APPropriate Behaviour
The book about all the things software writers do that aren't writing software.
FSF
Author Archives: Graham
One Window that is good for Mac security
I realise now that I didn’t cover this when it happened back at the beginning of March, but that not everyone in either the Apple world nor the general infosec community is aware of it. Nearly one month ago, Apple … Continue reading
Posted in AAPL
Comments Off on One Window that is good for Mac security
Why do we annoy our users?
I assume that, with my audience being mainly Mac users, you are not familiar with Microsoft Security Assessment Tool, or MSAT. It’s basically a free tool for CIOs, CSOs and the like to perform security analyses. It presents two questionnaires, … Continue reading
Posted in brute-force, password, tool-support
2 Comments
So it’s not just the Department of Homeland Security, then
What is it about government security agencies and, well, security? The UK Intelligence and Security Committee has just published its Annual Report 2008-2009 (pdf, because if there’s one application we all trust, it’s Adobe Reader), detailing financial and policy issues … Continue reading
Posted in Data Leakage, government, Policy
Leave a comment
Integrating SSH with the keychain on Snow Leopard
Not much movement has occurred on projects like SSHKeychain.app or SSHAgent.app in the last couple of years. The reason is that it’s not necessary to use them these days; you can get all of the convenience of keychain-stored SSH passphrases … Continue reading
Posted in Encryption, Keychain, Mac, ssh
8 Comments
Pre-order professional Mac security books!
You too can own a piece of the magic. Professional Cocoa Application Security and Enterprise Mac: Mac OS X Snow Leopard Security are both already in pre-order; use the Amazon affiliate links below if you want to give me a … Continue reading
Posted in PCAS
Leave a comment
Look what the feds left behind…
So what conference was on in this auditorium before NSConference? Well, why don’t we just read the documents they left behind? Ooops. While there’s nothing at higher clearance than Unrestricted inside, all of the content is marked internal eyes only … Continue reading
Posted in Data Leakage, government, NSConf, Policy, Privacy
Comments Off on Look what the feds left behind…
More NSConf code signing fun
I’ll be talking at the US NSConference on Tuesday, with an extended version of my talk on code signing. I’ll cover how it works, what it does, what it doesn’t do, and what it should do. Importantly, there are still … Continue reading
iPh0wnage
I just reviewed a blog post I wrote for Graham Cluley a while back, in which I looked at the impact a common vulnerability on the iPhone and Mac would have. I think in the run-up to the iPad’s release, … Continue reading
Posted in iPad, iPhone, Mac, Malware
Leave a comment
Anatomy of a software sales scam
A couple of days ago, Daniel Kennett of the KennettNet micro-ISV (in plain talk, a one-man software business) told me that a customer had fallen victim to a scam. She had purchased a copy of his application Music Rescue—a very … Continue reading
Code snippit from NSConference presentation
Here’s the code I used to display the code signature status within the sample app at NSConference. You need to be using the 10.6 SDK, and link against Security.framework. #import <Security/SecCode.h> – (void)updateSignatureStatus { SecCodeRef myCode = NULL; OSStatus secReturn … Continue reading
Posted in Codesign, NSConf, Talk
Leave a comment
