Tag Info

New answers tagged

1

Here is what is going on with missing reset password with Apple ID. FileVault 2-enabled Macs will not show a "Allow user to reset password using Apple ID" How to in FileVault is described here. Since you are NOT using the Apple ID password recovery feature (it is not enabled) your FileVault password is NOT vulnerable to it. It can not be used on ...


0

Check the "System Binaries" section of this answer. It works for 10.6.8, assuming you have Xcode installed. http://apple.stackexchange.com/a/146851/96606


0

My previous response confirmed that the status had not changed since June (4 months ago). I also confirmed that the problem still exists in Yosemite. ie this is still an open issue without a known resolution. I've looked a bit further into this issue. The current version of CrashPlan is 3.6.4. To resolve this issue: - Download the current version - ...


1

Bonjour advertising can be disabled by following the steps listed at "How to disable Bonjour service advertising": Make a back up copy of the mDNSResponder.plist file as a precaution. Open the mDNSResponder.plist file in Terminal using your preferred text editor. Here is a sample command: sudo nano ...


0

You can completely reset network settings under Settings > General > Reset.


3

Bluetooth needs to be in advertising (aka “Discoverable”) mode for Yosemite's Handoff to work. To disable Handoff in Mac Yosemite: Select System Prefs > General and uncheck "Allow Handoff between this Mac and your iCloud devices".


0

You have some app on the App Store who provide you a lot of way to lock your Mac. Like this one : https://itunes.apple.com/fr/app/lock-me-now/id464265594?l=en&mt=12 Or this : http://www.knocktounlock.com [Lock and unlock your Mac with your iPhone bluetooth]


0

My Windows 7 Home Premium had popups appearing and disappearing in a flash after reinstallation. The mysterious popups went away after I turned Windows Firewall on.


3

You can limit access to specific apps via the Parental Controls in: System Prefs > Users & Groups > Guest User then click the Open Parental Controls. It may take some configuration to get all the services working. But I've logged into guest having disabled Little Snitch and it hasn't opened. It worked fine when I logged back into my account.


0

Here is a patch, which is renaming Google Chrome/Chromium inside startup file and placing a script for calling browser with --ssl-version-min=tls1 parameter. No wrapper needed.


0

There is another piece of software similar to RedHand called Watchmac (from bloo7). I suggest you try using Watchmac as a work-around to this issue.


0

This seems to work: defaults write com.google.chrome org.chromium.ssl.ssl3 -bool no


1

You can't see the link as you only get a few attempts at getting the answers correct. Apple Support Document If you can't reset your security questions Contact Apple Support in either of these circumstances: You don't see the link to send a reset email, which means you don't have a rescue address. You see the link to send a reset ...


0

First double check with your hubby if the call came from your FaceTime. If it was, and you have no records, then do reset your account (new strong password would be good).


4

No, The app doesn't expose past actions and events to users. You should check that your AppleID is emailing an email address you control since erase and lock events trigger an email to the email on record for admin changes / security at https://appleid.apple.com There might be server logs and if you are really interested in knowing who erased your phone, ...


0

I'm an idiot! Just having the "LoginwindowText" key set to a string value is all you need! My "problem" was two-fold: The GUI won't display the checkbox as "checked" until you log out and back in. I had a typo in the key name in some of my notes that I was copy-pasting from. Hope this helps somebody else... I spent some serious time banging my head ...


0

A man in the middle attack can also be performed using sslstrip which can easily strip the ssl from https, making it an http connection, intercept all the data and use a fake certificate to re-enable the ssl before sending it out to the destination. In simple words that's the idea. The user will never know what even happened to him/her. This was showcased ...


-1

There is currently no information on whether this update will appear via the built-in App Store update mechanism - as described by patrix in the comments on the original question: "Nobody knows because Apple doesn't publish any update/patch strategies, and any other possible answer will not be backed up by facts".


