want excellent virus protection in a Mac-friendly package.” They summed up their review saying, about VirusBarrier, “It’s easy to update, it’s Mac-friendly and it runs unobtrusively. VirusBarrier is a great all-around system protector.”

Unfortunately, MacFormat doesn’t put its articles online, so we can’t link to it for you to read the entire test. If you’re in the UK, pick up the magazine, which coincidently includes a demo version of VirusBarrier X5 on its included DVD. But if it does come online in the future, rest assured that we’ll let you know.

Microsoft Office Update Contains Security Fixes

Microsoft has released Microsoft Office 2008 for Mac Service Pack 1, a major update to Office 2008, which also contains some security fixes that Microsoft says are critical. In Microsoft’s security bulletin describing the issues, the company says:

“This security update resolves several privately reported vulnerabilities in Microsoft Word that could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”

Whatever the vulnerabilities, the effects could be disastrous. It is rare that we see something that could allow attackers to create new accounts, install programs, and delete data. It is strongly recommended that you install this update immediately.

But the security fixes are not just for Office 2008. They cover Office 2004, as well as just about every version of Office for Windows. You can download the Office 2008 update here; it’s 180 MB. The Office 2004 update is here; it’s only 9 MB.

Laptop Thieves Nabbed by .Mac

Kait Duplaga, an Apple store employee, who lives in White Plains, NY, had two of her Apple laptops stolen from her home. Being a savvy Mac user, when Kait found that her Mac was being used (a friend saw her on iChat, showing that one of the computers had logged onto iChat automatically) she went into CSI mode. She used the “Back to My Mac” feature included with .Mac accounts to remotely access the laptop, then snapped a picture of the user. Showing the picture to friends, the person was identified as having attended a party at Kait’s apartment. The police took things from there, arresting two men for burglary, and recovering nearly all the stolen property.

Adobe Updates Acrobat for Critical Vulnerabilities

Adobe has issued a security bulletin regarding security updates to “Adobe Reader 8.1.1 and earlier versions Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier versions.” These programs have critical vulnerabilities that could “cause the application to crash and could potentially allow an attacker to take control of the affected system”. A total of eight vulnerabilities are fixed in these updates, and you can download them from the security bulletin page linked above.

Personal Information Easily Harvested on Facebook

Facebook is currently the most popular social networking site on the Internet. With the ability to find friends, communicate with them, and play games, the site can be addictive. But the BBC’s program Click this week showed that your personal information - the information in your Facebook profile - can be harvested easily by applications you choose to add to your profile.

It turns out that when you allow an application to access your personal information - something that many applications require - that application can get at not only your information, but that of your friends, without their knowing it, and in spite of their security settings.

The Click team created a simple application that could masquerade as a game or a test.

“We wrote an evil data mining application called Miner, which, if we wanted, could masquerade as a game, a test, or a joke of the day. It took us less than three hours.

But whatever it looks like, in the background, it is collecting personal details, and those of the users’ friends, and e-mailing them out of Facebook, to our inbox.

When you add an application, unless you say otherwise, it is given access to most of the information in your profile. That includes information you have on your friends even if they think they have tight security settings.

Did you know that you were responsible for other people’s security?”

The solution? Alas, there is none for no. The only thing you can do is make sure that you don’t include, in your Facebook profile, information that you don’t want non-friends to find out about. Or, as the Click team says, “In fact, the only way we can see of completely protecting yourself from applications skimming information about you and your friends is to erase all the applications on your profile and opt to not use any applications in the future.”

To learn more about this, watch this segment of Click on the program’s website.