MK&C tag:blog.karppinen.fi,2008-01-02://1 2008-10-15T08:22:05Z Marko Karppinen & Co. Movable Type Open Source 4.1-en-release-26-r1131-20080102 Knox 1.6 beta is now available tag:blog.karppinen.fi,2008://1.249 2008-10-15T08:22:05Z 2008-10-15T08:22:05Z We’ve just pushed out a beta of Knox 1.6. The major feature is support for Mac OS X 10.5 Leopard’s "sparse bundle" vault format. This format improves reliability and is much faster to compact. Please try it out and report... Marko Karppinen Please try it out and report any issues you encounter!]]> Another case of Apple ID theft tag:blog.karppinen.fi,2008://1.248 2008-08-01T18:31:22Z 2008-08-01T18:31:22Z Looks like Chris Pirillo also got his Apple ID stolen. Like in my case, Apple has assured him that their processes no longer allow this to happen. However, it seems that Apple’s procedures had not been improved during the two-and-a-half-week... Marko Karppinen Looks like Chris Pirillo also got his Apple ID stolen. Like in my case, Apple has assured him that their processes no longer allow this to happen.

However, it seems that Apple’s procedures had not been improved during the two-and-a-half-week period between the two incidents. I’m not taking their word very seriously at this point. Also, the promise to get back to me about their log files detailing my account’s usage? 30 days on since their initial call, I’ve heard exactly zip from Apple.

]]> How Apple replied to the password reset request tag:blog.karppinen.fi,2008://1.247 2008-07-10T08:19:23Z 2008-07-10T08:19:23Z We’re on to day three of this saga, with about 80 000 pairs of eyeballs on this thing. No word from Apple yet. Meanwhile, some people have asked for clarification and/or called BS on this, so I thought I’d post... Marko Karppinen We’re on to day three of this saga, with about 80 000 pairs of eyeballs on this thing. No word from Apple yet. Meanwhile, some people have asked for clarification and/or called BS on this, so I thought I’d post the email that Apple sent in response to the password reset request. This email was in my .Mac mailbox while the password reset emails mentioned apparently went to the yahoo.com address.

The account continues to get password reset requests, but as people have pointed out, those are harmless unless someone at Apple overrides the procedure manually. Also, to those who asked: my security question and answer are a meaningless challenge/response pair — there is no chance that someone guessed the answer.

Please include the line below in follow-up emails for this request.

Follow-up: [redacted]

Re: ADC account

Dear Mr Karppinen,

Thank you for contacting the Apple Developer Connection regarding your ADC membership account.

Please accept our apology for the delayed response.

In reviewing your information, I have found the following account:

Marko Karppinen
MK&C
Email address: [redacted]@mac.com
ADC Premier Membership
ADC Member number: [redacted]
Apple ID: [redacted]@mac.com
Last Login Date: 04 Jul 2008

Please know that I updated your email address for you to: marko.[redacted]@yahoo.com.

Furthermore, the password for your ADC account has been reset. You will receive two additional emails from Apple. One will contain your login account name, the other will contain your new temporary login password.

Once you have logged in with the temporary password, you will be presented with a “Password Expired” page. Enter the temporary password as the “old password” and select and enter a new personal password of your choice as the “new password”.

After you have logged in, please take a moment to review the information in your account profile to ensure the information is up to date.

Please know that it is possible to reset your password yourself online. We have included this process below:

1) Go to the Member Site at http://connect.apple.com.
2) Enter your Apple ID and select the “Forgot Password” button.
3) Enter your Date of Birth.
4) Choose your password reset option.

—The easiest option is to have your temporary password emailed to the email address listed on your ADC account. You also have the option to reset your password online by answering the challenge question you chose when you created your ADC account.

I hope this information is useful to you. Please let me know if you have any questions or need further assistance.

