Important Security Patch For Mac
This week saw a tragic start, when late Sunday night a man named Stephen Paddock killed 58 people and wounded hundreds more in Las Vegas. Flooded the internet in the immediate aftermath, as did questions—since answered—around how. We also —but didn't find much that's promising. There's at least a little levity—although more tragicomic, really—in Yahoo announcing that its one-billion account leak in 2013 was actually.
You also might enjoy this handy guide to, and when one of his staffers has commandeered his account. Also, the Department of Energy's email about, so that's fun. OK, back to terrible things. There's been an alarming rise in. The in the form of a Congressional hearing.
And last December, which invites all sorts of potential terrible results. And yet, somehow, there's more! As always, we’ve rounded up all the news we didn’t break or cover in depth this week. Click on the headlines to read the full stories. On Thursday, Apple released the first update to High Sierra, the new macOS operating system that debuted at the end of September.
And it’s an important one. High Sierra 10.13 had two disappointing credential security bugs at launch, but Apple says that both have been patched in this update. One is a bug that could have let attackers use a third-party app to pilfer usernames and passwords from macOS’s Keychain tool that stores credentials. The other is a flaw that revealed plain text passwords in the password hint for encrypted Apple File Systems volumes. If you added disk encryption with a hint, the plain text of your password would show up in the hint field in the Disk Utility. If you already created an encrypted volume before you installed the update, you’ll need to back it up, wipe the drive, reformat the File Systems volume, and then restore from the backup. Either way, use Apple’s “Software Update” tool to download the patch.
Like.right now. Google's of cybersecurity specialists has called out Microsoft for issuing patches inconsistently, and in a manner that could tip off attackers to vulnerabilities in older versions of the operating system. The fix, Google says, is just to apply the same updates across all iterations, so that hackers can't infer what vulnerabilities might be hiding where based on a given patch. Technically this happened last week, but for hopefully understandable reasons we're still mentioning here. Authorities recently apprehended Gal Vallerius in connection with selling drugs on the dark web bazaar Dream Market, allegedly under the handle OxyMonster.
While Vallerius lives in France, the feds picked him up in Atlanta, as he was traveling to a 'world beard-growing championship' in Austin, Texas. The dark web markets have been in a bit of chaos ever since this summer's, but have rarely seen such a hairy situation.
Security Protocol The feature list of macOS Sierra is deceptively simple. It is so modest in its scope that some users may be that they may not need the upgrade, even though it’s free. That’s a bad idea.
When a new version of macOS comes out, my first reaction is to check my mission critical apps. Being both a writer and a podcaster, I can’t afford a show stopper. But I’m always mindful that, in this day and age, many security fixes, many of which have architectural impacts, are rolled into each major release. Those architectural changes, in some cases, can impact the operation of some apps. That’s one reason why Apple has a long period of developer and public betas to work out those kinks. By the time a major release, like Sierra, is launched, most of those problems should be solved.
Why doesn’t Apple roll out the fixes piecemeal? The answer is that some are synergistic and depend on major OS changes that could, in turn, affect developers. Secondly, many sound scary, but are still in proof of concept phase and aren’t widespread in real world exploitations. They need to be attended to, but an urgent single point security update isn’t called for. A Helpful Analysis from Intego The Mac Security Blog at Intego is a very helpful place to find out more about all this.
In, Jay Vrijenhoek explains the situation with Sierra nicely. Apple maintains a webpage that provides 2. The entry for Sierra cites. According to author Vrijenhoek, there is something important to note: For those not familiar with reading Apple Security bulletins, the addressed vulnerabilities mention ‘Available for: OS X El Capitan v10.11.6,’ but this means the vulnerability was found in OS X El Capitan and fixed only if you update to macOS Sierra. Note that the and 2016-005 for Yosemite only fixes a few critical kernel issues, not the 65 issues fixed in Sierra. Accordingly, if you’re good to go with all your mission critical apps, it’s a good idea to upgrade to macOS Sierra just to make sure one of these obscure bugs doesn’t get exploited in the wrong place and the wrong time: your Mac.
It’s also important to recognize that because iOS is a descendant of Mac OS X, it often shares common security flaws. Author Vrijenhoek correctly points out: As an added bonus, the list of vulnerability fixes in iOS 10 was amended to show 28 additional vulnerabilities that were addressed in the release. Apple did not release these details until Sierra was released, likely because both operating systems shared the same flaws.
Publishing details on the flaws that were addressed in iOS 10 would have given those with malicious intent a nice roadmap of what to exploit in OS X. I surmise this is why major releases of macOS and iOS and tvOS are rolled in the same month. Apple often has to address the same flaw in all variations of its OSes. Be Aggressive. Like Apple I’m being a little over the top next, but not much. If you’ve been thinking that you can continue to survive with, say, a 2007 iMac running Mountain Lion, I’d advise against it if that Mac is connected to the Internet.
I also surmise that the reason Apple encourages updates with it’s Auto-downloading feature is so that customers are always mindful of the need to upgrade. Because Apple’s OS updates are free, Apple’s only incentive is to protect its customers, not develop a revenue stream. On the other hand, forcing users to upgrade before they’ve certified their mission critical apps would be inappropriate. Apple has chosen a wise middle ground. “” After a new macOS release, there are lots of articles that will guide you though the update of your apps so you can then update your OS. Here’s one by our Bob LeVitus: “” The bad guys are Apple customers should never assume they can do nothing and get away with it. Teaser image via. “For those not familiar with reading Apple Security bulletins, the addressed vulnerabilities mention ‘Available for: OS X El Capitan v10.11.6,’ but this means the vulnerability was found in OS X El Capitan and fixed only if you update to macOS Sierra.” That is NOT the meaning I have from reading that text.
To me, “Available for: OS X El Capitan v10.11.6” means that the fix for this vulnerability is available for 10.11.6. I would like someone with easy access to Apple to query this interpretation – it has been tossed around a lot lately and it’s time that Apple defined Read more ». “There are lies, damned lies, and statistics.” Counting the number of vulnerabilities fixed is a red herring. One would expect that newer software would require more maintenance than more mature software. It’s the nature of the beast. It is also irresponsible reporting.
Rather than suggesting Sierra is “more secure” because of the fixes, I will contend that Sierra is less secure because it requires additional hardening. Further this “Vrijenhoek” is wrong based on real analysis of the systems. If Apple has a CVE open for a vulnerability in El Capitan and reports to the government that it is fixed and Read more ». Excellent article! As ex Apple employee #00 i always read your editorials and Particle Debris blog which are the best rational viewpoint on Apple on the Web.
As a developer still using Terminal for development, i would like to read a regular article about the issues that arise with new major MacOS releases for the world of unix development tools installed via HomeBrew, MacPorts and the like. Database engines like Postgres, Java SDK development, JAVA EE, and the like which i use with BBEdit, for my (now outdated) habits of CLI development.
Free Security For Mac
Keep up the good (rational) work.