Apple iPhone and Apple iPod Touch Multiple Vulnerabilities

Apple iPhone and Apple iPod Touch Multiple Vulnerabilities - SANS.org

Affects -

• iPhone OS 3.1.3
• iPhone OS 3.1.3 for iPod touch

Got a new phone - iPhone 3GS!

Backed up old phone -3G 16GB

Sync'ed the new phone - 3GS 32GB.

Erased old phone.

How to erase all data from an iPhone - Apparently, this is a two-hour process (OMG). Maybe it won't take so long, since I was only using 7GB of the space.

Giving the 3G to the wife. The phone guys just swapped out my old SIM card from the old phone to the new one. Took the old one home and gave it to the wife and she was playing with it and yelled, "why is it working when there's no SIM?" We'd forgotten that this phone can still be used without a SIM, and she was going on the web and everything. Basically, it was in iTouch mode...hahaha. So, apparently, she can pop in the SIM from her phone (non-iPhone) and it should work. She'd still have to call or visit an AT&T authorized dealer so that they could turn on the iPhone data plan, though (from what I'm told). We'll add a family plan to my phone and she can piggy-back off of me.

Seriously, I considered the Droid but did not consider much else. Based on some reviews I read and some feedback from friends that have the Droid, I decided to not get that phone. Really, once you go iPhone, you're not turning back. Almost everyone I know that tried to switch away came right back.

The 3GS is much faster than the 3G (the 3G still lags a bit after finger inputs). I can play my Skee Ball much better with this new hardware (no lag due to other background tasks going on). It also feels just a tad lighter in weight. My old cases fit the new phone. All my apps are still compatible with the 3GS. The camera on the GS is worlds better, also...and the video function is a dream. Additionally, the speaker is WAY louder.

About all I have to do now is upgrade the firmware to v3.1.3 (it currently has v3.1.2).

And, to be different, I went black this time instead of white.

So, why upgrade to 3GS when this summer will probably be 4g? Because I'm not one to be a beta tester. I'll let other people sort out the new hardware...I just want a stable phone. Plus, if I REALLY want one, I'll get it anyways (and sell my 3GS to help pay for the 4g phone).

Mac Mini Server

Apple is offering a Mac Mini Server for $999. Tech specs are here and it doesn't appear configurable. You can add unlimited users to the server, though and it actually comes with the server OS software and what appears to be 1TB of drive space (tech specs state "dual 500GB disks"...dunno if this means some type of RAID). It also comes loaded with RAM (4GB) and utilizes a 2.53 GHz Core 2 Duo processor.

This appears to be hot stuff. If you attempt to build this yourself, it would more than likely cost quite a bit more than $999.

I'm in the market for another Mac, a desktop. I may be able to do a Mini like this, though, although I'd still want to game (via a virtual instance of Windows) and the video card in the Mini Server won't cut it...wait, I take that back, as it utilizes the Nvidia GeForce 9400M, which is actually used in the Macbook Pro as a default card (although it is upgradeable in the higher end models).

iPhone 3GS 32GB or Droid?

So, I'm really close to being able to upgrade my 3G 16GB soon (this coming Monday). I'm on the fence on if I should wait or upgrade to the 3GS 32GB. I just know as soon as I do, within months, Apple will release a new phone (happened last time, even though I knew it was coming but didn't know when).

I'm also curious about the Droid. The tech stats don't really mean all that much to me. I hear the keys on the pad are very small. The camera looks to be a lot better than any iPhone. Both can capture video. The Droid's memory and storage specs leave a bit to be desired, although it will take an external card (up to 16GB of microSD). Apparently, the Droid will chew up and spit out a freshly charged battery, although I've heard multiple people stating that the phone would need to be tuned (similar to when I tuned my phone to lessen battery consumption). Verizon's data plan has dropped to $69.99, according to some of the TV commercials I've recently been seeing. That would put a Droid close to what I'm paying now for my iPhone service. Both can tether and both can use headsets to voice-dial.

I could try out the Droid and return it within two weeks of purchase if I don't like it...wondering if I'd be wasting my time, though. My experience with Apple is GREAT and I'd definitely want to purchase through Best Buy and purchase their accident plan like I did with the last pone (and ended up dropping it not long after purchase, which Best Buy replaced for a small fee).

Basically, I'm afraid of giving up the Apple experience. I'll make a decision on what to do soon...but really, there's no rush to become indentured by another phone company...again.

A new year...what's in store for me, Apple-wise? ;-)

I'd like to get one of the following this year:

iPad 32- or 64-GB, wifi
iMac 27" 3.06-GHz
iPhone 3GS

Out of all of these, it will more than likely be the iMac. Really, an iPad would be cool and all, but its basically just a large iPod. And, I already have an iPhone (3G). I already have a Mac also (the Macbook)...I'd like a desktop system. What I'd REALLY like is a Mac Pro, but that's a bit beyond me. If I bought a Mac Pro, I'd definitely go all out, since at even the low range, you're already spending a lot.

