- apple-list - University of Manitoba Mailing Lists

INTEREST: JAVA exploits and vulnerabilities
by Wayne Billing 12 Sep '13

12 Sep '13

Apple Inc's stand on JAVA from: http://support.apple.com/kb/HT5648 To help limit exposure to potential Java web app vulnerabilities, try to follow this best practice: • Enable Java in your web browser only when you need to run a Java web app. • Confine your web browser only to the websites that need the Java web app. Do not open any other websites while the Java web plug-in is enabled. • When you are done, disable the Java web plug-in. See How to disable the Java web plug-in in Safari<http://support.apple.com/kb/HT5241> …from: http://blog.trendmicro.com/trendlabs-security-intelligence/java-native-laye… Aug28 Java Native Layer Exploits Going Up<http://blog.trendmicro.com/trendlabs-security-intelligence/java-native-laye…> 11:34 am (UTC-7) | by Jack Tang (Threats Analyst)<http://blog.trendmicro.com/trendlabs-security-intelligence/author/jacktang/> [cid:C0519326-20FA-4330-B240-0A86DE8287B7@cc.umanitoba.ca]<http://www.facebook.com/sharer.php?u=http://blog.trendmicro.com/trendlabs-s…> Recently, security researchers disclosed two Java native layer exploits (CVE-2013-2465 and CVE-2013-2471). This caused us to look into native layer exploits more closely, as they have been becoming more common this year. At this year’s Pwn2Own competition at CanSecWest, Joshua Drake showed CVE-2013-1491, which was exploitable on Java 7 running on Windows 8. CVE-2013-1493 has become a popular vulnerability to target in exploits kits such as Blackhole. To understand why these exploits are becoming more common, some understanding of Java’s architecture is helpful. Java exploits can be divided into two types: Java layer exploits and Java native layer exploits. [cid:98796DF5-6A2B-4F1C-A93A-1E0B1F3533C0@cc.umanitoba.ca] Figure 1. Java security model The above graph shows the Java security model. Java layer exploits target vulnerabilities in the Java layer runtime, which lets applications bypass the Security Manager and call high privilege functions. These exploits have the following characteristics: * Can be created with less effort, because attackers need not bypass operating system-level protections. * Are cross-platform (i.e., work with multiple operating systems) Similarly, Java native layer exploits target the Java native layer runtime. These exploits are harder to create, as they need to bypass OS-level protections like ASLR and DEP. In addition, the skills needed to create native layer exploits are more difficult to acquire. [cid:55ED4DDE-CA1D-425B-AB86-31A4254F9247@cc.umanitoba.ca] Figure 2. Timeline of common Java vulnerabilities In the past, Java layer vulnerabilities were more common, but that is no longer the case. Before 2013, there was a 3:1 ratio of Java layer vulnerabilities to Java native layer vulnerabilities. Starting this year, however, we are now seeing more native layer flaws. Why is this the case? * A large amount of the vulnerabilities of are present in the Java native layer code. In the June 2013 Java SE Critical Patch Update Advisory, approximately half of all the vulnerabilities fixed were in the Java native layer code. * Attackers are becoming more skillful in creating exploits. In the past, while there were many native layer vulnerabilities, less exploits were present because attackers did not always have the skill to create the necessary exploits. This year, however, attackers clearly have the capability to take advantage of native layer vulnerabilities. Two methods of exploitation are becoming more common, One is to make use of a Java array length overflow to tamper with the java.beans. Statement object’s AccessControlContext member. To do this, the following steps are necessary: 1. Prepare a Java Array object on a heap.[cid:28A07EF0-F21E-4BBC-9F9F-38600A510D56@cc.umanitoba.ca] Figure 3. Step #1 2. Trigger a Java native layer vulnerability. The array object’s length is overflowed to a very large value.[cid:6EEA4532-7DE9-4175-883A-34377F8299F7@cc.umanitoba.ca] Figure 4. Step #2 3. An attacker can then use the array object to get or set the following buffer precisely. They can tamper with the following java.beans.Statement object’s acc field, which points to a AccessControlContext object. In general, the acc field will be tampered to point to a full permission AccessControlContext object. This will let arbitrary code be run on the affected system. [cid:D8AA3DCC-BE0E-4739-906F-239E7BE60BBF@cc.umanitoba.ca] Figure 5. Step #3 This exploit method requires that both the buffer which can be used to trigger vulnerability and the buffer which needs to be overwritten are in the same heap. It requires some knowledge and skill to ensure that this is the case. In addition to this, information leaks and ROP shell code attacks were demonstrated at Pwn2Own 2013. It gets the module base address by targeting a Java native layer vulnerability and constructing ROP shell code to hijack the execution context. We believe that 2013 will see more similar exploits along these lines. We urge users to carefully evaluate their usage of Java is necessary and ensure that copies of Java that are used are updated, to reduce exposure to present and future Java flaws. Update as of 9:28 AM PDT, Sept. 2, 2013 Trend Micro Deep Security provides protection for threats targeting CVE-2013-2465, CVE-2012-4681, CVE-2012-1723 via the following rules: * 1005598 – Identified Malicious Java JAR Files – 3 * 1004870 – Identified Suspicious Jar File * 1005093 – Java Applet Field Bytecode Verifier Cache Remote Code Execution Vulnerability * 1005640 – Oracle Java storeImageArray() Invalid Array Indexing Vulnerability Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: some versions of Flash Player plug-in blocked
by Wayne Billing 11 Sep '13