Best regards,

[redacted]

Apple Developer Connection
Worldwide Developer Relations

Inquiry from marko regarding Reset Password
Email address: [redacted]@mac.com
Region: Europe

am forget my password of mac,did you give me password on new email marko.[redacted]@yahoo.com

]]> Apple just gave out my Apple ID password because someone asked tag:blog.karppinen.fi,2008://1.246 2008-07-08T06:05:32Z 2008-07-08T06:05:32Z I tried to log in to Apple Developer Connection this morning to find out that my password had been changed and the email associated with my account was now a yahoo.com address that wasn't mine. Luckily, my "security question" was... Marko Karppinen I tried to log in to Apple Developer Connection this morning to find out that my password had been changed and the email associated with my account was now a yahoo.com address that wasn't mine. Luckily, my "security question" was still the same, so I was able to reset the password and email address back.

Based on the emails that have appeared in my .Mac mailbox, this was accomplished by sending this classy one-liner to Apple:

am forget my password of mac,did you give me password on new email marko.[redacted]@yahoo.com

To which Apple reacted by doing the only reasonable thing – saying Sir, Yes Sir! and handing my account over. Here's the email I just sent Apple:

Dear ADC,

You have reset my password based on a request by someone other than me. Rather than checking if the requester was actually me by comparing the information in their personal profile, you have allowed a third party access my Apple ID for no reason whatsoever.

I tried to log in today and saw that my password had been changed, and the email address associated with my account changed to "marko.[redacted]@yahoo.com".

Apparently based on a single-line email inquiry, you have allowed a third party access to:
- My personal details
- My personal email
- All the files stored on my iDisk
- Everything I've synchronized to .Mac, including my Address Book, Bookmarks, Keychain items, etc.
- My credit card details as stored in my Apple Store profile
- My iTunes Music Store Account
- My ADC Premier membership, including the software seed key and other assets
- The iPhone Developer Program's Program Portal, including details of our development team

Frankly, this makes me so angry that I can't see straight. Did it not occur to you at all that someone at "marko.[redacted]@yahoo.com" was not actually me? For example, because the names didn't match?

Can you even begin to appreciate the amount of work I need to do to re-secure all the information that you have compromised? How do you propose to restore confidence that I, or indeed anyone, should ever store anything confidential on your systems again?

With best regards,
Marko Karppinen

Update: A few hours after posting this, a team lead from Apple Developer Connection's European support organization called me, apologized for the mess, and assured me that they don't normally operate this way. He promised to find out if Apple can determine, based on their logs, where and how my Apple ID was used in between the password reset and myself discovering all this about 12 hours later. I know that my .Mac mail was accessed, but luckily I don't use it for anything other than ADC-related communications. In fact, I'd be home free if it wasn't for .Mac Sync and some old, unencrypted backups on my iDisk (I've since then smartened up and my backups are now encrypted). I hope the logs will allow Apple to confirm that these services were not accessed by the third party.

Update 2: So it's soon 48 hours after the password reset, but no further contact from Apple. Perhaps I should let them know that, so far, 65 000 people have seen this and many might be wondering how Apple will end up handling the case?

Update 3: How Apple replied to the password reset request and other clarifications.

]]> Cocoa method name of the day tag:blog.karppinen.fi,2008://1.245 2008-05-22T10:10:33Z 2008-05-22T10:10:33Z From the ISyncConcreteSession private interface: - (void)attentionClassDumpUser:(id)fp8 reverseEngineeringThisClassAndCallingPrivateMethodsIsFun ButMayLeadToCompleteAndIrrevocableDataLoss:(id)fp12 atTheVeryLeastItWillCauseUnexpectedBehaviourForOtherApplications:(id)fp16 youHaveBeenWarnedAgainstDoingSo:(id)fp20; Indeed. But the question is… what does it do?... Marko Karppinen From the ISyncConcreteSession private interface:

- (void)attentionClassDumpUser:(id)fp8
reverseEngineeringThisClassAndCallingPrivateMethodsIsFun ButMayLeadToCompleteAndIrrevocableDataLoss:(id)fp12
atTheVeryLeastItWillCauseUnexpectedBehaviourForOtherApplications:(id)fp16
youHaveBeenWarnedAgainstDoingSo:(id)fp20;

Indeed. But the question is… what does it do?