Since it's almost bonus time, we'll see how this plays out. :-)

One full round of MW2 - Xfire Video

Yeah, this isn't related to Macs/Apple, but I thought it was cool.

One full round of MW2 - Xfire Video

Call of Duty: Modern Warfare 2 (for PC). The original .wmv video file has been heavily compressed to the .mp4 format, making it smaller but less clear (video- and quality-wise). There is also no sound (blame that on Xfire). The FPS person is me.

Latest jailbroken iPhone worm tries filching bank passwords

Latest jailbroken iPhone worm tries filching bank passwords

This is a nice read. This worm is named iBotnet.A. It explains the latest worm, which is quite a bit more malicious than the Rickroll worm that made the news two weeks ago.

Note that both of these worms aren't really exploiting holes in the underlying code. They take advantage of the ignorance of the user. To elaborage, both take advantage of the fact that jailbreakers need to install SSH software onto the phone. Jailbreakers tend to forget that the default password is public and known to the world. The smart moves would be to, 1) change the password to something else; 2) remove the SSH server after jailbreaking the phone; 3) if you still need the SSH server, use SSH key authentication. These seem like no-brainers to me but these are not apparent to most jailbreaker, since they usually don't have security in mind when installing this unauthorized firmware.

This worm is a bit humorous, also:

After it finds a vulnerable phone, iBotnet.A changes the root password to "ohshit"

Now that's funny!

iPhone worm in the wild

iPhone worm in the wild:

Couple of days ago there were a lot of discussions about an attack on iPhone users in the Netherlands where the attacker installed a backdoor that asked the iPhone owner to pay 5 EUR to get rid of the Trojan.

The attack was aimed exclusively against jailbroken (hacked) iPhones – these phones allow the user to run unofficial code and bypass Apple's official App Store. In other words – it allows users to run (often) pirated programs.

EDIT: More coverage at the SANS diary ==> Apple Security Update 2009-006 for Mac OS X v10.6.2

Net Scan iPhone app -- Installed

Net Scan

This app rocks!

This application has some decent configurability. I was able to scan the whole range of my home network (which contains over 10 hosts), getting details similar to a default scan using NMap.

The app costs $0.99. I got the app based on the recommendation of a friend and I played with his install of it a bit. The fact that I pulled the trigger on this app when I never buy iPhone apps speaks for itself!

iPhone firmware v3.1.2 is available

See "Apple iPhone Software now v3.1.2" article at PCWorld

I've no idea when v3.1.2 was released but I've never needed an update so badly.

My phone has been going comatose since I installed v3.1. During this time, I've also had cellular network issues. I'd have to restart the phone every couple of days. I'd miss calls because I couldn't tell when the phone was comatose until maybe 6 hrs with no e-mails and/or texts.

So, today, I decided to check for an update and v3.1.2 was queued up. I've installed it, along with an iWorks and iTunes update.

We'll see how things go.

AVI and Mac

So, I've been trying to view .avi files (movies) on my Mac. I've found that this can't be done unless I've the proper codec, so I did a bit of research and found the following:

http://www.thexlab.com/faqs/avidivx.html

I downloaded and installed DivX for Mac, which seems to work OK, but will ocassionally lag (voice vs. picture). If I continue to have issues, I'll try a different codec from the above link.

Software Updates - Sep 2009

While I was trying to back up my iPhone's data since I had to visit a local Genius Bar for a repair, I was prompted to install v3.1 of iPhone's flashcode. I believe this fixes that recent SMS vulnerability, but I could've sworn I already installed v3.1. I also had to update to the latest iTunes version, but I don't normally care too much about iTunes functionality, so I don't know what version is new and what functions and fixes apply.

Also, since I was at the Apple Store in Fair Oaks, VA, I bought the Family Pack of Snow Leopard. I installed it on my Macbook first and will do my wife's at a later time. I've not noticed any massive differences yet, but I only installed it last night (at 12AM). As a note, I don't believe this version will install on my PowerMac...it is for Intel CPUs only.


The visit to the Genius Bar wasn't all that stellar. The service was great, technical-wise, but my appointment was at 7:50PM. I wasn't seen until 8:30. My name wasn't called the whole time but I was showing as the next person to be seen. People kept coming in without appointments and just asking for adhoc help. I've no idea why someone wasn't telling those without appointments that they couldn't be helped because there was an established waiting list. The topper is that they called someone's name from the list (at 8:30PM) that was after me (and he wasn't even there...I guess he got tired of waiting)...I was like, WTF, I've been here the whole time and you're acting like I'm not even here. Then they immediately started to help someone that wasn't on the list and I had to yell that I'd been waiting 30 minutes without anyone calling my name.

