Slashdot is powered by your submissions, so send in your scoop


Forgot your password?

+ - Researcher Discloses Methods For Bypassing All OS X Security Protections

Submitted by Trailrunner7
Trailrunner7 writes: For years, Apple has enjoyed a pretty good reputation among users for the security of its products. That halo has been enhanced by the addition of new security features such as Gatekeeper and XProtect to OS X recently, but one researcher said that all of those protections are simple to bypass and gaining persistence on a Mac as an attacker isn’t much of a challenge at all.

Gatekeeper is one of the key technologies that Apple uses to prevent malware from running on OS X machines. It gives users the ability to restrict which applications can run on their machines by choosiing to only allow apps from the Mac App Store. With that setting in play, only signed, legitimate apps should be able to run on the machine. But Patrick Wardle, director of research at Synack, said that getting around that restriction is trivial.

“Gatekeeper doesn’t verify an extra content in the apps. So if I can find an Apple-approved app and get it to load external content, when the user runs it, it will bypass Gatekeeper,” Wardle said in a talk at the RSA Conference here Thursday. “It only verifies the app bundle.”

“If Macs were totally secure, I wouldn’t be here talking,” Wardle said. “It’s trivial for any attacker to bypass the security tools on Macs.”

Comment: Re:They should be doing the opposite (Score 3, Interesting) 298

> 10 years should be the norm. That is a fact.

Or less. The value of materials older than that is limited. There are, of course, counterexamples, but they are the exceptions to the rule. Something like 99.9% of all songs that receive any income do so in the first 18 months, and that number continues to shrink as the companies churn out pop.

But forget music, what about snapshots? Every selfie you take is covered for 70 years after you die. Clearly there is something very wrong with that.

+ - Apple Offers Developers Expedited Apple Watch Shipping->

Submitted by mpicpp
mpicpp writes: While pre-orders for Apple's new smartwatch opened two weeks ago, few buyers will actually receive their device on the April 24 launch day.
Ship dates quickly slipped to June, but if you're a developer, Apple can get it in your hands much sooner. As reported by MacRumors, Apple this week emailed developers to say they could receive an Apple Watch by April 28.

Specifically, Apple is offering iOS developers the 42mm Apple Watch Sport with blue sport band. "We want to help give Apple developers the opportunity to test their Watchkit apps on Apple Watch as soon as it is available," according to the email.

But it won't be as simple as clicking "buy" on

"This opportunity is offered by random selection and quantities are limited," it continued. Developers must register via the link in the email by 10 a.m. Pacific (1 p.m. Eastern) on April 23.

Link to Original Source

Comment: Re:Help me out here a little... (Score 1) 533

by Maury Markowitz (#49520249) Attached to: Utilities Battle Homeowners Over Solar Power

> Since we are paying retail rates for energy generated by NEM customers, it is shifting the burden of grid maintenance to the customers without PV.

Then fix THAT problem.

The problem isn't solar, the problem is that no one, no one, pays the actual cost of grid maintenance. If grid maintenance wasn't being partially(or completely) hidden in the $/kWh, the problem would disappear completely.

Comment: Re:Help me out here a little... (Score 1) 533

by Maury Markowitz (#49520179) Attached to: Utilities Battle Homeowners Over Solar Power

> I can state with great confidence that it was not in fact considered.

I can state with *perfect* confidence that it was. The 7% cap was written right into the language of the original REC system in Ontario, for instance, which was introduced in the early 2000s.

> This is because there are countries ... (Germany, Denmark, Australia)

Do you live in, installed PV in, or otherwise have anything to do with any of these three countries? Where does your great confidence come from exactly?

Here's the actual facts. Germany had a 5% cap on PV in any single branch, Italy set it at 7%, and most others have also selected 7, including most of Canada and the US. The exceptions have been ones that *raised* the cap to allow more PV, like Germany, California and Hawaii.

Comment: Re:Obvious (Score 1) 350

> Laws of physics

Ahhh, this is always a good start...

> That's why your phone can talk to base station a kilometer away, your WiFi will
> not carry over about 100m and bluetooth peripherals barely have 10m range.

With only very minor corrections, like the last 10 metres or so, all of these are due entirely to radiated power. The two corrections are near field effects, and building materials.

> 2. Meters long? AM receivers? What?

The limit for practical efficient antennas is about 1/4 wave. A 100 kHz AM signal is 3 km long. An efficient antenna for AM is about 750 meters long. The typical car antenna, at about a metre long, has a gain around -20 dB, around 1% efficiency. That is one of those "laws of physics" you claim to understand. The only reason you can hear anything on AM is because they broadcast tens of thousands of watts. Here, read something:

> Because GPS sends on wave length that is relatively clear from other signals and
> that is able to carry the weak signal over the necessary distance

No, it's because the quarter wave antenna at 1575 MHz is about 5 cm, which fits quite nicely in a cell phone. While a car AM antenna has a gain around -20 dB (and a Walkman is probably down around -25 or less due to the antenna being the earphone which isn't exactly straight), the typical cell phone GPS antenna has a gain around -9 to -2 dB.

Recall that dB is logarithmic; this represents and improvement of two orders of magnitude, meaning that the ~250W of radiated power from the GPS is received at about the same power density as 25kW from AM. Actually more because of the physics of AM:

There are minor adjustments throughout, but this is good to an order of mag, or better.

Really, you should make sure you know what you are actually talking about before you try to quote physics to the /. crowd.

