Apple Closes Security Hole & Released 5.1.4 of Safari Web-browser

Apple Closes Security Hole & Released 5.1.4 of Safari Web-browser 

Apple closes major security hole and released 5.1.4 of its Safari web browser for Windows and Mac OS X. According to Apple, the maintenance and security update addresses more than 80 vulnerabilities. The update also includes includes various stability and performance improvements as well as fixes for other non-security related bugs. With this release the company also promises an 11 percent boost in JavaScript performance, among other things. A majority of the security holes closed in 5.1.4 were found in the WebKit browser engine used by Safari. These include several cross-site scripting (XSS), cross-origin and HTTP authentication problems, as well as numerous memory corruption bugs that could be exploited by an attacker, for example, to cause unexpected application termination or arbitrary code execution. 

Important Changes:-

• Improve JavaScript performance up to 11% over Safari 5.1.3* 
• Improve responsiveness when typing into the search field after changing network configurations, or with an intermittent network connection 
• Address an issue that could cause webpages to flash white when switching between Safari windows
• Address issues that prevented printing U.S. Postal Service shipping labels and embedded PDFs 
• Preserve links in PDFs saved from webpages 
• Fix an issue that could make Flash content appear incomplete after using gesture zooming
• Fix an issue that could cause the screen to dim while watching HTML5 video 
• Improve stability, compatibility, and startup time when using extensions 
• Allow cookies set during regular browsing to be available after using Private Browsing
• Fix an issue that could cause some data to be left behind after pressing the “Remove All Website Data” button

For additional information you can prefer to visit Apple official site. TO Download Safari 5.1.4 Click Here. We also like to give you reminder that last moth Apple released the Mac OS X 10.8 Mountain Lion Developer Preview

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Apple Closes Security Hole & Released 5.1.4 of Safari Web-browser"https://www.voiceofgreyhat.com/2012/03/apple-closes-security-hole-released-514.html</a>

Flashback.G Trojan Targeting Mac Users While Stealing Passwords

 Flashback.G Trojan Targeting Mac Users While Stealing Passwords

Remember earlier MAC Security Blog reported that the latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.

 Yet again Mac users became the victim of another trojan. This new Trojan virus is capable of infecting their computers and stealing passwords to services such as Google, PayPal, online banking & so on. This virus is using a new installation method When a user visits a crafted web page, the new variant either tries to exploit two old security vulnerabilities or deploys a Java Applet which tries to trick the user into believing it has been certified by Apple. According to Mac Security Blog (Intego):- This new variant of the Flashback Trojan horse uses three methods to infect Macs. The malware first tries to install itself using one of two Java vulnerabilities. If this is successful, users will be infected with no intervention. If these vulnerabilities are not available – if the Macs have Java up to date – then it attempts a third method of installation, trying to fool users through a social engineering trick. The applet displays a self-signed certificate, claiming to be issued by Apple. Most users won’t understand what this means, and click on Continue to allow the installation to continue.
It is worth noting that Flashback.G will not install if VirusBarrier X6 is present, or if a number of other security programs are installed on the Mac in question. It does this to avoid detection. It seems that the malware writers feel it is best to avoid Macs where the malware might be detected, and focus on the many that aren’t protected.

Earlier also Mac users faced such attacks where OSX/Revir-B trojan was installed behind a PDF, and giving hackers remote access to MAC computers, not only Revier-B also Linux Tsunami trojan Called "Kaiten" targeted Mac OS users in 2011. Also another malware named "Devil Robber" which was also make MAC users victim while stealing their personal informations.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flashback.G Trojan Targeting Mac Users While Stealing Passwords"https://www.voiceofgreyhat.com/2012/02/flashbackg-trojan-targeting-mac-users.html</a>

Mac OS X 10.8 Mountain Lion Developer Preview Released By Apple

Mac OS X 10.8 Mountain Lion Developer Preview Released By Apple

 

Apple released a developer preview of the next major release of its operating system named Mac OS X 10.8 Mountain Lion. If you are a registered Mac developer then you can test the new flavor of Apple. Not to mention in this release Apple has added lost of charming features among them Gatekeeper is really handy one at leat from security point of view. Apple says gatekeeper will "help prevent you from unknowingly downloading and installing malicious software". Some of other features included by apple are iCloud, AirPlay Mirroring, Messages, Reminders, Notification Center, Share Sheets, Twitter Integration, Game Center and so on.

