iFAQs Newsletter | LA MACTECH

Trojan Horse Threatens Macintosh Security

Tue, 24 Jun 2008 16:06:40 -0700

Drag a Horse to Water -- but keep him off your Mac:
Major computer security service providers announced today the second major Trojan Horse to hit Apple's Mac OS X -- a computing platform often cited as invulnerable to the types of attacks that plague Microsoft's Windows operating System.

Unlike the previous Trojan that raised Mac users' heartbeats and caused en masse cries of "I told you so" from Windows users, the threat never materialized and the Trojan was never seen on computers in the wild.

Not so with Astht (aka Hovdy), said a senior manager at Symantec, the makers of Norton Antivirus for Macintosh. In a quote reported by IT News, the official stated Astht is indeed in the wild. Later, however, another Symantec senior staffer admitted that no known exploits have actually yet occurred.

While most security experts acknowledge the threat level is low and, along with the fact that the source code for Astht is also in the wild (along with templates hackers use to create variants of the Trojan), it is very likely an official security patch from Apple will be forthcoming, thereby eliminating the threat.

What is Astht and what dangers does it present:
The Trojan exploits a major security hole in Apple Remote Desktop Agent -- software built in to Mac OS X (Tiger and Leopard -- 10.4 and 10.5 respectively) that enables remote management of a user's computer. Most IT firms use Apple Remote Desktop (ARD) to administer their clients' servers and workstations. The exploit also affects Leopard's Screen Sharing feature.

By targeting the flaw in ARD Agent, Astht gains root access to the user's computer, giving it complete access to all files and processes. And, combined with its so-called drive-by download technique that masks downloads of additional malicious files -- sometimes from trusted Websites -- Astht has the ability to adapt to further compromise the user's system.

The ARDAgent-based Trojan uses privilege escalation to turn various services, such as Personal File Sharing, Remote Management, SSH and even thrid-party Antivirus programs, on and off. There are reports it may control built-in iSight cameras to surreptitiously grab shots of you, the user. More alarming perhaps, are reports that variants of the Trojan contain key logging applications that record your every keystroke.

For a more detailed look at how the Trojan unleashes its nasty payload upon the unsuspecting, please visit TidBITS.

How to combat Astht:
While we wait for an official solution from Apple, there are ways in which we can avoid coming in contact with Astht.

First and foremost DO NOT EVER download files from the Internet, especially from untrusted or unknown sources. For any file to be installed you must authenticate with your Administrator password. Do not do so if you are not intending to install an application or program.

In order for Astht to be a threat, it must find a way onto your computer. Make sure to close the door on it thereby denying it entry.

Next, consider the purchase of an antivirus package for your Mac. One such package we use at Techmuscle is Symantec's Norton Antivirus for Macintosh v. 11. You can find it here.

Finally, consider turning off all remote management functions. (You will need Administrator access in order to perform these steps. If you are a Standard user, please ask Techmuscle or your in-house IT director for help.)

To turn of remote management, please follow these steps provided by The Unofficial Apple weblog (TUAW). Visit http://www.tuaw.com/ardfix/ for a step-by-step, illustrated guide.

For advanced users:
This Terminal hackery is provided by MacFixIt.com but may prevent use of remote management and screen sharing features:

Running the following command to remove the setting of user/group ID upon execution will prevent the execution of commands as root:
◦ sudo chmod -s /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent

How to get LA MACTECH support:
Our new Web-based Trouble Ticket Support System alerts us to your support issues immediately and keeps track of your request from start to finish. You can even upload screen shots of alerts you receive, just by clicking a button.

Click "Support" on the menu bar of our Website or visit LAMACTECH.COM/SUPPORT to create a Trouble Ticket (see screen shot below):

For more information about Macintosh security please contact Techmuscle by visiting LA MACTECH.

In our next issue of iFAQ's:

Tasty Green Morsels
10.5.4 Update
Snow Leopard (aka Mac OS 10.6)

iFAQ's are Back!

Mon, 16 Jun 2008 09:00:27 -0700

In this issue of iFAQ's:

LA MACTECH Goes Bi
WWDC and Me
Apple Update Makes Leopard Purr
Leopard Redux

That's Hot!:

Dude. Don't get totally frapped up when your Mac goes down:
We're in Los Angeles, and still in the Big Apple. LA MACTECH is now bicoastal. We support your Mac, network of Macs, Mac OS X server, new and upcoming Apple technologies, and we can integrate them into your current network schema, including Windows Servers.

