Adobe, Apple Release Urgent Security Updates

It was Patch Tuesday for the second time this month — except this week it’s Adobe and Apple, not Microsoft, products that have urgent security updates.

Adobe yesterday released updates for its Acrobat and Reader applications and Flash Player browser plug-in to patch a dangerous vulnerability reported last week.

Bad guys had already been using the hole to attack PC users via Excel files infected with bad Flash objects.
The vulnerability affects all major PC operating systems (Windows, Mac and Linux), plus a minor one (Oracle’s Solaris) and Android OS smartphones, as well as all browsers.

Google’s Chrome got a jump on the Flash Player patch a few days earlier, thanks to a tight relationship with Adobe. Users running Chrome will still have to patch other browsers and the stand-alone Reader and Acrobat applications.

As has been the case for years, Internet Explorer requires a separate Flash Player plug-in from the other browsers.

Apple iOS devices will not need a patch; Steve Jobs’ ban on Flash for the iPhone and iPad seems to extend to Acrobat and Reader as well. (iOS reads PDF files natively.)

All patches are available from Adobe’s website here.

Slightly less urgent, but no less comprehensive, is Apple’s latest and possibly final major update to its Snow Leopard version of OS X.

This one bumps the version number up to 10.6.7 and patches 40 vulnerabilities in Apple and open-source apps and services, many related to the handling of image files.

Sophos’s Naked Security blog notes that the update also boosts Apple’s Safari browser to 5.0.4, which patches another 60 or so security holes.

Similar security upgrades are also available for OS X 10.5 Leopard, the last version of OS X to run on PowerPC-based Macs.

Apple’s OS X 10.7 Lion is scheduled to come out this summer.

Apple’s Software Update should automatically download the updates and prompt users to install them. If not, the updates can be found here.

[SecurityNewsDaily]

Mac OS X 10.6.7 fixes security vulnerabilities

 Apple today released Mac OS X 10.6.7 which increases the stability, compatibility, and security of your Mac.



AirPort
A divide by zero issue existed in the handling of Wi-Fi frames. When connected to Wi-Fi, an attacker on the same network may be able to cause a system reset. This issue does not affect systems prior to Mac OS X v10.6.

Apache
Apache is updated to version 2.2.17 to address several vulnerabilities, the most serious of which may lead to a denial of service.

AppleScript
A format string issue existed in AppleScript Studio's generic dialog commands ("display dialog" and "display alert"). Running an AppleScript Studio-based application that allows untrusted input to be passed to a dialog may lead to an unexpected application termination or arbitrary code execution.

ATS
A heap buffer overflow issue existed in the handling of OpenType, TrueType and Type 1 fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

Multiple buffer overflow issues existed in the handling of SFNT tables. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

bzip2
An integer overflow issue existed in bzip2's handling of bzip2 compressed files. Using the command line bzip2 or bunzip2 tool to decompress a bzip2 file may result in an unexpected application termination or arbitrary code execution.

CarbonCore
When used with the kTemporaryFolderType flag, the FSFindFolder() API returns a directory that is world readable. This issue is addressed by returning a directory that is only readable by the user that the process is running as.

ClamAV
Multiple vulnerabilities exist in ClamAV, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating ClamAV to version 0.96.5. ClamAV is distributed only with Mac OS X Server systems.

CoreText
A memory corruption issue existed in CoreText's handling of font files. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

File Quarantine
The OSX.OpinionSpy definition has been added to the malware check within File Quarantine.

HFS
An integer overflow issue existed in the handling of the F_READBOOTSTRAP ioctl. A local user may be able to read arbitrary files from an HFS, HFS+, or HFS+J filesystem.

ImageIO
A heap buffer overflow issue existed in ImageIO's handling of JPEG and XBM images. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

A buffer overflow existed in libTIFF's handling of JPEG encoded TIFF images and CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

An integer overflow issue existed in ImageIO's handling of JPEG-encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

Image RAW
Multiple buffer overflow issues existed in Image RAW's handling of Canon RAW images. Viewing a maliciously crafted Canon RAW image may result in an unexpected application termination or arbitrary code execution.