11 Sep '13

[NOTE: you can check which version of FLASH (if any) is running on your OS X machine at: http://helpx.adobe.com/flash-player/kb/find-version-flash-player.html ] ….from: http://lists.apple.com/archives/security-announce/2013/Sep/msg00001.html * Subject: APPLE-SA-2013-09-10-1 OS X: Flash Player plug-in blocked * From: Apple Product Security <email@hidden<mailto:email@hidden>> * Date: Tue, 10 Sep 2013 19:22:10 -0700 APPLE-SA-2013-09-10-1 OS X: Flash Player plug-in blocked Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 11.8.800.94. Information on blocked web plug-ins will be posted to: http://support.apple.com/kb/HT5655 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: AppleTV software upgrade
by Wayne Billing 11 Sep '13

11 Sep '13

…from: http://allthingsd.com/20130911/that-apple-tv-refresh-is-coming-next-week/ That Apple TV Refresh Is Coming Next Week Peter Kafka SEPTEMBER 11, 2013 AT 3:00 AM PT [apple_tv_cook]<http://i1.wp.com/allthingsd.com/files/2013/09/apple_tv_cook.png>Nope, Apple didn’t show off new Apple TV hardware yesterday. And Apple didn’t talk about new software for its Web video box, either. But it’s still coming. People familiar with the company’s plans said that Apple TV is scheduled for an internal overhaul on Sept. 18, the same day Apple releases its iOS 7 mobile operating software<http://allthingsd.com/20130910/ios-7-ships-september-18/>. The one new feature I’m aware of is a tweak to Apple’s AirPlay system. I didn’t do a great job of explaining this before, so here’s another stab: The new software will allow people who have purchased content from Apple’s iTunes store to play that stuff on other people’s TVs, via its AirPlay system. The key part is that they will be able to tell an Apple TV box they don’t own to stream the media they do own, directly from the cloud. That’s a change from the current system, which requires users to download stuff to their iPhones and iPads and fling it to the TV from there. It also echoes the way Google’s new Chromecast device works. Hope that makes more sense. I had thought Apple might have talked about this yesterday<http://allthingsd.com/20130906/apple-wont-introduce-new-apple-tv-box-next-w…>, but Tim Cook and company didn’t mention Apple TV in any way<http://allthingsd.com/20130910/coming-up-apple-expands-the-iphone-family-at…>. You might assume that this means they don’t think the software overhaul is significant. Or you might argue that they didn’t want to spend much time discussing anything besides their new phones. Note, for instance, that iTunes Radio, which is also in the works, didn’t get any stage time. (Correction: Thanks to several of you who pointed that iTunes Radio did in fact get a brief mention yesterday.) Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: Blackberry: BlackBerry Messenger is coming to Android and iPhone
by Wayne Billing 01 Sep '13

