Apple Issues Network Time Protocol Security Fix for OS X Users

[OLDCODGER]

3. Buy an old, beat up Mac and disconnect it from the internet and run your old software that way. Or buy a new Mac with the current OS and use that for your internet usage.

Or you can continue to be willfully ignorant about security threats, in which case, good luck bro. You're gonna need it.

You missed one. Buy a cheap PC, put Ubuntu on it for surfing, and leave Mac for offline work - which is what I shall do shortly.

 

[dolphin842]

I think that Apple support article has some details wrong. I see the same SHA1 fingerprint on that certificate for every installer package I've downloaded from Apple, including some as far back as mid 2012, but it doesn't match either of the ones mentioned in that article (it starts with 1E 34 E3).

The SHA1 on the certificate itself will be different than the SHA1 for each individual update. The certificate is used to sign the package (which the OS uses for Gatekeeper verification), whereas calculating the SHA1 of the package doesn't involve the certificate — it's just a checksum of the bits inside the .pkg. Using individual .pkg SHA1 checksums from Apple is usually rather pointless, as Apple tends to serve the pages listing the checksums via unencrypted HTTP. The best bet is to instead verify that the certificate used to sign the .pkg is valid, which you've done.

You missed one. Buy a cheap PC, put Ubuntu on it for surfing, and leave Mac for offline work - which is what I shall do shortly.

An even cheaper option would be a chromebook or chromebox, if all you need is a web browser.

 

[OLDCODGER]

An even cheaper option would be a chromebook or chromebox, if all you need is a web browser.

Thanks, but I prefer to control the OS etc. (old-fashioned).

 

[AlecZ]

Here's another option for you: Turn off automatic time synching on Snow Leopard.

Good idea. I told my brother and will do this on my server.

 

[AlecZ]

You're right, it isn't. But to say the "software hasn't been supported" is wrong.

OS X has been updated pretty regularly: we're on Release 10 of it right now (10.10.x). For quite a few computers well beyond the typical useful life of computer hardware, it's possible to install up to the current dot-release update and get all the security fixes you need, and more.

To say "Apple stopped supporting Snow Leopard" is basically the equivalent of saying Microsoft "stopped supporting" Windows Vista Service Pack 1. The answer to that is: you need to update to the current version of the software to continue to get support. In Microsoft's case: that would be Vista, Service Pack 2, at a mininum. In Apple's case: either Mountain Lion, or go the free route and upgrade to Mavericks or Yosemite.

Apple's "dot" versions are very different from MS's, so it's not a useful comparison. All that really matters is that with Apple, you have to update your OS at least every 2 years to get full support (about every 4 years for security updates), and with Microsoft, you have a lot more time. Windows 7 and Snow Leopard came out around the same time. Thank goodness you can still use Windows 7 and have complete support because everyone hates Windows 8.

----------

Why would I do that? Snow Leopard works, and runs all my software properly. Later OSs add nothing of value to me, and, judging by comments on this board, causes problems that i don't currently have.

Exactly, it does nothing but create new problems! I'm sick of being harassed about updates every year. Apple for some reason can't just leave me alone with my OS that works perfectly fine. I have to update every 2 years (purely for Xcode; otherwise I wouldn't) and have to fix whatever new problems arise, usually slowing down my computer in the process.

They care so much about simplicity. It's nice how there are fewer hardware configurations out there (instead of thousands of models like Dell), but they ruin it by needlessly making so many versions of OS X.

 

[dolphin842]

Thanks, but I prefer to control the OS etc. (old-fashioned).

More than understandable... I tend to agree and hope that mentality doesn't become 'old-fashioned' .

That said, I am leaning toward Chrome OS in situations where someone else needs a computer but I don't have the time to administer it for them. So long as people are aware of what is entailed with running inside Google's ecosystem, I think it's a good choice in certain circumstances.

 

[CFreymarc]

You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

I have been involved with several network security profiles. Getting "in the head" of the people that write these pieces of malware. Typically, they are very strong talents that come from socially or economically suppressed backgrounds. If they were in an more open job market, most would code something much more productive.

