Anyway, having a regular schedule for privately-disclosed doesn’t mean you can’t also publish special-case urgent updates whenever you want, as Microsoft sometimes does. In short, Apple seems IMO to lack regularity, frequency and urgency in its updates, and “when the vendor feels like it” isn’t really good enough these days. Like many others, I see zero point in handing patches to the malware and exploit rats on a plate on an appointed day. There’s no defense for that behavior other than the fact that many IT staff are lazy and like it that way, which of course is an idiotic excuse. As for XProtect being “an anti-virus,” I never called it that.

1. Mac Os X Security Features

Apple has seemingly settled on a three-year support policy for OS X security updates. OS X 10.8's (Mountain Lion's) lifespan assumes a final security update in September 2015. Labeled as Security Update 2015-004 1.0, the software update includes many fixes to a wide variety of potential security issues for OS X, and is therefore recommended for all Mac users running OS X 10.9.5 or OS X 10.8.5 to install. OS X El Capitan 10.11.1, Security Update 2015-004 Yosemite, and Security Update 2015-007 Mavericks OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 21 Oct 2015.

Thursday, Apple issued a new security update for Mac users running OS X Yosemite 10.10.2. The update, titled ‘Security Update 2015-003 1.0,’ is available right now through the Updates tab of the Mac App Store and is recommended for all users as it improves the security of OS X.

Apple has released security updates for QuickTime, Safari, Mac Extensible Firmware Interface (EFI), OS X Yosemite, and iOS. Exploitation of some of these vulnerabilities may allow an attacker to obtain elevated privileges or crash applications. Available updates include: • QuickTime 7.7.7 for Windows 7 and Windows Vista • Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7 for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.3 • Mac EFI for OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5 • OS X Yosemite 10.10.4 for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10 to v10.10.3 • iOS 8.4 for iPhone 4s and later, iPod touch 5th generation and later, and iPad 2 and later US-CERT encourages users and administrators to review Apple security updates,,,, and apply the necessary updates.

If I were a gambling man (there’s a song about that!), I’d wager that 10.6 *is* out of support, not least because 10.7 and later all have a different architecture and only work with newer, albeit now fairly old, Macs. As a cut-off point, supporting back to 10.7 makes a lot more sense for Apple than supporting back to 10.6, and can be still be considered reasonably generous.

The rest of the Macs that are compatible with it have newer operating systems. High Sierra On September 25, 2017 Apple released 10.13 High Sierra. Its on the low end are identical to its predecessor Sierra although some new features may require newer hardware. Before making an installation. Also, unlike Sierra, your Mac must be running a mimimum of Mountain Lion. Do not depend on older news of compatibility than the official release date, as that may pertain to prerelease beta software compatibility, which may differ from the release version.

FileVault 2's whole-disk encryption is more secure, in part because virtual memory swap files, system logs, and other potential sources of data leakage are encrypted. We've previously covered; search for and click 'load more posts' to find even more articles. Apple also made security enhancements to (ASLR), making programs more attack-resistant by using memory in less predictable ways.

Apple does not abandon machines that are less than two years old, that is simply false. Apple is doing this simply to make more money. They have always done this, which is why I happily abandoned ship in the mid 2000’s. There is nothing about Lion or Mountain Lion that’s requiring insane new hardware requirements (Windows 8 is LESS resource intensive than Windows 7 and runs faster on legacy machines than 7 does). Apple wants your money.

By resetting the system clock, hackers who have already managed to grab limited control of a Mac can sidestep the need for the root-access password. The sudo flaw had been identified in OS X in March, but attracted more attention two weeks ago after Metasploit, the popular open-source penetration toolkit, that made it easy to exploit the bug. [ ] Also published Thursday was an update to Safari 5, the Apple browser for Snow Leopard; the separate update patched a pair of vulnerabilities, including one revealed at the September 2012 Mobile Pwn2Own hacking contest by a Dutch team who used it to exploit iOS.

10.4.8 has been found to have an issue with WiFi (Airport) on Intel Macs, and solutions are currently still being sought for these issues. Not all Intel Macs are affected, and most likely if you follow the suggestions below when you do upgrade, you won't have trouble with the update.

As mentioned to some degree above, many security enhancements can be worked around by a determined attacker (for further reading, see on the topic). Even with all that Apple has done and continues to do to keep Mac users safe, it's critical for users to stay aware of the various types of attacks they may face on a daily basis, and to continually learn how to avoid falling victim to them.

Business Insider. From the original on August 18, 2012. Retrieved September 1, 2012.

Sandboxing helps contain malicious code. The App Sandbox in macOS helps ensure that apps do only what they’re intended to do.

