Exploit Articles on TUAW - The Unofficial Apple Weblog

Apple's DNS patch coming up short

by Michael Rose (Aug 1st, 2008)

The distance between good intentions and actual results seems to be getting longer and longer. While Apple did release a security patch yesterday that included a fix to BIND for the highly publicized cache poisoning exploit -- some time after most other vendors got updates out to customers -- that ...

More on the CanSecWest exploit and Java

by Michael Rose (Apr 23rd, 2007)

According to Matasano (home base for security researcher Dino Dai Zovi), the announced-but-unreleased web browser exploit that was used to win the CanSecWest MacBook Pro challenge involves browser support for Java. Turn off Java for Safari (or Firefox, or Camino) and your machine is immune. Let's ...

New Mac OS X Exploit?

by Erica Sadun (Nov 21st, 2006)

The UK's IT Week reports on a possible new Mac OS X exploit. A proof of concept appears on the Info-pull.com website, claiming that corrupted UDTO HFS+ image structures are vulnerable to denial of service attacks. If true, this same issue may affect FreeBSD installations. The article suggests ...

Another Look at Mac OS X Security

by Damien Barrett (Mar 7th, 2006)

I take security exploits seriously. I'm responsible for many hundreds of Macintosh computers that reside in many different environments, not to mention half-a-dozen X-Serves, several of which are production boxes open to the world. When a security exploit is announced, I look to see if it will ...