Panther/Tiger/Leopard Updates

http://isc.sans.org/diary.html?storyid=3656:

Apple released in the last days upgrades to it's Tiger (10.4) and Leopard (10.5) versions of OS X.

For those unfamiliar with Mac OS X: this isn't just security patches, it somewhat comparable to what Microsoft calls a service pack. As such it can include stability fixes, features, etc. and security fixes.

10.4.11 includes a long list of security fixes. Since it's a all or nothing deal, there's very little real use in discussing all of them individually. Just take the plunge: there are a few bad ones in there, so you'll need it anyway. Some readers wrote us that there might be some issues with it all, so be careful. That said, I'm running it for a bit already and have not seen a single bad thing so far.

* CVE-2007-3456
* CVE-2007-4678
* CVE-2007-2926
* CVE-2005-0953
* CVE-2005-1260
* CVE-2007-4679
* CVE-2007-4680
* CVE-2007-0464
* CVE-2007-4681
* CVE-2007-4682
* CVE-2007-3999
* CVE-2007-4743
* CVE-2007-3749
* CVE-2007-4683
* CVE-2007-4684
* CVE-2007-4685
* CVE-2006-6127
* CVE-2007-4686
* CVE-2007-4687
* CVE-2007-4688
* CVE-2007-4269
* CVE-2007-4689
* CVE-2007-4267
* CVE-2007-4268
* CVE-2007-4690
* CVE-2007-4691
* CVE-2007-0646
* CVE-2007-4692
* CVE-2007-4693
* CVE-2007-4694
* CVE-2007-4695
* CVE-2007-4696
* CVE-2007-4697
* CVE-2007-4698
* CVE-2007-3758
* CVE-2007-3760
* CVE-2007-4671
* CVE-2007-3756
* CVE-2007-4699
* CVE-2007-4700
* CVE-2007-4701

10.5.1 includes some security fixes too, all centered around the application firewall:

* CVE-2007-4702
* CVE-2007-4703
* CVE-2007-4704

Apple also released patches for the beta of safari, but hey, it's beta software!

Rex pointed out we were missing the security update to 10.3.9 (Panther) that fixes many of the security problems also fixed in 10.4.11.

DNS changer Trojan for Mac (!) in the wild

http://isc.sans.org/diary.html?storyid=3595

This is rather shocking (and not so shocking...both at the same time).

This is NOT a failing of OS X. This trojan installs via some social engineering...a human and not object failure.

[UPDATE:

I've added the following rule (highlighted at the above link) to two of my Snort sensors:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE CURRENT_EVENTS Mac Trojan HTTP Checkin (accept-language violation)"; flow:established,to_server; content:"GET "; depth:4; content:" HTTP/1.1|0d 0a|Accept-Language\: "; pcre:"/Accept-Language\: [a-zA-Z0-9]{20}/"; classtype:trojan-activity; sid:2007650; rev:1;)]

Mac Security - ISC Cyber Security Awareness

http://isc.sans.org/diary.html?date=2007-10-18

Cyber Security Awareness Tip #18: Mac Tips
Published: 2007-10-18,
Last Updated: 2007-10-18 18:13:37 UTC
by George Bakos (Version: 1)

Welcome to day 18 of Cyber Security Awareness Month. Today we're welcoming your tips on securely working with Apple Mac systems. Let's start off with a bit of sage guidance I already received: Don't assume that your machine is secure simply because it's a Mac. While OS[789X] doesn't enjoy the sheer volume of badguy attention as other operating systems, the number certainly isn't zero and you can expect it to grow.

It's amazing how many Mac users and admins are submitting tips. What is even more amazing is how many of those tips are repeated by the majority of you. Can you spell c-o-n-s-e-n-s-u-s?

