Mac Attack: Another Trojan Hidden Inside Photoshop Crack

Iservices_b1

We won’t be covering all Mac malware outbreaks here, but coming as it does so soon after the iWork ’09 trojan, this new exploit is worth a mention. Intego, who tipped us off to the trojan embedded inside a pirated version of Apple’s iWork suite, has discovered much the same thing inside a crack for Adobe Photoshop CS4.

Of course, it’s not in the real Photoshop, but carried in a "crack" application which is applied to Photoshop CS4 in order to serialize it and stop it calling home to Adobe’s servers (CS4 has some pretty heavyweight piracy protection inside). The trojan, called OSX.Trojan.iServices.B, then opens up a backdoor with root access and connects on a random TCP port to two internet addresses. This gives a remote attacker complete access to your Mac.

Scary stuff, and enough to wipe the smug smile off the face of any Mac owner (like me). The answer is to be more careful. Don’t run untrusted software, and be cautious about giving anything your admin password. Above all, don’t pirate applications. Oh, and you could run Intego’s antivirus software, but – just like Windows – if you take care you don’t really need it.

New Variant of Mac Trojan Horse iServices Found in Pirated Adobe Photoshop CS4 [Intego]

See Also:

Hands-On: Password Organizer Too Frustrating to Use

Spo1

Meet the Logio Secure Password Organizer from Atek, a credit card sized piece of flimsy plastic that couldn’t feel cheaper if it had been conceived as a Christmas Cracker novelty. The $30 device was sent to me at the end of last year and today I finally managed to struggle through the blister pack (better constructed than the item itself) to take a first (and last) look.

The idea of the organizer is that you keep your passwords in it. This
is a good thing. As the package blurb tells us, short, easy to remember
passwords are insecure, but longer passwords are of course harder to
remember. The organizer stores the details for you in three
fields — website, login and password. The whole lot is protected by a
master password, required when you switch the machine on.

It sounds fine, but in practice it was too frustrating to even enter one login. But let’s move back a little. First, you need to slide in the standard CR2016 battery, supplied (although wrapped in many, many layers of polythene).

Spo4

The little carrying drawer popped out and headed, along with the battery, under the sofa. I rescued both and fired the thing up. You automatically enter the setup mode, which means choosing a long master password. And that’s where the trouble starts. You don’t know if you are entering numbers or letters, and you need both for a strong password. As it was just a test, I hit the numbers one through nine in order. It turns out that I actually entered letters. Hmmph.

Next you need to calibrate the display contrast, beep volume and so on, until we get to the main screen. There, you enter details as you would on a mobile phone, tapping each button several times to select letters. Thankfully you get a dedicated .com button, but this seems rather pointless, as does the http:// option: it’s not like you’ll actually be using these urls — they’re just reminders.

After that it started to get really annoying. As if the poor input method weren’t bad enough, the whole unit creaks and cracks as you use it, and the buttons themselves feel about as long-lasting as a piece of rice paper in a rainstorm. But hey! There are some classy accessories. Number one, the faux-leather case:

Spo2

A thing of soft, plush beauty, we suspect the reason for the case is to protect your delicate pocket lining in case of the inevitable chip and cog-spilling meltdown. Next is the stylish lanyard strap:

Spo3

The strap is long enough to encircle your neck, so you can have the organizer with you at all times. On the other end is a fine plastic filament which should be threaded through a hole in the plastic card. My review version came with another little section of filament taped to the end. I assume it is a spare, and appreciate it, although I think the filament will easily outlast the device itself.

This piece of tat seems more suited to another era, a time when the sign-up gift from the bank was a credit card sized calculator and you actually got excited by it. Now we have software to do this sort of thing, from the Mac’s built in keychain to the excellent paid software 1Password, which costs just $10 more and does a whole lot extra.

Oh, one more thing. The Logio holds just 200 logins. While a very low number, even that is too much. Imagine trying to enter all that information using this interface. I think I’ll just stick to using my dog’s name as my single sign-on, everywhere (note to would-be identity thieves — I don’t have a dog).

