macOS Annual Update Is Planned Obsolescence

Welcome to my battle with Apple and their operating systems.

Ever since OS X 10.7 Lion, which was released on July 20, 2011, Apple has released one operating system each year, leading us to 2017, when Apple released their most recent operating system, macOS 10.13 High Sierra on September 25, 2017.

 Release date of each operating system located in far right column

Release date of each operating system located in far right column

One thing that has been nice is the fact that we've seen something new every year, with new features, new functionality designed to make your experience better, and everything in between. 

This idea, however, does have many downfalls, and it is not discussed nearly enough. It seems to be that only people interested in Apple's security see the flaws.

See, the entire reason behind new operating systems is not just to have cool, new features. It should be largely in part to making the operating system, and its fundamentals, better. Better by being more secure, harder to exploit flaws, more testing prior to release, etc., etc. 

This is not how we've seen Apple react in the past seven years, with the rushing out of operating systems. Because of this, we've seen horrifying flaws in the operating system that allow unauthorized root (administrative) access simply by clicking an empty box three times. Even worse, Apple's macOS doesn't provide a bug bounty program, which the majority of high-end companies due. This means that if you are a security penetration tester or researcher, and you find a flaw in a system, you disclose it to said company following the proper disclosure guidelines, and they pay you for finding an issue. Apple doesn't have that program, which means that if you've spent time finding a bug in Apple's operating system, there is very little incentive to go through the proper disclosure methods. This is why some of Apple's serious flaws have just been exposed via social media.

Again, these are very fixable problems for Apple. Provide a bug bounty program, and focus more on the quality of the new operating systems instead of quantity. Quality over quantity every time!

Let's take a look at Windows, whose operating systems seem to be much more exploitable than Apple's operating systems. They released, arguably, their most stable operating system, Windows 7, in October of 2009. Many, many companies and end-users still use this operating system today. Windows 10 was released in July 2015, closing in on three years ago. Microsoft, although issues with operating systems, partially due to how hard they are targeted by malicious content, only releases operating systems, roughly every three years.

Apple is always striving to "raise the bar," according to CEO Tim Cook. However, what they are doing instead, is rushing out incomplete, hastily thrown-together operating systems that are loaded with issues.

So why does Apple do this? Is it simply because they are trying to "raise the bar?" No, I don't think that for one minute.

I'm sure many people, who own iPhones especially, have heard the phrase "planned obsolescence." It's a frightening term when you think about it. The idea is, in this case, that Apple rolls out new products and operating system each year with the idea that your device, which may be only two years old, is approaching obsolescence. In Apple's eyes, and this is 100% accurate, hardware, whether it be an iPhone, iPad, MacBook, iMac, or anything else, is considered obsolete after five years passed the release date. An example is that computer constructed in 2011 are now considered obsolete. Now that may not be a big deal, except when it comes to getting your device serviced by Apple. Obsolete machines no longer have parts created by Apple, which means Apple will no longer service them. It's sad, depressing, and surprising for a Fortune 500 company. You don't see this in any other company, that comes to mind, that does this.

Screen Shot 2018-02-11 at 6.04.53 PM.png

In an anonymous poll conducted, consisting both of end-users and people employed in the information security sector, over 75% of people surveyed believe that the quick, almost unreasonably fast production of Apple products is due to this idea of planned obsolescence. Whether this is true or not, Apple should at least respond to that accusation, as I am definitely not the first person to propose this.

I used to think that Apple just wanted to continue to roll out products, and because of their enormous product line, they had to quit production of certain pieces of hardware. The more I look at it, and the more I study the Mac operating system, the more I believe that planned-obsolescence is actually a large reason for this bizarre reasoning behind releasing operating systems and Apple hardware each year. What they should do instead, is try to be certain that users can't unlock App Store preferences without administrative privileges. This is what happens when products aren't properly tested and ran through extreme vetting processes before their release. Yes, they release a public beta, but I don't think that's enough when the engineers only had a year to make it.

I worry that Apple's planned obsolescence may one day be its downfall. It's operating system is still, in my opinion, the most complex and stable operating system, when compared to different Unix operating systems like Linux, or when compared to the Windows platforms. If you've had issues with your computer, please let me know. I'd be happy to speak with you about it!

