updated 081220001622
Introduction
The Mac OS platform can be secured as well as any other standard
system if the user follows certain checks and safeguards. There are
even security bonuses with the Mac OS - compared to other operating
platforms, very few trojans or viruses have been developed for these
systems - unlike Windoze environments which are under constant attack
from the latest problem programs. This info file has been written to
help individual Macintosh users ensure good security in their system
environments. This guide assumes that you have a basic working
knowledge of Macintosh OS and can comfortably navigate your way around
the system and install software.
Links in blue refer to pages on the security.tao.ca main site that have detailed background information on the subject mentioned.
should this title be here?
Levels of Security?
A quick way to test the overall level of security on your Mac (or just
to show yourself how easy it is to gather pertinent data from it) is
to look at the data that can be gathered from your Preferences and
Settings files either manually or using a program like ResEdit or a
small utility like Ferret
(home - download).
Ferret output window
Ferret will gather the saved 'access information' from preferences and
settings files (Including AIM, Apple File Sharing Registry, FreePPP,
Gerry'sICQ, Internet Control Panel, MacSLIP, Netscape Communicator,
OT/PPP and ARA and more) on any mounted volume. It can even decrypt
some passwords, all in under 60 seconds for most volumes.
This is a good first exercise to see what is sitting on, or very close
to surface level on your computer - and thus, accessible to anyone
sitting down at your machine or intruding on it remotely.
Your Macintosh System
The first thing to recognize is that there are many ways that a
machine may be compromised. Viruses, software with built-in trojan horses, keylogging
software and remote admin programs can all be easily installed (either
physically or remotely) on your machine, and used to keep tabs on your
computer and the files that it processes and runs.
To help ensure you are not running software that is putting the
security of your machine at risk you should perform clean system
software installations on a regular basis. System software should be
obtained only from a reputable source. If for some reasons you have
any doubts about the system software in your possession - get a new
copy directly from Apple.
This below doesn't sound right
One thing to do right away upon a new system install is to delete or at
minimum move to a disabled folder.
System 9.0+
Web Sharing extension & control panel
location: HardDrive:System Folder:Control Panels:Web Sharing
System Folder:Extensions:Web Sharing Extension
Personal Web Sharing server software that is installed with a lot of
Macintosh operating systems unless you really plan on running web
server from your home computer.
Multiple Users extension
location:
Also recognize that the Multiple Users
support in OS 9 (allowing you to set different levels of access to
your machine) is very easy to break through with nothing more than a
startup CD or via many several other methods. "Multiple Users" is not secure
Find By Content extension and folder
location: HardDrive:Extensions:Find By Content
HardDrive:Extensions:Find: (entire "Find" directory)
Find by Content automatically indexes your Hard Drive for use by Sherlock
Remote Access control panel
location: HardDrive:Control Panels:Remote Access
Allows access from
Software Updater 2 extensions & control panel
location: HardDrive:Control Panels:Software Update
HardDrive:Extensions:Software Update Engine
HardDrive:Extensions:Software Update Scheduler
Modem control panel
location: HardDrive:Control Panels:Modem
If you use an ADSL and Cable connection and do not sue you internal or external dialup modem at all,
disable this control panel so that it can't be used by Remote Admin or Trojan software.
System 8.5
Remember that all software residing on your hard drive that is not
stored in a encrypted partition or disk is at risk of incursion. Clean
installs of other important software are also a good idea. Check
cryptographic signatures on software distributions that are signed.
Mac Os 9 has introduced the Apple Verifier utility (located: HardDrive:Applications:Security)
You can verify whether a Mac OS file or program that you've downloaded from the Internet is
from the authorized sender and has not been modified by checking its digital signature.
10/20/99 - 60481 - Mac OS 9: File Security - Verifying Digital Signatures
http://tcl.info.apple.com/techinfo.nsf/artnum/n60481
Detection
The Detection Section of this model covers policies and procedures that enhance
the chances for the system administrator or user to detect improper or
unauthorized use of a Macintosh using MacOS V7.5.x.
The policies and procedures
discussed in this section tie directly into the actions listed in the Background,
Prevention, Awareness, and Recovery sections.
Recording System Defaults
When a Macintosh is accessed by an unauthorized user, there is a possibility that
the system software, application software, and documents will be modified or
deleted. When an unauthorized access is detected, the system administrator should
check the Macintosh for modified and deleted files, hidden files, viruses, trojan
horses, etc., and then restore the Macintosh to its original state.
Keeping
accurate information on the default system configuration is an easy way to detect
and defeat and unauthorized user in this regard. The routine procedure of making
system backups, comparing current and archived files for unexpected changes, and
reviewing the Startup Folder, Shutdown Folder, Extensions Folder, and Preferences
Folder for unexpected additions or changes will help the system administrator and
users detect unauthorized activity.
ACTION: Implement a routine schedule of
complete system backups. Periodically verify that the backups are usable. Check
the default system configuration for any unexpected changes.
Paving your hard drive
Do not download and use software from any ftp or web sites that are suspicious in any way.
This includes a lot of free web page servers...
Know what software is installed on your computer. Be ware of spyware products and other snakeoil.