Brief About Gatekeeper:-
The Gatekeeper feature has three levels of security for running applications downloaded from the Internet; "Mac App Store", "Mac App Store and identified developers" and "Anywhere". The first setting only runs applications downloaded from the Mac App Store, in a style similar to the iPhone only running apps from the App Store. Unlike the iPhone though, Gatekeeper lets users allow applications from other sources. The "Mac App Store and Identified Developers" option only allows applications from the store and from developers who have signed their program with an Apple-issued Developer ID, while "Anywhere" allows any program to be downloaded and run. It is unclear how Gatekeeper interacts with software loaded from other media, such as a USB memory stick or CD/DVD.

For More Information & To Download Mac OS X 10.8 Mountain Lion Developer Preview Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Mac OS X 10.8 Mountain Lion Developer Preview Released By Apple"https://www.voiceofgreyhat.com/2012/02/mac-os-x-108-mountain-lion-developer.html</a>

Apple Released Mac OS X Lion v10.7.3 & Closes Security Hole

Apple Released OS X Lion v10.7.3 & Closes Security Hole

As expected Apple has released security update 2012-001 for Mac OS X 10.7.3 and, for Mac OS X 10.6.8 Snow Leopard. In this release they have addressed a number of vulnerabilities in the company's desktop and server operating systems. According to Apple through this release they have patched more than 50 security holes such as remotely execute arbitrary code on a victim's system, gain access to private information or cause a denial-of-service (DoS).
The Client and Server updates fix issues in Address Book, ColorSync, CoreAudio, CoreMedia, CoreText, CoreUI, OpenGL, Internet Sharing, ImageIO, and in the QuickTime media player and various libraries used by Mac OS X. Other problems addressed include vulnerabilities in Apache, the libpng reference library, the PHP scripting language, Subversion and X11. Security Update 2012-001 also corrects problems in Tomcat and SquirrelMail.

Users can download Mac OS X Lion 10.7.3 (Client Standard Update 997.01 MB, Client Combo Update 1.2 GB, Server Standard Update 1 GB, Server Combo Update 1.34 GB) and Security Update 2012-001 (Client 192.73 MB, Server 212.09 MB) from Apple's Support Downloads page. Alternatively, Mac OS X users can upgrade to the latest releases using the built-in Software Update function. 

Additional information can be found on the support page.

For security issue all the users are advised to update their system as early as possible.

-Source (Apple, The-H)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Apple Released Mac OS X Lion v10.7.3 & Closes Security Hole"https://www.voiceofgreyhat.com/2012/02/apple-released-mac-os-x-lion-v1073.html</a>

Fingerprint Security Solution For Apple Mac OS X Lion & Snow Leopard By AuthenTec

Fingerprint Security Solution (Fingerprint Sensor & TrueSuite Identity Management) For Apple Mac OS X Lion & Snow Leopard By AuthenTec

We have earlier discussed the new security implementation of Microsoft and the new technology is called picture password. Now Apple also introducing digital security system in Mac OS. AuthenTec, a leading provider of mobile and network security launches Fingerprint Security Solution including an Eikon fingerprint sensor and TrueSuite identity management software - for Apple Mac laptops and desktop computers running on Lion and Snow Leopard operating systems.

The new Eikon-TrueSuite offering from AuthenTec includes the following features:-

• Web site logon (new) – logon to websites with a swipe of the finger; no need to type passwords

• QuickLaunch (new) –launch and logon to favorite websites; associate

• websites with different fingers

• Easy fingerprint enrollment/setup

• Mac logon

• Fast user switching

• Automatic updates (new) – ensure your software always incorporates the newest features

The new Eikon fingerprint reader for Mac and matching TrueSuite user software will be available in March for $59.95 from Apple.com, and AuthenTec’s Web store


According To Release Note:-
 

“Based on the strong demand from the Mac community, we are pleased to offer a
fingerprint security solution with features and functions that enhance the user experience and support the newest Apple OS,” said Tom Aebli, AuthenTec Vice President of Software and eCommerce. “AuthenTec is pleased to offer Mac users the same fingerprint security and convenience features already enjoyed by millions of Windows PC users.”