Strava Endangering the Military Accidentally

 Corvallis, Oregon on the Strava Global Heat Map

Corvallis, Oregon on the Strava Global Heat Map

It was once outlandish to think that robots would learn from humans, and then take over the world. Seems pretty silly, right? 

As time goes by, we see advancements in technology. Many of them are for the good of the country, whether it is advancing medical equipment, vehicles that don't emit carbon, and the list goes on and on.

We do, however, see that technology to a certain extent, can actually put human lives at risk.

The fitness company Strava, who dubbed their own motto "The Social Network for Athletes," recently updated their website to reveal a new, updated Global Heat Map, showing where people around the world are exuding the highest heart rates during exercise or  the highest rates of speed. I imagine Strava was imagining this map being a motivational tool for people to get out and exercise, but what we've seen with their recent publication is actually horrifying. 

strava fitness raf mount pleasant.png

You can just take a look at Interstate-5 and see how "busy" it is. That's not frightening. You know what is? That you can look at a top-secret United States military base in Syria and see exactly where the soldiers are running due to the fact that they left their fitness apps open. This also reveals some odd amounts of traffic, whether it be foot or vehicular, in places like Royal Air Force Base Mount Pleasant (pictured left). Not only can you see the main roads entering and exiting the compound, you can also see some of the smaller, more rural roads. For people fighting against America, whether it be a foreign power like North Korea, or a terrorist organization, like ISIS, this information can be vey useful.

We don't just see this in our home country. We can see our military bases from around the world. Take for example the picture below. You can clearly see some of the main FOBs (Forward Operating Bases) in Afghanistan.

fobafghanistan.jpeg

You can't tell me that it isn't creepy what you can see. It's like when consumers first started realizing that you could actually see people committing crimes on Google Earth. It's technology catching up and passing the humans. 

As a fan of thriller novels, this is the stuff that can make nightmares that you read in a thriller novel come true. This map makes military bases come alive and obviously identifiable. 

military bases.jpeg

It's hard to blame Strava for publishing this, as it is a pretty amazing map to view, but with many of technology's bugs, the fact that Strava didn't have to clear this with the United States Armed Forces is staggering. When some in information security finds a bug in a system, the idea is to follow proper protocol and alert the company's security team to give them time to patch the issue before taking it public, but Strava appeared to just ignore all warning lights. It is nearly impossible to believe that NO ONE at that company thought about the ramifications of publishing something that is just gathering massive amounts of data and publishing it. Granted, when you download their app, you basically Accept their Terms & Conditions, which all them to collect your locational data, but it is still surprising that they took so much of this public.

We can even see the issues in the United Kingdom, more specifically, Her Majesty's Naval Base, or HMNB Clyde, is home to the UK's nuclear arsenal. It would be very disconcerting to know exactly where employees are moving at all times. 

I think the bigger question that should be asked is why are employees allowed to use their cellphones in the same building as nuclear weapons? It would be incredibly ironic for a nuclear weapon to go off because a Samsung Galaxy explodes in someone's pocket.

 HMNB Clyde, UK

HMNB Clyde, UK

I wish I knew what the best response to this would be. It's hard to blame Strava, although their publishing is endangering lives, but it truly is the user's fault for using their application on military bases. Hopefully we will see a crackdown on the use of their app in sensitive areas, although it may already be too late.

Best Mac Security Tools of 2017

Computer_virus_illustration.jpg

As we round out another year, I look back at everything that has happened this year with computer security, especially in the Apple sector.

We can look back at WannaCry, the ransomware attack that ravaged Microsoft systems across the world in May. It infected around 300,000 computers and over 200,000 victims. This was quickly followed by another piece of ransomware called Petya. In March, a data trove of 8,761 documents were posted to Wikileaks, which was entitled "Vault 7," a collection of stolen documents containing documentation of alleged spying operations and different hacking tools. This doesn't even take into account the massive amount of DDoS (Distributed Denial of Service) attacks against companies and individuals. Last but not least, we cannot forget the massive data leaks in the past few years, which includes but is not limited to Equifax, Target, Sony, Yahoo, Ashley Madison, Adult Friend Finder, and last but not least, Stuxnet.