System Integrity
After re-installing a clean Operating System on your Mac and software from verified sources.
Installer Observer 3.02 (home - download PPC / 68k).
is a program designed to aid users in determining exactly what an
Installer/Updater/Trojan Horse/Whatever has done to their system.
One should use it to first Scan folders within and/or including their System folder and save a snapshot
of those folder(s) if necessary.
Then, after running
Installer/Updater/Trojan Horse/Whatever, he or she should load the saved system state if necessary
and have Installer Observer Examine the changes made by the
Installer/Updater/Trojan Horse/Whatever. Installer Observer will report new files/folders,
files/folders that have been removed, and files/folders that have been
changed.
Utilities such as WhoInstalled 1.1.2
(home - download)
A copy of the "snapshot" should be kept in a secure place preferably on encrypted disk.
Virtual Memory, RAM and Memory caches
If at all possible you should not be using Virtual Memory at all (see above)
but if you are, it can be erased after you disable it in the
Restart your computer and then wipe all the free space on your hard drive
Virtual Memory uses space on your Hard Drive as Virtual RAM in essence storing your everything from RAM on your Hard Disk.
Solution: Buy enough RAM so you do not have to use Virtual RAM and turn it off in the Memory
control panel (located: HardDrive/System Folder/Control Panels/Memory)
A few simple precautions need to be taken to assure the absolute secrecy of your data. First of all,
NEVER run enigma with virtual memory on, an image of the
clear-text or key could be left on your hard disk. See the memory control panel for this switch.
This caution applies to the new "enhanced" virtual memory tools
such as OptiMem and RamDoubler as well. If you can't live without these utilities just be sure to
always run Enigma when you have plenty of free (real) RAM.
KeyLogging, Trojans and Remote Admin
Detection
Manually checking your System Folder to know what belongs there after a clean system install is
good idea. You can use a program like ResEdit so you can see all invisible files and folders on your hard drive.
Its always a good idea to inspect your Extensions, Control Panels and Startup Items folder and take a
look for any strange files.
Monitoring System Processes
Cone Of Silence (home - download) was developed to detect key-logging software running in the background on your computer.
It great little utility for detecting for keylogging software, but what works even better is...
System process watchers like
Peek-A-Boo 1.5 (home - download),
ProcessInfo 1.3.1 (home - download) and
ProcessWatcher 3.2
tend to be the best method of detecting any strange processes running the background on your computer.
Peek-A-Boo window
Strong Encryption
Security of your files and information stored on your computer
can only be kept from most eyes by encrypting them.
Read more about encryption...
Disk Encryption
Encrypting your hard drive is an ideal solution to many security problems.
Large amounts of data including software can all be stored safely inside and encrypted partition.
Users or groups can be given there own encrypted partition.
The only really good option out there is PGP Disk and it has been distributed free with several versions of PGP for the Macintosh.
It allows for PGP partitions of sizes from ???k fitting on a floppy all the way up to 2000 MB.
PGP and PGP Disk versions below 6.5.1 are not compatible with Mac OS 9.0+
Download:
Harden Your Browser
Use 128 bit encryption only.
Secure Socket Layer (SSL) allows you to have secure access to a web site or certain pages on a web site. Connections
always use the prefix https:// (Secure HTTP) instead of http://. You can usually find out if a server has SSL available
by trying their normal url and adding the s. You can tell if you are connected using a SSL connection by looking at the
bottom bar of your browser. Depending on what browser you are using you will see a closed lock instead of an open lock or a
key with one (40 bit) or two (strong encryption) teeth instead of a broken key.
You can test your browsers encryption strength by using Fortify's test page click here
Snake Oil
Good cryptography is an excellent and necessary tool for almost anyone. Many good cryptographic products
are available commercially, as shareware, or free. However,
there are also extremely bad cryptographic products which not only fail to provide security, but also
contribute to the many misconceptions and misunderstandings surrounding cryptography and security.
Read "Snake Oil Warning Signs: Encryption Software to Avoid" (local original pdf version)
File Sharing and Apple Talk Networks
Turn off File Sharing and when connected to the net.
If you're not connected to an AppleTalk Network, disable Appletalk.
E. For Macintosh systems, disable file sharing and web sharing extensions unless absolutely required.
If file sharing must be enabled,
ensure strong passwords for access, and stop file sharing during periods in which it is not required.
To permanently disable Web sharing in MacOS 8 or MacOS 9, remove two files and restart:
System Folder:Control Panels:Web Sharing
System Folder:Extensions:Web Sharing Extension
To permanently disable AppleShare/IP in MacOS 9, remove one file and restart:
System Folder:Extensions:Shareway IP Personal Bgnd
If you need to use an AppleTalk network you should seriously consider using
Public Key Authentication for AppleShare
(home - download)
or some other type of encrypted Virtual Private Network like PGPNet.
The Internet
Firewalls
If you connecting to the internet all, even via a dialup 300 baud modem you should be using
at least a software firewall at all times.
There are really only two products out there for the Macintosh; NetBarrier and DoorStop.
While they are both great products I reccomend NetBarrier as its interface is easier to use
and has few more bells and whistles.
