If your question pertains to a specific protocol, e.g., ssh or ssl (https), please use that tag instead.

learn more… | top users | synonyms

3
votes
6answers
1k views

Can bash be replaced entirely in OS X?

Because of CVE-2014-6271 and CVE-2014-7169 on OS X I was wondering: can bash be replaced entirely by another, non-affected shell (eg dash or others)?
4
votes
1answer
343 views

How to mitigate Bash risk while waiting for a patch (sans a recompile)?

This is related to How do I recompile Bash to avoid the remote exploit CVE-2014-6271 and CVE-2014-7169?, Are Macs vulnerable to the Bash shellshock bug? and Are Bash, Bourne, and Korn shells compiled ...
3
votes
1answer
418 views

My MacBook Air is automatically connecting to a password protected network that's not mine!

I'm starting to think I've been hacked because my Macbook Air is frequently jumping to a neighbors password protected network on its own! I see the network in the "preferred network" list and I don't ...
49
votes
5answers
27k views

Are Macs vulnerable to the Bash shellshock bug?

Red Hat recently announced a major security-related bug in the Bash shell. Some are calling it the "shellshock" bug. Since OS X is built off of Unix, is it vulnerable to attacks that exploit this bug? ...
336
votes
7answers
245k views

How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)?

Given that Bash 3.2 (the version shipped by OSX) is vulnerable to the remote execution exploit known as "Shell Shock" (CVE-2014-6271 and CVE-2014-7169) how do I rebuild Bash and secure my system ahead ...
0
votes
1answer
193 views

Can I turn off my Guest account and still use Find My Mac?

I understand that turning on Find My Mac also turns on a "Guest" account (in "login only" mode). For a variety of reasons, I would prefer not to have an enabled Guest account at all. Does Find My ...
1
vote
1answer
447 views

Why is a secure erase 'not necessary' for SSD's?

I'm about to trade in a 2010 MacBook Pro with an SSD. However, I'm unable to do a Secure Erase from the recovery disk (as I used to do with mechanical hard drives before selling or giving away a ...
4
votes
5answers
2k views

Is there a way to find out when a USB flash drive has been last used (on any computer)?

I have a USB flash drive and I believed someone else may have plugged it in their computer and copied some files. Using my Mac, how do I know when was the last time my usb flash drive was plugged ...
1
vote
1answer
330 views

Stolen mac locked automatically or by thief?

My MacBook Pro was stolen a few days ago. I have a lock on the start up screen requiring a password anytime the laptop comes out of sleep mode, however when I attempted the "Find My Mac" app, it says ...
2
votes
0answers
80 views

How to add a process to sandboxd's configuration?

I have a particular process that is having some problems writing to the /private/tmp folder. sandboxd keeps emitting the following error: sandboxd[xxx] ([xxxxx]): process(xxxxx) deny ...
0
votes
1answer
39 views

Confusion with sudo and multiple local accounts

I am having difficulties figuring out why certain things are much more complicated on a mac terminal than a standard linux shell.. Say I have two local accounts, one administrator called "adm" and a ...
0
votes
1answer
53 views

Apple Mail is trying to use certificate and won't send without

I created an account on a website and they installed a certificate on my machine for authentication. I'm not sure how this technically works but the certificate is somehow linked to my GMail address. ...
0
votes
0answers
73 views

Where are Internet Recovery system files stored?

I have just erased all data on my MacBook Air hard drive and reinstalled OS X using Internet Recovery. As you already know, recent Mac computers have Internet Recovery system which enables users to ...
2
votes
2answers
989 views

Can someone who's gained access to my iCloud account prevent me from receiving text messages?

Can someone use my iCloud account to prevent me from receiving messages on my devices from specific people? I can get calls from a particular person but no text messages for a few days now.
0
votes
1answer
47 views

iPhone lock time not showing showing all options

On my iPhone running iOS 7, I can only set auto-lock times of up to one hour. My son's can have an auto-lock time of up to three hours, and there's no obvious difference between our two phones. ...
12
votes
2answers
4k views

Where does Apple's predictive keyboard get it's “contextual” content from?