The vast majority of them are Mac versions of general Best Practices, but with a few software-specific tweaks. Here is a list sent in from Kim at Pepperdyne:

1. Keep your firewall up - the Mac firewall is decent - use it consistently.
2. Keep patched - its better for Jobs' engineers to do a job on your computer, than for an intruder to do so. If you want to check for patch problems because your system has critical uptime, I find macintouch.com to be a prompt bellwether for patching issues. Oh, and see #3
3. Back up your system - an external HD and Carbon Copy Cloner is an effective solution for single computers. Back up to an encrypted HD image and/or physically secure your backup disk.
4. Do updates and installs with an administrator account; do your web and email with a different account.
5. Keychain is a huge advantage on the Mac, but definitely use a strong password. I advise one that is over 15 characters to defeat the behind-the-scenes LANMAN hashing that takes place on Macs that provide windows fileshares.
6. Turn on Filevault home directory encryption. As strong as your password x 128-bit AES. Make a strong master password and put it in an envelope and place it with your secret papers (tell your partner/lawyer/boss/spouse where it is, as appropriate). I've been using FileVault under Tiger for over a year. My home directory has survived crashes and forced reboots (yah, they happen on Macs) on both Intel & PPC architectures.

If you have a tip, shoot it in using our contact form and I'll post them here throughout the day.

Cheers!

g

PHPSysInfo installed on G4 PowerMac

I wanted to better understand the internals of the 'new' system and get a feel for how it deals with load, so I installed PHPSysInfo for Macs.

I had problems getting .php files to render (dunno why, as I run several sites that utilize PHP on my LAN. I guess the issue was that I keep forgetting that Macs are similar to BSD and that I'm still a bit intimidated by the file structure of Macs.), so I did a web search and found the following:

http://www.devarticles.com/c/a/Apache/Using-Apache-and-PHP-on-Mac-OS-X/

cd /etc/httpd

Next step is to use "root" privileges, start up the text editor named "Pico" and edit the "httpd.conf" file.

Use the following command in the Terminal.app:

sudo pico httpd.conf

Type the root password and you are ready to go.

Locate the 4 lines:

#LoadModule php4_module
#AddModule mod_php4.c
#AddType application/x-httpd-php .php
#AddType application/x-httpd-php-source .phps


Use your arrow keys to navigate the document and remove only the pound signs "#". The best way to navigate is to use the DOWN arrow key and stay to the left Side of the document. To remove the pound sign, hit the right arrow to the right Of the sign and then hit the DELETE key.

Warning: Only remove the pound signs!! Keep the lines of code where they are and do not relocate them!! You have been warned!

The changed lines should look like this:

LoadModule php4_module
AddModule mod_php4.c
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

Save the file by hitting the CTRL + X keys. Pico will ask you if you want to save the document, just hit the Y key to say “YES”. By uncommenting the lines you will load PHP as a module and help the Apache Web Server Serve any PHP file types. You can also create PHP files with another extension simply by adding another Type to the list in the "httpd.conf" file.

What if I wanted all of my PHP files to end with the. bozo extension? Simple, just add this line to the "httpd.conf" file situated next to the AddType section.

AddType application/x-httpd-php .bozo

After you save the file and restart the Apache Web Server, any PHP file saved with that .bozo extension would display your PHP coding just like a normal PHP file. Now close and save the file. We have to restart the Apache Web Server for everything to take effect. If Apache is running, turn it off by clicking the "Web Sharing On" button that says, "Stop" located in the "Sharing" Section of the System Preferences.

This helped totally, and I can now monitor my system in a pretty GUI.

I'd still like to give ntop a spin, though. I friend showed me his install of ntop and I was highly impressed. Looks like a new project for me!

What's Up With My Macbook?

I haven't done much with my Macbook since adding more RAM.

I'm using a good bit of dashboard widgets. For instance, I'm using the calendar, Ministats, AccuWeather, calculator, temperature monitor, and RAM/CPU monitoring tools.

I'm also using iStats...it is a pretty awesome tool!

I've not done much else, though... :(

I'd like to add a GB of RAM soon, but other than that, I'm fine with things the way they are at this point in time.

I'd also like to jump to Leopard when it is finally released (sometime in October).

'New' Mac G4 Power Mac acquired!