 

[benji888]

So are Snow Leopard and Lion

1) Not affected
2) No longer supported

?

2) No longer supported.

Well, that's not very bright of Apple...to ditch security updates for users who are still using these OS's is just not smart, some can't, or don't want to update to a newer OS X. Some people have invested large $ in hardware and software that works, and they should not be left with an un-secure system...OS X upgrades may be free now, but, software updates to work with them may not be. Frankly, 10.6.8 Snow Leopard is still the most stable Mac OS X Apple has made yet (and, with the exception of Yosemite, perhaps the fastest), and I've used every single Mac OS since Mac OS 8.

In fact, even though Apple wants people to update to Yosemite, I have to go back to what I used to recommend and say, you're better off waiting for 10.10.3 before upgrading, if you haven't yet.

I used to wait for 10.x.3 updates before upgrading, but, I read Mavericks betas were decent, and it was free, and it started out better than Mtn Lion, and Mtn Lion was a bit of a sluggard, so, for the first time in years, I upgraded right away.

This is the problem with making the upgrades free, people are adopting it faster than they really should be. That is, only because Apple releases OS's lately that are not ready for consumption.

 

[scaredpoet]

All that really matters is that with Apple, you have to update your OS at least every 2 years to get full support (about every 4 years for security updates), and with Microsoft, you have a lot more time.

Actually, with Microsoft, you're going to get a lot LESS time than you used to have, starting with the end of Windows XP support that happened last year. Mainstream support for Windows 7, for instance, ends on January 13. And with the move from Windows 8.1 to Windows 10, the rapid release cycle is being adopted by Microsoft as well. The paradigms between he two aren't nearly as far apart as you might think.

Windows 7 and Snow Leopard came out around the same time. Thank goodness you can still use Windows 7 and have complete support because everyone hates Windows 8.

Yeah, about that....

 

[iolinux333]

First of all, I commend you for putting your money where your mouth is. More than anything said on an internet forum, voting with your walllet is the best way to tell companies how you feel.

Regarding the marketing thing, when has Apple actually lied as opposed to simply not living up to the expectation that you have placed on them given your interpretation of their marketing campaigns? Most Apple ads as of late don't even have many words, they just show people enjoying their products.

For example, if you interpret "It just works" to mean that every Apple product ever made will always work perfectly, then of course Apple lied. But no sane person would interpret that statement in such away. For that matter, nobody should ever make decisions based on marketing alone. I have never purchased an Apple product without seeing it in person and using it first. Separating marketing from reality is a basic skill that all able-minded people should possess, and no company should be held accountable for someone's lack of that skill- unless the company flat out lies. Again, I don't think that Apple has flat out lied in a very long time.

(To be clear, I am not trying to insinuate that you lack the ability to separate marketing from reality. I've seen your posts around here many times and know that you are intelligent. But I certainly know that a large segment of the public lacks the ability to do so, and it's quite alarming.)

Furthermore, Microsoft was indeed evil in comparison to Apple- ten to fifteen years ago. Today's Microsoft is a much more pleasant and nimble corporation that works with the market rather than against it. I sure hope people aren't stuck in the late 90's mentality that drove a wedge in between Mac and Windows users.

TL;DR- Take all marketing with a grain of salt, buy the product that works for you- Apple or otherwise.

Typing from phone so this is brief.

1. You nailed me on the 90s mentality. I'm still mad at Apple for not delivering a promised update way back then.

2. I just can't get over being LIVID that they won't issue a 1 MB patch for a critical security flaw to people who have machines they can't afford to upgrade. This doesn't affect me, I can buy whatever I want. But that wasn't always the case and I know what it's like to be left in the cold. I don't think anyone at Apple knows what that's like. They put the code out there in its flawed state. Their refusal to fix their problem speaks to a lack of character IMO.

3. Good post on your part & points being considered.

 

[scaredpoet]

Well, that's not very bright of Apple...to ditch security updates for users who are still using these OS's is just not smart, some can't, or don't want to update to a newer OS X.

You could say the same of Windows XP. The reality is that there comes a time where older software and hardware needs to be left behind, particularly when the current version of OS X still supports 7 year old hardware, and is just as stable.

