I don't use iPhoto too much, but it has it uses. There's a nice 103 MB update for it that fixes the issue from the iPhoto 8.03 update that caused iPhoto to crash. You could work around it by holding the Option key and then choosing your library, but what fun was that. I didn't have that problem, but this should help those that did.
Well, here we go. First update and it's an Apple router one.
An undisclosed vulnerability in Internet Explorer, combined with exploiting Safari for Windows' ability to download files without being prompted, apparently allows the bad guys to take over Windows. This affects XP, Vista and IE versions 6 and 7. The unnamed Internet Explorer bug has been around for awhile. Combined with the Windows version of Safari, where files can be downloaded without an option to prompt before doing so, the flaw can be used to take over Windows, reports Aviv Raff.
The flaw in Internet Explorer uses the calculator program in conjunction with Safari for Windows to make two moderate vulnerabilities into a critical one. Microsoft has issued a bulletin, but it doesn't really say too much. Even if Microsoft patches IE, there's still Safari's "carpet bomb" issue that can allow unwanted downloads. Right now, Apple doesn't appear to want to fix this. Simply adding the option to prompt for all downloads before doing the download would help prevent this. Stopbadware wrote on their blog to urge Apple to do so.
You have to visit a specially crafted web page for this exploit to work. So it is not an all out fiasco. So far, there is not a known use of this problem. Right now, the only guaranteed fix to prevent this is to uninstall Safari for Windows. This may not be a bad idea, since there could be more bugs like this that can be exploited in Safari for Windows, said Raff in an interview with Macworld.
A few hours ago, Apple made the 10.5.3 update available on Software Update. There's lots of changes and fixes in this one. If you have 10.4 Tiger, you do get a nice set of security updates so you don't feel left out.
After you update to Mac OS 10.5.2 Leopard, there's an update for your video graphics. Not much detail provided on the download page, but performance is reported to greatly increase for World of Warcraft. After you update to 10.5.2, run software update again to get this update.
Apple released the next big update for Leopard today, 10.5.2. There's also a security update for users running 10.4 Tiger, Security Update 2008-001. Security updates for Leopard are included in 10.5.2 while tiger will have the 2008-001 as an update.
F-Secure has reported about the first known rogue antispyware program for MacIntosh computers. Macsweeper is what it goes by. With the growing number of reported fake codec zlob trojans made for Macs, this doesn't surprise me. The first known Mac fake codec was reported just last November. Since then, there has been a steady release of Mac fake codecs to go along with the Windows versions. The last one discovered was on January 11th. If you go through Sunbelt's blog, you'll find many more.
For now, I'm not sure how you remove it, but it appears to be mainly a nuisance. More updates on this later.
Right before going to bed, I saw that there is a new variant of the all too familiar Zlob DNSChanger that has been infecting Windows computers for some 2 years now. The big change is it targeting Mac OS X instead of Windows. It does the same thing as the Windows versions that change your DNS to hijack your computer. It will redirect you to web sites you didn't mean to go to and your search results will also get sent to ones that the bad guys want you to see. That way,they can bombard you with ads and other garbage to try and get money out of you.
DNS is like a phone book. Your computer looks up what IP address a site like Google.com has. Since you are now using the fake phone book, when you click on a link or enter a web address, they send you to a similar web site. Usually, it has a lot of ads and links to other crappy websites. My experience with the Windows variants tends to be only a few redirects and then you are left alone for awhile. Also, unlike the zlob variant that tries to sell a fake antispyware program, you do not get pop ups and warning balloons that your system is infected.
The OS X version uses the same tactics to get you to install the trojan. A video gives you a warning that you need t install a codec or plug-in for Quicktime to view it. When you download the fake codec and try to install it, OS X will ask you for your admin password. This is one advantage that OS X has that most Windows users do not have. If you do not enter your password, then nothing bad happens. If you do enter your password, then you get hijacked.
Macworld has more details on this and how it can be removed. One of the first to report this trojan was Intego, who makes security software for MacIntosh computers.
Check in your Library folder (not the System/Library or your user Library) for a file called plugins.settings. The path to the file is:
/Library/Internet Plug-Ins/plugins.settings
Removing that file by itself won't fix the trojan. You need to do a little work in Terminal to remove OSX.RSPlug.A
1. In the Finder, navigate to /Library -> Internet Plug-Ins, and delete the file named plugins.settings. Empty the trash. This deletes the tool that sets the rogue DNS Server information.
2. In Terminal, type sudo crontab -r and provide your admin password when asked. This deletes the root cron job that checks the DNS Server settings. You can prove it worked by typing sudo crontab -l; you should see the message crontab: no crontab for root.
3. Open your Network System Preferences panel, go to the DNS Server box, and copy the entries you can see to a Stickies note, TextEdit document, or memorize them. Now retype those same values in the box, then click Apply.
4. Reboot your Mac.
For the most part, this is more of an annoyance. The main danger comes if you go to a website and enter personal information that the crooks want. They could redirect you to a website that isn't really your bank or Pay Pal and steal your login information. Although it seems now that it is mainly to send you to websites to peddle programs and display ads for you to click on.
My favorite web browser Firefox release a small but important update today. This update fixes a security issue with Quicktime Media link files. Since Quicktime is all over the Net, I would update as soon as you can. This update is for Firefox Windows, Mac OS X and Linux.
Firefox 2.0.0.7 download
Speaking of Quicktime, there have been some important security updates for it as well recently. You can download it with or without iTunes on the Quicktime download page. You don't have to put in an email address to download.