Product page [Atek]

Tmsuk T-34 robot speaks softly, carries a big net

Tmsuk T-34 robot speaks softly, carries a big net

We’ve seen robots controlled by cellphones before, but nothing quite like the T-34 from Tmsuk, creator of an amazing variety of bots that range from whimsical to menacing. The T-34 falls somewhere in-between, looking decidedly like a purple monster truck that’s been granted the ability to trap — or at least inconvenience — baddies. A remote operator can get a live feed of what the T-34 is seeing and then fire a large weighted net when the target is in range. As you can see in the video below it does look to be rather challenging for this loafer-wearing mock burglar to extract himself, but once free we’re not sure what else the T-34 can do other than bleat helplessly while waiting for someone with arms to show up. Just the same, if you’re looking to put a damper on your local criminal activity and have $9,000 to spare, Tmsuk will be happy to sell you one — in about two years when they become available.

[Via SlashGear, thx Chris]

Continue reading Tmsuk T-34 robot speaks softly, carries a big net

Filed under:

Tmsuk T-34 robot speaks softly, carries a big net originally appeared on Engadget on Fri, 23 Jan 2009 09:44:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

Another Mac Virus Alert. Real This Time?

Ism0901
Anti-virus maker Intego has issued a warning about a Mac trojan that is both in the wild and actually malicious, unlike anything seen before. The distribution system is BitTorrent — specifically a pirated version of the iWork 09 suite just released by Apple.

What does this mysterious trojan do? It drops an application named iWorkServices into the system startup folder (/System/Library/StartupItems). Intego:

The malicious software connects to a remote server over the Internet; this means that a malicious user will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely. The Trojan horse may also download additional components to an infected Mac.[emphasis added]

It sounds a little woolly, doesn’t it? "Various actions remotely" sounds threatening but is really too non-specific. Better is the recommendation from Intego: Install its VirusBarrier X4 and X5 software. Surprise!

This might well be the first real security threat that OS X has seen. Or it may be a rather cynical cash-in on a harmless trojan. It could even be a complete set up. One thing we do know, though, is that you’d have to be a complete moron to download iWork 09 via BitTorrent — there is a free, one month trial version available from Apple’s own site. Also, Intego: way to write a headline — take a look at the link below, copied verbatim. It reads like a telegram.

Mac Trojan Horse OSX.Trojan.iServices.A Found in Pirated Apple iWork 09 [Intego]

President Obama Wears Bullet-Resistant Suit at Inaugural

Barack Obama had more than the Presidential ‘beast’ limo taking care of his safety yesterday.

According to some reports, he wore a suit made by a clothier specializing in bullet-resistant clothing during the inauguration ceremonies.

Coat_caballero_bullets
While no one from the U.S. Secret Service have yet to mention any details about the garment’s structure, some are speculating it may have come from the line by Colombian designer Miguel Caballero. As we noted last year, Caballero is well known for his super tough but flexible and business appropriate clothing (see pic at right), such as the $7,500 polo shirt that can stop a shot from a 9-mm revolver.

Due to some of the unfortunately rising levels of dangerous conflicts in Colombia and other parts of Latin America, the need for this type of clothing has also led to a spike in sales.

According to Caballero, many of his garments offer more than three levels of ballistic protection and they are about seven times more flexible than the Kevlar vests that are usually worn. Designers that use Kevlar tie together dense strands of the material (500 to 1,500 filaments per strand of yarn, according to Slate), which is then weaved into the clothing.

With close to 2 million people on hand to watch the president-elect take the Oath of Office, the level of security was understandably tight and every precaution was taken to ensure safety for all.

Earlier this month, we noted that President Obama will be using the safest Presidential limo ever built, the so-called Cadillac One (or simply, "The Beast"), whose toughness rivals a tank and seals off like a bank vault in the event of a potential attack.

Is This The World’s Strongest Safe?

Safeashouses

Ever wondered why tech hardware companies blog? This is why: In the same way that the Will It Blend? videos did wonders for BlendTec’s sales, German safe manufacturer ExtraSafe is showing off the results of an unsuccessful assualt on one of its strongboxes in the hope of bigging up its reputation.

According to the company’s blog, safe crackers tried to bust open a 500Kg (1100lbs.) safe and failed spectacularly. These guys weren’t amateurs, either — one of their tools was a $25,000 diamond core drill bit. The picture shows the tattered but triumphant safe after the would-be-thieves gave up and walked away.

We wonder just why they were bothering. These criminals weren’t glamorous jewel thieves — they were after "official stamps and documents". Next time, guys, just visit the local post office and ask, OK?

