Why is your Mac all for sudden using Bing as a search engine?
Even as a Mac user, you may have heard about Bing, at least you may have seen it demonstrated in commercials [1]. But if your default search engine on your Mac is all for sudden switched to Bing, this may be due to another piece of legacy software that some Mac users may have a hard time living without : Microsoft's Internet Explorer. So why not just search ("google") if there is a version for OSX:
Sure enough, there is a FREE! Internet Explorer for Mac available. Lets download it, and see what happens.Â
As it turns out, the page that you are going to download (the usual .dmg file) is signed by a valid Apple developer signature. It will install fine with Maverick's default "gate keeper" setting. Upon installation, it offers a couple additional free product. A "Shopping and Search Helper" as well as some software that will clean your Mac and make it run faster and safer.
In some ways, I have to say I admire how honest the search optimizer is in its EULA. The software will (the original uses all upper case for this section, like shown below):
.. RESET YOUR HOME PAGE AND/OR DEFAULT SEARCH FOR INTERNET EXPLORER, FIREFOX AND CHROME TO TROVI SEARCH...
... BLOCK AND NOTIFY YOU OF ATTEMPTS BY OTHER SOFTWARE TO CHANGE YOUR SELECTED HOME PAGE AND/OR DEFAULT SEARCH...
The Trovi privacy policy is similarly explicit, and not hiding must. The software will collect among other items [2]:
- IP Address and device identifiers like UDIDÂ
- web pages you visit and the content you see, access and utilize...Â
- interactions on social networks
- registration information you provide like name, address, e-mail, phone number, gender birthday
In the end, you end up with a bunch of adware, and , an actual legit version of Internet Explorer 5, which used to run on Mac OS, but doesn't really run on OS X Mavericks.Â
For a full walk through see this YouTube video:Â https://www.youtube.com/watch?v=bVwyxaYJgKY
â??
In short: I don't think this software does anything illegal. It clearly advertises what it does. If you feel otherwise, you can file a complaint with courts in Cyprus where the company is located.
[1]Â https://www.youtube.com/user/bing
â??[2] http://info.trovi.com/Privacy
CSAM: My Storage Array SSHs Outbound!
Kuddos to Matthew for paying attention to egress traffic. We keep emphasizing how important it is to make sure no systems talk "outbound" without permission. Just this last week, various Shellshock exploits did just that: Turn devices into IRC clients or downloading additional tools via HTTP, or just reporting success via a simple ping.
So no surprise that Matthew wrote us: "... the first time I saw the storage array SSH to the internet I about fainted. ..."
I would be surprised too! And turns out that isn't the only person that experienced this. Mark noted:
"Had the seem freak moment when I saw it happen. The SAN happily communicating to an outside entity. Though the company had been well and truly hosed."
Luckily, before going too far down the incident handling road, Matthew realized that this was a false positive. The storage array in question called "back home" to the vendor to report on its status. The purpose of this communication is to report failed disks or other critical events that may trigger a service call. Vendors will agree to turn off this feature, but then of course it is up to you to recognize faulty disks.
Got anything like that? Let us know. (if possible with log snippet / packet capture or other show-and-tells)
Cyber Security Awareness Month 2014: Scary False Positives
To "celebrate" cyber security awareness month, we decided to focus on "scary false positives" during October. If you have any to share, please let us know. What we are looking for is preferably a lot entry, or another "indicator" that led you to believe that your system was compromised, but in the end turned out to be a false positive.
Please e-mail your stories to handlers-at-isc.sans.edu or use out Contact form.
Comments
Anonymous
Dec 3rd 2022
9 months ago
Anonymous
Dec 3rd 2022
9 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
Anonymous
Dec 26th 2022
8 months ago
Anonymous
Dec 26th 2022
8 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
8 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
8 months ago
Anonymous
Dec 26th 2022
8 months ago
https://defineprogramming.com/
Dec 26th 2022
8 months ago
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
https://defineprogramming.com/
Dec 26th 2022
8 months ago
rthrth
Jan 2nd 2023
8 months ago