With all of that being said, although not all of these attacks were done specifically to the Mac operating system, some of them did. Because of that, we have compiled a list of the top security tools of this year. They weren't all produced this year, but they are the security tools that I use daily and trust whole-heartedly. We will also recount some of the biggest tricksters and liars of the year as well in our next blog post.

If you are interested or have questions about any of this years top security tools, please let me know. Send me an email at stuart@crashsecurity.com.


Top 5 Mac Security Tools of 2017:

 

Honorable Mention

nordvpnlogo-100726095-large.jpg

NordVPN

NordVPN is my favorite VPN (virtual private network) I've used thus far, and I have tried quite a few. I've tried quite a few, and after being disatistfied with the price of the last one I used, ExpressVPN, I moved to NordVPN. 

I learned of a great comparison site called That One Privacy Site that provides a breakdown for tons and tons of VPNs. To sum up VPNs, they encrypt your IP address, so you can remain relatively anonymous while browsing the internet. With how many different things I research, I have to use a VPN. NordVPN is one of the top rated, and it also has great reviews. You can choose where you want your IP address routed through, whether it be Canada, Europe, Asia, or anywhere in between.

Sign up for the two-year plan for $3.29/month.

Follow NordVPN on Twitter: @NordVPN


No. 5

Screen Shot 2017-12-22 at 2.27.29 PM.png

GPG Tools

This suite of tools allows you to send encrypted emails using the program, GPG Suite. Although it may seem as if your email is impenetrable, it isn't. This tool can be tough to configure, but once completed, it is an amazing application. It allows you to give your public key to others, in which they can send you encrypted messages. The only way to see those messages is by decrypting them with your private key. It uses an encryption called OpenPGP, PGP standing for Pretty Good Privacy (no joke). Using a server, you can access your friend's public keys to send them emails when you need or want to do it. It is a plug-in for Mac Mail, so if you use a different email client, you may have to download a different tool. This is available for macOS 10.9 and higher. Read more at their website which is linked in their title.

To send me an encrypted email, my public key is: BB387DBD

Follow GPG Tools on Twitter: @GPGTools


No. 4

littlesnitch_256.png

Little Snitch

Little Snitch is a network monitoring tool that makes your connections visible. You can allow or block certain connections, as well as set parameters about the connection. Say I want to do an Adobe update, but I only want my computer reaching out to Adobe's server address for 30 minutes, I can set the parameter to allow the connection for 30 minutes. After that time expires, the connection will be blocked. You can also block a site for a certain amount of time or "Forever." Same goes with allowing websites. I allow my computer to connect to the iCloud server "Forever," as I constantly have things syncing with my iCloud account. 

microsnitch_340.png

Little Snitch also now has a companion piece of software called Micro Snitch, that monitors your computers camera and microphone and will alert you when they go active. This piece of software, I have found not as useful, and I will explain why a little further down this article.

Follow Little Snitch on Twitter: @LittleSnitch


No. 3

infected-files.jpg

ClamXAV

ClamXAV has, for years, been my favorite antivirus on the market for multiple reasons. One common issue with running antivirus on a Mac is live-monitoring. For quite some time, ClamXAV did not support live-monitoring, and it was instead a simple, powerhouse antivirus scanner. If you run this program as just an antivirus scan, it will bog your machine down, but I would simply set it up at night, and allow the scan to run while I slept. When I woke up, it had a list of all of the issues it may have found. I could then immediately put them in my Trash. 

What ClamXAV has released more recently is ClamXAV Sentry. It is a live-monitoring piece of software that I set up to monitor specific folders. Obviously, the folder most likely to get infected on your computer is your ~/Downloads folder. Anything downloaded from the internet will typically download here. I have it monitor my Downloads and my Desktop, as well as a few hidden folders. Most every-day users would not need to worry about the hidden folders, but because of how much I play with malware, I set it up to scan that anyway. 

So why do I like ClamXAV over Norton or Sophos or McAfee? Well, those programs live-monitoring are extremely CPU-consuming. I find myself getting angry with how slow it makes my machine run. With ClamXAV, I've never had that problem. ClamXAV is also one of the quickest AV engines to find new malware in the wild, so I cannot recommend it enough. 

There is a free trial, but it is now a paid program, and I think it is well worth the $29.95.