It also provides some other good options such as;
Full logging and a Fully customizable Rules set.........
Internet Control panel info
Internet Browsers
Browser bookmarks, caches and history's are all very easily viewable. They are even utitlites to
help make it reall easy for you like Netscape History 3.0.3
ICab
Explorer
Netscape:
about:memory-cache (you'll see the memory cache)
about:image-cache (you'll see a list of the cached images...)
about:global (you'll see global history entries)
about:cache (you'll see all disk cache statistics)
about:document (you'll get a new window with info about the current document)
Customize your Netscape Communicator preferences for your privacy and security:
step #?
Select Preferences from the pull down Edit menu.
In your Preferences make the following changes:
Click on Navigator, change Navigator starts with
to Blank Page if it is not already.
Delete the Home page location: so it is empty.
Change the Visited links expire after to 1 day. You can also
clear you History by clicking on Expire now.
Click on Smart Browsing, make sure Enable "What's Related" is not checked, also
make sure Enable Internet Keywords is not checked.
http://www.interhack.net/pubs/whatsrelated/
Eudora
No Log plugin
NoLog by Andrew Starr turns off Eudora logging.
http://www.emailman.com/eudora/mac/macfiles/nolog.sit.bin
Edit headers plugin
http://www.emailman.com/eudora/mac/plugin.html
Traces on your computer
Hard Disk
As you probably already know everything you throw in the Trash is not actually erased when you
empty the trash. It is an amazingly simple process to run Norton UnErase or another data recovery tool
and get dozens of files that you have "deleted".
In order for any file to be securely deleted you should use some type of data overwrite utility.
Even files that are encrypted should be securely destroyed.
Free Space Wiping
There are many utilities for the Mac that are supposed to overwrite data securely.
We reccomend Burn 2.5 (home - download)
In order to securely delete data you should set the preferences to use a Random
Pattern and overwrite data 13 times.
? PGP Wipe - http://www.McCune.cc/PGPpage2.htm#Wiping
---
Expert Witness for Macintosh, version 3.6
Registered users of Expert Witness for Macintosh should make sure they are running the latest version.
---
File Resource Headers
info.....
Wipe Resource Headers 1.0 (home - download)
20 July, 2000 - I found out at MacHack this year that Mac OS 9.0.4 actually wipes the resource header when it creates a new file. Cool. They're obsoleting this product for
me. Of course any files you'd created before you installed 9.0.4 could still have sensitive information in the header, but at least new files won't.
Postscript File Headers conatin email addresses from Internet Config......
StripAPost
PGP Tips
Your secret keyrings, if you do happen to be using PGP!
These are protected by your passphrase, so I hope you've got a realllllly long one, and it's not
something any average cracker will be able to pick, and you're not running any keypress macro recorders or typing sniffers, and you've not got any
Trojan Horses or Password Targeted Viruses busy siphoning off your passwords and passphrases, and you trust all the software you run on your PC,
even Micro$oft's recent "on line sniffing programs"
PGP Preferences, keys and RNDSeed all normally located in your System Folder (YourHardDisk/System Folder/Preferences/Pretty Good Preferences)
should be moved to your encrypted PGP Disk partition.
Set Auto-Unmount to a low amount of time. This way if you walk away from your computer and forget
to umount your PGP Partition it will attempt to auto-unmount it
Other Tips and Tricks
Startup & ScreenSaver Security
Most if not all password protection schemes on the market for the Mac OS can be bypassed or broken via
numerous methods. You should never rely on them.
They may keep out a typical layperson, nosy person and even some hired investigators out
they won't keep and any Security Professional out for very long.
Encrypted partitions/disks are the only real solution.
Apple's startup password security features have been plagued by security and other
bugs through it's history. They may be good enough to keep lots of people out but are allmost
always accessible through a backdoor or some other means.
Using Mac OS 9's Multiple Users feature you can have a password at startup. If you need very
strong security, or are not running Mac OS 9 you may need to purchase a third-party solution
such as a screen saver, or other security software.
Passwords
Use secure pass phrases for your System and Internet related programs.
But beware that a lot of software out there does not use very secure encryption for password storage and
some of them use none at all.
Stayaway 1.0 will break the encryption algorithm used on the MacOS Users & Groups Data File, On Guard,
Internet Config, FreePPP, Virex Control Panel, FTP Transmit, and Keep Out!
Choosing not to Save the password in the program if it gives you the option and moving the applications
applicable preference/setting file to a secure encrypted disk/partition and replacing
it with an Alias may also help solve this problem.
Do not use the same passwords for System/Internet related programs and
other more secure and much more important applications such as PGP, Web Confidential, etc.
References
Sites:
security.tao.ca - http://security.tao.ca
Secure Mac - http://www.securemac.com
Mac Security
Pure Mac's - Paranoia software section
Articles:
Secure Deletion of Data from Magnetic and Solid-State Memory - http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
Info Sources
Encryption:
A Basic Introduction to Crypto
Why Cryptography Is Harder Than It Looks - By Bruce Schneier
Minimal Key Lengths For Symmetric Ciphers to Provide Adequate Commercial Security
Newsgroups:
| 