Apple sent me a customer survey form and I informed them of these issues....wasted effort, maybe?

They did fix my phone, though. I had an issue with bubbles that I may have already reported on this blog already. Bubbles under the screen. I noticed this maybe 2-3 months ago. When I initially noticed the bubbles, there weren't all that many (4-5). When I checked earlier this week, there were 11. The Genius asked me if I'd been leaving my phone in the car. I told her that I work in an office environment and that my phone was always with me. They replaced the glass within 5 minutes. I didn't know the iPhone was modular in nature. I was assuming I'd get a new phone (LOL!). I'm just glad I got the issue fixed and hope it is not a repeat issue, as I've only had the phone a year.

[EDIT: The store manager called me today. I sort of expected it since they sent me a survey and asked if they could contact me for a verbal follow-up. I explained what happened and he apologized. I told him that I know things get busy and I also have similar experiences at work, but that a half-hour wait for a 5 minute fix was borderline unacceptable. He was also surprised no one was calling out names of the appointment holders. Hopefully he'll have a chat with his team and get things better organized. This is the second time I've had issues with that particular store. Last time it was them holding my Macbook for an excessive amount of time. Maybe I'll go to the Reston store next time...[9/14/2009]]

Mac OS X v10.6 Snow Leopard

http://store.apple.com/us/product/MAC_OS_X_SNGL

Mac OS X v10.6 Snow Leopard is now available for purchase!

Got my Macbook back! Dude, I got a Dell!

I took my Macbook to the local Genius bar last Wed. They replaced the magsafe cord and kept it for a few days to replace the 'palm rest'. All covered under warranty! The only thing is, I lost my MacStyle in the process...perfect time to get another, though!

The Genius really dug my MacStyle and asked me a lot of questions. He said he saw them on the web but that mine was the first he'd seen in real life. He asked how hard it was to install and remove. He said that it really looked sharp and wanted to get a few for the Geniuses at the bar. I thought that was really cool.

Another thing: The Genius said that the repair would be two days. I gave it to them Wed evening. He said that they'd a lot of repairs to do, due to Spring break and college students, but that they'd give me a call around Friday-Saturday. I never got a call. I figured they were busy so I gave them a bit more time. I was off on Monday and wanted to see if they were done (I don't have a lot of time off to do this sort of stuff), so I called. The lady who answered asked if I'd gotten a call from them and I said 'no'. She said that if they hadn't called me, it more than likely wasn't done. I told her that they'd had it since Wed and that it was Monday...that was more than enough time to get it done. She went in the back of the store and checked...came back and said that it was ready to pick up. WTF. She makes a smart comment saying that they'd have called me if it was complete, then 2 minutes later says that it is done. I was a bit pissed. Why? They told me it would be done, gave me an estimated date, I went out of my way to not hassle them when that estimated date expired and got no call from them. I don't understand how or why she made it seem like I was badgering her store. This is exactly why I don't always like dealing with service-related issues...this is also why I typically buy my own parts and fix my own stuff...I hate depending on people with the heads up their anuses. A simple call would've been nice...I guess they were that busy. I understand that, but don't understand the attitude after waiting 2 more days than their estimated time. I should've been very vocal about this.

Oh yeah, I got a Dell Mini 9. I almost returned it so that I could order an Asus 10". I decided to stick with the Dell, though. Awesome machine. I can live with the non-standard keyboard. It has Ubuntu installed (Dell build), has a 32GB solid-state drive, and a 1.3MP webcam, otherwise its standard. I'd like to add another gig of RAM but the 1GB it currently has isn't giving me issues.

A lot of Dell Mini owners are installing OS X on their Minis. I'm not to that point yet. I did try to make my Ubuntu look like OS X but have to run Compiz in order to do it...that's a deal-breaker, as Compiz makes the unit lag a bit (moving scroll bar and such).

Basically, there's not much I don't like about this machine. I really like the fact that it doesn't make any noise (no fan). It gets warm but not as warm as my Macbook. About the only thing I don't like is the funkily-mapped keys (like the ' and | keys: I have to use key combinations to use those characters, which slows me down considerably when in CLI). Another issue I've seen is that I can't shell into some of my machines from the Dell. When I experience this issue, I immediately go to my Mac and try the same thing and it works fine. Note that this is not an SSH client or server issue. Looking at the SSH client debug logs, I don't see anything glaring. Looking at the remote machine's auth logs, I see authentications. Weird. It may be an issue with the wifi card. I do plan on replacing the stock mini-PC card with a card supported openly (it has a Broadcom card that works but I prefer something open).

I may look into doing a dual-boot of Ubuntu and OS X in the near future.

And I do plan on reconnecting my G4 Powermac again soon (so I can use it to serve and perform backups).