Comment: Re:Power beaming [Re:Revising a previous concept] (Score 1) 167

by Maury Markowitz (#49519729) Attached to: ISS Could Be Fitted With Lasers To Shoot Down Space Junk

> We looked at lasers for space-to-Earth power beaming, but it's less practical than you might think

Actually that's precisely why I asked. I recall this was offered up as a solution to the inefficiencies of microwave beaming, only to find that it was even worse.

Space power is a bad idea, but it refuses to die.

Comment: Re:Obvious (Score 1) 350

> Have a much greater range. In most cases you will be able to hear a station transmitting from tens of kilometers away

Well yeah, because they're broadcasting tens of thousands of watts. What, did you think this was due to some magical properties of the waves?

> Are typically designed to have backup power in case of an emergency

So do lots of cell towers. And since cell towers are in the hundreds of watts they are much easier to power and the total power needed to cover a particular geographical area is much smaller (see inverse square law). To the point where there was an article here only a day or two ago about solar powered towers. Know any FM stations that cover 20+ mile range that are solar powered?

> most FM receivers also have AM receiver function

Which require an antenna several meters long.–Harrington_limit

> That means they don't rely on phone's weak transmitter's ability to reach the tower

Keep thinking inside that box. Meanwhile the same cell phone is receiving GPS signals FROM SPACE.

Comment: Re:Obvious (Score 1) 350

> Let us know how that data service is working when a serious disaster strikes.

Exactly as well as the FM stations.

But we're arguing about which of two solutions is best. That's called the fallacy of the excluded middle. We don't want to debate whether FM or cell is better for emergency broadcasts, we simply want to know what's the best way to send emergency broadcasts.

So what is the actual problem? We want to

* provide rapid emergency information to people over a city-to-country sized area
* have that information appear on their cell phones even in the event of a natural or man-made disaster that takes out the infrastructure
* we want that to happen using the technology we already have in the cells phones

Ok, so now lets look at what technology we have in the cell phones:

* various cell receivers
* maybe an FM receiver, but it only works with an external antenna
* GPS and GLONASS receivers

And suddenly anyone who suggests that this should work using FM receivers looks like an idiot. The obvious solution to this problem is to define a few standard messages and stamp them with time, time-to-live, and geographical area-of-effect and send them into the GPS bitstream. John Deere's been doing this for years with Starfire.

Comment: Re:Help me out here a little... (Score 1) 533

by Maury Markowitz (#49509735) Attached to: Utilities Battle Homeowners Over Solar Power

> Yes, but you still need to have variable, reactive supply to deal with that 50% variance

Lolz. You always needed that. Here's a graph:

Note that demand varies between 12 and 16.5 over 3 hours.

> Reactive supply is less efficient than constant supply

Sure, if your supply has something that's large and spinning. Totally false otherwise, like in the case of an inverter.

Comment: Re:Help me out here a little... (Score 1) 533

by Maury Markowitz (#49509689) Attached to: Utilities Battle Homeowners Over Solar Power

> It becomes a problem when some business that normally draws power through some massive feeder
> lines from a cogen plant starts drawing power from all of those houses through wires that weren't designed to allow that much current draw.

There's no difference in grid terms. The power ultimately ends up in the big cable that runs into the business. Where those electrons initially came from is hidden in the grid.

There is one concern though. Most older transformers are designed to be efficient in sending power in one direction only. They will send it the other way, but they're not designed to. When a lot of energy is flowing the "wrong way" that inefficiency comes out as heat, which can cause the transformer to start heating up and shut down. It's non-linear, small amounts of power flowing back are essentially frictionless because that wasted energy is tiny compared to the heat capacity of the transformer. It's only when you start getting into the 50% range that it gets interesting (depends on the model of course).

The solution to this problem is to limit the total amount of generation on the other side of the circuit to some fixed percentage. Here in Ontario, with a completely outdated grid (thanks Darlington) we're capped at 7%. That means even if the grid is down and all the PV is blasting, the total amount of power flowing back is 7% of what it's designed to handle downstream. This keeps it far, far, from the point where backfeeding is a problem. Of course 7% is a problem. In California it's 15 to 30%, depending.

Comment: Re:Help me out here a little... (Score 3, Informative) 533

by Maury Markowitz (#49509645) Attached to: Utilities Battle Homeowners Over Solar Power

> By whom?

By all levels of government.

> Where's the budget item in the state/local/federal budget?

Right here:

It's about $30 billion a year in direct subsidies. This does not include outside R&D, like the share of nuke development that happens as a side-effect of weapons programs (which has very recently dropped to just about zero now that MOX is largely run out). It excludes more wishy-washy issues like nuke liability insurance issues, or the more nebulous concepts like funding the Navy to keep the sea lanes open. This is pure, direct subsidies.

> Stop repeating paranoid memes.

Stop repeating BS that ten seconds of google will prove to be blatantly false.

Comment: Re:Help me out here a little... (Score 1) 533

by Maury Markowitz (#49509565) Attached to: Utilities Battle Homeowners Over Solar Power

> I'm not sure how it does it

The MPPT puts the panels way off their I-V curve, so their efficiency goes to zero. They are not dumping energy, the panels actually stop producing.

> or based on local factors such as overvoltage in the grid?

That is exactly how they work, well, one of the techniques anyway.

> This tolerance is quite wide, because otherwise inverters wouldn't work a lot of the time.

The tolerance is exactly the same for all grid-connected generators, whether they be nuke plants of a couple of panels on your roof.

Evolution is a million line computer program falling into place by accident.