01 Sep '13

…from: http://ca.blackberry.com/bbm.html [cid:059BEA9E-E40E-4578-81F7-FAB7BDC88071@cc.umanitoba.ca] BBMISCOMINGTOANDROIDANDiPHONE Be the first to find out when BBM™ is available on Android™ and iPhone® Email Address * I would like to receive information about your products and services. Privacy Policy<http://www.blackberry.com/privacypolicy> Sign up<http://ca.blackberry.com/bbm.html#>

1 0

FYI: more old JAVA versions blocked
by Wayne Billing 30 Aug '13

30 Aug '13

….from: security-announce-request(a)lists.apple.com<mailto:security-announce-request@lists.apple.com> Today's Topics: 1. APPLE-SA-2013-08-29-1 OS X: Java Web plug-in blocked (Apple Product Security) ---------------------------------------------------------------------- Message: 1 Date: Thu, 29 Aug 2013 14:12:42 -0700 From: Apple Product Security <product-security-noreply(a)lists.apple.com<mailto:product-security-noreply@lists.apple.com>> To: "security-announce(a)lists.apple.com<mailto:security-announce@lists.apple.com>" <security-announce(a)lists.apple.com<mailto:security-announce@lists.apple.com>> Subject: APPLE-SA-2013-08-29-1 OS X: Java Web plug-in blocked Message-ID: <89052771-2BB5-4DB4-A95B-C78C95D4B917(a)lists.apple.com<mailto:A95B-C78C95D4B917@lists.apple.com>> Content-Type: text/plain; charset=us-ascii -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-08-29-1 OS X: Java Web plug-in blocked Due to multiple security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to: Java 6 update 51 Java 7 update 25 More information on Apple-provided updates is available at http://support.apple.com/kb/HT5797 Information on blocked web plug-ins will be posted to: http://support.apple.com/kb/HT5660 Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: One more place to avoid fake Apple-branded products...
by Wayne Billing 30 Aug '13

30 Aug '13

Hint: There are black iPhones and there are white iPhones. There are no blue or purple or yellow or orange or red iPhones….. at least not yet…. (see http://www.macrumors.com/2013/08/29/new-videos-depict-champagne-and-graphit… and http://money.cnn.com/2013/08/28/technology/mobile/iphone-5c/) ….from: http://9to5mac.com/2013/08/29/your-local-mall-kiosk-might-be-carrying-fake-… Your local mall kiosk might be carrying fake Apple products<http://9to5mac.com/2013/08/29/your-local-mall-kiosk-might-be-carrying-fake-…> http://www.youtube.com/watch?v=D8s8CmmCzb4 [cid:730DFE82-A3EA-4C50-8574-CED66479A758@cc.umanitoba.ca] A news report <http://www.wbaltv.com/news/maryland/anne-arundel-county/police-seize-hundre…> out of Baltimore demonstrates the level of counterfeit Apple products that are being sold right under our noses in malls, some of which undoubtedly share space with an Apple Store. Officers said they raided the Cyberion store and the ST Tech Pros kiosk last Friday and recovered hundreds of fake Apple products that were being sold as authentic factory replacements.”These organizations that make these products are using substandard materials. They are doing everything they can to make them look like the real thing,” said Greg Shipley with the Maryland State Police. While this particular bust may have been an isolated incident, if you’ve been to a US mall in the past few years, you’ve likely seen kiosks with fake Apple products. They are everywhere. The items recovered from the Baltimore Mall included: * 24 iPhones and the colored fronts and backings that go with them * Cellphone conversion kits * iPhone and iPad covers * Apple product ID stickers * iPad replacement screens * Various internal iPhone parts. * Packaging materials, equipment used to design and print those materials * Computer equipment believed to be used to clone phones. “Our investigators believe that they were acting as some type of authorized Apple repair shop and they were taking Apple phones and replacing them with interior parts that were inferior, that were fake, that were not Apple products,” Shipley said. According to the report, an Apple representative helped with the investigation by confirming that the products were indeed counterfeit. The estimated value of all the items was more than $89,000. A counterfeit Apple AC adapter is believed to be responsible for the electrocution death of a Chinese woman<https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCwQFj…>. Apple responded to the situation by offering USB power replacements for people who unknowingly bought counterfeits<http://9to5mac.com/2013/08/05/apple-launching-third-party-iphone-usb-charge…>.