LA MACTECH serves the New York metropolitan area and, starting right now, the Los Angeles Metro Area. Check out our support options here.

Whether we take the Subway or the Freeway, LA MACTECH is here for you!

WWDC and Me:

With all bets down and the odds even, the customer wins:
Breaking with tradition, Mac rumor sites scored big during this past Monday's World Wide Developer's Conference (WWDC), held in San Francisco. Analysts and Apple Fanboys alike trumped the über-secretive Apple machine with on-target predictions that fueled iPhone 2.0 frenzy.

From the Tech Beat to Wall Street, and with the cat all but out-of-the-bag, Apple's visionary leader still inspired and delighted the crowd. Minor leaks from AT&T, and other telecoms, did not spoil the party.

In fact, they added to the excitement. iPhone 2.0, along with Apple's innovative MobileMe Push Technology (out this July) promises to one-up every major PDA on the market. The next gen iPhone also sweetens the pot with 3G high-speed mobile broadband featuring Apple’s signature design, functionality, and branding.

Techmuscle will give you a concise breakdown of Apple’s new offerings with links to Websites sure to make for great summer reading leading up to the iPhone’s July 11th release, and certainly long after. First, here are the benefits of the iPhone 2.0, officially called iPhone 3G:

Introducing iPhone 3G:

The new price point -- $199 here on the AT&T network -- and nearly global availability. Enchanting!
Vastly increased speed: Email attachments and Websites load 2.4 times faster than EDGE on the new 3G network.
Simultaneous talk and data browsing.
GPS technology with a new Twist: A-GPS that allows faster location pinpointing by finding the closest satellites to your location.
A modified design: A new plastic back is sleeker and feels better in your pocket.
Better range and battery life: The new design increases the iPhones range and reception, all using less battery power.
Tougher Construction: Metal buttons replace the old plastic ones.
The App Store!: Starting in July, a wide-range of applications designed to enhance the functionality (with a capital fun) of your iPhone will be available on iTunes.
MobileMe, the feather in Apples cap: This technology literally pushes your email, contacts, calendars and media to your iPhone, other Macs and even PCs.
iPhone 2.0 software will be available to users with first generation iPhones, though the phone will continue to operate on the EDGE network.

Push, don't pull!

Apple’s MobileMe is sky-high breaking new ground:
Apple’s always been ahead of the pack in the wireless revolution. Now they’ve done it again with something called MobileMe. While this new innovation replaces .Mac, it takes that service to a new, literally higher level -- the MobileMe cloud.

Look mom, no hands (or wires)!
Sans wires, your email, contacts, calendars and more will appear on your home computer (Mac or PC), iPhone and/or PDA, and your office computer all at once.

Changes you make are instantly and automatically reflected on each and every device. Here’s how it works: your data is pushed up into the MobileMe cloud, and rains down (or, more accurately, is pushed down) onto all of your devices. MobileMe is compliant with every major Web browser that provides users with a cool interface for this complex technology.

No More Corporate High Wire Act: IT Without a Net!

MobileMe, iPhone loves Company:
Both MobileMe and iPhone 2.0 now give joy at home and in the office. Microsoft Exchange Server, Cisco VPN and other Enterprise technology is built into the new iPhone, making it a functional and secure workplace communications tool.

Over the years, Push Technology became synonymous with corporate America’s de facto email server standard, Microsoft Exchange Server, and with RIM’s BlackBerry handheld. The original iPhone could not easily provide business users with access to their corporate email accounts -- but that didn’t always stop them from buying the hot sleek device. Corporate IT departments -- historically not Apple friendly -- were stuck between a rock and an iPhone.

Don’t ask. Do tell:
iPhone 2.0 makes Exchange issues a thing of the past with built-in tools to connect to the Enterprise. No more hassles with your Windows IT staff. Your email, contacts, calendars and media find you!

At home, at play or in the office:
MobileMe is the answer to keeping all of your important information on hand whether you’re on your home computer, on the Web, using your iPhone or your laptop. And, a MobileMe account offers users a generous 20 GB of storage capacity!

