First iWork ‘09, now Adobe PhotoShop CS4. Both software packages have been found BitTorrent sites and contain a trojan horse which creates a backdoor with root privileges. The difference is that the trojan that comes with Adobe PhotoShop CS4 is not installed via the app, but instead via a “crak” app that comes with it [...]
Read the rest of this entry »

ATM skimmers are now being manufactured with the ability to send to the thief an SMS message containing all skimmed card data, thus greatly reducing the risk of the thief getting caught retrieving data from the skimmer. For those who don’t know, an ATM skimmer is a device that is inconspicuously mounted over an ATM’s card [...]
Read the rest of this entry »

Nick Wingfield with The Wall Street Journal gets confirmation that a plan is in place for Apple to remotely kill certain iPhone / iPod touch applications if they are found to be malicious. Mr. Jobs confirmed such a capability exists, but argued that Apple needs it in case it inadvertently allows a malicious program — one [...]
Read the rest of this entry »

Security Update 2008-005 fixes the BIND DNS cache poisoning vulnerability by updating BIND to 9.4.2-P1(Leopard) and 9.3.5-P1(Tiger). Also of note, this update addresses the OSA privilege escalation issue by not loading scripting addition plugins into applications running with system privileges. Other items affected by this update include CarbonCore, CoreGraphics, Data Detectors Engine, Disk Utility, OpenLDAP, [...]
Read the rest of this entry »

Apparently, the Aurora Feint game would send your contact list unencrypted to the company’s servers. Hopefully the developers will fix this properly and get their game back in the App Store.
Read the rest of this entry »

Dino Dai Zovi has a fairly comprehensive list of the security-related features he hopes Snow Leopard will implement. Real ASLR (address space layout randomization). Full use of hardware-enforced Non-eXecutable memory (NX). Default 64-bit native execution for any security-sensitive processes. Sandbox policies for Safari, Mail.app, and third-party applications. Mandatory code signing for any kernel extensions. Read the rest of the article for [...]
Read the rest of this entry »