I've not posted in QUITE awhile. Not that I've been idle, but I've been more active in my Slackware blog, documenting mostly security-oriented material, but 2 weeks ago, I got a surprise.

A friend of mine has purchased a sailboat with the intention of living in it, which means that everything in his current home has to be trashed, sold, or given away. He had a Macintosh G4 Power Mac that he needed to get rid of, so I took it off his hands! The image to the upper left is a spitting image of the machine that I now have.

The machine itself isn't particularly powerful, but it appears to be cutting-edge for its day: dual 550MHz PowerPC processors (!!), 30GB hard disk (this is the original disk), 768MB of RAM, a CD-RW drive, and a ZIP drive. I did not know that this was a dual processor system until I checked while typing this post...this is quite a surprise.

Now, I got the Mac and it was running Mac OS X 10.3.9 Panther Server, but the drive immediately began to make noises and I got fed up and replaced it with a 100GB Seagate IDE drive, which was only $50. I could've went bigger, but these machines only recognize 120GB or so, due to BIOS limitations. There are workarounds to avoid this limitation, but I'm not going to spend a lot of money on a 7-year-old system if I can help it. I went out and bought the latest Mac OS X Tiger and installed it on the new drive without issues. The system runs very well. I think I'd much rather run Panther (Server) but my friend didn't provide me with the disks.

The stats of this system are below:

Machine Name: Power Mac G4
Machine Model: PowerMac3,4
CPU Type: PowerPC G4 (11.3)
Number Of CPUs: 2
CPU Speed: 533 MHz
L2 Cache (per CPU): 1 MB
Memory: 768 MB
Bus Speed: 133 MHz
Boot ROM Version: 4.1.8f5

This box is going to be a riot! Hopefully, I can even upgrade the CPU to something more substantial, but for now, I can probably get away with adding more RAM.  [EDIT 03/17/2010:  Not!  CPUs for this machine are EXPENSIVE!   I've also added more RAM and the system now has 1GB of PC133-333 (1x512MB and 2x256MB)...one slot is still empty.  It'll take 2GB of RAM when using OS X, but only 1.5GB if using OS 9.]

This system will most likely end up serving web pages and serving MySQL content.

The Dreaded Brown Stains...

I've got the dreaded staining on the sides of the touchpad and the touchpad and pad button. I've been using Mr. Clean's Magic Erase and it's doing a decent job but not removing 100% of it. I do wash my hands a lot but evidently this isn't a cleanliness thing. I've had the laptop since last July and while I don't use the laptop overly much (I've 8 other machines in the house, not including my wife's laptop), I use it just enough to where it should be getting a bit of wear on it in 7 months of use, so I'm not going to report it to Apple just yet, unless it gets a lot worse.

Learning the little things about Macs

Yeah, I just discovered when my Mac was built. I already knew where it was built (Tiawaan, I believe), but I've found that it was built during week 24 of this year, by looking at the serial number:

From System Profiler:

Hardware Overview:

Machine Name: MacBook
Machine Model: MacBook1,1
CPU Type: Intel Core Duo
Number Of Cores: 2
CPU Speed: 2 GHz
L2 Cache (shared): 2 MB
Memory: 768 MB
Bus Speed: 667 MHz
Boot ROM Version: MB11.005F.B00
Serial Number: 4H6246WFU9E
SMC Version: 1.4f10
Sudden Motion Sensor:
State: Enabled

See the Serial Number? The 4th and 5th numbers determine the build week.

Now, I have to track down any issues that all week 24 systems have had in recent months, but maybe I shouldn't be opening up Pandora's Box, eh?

More RAM please!!

I just added RAM maybe 1/2 hour ago. It was easy, IMO. It certainly wasn't as easy as adding RAM to my Toshiba or Dell, but after doing it (and considering the fact that its all over forums everywhere that this is a difficult task), it wasn't as hard as people tend to make out.

I didn't have to push as hard as others, I believe, but I didn't swap out both chips, just one. Since I left one in, I could judge how far I had to push it in by observing the one that was already installed. I pushed once, let go, then looked over and compared the two and saw that I hadn't pushed it in far enough, so I pushed one more time and kept pushing until it moved. I let go and compared them again, then put the L-bracket back in.

