My Definitive List of Must-have Free Mac Applications and Best Paid-for Counterparts
These are the apps that I will install first on pretty much any new Mac that I get. I’m a huge fan of free and open source software, and no other platform has free software of the same quality and calibre as Mac OS X. Most of these are Mac-only apps (a couple are cross-platform). I’m listing free applications wherever possible, but if there is a paid-for app that I consider best-of-breed, I mention those too. Hopefully this list will help all of the techie switchers get the apps they need quickly. This list is a work-in-progress, so I’ll be adding to this it over time.
If you’re only interested in my recommended security apps, they’re at the bottom! Feel free to post in the comments if you have any you think are worth mentioning.
Last updated: 14/04/2015
Researchers Extract iPhone Data and Passwords in Minutes
A group of German security researchers from the Fraunhofer Institute for Secure Information Technology have discovered a way of extracting personal information and stored credentials from a locked iPhone, by way of a jailbreak. By gaining physical access to an iPhone (or iPad/iTouch), an attacker is able to reboot it into recovery mode, thus allowing them to upload their own jailbroken firmware onto the device. As part of this process SSH is enabled and a script can then be uploaded to the device which uses built-in system calls to extract encrypted data (including credentials in the keychain) from the device. See the video below for a demo of their attack, which can take as little as six minutes.
This attack would not be possible without existing jailbreak mechanisms, which effectively bypass the iPhone’s sandbox and allow unsigned code to be executed. The second issue is the way that iOS handles stored data and credentials, allowing any application to request the information. This is actually a prime example of the dangers of having a jailbroken iPhone or iPad, as it makes it much easier for an attacker to execute malicious code on your device.
These kinds of issues are not isolated to iOS devices, and the same would exist on other devices that could be made to run custom scripts. This will be a tricky issue for Apple to resolve, as much of its security relies on a strong sandbox. Their best chance is to try to identify and patch as many of the vulnerabilities that could be used for a jailbreak. They will also need to review the way iOS handles encrypted data, and ensure that data cannot be extracted by arbitrary applications.
Luckily there is not yet a publicly available automated tool to perform this attack, so it is unlikely that a random thief will be obtaining your data. If you’re really worried, you can use Apple’s free Find My iPhone service to remotely wipe your iOS device should it be lost or stolen. Check out my article on protecting and recovering your iPhone from loss and theft for more information.
The team’s original research paper is available here (PDF).
Mac App Store Simple Copy Protection Security Bypassed
The Mac App Store was released in the recent 10.6.6 update, allowing Mac users to buy and install apps in the same, easy, one-click fashion as iPhone and iPod Touch users. Over 1 million apps were downloaded in the first 24 hours. Although the Mac App Store doesn’t make use of a sandbox like the iOS App Store does, there are still several mechanisms developers can use to prevent their software from being copied and shared between different users.
Hackers have discovered that one of the simpler methods used to authenticate an app is actually stored as a separate plist file within the application bundle. This means that an app can be copied, and the authentication files within its bundle can be replaced with those from an app that was legally purchased (even if it’s a free app).
In order to resolve this, developers should not rely solely on the data found within the plist file external to the binary, and perform some checks against hard-coded values within the binary itself. Some simple tips are available here. Ultimately all software is crackable, Mac App Store or not, so my suggestion to application developers is: spend more time developing great new features, and less time worrying about anti-piracy. This is what itself Apple does. In the long run most people will follow the simplicity route and buy the app.
In related news: How not to store passwords in iOS (developers take heed)
Survey Reveals People’s Bad Password Practices
SecurityWeek has posted about a recent password survey (commissioned by Webroot), which reveals some details about how common folk use their passwords. Overall I don’t find their findings to be groundbreaking, and although we know that many people are stupid about how they use their passwords, the statistics provided in the survey are a bit soft if you ask me. Some of these ‘results’ I take with a grain of salt, as I have done some of these things, yet don’t consider myself insecure: I do reuse SOME passwords (selectively), I do log in to stuff over public wifi networks (where appropriate – eg. SSL), and I have shared a password in the past year. It all depends on how you do these things.
I won’t go into much detail, but these are some of what I think the most important points were:
- Almost half of all users never use special characters (e.g. ! ? & #) in their passwords, a simple technique that makes it more difficult for criminals to guess passwords.
- 86 percent do not check for a secure connection when accessing sensitive information when using unfamiliar computers.
- Almost half of Facebook users (47 percent) use their Facebook password on other accounts and 62 percent of Facebook users never change their password. (I consider this important as Facebook passwords are often targetted by phishing/malware)
- 30 percent remember their passwords by writing them down and hiding them somewhere like a desk drawer.
If I were able to do a large-scale survey, I’m sure I could come out with some more interesting results.
Loading ...