]]> Pyro 1.7 is out tag:blog.karppinen.fi,2008://1.244 2008-05-13T14:36:56Z 2008-05-13T14:36:56Z After only eleven-or-so months in the making, Pyro 1.7 is finally out. This long-overdue update to our Mac-native Campfire group chat client makes Pyro more compatible with Leopard and Safari 3. It's still not perfect, but it's a big step... Marko Karppinen Pyro 1.7 is finally out. This long-overdue update to our Mac-native Campfire group chat client makes Pyro more compatible with Leopard and Safari 3. It's still not perfect, but it's a big step forward from 1.6. Pyro is free, so go try it out now!]]> The evolution of Mac OS X and iPhone OS names tag:blog.karppinen.fi,2008://1.243 2008-05-13T13:57:47Z 2008-05-13T13:57:47Z First there was Mac OS X. Then came iPhone, running OS X (see apple.com). At this point, dropping the "Mac" was widely considered to be semantically significant. Next, at the March 6 special event and the iPhone SDK, Apple started... Marko Karppinen First there was Mac OS X. Then came iPhone, running OS X (see apple.com). At this point, dropping the "Mac" was widely considered to be semantically significant.

Next, at the March 6 special event and the iPhone SDK, Apple started referring to iPhone's operating system as the iPhone OS. This seemed like a smart choice to me — the distinction between OS X and Mac OS X was probably lost on all but the nerdiest of Mac fans.

But now, with today's press release about the WWDC keynote, the names have seemingly changed again. Throughout the release, Apple consistently refers to OS X Leopard and OS X iPhone.

Speculate away.

]]> Share your flights with flightagenda.com tag:blog.karppinen.fi,2008://1.242 2008-04-09T15:30:12Z 2008-04-09T15:30:12Z We just opened the doors to flightagenda.com, a small but useful site we've been working on for a while now. With flightagenda.com, you can enter in your upcoming flights and get back an iCal calendar with all the flight details.... Marko Karppinen We just opened the doors to flightagenda.com, a small but useful site we've been working on for a while now. With flightagenda.com, you can enter in your upcoming flights and get back an iCal calendar with all the flight details. The focus has been on making the site as small and as quick to use as possible, and I'm pretty happy with the results: you can go from sign up to having a shared flights calendar in less than a minute (yes, we've timed it).

We're calling the site an alpha for the time being, but there are no known issues. Sign up and let us know what you think!

]]> Apple TV Take Two, first impressions tag:blog.karppinen.fi,2008://1.241 2008-02-12T20:16:34Z 2008-02-12T20:16:34Z This is easily the slickest video-on-demand service to date. A newly released movie (we went for Superbad) in 720p HD cost $5 and was ready for playing within 15 seconds of the purchase. And the cost of a 40GB Apple... Marko Karppinen Superbad) in 720p HD cost $5 and was ready for playing within 15 seconds of the purchase. And the cost of a 40GB Apple TV is about what you'd pay for 10 movies on blu-ray. This seems to be a no-brainer if there ever was one.]]> Reboot tag:blog.karppinen.fi,2008://1.240 2008-02-08T19:40:52Z 2008-02-08T19:40:52Z Marko Karppinen I’ve moved this blog to a new address to make way for a brand new MK&C web site. Some long-overdue updates to the blog are coming as well. My apologies for the fact that you are likely to see all my old posts again in your feed reader due to the source change.

]]> Quay tag:blog.karppinen.fi,2007://1.239 2007-11-28T17:07:20Z 2008-01-02T11:16:34Z Our friend Rainer Brockerhoff just released Quay, a $10 utility that brings hierarchical menus back to the Leopard dock. It does what it says on the box, and does it well. Go get it!... Marko Karppinen Our friend Rainer Brockerhoff just released Quay, a $10 utility that brings hierarchical menus back to the Leopard dock. It does what it says on the box, and does it well. Go get it!