AuthenTec’s software and eCommerce business supports the millions of fingerprint sensors already integrated into laptops, tablets and mobile phones. The software and eCommerce portfolio includes AuthenTec’s TrueSuite identity management software, Eikon fingerprint readers for PC and Mac, KeepVault online backup services, and mobile and PC applications that enhance security and the user experience.

-Source (AuthenTec)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Fingerprint Security Solution For Apple Mac OS X Lion & Snow Leopard By AuthenTec"https://www.voiceofgreyhat.com/2012/01/fingerprint-security-solution-for-apple.html</a>

DNSCrypt: A Security Tool To Encrypt DNS Traffic

DNS service provider OpenDNS announced a preview release of a new open source tool named DNSCrypt to enhance internet security. DNSCrypt encrypts all DNS traffic between a user's system and a DNS server. The tool is currently only available for the Mac, with a Windows version promised, and only works with OpenDNS's own DNS service. Normally, DNS information is exchanged between client and server as plain text which makes it vulnerable to snooping or modification and man-in-the-middle attacks. By encrypting the exchange, OpenDNS hopes to make the "last mile" of DNS requests more secure.

In the Press Release David Ulevitch Founder/CEO of OpenDNS Said:-

"Today we unveil DNSCrypt, a new security tool we’ve developed that has been on our minds for a long time. It has a simple but important function: encrypt all DNS traffic between you and OpenDNS. Nothing else like it exists, and we have very high expectations for the positive impact it can have on the Internet security and privacy of millions of people around the world.

DNS is a critical part of the Internet’s infrastructure, and though a good deal of attention has been paid to improving its security in recent years with DNSSEC, an important part has been overlooked. It’s what’s often referred to as the “last mile,” or the connection between you and your ISP or your DNS provider, if you use a DNS service like OpenDNS. It’s in this “last mile” that bad things are most likely to happen — snooping, tampering, or even hijacking traffic. Anyone who knows what they’re doing can eavesdrop on your Internet activity and see exactly which domains you are resolving, and in many cases, what websites you’re visiting.

It happens all the time on insecure networks at coffee shops, and even residences. Some ISPs have even been accused of spying on their customers’ activity. What’s worse, the “last mile” is ripe for man-in-the-middle attacks, where an intermediary injects themselves into your traffic path masquerading as your intended destination, but all the while, being able to see and modify your traffic. This leaves little confidence for the Internet user.

DNSCrypt changes this and has the potential to completely revolutionize Internet security. DNS has, unfortunately, always had some inherent weaknesses because it’s transported in plain text. DNSSEC has never attempted to address that (crazy, I know). Encrypting all DNS traffic means a fundamental change to the security of the system on the whole and a strong improvement. It’s not the only solution, and there’s still an important place for verification and validation of domains like DNSSEC provides, but it’s a very strong first step."

For More Info & To Download DNSCrypt Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">DNSCrypt: A Security Tool To Encrypt DNS Traffic"https://www.voiceofgreyhat.com/2011/12/dnscrypt-security-tool-to-encrypt-dns.html</a>

Windows Phone 7 Connector For Mac By Microsoft Corporation

Windows Phone 7 Connector is a simple, easy-to-use application designed to sync your favorite media files from your Mac, with your Windows Phone 7 or Zune HD. You can also sync photos and videos you captured on your phone with your Mac, and when needed, update your Windows Phone 7 software. Microsoft’s latest release of the Windows Phone 7 Connector is said to fix a number of bugs, including the spotty connectivity that a number of users have reported.

Features:-

• Full sync and import support for Apple Aperture software
• Drag and drop import of files from Browse Device
• Ringtone transfer support (for phones running Windows Phone 7.5 or later)
• Improved video conversion process with user configuration options
• Support for Windows Phone Marketplace (for phones running Windows Phone 7.5 or later)
• Localization support for 13 additional languages
• Improvements to backup and restore operations
• Improved configuration for podcast sync and photo import
• Improved iTunes import support in certain languages
• Improved metadata support for videos

Fixes :-
• Added additional error codes and help references for device update
• Resolved connectivity issues with certain devices
• Resolved album art display issues for certain device