I spent more time putting the L-bracket back in than anything else. I started at the screw closest to the bend. I had a jewel flat-tip screwdriver, so I used it to push the cushioning material in while I was pushing the bracket. It helps to screw the two screws closest to the bend about halfway before messing with the cushioning material and dealing with the last screw. The last screw was the kicker...I kept screwing and having to back off because the screw was attempting to bind. I found that if I pushed the bracket upward a bit, it would align the bracket's hole with the case's hole and help keep the screw aligned when screwing it in.

I added 512MB from New Egg. Talk about pissed. I ordered 1GB...I actually clicked on a link for 1GB, saw that 1GB was added to my cart, made the purchase and the next day, I checked my e-mail and found that there was 512MB that was being shipped to me. I contacted a sales rep but they wouldn't halt the shipment because it was already in progress. I told them that I wasn't going to purchase from them again and I'd been buying from them since '97. 4 days later, I checked and saw that the shipment hadn't shipped yet! So, I sent them a nastygram e-mail and then checked again 8 hours later. I found that they voided the shipment and reprocessed it as a new shipment as express delivery. Since the order was only in 'step one' of their process, I was able to cancel it. I called and spoke to a rep and she was able to verify that it was cancelled. So, guess what showed up via UPS on my doorstep today (not an express shipment)?? The ORIGINAL order that was voided along with the second shipment. I decided to put it in the Mac anyways instead of shipping it back, but those guys have their heads up their butts. Never again will I order from them!

So now, I've the option of purchasing 1GB again, but I think I will do it locally...sure, it'll be more expensive but if you factor in shipping and hassle of online orders, they balance out, plus I'll have instant gratification if I purchase locally AND if the RAM is bad or the wrong size, I can always return locally instead of RMAing something.

I'll give NeoOffice a spin to see how it reacts to the RAM.

Also, I've got the recent fan firmware update on my Mac now. To be honest, I don't notice a huge difference, then again, I haven't had it on my lap yet. One thing that does bug me a bit is that I notice the fans being on. Some people complain too much about these laptops, especially the fact that they run hot, but EVERY dual core laptop runs hot. That's the price you pay for power. It's similar to cars and motorcycles. If you've a 300 HP car, you're certainly going to have less gas mileage than a 200HP car, even if you drive with the intention of saving fuel. The laptops are actually only hot because of the case, as there isn't much room for cooling management in these ultra-thin notebooks. A lot of people need to face the fact that they can't have their cake and eat it too...just because its a Mac doesn't mean that it can achieve the impossible.

I'm finished. Ta ta!

Lastest Installed Software

I've installed a few software packages in the last few days:

Chicken of the VNC
CyberDuck

Google for those ... they are easy to find. Both are pretty solid. I've yet to ferret out any underlying issues with those tools (or any user-error issues :o) ).

Currently, I'm working on aliases for certain commands, specifically SSH commands so I can log into my remote hosts with one typed word. I've gotten the aliases to work but I'm still working on getting them to be sticky (or permanent). It appears that most web pages out there are focused more on pre-Tiger. It should be long before I have it working though.

I also bought a book, "Mac OS X Tiger for Unix Geeks, which is a pretty good read and appears to be very practical, although it's not as granular as I need it to be, so i may go back out and get another OS X book to assist me in my learning.

One of the book's highlights is firewalling. I had no idea OS X was using ipfw behind the scenes. I shall take advantage of that soon! :o)

OK, it's late and I've to work tomorrow (first time in a week). Laters!

Recent Software Installed

I've recently installed Chicken of the VNC (COTVNC) and XChat Aqua. While I've installed COTVNC, I haven't used it yet, but I've been using XChat Aqua since last night and it is a very good representation of the GTK-version of XChat. In fact, it actually appears better. I shall hopefully be installing some of my oper scripts from my *nix boxes onto the Aqua version on the Mac Book...hopefully they work.