2

Will this update (eventually) be applied automatically via the App Store, or do I have to apply it manually? As I explain in my answer on the question you link to, Apple has released patches you can download & run yourself. You do not have too compile from source or be deeply technically capable to run them. Just download the one appropriate for ...


0

There is a patch for Mountain Lion, see http://support.apple.com/kb/DL1768.


0

Popmoi, the last login on console is exactly that: Somebody (likely you) logged into a bash session on your computer at 2:02:18 on Sep 30. Generally, 'console' is shown for the first shell login and then ttys000 would be the next. I see this every login/reboot for my Terminal group, which opens two bash sessions in different tabs.


1

If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing: http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html At the time of writing (Sept 30) they've ...


0

Apple has quietly dropped support for Snow Leopard and earlier versions. This page has various means of helping you to compile your own version should you wish to do so: How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)? There is a lot of attention on all the posts on that page. Read it all and find the ...


10

For anyone struggling with compiling from source, as of September 29th, Apple has officially released patches for Mac OS X 10.9.5, 10.8.5 as well as 10.7.5: OS X bash Update 1.0 – OS X Mavericks OS X bash Update 1.0 – OS X Mountain Lion OS X bash Update 1.0 - OS X Lion


-6

You can follow the instructions here: https://github.com/tjluoma/bash-fix Basically, do the following in a Terminal: curl -s https://raw.githubusercontent.com/tjluoma/bash-fix/master/bash-fix.sh | zsh -f


0

You could possibly try recompiling bash yourself using this link. It patches the vulnerable bash version, but the new version is not signed by apple and could possibly break things.


1

I would advise against making the Homebrew installation of bash your system-wide bash or sh command. However it should be fine to use as your personal shell. Homebrew provides a vanilla installation of Gnu Bash. You will be missing any Apple additions to the shell that are provided if you use the Apple-supplied bash or sh binaries or source code from ...


2

I made this tool as soon as I heard about this vulnerability. It'll provide you with a link to a article to patch your shell if the tool determines you're vulnerable. Requires Mac OS X 10.6 and up.


1

Yes, you should. Even in the very worst case, you're trading a known-exploitable version of a program for one that is theoretically exploitable only by whoever crafted a potential back door. Tons of people know about the current problem and can use it against you right now, but presumably few people know about this hypothetical back door that may not even ...


0

Yes, if you mean as /bin/sh, but it could be problematic, but if you want to replace bash as /bin/bash or remove bash entirely, basically no, though it's not impossible --since, scripts are text files, you could edit every shell script, and then maintain the system yourself, by yourself, for the rest of time... There is no drop-in-replacement for bash. ...


1

All Mac OS X machines are technically vulnerable to “Shellshock,” until Apple issues a security update that patches bash, but.. Your question should be: Can I be hacked remotely? There is so much software that uses bash absent-mindedly that answering that question is extremely hard. If you're worried then I'd suggest several changes in System ...


4

Macs don't use Bash for DHCP, so that particular vulnerability does not apply. Unless you run a vulnerable web server or have restricted remote access accounts, it's not worth the trouble to recompile Bash on OS X.


2

Obviously you joined neighbors network once upon a time. Since you have the "Remember networks this computer has joined" Enabled, it will remember it. Find it and delete it in networks - advanced, or just delete both and next time reconnect in the coffee shop, but do not connect to Free WiFi if showing up when at home. The fact that they have the same ...


3

As an end user, check that: your guest account is off: System Preferences > Users & Groups > Guest User your ssh access is off: System Preferences > Sharing > Remote Login By default these are both off on Mavericks. As an end user, it is safer to wait for an official Apple security update fixing this bash vulnerability.


3

As @webmarc said, no. You can replace /bin/bash with some other shell but you will certainly break some programs because bash has several differences in his syntax that made it incompatible. I couldn’t find a bash-compatible alternative shell. However I symlinked dash to /bin/sh and found no issues so far. Regarding the DHCP here there is a proof of concept ...