]]> Scary SSL certificate bug in Mac OS X is now fixed tag:blog.karppinen.fi,2007://1.238 2007-11-15T10:55:15Z 2008-01-02T11:16:34Z Back in May, we discovered and reported to Apple a serious vulnerability in Mac OS X. The issue was silently fixed in Leopard, but yesterday Apple made fixes available for 10.3 and 10.4 as well. Here’s how Apple describes the... Marko Karppinen Back in May, we discovered and reported to Apple a serious vulnerability in Mac OS X. The issue was silently fixed in Leopard, but yesterday Apple made fixes available for 10.3 and 10.4 as well. Here’s how Apple describes the issue:

An issue exists in the validation of certificates. A man-in-the-middle attacker may be able to direct the user to a legitimate site with a valid SSL certificate, then re-direct the user to a spoofed web site that incorrectly appears to be trusted. This could allow user credentials or other information to be collected. This update addresses the issue through improved validation of certificates. Credit to Marko Karppinen, Petteri Kamppuri, and Nikita Zhuk of MK&C for reporting this issue.

This generic language often used in vulnerability descriptions doesn’t really drive home the impact of the issue. To start, I’d change “may be able” to “is able” and “could allow” to “allows”. This vulnerability is exploitable every time. Here’s a real world example:

  • You connect your MacBook to a Wi-Fi access point, such as a T-Mobile HotSpot. But the access point isn’t really what it seems — someone’s just announcing a rogue network with the “tmobile” SSID. This could happen anywhere.
  • When you start surfing, the access point redirects you to the login page as normal. Before the SSL-encrypted login page is downloaded, however, a non-encrypted redirection page appears for a fraction of a second. Again, this is normal. But this time, the page includes a 1x1 pixel image from a server the attacker has a real SSL certificate for. Let’s call it www.validcertificate.example. Real SSL certificates that are trusted by Mac OS X are available from a number of vendors without any verification of the site’s identity.
  • Loading that single image from www.validcertificate.example has now “seeded” that certificate as being trusted by the system. From this point on, the affected Mac OS X systems will trust this certificate no matter which domain name it is being served from.
  • Since the owner of the rogue hotspot controls your DNS as well, he can now direct all your traffic through his own servers. The T-Mobile login page, PayPal.com, your web email — all will appear in their correct addresses, with SSL enabled, and with the SSL lock icon on the corner of your Safari window. Everything seems to be just fine, but behind the scenes, all of those sites are using the www.validcertificate.example certificate and the owner of the hotspot is recording all of your seemingly-encrypted traffic.

Scary? Yeah. If you’re still on Tiger or Panther, install the software update immediately. If you can’t, at least click the SSL icon on all sites you navigate to — the certificate details will not be right if you are being spoofed. For more info, keep checking the DHS’s National Vulnerability Database for their take on the issue (not online yet).

]]> Knox 1.5.3 for Leopard is coming, but… tag:blog.karppinen.fi,2007://1.237 2007-10-26T16:52:48Z 2008-01-02T11:16:34Z Here’s a quote from Apple’s ADC Membership Agreement, the contract that governs the use of pre-release seeds of Leopard: Further, you certify that you will not transfer or export any product, process or service that is the direct product of... Marko Karppinen Here’s a quote from Apple’s ADC Membership Agreement, the contract that governs the use of pre-release seeds of Leopard:

Further, you certify that you will not transfer or export any product, process or service that is the direct product of any Apple pre-release software and that final testing will be done with any finished product that will be released to the mass market. [emphasis ours]

So, yes, a couple more days before the free Leopard update for Knox. We’re very far in its development, but only got the final Leopard DVDs today. Please bear with us as we work to bring this update to you.

]]> Embedding frameworks in loadable bundles tag:blog.karppinen.fi,2007://1.236 2007-08-11T22:11:47Z 2008-01-02T11:16:34Z Jeff Johnson delves deep into framework linking on Mac OS X on this great post about his one BaseTen commit.... Marko Karppinen Jeff Johnson delves deep into framework linking on Mac OS X on this great post about his one BaseTen commit.

]]> The 64bit transition is complete tag:blog.karppinen.fi,2007://1.235 2007-08-08T08:34:20Z 2008-01-02T11:16:34Z The new Mac mini has a Core 2 Duo processor, meaning that the last of Apple’s Mac products has now transitioned to a 64-bit CPU. For the first time ever, all shipping Macs are 64-bit computers. Welcome to the future.... Marko Karppinen The new Mac mini has a Core 2 Duo processor, meaning that the last of Apple’s Mac products has now transitioned to a 64-bit CPU. For the first time ever, all shipping Macs are 64-bit computers. Welcome to the future.

]]>