Language Selection

English French German Italian Portuguese Spanish

Mac

Proprietary Security Issues

Filed under
Microsoft
Mac
Security

Proprietary Software Security

Filed under
Microsoft
Mac
Security
  • OMIGOD: Azure users running Linux VMs need to update now [Ed: They need to abandon Microsoft Azure and get reprimanded by the employer for ever choosing this NSA company as a host in the first place]
  • Microsoft September 2021 Patch Tuesday: Remote code execution flaws in MSHTML, OMI fixed
  • Microsoft Patch Tuesday, September 2021 Edition

    Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that’s reportedly been abused to install spyware on iOS products, and Google‘s got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software.

  • Apple Patches Up Devices In Response To The Exposure Of Yet Another NSO Group Exploit

    Israeli digital arms merchant NSO Group continues to sell its malware to a wide variety of governments. The governments it sells to, which includes a bunch of notorious human rights abusers, continue to use these exploits to target dissidents, activists, journalists, religious leaders, and political opponents. And the manufacturers of the devices exploited by governments to harm people these governments don't like (NSO says "criminals and terrorists," long-term customers say "eh, whoever") continue to patch things up so these exploits no longer work.

  • It's not just you: Emergency software patches are on the rise

    Researchers raised the alarm Monday about a big one: The Israeli spyware company NSO Group, which sells programs for governments to remotely take over people’s smartphones and computers, had figured out a new way into practically any Apple device by sending a fake GIF through iMessage. The only way to guard against it is to install Apple’s emergency software update.

  • Apple Rushes Out Emergency Update to Stop ‘No Click’ Spyware

    The flaw, disclosed Monday by Citizen Lab, allowed a hacker using NSO’s Pegasus malware to gain access to a device owned by an unnamed Saudi activist, according to security researchers. Apple said the flaw could be exploited if a user on a vulnerable device received a “maliciously crafted” PDF file.

Gnome 3 compare to MacOs

Filed under
Mac
GNOME

An assertion I have made in the past is that to me “Gnome 3 feels like MacOs with rough edges”. After some discussions with others, I’m finally going to write this up with examples.

It’s worth pointing out that in my opinion, Gnome 3 is probably still the best desktop experience on Linux today for a variety of reasons - it’s just that for me, these rough edges really take away from that being a good experience for me.

Read more

Get macOS ‘Quick Look’ on Ubuntu with GNOME Sushi

Filed under
Mac
GNOME
Ubuntu

Sometimes file thumbnails in Nautilus aren’t enough. Sometimes you need a closer look at a file, photo, or folder to make sure it’s the one you actually want, but without the hassle of opening a full-blown app to find out.

And that’s where GNOME Sushi comes in.

GNOME Sushi is an alternative to macOS ‘Quick Look‘ for Linux desktops that use Nautilus, aka GNOME’s famous file manager.

You select a file in Nautilus, tap the spacebar, and an instantaneous (and usually interactive) preview of the file appears — no need to open a full app.

Sushi supports file previews for most plain-text documents, including scripts with syntax highlighting, as well PDFs, HTML files, and LibreOffice documents. Music and video file previews use the GStreamer framework to let you to seek/scrub through them.

Read more

Microsoft Windows and Apple as Liabilities

Filed under
Microsoft
Mac
  • Energy secretary backs ban on ransomware payments: 'You are encouraging the bad actors'

    Energy Secretary Jennifer Granholm said Sunday that she supports a law that would ban companies from paying ransom to [crackers] holding their information hostage after a recent spate of cyberattacks on companies responsible for crucial parts of the U.S. infrastructure.

    In an interview on NBC's "Meet the Press," Granholm acknowledged that she is not sure whether Congress or President Joe Biden are ready to take that step, but she warned that paying ransom only emboldens [crackers]. And she said private companies need to take responsibility and tell the government when they are attacked for the good of the country.

