Apple issues updates for lots of critical holes - patch now!

fyi

Apple issues updates for lots of critical holes - patch now!

I thought Apples were magically safe from the bad guys. Angels in the kernel, or something.

Thanks for the tip - as the prostitute said to the leper!

I have updated all four of my Apple machines.  Took about a minute apiece.  The mobile devices said the update addresses "bug fixes and compatibility with Apple Music" and the mainframe update said "bug fixes, compatibility issues and security" and a bug where iPhoto wouldn't download videos from the latest version of GoPro.

Apples are not immune from hacking, it's just much much harder.  Apple doesn't roll out "critical security patches" on a weekly schedule like Microsoft, but only when an update it is required -- two or three times a year.  And most of them seem to be cases like GoPro above, where a "trusted vendor" makes a change to their software which breaks a linkage within Apple.

The same website Richard referenced above wrote:

Not Fixed Yet
We can't see any fixes specific to the Thunderstrike 2 attack.

That's a trick whereby malicious code is written into the firmware of a plug-in Thunderbolt device, such as a network dongle, and used to modify a Mac's built-in Boot ROM firmware.

The Mac firmware is supposed to be sacrosanct and secure: modifiable at initial bootup only, and only updatable to new firmware that is digitally signed by Apple.

Unauthorised and malicious firmware modifications would run every time you reboot your Mac, would load before OS X (and thus be able to subvert it), and would be very hard indeed to remove, especially if the firmware hack were to "close the door behind itelf."

This sounds like a serious breach -- if you boot to a Thunderbolt dongle with malicious code. I don't even know what that is, or if such a thing exists (why would it?)

Apple's website wrote:

The OS X Yosemite 10.10.5 update improves the stability, compatibility, and security of your Mac, and is recommended for all users.

This update:
Improves compatibility with certain email servers when using Mail
Fixes an issue in Photos that prevented importing videos from GoPro cameras
Fixes an issue in QuickTime Player that prevented playback of Windows Media files

For detailed information about the security content of this update, please visit: http://support.apple.com/kb/HT201222

For more detailed information about this update, please visit: http://support.apple.com/kb/HT205004.
Security Content

For detailed information about the security content of this update, see Apple security updates.

See http://support.apple.com/kb/HT5044 article for details on how to verify the authenticity of this download.

NoCoPilot wrote:

Apples are not immune from hacking, it's just much much harder.

You are not alone in thinking this, NoCo. And you are not alone in being incorrect.

I grant that Apple products are safer, but they are no more secure than Windows machines.

They are safer solely because of the small installed base and small number of attacks perpetrated.
According to some hackers, Apples are much easier to break into; they just don't bother.

Here is an article with blurbs on the matter from 32 security experts (the description used by the article's author). I notice that a good many of them use and recommend Macs.

Quote :

Meanwhile, Mac users are just as vulnerable to Web-based attacks like phishing as PC users are, and Mac users who fall prey to phishing tend to lose more money on average than PC users do, the survey found. "Viruses are a diminishing percentage of what we're seeing," said Randy Adams, director of technical education at ESET. "A lot of attacks have to do with social engineering and that kind of attack is platform agnostic."

Yep, "Social engineering" is software-independent.  Anyone who opens up the filters to any website gets what they deserve.

Although, even there, the MAJORITY of malware waiting to be picked up is aimed at Windows, so OS-X users will admit fewer bugs than Windows users.

But yeah, stupid users can circumvent any kind of protection.

Quote :

"So, the next question is--when people ask me what kind of computer should they buy for home, which one do I recommend? Well, I recommend Apple Macs to my friends. Compared to Windows (where we see 50,000 new malware samples every day) malware for Mac is still a novelty. Mac malware is becoming more common, is in the wild, and is financially motivated...You can still get hit--but there are a lot less arrows being thrown at Mac users...I do tell my friends that they should run antivirus on their Macs, just like I do on the Macs my wife and I use at home."

Other than the paragraph about social engineering, did you notice that the consensus is that the MAC OS is no more secure against malware than is the PC? Or that Safari is especially simple to attack? In other words, that the Apple machines are not "much much harder" to hack?

Did you read the same article I did?

