Adobe releases Flash Player 11.6.602.137 beta

Posted by:
Date: Wednesday, January 9th, 2013, 07:45
Category: News, Software

On Tuesday, Adobe released Flash Player 11.6.602.137 for Mac OS X, a 16.9 megabyte download via MacUpdate as a pre-release beta. The new version adds the following fixes and changes:

- This pre-release includes new features as well as enhancements and bug fixes related to security, stability, performance, and device compatibility for Flash Player 11.6 and AIR 3.6.

Adobe Flash Player 11.6.602.137 requires an Intel-based Mac running Mac OS X 10.6 or later to install and run.

If you’ve tried the new Flash Player and have any feedback to offer, please let us know in the comments.

Hacker cites iOS 6 code as becoming more secure, offering “tougher protections”

Posted by:
Date: Wednesday, December 26th, 2012, 07:18
Category: iOS, News, security, Software

Hacking an iOS device may be getting tougher to do.

Per iPodNN, in a recent tweet, hacker i0n1c has revealed that the forthcoming iOS 6.1 update adds “again tougher protections” to the codebase even compared to iOS 6, suggesting that security has been dramatically improved.

While many users have perfectly legitimate reasons (beyond just wanting to) for jailbreaking their iOS devices, because the technique relies on finding an exploitable “hole” in the OS code that could also be used for malicious purposes, Apple is naturally very eager to close up avenues by which unofficial or dangerous code could be injected into the device — even though many “unofficial” apps are simply ones that were rejected by Apple for App Store guideline violations, mostly for altering core OS elements.

Closing down jailbreaking loopholes will also close off one of the principle sources of pirated apps, also giving Apple considerable incentive to cut off the practice. Holes in Android code are frequently used to install scamware, malware, privacy-compromising and even virus-ridden apps — a growing problem for Google, though the ability to heavily customize and “root” Android devices is a major selling point to the most technically-proficient of Android’s audience.

The hacker community believes that iOS 6 will eventually get an “untethered” (meaning “persistent through restarts”) jailbreak, but that iOS 6.1 may represent the end of the free jailbreaking road. The security may simply have reached a point where only those likely to sell any remaining exploit secrets are likely to be able to come up with any.

Apple has made security a top priority on iOS, since it is the only platform where malware is all but completely unknown. Many of the security improvements made in iOS have also been transferred to the Mac as applicable, including complete sandboxing of applications and developer “signatures” on apps.

In his tweet, i0n1c refers to a “changing of the guard” that has brought much-improved security to iOS. It’s unknown if this refers to Craig Federighi’s recent promotion to handle both iOS and OS X, or if this is a reference to Kristin Paget, a top white-hat hacker herself who is now listed on LinkedIn as a “Core OS Security Researcher” at Apple.

Stay tuned for additional details as they become available.

iOS 6 security bug in wild, reenables JavaScript under Safari without input from user

Posted by:
Date: Monday, December 24th, 2012, 08:57
Category: News, security, Software

This is the reason bug fixes were invented.

Per AppleInsider the Safari web browser in Apple’s iOS 6 platform has a potentially serious JavaScript bug that could have major security and privacy implications.

The new “Smart App Banner” feature in iOS 6 is designed to allow developers the ability to promote App Store software within Safari. The Smart App Banner detects whether a user has a specific application installed, and invites them to view the software on the App Store or open it on their iOS device.

But for users who choose to turn off JavaScript in the Safari Web browser, the appearance of a Smart App Banner on a website will automatically and permanently turn JavaScript back on without notifying the user.

iOS device owners can test this issue by opening the Settings application and choosing Safari, then turning off JavaScript. Then simply launch the Safari browser and visit a website with a Smart App Banner.

Users can then go back into the Settings application to verify that the JavaScript setting switch has been flipped back to the “on” position without warning. Accordingly, JavaScript features on websites will begin working again.

The issue has reportedly existed since the release of iOS 6 months ago, though it has not been widely reported. In addition, people familiar with the latest beta of iOS 6.1 said the problem also remains in Apple’s pre-release test software on the iPhone.

Peter Eckersley, technology products director with digital rights advocacy group the Electronic Frontier Foundation, said he would characterize such an issue as a “serious privacy and security vulnerability.”

Neither Eckersley nor the EFF had heard of the bug in iOS 6, nor had they independently tested to confirm that they were able to replicate the issue. But Eckersley said that if the problem is in fact real, it’s something that Apple should work to address as quickly as possible.

“It is a security issue, it is a privacy issue, and it is a trust issue,” Eckersley said. “Can you trust the UI to do what you told it to do? It’s certainly a bug that needs to be fixed urgently.”