Installer
A URL processing issue in Install Helper may lead to the installation of an agent that contacts an arbitrary server when the user logs in. The dialog resulting from a connection failure may lead the user to believe that the connection was attempted with Apple. This issue is addressed by removing Install Helper.

Kerberos
Multiple cryptographic issues existed in MIT Kerberos 5. Only CVE-2010-1323 affects Mac OS X v10.5.

Kernel
A privilege checking issue existed in the i386_set_ldt system call's handling of call gates. A local user may be able to execute arbitrary code with system privileges. This issue is addressed by disallowing creation of call gate entries via i386_set_ldt().

Libinfo
An integer truncation issue existed in Libinfo's handling of NFS RPC packets. A remote attacker may be able to cause NFS RPC services such as lockd, statd, mountd, and portmap to become unresponsive.

libxml
A memory corruption issue existed in libxml's XPath handling. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

A double free issue existed in libxml's handling of XPath expressions. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

Mailman
Multiple cross-site scripting issues existed in Mailman 2.1.13. These issues are addressed by updating Mailman to version 2.1.14.

PHP
PHP is updated to version 5.3.4 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution.

PHP is updated to version 5.2.15 to address multiple vulnerabilities, the most serious of which may lead to arbitary code execution.

QuickLook
A memory corruption issue existed in QuickLook's handling of Excel files. Downloading a maliciously crafted Excel file may lead to an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

A memory corruption issue existed in QuickLook's handling of Microsoft Office files. Downloading a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution.

QuickTime
Multiple memory corruption issues existed in QuickTime's handling of JPEG2000 images. Viewing a maliciously crafted JPEG2000 image with QuickTime may lead to an unexpected application termination or arbitrary code execution.

An integer overflow existed in QuickTime's handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

A memory corruption issue existed in QuickTime's handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

A cross-origin issue existed in QuickTime plug-in's handling of cross-site redirects. Visiting a maliciously crafted website may lead to the disclosure of video data from another site. This issue is addressed by preventing QuickTime from following cross-site redirects.

A memory corruption issue existed in QuickTime's handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

Ruby
An integer truncation issue existed in Ruby's BigDecimal class. Running a Ruby script that uses untrusted input to create a BigDecimal object may lead to an unexpected application termination or arbitrary code execution. This issue only affects 64-bit Ruby processes.

Samba
A stack buffer overflow existed in Samba's handling of Windows Security IDs. If SMB file sharing is enabled, a remote attacker may cause a denial of service or arbitrary code execution.

Subversion
Subversion servers that use the non-default "SVNPathAuthz short_circuit" mod_dav_svn configuration setting may allow unauthorized users to access portions of the repository. This issue is addressed by updating Subversion to version 1.6.13. This issue does not affect systems prior to Mac OS X v10.6.

Terminal
When ssh is used in Terminal's "New Remote Connection" dialog, SSH version 1 is selected as the default protocol version. This issue is addressed by changing the default protocol version to "Automatic". This issue does not affect systems prior to Mac OS X v10.6.

X11
Multiple vulnerabilities existed in FreeType, the most serious of which may lead to arbitrary code execution when processing a maliciously crafted font. These issues are addressed by updating FreeType to version 2.4.3. 

[Net-Security]

Apple issues mammoth security update for Safari browser

Apple has released Safari 5.0.4 - the latest version of Apple's browser software for Windows and Mac users - patching an eye-watering 62 security vulnerabilities in the process.

The vulnerabilities, described in an Apple knowledgebase article, were disclosed at the same time as a host of security holes in the iOS software used by the iPhone, iPad and iPod touch were also revealed by the company.

What this means is, just like their iPhone/iPod touch/iPad-owning cousins, people who run Safari on their Mac or Windows computers would be wise to check out the latest available security updates as soon as possible.

Apple doesn't like to assign severity levels to the security vulnerabilities found in its products, but the bugs in Safari look pretty critical to me. 57 of the 62 bugs can be exploited just by a user visiting a maliciously-crafted website.