Quote :

Carole Fennelly, director of content and documentation at Tenable Network Security: "I will give you a frustrating answer: the most secure system is the one that you know how to secure Meaning if you're pretty knowledgeable in Windows, or even just disciplined enough to keep up with Windows updates and keep your antivirus up to date, there's no reason you can't run a Windows box relatively securely. My mother-in-law has a Windows machine and does very well with it. HOWEVER if you are the type to not let Windows do its updates, tend to click on anything, etc., I'd say get a Mac. I had my parents get a Mac for this reason.

"In short, Mac is probably more secure in that more people write Windows exploits. This would probably change if the majority of people had Macs. Windows requires effort to be secure. Then again, so do most OSes."

Quote :

Joe Grand, president of Grand Idea Studio, hardware hacker, inventor: "Not taking into account the human factor of falling for social engineering, phishing scams, etc., which could affect any operating environment, I would say right now the safer route is Mac OS X, primarily because there just isn't a huge amount of directed attacks against the operating system compared to a Windows environment (yet).

Bottom line: no OS is totally secure without maintenance.

Firefox is more secure than Safari.

Okay.

I use Safari on the mobile devices (because I have to) but they're inherently more secure than a desktop. I use only Firefox on the desktop.

Why are we arguing? We both agree either platform CAN be hacked if you don't keep up your maintenance upgrades. With Windows that's a weekly procedure. With Apple it's every month or two (or three -- and then mostly for software compatibility).

I would never deny that, at this time, the Mac is much safer than the PC. But if Apple increases its market share to somewhere around 20 percent, the Macs may come under serious attack. My daughter has been using Macs for about ten years now and has never had a problem with malware. Her only problems have been with hardware.

Yeah, it can be a pain in the ass to load security patches for the PC, but the system can be set to automatically download and install the patches in the background. PCs are more difficult to maintain as far as security goes, no doubt about that.

Yea, we agree.

My SIL just bought an iMac and is learning the ropes, after being a Windows user. She has commented on the different design philosophies that define each platform. Windows tends to put every option out there, in pull-down menus or menu-bar icons -- no matter how arcane, unusual or unusable. Apple OTOH tends to err on the side of cleanliness and open space. Often many of the functions, even the ones you use frequently, are hidden. You need to know the 'Secret Shortcut' to get to anything.


It's a difference in philosophy. Mac users feel like members of an exclusive club because they've been to the Genius Bar and learned the magic handshake.

If I was buying my first computer today, it would probably be a Mac (although I still think they are terribly over-priced).

I have such a long history with the Microsoft boxes, back to long before they came out with Windows. I never had one of the first generation of PCs; I stuck with my CP/M machine until I had to have a PC for firmware program development. Then I got an AT clone from PCs Limited. No internet ordering, all over the phone. The guy who took my order was Michael Dell. They later changed the name of the company. Duh. The first version of Windows I had was 1.0. It wasn't an OS, but an application program. It came on floppy disks. Now, by sticking with XP, I have all of the developer programs (they cost much more than a computer) so that I can write programs to do whatever I want. I guess I've gotten so comfortable with the system that it will be difficult to change to anything else, even a later version of Windows.

I have looked long and hard at the Macs, but I find small things in each one that I just don't like. Maybe I need to go down to the Genius Bar and try one out, rather than just looking at the specs.

I started using a green-screen dumb terminal at work on a PDP mainframe in 1978. In 1983 when they came out we purchased a few Compaq Luggables, and then went to IBM PCs by the end of the year (still monochrome -- orange -- screens). We could do email and a few small calculator programs, not much else.

My dad had been a manager at Boeing Computer Services since 1956 or 1957, so I grew up hearing about computers.

My first personal PC was an Amstrad CP/M machine, about 1985.

In 1986 or so I worked for a Korean PC clone manufacturer, building computers from component parts according to the user's needs. We sourced parts from all over the world.

I remember when DOS 3.0 changed to DOS 3.1, it was a big improvement. I did not participate in 2.0 or 1.0. I have used every version of Windows since it was just a GUI shell. When I worked for Ballard Computer we sold every brand of PCs then available, plus Apple IIC and the first 1984 Macintosh.

Yeah, we old.

Dumb terminals? You lucky bastard.

My first programming was on an IBM mainframe. With punch cards.