Time to Upgrade: Leopard’s Cautious Cats Tear Into 10.5.3 and Like What They Taste

How to Catch this Grown-Up Cat:
On May 28th, Apple posted the 10.5.3 Leopard Combo Update. You may use Software Update (located in the Apple menu in the upper left corner of your screen) to automatically perform the update, or it can be downloaded directly from Apple.

You must have administrator access on your Mac to download and install the 10.5.3 update following these practical guidelines:

Shut down all running applications/programs (make sure to Quit them from the application's pulldown menu in the Menu Bar).
Go to your Applications Folder (Macintosh HD [or whatever you've named your Hard Drive] > Applications > Utilities) and open the Utilities folder.
1. Open the Disk Utility application.
2. Choose your the name of your hard drive on the list in the large box on the left and click the "Repair Disk Permissions" button.
3. Take a cat nap or grab a cup of coffee. This may take some time.
For a major update (an update that incrementally changes the version of your Mac OS such as from 10.5.2 to 10.5.3) Techmuscle suggests checking your hard drive for errors.
1. Start up your Mac with the CD or DVD that it came with or the retail DVD you used to upgrade your Mac.
2. Boot from your DVD by holding down the 'c' key immediately after you hear your Mac chime.
3. Choose English (or whatever language you prefer) and click the right arrow.
4. From the Utilities menu in the Menu Bar choose Disk Utility.
5. Again, choose your disk in the left-hand column.
6. Click the "Repair Disk" button on the bottom right of the Disk Utility window.
7. If you receive a message that your "Macintosh HD seems to be OK" move on to the Step i.
8. Repair your HD once more to correct any errors and move on to the next step.
9. Quit Disk Utility.
10. Choose Startup Disk from the Utilities menu.
11. Choose Macintosh HD as your startup disk and click the "Restart Button."
Now you're ready to install the 10.5.3 update either via System Update (as Apple recommends, or with the standalone Combo Updater).

Avoid using your Mac (opening and using applications) until the entire installation process is complete.
After the installer is finished, you will be asked to restart your Mac -- it will restart automatically if you do nothing.
Upon restart, your Mac will take longer than usual to boot up. It will also boot again after you see the grey Apple screen. Do not panic! Your Mac is just getting set for the changes. Enjoy!

About 10.5.3: More Muscle and Agility, and Weight:
Apple's philosophy of giving users an intuitive, friendly, elegant, and powerful operating system is proven with this update. With that in mind, it's hard to believe that 10.5.3 itself weighs in at a hefty 21,000 lines of new code!

That code squashes a number of bugs that plagued earlier versions, making 10.5.3 a critical update.

Remember though, it's not the last Leopard update we’ll see, but it's a vast improvement over previous versions. In fact, 10.5.4 is right around the corner (more on that later).

Here are 10.5.3's major improvements:

Overall stability improved.
Time Machine now conserves MacBook and MacBook Pro battery life (Stay tuned for a Time Machine backup tutorial in an upcoming issue of iFAQ's!).
Better graphics performance.
Spotlight searches are faster and more reliable, particularly on shared volumes.
Wireless connectivity is improved for Airport and Time Capsule.
Spaces has been improved.

Techmuscle will provide more detail and track under-the-hood improvements in the weeks to come. More information can be found at Apple's Knowledge Base article here.

Catch a Tiger by the Tail:
Just prior to going to press, a Techmuscle customer, happily using Mac OS X Tiger (aka 10.4), aksed why she should go through the trouble and expense to upgrade to Leopard. She involked the old adage, "If it ain't broke..."

Tiger is indeed a stable OS, though like with any legacy operating system, it has a finite shelf life. While Apple continues to provide support for Tiger, new features such as MobileMe will work best with Leopard. Some features, like Time Machine and Spaces, only work with Leopard. Also, Apple generally provides updates for its current OS and the one released immediately prior, but will then End of Life (EOL) anything older.

To learn whether your older Mac supports Leopard, click here.

Nine Lives? At Least:
Mac sites are already buzzing with news of the next incremental Leopard update. Leopard 10.5.4 has been seeded to developers. The new update concentrates on brining iPhone 2.0 and MobileMe compatibility to iTunes, Macintosh Sync Services and other parts of the Mac OS.