Follow ClamXAV on Twitter: @ClamXAV


No. 2

Malware-Bytes.png

Malwarebytes for Mac

Another amazing malware remover and antivirus, Malwarebytes. For many years, Malwarebytes stuck pretty specifically with malware and something referred to as PUPs (Potentially Unwanted Programs). More recently, they have begin diving into the AV community, and with each update, Malwarebytes and ClamXAV get more and more similar as far as what they do. Malwarebytes for Mac was a program that I used often to help rid people of unwanted programs and adware. We will dive into some of these PUPs in our next blog post, but Malwarebytes was always there, and it would always remove the program fully, not leaving behind any files, no matter how deep they were buried in your system. 

Malwarebytes recently released Malwarebytes Premium 3.0, which is not only a malware scanner, but an antivirus software with "Real-Time Protection," which is like their version of live-monitoring. I got this upgrade immediately, and although there were some bugs early on with the program utilizing large amounts of memory, sometimes even when the program wasn't running, those bugs have since been resolved. Malwarebytes is also touted as one of the top antivirus scanners.

Take the image below. This shows live threats that Malwarebytes, for Windows and Mac), is catching. It also shows threats that it caught that other antivirus softwares did not. This was a screenshot I took less than two minutes into this map populating in real-time. I can't imagine what it would look like if I allowed it to run for hours on end.

Screen Shot 2017-12-21 at 11.58.55 AM.png

Malwarebytes is now the company to beat when it comes to antivirus. They are also one of the first companies to catch new threats, and they keep very busy on social media platforms for support and tips. You can download the free or paid version.

They also frequently blog about security issues, which I highly recommend reading. They are very up to date on everything that has to deal with computer security.

Follow Malwarebytes on Twitter: @Malwarebytes

Follow Malwarebytes for Mac specialist Thomas Reed on Twitter: @ThomasAReed


No. 1

CaY75aNi_400x400.png

Objective-See

Objective-See and creator Patrick Wardle has been pumping out free application after free application for years now. No, they don't have one app, they have OVER 10!

First, Oversight, one of their newer applications, does the live-monitoring of your computer camera and microphone. As I mentioned earlier, Micro Snitch does it as well, but anything produced by Patrick Wardle is going to be some of the best software out there. It is easy to run, is easy to set up, and it just runs in the background, using virtually no CPU or memory. It is fantastic. You can allow or block connections when they are coming in, so you will instantly know if someone is using your camera without your permission.

In addition to this, they've added another application called BlockBlock, which monitors common persistence locations on your computer. This would be the locations malware may install.

Another application, Ransomwhere?, helps stop ransomware from making you a victim. It notices when something is encrypting your files, and you can either approve or terminate the process that is doing so. This is such a fantastic tool seeing as how ransomware has constantly been on the rise, especially over this past year.

Wardle has also released multiple open-source tools, encouraging users to download the programs through a Git website like GitHub. One of the more recent open source tools called ProcInfo is a tool that allows you to find a specific process and analyze it. This allows you to trace what a specific process is doing to see if it is malicious or not.

They have also produced an open-source program called LuLu that is a firewall. It will block any outgoing connection until it is approved by the user. I just recently started using LuLu, and I love it so far.

Again, all of these applications are FREE.

These are just four of the many tools that Objective-See has produced. I would highly suggest using them, and if you need help installing any of them, don't hesitate to let me know.

Follow Objective-See on Twitter: @Objective-See

Follow Patrick Wardle on Twitter: @PatrickWardle


In conclusion...

These are applications that I LOVE. I don't get paid to promote any of these. In fact, the free tools by Patrick Wardle and Objective-See are on Patreon, and I donate to them monthly because I believe so much in the power of the products. To show you how much I like these, I took a screenshot of my toolbar, where you can see many of these currently running.

 (From left to right): MicroSnitch, BlockBlock, LuLu, ClamXAV Sentry, Little Snitch, Malwarebytes Premium 3.0, Oversight, NordVPN

(From left to right): MicroSnitch, BlockBlock, LuLu, ClamXAV Sentry, Little Snitch, Malwarebytes Premium 3.0, Oversight, NordVPN

Don't take Mac security for granted. All Macs are susceptible to malware. It's not to late to download applications. Again, if you need any assistance installing these programs or how to operate these programs, please don't hesitate to contact me either for a home visit through my House-Call page or a general questions through my Contact page.