  • US recovers millions in cryptocurrency paid to Colonial Pipeline [crackers] [iophk: Windows TCO]

    Colonial Pipeline, a network that provides around 45 percent of the East Coast’s fuel, was the target of a crippling cyberattack last month that forced it to shut down operations for several days.

    Joseph Blount, the company’s CEO, later revealed in an interview with The Wall Street Journal that he authorized the company to pay the cyber criminals behind the attack the equivalent of $4.4 million in bitcoin on the day of the breach in exchange for the keys to decrypt the network.

    The FBI recommends against paying the ransom, as it may encourage the [attackers] to go after another group, and the payment may be used for criminal operations. The Biden administration has reiterated this stance in recent weeks.

  • US Snatches Back Ransom from Colonial Pipeline [Crackers] [iophk: Windows TCO]

    U.S. law enforcement officials say they have hit back at the Russian-based criminal network that caused gas pipelines to shut down across parts of the country last month, seizing much of the multimillion-dollar ransom payment before it could be used.

    The Justice Department announced Monday it recovered $2.3 million of the approximately $5 million Colonial Pipeline paid to the DarkSide Network following the ransomware attack, which resulted in fuel shortages along the U.S. East Coast.

  • Feds recover millions from pipeline ransom [crackers], hint at U.S. [Internet] tactic [iophk: Windows TCO]

    The FBI was able to seize control of DarkSide's proceeds by gaining access to a central account holding about 63.7 bitcoins, worth around $2.3 million, Deputy Director Paul Abbate said. A court document said that the seizure took place in Northern California, putting it within reach of U.S. law, and that the FBI was able to access the "private key," or password, for one of the gang's bitcoin wallets. It was unclear how the key was compromised.

  • Adversaries Could Shut Down US Power Grid, Energy Secretary Says [iophk: Windows TCO]

    When Granholm was asked by CNN’s Jake Tapper about vulnerabilities in the electricity grid and whether a foreign actor has the ability to shut it down, Granholm said, “Yeah, they do. There are thousands of attacks on all aspects of the energy sector and the private sector generally.”

  • Senate sergeant at arms says cyberattack more worrisome than repeat of Jan. 6 insurrection [iophk: Windows TCO]

    Senate Sergeant at Arms Karen Gibson said Saturday she is more concerned about a cyberattack on the government than another insurrection like the one that rocked Capitol Hill on Jan. 6.

  • First Known Malware Surfaces Targeting Windows Containers

    Organizations running Windows containers in their Kubernetes cluster have a brand-new threat to worry about.

    Researchers from Palo Alto Networks (PAN) have discovered what they say is the first known malware targeting Windows containers. The malware, named Siloscape, is designed to escape from a Windows container into the Kubernetes node so it can spread in the cluster.

    Attackers can use the malware to carry out a variety of malicious actions, such as credential and data theft, deploying ransomware, and breaching enterprise software development and testing environments.

    Daniel Prizmant, senior staff researcher at PAN's Unit 42 threat intelligence team, says the malware is a manifestation of the growing attacker focus on cloud environments. "Attackers are undergoing their own digital transformation and exploiting the massive enterprise shift to the cloud and new technologies like containers," he says. "As a result, container security has become important."

  • Apple pays millions to woman after explicit photos posted online

    Apple paid millions of dollars to a student after iPhone repair technicians posted explicit photos and videos from her phone to Facebook, legal documents have revealed.

    The tech giant agreed a settlement with the 21-year-old after two employees at a repair facility uploaded the images from a phone she had sent to Apple to be fixed, resulting in “severe emotional distress”.

    The incident, which occurred in 2016 at a centre in California run by Pegatron, an Apple contractor, is one of the most significant privacy violations to be revealed at an iPhone repair facility.

  • Student's nude photos leaked to Facebook by iPhone service centre, Apple now paying her millions of dollars

    The confidentiality agreement was meant to avoid “substantial business harm”, as Apple insisted on confidentiality throughout the settlement. For this reason, Apple was simply referred to as a “customer” throughout the proceedings.