For More Information & to Download Windows Phone 7 Connector For Mac Click Here 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Windows Phone 7 Connector For Mac By Microsoft Corporation"https://www.voiceofgreyhat.com/2011/11/windows-phone-7-connector-for-mac-by.html</a>

Spyware, Trojans Exploits iTunes & Gaining Access To Computers

A remote monitoring software" developed in Germany is designed to exploit a vulnerability in iTunes in order to infect target computers. An IT monitoring company advertises its ability to distribute spyware software for government agencies using fake iTunes updates. Apple iTunes has been rectified and closed a security hole. The exploit in question relies on the fact that, assuming Apple Software Updater is not active, iTunes uses an unencrypted HTTP request to query for the URL for the latest version of the program from the Apple server. Because the query is unencrypted, this URL could be modified. If a user were to respond to an iTunes update message, they could then be taken to a crafted web page intended to install the "remote monitoring tool" onto their computer. For the redirection to work, however, a Gamma customer would need to be able to actively interfere with the network, limiting its use to entities such as ISPs acting under government orders.

iTunes update to play Trojans :-

Unlike their Italian rivals of the company hacking team, which campaigned in Berlin also to new customers, the gamma-people even ensures that journalists had to leave before the presentation of their "Managing Directors" the hall. The fear has obviously good reasons: Gamma seems to operate at FinFisher dubious methods - that suggests marketing material SPIEGEL has obtained. After that, the authorities offered and government software works similarly to that of computer criminals who should be fought with it.

Apparently, it is clear from FinFisher promotional videos, for example, the software uses Apple's popular iTunes media supermarket to load with a fake software updates FinFisher-sniffing software on the computers of suspects.

The demand for surveillance technology for the Internet, such as the Gamma International Ltd. and hacking demonstration team in Berlin and they peddled, has risen significantly in recent years internationally. Security agencies worldwide are faced with the problem that increasingly suspicious encrypted communication over the Internet. Agreements, the suspects met earlier on relatively simple to intercept landline telephones or mobile phones to run, now increasingly encrypted Internet telephony services like Skype or encrypted computer chat. Authorities often get only with how to arrange suspects via cell phone to the next encrypted chat.

This issue promises companies like Gamma International Ltd. and hacking team to solve. However, this kind targeted surveillance measures are not easy to implement: Listening encrypted communication is only possible if it occurs before encryption. This software must be installed, the conversations, emails or chats ausleitet unnoticed on the computers of suspects - unencrypted to the security authorities. In plain English: the authorities have to hack into the computers of suspects. 

-News Source (Spiegel Online)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Spyware, Trojans Exploits iTunes & Gaining Access To Computers"https://www.voiceofgreyhat.com/2011/11/spyware-trojans-exploits-itunes-gaining.html</a>

VMware Fusion 4.1 Allowing Virtualization of Mac OS X

VMware Fusion 4.1.0 released for Mac OS X. Last last week VMware released an update to its popular virtualization software that adds many improvements and bug fixes. The biggest improvement is the applications ability to run older versions of Mac OS X Leopard and Snow Leopard. Apple changed the Mac OS X licensing terms with the release of Mac OS X Lion. The new software license allows users to install and use virtual machines running the client or server version of Lion on their Mac.  It doesn’t mention anything about older versions of Mac OS X so it is assumed that you still aren’t allowed to run either of them in a virtual machine.

Apparently VMWare is leaving the decision whether or not they virtualize either of the older versions of Mac OS X to the user. If a user tries to install Leopard or Snow Leopard in Fusion 4.1 they will be prompted with a dialog that asks: “Verify that the operating system is license to run in a virtual machine. ” If you select Continue then Fusion will go ahead with the installation of the operating system leaving the decision to go ahead entirely in the user’s hands.

For More Information & To Download VMware Fusion 4.1 Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">VMware Fusion 4.1 Allowing Virtualization of Mac OS X"https://www.voiceofgreyhat.com/2011/11/vmware-fusion-41-allowing.html</a>

iOS 5.0.1 Released (It's time to Update The Firmware)

Apple's iOS 5.0.1 is now available. 

The new version bumps iOS5 up to 5.0.1, and is Apple's first OTA update. OTA stands for "over-the-air", and means that you can download and apply the update directly from your iDevice. You no longer need to download the entire firmware file to your computer - including yet another copy of everything which hasn't changed in iOS - and push it to your device.