An update to QuickTime, version 7.5, just released, also adds stability, compatibility and security, and is recommended for Panther, Tiger and Leopard users and can be applied via Apple Software Update.

A Leopard Refresher:
Leopard first pounced in late October 2007 -- ages ago in tech-years. Leopard (aka Mac OS 10.5), said Apple, was a sleek mature predator with amazing killing potential -- also the first version of Mac OS X to be UNIX-certified.

Techmuscle's fall review of Leopard sited many new features, including: Spaces, Coverflow, and the 3D Desktop and Dock. We also advised caution in seeing past the flash and potential, and realizing that although tantalizingly fresh, this new upgrade was prone to bugs. Out of the box, 10.5.0 exhibited some clumsiness that is being cured by some time on-the-prowl.

Admin or Standard User:
Again, you MUST have administrator access to your computer in order to perform this or any update. If you are a corporate customer, please see your IT director for information on the updates mentioned in this iFAQ.

If you would like Techmuscle to perform this or any update for you or your business, please contact us.

How to get LA MACTECH support:

Our new Web-based Trouble Ticket Support System alerts us to your support issues immediately and keeps track of your request from start to finish. You can even upload screen shots of alerts you receive, just by clicking a button.

Click "Support" on the menu bar of our Website or visit LAMACTECH.COM/SUPPORT to create a Trouble Ticket (see screen shot below):

In our next issue of iFAQ's:

Tasty Green Morsels
10.5.4 Update
Snow Leopard (aka Mac OS 10.6)

Photos courtesy Apple.

Coming Soon: The Leopard Logs (Part 1)

Fri, 09 Nov 2007 07:00:17 -0800

A How To on how to prepare for your Leopard upgrade.

For current Leopard troubleshooting information click here.

Apple Lets the Cat Out of the Bag

Mon, 29 Oct 2007 07:00:28 -0700

The next major upgrade to Apple's Mac OS X came this Friday when Apple released Leopard with more than 300 improvements to Mac OS X. But should you leap to Leopard or wait to upgrade?

An Apple a Day Helps Keep the Viruses Away?

Wed, 18 Jul 2007 15:14:16 -0700

How to protect your Mac from viruses and how, and what, to backup.

True iPhone Confessions

Wed, 11 Jul 2007 14:35:48 -0700

Techmuscle's first look at the Apple iPhone with Tips and Tricks.

Wait To Update to 10.4.10

Wed, 27 Jun 2007 10:48:28 -0700

Some worms in the Apple make waiting to update to Mac OS 10.4.10 a good idea.

Apple Releases Tiger Update 10.4.10

Thu, 21 Jun 2007 15:20:32 -0700

New Apple update adds new features to Mac OS X.

Tiger Update Adds Security and Squashes Bugs

Wed, 04 Oct 2006 15:33:32 -0700

Tiger system update adds new security features to Mac OS X.

Apple Releases Tiger System Update 10.4.7

Tue, 27 Jun 2006 16:06:32 -0700

Apple released a Macintosh Operating System update for Tiger (Mac OS 10.4) today.

Special Edition - Backing Up Your Data

Sun, 16 Apr 2006 16:11:10 -0700

Where your data lives and how to back it up.

Apple Releases Tiger System Update

Mon, 03 Apr 2006 16:26:16 -0700

Apple Releases Mac OS 10.4.6.

Apple Releases Second Security Update for March

Tue, 14 Mar 2006 16:32:03 -0800

Apple released Security Update 2006-002 -- Apple's second Security Update for March.

Apple Combats Trojan with Security Update

Thu, 02 Mar 2006 16:36:03 -0800

Following reports of the appearance of malicious programs that affect Mac OS X, Apple has released Security Update 2006-001.

Mac OS 10.4.5 Update: Cleared For Takeoff

Tue, 28 Feb 2006 16:40:27 -0800

Apple's 10.4.5 update for both PowerPC and Intel Core Duo Macs has been tested and may be installed by customers.

Mac OS X Safari Security Alert

Tue, 21 Feb 2006 16:45:33 -0800

Security experts found a critical vulnerability in Mac OS X (Tiger) and the Safari Web browser.

Mac OS X Trojan (Virus) Alert

Thu, 16 Feb 2006 16:48:43 -0800

The first Trojan to target Mac OS X has just been identified. Also, Apple releases Mac OS 10.4.5.