How long is long enough? Should Apple still be required to patch System 7? ProDOS?

 

[tdale]

I'm having a hard time believing that it is actually motivated by money as much as it used to be since there are so many (easier) ways to make money online.

I believe that it has to be some sort of degenerate psychosis created by the anonymity of the internet. People have evolved over the last 20 years or so as the internet evolved to take pleasure in the misfortune of others. Its almost like the thrill of hacking a computer and knowing that you have ruined lives without being caught is the thing and the money is just the icing on the cake.

Yep, it's le the arsonist, who turns up to watch the fire

 

[iolinux333]

Mainstream support for Windows 7, for instance, ends on January 13.

Wut?

----------

More than understandable... I tend to agree and hope that mentality doesn't become 'old-fashioned' .

That said, I am leaning toward Chrome OS in situations where someone else needs a computer but I don't have the time to administer it for them. So long as people are aware of what is entailed with running inside Google's ecosystem, I think it's a good choice in certain circumstances.

I'm starting to think that my next machine might be something I set up to triple boot ChromeOS/Linux/Windows.

 

[jhwalker]

Then let me be blunt: the level of risk is high, and will grow higher with every new security threat. You are are already vulnerable to shellshock. With the NTP bug, that makes two high profile security vulnerabilities that you're not patching. It will only grow.

Sitting around, putting your fingers in your ears and saying "I don't know from these newfangled bugs!" and hoping nothing happens to your system isn't going to make the problem go away. If you insist on keeping Snow Leopard on your computer, then you need to learn how to use Brew or Macports to figure out how to compile and patch new versions of the low-level packages that run on your computer. That's the price you pay for wanting to run old software on the public Internet.

If that's not something you want to do, then you have other options:

1. Buy and learn VMware Fusion and install Snow Leopard in an isolated container, and run your old software in there while upgrading your main OS.

2. Upgrade and say goodbye to that old software, or

3. Buy an old, beat up Mac and disconnect it from the internet and run your old software that way. Or buy a new Mac with the current OS and use that for your internet usage.

Or you can continue to be willfully ignorant about security threats, in which case, good luck bro. You're gonna need it.

I have a 2007 MacBook Pro in *great* (not "old, beat up") condition. It runs just fine, does everything I want, and there is no reason whatsoever I should replace it . . . except that it cannot be upgraded past Lion, because Apple has artificially limited their support for this older hardware.

I don't plan on replacing it for a few more years, so I guess I'm just SOL WRT security issues until then :/

 

[scaredpoet]

You missed one. Buy a cheap PC, put Ubuntu on it for surfing, and leave Mac for offline work - which is what I shall do shortly.

Best of luck with that. I've used Ubuntu, it's a great OS, runs my web servers quite well. Just understand Ubuntu's standard support cycles: 6 months for mainstream updates, and 18 months for standard versions (yes, including security updates). The LTS cycles are 18 months mainstream and five years for security, of which 8 months of the most recent LTS has already gone by (leaving you 4 years, 4 months to go on security, and just 10 months to go on mainstream). The LTS security updates are about the same as the historical support cycles for OS X versions, and the mainstream support cycles are way, way less.

And all of those past, unsupported installations all have the same NTP bug that's got you riled up on the Mac today. The situation is no different there. Arguably even a bit "worse," assuming you like running outdated software. The answer to that is the same as on the Mac: Update your OS.

EDIT: My bad... starting with the last version, Ubuntu reduced the non-LTS lifecycle to 9 months, from 18. Including security updates.

 

[hugodrax]

You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

Actually it is more profitable. They are not going to go through all that trouble if it was not.

 

[scaredpoet]

I have a 2007 MacBook Pro in *great* (not "old, beat up") condition. It runs just fine, does everything I want, and there is no reason whatsoever I should replace it . . . except that it cannot be upgraded past Lion, because Apple has artificially limited their support for this older hardware.

"Artificial" is subjective. Your hardware is going on 8 years old. That's a pretty good run for a laptop.

I don't plan on replacing it for a few more years, so I guess I'm just SOL WRT security issues until then :/

I've already laid out possible alternatives that allow you to keep your OS. They just require a little extra work and some reading to get up to speed on.