So I was playing around with the iOS 8, when I notice that upon typing "new" anywhere, the predictive keyboard suggests the term "NewTerm". I recall using this word in a tweet, so I brushed it off. ...
0
votes
0answers
569 views

Keeps promoting me for icloud password when i enter it it's incorrect and the account is locked

Every so often on my phone it pops up saying "enter icloud password" when I enter it correctly it says the password is incorrect so I go onto I forgot and enter my icloud email address and answer by ...
1
vote
2answers
141 views

How long is it safe to use iOS 7? [closed]

I have an iPhone 4. I would like to know: since iOS 8 is not going to work on the iPhone 4, when should I be worried about the security of my device, since iOS 7 will eventually cease to be supported ...
4
votes
2answers
3k views

Where is the “Send all traffic over VPN connection” setting in OSX 10.9 Mavericks?

I'm attempting to change the settings of a Cisco IPSec VPN connection which was set up through OSX's built in VPN client in system preferences. The VPN functions as expected, allowing me to access ...
-2
votes
2answers
44 views

Password-restricting access to any application on an iOS device?

Ok I have a iPhone and I would like to know if there a way to restrict access, via a password, to any application installed on the device? For example: if I wanted to access a specific game or the ...
0
votes
2answers
945 views

Why do I need to “bypass” 169.254/16?

In my MacBook's networking proxy settings I have "169.254/16" among the list of domains for which to bypass proxy settings: What purpose does this serve and why do I need it? Can I get rid of it?
1
vote
1answer
333 views

How do I disable “iTunes Home Sharing”?

Whenever I launch iTunes, I see my computer appears listed among those offering Bonjour services (e.g., by iStumbler), with an entry for "iTunes Home Sharing" even though I have unchecked "Share my ...
0
votes
0answers
23 views

Why do my account settings (seem to) change after migration?

Prior to a recent Mavericks-Mavericks migration using Migration Assistant I had additional password security related options which are absent after the migration. In Security & Privacy > General ...
0
votes
1answer
71 views

OS X 10.9.4 - How can I limit the number of failed login attempts?

With OS X 10.9.4, how can I limit the number of failed local login attempts? I'm looking for something similar to the Windows Account Lockout Threshold mentioned here: ...
1
vote
2answers
2k views

Does apple automatically sign out all connected devices when you change the apple id password?

Yesterday, I got a bunch of emails from Apple, sent to one of my unused gmail addresses (which still has forwarding to my regular one). I do NOT have an appled ID associated with that address, but it ...
1
vote
0answers
120 views

mdflagwriter using port 21?

I have a 17" mid 2010 MBP with 8GB ram. After reading up on some of the latest vulnerabilities, I did a port scan and found port 21 OPEN vs stealth for all other ports. I cannot figure out what is ...
2
votes
1answer
61 views

Can I find out if my employer is snooping on me?

I work at a large university and have a computer supplied by my employer. There is apparently some sort of remote management that the help desk can use if I call them and accept their request to log ...
0
votes
2answers
63 views

What security settings should one use with Keychain?

I'm a new to Mac and found that Keychain has gathered quite a lot of passwords so far. I'm concerned about the security of these data, and I would like what security settings would you recommend so ...
1
vote
1answer
72 views

How to create a recovery key for an encrypted disk image?

FileVault 2 is computing a recovery key when I decide to activate this security mode. This recovery key is a mandatory safety belt when someone wants to use serious cryptography. Is it possible to ...
-6
votes
3answers
244 views

Forgot password and only know my birthdate to reset me password

I lost my work phone (an iPhone 4S) today, and I have no idea what the password is or what the security answers are. I only know my Apple ID and and birth date. Is there any way around this so I can ...
0
votes
1answer
37 views

Enable flash player audio access in safari for a website permanently

I get this request every time I try to use the microphone on the same web page. Is there anyway to set this so it stops asking for this domain. I understand the security ramifications; however I ...
1
vote
1answer
83 views

Apps Stuck in Security & Privacy > Accessibility

I was messing around with using AppleScript for GUI manipulation so the apps I was making had to be granted access. The very first one I did showed up in Security & Privacy > Accessibility as ...
2
votes
1answer
783 views

My iPhone is protected by password, is it possible for the thief to restore factory setting?