Macbook falling apart

Hrmm...

Noticed at least 3 issues in the past month:

1. Back vent is beginning to peel at the edges.

2. Power cord has a short in it, near the magsafe connection.

3. Right-front "palm rest" is peeling/splitting (a good sized chunk pretty much fell off).

I can fix all of these, but since the laptop has Applecare, I'll just see about sending it in to get repaired before Applecare expires this summer.

In the meantime, I've ordered a Dell Mini 9 that I'll attempt to use when it is in the shop (not a really good replacement but its better than nothing...last time I sent my Mac in to get repaired, I almost lost my mind).

EDIT -- man, it is difficult to decide which netbook is best. One thing I don't like about the Mini that I've been hearing about is the fact that they've removed a lot of the keys and made it to where you have to use key combination strokes to type certain characters.

I'd also cancelled my initial Mini order a few days ago and reordered (upgraded a few parts after I received a Presidents Day discount).

Yesterday and today I did more research and found that I want the following instead:

ASUS Eee PC 1000HE 10-Inch Netbook (1.66 GHz Intel Atom N280 Processor, 1 GB RAM, 160 GB Hard Drive, 10 GB E-Storage, Bluetooth, XP Home, 6 Cell Battery) Blue.

Amazon.com has it for $374 with free shipping. This deal is a bit better than my Mini order...and I get bluetooth, bigger hard disk (but not SSD), and a bigger screen. I attempted to cancel my current Dell order but the won't allow it. They state that it is currently in the production stage. Well, it's been in the production stage since I first ordered it (a week ago). It also isn't due to ship for another week. I was terse with the phone agent. I'll let the Dell ship then immediately return it. I'd already ordered the Asus and had to cancel the order. I'd order both (and return the Dell) if it weren't for the fact that my wife would be pissed. There's also a 2-week wait for the Asus (ARRRGGGHHH).

I'm actually afraid of having the Dell arrive here because I may end up changing my mind again and keeping the Dell. :(

Why mention this on my Macbook blog? Well, I'd had the idea of putting OS X on my Dell (I probably can't do that with the Asus). I do plan to code a lot on the Dell, but if it means me having to use key combinations to type a ', that's going to SUCK!!

Oh well. I may give the Dell a spin. I know I have a trial time period before I return.

Time Machine

I'm trying to educate myself on Time Machine. I've a new USB 2.0 external drive that I'd like to use as a backup repository for my Macbook. Time Machine doesn't want to play nicely, though.

A few things...

1. I've added more RAM to the Macbook. In fact, I've upgraded from 768MB of RAM to 2GB. I couldn't resist the price. I bought the RAM from Best Buy because they were having a sale. I got 2GB for $37.

2. I've learned a new key combination for Macs. I wanted to know if there were key commands to capture screenshots. The key command is 'commmand + shift + 4'. The only issue I had was that once I executed those key strokes, I didn't know if I had to paste the screenshot somewhere or access an already generated screenshot. I eventually decided to use the capture utility to do the same thing.

1 & 2:

Screenshot of #s 1 and 2:























3. My battery charger and adapter broke. It appears that the cord near the square brick got too hot or something...there is now a hole in the outside plastic coating. The power adapter was also very hot to the touch. I'm currently using the wife's adapter to charge my notebook until I can either purchase one or (more than likely) schedule a Genius Bar appointment.

4. There's a piece of plastic flaking off of my Macbook behind the screen toward the bottom, where the big enlongated vent is. This wasn't there a week ago. It hasn't broken off yet and I still have Applecare on this 1g notebook. I may let it pass but I'm beginning to see several casing flaws that are beginning to add up. I'll post pictures later.

OS X DNS Changers, part three

Excerpt

Well it looks like my first day on duty I have the pleasure of sharing the latest and greatest in OS X DNS hijacking script. For those long time readers of ISC this topic may sound somewhat familiar, that is because this subject has been covered twice before in some detail. Since this entry is on the long side of things, I will very quickly cover the important part for readers who DO NOT have the time to read all of this.

http://isc.sans.org/diary.html?storyid=5390

OSX on a Dell Mini??!!

http://vimeo.com/2206943

New Line of Macbooks and Macbook Pros!

http://www.apple.com/macbook/

http://www.apple.com/macbookpro/

* Note:  I linked to Apple's product pages...these will change as the products are improved, but I didn't want to directly archive the pages.  If you're looking at this years after the fact, please use Google to search and keep the date of the post in mind.

The huge change is the Macbook. It is now all aluminum and appears thinner. The touchpad now also functions as a large button and can handle large gestures. The battery power level indicator is also now on the side or edge of the Macbook (vs. the bottom). There also appears to have been a HUGE graphics card upgrade, enabling intensive 3D gameplay.

Time to trade up! :) Either that, or just get an iMac (which is where I'm leaning).