If that's not a reason to install a security update to your Safari browser, I'm not sure what is.
You can download Safari 5.0.4 from Apple's website for Mac OS X 10.5 (Leopard), Mac OS X 10.6 (Snow Leopard), Windows XP, Windows Vista and Windows 7.

SophosLabs see tens of thousands of legitimately websites that have been infected by malware every single day, so it's really important to keep your browser up-to-date with the latest security patches.

[NakedSecurity]

Five Apple Security Myths — and the Disturbing Truths

"I just got a Mac,” think many first-time Apple customers. “I'll never have to worry about a virus again."
So it would seem to many longtime PC users, plagued by virus, e-mail and phishing attacks that require constant vigilance and the installation of often pricey security software. They rarely, if ever, hear their Mac-using friends complaining about the same problems.

But even though it’s true that Macintosh computers, iPhones, iPods and iPads (the latter three of which run Apple’s iOS mobile operating system) are subject to far fewer attacks than their Windows (or Android) counterparts, Apple products are definitely not immune to security flaws.

In fact, as Apple’s market shares increase, so do the chances of malware being written specifically for the company’s devices.

Virgin territory


Apple software is actually ripe for attack. At the 2010 “Pwn2Own” hacking contest, held every March at the CanSecWest security conference in Vancouver, Apple’s Mac OS X, the Safari Web browser and an iPhone 3GS were all exploited with surprising ease, falling quicker than their Windows-based competitors.

The overconfidence many Apple users feel about their gadgets may come from the company itself, said Alex Horan, director of product management at Boston-based Core Security.

“On its website, Apple states that: ‘Mac OS X doesn’t get PC viruses. And its built-in defenses help keep you safe from other malware without the hassle of constant alerts and sweeps,” Horan said.
But it’s a false comparison.

“Traditionally the only reason we haven’t seen a lot of news about viruses and worms targeting Mac systems is because we haven’t seen as many Mac systems in use,” Horan explained.

“The reality today remains that if I want to write some code that will attempt to control the maximum number of systems, then I need to have that code target the most common systems out there [Windows]. But as the number of Mac system grows, so will the attention of the attackers.”

Horan’s colleague at Core Security, Vice President of Security Awareness and Government Affairs Tom Kellermann, added a warning.

“Over the past few years, we’ve seen multiple exploits that have proven that this perception around Apple security is truly misguided,” Kellerman said. “Those people who believe that they are fundamentally more secure simply because they use Apple products will likely someday learn to regret it.”
Five hard lessons


With that in mind, here are five Apple security myths — and the brutal truth behind each:

Myth: I don't need antivirus and spam protection because I work on a Mac.

Truth: The Mac OS X operating system is targeted less frequently by malware only because it’s not as widespread as Windows. It’s no more secure than any other operating system, said Sorin Mustaca, data security expert at Germany-based Avira.

As for phishing attacks, said Mustaca, “the biggest problem in this case is not the computer itself, but rather it's the user.”

Myth: I can't be infected by any malicious software because I get my applications exclusively from the iTunes App Store.

Truth: “We've seen a couple of times already that the App Store is not such a secure fortress as one might have hoped,” said Mustaca. “It is extremely difficult to check every single application that is inserted there.”

Myth: Mac OS X is inherently more secure than Windows.

Truth: Apple’s brand-new products are being hacked almost immediately upon arrival. For example, “jailbreaking” your iPhone is as easy as browsing to a specific website.
“For a while, it was easier to write exploits for Mac OS X systems than it was for Windows, but now they're relatively equal,” said Core Security technical specialist Dan Crowley. “Bugs seem to be just as easy — if not easier — to find in Mac OS versus Windows.”

Myth: Apple's Safari browser is more secure than Microsoft's Internet Explorer.

Truth: Safari had more than twice the number of reported vulnerabilities in 2009 (94) than did Internet Explorer (41), according to Symantec's Global Internet Security Threat Report.

Myth: iPad users are not susceptible to the same sorts of attacks that Windows users experience.