Drilled, bent, maltreated – But This Safe Didn’t Give Way [ExtraSafe via New Launches]





Add to Reddit
Add to Facebook
Add to digg



Personal Tracking Device Offers Free Monthly Subscription, More Detailed Tracking

Xact_large4

The unyielding progress of technology has brought us another gadget that fully does away with the idea of personal privacy. Xact Technology’s Xact|Trax provides a detail account of a person’s location (or a cat or a package, or one inside the other, if you so choose). Like other GPS modules, it has a special tracking website set up for the obsessively compulsive.

According to Xact, the device uses tech from u-blox that boosts the speed needed to pick up a wireless satellite signal, through a 50-channel five-positioning engine. They claim this makes the receiver powerful enough to be used in the toughest places in the world where you couldn’t possibly believe you could get a signal, like a cave, or the deep recesses of Alec Baldwin’s ego.

One of the most interesting features is one what they call ‘geo-fences.’ With it, you are able to determine how far within a specific area an object (or a recently-met crush, if you want to make a distinction), is able to travel – if said object goes beyond the ‘geo-fence,’ you’ll be immediately alerted through SMS texting. That’s right.

The geo-fence feature is offered by a few other GPS devices, but Xact is the only one to offer a no-monthly fee subscription. That may be a good enough incentive for people who haven’t tried this technology to jump in. As for me, I will continue to check under my car for any unwanted personal tracking hardware. These RFID groupies, man, they need to let it go.





Add to Reddit
Add to Facebook
Add to digg



Verbatim trots out OS X-friendly 8GB Store ‘n’ Go retractable USB drive

Verbatim doesn’t really make a lot of racket during the year, but come Macworld / CES, it pulls out all of the stops. Alongside a new family of delectable ExpressCard SSDs, the company is also introducing an 8GB Store ‘n’ Go Retractable USB Drive (Windows version shown) that caters to the OS X crowd. Verbatim’s pushing two main selling points here: for starters, the capless, retractable design means that your USB socket will always be covered, and secondly, the password controlled access to the drive’s private zone plays nice within an OS X environment. The half-ounce device is expected to land on store shelves in just a few weeks, though it’ll cost you a stiff $59.99 if you’re looking to pay MSRP.

Filed under:

Verbatim trots out OS X-friendly 8GB Store ‘n’ Go retractable USB drive originally appeared on Engadget on Tue, 06 Jan 2009 15:28:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

PlayStation 3 used to hack SSL, Xbox used to play Boogie Bunnies


Between the juvenile delinquent hordes of PlayStation Home and some lackluster holiday figures, the PlayStation has been sort of a bummer lately, for reasons that have nothing to do with its raison d’etre — gaming. That doesn’t mean that the machine is anything less than a powerhouse — as was made clear today when a group of hackers announced that they’d beaten SSL, using a cluster of 200 PS3s. By exploiting a flaw in the MD5 cryptographic algorithm (used in certain digital signatures and certificates), the group managed to create a rogue Certification Authority (CA) which allows them to create their own SSL certificates — meaning those authenticated web sites you’re visiting could be counterfeit, and you’d have no way of knowing. Sure, this is all pretty obscure stuff, and the kids who managed the hack said it would take others at least six months to replicate the procedure, but eventually vendors are going to have to upgrade all their CAs to use a more robust algorithm. It is assumed that the Wii could perform the operation just as well, if the hackers had enough room to spread out all their Balance Boards.

[Via ZD Net]

Filed under:

PlayStation 3 used to hack SSL, Xbox used to play Boogie Bunnies originally appeared on Engadget on Tue, 30 Dec 2008 17:41:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

Panasonic debuts password-protected whiteboards

While Panasonic’s two newest whiteboards lack those snazzy multitouch capabilities, they posses something only the true undercover FBI agent posing as a first grade teacher could appreciate. The film and steel boards look pretty traditional at first glance, but underneath of that plain jane facade is a highly advanced security system. You see, each board can accept passwords, which will in turn restrict the ability to transfer information from the board to USB flash memory. For those cleared for access, the whiteboards can transfer on-screen information to a PC via USB, though we suspect you’ll have to handle the encryption on your end. ‘Course, neither of these will run you cheap, but you know your underground supervisor won’t mind shelling out upwards of two large to make sure schematics to rule the world aren’t intercepted by meddling rivals.

Filed under: ,

Panasonic debuts password-protected whiteboards originally appeared on Engadget on Sat, 27 Dec 2008 12:21:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments