OS X Lion disappoints again - it's just like having no password at all

    OS X from apple has not seen a great deal of interest during development (if any) and one million downloads on launch day, reported by Apple, so you can expect that number was rounded. For an $30 OS this is certainly a disappointment.

Not only has one of the sites endorsed by Apple, Gizmodo, called it a failure but the cuts in manufacturing quality at Foxconn and security holes haven't certainly brought more popularity:

     Security blog Defense in Depth has found a glaring security flaw in OS X Lion that enables hackers to change the password of any user on a machine running Lion. “[While] non-root users are unable to access the shadow files directly, Lion actually provides non-root users the ability to still view password hash data,” Patrick Dunstan from Defense in Depth explained in a recent blog post. The result is that anyone could use a simple Python script, created by Dunstan himself, to discover a user’s password. It gets worse. Reportedly, OS X Lion does not require its users to enter a password to change the login credentials of the current user. That means typing the command: “dscl localhost -passwd /Search/Users/Roger” will actually prompt you to set a new password for Roger. Hackers could easily take advantage of the known bug if they have local access to the computer and Directory Service access. Disabling automatic log-in, enabling sleep and screensaver passwords and disabling guest accounts are as efficient to keeping your Mac secure as duck-taping the lid. We recommend upgrading to a Linux based OS or Windows.

MAC: Security so bad, even your battery can get hacked

There's your problem, it's a virus!

   Charlie Miller's managed yet again to render several Macbooks, Macbook Pros and Airs useless after gaining total access to their battery's micro-controllers' firmware via a security hole. Evidently, the Li-ion packs for the line of laptops are accessible with passwords he dug up from an 2009 software update. He mentions that someone could "use them to do something really bad," including faulting charge-levels and thermal read-outs to possibly even making them explode. He also thinks hard-to-spot malware could be installed directly within the battery, repeatedly infecting a computer unless removed.

“You could put a whole hard drive in, reinstall the software, flash the BIOS, and every time it would reattack and screw you over. There would be no way to eradicate or detect it other than removing the battery.”

iOS and MACos destroyed (again) at Pwn2Own security conference

    The Pwn2Own event, held at the CanSecWest security conference in Vancouver, allows companies to challenge hackers to exploit their software, i.e. operating systems or web browsers.

iOS
    Charlie Miller and Dion Blazakis have managed to yet again hack iOS thanks to a security hole in the mobile version of Safari. They managed to access the contacts and inbox of an iPhone 4 (iOS 4.2.1) by simply loading a web page.
    The vulnerability isn't patched in iOS 4.3 and it looks like ASLR (Address Space Layout Randomization) won't be able to protect you from this one.

MACos
    This year French pen-testing firm VUPEN has hacked Apple’s Safari web browser using a zero-day flaw to win the coveted Pwn2Own hacker challenge.
    The exploited computer was a fully patched MacBook running Mac OS X (64-bit). Co-founder of VUPEN, Chaouki Beckar, lured the Mac to a fake website and managed to bypass the ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) execution procedures that were built into the OS. He then launched a calculator app successfully and wrote files to the machine.