If you want a preview, > please download the version in our CVS repo at I know it isn't the most recent version available, but this version is used extensively across the corporation. Changing the version of ACE all these products used will cause the architect's heads to explode;) Is it your opinion that 5.3.1 is hopeless cause on. Hi Jason, >> I know it isn't the most recent version available, but this version >> is used extensively across the corporation. Changing the version of >> ACE all these products used will cause the architect's heads to >> explode;) >> >> Is it your opinion that 5.3.1 is hopeless cause on Tiger? It'll take some work, but companies like Riverace, Remedy, and OCI can help out with this stuff if staying with 5.3.1 is essential.

Was introduced in Lion, designed to suppress potential damage caused by third-party applications or the exploitation thereof, and to reduce a compromised or misbehaving app's ability to steal or damage a user's data. Image credits: Apple,; inspired. Apple also added the new Gatekeeper feature from OS X 10.8 to the final version of Lion, 10.7.5. OS X 10.8 Mountain Lion (released in July 2012) The most notable security improvement in OS X 10.8 Mountain Lion was, a feature designed to help prevent malware and sketchy programs downloaded from the Internet from running. It added a new set of options in the Security & Privacy section of System Preferences, where the user could choose to allow applications downloaded from: the Mac App Store only, the Mac App Store and 'identified developers' (meaning developers registered with Apple), or anywhere. Image credit: Apple Does Gatekeeper really help?

Retrieved May 19, 2013. • Breen, Christopher.

There is a huge difference between 10.10 and 10.2. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. In article, John Albert wrote: > I tried downloading and running the update, and it wouldn't install over > my copy of 10.2.2 (public beta, build 14C106a). > > It threw up the message (to the effect): > 'Your system doesn't support the update'. > > Just wondering if someone who -does- successfully install the posted > version of 10.2.2 would be kind enough to post the build number after > running the update?

OS X 10.7 Lion (released in July 2011) OS X 10.7 Lion introduced FileVault 2, offering full-disk encryption. This was an improvement upon the FileVault feature of previous versions of OS X which only had the ability to encrypt individual user accounts. FileVault 2's whole-disk encryption is more secure, in part because virtual memory swap files, system logs, and other potential sources of data leakage are encrypted. We've previously covered; search for and click 'load more posts' to find even more articles. Apple also made security enhancements to (ASLR), making programs more attack-resistant by using memory in less predictable ways.

Leopard was the second and final major release of Mac OS X to officially support both PowerPC and Intel processors. Leopard's PowerPC version (which ran on G5 and higher-end G4 processors) was the first version of Mac OS X to not include the '.' From the very first version of Mac OS X all the way through Tiger, Classic had enabled software written for Mac OS 9 or earlier to run alongside Mac OS X applications. A side effect of Classic's demise was that most malware developed prior to OS X could not infect upgraded Macs. Mac OS X 10.6 Snow Leopard (released in August 2009) The most well-known security enhancement in Mac OS X 10.6 Snow Leopard is Apple's introduction of XProtect, which Apple somewhat confusingly called the 'safe downloads list,' even though it was originally designed to block certain known malware from being downloaded. In September 2012, Apple enhanced the XProtect functionality to also block outdated versions of two common browser plug-ins, Adobe Flash Player and Oracle Java, which were often exploited by malicious or infected Web sites and advertisements, and in January 2016 Apple began blocking outdated versions of Microsoft Silverlight. As of February 2016, Apple continues to update the XProtect signatures for Snow Leopard, even though Apple has long since stopped patching the core Snow Leopard operating system along with its versions of Safari, iTunes, and other components.

Apple itself admits this; the company in 2009, 'The feature isn't intended to replace or supplant antivirus software, but affords a measure of protection against the handful of known Trojan horse applications that exist for the Mac today.' Although Apple tried to downplay the prevalence of Mac malware at the time, a significant number of new threats targeting the Mac have been in the wild in the intervening years; see (covering the 1990s through November 2014) and our (covering 2006 through the end of 2015). It cannot be emphasized enough that using a Mac without antivirus software in today's day and age is quite a bit like driving on the highway without a seatbelt; you might get lucky and never get hit, but it would be rather reckless to take that risk. We urge you to check out and decide which is best for you.

CVE-ID CVE-2014-4371: Fermin J. Serna of the Google Security Team CVE-2014-4419: Fermin J. Serna of the Google Security Team CVE-2014-4420: Fermin J. Serna of the Google Security Team CVE-2014-4421: Fermin J. Serna of the Google Security Team Kernel Available for: OS X Mavericks v10.9.5 Impact: A person with a privileged network position may cause a denial of service Description: A race condition issue existed in the handling of IPv6 packets. This issue was addressed through improved lock state checking. CVE-ID CVE-2011-2391 Kernel Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1 Impact: Maliciously crafted or compromised applications may be able to determine addresses in the kernel Description: An information disclosure issue existed in the handling of APIs related to kernel extensions.

Retrieved August 20, 2012. • August 17, 2012.. From the original on July 29, 2012. Retrieved September 1, 2012. • Dachis, Adam (July 28, 2012).. From the original on August 30, 2012. Retrieved September 1, 2012.