This Update Contains Improvements & Bug fixes Including:-

• Fixes bugs affecting battery life

• Adds Multitasking Gestures for original iPad

• Resolves bugs with Documents in the Cloud

• Improves voice recognition for Australian users using dictation

Products Compatible with this Software Update:-

• iPhone 4S

• iPhone 4

• iPhone 3GS

• iPad 2

• iPad

• iPod touch (4th generation)

• iPod touch (3rd generation)

For information on the security content of this update Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">iOS 5.0.1 Released (It's time to Update The Firmware)"https://www.voiceofgreyhat.com/2011/11/ios-501-released-its-time-to-update.html</a>

Apple Released 'battery fix' For iOS Update

Apple last night rolled out iOS 5.0.1, promising that the update flattens bugs that have caused iPhone 4S owners to suffer from rapidly depleting battery syndrome.

This Fix Contents:-

• Fixes Bug Affecting Battery Life
• Adds Multitasking Gestures for original ipad
• Resolves bug with documents in the cloud 
• Improves Voice recognition for Australian users using dictation 

The update - available through iTunes, or from the new Software Update entry in iOS' settings app - also makes it easier for Aussies to speak to the 4S' voice assistant, Siri. And, said Apple, it "resolves bugs with Documents in the Cloud", though this user still has to turn iCloud document syncing off in order to turn it on, if you see what I mean. Finally, iOS 5.0.1 brings the four-finger swipe gesture for showing and hiding the multi-tasking menu to the original iPad. iOS 5.0.1 runs on every iPhone from the 3GS upward, plus the first- and second-gen iPads and the third- and fourth-generation iPod Touch

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Apple Released 'battery fix' For iOS Update"https://www.voiceofgreyhat.com/2011/11/apple-released-battery-fix-for-ios.html</a>

"Devil Robber" Trojan Infects Mac OS-X & Stealing Personal Information

"DevilRobber" Trojan Infects Mac OS-X & Stealing Personal Information (Credit Cards, User-name, Passwords & so on).

 

Now another piece of malware has struck unsuspecting Mac owners.  The new multiplatform trojan is much more sophisticated than most of the past malware to hit the Mac platform. The malicious program installs as part of infected torrent downloads from sites such as The Pirate Bay.  Thus far the malware has been primarily found to be piggybacking on pirated copies of the image editing app GraphicConverter version 7.4 (whose authors are not involved in the screen and do not approve of the pirating in the first place).  The onboard malware is officially known in security circles as OSX/Miner-D, and is nicknamed the "DevilRobber".

Once installed on the victim's machine, the malware opens a back-door to the OS X system, allow remote command-and-control.  It also monitors your computer, attempting to steal personal information like credit cards.

To do this it takes screenshots.  It also periodically dumps confidential information from various applications -- such as truecrypt data, Vidalia (TOR plugin for Firefox), your Safari browsing history, and .bash_history -- into the creatively named file dump.txt.  It also records your username and passwords via monitoring using a proxy server (on port 34522 in the most common variant, but likely to change).

-News Source (NS, Intego, Dailytech)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">"Devil Robber" Trojan Infects Mac OS-X & Stealing Personal Information"https://www.voiceofgreyhat.com/2011/11/devilrobber-trojan-infects-mac-os-x.html</a>

Linux Tsunami Trojan Called "Kaiten" Targeting Mac OS

Malware writers have derived a new Trojan for Mac OS X by porting an older Linux backdoor Trojan horse onto another platform. The newly discovered Tsunami Trojan is derived from an earlier Linux-infecting backdoor Trojan, called Kaiten, which phoned home from infected machines to an IRC channel for further instructions. Security firms are still in the process of analysing Tsunami but early speculation suggests it may be a DDoS attack tool.

"Mac users are reminded that even though there is far less malware in existence for Mac OS X than for Windows, that doesn't mean the problem is non-existent," said Graham Cluley 

We fully expect to see cybercriminals continuing to target poorly protected Mac computers in the future. If the bad guys think they can make money out of infecting and compromising Macs, they will keep trying. My advice to Mac users is simple: don't be a soft target, protect yourself.