I've given up on trying to get my Lexar JumpDrive working with the Mac Book, as to get the security software to work on the Mac appears to be convoluted...I'm a bit depressed.

Also, hopefully next payday, I'll be getting at least a gig of RAM for the Mac Book. I can't really afford 2GB so 1GB will suffice. I've been getting the spinning ball, indicating I've maxxed out my RAM usage for what I currently do with the Mac Book (lots of web browsers open at once, and a few other windows).

Difficulty using Lexar JumpDrive

I've been trying to access my Lexar JumpDrive on my Mac Book. I've two partitions on the drive, a public one and a secure one. Lexar has software called JumpDrive Secure that will let users access their secure partitions on the drive in a Mac environment. I haven't gotten it to work on the secure partition, only the public.

What I may do is just access the secure partition on one of my Linux machines (or maybe even the Windows machine) and copy the secure partition to my Mac machine using SCP.

I can't find any other websites that show a fix, so I'm stuck for the moment. I'll use my work-around for now.

Installed three new software packages:

coconutBattery
coconutIdentityCard
coconutWiFi

I can tell you now that coconutIdentityCard is pretty much useless, as it doesn't really do much. It'll tell you if your Mac is possibly stolen and also your unit's build date (estimated). coconutBattery will also tell you how old your machine is, amongst other things. coconutWiFi is also useful, as it will tell you how many WAPs it sees and will make a sound everytime it detects a new WAP.

coconutBattery and coconutWiFi will stay installed, but coconutIdentityCard will be removed.

You can get these three apps at http://www.coconut-flavour.com

Apple to start addressing white Mac Book discoloration issues

Apple has reportedly attributed the discoloration on and around the palm rest of some MacBook models to a manufacturing defect. See the link below. You can also read many, many complaints at http://www.forums.macrumors.com and http://www.forums.macnn.com:

http://www.macnn.com/articles/06/06/30/macbook.discoloration/

I have to mention that I've owned my Mac Book for a bit over 2 weeks and I haven't seen any discoloration (yet ). I'm hoping this is an isolated issue with certain lots of Mac Books.

Ran Into My First Issue

I've a problem viewing encrypted web pages using Safari (v 2.0.4). I need to view one of my company's web portals and can't get in, as the webpage complains that I'm not using a 128-bit browser.

Yes, I know that Safari is 128-bit capable. Yes, I know I'm using an older version. I've installed Safari Enhancer (per an archived MacRumors.com post), hoping the issue would be resolved. Safari Enhancer supposedly lets you change the user-agent of an HTTP browser, yet I've changed the user-agent from Safari to IE 6 to Firefox to no avail.

I'll work on this further either tomorrow or Friday. It's very late here and I've 6 hours of driving ahead of me tomorrow.

Received My New Mac Book 13"

YES!

I've been dying to get a Mac for about a year. Everytime I saved, something came up to where I had to spend the money. Finally, though, I got one.

Let me tell you that it was very hard to pick which I wanted. Last year, I was going to get a 17" G4 Powerbook, then changed my mind and was interested in a friend's 12" G4 Powerbook. Then I became interested in the Mac Minis. THEN Apple went crazy with their new Intel-based products. At that time, I was still interested in the Intel Mac Minis, but soon after, I got a glimpse of the Mac Book Pros (15"). A friend gave me a presentation of his...VERY nice. He told me to hold off until the "iBooks" were released...I almost didn't. I'm glad I did. I read the Apple pages on it then the whole family visited the Tyson Corner Apple Store. I got a look at them all and fell in love with the Mac Book.

I really wanted the black Mac Book but couldn't justify the price difference between the 2.0GHz white and black, so what I did was build a machine to order, upsizing the drive from 60GB to 80GB. With the military discount (my wife is in the US Army), and the fact that an extra 20GB was only $40 USD, I was very happy. Even with the Apple Care Plan, this laptop was the cheapest I've ever spent on a new notebook.

I'm not going to spew out the specs of this machine, as it is advertised at http://www.apple.com and is all over the 'net. I shall take pics soon and post them.