    The tech major was only recently named as the customer during a separate, unrelated lawsuit it faced. Apple confirmed the incident to The Telegraph.

    The confidentiality agreement left many details of the incident hidden. What is known is that the two employees have been fired after an “exhaustive” investigation by Apple. Apple has also been reimbursed for the settlement by Pegatron. Pegatron and its insurers, who refused to pay the bill, have now settled the matter privately.

    The incident shows a glaring loophole in the tall claims repeatedly made by Apple over the strict control of its repair facilities. The company has often cited this as an argument against legislation that would make it easier for third parties to fix its devices. It seems like Apple’s case does not seem too strong if such incidents can occur within the company’s well-monitored facilities.

  • Apple settles with student after authorized repair workers leaked her naked pics to her Facebook page

Proprietary Software, Security, and Monopoly

Filed under
Microsoft
Mac
Security
  • Cyber-Attack on Air India Led to Data Leak of 4.5 Million Fliers

    [Attackers] infiltrated the servers of Air India Ltd. and gained access to personal data of 4.5 million fliers, the nation’s flag carrier said.

    Personal data of passengers registered between August 2011 and February 2021 were compromised in the attack, the carrier said in a note to fliers that was shared via Twitter. The details included credit card and contact information and frequent flier data.

  • Ransomware Moves from ‘Economic Nuisance’ to National Security Threat [iophk: Windows TCO]

    https://www.voanews.com/silicon-valley-technology/ransomware-moves-economic-nuisance-national-security-threat

    [...]

    While Blount, the Colonial Pipeline CEO, defended his decision to pay a ransom as “the right thing to do for the country,” law enforcement officials and cybersecurity experts say such hefty payments embolden cyber criminals to carrying out more attacks.

  • FBI warns Conti ransomware gang struck health and emergency networks [iophk: Windows TCO]

    The Federal Bureau of Investigation said that the same group of online extortionists blamed for striking the Irish health system last week have also hit at least 16 U.S. medical and first response networks in the past year.

    In an alert made public Thursday by the American Hospital Association, the FBI said the cybercriminals using the malicious software dubbed ‘Conti’ have targeted law enforcement, emergency medical services, dispatch centers, and municipalities.

    The alert did not name the victims or go into detail about the nature or severity of the breaches, saying only that they were among more than 400 organizations worldwide targeted by “Conti actors.”

  • Application Compatibility Hell: Microsoft set to remove Internet Explorer from Windows 10. (But 99% of it will linger.)

    Even NPR commented on Microsoft getting ready to remove Internet Explorer from Windows 10, but I thought I’d chime in and mention that you can do that today if you want to.

    Microsoft Edge has a thing called Internet Explorer Mode that can reload a site using the Trident engine from Internet Explorer.

    Due to the architecture of Internet Explorer, Trident is an embeddable component and Internet Explorer is just a small shell around that component. Internet Explorer Mode does not require the “Internet Explorer 11” feature to be turned on, so you can “remove” Internet Explorer and this Mode will still work in Microsoft Edge, should you turn it on.

    I’ve been trying out opening sites in IE Mode in Edge, and it’s pretty clear that Trident has aged quite badly and the only reason why you’d ever do this is if you ended up with some crap web application that nobody is going to fix anytime soon. Like the beneficiary enrollment page on One Walmart.

  • QBittorrent Developer: “Apple app notarization is extortion pretending to be security. Issue closed.” Bonus: Ancient operating systems. (Windows)

    A developer of the popular Bittorrent protocol client “QBittorrent” closed the “Won’t run on macOS Catalina” bug (due to Apple’s fake security scam of software signing+notarization) by closing the issue.

    After a discussion, it wasn’t even about the $100 a year it would cost to get to get an Apple developer account so they could give a program away for free, or wondering if they could even get Apple to sign off on a Bittorrent app if they did, but that the infrastructure that you have to put in place to build, sign, and notarize Mac apps is daunting and not worth the pitiful amount of Mac users that it would bring in.