Mac Trojan authors have previously used Windows backdoor code but the Tsunami Trojan is the first case we've across, at least, where malware tricks from the world of *nix have been turned against Macs

-News Source (Register & NS)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Linux Tsunami Trojan Called "Kaiten" Targeting Mac OS"https://www.voiceofgreyhat.com/2011/10/linux-tsunami-trojan-called-kaiten.html</a>

iPad 2 Running iOS 5 Security Vulnerability, Using A Smart Cover Password Can be Easily Bypassed

Reports of security flaws in Apple's new iOS 5 continue to surface. There's a super easy way to bypass a password-protected locksreen on an iPad 2 that's equipped with iOS 5, which we've successfully completed with steps provided by German blog Apfeltalk.
Here's how to re-create the flaw. First, enable password protection on the iPad 2 and lock it. Second, hold down the power button for a couple seconds until you see the red "slide to power off" slider at the top of the screen. Third, close the smart cover and open the smart cover again. And fourth, tap "cancel" at the bottom of the screen. What you should see next is the last screen accessed before you locked your tablet. Don't have a smart cover? You can skip step three by simply grazing a magnet across the right side of the tablet. 

Video Demonstration:-

Note that this doesn't completely unlock the device. It only opens the screen you were last looking at, but nothing more; you can't open apps or perform tasks. But it's a big deal if you were, say, doing some incriminating Web surfing and left your iPad 2 lying around a house with a curious (and tech-savvy) partner. We tried it on both iOS 5 and iOS 4.3.3, and it only worked on iOS 5, so it appears to be a software flaw. No doubt Apple is aware of the issue and will hopefully fix it in an imminent update.

For more information and to see the German (Apfeltalk) blog post click here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">iPad 2 Running iOS 5 Security Vulnerability, Using A Smart Cover Password Can be Easily Bypassed"https://www.voiceofgreyhat.com/2011/10/ipad-2-running-ios-5-security.html</a>

iPhone Can Be Used As Spyware & Can Snoop Desktop Typing

A team of researchers at Georgia Tech have demonstrated how they were able to spy on what was typed on a regular desktop computer's keyboard via the accelerometers of a smartphone placed nearby. Normally when security researchers describe spyware on smartphones, they mean malicious code that can be used to snoop on calls, or to steal the data held on mobile phones.

In this case, however, researchers have described how they have put software on smartphones to spy on activity outside the phone itself - specifically to track what a user might be doing on a regular desktop keyboard nearby. It sounds like the stuff of James Bond, but the researchers paint a scenario where a criminal could plant a smartphone on the desk close to their target's keyboard and use specialist software to analyse vibrations and snoop on what was being typed. It's a quite beautiful twist on how bad guys could use microphones to "hear" keystrokes and spy on your passwords.

Patrick Traynor, an assistant professor in Georgia Tech's School of Computer Science, admits that the technique is difficult to accomplish reliably but claims that the accelerometers built into modern smartphones can sense keyboard vibrations and decipher complete sentences with up to 80% accuracy.

"We first tried our experiments with an iPhone 3GS, and the results were difficult to read," said Traynor. "But then we tried an iPhone 4, which has an added gyroscope to clean up the accelerometer noise, and the results were much better. We believe that most smartphones made in the past two years are sophisticated enough to launch this attack."

Indeed, a photograph of the researcher shows him posing with what appears to be an Android smartphone.

The study's authors also determined that because the smartphone had to be within a range of just three inches from the keyboard, phone users who left their phones in their pockets or purses, or simply moved them further from the keyboard would be well defended.

The researchers admitted that the likelihood of an attack of this nature "right now is pretty low", and I'm not planning to lose any sleep over the threat. Nevertheless, if you manage to get the chance do take some time to read the paper: "(sp)iPhone: Decoding Vibrations From Nearby Keyboards Using Mobile Phone Accelerometers"

-News Source (NS, Computer World, Georgia Tech's School)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">iPhone Can Be Used As Spyware & Can Snoop Desktop Typing"https://www.voiceofgreyhat.com/2011/10/iphone-can-be-used-as-spyware-can-snoop.html</a>

Flashback Trojan Targeting Mac OS X in VMware Fusion

Underscoring the growing sophistication of Mac-based malware, a trojan preying on OS X users has adopted several stealth techniques since it was discovered last month.
Updates to the Flashback trojan, which gets installed by disguising itself as an Adobe Flash update, now prevent the malware from running on Macs that use VMware Fusion. Such virtual machine software is routinely used by security researchers to test the behavior of a malware sample because it's easier to delete a virtual instance when they're finished than it is to wipe the hard drive clean and reinstall the operating system.

