The 3 Hottest Physical Security Products at CES 2015 | The Mac Security Blog: "You already know where to turn for the best Mac security products on the planet. But as any good security practitioner will tell you, it's important to take a layered approach to security."

Love the Noke padlock, would hate if it ran out of battery power!

Labels: security

OS X 10.10.2 will fix years-old Thunderbolt hardware vulnerability: "The so-called 'Thunderstrike' hardware exploit was publicized late last year, but the hack takes advantage of a flaw in the Thunderbolt Option ROM first disclosed in 2012. Until now, that flaw hasn't been patched, but according to iMore, the latest beta of Apple's OS X 10.10.2 update fixes the problem."

Un-striked.

Labels: security fix, security flaw, thunderstrike

Twitter’s war on developers continues: Tweetbot for Mac falls victim to token limit, gets pulled from App Store | 9to5Mac: "In November, 9to5Mac brought you an exclusive interview on Twitter’s limitations on third-party developers with the Iconfactory’s Gedeon Maheux. In the original article, Maheux said that development on Twitterrific 5 for Mac had stalled due to Twitter’s strict limits on how many users can login to a particular application."

All in good fun until somebody loses an eye.

Labels: devwars, twitter

Google's Project Zero reveals three new zero-day exploits in Apple's OS X [u]: "An internal software security research team at Google has publicly revealed three of recently-discovered zero-day exploits in Apple's Mac OS X desktop operating system, though the severity of each vulnerability is unknown."

Don't like the sound of sandbox escape via XPC.

Labels: security flaw, XPC service

Security bug Heartbleed may be forgotten, but it's not gone | VentureBeat | Security | by Ruth Reader
However, a new bill called the Cyber Supply Chain Management and Transparency Act of 2014, would require software makers to provide a bill of materials for all the code components used in the software.

Obviously, bureaucracy will provide a solution that software engineers themselves cannot provide. Right.

Labels: openssl

What Blackhat Gets Right: A Chat With Former Hacker Kevin Poulsen: "Back in Kevin Poulsen's hacker days, before he became writer and Wired editor, he pulled stunts like taking over the phone lines in a radio contest to win himself a Porsche, or breaking into the FBI's computer system when he ended up on the agency's Most Wanted list to change his physical description. He served a five-year sentence for his crimes. Now he's consulting for Hollywood hacker films."

It's an interesting plot, low on tech details that runs toward an ever-closing noose. Instead of ever heightening public stakes. I enjoyed it.

Labels: blackhat, hacker movie

This USB wall charger secretly logs keystrokes from Microsoft wireless keyboards nearby | VentureBeat | Security | by Emil Protalinski: "Privacy and security researcher Samy Kamkar has released a keylogger for Microsoft wireless keyboards cleverly hidden in what appears to be a rather large, but functioning USB wall charger. Called KeySweeper, the stealthy Arduino-based device can sniff, decrypt, log, and report back all keystrokes — saving them both locally and online."

It ain't getting better...

Labels: security, security flaw

Today's computers face more attacks than ever - CNET: "Kaspersky saw four times more mobile malware attacks in 2014 than the year before, said Patrick Nielsen, a researcher with the company."

Dang! Glad most of those are for the Windows.

Labels: security

Introducing Quarantino.app for Mac OS X (10.6.8 through 10.10.x) - a simple and effective way to view the signing credentials of an app downloaded from the internet, and if so desired, remove the quarantine attribute (xattr -l com.apple.quarantine).

The fact of the matter is, some OS features are not available to properly signed applications if they are in the quarantine. Don't believe me? See if you can spot the differences in operation between Quarantino.app (quarantined) and after you remove it from the quarantine.

Available for download now from this website (DeveloperID credentials) and coming soon to the App Store (fingers crossed - in review)!

Labels: com.apple.quarantine, quarantino, secure coding mac, security, utility

http://www.giac.org/paper/gsec/28443/mac-security/124082

Nice security overview of Mac OS X. Different features and advantages are covered.

Labels: mac runtime sandbox detection, sandbox policy language, secure coding mac, security, xprotect.plist

Security researcher rewrites Mac firmware over Thunderbolt, says most Intel Thunderbolt Macs vulnerable | 9to5Mac: "Once installed, the firmware cannot be removed since it replaces Apple’s public RSA key, which means that further firmware updates will be denied unless signed by the attacker’s private key"

Most hardware manufacturing is done overseas.

Labels: security flaw

Technical notes, my online memory: Gatekeeper, XProtect and the Quarantine attribute: "Apps can opt-in to Gatekeeper and Xprotect protection by adding LSFileQuarantineEnabled to their Contents/Info.plist. This means that any files created by that app will get tagged with the apple quarantine HFS+ extended attribute.

Everything you wanted to know about quarantine but were afraid to ask.

Labels: gatekeeper, quarantine, secure coding mac, security