    So, the way to make it run is still turn off Gatekeeper, at least for however long Apple allows it.

    It’s not really your computer anyway. It ain’t done til GNU/Linux won’t run…. Oh wait, this too has happened.

  • Federal Judge unimpressed with Tim Cook’s testimony.

    Per NPR, the first day of testimony in Epic’s lawsuit against Apple did not go well for CEO Tim Cook.

    It seems that the judge was the most skeptical of Cook’s arguments that the program that reduces “commissions” to Apple for small developers were sufficient, or that consumers had sufficient choice in the In-App Payments market because Android phones exist.

    Of course, that argument is ridiculous. Google’s commissions are exactly the same. The issue here is that the commissions themselves are too high and raise prices for the user. When Epic put it’s own in-app payment system into Fortnite, it passed some of the savings to the user. It cost 20% less than paying through Apple or Google.

    Jamie Zawinski had previously complained that Apple deliberately did things to discourage developers from giving away apps for iOS that are really free. For example, Google charges $25 once to get a Google developer account, and Apple charges $100 a year. Apple pressures people to make money so that they can take 30% of it.

    NPR goes on to mention the fact that iPhone sales have been stagnant for years. This is true, and there has not been a “next product” because Apple isn’t an innovative company. If they lose the in-app purchase revenue, money they are effectively stealing from their user (since the developer isn’t just absorbing it), they hit the skids.

  • “Tim Apple” testifies in court on the App Store monopoly.

    Today, Tim Cook (“Tim Apple” as Trump called him), testifies on Apple’s App Store monopoly.

    Of course, people should know that they’re going to try to excuse their behavior on creating a “good experience” for users and to “keep things safe” from malware, and from a child that may not use the computer correctly.

    The problem with this model is that Apple has been using their monopoly to profit from doing essentially nothing except imposing ridiculous rules on app developers, censoring apps, and taking nearly a third of gross sales for providing a distribution service.

    Apple’s model makes the user lose on numerous fronts, and it makes software more expensive and costs jobs in the economy.

    They also can’t guarantee it’s secure. At issue is Fortnite adding its own payment method to bypass Apple’s store siphoning off their revenues.

    How did it get past app review? The code was set to do nothing for a while, so that it would get through the review and then activate later.

    If a payment mechanism can do that, so can malware, and once malware runs on a device it’s too late. It can gain more permissions by exploiting bugs in the firmware, and become a rootkit. At that point, it would be difficult for Apple to even get rid of it.

  • Tim Cook’s Fortnite trial testimony was unexpectedly revealing

    Epic mustered its own arguments: people can still choose to keep their phones locked down, and they might want to access stores with even more carefully curated apps or even better privacy controls. It’s previously accused Apple of hypocrisy, pointing out anecdotal failures to catch specific apps (like a game called Ganja Farmer: Weed Empire) that violate App Store guidelines. “It’s not 100 percent. It’s not perfect. You will find mistakes being made,” Cook said when Apple’s counsel asked about those incidents. “But if you back up and look at it in the scheme of things, with 1.8 million or so apps on the store, we do a really good job.”

  • Apple's Tim Cook grilled by judge overseeing Epic's Fortnite trial

    Apple says its control over the App Store promises security and reliability for users. Epic says it stifles competition.

  • Apple App Store profits look 'disproportionate,' U.S. judge tells CEO Cook
  • FOSS Patents: Friday for Fortnite

    No, I don't want to gloat, but it's mind-boggling what happened yesterday in that Oakland courtroom at the end of the main part (they're done apart from closing arguments on Monday) of the Epic Games v. Apple App Store antitrust trial. It's fair to say that at this point the question is most likely about remedies. Epic is on the winning track with respect to liability as Judge Yvonne Gonzalez Rogers of the United States District Court for the Northern District of California laid bare the bankruptcy of Apple's defenses. Being an App Store complainant myself (though I tried what I could to work things out), that's what I had hoped, but the hurdle was and remains high.

