Security-Protocols

No I am not joking either. Apple has finally released a Time Machine update, as well as AirPort Firmware 7.3.1 which enables Time Machine over AirDisk. Now, AirDisk is still not all that stable but it does work. I am still using an old Mac Mini for my file server / Time Machine backup system since its much more stable than using AirDisk on my AEBS.

So what you need to do is apply the AirPort Update 2008-001, then install Time Machine and AirPort Updates 1.0. Then launch the AirPort Utility and you should be prompted to update to firmware 7.3.1. If not, choose you can “Manual Setup” then choose “Upload Firmware” from the Base Station menu.

So the next question is.. where are our encrypted Time Machine backups? This was a feature in early builds of Leopard, but was yanked out for the final release.

Today, Apple has released Safari 3.1 which supports HTML 5 which introduces new CSS animation, HTML5 media support as well a downloadable fonts.

CSS - animation capabilities has support for transitions, and also animations which allows you to do CSS animations as well as Transitions. See my demo below:

< video src=sample.mov autoplay /video >

HTML5 Media Support - The new HTML5 “video” and “audio” elements allow you to add native support for embedding video and audio content in web pages. They also provide a rich scripting API for controlling playback. This makes is almost as simple as adding an image to a webpage:

Downloadable Fonts so you can link to actual font files within your CSS, instead of having to rely on common which are available to browsers.

The Safari 3.1 also fixes 13 security related flaws most of them being boring cross-site scripting issues. I have started fuzzing Safari 3.1 HTML5 markup elements and the CSS animation stuff to see what new flaws they have introduced in 3.1. I will update this post with what new bugs I find.

On Tuesday, Apple released AirPort Utility 5.3.1, which is the software to control the AirPort Extreme Base Station, AirPort Express Base Station and Time Capsule. AirPort Utility 5.3.1 is available for download either using the Software Update and or directly from Apple’s Web site. Apple has indicated that the AirPort Utility 5.3.1 “includes general fixes and compatibility updates” for AirPort Utility, AirPort Base Station Agent and the AirPort Disk Utility.

So im sure everyone is wondering if 5.3.1 will enable users to use an attached drive for wireless time machine backups on an Airport Extreme? The answer is NO. Thanks Apple!

AirPort Utility 5.3.1 Download
http://www.apple.com/support/downloads/

Nate True and The Dev Team has released jailbreak for iPhones and iPod touchs running version firmware 1.1.3. This one is also very similar to the jailbreak which was released earlier this week, only without the issue of your iPhone not working. Do note that this jailbreak requires your iPhone to be running firmware v1.1.2. iPhones running v1.1.1 will need to upgrade to v1.1.2, jailbreak, and then install the “BSD Subsystem” package. The reason for this is because the v1.1.3 jailbreak occurs on the iPhone itself and is therefore platform independent.

This jailbreak does not upgrade the iPhone’s baseband which breaks things like “Locate Me” functionality in Google maps. If your using a valid AT&T account, it is a good idea to upgrade to v1.1.3 and then downgrade to a jailbroken version of v1.1.2.

For the ones who are using an unlocked iPhone, I suggest that you stay away from firmware version 1.1.3 because it will re-lock your iPhone.

I have tested this jailbreak, and it defianlty works as advertised. It does require some patience, but from my experience it didnt have very many issues.

Download here:
http://security-protocols.com/files/Jailbreak-1.1.3.tar.gz

What did the five fingers say to the face? SLAP!

Rick James slaps v1.1.3

Michal Zalewski and his colleague Filipe Almeida have released DOM Checker which is an automated tool for validating browser security policy enforcement. Below is a description of DOM Checker from the page:

The tool features several fairly neat features, including exhaustive hierarchy crawling and side-channel blind write validation to reduce the number of false positives.

DOM Checker had been used to find a number of major security bypass and information disclosure problems in several popular browsers, and we had worked closely with vendors to resolve them (although it’s worth noting that the tool still reports anywhere from 10 to 30 low-risk, design-related information disclosure issues in these programs).

Our hope is that this tool may serve as a framework for ongoing browser security research, and would be integrated by browser vendors with their regression testing and general release QA processes.

Project Page:
http://code.google.com/p/dom-checker/

Access live instance for testing
http://lcamtuf.coredump.cx/dom_checker/