The iPhone is out and the malware makers are already using it dupe people out of their money. Sunbelt reports that there is a new trojan that will offer pop ups to take you to a fake iphone.com webpage. Normally iPhone.com redirects to the a page on Apple.com for the iPhone, but on infected systems, a custom webpage replaces the legit one. A browser helper object is added to Internet Explorer to take you to the fake webpage:
BHO: H - {AA7F2000-EA05-489d-900C-3C7C0A5497A3} - C:\WINDOWS\system32\rwera21s1.dll
It's triggered when you go to Google.com or Yahoo.com. Some realistic looking pop ups appear and if clicked, you'll end up on the fake page. The fake page is hosted by Hostfresh, a dubious hosting company as reported by Sunbelt.
If you try to order an iPhone through these pop ups, all you'll get is an empty wallet. Check out the screenshots and other info posted at Sunbelt Blog.
Apple announced two new ways to access Youtube from your Apple TV and iPhone.
Apple TV now has new menu choice for youtube.com if you update it software version 1.1. While you don't view the actual Youtube website, you can access many of the features and videos through the Apple TV. You can view the most popular videos, most watched, search and do most f the things you could do if you if you were on a computer. You can even log in to your account save favorites and rate videos. Not every video will initially be available. All of the videos on Youtube need to be converted to the H.264 encoded mp4 format to play on Apple TV. It will take several months to convert them all but there are still quite alot that can be viewed now. There's a good article at iLounge that describes this and has screen shots of the Apple TV using Youtube. You can also check it out at Apple.com.
The iPhone has been confirmed to include the ability to stream videos from Youtube as well. There will be 10,000 available when the iPhone launches next week, with more added over time.
Leopard is on the horizon but a new update for Tiger came out today to address a security issue, improve reliability and add new functionality. Yahoo!Sync has been added in what appears to be to allow syncing contact info with your Yahoo ID and to your iPhone. Raw file support has been added to allow processing of files from various cameras. Bluetooth and USB have updates to improve reliability with certain devices connected to a Mac. The security update addresses a potential problem with the new IPv6 protocol.
Details of the security content of this update can be found here. More details on what's new in 10.4.10 is here. Use software update to get 10.4.10. How to use software update info here.
Apple has released a public beta of it's Safari web browser. Until now, it's only been available on mac computers, so this is an interesting development. Safari version 3 will be the the one that comes with the next release of Mac OS 10.5 Leopard. It is currently beta, so that means it is still being tested and worked on. It may stil have bugs or not work as expected.
The free public beta of Safari 3 is available immediately as a download at http://www.apple.com/safari, and is preview software licensed for use on a trial basis for a limited time. The final version of Safari 3 will be available as a feature in the upcoming Mac OS® X version 10.5 Leopard, and will be available as a free download to Mac OS X Tiger and Windows
users in October.
System requirements:
Safari 3 for Mac OS X requires Mac OS X Tiger 10.4.9 or later, a minimum of 256MB of memory and is designed to run on any Intel-based Mac or a Mac with a PowerPC G5, G4 or G3 processor and built-in FireWire®.
Safari 3 for Windows requires Windows XP or Windows Vista, a minimum of 256 MB of memory and a system with at least a 500 MHz Intel Pentium processor.
I noticed that there was an update for iTunes when updating one of my Windows computers with the Quicktime security update from earlier today. At first I thought I forgot to update that computer the last time iTunes updated but then I noticed the version was 7.2. Since the version jumped from 7.1.1 to 7.2, I figured this was the update that would include the DRM free upgrade for EMI's music sold on iTunes. I checked the download page and it's confirmed:With iTunes 7.2, preview and purchase iTunes Plus music—new higher-quality, DRM-free music downloads from participating music labels.
At the moment, there's no change in the iTunes Store. No copy protection free music, but it's late in the day. Apple will likely make one tomorrow California time. Right now, it's 11 PM and May 29th still. Even so, you can still download the new version from the download link above.
I won't repeat what has been posted a million times on the Net already, but the copy protection free music will also be twice the quality as well, 256 vs 128 AAC. The details are in this AppleInsider web page, as well as a link to a Wiki page that lists many of the artists that are EMI.
Edit to add: I see Windows Vista is now officially supported as well. Until now, Vista was not supported 100% by iTunes.
Quicktime has a new update for version 7.1.6 to fix some flaws that could allow the bad guys to attack your computer. It is for both Mac and PC versions of Quicktime.
Description: A design issue exists in QuickTime for Java, which may allow a web browser's memory to be read by a Java applet. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information. This update addresses the issue by clearing memory before allowing it to be used by untrusted Java applets.More details on Apple's write up about it.
Microsoft release the final update for Vista that addresses a problem when trying to eject an iPod.
The release is for users worldwide and works with the latest version of Apple iTunes to correct an issue that caused some iPods to become corrupted when ejecting them using Windows Explorer or the "Safely Remove Hardware" function in the System Tray.
Apple release a new update for Quicktime recently that addresses several security issues, as well time code and closed captioning. Details of the security issue can be found on Apple's about page for Quicktime 7.1.6. The short story is that the bad guys can use a java applet to execute code to attack your PC or Mac.
You can download the update from Apple, run Apple Software Update on your PC or Software Update on your Mac. Windows update is here and the Mac one is here.
It's not a security update, but if you have an iPod Shuffle and need to restore it back to factory settings, this may interest you. iPod Reset Utility will restore your Shuffle back to factory settings when you aren't able to use the restore feature in iTunes. I would follow the iPod 5 R's before using the reset utility, since restoring your iPod will erase your music from the Shuffle.
iPod Rest Utility 1.0 download for Windows and Mac. Installation info and use can be found here.
