"Hey Siri" support and possibly wireless charging case alongside AirPower charging mat.
Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero
Google's security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. [...]As the 90-day deadline hit during the week, the group began posting its findings online. Google's notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.
Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.
But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
[B]ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.Google's Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.
Tags: OS X 10.10.2, Project Zero
[ 195 comments ]
Top Rated Comments
(View all)
50 months ago
Google is playing dirty.
How?
They could expose the issue without the 90 day grace period if they wanted to be dirty.
50 months ago
Anyone hear that that explosion at Cupertino?
The irony that Android right now is biggest botnet source in the world right now because of crap level security and upgrade policy... That I could have 100+ separate security patches for Microsoft in one year... Makes Apple pretty secure from any derision from the likes of Google or Microsoft.
50 months ago
Google is playing dirty.
You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple
50 months ago
You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple
Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.
50 months ago
Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.
50 months ago
How about Google actually fix their own bugs?
Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548
Those in glass houses...
Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548
Those in glass houses...
50 months ago
I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.
I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.
50 months ago
Its funny how so many people are shooting the messenger. Regardless of how it came to light, the fact is Apple needs to address this (like any security concern) yet, this thread has turned into an argument on how bad google is.
50 months ago
Nice heads-up from a company who has the most buggiest OS of them all.
Let's others report all the bugs and security holes in Android and give them 90 days.........
Actually, Google is totally cool with that. In fact, they encourage it.
From http://www.google.com/about/appsecurity/ :
"If you believe you have discovered a vulnerability in a Google product or have a security incident to report, go to goo.gl/vulnz to include it in our Vulnerability Reward Program. If you have a vulnerability report for Android, email security@android.com. For Chrome vulnerabilities, use the Chromium bug tracker. Upon receipt of your message we will send an automated reply that includes a tracking identifier. If you feel the need, please use our PGP public key to encrypt your communications with us.
We believe that privately notifying vendors about vulnerabilities in their software, and setting reasonable disclosure deadlines in accordance with the severity of the bugs, is good for the overall security of Internet users."
[ Read All Comments ]
Apple has enhanced Spotlight search in macOS in recent years, with the addition of Spotlight Suggestions allowing it to tap into a variety of online data sources like weather and sports....
Apple has ceded its position to Walmart as the third largest online retailer in the U.S., according to a new report out this week (via TechCrunch).
Research provider eMarketer Retail calculates...
Adobe today updated its Lightroom app for iOS devices with support for Apple's latest iPhones and iPads.
Lightroom CC for iOS will now display properly on Apple's fall devices, including...
Tap, the company behind the futuristic Tap wearable keyboard, today announced the launch of a new TapAcademy app for iOS that's designed to make it easier to learn to use the keyboard.
Tap...
Verizon today announced the launch of a new "My Numbers" feature designed to let you add up to four additional numbers to a smartphone with unlimited calling and texting, for a total of five...
For this week's giveaway, we've teamed up with SANDMARC, a company that makes camera lenses for the iPhone, to offer MacRumors readers a chance to win a kit that includes a set of Pro...
Popular weather app Weather Atlas, made by Contrast and Agile Tortoise, today received a major 2.0 update that adds new functionality and a new look to the app.
With the 2.0 update, Weather...
Anki has been making toys that use artificial intelligence for years now, starting with the Anki Overdrive set of racing cars and the interactive Cozmo toy robot, but this year the company launched...