 

[rdlink]

Microsoft supports their software for at least a decade.

With their yearly OS release schedule, Apple abandons software support after three years.

Microsoft supported XP for ten years because nobody would buy its replacement.

----------

You can install Yosemite on 7-year-old iMacs, hot shot.

Thank you. My ex girlfriend's early 2008 iMac will run Yosemite just fine.

Most people (Note that I said MOST) who come on these forums clamoring about how Apple abandoned them because they don't put out a convenience update for Snow Leopard, or Leopard actually have machines that will run the later (free) operating systems.

But they're like vegans. They want to make a lot of noise so that people will pay attention to them.

Now I've ticked off the old OS users and the vegans. Watch the fireworks now...

 

[Mr. Retrofire]

Most people (Note that I said MOST) who come on these forums clamoring about how Apple abandoned them because they don't put out a convenience update for Snow Leopard, or Leopard actually have machines that will run the later (free) operating systems.

New versions of OS X have a lot of bugs and are usually slower than previous versions.

 

[twigman08]

You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

While I agree about "hackers," I'm just pointing out that actually a lot of these hackers do have jobs. You know their are companies/people who get paid just to try to hack into systems and figure out security flaws, right? So some of these "hackers" you're talking about actually do have jobs. Their job is just to do what they like to do.

 

[bernuli]

fix no fix on Mountain Lion 10.8.5

I installed OS X NTP Security Update 1.0 from the app store, Updates section. All that seems to have happened is time stamp updates to

/usr/sbin/ntpd
and
/private/etc/ntp-restrict.conf

Neither file has changed byte wise, although diff does report ntp differs, but no diff in ntp-restrict.conf

Either way, I still seem to be running:

ntpd - NTP daemon program - Ver. 4.2.6

I have since disabled ntpd from the Date & Time pref pane.

 

[dolphin842]

Either way, I still seem to be running:

ntpd - NTP daemon program - Ver. 4.2.6

I have since disabled ntpd from the Date & Time pref pane.

Hmm... same here on 10.10.1: Ver. 4.2.6. For what it's worth, "what /usr/sbin/ntpd" says 92.5.1, which is what Apple says should be there, but I'm going to play it safe and disable time sync as well.

 

[bernuli]

oh, what. Yes, I am getting PROGRAM:ntpd PROJECT:ntp-77.1.1
vs
PROGRAM:ntpd PROJECT:ntp-77.1

on the old.

be nice is there was on version of getting the version.

Hmm... same here on 10.10.1: Ver. 4.2.6. For what it's worth, "what /usr/sbin/ntpd" says 92.5.1, which is what Apple says should be there, but I'm going to play it safe and disable time sync as well.

 

[Hurda]

I believe that it has to be some sort of degenerate psychosis created by the anonymity of the internet. People have evolved over the last 20 years or so as the internet evolved to take pleasure in the misfortune of others. Its almost like the thrill of hacking a computer and knowing that you have ruined lives without being caught is the thing and the money is just the icing on the cake.

Are you actually out of your mind?
Penetration-testing, application/network-security etc. is a multi-billion dollar industry.
You know, because companies want to find critical bugs before blackhats do.
Kids these days...

----------

Actually, with Microsoft, you're going to get a lot LESS time than you used to have, starting with the end of Windows XP support that happened last year. Mainstream support for Windows 7, for instance, ends on January 13. And with the move from Windows 8.1 to Windows 10, the rapid release cycle is being adopted by Microsoft as well. The paradigms between he two aren't nearly as far apart as you might think.

Wut?

Mainstream Support meaning new features and security-bugfixes.
After that date, it's an additional five years of security-bugfixes until January 13th 2020, called Extended Support.

Know your facts.

 

[Winni]

Snow Leopard is approaching being 6 years old...

And that's an excuse for not providing it with security updates anymore? Microsoft platforms receive security updates for at least a decade. MS also communicates very clearly the support cycle of a product before it is even launched. But unlike Apple, they are serving enterprise customers where you simply cannot expect your customers to roll out a new operating system every year. Maybe that explains their much better support cycles...