1 0

INTEREST: BlackBerry considers spinning off Messenger
by Wayne Billing 27 Aug '13

27 Aug '13

http://arstechnica.com/information-technology/2013/08/blackberry-considers-… BlackBerry considers spinning off Messenger as separate business With BBM due to appear on iOS and Android, service may fare better on its own. by Sean Gallagher<http://arstechnica.com/author/sean-gallagher/> - Aug 27 2013, 3:33pm CDT [cid:4BEF973E-4B7F-44E6-BDA5-2C30FC563132@cc.umanitoba.ca] Coming to Android and iOS soon, and possibly even more—BlackBerry is considering setting BBM free as a subsidiary. BlackBerry Messenger (BBM), the messaging service that has existed exclusively on BlackBerry phones for years, may soon be set (partially) free. According to a report from the Wall Street Journal, BlackBerry is considering spinning off the Messenger service as a subsidiary company that would operate more independently from the Waterloo, Ontario, mothership. BlackBerry is already preparing to release BBM for iPhone and Android<http://us.blackberry.com/bbm.html> and is moving to position the service as a broader social media and communication platform. The Journal reports that the subsidiary, which would be named BBM Inc., would move to offer additional services atop the messaging platform, potentially including a Twitter-like service called BBM Channels and a desktop client. BBM already offers voice chat, and the service would be expanded to offer a video chat feature similar to Google Hangouts and Apple's FaceTime. A BlackBerry spokeswoman would not comment on the report. On August 12, BlackBerry executives announced that the company was undertaking a "strategic review" and that they were considering selling the company<http://arstechnica.com/business/2013/08/blackberry-announces-that-it-may-se…> as one of the outcomes of that review. Operating BBM as a subsidiary would allow BBM to expand development efforts beyond the BlackBerry platform itself, but it would also make the service easier to sell off, fully spin-off as a new company, or potentially raise the value of the whole company in the event of a sale. The timing may be a little off for BBM, however. The number of users of the service has dropped precipitously as the BlackBerry platform has lost market share in North America. BBM currently has about 60 million active users. By comparison, Kik—formed in Waterloo by former BlackBerry Messenger developers—now has over 80 million users<http://business.financialpost.com/2013/08/20/kik-surpasses-blackberry-messe…>.

1 0

FYI: Apple improves AppleCare/Online support
by Wayne Billing 27 Aug '13

27 Aug '13

The new "Contact Apple Support" look by selecting GET STARTED in the "Contact Apple Support" area on the Apple Canada - Support page (http://www.apple.com/ca/support/): [cid:3CECB28F-86D9-4932-9DF0-9649B5D5F73E@cc.umanitoba.ca] …from: http://9to5mac.com/2013/08/26/apple-launches-more-intuitive-applecare-suppo… Apple launches more intuitive AppleCare support website, 24/7 chat<http://9to5mac.com/2013/08/26/apple-launches-more-intuitive-applecare-suppo…> Subscription: 9to5Mac » Feed<http://9to5mac.com/> Published: Yesterday 6:47 PM Author: Mark Gurman ________________________________ Earlier this month, we reported that Apple would soon introduce significant changes<http://9to5mac.com/2013/08/07/applecare-chat-support-to-soon-go-247-new-ios…> to its online AppleCare support portals. In line with our report, Apple has begun rolling out a redesigned Applecare website to provide support and has also begun rolling out 24/7 live chat support. The new AppleCare website is easier for users to follow and it groups product categories in more understandable fashion. The new support site also makes it simpler for customers to identify the exact issues with their device. The updated site also is designed with a focus on connecting customers directly to an AppleCare support employee. Customers can easily schedule a call, in-store Genius Bar appointment, and access live chat support. On the topic of live chat support, we’re told that 24/7 chat support<http://9to5mac.com/2013/08/07/applecare-chat-support-to-soon-go-247-new-ios…> has begun rolling out. Initially, the support was limited to certain hardware and software, but now Apple is supporting both Mac and iOS Device support at every hour of the day and night. While the new AppleCare site has begun going live for some readers, other users are reporting that they are still seeing the old website. It is likely that Apple will complete the release of the redesign in the coming days.