According to MAC Security Blog:-

The latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.
Next, the installer for the malware downloads the payload when running the postinstall script.

Finally, it no longer installs the easy-to-spot ~/Library/Preferences/Preferences.dylib. Instead, it installs the backdoor inside Safari, and does so in two ways. It adds information to Safari’s info.plist file, with the location of the backdoor, and it adds the actual backdoor module at /Applications/Safari.app/Contents/Resources/UnHackMeBuild.

Even if a user removes the above file (UnHackMeBuild), they need to edit Safari’s info.plist file; if not, Safari will look for the backdoor on launch, and, if it is not found, Safari will quit.

-News Source (Intego Blog, The Register)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flashback Trojan Targeting Mac OS X in VMware Fusion"https://www.voiceofgreyhat.com/2011/10/flashback-trojan-targeting-mac-os-x-in.html</a>

Mac OS X 10.7.2 & Safari 5.1.1 Released (Multiple Security Vulnerability Has Been Fixed)

Apple has released Mac OS X 10.7.2 and, for Mac OS X 10.6.8 Snow Leopard users who have yet to upgrade to Lion, Security Update 2011-006; these updates address a number of security vulnerabilities in the company's desktop and server operating systems. According to Apple, more than 70 holes have been closed by the updates, many of which could be exploited by an attacker to remotely execute code with elevated privileges, gain access to private information, or cause a denial-of-service (DoS).
Mac OS X 10.7.2 and Security Update 2011-006 fix issues in the QuickTime media player, iChat Server, CoreFoundation, CoreMedia, CoreProcesses, CoreStorage, and the kernel, as well as IOGraphics, MediaKit and Open Directory. Other problems addressed by the update include security vulnerabilities in Apache, the Application Firewall, the BIND DNS server, PHP, Python, the SMB File Server, Tomcat and X11. Various root certificates were also added or updated.

Apple also released an update for its Safari web browser for Windows and Mac OS X. Version 5.1.1 of Safari corrects a total of 43 security vulnerabilities, most of which are memory corruption issues in the WebKit browser engine that could be exploited to execute arbitrary code. Directory traversal, policy, and uninitialised memory access issues have also been fixed.

To Download Safari 5.1.1 Click Here

To Download Mac OS X Lion 10.7.2

• Server Standard Update

• Server Combo Update

• Client Standard

• Client Combo Update

To Download Security Update 2011-006

• Client 

• Server

-News Source (Apple & The H)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Mac OS X 10.7.2 & Safari 5.1.1 Released (Multiple Security Vulnerability Has Been Fixed)"https://www.voiceofgreyhat.com/2011/10/mac-os-x-1072-safari-511-released.html</a>

Steve Jobs Died

An episode ends. Apple on Wednesday confirmed that its former CEO, Steve Jobs, has died. He was 56.

"Apple has lost a visionary and creative genius, and the world has lost an amazing human being," Apple said in a note on its Web site. "Those of us who have been fortunate enough to know and work with Steve have lost a dear friend and an inspiring mentor. Steve leaves behind a company that only he could have built, and his spirit will forever be the foundation of Apple."

The Apple.com Web site currently bears a photo of Jobs (left). Apple asked fans to share their memories, thoughts, and condolences via rememberingsteve@apple.com.

Jobs stepped down as Apple CEO in August after nearly 14 years at the helm of the company he co-founded in 1976. "I have always said if there ever came a day when I could no longer meet my duties and expectations as Apple's CEO, I would be the first to let you know. Unfortunately, that day has come," he said at the time.

Apple did not disclose any additional details about his passing, but Jobs had battled health problems for several years. Three years after having successful surgery for pancreatic cancer, Jobs announced in January 2009 that he had a "hormone imbalance" that was robbing his body of necessary proteins. He took a leave of absence, and it was later revealed that he underwent a liver transplant. By June 2009, he was back at work.