I quickly activated lost mode in find my iPhone. I worried that the thief managed to restore factory setting before I do that. The thing is before I put lost mode, I disable the 3G dataplan following ...
1
vote
1answer
298 views

iMessage sharing and changing AppleID

My husband and I recently split up. Both our phones and both our iPads were all on his Apple ID. Would I be notified on my phone if he were checking my iMessages? I have recently created my own Apple ...
1
vote
1answer
74 views

Suppress Java warnings

I'm using a website with a Java plugin (applet I think) that prompts me everytime I use it to access the local file system. These are the two pop ups: and: I already have the site in question ...
1
vote
2answers
67 views

Detecting malware in panic reports

Is there a way to identify kernel modules that shouldn't be there out of a panic report? For example, looking at this discussion https://discussions.apple.com/thread/2778885, there it was pretty ...
1
vote
1answer
53 views

Is using 10.8 (over 10.9) a security risk?

Is 10.8 currently (as of 2014 Aug) fully supported, especially security-wise, or using it might be a security risk?
2
votes
1answer
472 views

How to always allow “[program] wants to make changes. Type your password to allow this.”

I use a program which prompts me often to "make changes" (make a system-level/root-level change). I trust this program and want to always allow it to do so. How is this done? I would expect an "always ...
1
vote
1answer
359 views

If I didn't activate my find my iPhone is it possible for the thief to reset factory settings?

I just got my iPhone stolen. I quickly turn on find my iPhone. I wonder if before I did that the thief have reset factory setting first. Is it possible? It seems that the mere act of setting my ...
1
vote
0answers
13 views

User permissions prevent me from loading the Security & Privacy settings — how do I fix this?

I can't seem to load the System Preferences > Security & Privacy settings pane. I inadvertantly changed admin settings on my machine and since then I've been unable to access my documents and ...
1
vote
0answers
94 views

Non-extractable private key in Keychain Access.app

The manual page for /usr/bin/security on OS X 10.9 indicates that there is a -x option for security import to specify that private keys are non-extractable after being imported. How is this ...
0
votes
0answers
19 views

Why doesn't Apache show up under Firewall (System Preferences » Security)?

Why doesn't Apache show up under Firewall settings, and are there other programs that aren't showing up here? (outside of those that are inclusive of "basic internet services", e.g. DHCP, Bonjour, ...
1
vote
1answer
187 views

How to securely delete individual files (documents) on the iPhone?

My understanding is that when files are deleted on a computer (and here, I am considering the iPhone a "computer"), those files are typically recoverable using forensic tools. I know there are easy ...
0
votes
0answers
172 views

Getting verify certificate errors after adding Google Account & iCloud keychain problem?

I keep getting a verify certificate error whenever I add my Google Account. The domina is an old company I used to work at and I have removed all account in reference to that account. However I get ...
5
votes
1answer
99 views

How to enforce sandbox rules for the particular app?

I wrote an sandbox specification file (inspired by files from /usr/share/sandbox and manuals like this) and now I can launch some app in sandbox with sandbox-exec $path_to_rules ...
1
vote
0answers
130 views

My iPhone got stolen and appears offline

Okay, so I lost my iPhone 4s last night and it appeared as offline immediately upon signing on to Find My iPhone. I placed it on Lost Mode right away. I got an email that my Apple ID password got ...
0
votes
0answers
117 views

iPhone acting on its own

Something weird was happening with an iPhone when we used it with a 12V output, it started to do thing (press the screen) by it self. The power setup was like this: Solar power battery 12V to 220V ...
0
votes
0answers
110 views

Using custom Certificate Authority for SSL websites with Safari on OS X 10.9.4

I have followed the directions here (http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/) to create a CA and SSL certs signed by the CA for my own internal websites. ...
0
votes
0answers
58 views

How do I import a SMIME certificate and automatically set the Keychain trust?

We are deploying SMIME certificates to all clients and we need to ensure that these certificates are only trusted for email. Given that our users are "unmanaged" and off the corporate network, how ...
1
vote
2answers
313 views

Is there an actually secure VNC iOS app for use with OS X Screen Sharing?

All iOS VNC clients I have tried use regular VNC authentication. This is insecure because of the 8 character limit on the password, and so on. Some apps such as RealVNC's VNC Viewer, does have info ...