1 0

FYI: Ever wanted iWork for iCloud(beta)?
by Wayne Billing 24 Aug '13

24 Aug '13

At the last World Wide Developers Conference (WWDC) Apple announced that the iWork products - Pages, Numbers, and Keynote - were now available (in beta form) for iCloud; in your web browser…. for OS X and Windows. Initially access was restricted to developers or by invitation but Apple seems to have extended access to anyone with an Apple ID. Keep in mind it's still beta so some things may not be as you've experienced in the previous products but the expectation is that the full functionality will eventually be available on all platforms supported by Apple and Microsoft using Safari, Internet Explorer, or Chrome. Here's the WWDC introduction: http://www.youtube.com/watch?v=z4AXS015O5E If you don't yet have an Apple ID or want more information about Apple ID's: http://www.apple.com/support/appleid/ …..from: http://www.engadget.com/2013/08/23/iwork-for-icloud-beta-open-to-all/?utm_m… iWork for iCloud beta now open to anyone with an Apple ID By Jamie Rigg<http://www.engadget.com/about/editors/jamie-rigg/> posted Aug 23rd, 2013 at 7:21 AM78 <http://www.engadget.com/2013/08/23/iwork-for-icloud-beta-open-to-all/?utm_m…> ________________________________ [iWork for iCloud beta now open to anyone with an Apple ID]<http://www.engadget.com/2013/08/23/iwork-for-icloud-beta-open-to-all/> First it was available to developers<http://www.engadget.com/2013/06/10/apple-unveils-iwork-for-icloud/>, then a select few who received invitations<http://www.engadget.com/2013/07/19/apple-sends-iwork-for-icloud-beta-invita…>, and now the beta of iWork for iCloud is available for all. Apple's made no official announcement, but point your browser to icloud.com<https://www.icloud.com/>, punch in your Apple ID details, and there you have it: Pages, Numbers and Keynote. Seeming as you normally have to pay for the iWork software suite, this could be a time-sensitive public beta that'll be pulled once you've found all the bugs (this editor has full access without owning any of the iWork programs). So, you might as well have a go at being productive in the cloud before it's too late.

1 0

FYI: iMac (27-inch): AMD Radeon 6970M Video Card Replacement Program
by Wayne Billing 19 Aug '13

19 Aug '13

While Apple has an "Exchange and Repair" web page (http://www.apple.com/support/exchange_repair/) where they list current repair and exchange programs, the following "video card" item hasn't made it to that page yet: ….from: http://support.apple.com/kb/TS5167 iMac (27-inch): AMD Radeon 6970M Video Card Replacement Program Symptoms Apple has determined that some AMD Radeon HD 6970M video cards used in 27-inch iMac computers with 3.1GHz quad-core Intel Core i5 or 3.4GHz quad-core Intel Core i7 processors may fail, causing the computer’s display to appear distorted, white or blue with vertical lines, or to turn black. iMac computers with affected video cards were sold between May 2011 and October 2012. Resolution If your iMac has an AMD Radeon HD 6970M video card and is exhibiting any of the issues described above, choose one of the following options to arrange to have your iMac evaluated: * Apple Retail Store: Set up a Genius Bar<http://concierge.apple.com/reservation/us/en/techsupport/> appointment. * Apple Authorized Service Provider: Find one here<https://locate.apple.com/>. * Apple Technical Support: Contact us<http://support.apple.com/kb/HE57> for local service options. Before you go in for service, please back up your data. Learn more about backup options<http://www.apple.com/support/backup/>. If the iMac (27-inch) meets these requirements, Apple will replace the video card free of charge for three years after the first retail sale of the computer. Additional Information If you believe you have paid for a repair or replacement due to this issue, contact Apple<http://support.apple.com/kb/HE57> regarding a refund. This worldwide Apple program does not extend the standard warranty coverage of the iMac. Apple will continue to evaluate service data and will provide further updates to this program as needed. Last Modified: Aug 17, 2013

3 3