Man-in-the-Middle exploit discovered

A new exploit was recently discovered whereby requests to servers using unencrypted access (http://, instead of https://) could be redirected, allowing them to read packets, access credentials and gain access to other devices. The full post describes this is more detail, but the gist of it is try to use encrypted means whenever possible, especially when a potentially hostile environment – airport, coffeeshop, etc.

Fortunately, to correct this situation is fairly straightforward:

Applications > Utilities > Open Terminal app
verify vulnerability:
sysctl net.inet.ip.redirect | grep ": 1" && echo "DoubleDirect: VULNERABLE" || echo "DoubleDirect: SAFE"
If you see ‘Vulnerable’ then
sudo sysctl -w net.inet.ip.redirect=0
enter your password
verify fixed:

sysctl net.inet.ip.redirect | grep ": 1" && echo "DoubleDirect: VULNERABLE" || echo "DoubleDirect: SAFE"
should see ‘Safe’

MacBUS April 29 Meeting

Dalo's World2Dale Fletcher will present
Use Digital Photos for Documenting

Time details, location details, equipment details, creating PDF’s. Equipment specifications, confirmation of delivery, condition of products. Practical uses of each type of details.

TOP 10 MALICIOUS EMAIL ATTACHMENTS


for August included four “ransomware” programs, which aim to extract money by locking victims’ files or falsely warning they’ve been viewing illegal material.
The ransomware programs block “the work of the operating system and display a banner that gives instructions on how to unblock the computer. For example, the user is told to send a text message with a specific text to a premium-rate number,” the analysts wrote.
Two other very old email worms, Bagle and Mydoom, also made the top 10. After infecting a computer, Bagle infiltrates a person’s email contact list and sends itself out repeatedly. It was the third-most-common malware in August even though it was also discovered in 2004.
Two variations of Mydoom took the eighth and tenth places. Like Bagle, Mydoom also collects email addresses from infected computers and emails itself.
Phishing attacks rose tenfold, Kaspersky said, but still only amounted to a tiny fraction of overall spam, at .013 percent. Apple was one of the main phishing targets.
“We frequently came across emails that supposedly came from the official address of the company, but which in fact were phishing messages designed to deceive users and steal their logins and passwords,” Kaspersky wrote.
Some of the phishing emails, which purported to come from the “Apple Security Center,” warned users that their accounts had been frozen and that they have 48 hours to confirm their details.
Users are instructed to click on a link in the fraudulent email. “However, both the request to confirm the account information on third-party sites and the absence of a personal address should alert users to the risk of fraud,” according to the post.