C/C++/Cocoa tool for codesign security, Developer ID, & Mac App Store Receipt Validation
Tighten Pro - in the Mac App Store
Tighten Pro is now available in the Mac App Store.
Simply click on the icon to the left to purchase directly from Apple.
Or choose PKCS#7Viewer.app by clicking the image to the right.
Mac Developer: Trivial authentication bypass in libssh leaves servers wide open | Ars Technica
Trivial authentication bypass in libssh leaves servers wide open | Ars Technica: "A search on Shodan showed 6,351 sites using libssh, but knowing how meaningful the results are is challenging. For one thing, the search probably isn’t exhaustive. And for another, as is the case with GitHub, the use of libssh doesn’t automatically make a site vulnerable."
The cool linkage here is Shodan.
Labels: security is hard
Mac Developer: iTunes is finally in the Microsoft Store | Ars Technica
iTunes is finally in the Microsoft Store | Ars Technica: "Promised just over a year ago at Microsoft's Build conference in 2017, Apple iTunes is now finally available in the Microsoft Store."
Do as I say, not as I do.
Labels: Apple vs. Apple
Mac Developer: Caesars Palace not-so-Praetorian guards intimidate DEF CON goers, seize soldering irons | Ars Technica
Caesars Palace not-so-Praetorian guards intimidate DEF CON goers, seize soldering irons | Ars Technica: "Katie Moussouris—a bug bounty and vulnerability disclosure program pioneer at Microsoft, an advocate for security researchers, and now the founder and CEO of Luta Security—was confronted by two male members of hotel security as she returned to her room. When she went into the room to call the desk to verify who they were, they banged on the door and screamed at her to immediately open it."
Looks like Orwellian future, smells like Orwellian future, probably living in an Orwellian future.
Mac Developer: 'Synthetic Click' attack re-emerges in macOS High Sierra at Defcon
'Synthetic Click' attack re-emerges in macOS High Sierra at Defcon: "A vulnerability has been discovered in macOS that could allow an attacker to impersonate a mouse click, enabling for it to bypass security prompts and completely compromise a Mac, a flaw that was found by accident. "
No, mama no!
Labels: security fail, security is hard
Mac Developer: Autodesk dropping support for Alias and VRED in macOS Mojave over OpenGL deprecation
Autodesk dropping support for Alias and VRED in macOS Mojave over OpenGL deprecation: "It isn't clear why Autodesk made the declaration that OpenGL's deprecation was responsible for the applications not working in Mojave."
Dammit Jim, I'm a journalist not a software developer!
Labels: open standards
Mac Developer: Google launches “Shielded VMs” to protect cloud servers from rootkits, data theft | Ars Technica
Google launches “Shielded VMs” to protect cloud servers from rootkits, data theft | Ars Technica: "Both Microsoft and Google have launched confidential computing technologies; Microsoft's Azure Confidential Compute was announced last September, and Google's Asylo framework was launched in beta in May. These platforms run application containers in "trusted execution environments"—enclaves that prevent access to the data within those instances from being read by anything running on the underlying operating system or virtual environment."
Labels: 1984, security is hard, security policy
Mac Developer: Wipe your iPhone before selling it, because if you don't you might get your data stolen
Wipe your iPhone before selling it, because if you don't you might get your data stolen: "Even if you can't use your phone, you can safeguard your data. For instance, Apple does let you remotely wipe everything using Find My iPhone from another iOS device. That has to be enabled: if you've never switched on Find My iPhone or you've actively switched it off, you can't remote wipe."
The moral of the story is: turn on Find my iPhone
Labels: app security, security fail
Mac Developer: Amazon Echo recorded household audio, sent it to random contact
Amazon Echo recorded household audio, sent it to random contact: "An Oregon family's Amazon Echo recorded household audio and sent it to an employee of the family's husband, something Amazon blamed on a rare bug that it intends to fix."
Labels: security fail, security leak
Mac Developer: Police use of Amazon’s face-recognition service draws privacy warnings | Ars Technica
Police use of Amazon’s face-recognition service draws privacy warnings | Ars Technica: "Amazon is actively courting law-enforcement agencies to use a cloud-based facial-recognition service that can identify people in real time, the American Civil Liberties Union reported Tuesday, citing the documents obtained from two US departments."