Truth: According to Anup Ghosh, founder and chief scientist of Fairfax, Va.-based Invincea, Apple released the iOS 3.2.2 software update for the iPad specifically to fix a critical vulnerability in Adobe Reader that can be exploited by malicious PDF files.

So what can you do to make your Apple device more secure? First of all, never open an e-mail attachment you’re not expecting, even if it’s from someone you know.

Always check the URL — the long string of characters that begins with “http” — in your browser address window when surfing the Web, even on an iPhone or iPod Touch. Be very careful about using free Wi-Fi hotspots in coffeeshops, libraries or airports — it’s safer to just use your cellular carrier’s data service.

There isn’t any third-party security software for iOS devices as of yet, but a few Mac OS X applications are available, such as Sophos Anti-Virus for Mac Home Edition (free), BitDefender Antivirus 2011 for Mac (starting at $40 per year), Intego Virus Barrier X6 ($50 per year, two users) and various Norton products (starting at $50 per year).

[SecurityNewsDaily]

Apple Fixes Nearly 60 Bugs With iTunes 10.2 Release

Apple has released a new version of its ubiquitous iTunes software that includes fixes for nearly 60 vulnerabilities, including several bugs that could be used to run remote code on vulnerable machines.

Most of the vulnerabilities that Apple fixed with the release of iTunes 10.2 lie in the open source WebKit layout engine that underpins iTunes. Many of the vulnerabilities can be used by attackers to either crash iTunes or execute arbitrary code on the PC. Apple recommends that users download the new version immediately.

"Multiple memory corruption issues exist in WebKit. A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead to an unexpected application termination or arbitrary code execution," Apple said in its advisory.

The non-WebKit bugs fixed in the new version of iTunes are equally as serious, with several of them capable of being used for remote code execution. Here are the details on the non-WebKit vulnerabilities:

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Multiple vulnerabilities in libpng
  Description: libpng is updated to version 1.4.3 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. For Mac OS X v10.5 systems, this is addressed in Security Update 2010-007.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution
  Description: A heap buffer overflow issue existed in ImageIO's handling of JPEG images. Viewing a maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution
  Description: A buffer overflow existed in libTIFF's handling of JPEG encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution
  Description: A buffer overflow existed in libTIFF's handling of CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

• libxml
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution
  Description: A double free issue existed in libxml's handling of XPath expressions. Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution.

• libxml
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution
  Description: A memory corruption issue existed in libxml's XPath handling. Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution.

A large number of the vulnerabilities fixed in this release of iTunes were reported by members of Google's internal security research team, which has become quite active in researching outside applications recently.

[ThreatPost]

iTunes 10.2 addresses multiple security vulnerabilities

 Apple has released an update, version 10.2, to the popular iTunes  media player software, closing a number of security vulnerabilities in its product. According to Apple, iTunes 10.2 corrects five vulnerabilities in ImageIO, as well as two issues in the libxml library, many of which could possibly be used by an attacker to execute arbitrary code.

The update also fixes a total of 50 bugs in the WebKit browser engine which could also lead to arbitrary code execution via a man-in-the-middle attack while browsing the iTunes Store. In addition to closing the above security vulnerabilities, the iTunes update also improves Home Sharing and adds support for iPhone, iPad and iPod touch devices running iOS 4.3, which is expected to arrive on 11 March.

Version 10.2 of iTunes is available to download for Windows (32- and 64-bit) and Mac OS X 10.5 or later. All users are advised to upgrade as soon as possible.

[h-online]

Dispelling Myths about Apple Products and Viruses

For years, Apple products have had one up on the PC regarding viruses and malware.  However, due to increased market share, that time may be coming to an end.

Throughout the history of Apple products there has been a long standing consumer myth that they are incapable of becoming infected with viruses.  Most believe that the Mac Operating System was simply more secure than that of PC. 
Although the system may be more secure, it is still vulnerable to malware and other infections.  One needs to look no further than the fact that Apple sells anti-virus software from many of the leading names in the virus protection industry.  What really gave Apple its edge was their lack of market penetration, a result of occupying a small portion of the computer sales industry. 
Simply put, if you want to catch a fish, you go to the pond with the most fish.  That “pond” has always been PC’s.  However, along with their growing popularity and rise in market share, Apple products are becoming more vulnerable to viruses and other harmful infections.