Though highly successful, Jobs's busy 2010 again took a toll on his health and he took another leave of absence in January 2011. He surprised and delighted fans, however, by showing up for the debut of the iPad 2 in March, telling those in attendance that he had worked too hard on the product to miss its launch. He was also there to show off iOS 5 and Mac OS X Lion a few months later.

Tim Cook, who is now Apple's CEO, took the stage in Jobs' place to launch the new iPhone 4S, the start of a new era at Apple.

-News Source (PC Mag & Apple)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Steve Jobs Died"https://www.voiceofgreyhat.com/2011/10/steve-jobs-died.html</a>

Apple Fixes OSX Revir-B Trojan Vulnerability

Apple has updated the bare-bones antivirus protection included with Mac OS X to detect a Trojan horse that poses as a PDF document. That Trojan, named "Revir.A" by Finnish security company F-Secure but "Revir.B" by others, masquerades as a PDF file . Unwary users who download and open the fake PDF actually start a malware chain reaction that infects a Mac with multiple pieces of attack code, including a "backdoor" designed to listen to a hacker-controlled server for further instructions. 

Apple added a signature for Revir on Friday to the detection engine called XProtect included with Mac OS X 10.6, aka Snow Leopard, and Mac OS X 10.7, better known as Lion. Since May, when Apple fought a weeks-long battle with makers of phony Mac security software -- usually called "scareware" or "rogueware" -- XProtect checks daily for new signature updates.
The new signature will detect Revir if a user downloads the fake PDF document using Safari, iChat or Mail -- Mac OS X's native email client -- and then displays a warning urging the user to toss the file into the Trash. On Monday, however, Mac-centric security company Intego said it had spotted a new piece of Mac malware disguised as an Adobe Flash installer.
Tagged "Flashback" by Intego, the Trojan installs itself when the fake Flash file is run, then deactivates the Mac outbound firewall Little Snitch , likely as an attempt to hide communication between the malware and its remote command-and-control server.
Flashback uses the same phony Flash distribution tactic as a Trojan horse named "QHost.WB" found by F-Secure in early August. Apple updated XProtect to detect QHost on Aug. Intego speculated that hackers may think the Flash installer trick will be effective because Lion, unlike earlier Mac OS X editions, does not come with the Adobe software pre-installed.
The French antivirus firm recommended that users download Flash Player only from Adobe's website, and if they're using Safari, to uncheck the box marked "Open 'safe' files after downloading" under the General tab to prevent fake installers like Flashback from running automatically. 

-News Source (Network World)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Apple Fixes OSX Revir-B Trojan Vulnerability"https://www.voiceofgreyhat.com/2011/09/apple-fixes-osx-revir-b-trojan.html</a>

iPhone Event October Will Be Held On Apple Campus

Apple intends to host the October 4th media event on their own campus in Cupertino, California, according to a new report from WSJ’s AllThingsD. The event is expected to be headlined by the iPhone 5 (or iPhone 4S), in addition to introducing the next iPod touch, iOS 5, iCloud, and Mac OS X 10.7.2 update. This is a change to Apple’s tradition of hosting larger event sat San Francisco’s Yerba Buena Center. Although AllThingsD isn’t sure as to why the events location is different, they propose a few theories. The other side to not booking the YBCA is that it has kept the event date hidden from the public, something that was relatively easy to guess due to the public accessibility of the Yerba Buena Centers event calendar. Few details on any new hardware have surfaced, and there is an ongoing debate as to whether a true iPhone 5 will be revealed or if the iPhone 4S will be the next-gen iPhone. While there is plenty of speculation in the tech world as to the specifics of the next phone, it’s important to remember that Apple goes to incredible lengths to keep products secret, as demonstrated by the immense security precautions surrounding the iPad when it was in testing prior to public launch.

According To Apple:-

"Perhaps the release date was too much of a moving target to risk booking a large space like Yerba Buena Center for the Arts (YBCA), which has hosted a number of big product unveils in the past. Perhaps, the company felt a more intimate venue was best for newly installed CEO Tim Cook’s first media event. Perhaps YBCA was simply already booked. Whatever the reason, the world will get it’s first look at the next iPhone at Apple’s Town Hall Auditorium in early October."

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">iPhone Event October Will Be Held On Apple Campus"https://www.voiceofgreyhat.com/2011/09/iphone-event-october-will-be-held-on.html</a>