But Lysa Myers, a virus hunter at security firm Intego, said she doesn’t see the bug as a major concern for the vast majority of iOS device owners.

“While this issue is certainly not an ideal situation, by itself it actually isn’t that large a problem,” said Myers. “At the moment it doesn’t pose a threat, but we’ll continue to monitor it to make sure it doesn’t become more exploitable. There’s also the fact that few people actually disable JavaScript completely as it can partially, or totally, disable the majority of websites.”

Stay tuned for additional details as they become available.

Apple releases iOS 6.0.2 update, includes fixes for Wi-Fi, security features iPhone 5, iPad mini

Posted by:
Date: Wednesday, December 19th, 2012, 08:57
Category: iOS, iPad, iPhone, iPod Touch, iTunes, News, Software

Hey, an update’s an update.

Late Monday, Apple released iOS 6.0.2, the latest version of its iOS operating system for the iPhone 5 and iPad mini devices.

The update, a 626 megabyte download, offers the following fixes and changes:

- Fixes a bug that could impact Wi-Fi.

- Assorted security fixes detailed here.

The iOS 6.0.2 update requires the following devices:

- iPhone 3GS / 4 / 4S / 5

- iPad 2 and new iPad

- iPod Touch 4th Gen

- iPad Mini

As always, the update can be acquired via iTunes or the Over The Air software update feature built into iOS 5 or later.

If you’ve tried the update and have any feedback to offer, please let us know in the comments.

Adobe releases Flash Player 11.6.602.108 update

Posted by:
Date: Thursday, December 13th, 2012, 07:11
Category: News, security, Software

adobelogo

On Monday, Adobe released Flash Player 11.6.602.108 for Mac OS X, a 11.9 megabyte download via MacUpdate. The new version is for Adobe Flash Player 11.6.602.108 and earlier versions and adds the following fixes and changes:

- Bug fixes related to security, stability, performance, and device compatibility.

Full release notes are available here and the new version requires an Intel-based Mac running Mac OS X 10.6 or later to install and run.

If you’ve tried the new Flash Player and have any feedback to offer, please let us know in the comments.

“Dockster” trojan for the Mac goes into the wild, plays on the same Java vulnerability as “Flashback”

Posted by:
Date: Tuesday, December 4th, 2012, 08:57
Category: News, security, Software

Ok, this shouldn’t be happening again.

Per F-Secure, a new piece of malware that takes advantage of a well-documented Java vulnerability has been found on a website dedicated to the Dalai Lama, with the trojan able to install itself on an unwitting Mac user’s computer to capture keystrokes and other sensitive data.

Dubbed “Dockster,” the malware was first found by antivirus and security firm Intego to have been uploaded to the VirusTotal detection service on Nov. 30. At the time of its discovery, the remote address associated with trojan was not active, possibly indicating that the code’s creators were testing whether it would be detected, but as of this writing the malicious code is now “in the wild.”

Similar to the Flashback exploit from September 2011, Dockster leverages the same Java vulnerability to drop the backdoor onto a Mac, which then executes code to create an agent that feeds keylogs and other sensitive information to an off-site server.

In the case of Flashback, which was also discovered by Intego, a reported 600,000 Macs were affected before both Apple and Oracle released a Java patches to remove the malware and protect against future attacks.

Although the newly-found Dockster takes advantage of an already fixed weakness, users who haven’t yet updated their Macs or are running older software may still be at risk.

In which case, try to ensure that your friends and family with older, pre-OS X 10.6 software are up to date and be careful out there.

Mozilla releases Firefox 17.0 update

Posted by:
Date: Wednesday, November 21st, 2012, 09:35
Category: News, Software

elfirefox

The Firefox version number just keeps getting pushed higher…

Late Wednesday, Mozilla.org released version 17.0 of its Firefox web browser. The new version, a 33.3 megabyte download and adds the following fixes and changes:

What’s new:
- FIXED – 16.0.2: Security fixes can be found here

- FIXED – 16.0.1: Vulnerability outlined here.

- NEW – Firefox on Mac OS X now has preliminary VoiceOver support turned on by default.

- NEW – Initial web app support (Windows/Mac/Linux).

- NEW – Acholi and Kazakh localizations added.

- CHANGED – Improvements around JavaScript responsiveness through incremental garbage collection.

- DEVELOPER – New Developer Toolbar with buttons for quick access to tools, error count for the Web Console, and a new command line for quick keyboard access.

- DEVELOPER – CSS3 Animations, Transitions, Transforms and Gradients unprefixed in Firefox 16.

- DEVELOPER – Recently opened files list in Scratchpad implemented.

- FIXED – Debugger breakpoints do not catch on page reload (783393).