-1

First, patching bash and sh for this vulnerability is likely to break some scripts on your Mac. You really don't need to do this unless you are are offering web services to the public internet directly from your Mac. So if it is really not necessary, wait until there is an official security update from Apple. Being warned, here are some instructions on how ...


5

First, you don't need to do this unless you are are offering web services to the public internet from your Mac. If you are not, wait until there is an official security update from Apple. However, if you are offering web services, you might want to update. Official Patch Apple has released an Official Bash Security Update Here Checking whether you are ...


0

some sites indicate one could be infected via a DHCP client. This does not apply to OS X. On Linux systems, a shell script is usually called after receiving a DHCP lease from the server. This is not the case on OS X. Unless you're running a web server on your Mac which serves CGI scripts, you have little reason to worry.


1

Unfortunately, no... various shells have differing syntaxes making the scripts written for one shell possibly incompatible with another shell. I haven't seen the DHCP based infection you're speaking of, can you provide a link in your question?


1

dash contains only a tiny subset of the commands found in bash and even sh (which itself is a sub-set of things in bash). Replacing either with dash will surely yield inoperable scripts on your system and possibly break your system more than it protects your system. You can recompile bash to mitigate some (at the time this was written) of potential danger ...


5

Wi-Fi passwords are synchronized via iCloud keychain. That's why your iPhone also knows the password. Try deleting this network from Preferred Networks. Also delete item from your keychain. In Keychain Access.app select iCloud keychain, find the item with the SSID (network name) of your neighbor's network and remove it (Right click -> Remove).


11

NOTE regarding the official Apple OS X bash Update 1.0: This software update only brings the official Apple bash version to 3.2.53. The 3.2.54 patch revision offers the following change: This patch changes the encoding bash uses for exported functions to avoid clashes with shell variables and to avoid depending only on an environment variable's ...


42

Yes you are technically vulnerable. So if you feel like panicking or billing a panicked client for a few hours of panic work, go for it! But the reality is unless you allow SSH access from remote connections or a web server that runs server side scripting, you are not at risk. You are only truly vulnerable if someone you do not know can remotely access your ...


33

Yes! Type this in your shell env x='() { :;}; echo vulnerable' bash -c 'echo hello' If it says vulnerable then you are vulnerable. If it says bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' hello then you are good. Edit: link to the fix


13

Macports This gets you a bash version 4.3.28(1) which patched both vulnerabilities (CVE-2014-6271 and CVE-2014-7169) as well as some subsequently discovered ones. This is useful if you have changed shells to use Macports bash to get the version 4 features. It will not solve the issue of standard OS scripts as the have #!/bin/sh or #!/bin/bash as the first ...


0

OS X 10.6.8 - Snow Leopard The post of @AlBlue is very complete. However, on my OS X 10.6.8 server his fix will not work. Apple has no fix for 10.6.8 and the steps explained by @AlBlue do not work with Xcode 3.2.6 (which is the latest version for Snow Leopard). I recieve an error: ** BUILD FAILED ** The following build commands failed: sh: CodeSign ...


401

Status Apple has released Bash security fixes for Shellshock and related vulnerabilities as "OS X bash Update 1.0". They can be installed through normal system update for people using OS X Mountain Lion v10.8.5 or OS X Mavericks v10.9.5 (they are included in Security Update 2014-005) and can also be installed manually. Official Apple fixes are also ...


3

Yes, it will still function without the guest account. However, in order for Find my Mac to locate your Mac, the Mac needs to be connected to the internet. If your account is secure and your Mac is stolen, presumably the thief would not know your password, and so wouldn't be able to login and join a WiFi network. Leaving guest access enabled allows them ...


1

The problem that I see with "almost every article" is that they're 3-4 years old. Some of them even mention attempting degaussing the drives as a means of clearing out data. That implies a lack of understanding of how Flash storage works in the first place. Seriously. Degaussing? "ATA Secure Erase" is a means of telling the drive to zero out all the blocks. ...



Top 50 recent answers are included