    After my final pretrial post and Twitter thread, I didn't comment on the trial itself or on the issues in it. I just noted some suspicious Twitter activity.

    I dialed in only for opening statements (followed by Epic Games CEO Tim Sweeney's testimony, which was almost inaudible) and for Apple CEO Tim Cook's testimony yesterday. In between, I just read other people's tweets (mostly not even in real time), particularly the ones by Protocol's Nick Statt (here's his report on how the judge "saved her best for last") and The Verge's Adi Robertson (here's his article, which contains a partial transcript of how Judge YGR grilled Tim Cook), but also others.

    After the first couple of days, I was profoundly worried. The judge had tough questions for Epic, and some of the answers might have been tactically suboptimal. The inflection point in the early phase of the trial was the testimony of Lori Wright, a Microsoft Xbox exec. As far as I could see on Twitter, it was just perfect and definitely eye-opening.

Restore an old MacBook with Linux

Filed under
GNU
Linux
Hardware
Mac

Last year, I wrote about how you can give new life to an old MacBook with Linux, specifically Elementary OS in that instance. Recently, I returned to that circa 2015 MacBook Air and discovered I had lost my login password. I downloaded the latest Elementary OS 5.1.7 Hera release and could not get the live boot to recognize my Broadcom 4360 wireless chipset.

Lately, I have been using Linux Mint to refurbish older laptops, and I thought I would give it a try on this MacBook Air. I downloaded the Linux Mint 20.1 ISO and created a USB boot drive using the Popsicle software on my Linux desktop computer.

Read more

Complexities in bringing Linux to Apple’s M1 Macs

Filed under
Linux
Mac

  • Open-source team details the complexities in bringing Linux to Apple’s M1 Macs

    The crowdfunding Asahi Linux project has published the first progress report detailing its effort to port Linux to the Apple Silicon platform with the M1 Macs. Apple’s new processor architecture is creating some difficulties…

  • Porting operating systems to Apple Silicon leagues harder than migrating software

    In its introduction of Apple Silicon to developers, Apple has provided assistance to developers to port their Intel-compatible apps over to M1. For developers performing more ambitious feats, such as porting Linux over to Apple Silicon, the task is multiple times harder.

    In a blog post about the Asahi Linux project, the team discusses its findings in trying to set up an alternative boot kernel on Apple Silicon systems. While most of the feature has been implemented, the lack of support for a command that allows the installation of a non-Apple kernel led to an attempt to document the undocumented system.

    The main hurdle faced was that Apple Silicon boots differently from PCs, and works "more akin to embedded platforms" like Android or iOS devices. There are differences and a "few bespoke mechanisms" in use, though Apple apparently made the boot process "feel closer" to an Intel Mac.

  • Open-Source Team Describes the Difficulties to Port Linux on M1 Macs

    Apple introduced the M1-powered Macs last year and the machines received a pretty good rating overall. To be exact, the M1 series flaunted enhanced performance and battery life. While the industry is yet to follow Apple's footsteps. Apart from software support, developers around the world are working to take advantage of the Apple Silicon. The crowdfunding Asahi Linux project published a new progress report that shares details on the complexities of port Linux on M1 Macs.

The problems with Apple aren't just outages, they are injustices

Filed under
GNU
Mac

This November, both everyday users and privacy advocates found new reasons to be concerned about Apple. After an update to the latest version of their operating system, users found that they were unable to launch applications that were not written by Apple itself. This problem was caused by an Apple server outage. But why did the unavailabilty of a remote server prevent a user from launching a program on their own computer?