Mac Developer: Smartphone app that allows credit card skimming ‘real risk’ to consumers: experts - National | Globalnews.ca
Smartphone app that allows credit card skimming ‘real risk’ to consumers: experts - National | Globalnews.ca: "A smartphone app, which allows the user to read credit card information through wallets and purses, is cause for concern amongst consumers that carry credit cards with radio-frequency identification (RFID) technology, according to experts.
The free app, available on the Samsung Galaxy S3 through the Google Play store, allows the phone to read the RFID chip on a credit card, picking up the cardholder’s name, credit card number and expiry date, according to a CBC investigation."
Way to go global payment processing plutocracy!
Labels: security is hard
Mac Developer: YubiKey NEO's physical NFC key can now unlock apps on iPhone 7 & later
YubiKey NEO's physical NFC key can now unlock apps on iPhone 7 & later: "Taking advantage of the more open NFC access on iPhones made possible with iOS 11, Yubico has announced that its physical YubiKey NEO authentication key can now be used to unlock compatible iOS apps.
Labels: authentication, ludicrous speed, security is hard
Mac Developer: Intel promises fix for new 'Variant 4' Meltdown, Spectre vulnerability
Intel promises fix for new 'Variant 4' Meltdown, Spectre vulnerability: "Industry woes over Meltdown and Spectre continued this week when Google and Microsoft on Monday revealed a newly discovered silicon-level vulnerability impacting chips used in millions of computers, including those marketed by Apple. "
I'm totally cereal about this.
Labels: security fail, security flaw, security is hard, software fail
Mac Developer: Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed • The Register
Mac Developer: More Spectre-style chip flaws discovered in Intel processors
More Spectre-style chip flaws discovered in Intel processors: "The eighth vulnerability is apparently an exception, potentially posing a greater threat than Spectre itself, as it could allow an attacker to launch an exploit in a virtual machine (VM) as a way to attack the host system. Largely affecting enterprise, as well as some individual users who operate VMs privately, the vulnerability could also be used to attack other VM instances on the same server, and due to Intel's Software Guard Extensions (SGX) not being "Spectre-safe," it could also intercept passwords and keys transmitted between VM instances. "
"Nobody ever got fired for buying IBM."
Labels: security exploit, security fail, security flaw
Mac Developer: Drive-by Rowhammer attack uses GPU to compromise an Android phone | Ars Technica
Drive-by Rowhammer attack uses GPU to compromise an Android phone | Ars Technica: "Over the past few years, there has been a steady evolution in Rowhammer, the once largely theoretical attack that exploits physical defects in memory chips to tamper with the security of the devices they run on. On Thursday, researchers are unveiling the most practical demonstration yet of Rowhammer's power and reach: an exploit that remotely executes malicious code on Android phones by harnessing their graphical processors."
Yo! Hammer! Can't touch this...
Labels: security flaw, security is hard
Mac Developer: Hands off! Arm pitches tamper-resistant Cortex-M35-P CPU cores • The Register
Hands off! Arm pitches tamper-resistant Cortex-M35-P CPU cores • The Register: "Arm has released a new processor core design for Cortex-M-powered system-on-chips that will try to stop physical tampering and side-channel attacks by hackers."
Mac Developer: Baltimore’s 911 system, Boeing join Atlanta in week of crypto-malware outbreaks | Ars Technica
Baltimore’s 911 system, Boeing join Atlanta in week of crypto-malware outbreaks | Ars Technica: "Last Friday, the City of Atlanta was struck by a ransomware attack that took much of the city's internal and external services offline. As of today, many of those services have been restored, but two public portals remain offline."
Security is hard, people. And getting harder. Humans are the weak link in the chain.
Labels: social hacking
Mac Developer: Intel drops plans to develop Spectre microcode for ancient chips | Ars Technica
Intel drops plans to develop Spectre microcode for ancient chips | Ars Technica: "Intel has scaled back its plans to produce microcode updates for some of its older processors to address the "Spectre variant 2" attack. Core 2 processors are no longer scheduled to receive updates, and, while some first generation Core products have microcode updates available already, others have had their update cancelled.
I wanted to fix the worst computer bug in the history of humankind but then I realized if I don't fix it, people will buy more new CPU chips. It's a win-win situation!