- FIXED – No longer supporting MD5 as a hash algorithm in digital signatures (650355).

- FIXED – Opus support by default (772341).

- FIXED – Reverse animation direction has been implemented (655920).

- FIXED – Per tab reporting in about:memory (687724).

- FIXED – User Agent strings for pre-release Firefox versions now show only major version (728831).

Known Issues:
- UNRESOLVED – If you try to start Firefox using a locked profile, it will crash (see 573369).

- UNRESOLVED – For some users, scrolling in the main GMail window will be slower than usual (see 579260).

- UNRESOLVED – Windows: The use of Microsoft’s System Restore functionality shortly after updating Firefox may prevent future updates (see 730285).

- UNRESOLVED – Pointer lock doesn’t work in web apps (see 769150).

Firefox 17.0 requires an Intel-based Mac running Mac OS X 10.5 or later to install and run.

If you’ve tried the new version and have any feedback to offer, please let us know in the comments.

Twitter sends out e-mails to significant number users needing passwords on “compromised accounts”

Posted by:
Date: Thursday, November 8th, 2012, 07:40
Category: News, security, Software

If you found that your Twitter password was reset, there’s a valid reason for it.

Per CNET and the TweetSmarter blog, an unknown number of Twitter users have received a genuine e-mail from the company warning they should change their password as soon as possible.

In the e-mail, the microblogging company noted: “Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We’ve reset your password to prevent others from accessing your account.”

The company did not say in the e-mail that there has been a hack, a breach of data, or anything out of the ordinary, however. At this stage, it’s unclear how many have been affected or what’s caused the mass e-mailing of its users.

A post on Wednesday noted that in some cases when “large numbers of Twitter accounts have been hijacked,” the company sends out these e-mails en masse, even sending messages to accounts that may not have been affected by any hack or hijack to err on the side of caution.

So far, a few high profile accounts have noted interference, including David Mitchell, who said:

“Got an e-mail from twitter telling me that my password had to be changed because they thought my account had been hacked,” adding in another tweet: “So I’ve changed it, but the only evidence of hacking I can find is that my tweet about my Observer column last Sun has disappeared. Weird.”

Stay tuned for additional details as they become available.

Adium updated to 1.5.4

Posted by:
Date: Wednesday, November 7th, 2012, 08:37
Category: News, Software

adiumducky.gif

Adium, the open source instant message chat client with support for multiple programs (including AOL Instant Messenger, ICQ, Jabber, MSN, Yahoo! Google Talk, Bonjour, etc.) has been updated to version 1.5.4.

The new version, a 22.7 megabyte download adds the following fixes and changes:

- Updated the included Growl SDK to 2.0, adding support for Notification Center on 10.8 if Growl is not installed. (#15867)

- Updated libotr to 3.2.1, fixing a security vulnerability.

- Updated libpurple to 2.10.6.

- Changed the default tab switching shortcuts for new users to Control-Tab/Control-Shift-Tab, to match Safari. (#16102)

- Improved disk usage: limit the tracking of the “last seen” time to contacts who are on your contact list.

- Fixed a problem where accepting a group chat invite on Sametime 8.5.1 would crash Adium. (Jonathan Rice and Jere Krischel) (#16114)

- Fixed a problem where accepting a group chat invite on HipChat’s XMPP server would crash Adium. (#16007)

- Fixed a problem preventing Adium from executing Applescripts when Gatekeeper is enabled.

- Added routines to make Secure Transport (on 10.8 and above) work around buggy TLS implementations in certain older XMPP servers. (#16081)

- Updated translations: British English, Czech, Danish (#16196), Dutch (#16220), French (#16207), Italian (#16218), Norwegian (Bokmål) (#16219), Portuguese (Portugal) (#16211), Slovakian (#16194), Turkish.

Adium 1.5.4 is available for free and requires Mac OS X 10.6.8 or later and an Intel-based Mac to run.

If you’ve tried the new version and have any comments, let us know.

Google Chrome updated to 23.0.1271.64

Posted by:
Date: Wednesday, November 7th, 2012, 08:53
Category: News, security, Software

google-chrome-logo

It’s the bug fixes that make a difference.

Late Tuesday, Google released a beta of version 23.0.1271.64 of its Chrome web browser. The update, a 56.5 megabyte download, adds the following fixes and changes:

- Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.

- High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.

- [Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.

- High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.

- Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Groebert of the Google Security Team.

- Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.

- Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).

- Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).

- High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.

- Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.

- Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).

- High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

Google Chrome 23.0.1271.64 requires an Intel-based Mac with Mac OS X 10.5 or later to install and run. If you’ve tried the new version and have any feedback to offer, please let us know in the comments.