It turns out that each time a program is opened on macOS, it phones home via the Online Certificate Status Protocol (OCSP) to see if that application is "okay" to launch: it asks the corporation permission each time a new application is encountered, sending potentially identifying information along with that request. While this function only made news because of the recent server outage caused by the release of the newest version of macOS, Big Sur, research indicates that the report-back has existed in the operating system since September 2018, with the release of macOS Mojave. This is a classic case of proprietary software serving as an instrument of unjust power.

Although Apple does not directly receive the name of the application, but rather information on who developed it, most developers have only a very limited number of apps on the App Store, making it easy for Apple to infer. More disturbing yet is the other identifying information that is sent along with the request, which includes the user's approximate location and the current date and time.

Because macOS is so restricted, it leaves everyone, including free software developers, powerless to help users prevent their application use from being reported back to Apple. Due to the way the system is engineered, free software firewalls like LuLu are unable to block the information from being sent to Apple domains. Furthermore, the information is sent unencrypted over the network, potentially allowing a snoop to see which applications a user was trying to launch on their own computer. The request also bypasses any VPN, letting Apple know their approximate location even if the user has taken steps to stay anonymous.

Read more

macOS to FreeBSD migration a.k.a why I left macOS

Filed under
Mac
BSD

I think the title tells a lot about the story I’m going to tell you.

This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.

Not so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.

Read more

Also: Fiddling with OpenBSD ports

Syndicate content

More in Tux Machines

Maui Report – 15

Maui 2 was released a month ago, and since then new features, bug fixes, and improvements have been made to the Maui set of apps and frameworks; the following blog post will cover some of the changes and highlights from the last or so months of development. What’s new? Among many bug fixes that will be listed below for each individual app, some of the highlights include better support for client-side decorations aka CSD. Clip, the video player, is now working again on Android; MauiKit Controls now provide improved contextual menu actions and a lighter tab bar styling. Index, the file manager, can now also preview PDF documents, adding up to support for previews of text, video, audio and fonts file types; and translucency support is now embedded into MauiKit itself. Read more

Overcoming the Challenges of Embracing Linux: a Different Perspective

After months of working at SUSE, my Jungle Green t-shirt was finally recognized at a store. “SUSE?” the gentleman asked, pointing at the large white letters. “Yes, I work there!” I responded, thrilled that I had the opportunity to engage in our mutual love of the chameleon, Geeko, “But I don’t work on the technology, I’m in Program Management.” “Well, let me ask you this – what is the operating system on your computer at home?” he asked, inquiring to my level of SUSE-ness. “Just the basic… Microsoft,” I responded. He continued, “I have a virtual machine with Slackware 1.0 I’m running, and I’ve been trying to get my hands on something old, openSUSE older than 5.3.” I breathed a sigh of relief when our conversation was cut short and he ran off to help another customer. Slackware? Virtual Machine? All terms I had just enough exposure to know what category they belonged in, yet not enough to carry a conversation. Despite the embarrassment, I knew I wasn’t alone. A 2020 study by the AnitaB.org Institute found that women make up 28.8% of the tech workforce. When considering open source technology, this number further shrinks down to the single digits. Nonetheless, the number of women becoming cloud native practitioners is growing. Recently, Lynne Chamberlain, CEO of SUSE Rancher Government Solutions, and Denise Schannon, Director of Engineering, joined special host Katie Gamanji for a special feature of OCTOpod in which they discussed their contributions to Linux, challenges they have faced and shared inspiring stories on how they’ve overcome those challenges to get to where they are today. Read more

Android Leftovers

Privacy-focused Linux Distributions to Secure Your Online Presence in 2021

Linux distros are usually more secure than their Windows and Mac counterparts. Linux Operating Systems being open-source leaves very less scope of unauthorized access to its core. However, with the advancement of technologies, incidents of attacks are not rare. Are you in a fix with the coming reports of Linux systems targeted malware attacks? Worried about your online presence? Then maybe it’s time to go for a secure, privacy-focused Linux distro. This article presents a guide to 3 privacy-oriented Linux distributions that respect your privacy online. Read more