Labels: security fail
Mac Developer: There's a new malicious link that can crash or hang Messages and Safari
There's a new malicious link that can crash or hang Messages and Safari: "Yet another "text bomb" has surfaced, this time in the form of a website that can sometimes cause system crashes or hangups when received through Apple's Messages app on iOS and macOS."
Labels: android vs. ios
Mac Developer: Found: New Android malware with never-before-seen spying capabilities | Ars Technica
Found: New Android malware with never-before-seen spying capabilities | Ars Technica: "Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before."
aka Wowsers and browsers.
Labels: security is hard
Mac Developer: Geekbench and Reddit think they’ve cracked why iPhones get slower over time | Ars Technica
Geekbench and Reddit think they’ve cracked why iPhones get slower over time | Ars Technica: "Based on anecdotal observation, many iPhone users have long believed that older iPhones get slower over time. Generally, people have assumed that this is because of new features and additions in new versions of iOS that are better optimized for the latest phones."
Conspiracy theories laid to rest: it's the hardware, stupid!
Labels: 1984, ios
Mac Developer: Guilty: NSA bloke who took home exploits at the heart of Kaspersky antivirus slurp row • The Register
Guilty: NSA bloke who took home exploits at the heart of Kaspersky antivirus slurp row • The Register: "Kaspersky Lab has denied any wrongdoing in the matter or illicit ties to Russian intelligence. The security vendor also pointed out Pho's machine was infected with loads of malware, meaning any miscreant could have stolen Uncle Sam's cyber-weapons."
At the very least Kaspersky needs a new publicist.
Labels: security flaw, security is hard
Mac Developer: The underground story of Cobra, the 1980s’ illicit handmade computer | Ars Technica
The underground story of Cobra, the 1980s’ illicit handmade computer | Ars Technica: "Back then, Romania’s hardware industry mainly cloned the British Sinclair ZX Spectrum, a machine released in the UK in 1982. This device was copied all across Central and Eastern Europe. The ZX Spectrum was an 8-bit personal computer built around a Zilog Z80 A CPU running a BASIC interpreter, an easy-to-use programming language widespread on microcomputers at that time. It used a TV set as a display and audio cassettes for storage."
I have seen the future and it is the past.
Mac Developer: Google engineer proves any iPhone app with permission to access the camera is capable of spying
Google engineer proves any iPhone app with permission to access the camera is capable of spying: "Once granted, Krause advises it is possible for an app to photograph and record from the cameras any time the app is in the foreground, without informing the user the images and video are being captured with flashes or other indictors. "
Troubling but not nearly as troubling as the gaping security holes on Android.
Labels: android vs. ios
Mac Developer: Apple confirms KRACK Wi-Fi WPA-2 attack vector patched in iOS, tvOS, watchOS, macOS betas
Apple confirms KRACK Wi-Fi WPA-2 attack vector patched in iOS, tvOS, watchOS, macOS betas: "AppleInsider has learned that Apple has rectified the "KRACK Attack" Wi-Fi WPA-2 exploit in "recent" macOS, iOS, tvOS, and watchOS betas —but was unable to confirm that a patch is coming for the AirPort series of routers."
The other shoe dropping...
Labels: security exploit
Mac Developer: Wi-Fi security has been breached, say researchers - The Verge
Wi-Fi security has been breached, say researchers - The Verge: "At about 7AM ET this morning, researchers revealed details of a new exploit called KRACK that takes advantage of vulnerabilities in Wi-Fi security to let attackers eavesdrop on traffic between computers and wireless access points."
Kind of a major fail.
Labels: security exploit, security fail
Mac Developer: Cult of Mac Magazine: Why you shouldn’t trust every Apple ID prompt, and more | Cult of Mac
Cult of Mac Magazine: Why you shouldn’t trust every Apple ID prompt, and more | Cult of Mac: "It’s not uncommon to see a random popup that asks you to “Sign In to iTunes Store” on iOS. They sometimes appear unexpectedly, but they’re usually genuine. There is a chance that the app’s developer is phishing for your Apple ID password. We’ll show you an easy trick to distinguish legit popups from phishing attempts."
The beginning of the end...
Labels: security fail