CVE-ID CVE-2014-4497 Bluetooth Available for: OS X Yosemite v10.10 and v10.10.1 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An error existed in the Bluetooth driver that allowed a malicious application to control the size of a write to kernel memory. The issue was addressed through additional input validation. CVE-ID CVE-2014-8836: Ian Beer of Google Project Zero Bluetooth Available for: OS X Yosemite v10.10 and v10.10.1 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple security issues existed in the Bluetooth driver, allowing a malicious application to execute arbitrary code with system privilege. The issues were addressed through additional input validation. CVE-ID CVE-2014-8837: Roberto Paleari and Aristide Fattori of Emaze Networks CFNetwork Cache Available for: OS X Yosemite v10.10 and v10.10.1 Impact: Website cache may not be fully cleared after leaving private browsing Description: A privacy issue existed where browsing data could remain in the cache after leaving private browsing.

Anti-malware is the accurate term. Tradition is no reason to keep using the ‘virus’ word when it doesn’t actually apply. What Apple called XProtect, I don’t know.

Mac Os X Security Features

Retrieved August 26, 2014. Archived from on January 4, 2012. Retrieved August 26, 2014. Retrieved June 6, 2011.

Apple has released security updates for QuickTime, Safari, Mac Extensible Firmware Interface (EFI), OS X Yosemite, and iOS. Exploitation of some of these vulnerabilities may allow an attacker to obtain elevated privileges or crash applications. Available updates include: • QuickTime 7.7.7 for Windows 7 and Windows Vista • Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7 for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.3 • Mac EFI for OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5 • OS X Yosemite 10.10.4 for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10 to v10.10.3 • iOS 8.4 for iPhone 4s and later, iPod touch 5th generation and later, and iPad 2 and later US-CERT encourages users and administrators to review Apple security updates,,,, and apply the necessary updates. This product is provided subject to this and this policy.

The issue was addressed with improved type checking. CVE-ID CVE-2014-8835: Ian Beer of Google Project Zero UserAccountUpdater Available for: OS X Yosemite v10.10 and v10.10.1 Impact: Printing-related preference files may contain sensitive information about PDF documents Description: OS X Yosemite v10.10 addressed an issue in the handling of password-protected PDF files created from the Print dialog where passwords may have been included in printing preference files. This update removes such extraneous information that may have been present in printing preference files. CVE-ID CVE-2014-8834: Apple Note: OS X Yosemite 10.10.2 includes the security content of Safari 8.0.3.

Staying on Mountain Lion just got risky. Related Topics. By registering you become a member of the CBS Interactive family of sites and you have read and agree to the,. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services.

” If you call that “legacy hardware” you are insane, or so brainwashed by Apple you can’t admit when they are obviously screwing people over – Like I was for many years. Like them or hate them, Microsoft stands behind their OS’s for years. XP’s announced discontinuation of support was only recently announced. Vista, Win7, and Win8 are all supported running on a wide variety of hardware. I have 3 macs an i mac running osx 10.5, but wont upgrade any further but it still works well,so use firefox as my main browser and use sophos free anti virus just to be a bit safer,it still runs well so no intention of leaving it to gather dust just yet,my other 2 macs i have upgraded to lion but my white mackbook wont go any further so should be ok for a little while yet,my new i mac runs lion at the mo,but will upgrade that too mountain lion as soon as the bugs are ironed out!!!both of these macs run intego on a 3 year licence!!! Well then, Apple and linux use kind of the same open source (apple is closed source with open source components) thing. Thats why there are no or less viruses for Apple and linux because of their open source.

This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4481: Felipe Andres Manzano of the Binamuse VRT, via the iSIGHT Partners GVP Program CPU Software Available for: OS X Yosemite v10.10 and v10.10.1, for: MacBook Pro Retina, MacBook Air (Mid 2013 and later), iMac (Late 2013 and later), Mac Pro (Late 2013) Impact: A malicious Thunderbolt device may be able to affect firmware flashing Description: Thunderbolt devices could modify the host firmware if connected during an EFI update. This issue was addressed by not loading option ROMs during updates.

[ ] The has received an updated look, emulating the appearance of the aluminum metal surface that much of Apple's current hardware line-up sports. Scroll bars widen when the mouse hovers over them.

CVE-ID CVE-2014-4484: Gaurav Baruah working with HP's Zero Day Initiative FontParser Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4483: Apple Foundation Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1 Impact: Viewing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the XML parser. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4485: Apple Intel Graphics Driver Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1 Impact: Multiple vulnerabilities in Intel graphics driver Description: Multiple vulnerabilities existed in the Intel graphics driver, the most serious of which may have led to arbitrary code execution with system privileges.

There is a new QTMovie example implementing a simple QuickTime Movie Player - to show you how it works. ActiveDeveloper v2.14 also has the 3.