BACKGROUND

The myth that Apple products are impervious to viruses is almost like a virus in and of itself.  Only instead of infecting Apple products, it is infecting the way Apple users think about the product.  This “myth” continues to mislead Apple users into believing they are safe from viruses and there is no need for anti-virus programming.
Unfortunately, life would just be too simple if this was the case. From reading forums and discussing the topic with owners of Apple products, it is blatantly obvious that Apple users are completely unaware of the harm to which they are exposing their computers.

Currently there are several types of viruses that can potentially harm Apple products.  One of the main areas of concern is downloading files that are infected with Trojan horses, spyware, and worms.  These types of files can be found on pirated software and games. 
Versions of Microsoft Office infected with viruses can also infect Mac products using the program.  Also, browser plug-ins for viewing video content can harbor malware, making your Mac more vulnerable to other infections.  These problems are really just the beginning because they do not take into account the growth and success of Apple and their products.

STRATEGIC PLANNING ASSUMPTIONS

-Apple, the company, must do a better job of informing their customers of the risk to their computers.  What was once a selling point, needs to now be addressed as a concern.

-Apple users need to become more educated.  They need to open their eyes to the problem and take appropriate action.

-Acquire an anti-virus program.  Many of the major anti-virus companies, such as McAfee, Intego, Norton and Symantec have all released programs for Apple products.

ANALYSIS

The main reason for the recent increase in viruses infecting Apple products goes hand in hand with the success of the company.  In just the past two years, Apple has consumed nearly 3% of the entire computer sales in the United States, raising their overall market share to 10.4%. 
Although that may not sound like a large increase, Apple’s annual growth is nearly off the charts.  Over those same two years, Apple’s year to year growth has been 24.1%, which dwarfs the overall industry’s growth of 3.8%.  With the wild popularity of the iPad, iPhone and other Apple products, this percentage will only continue to grow.

In any business venture, success has its drawbacks, and this same theory can be applied to Apple and their current surge in the United States computer sales industry.  As stated previously, the idea that Apple products were incapable of being infected with viruses was a selling point. 
Many businesses opted to use Apple computers for their convenience and savings that go along with not having to worry about viruses or spend more money on anti-virus programming.  While Apple products once enjoyed the safety of their own anonymity, they must now accept what comes along with their new found popularity.

IMPLICATIONS

-The “myth” of Apple products not being able to contract viruses is simply not true.

-Apple has become a mainstay of the computer industry, holding a market share of nearly 11%, a figure which continues to rise.  As a result of the increased penetration, the most secure days of the Mac OS are in the past.

-The vulnerability of Apple products goes hand in hand with the success of the company, which is growing at a rate nearly eight times that of the rest of the computer industry.

-While the sales figures of HP and Dell have plateaued, Apple continues to grow at an annual growth rate of 24.1%.

-Apple currently holds the number four ranking in the computer sales industry, behind HP, Dell, and Acer.  Following market trends, by this time next year, Apple will be well ahead of Acer and catching up to HP and Dell.

-Due to the wild success of the iPad, iPhone and the Mac OS, there are no signs of Apple’s growth slowing down.

KEY FINDINGS

-The majority of Apple users are completely unaware of the susceptibility of their computers when it comes to malware.  Stay informed with updates from Apple and other security upgrades.

-The easiest way to prevent computers from being infected with viruses is to stop them before they start.  We all know how difficult computers can be to work with when they are infected with any type of virus.

-Nearly all the major anti-virus companies now sell programs for Apple products.  (A sign of things to come?)

RECOMMENDATIONS

-Verify that your computer is protected by an anti-virus program.  There are some free anti-virus programs available, such as iAntiVirus and ClamXav, however they are not considered as robust as the major companies such as McAfee, Intego, Norton and Symantec.

-Use common sense when surfing the web.  Do not visit websites that are not known to be secure and do not download files or documents from an unknown sender.  Also make sure your virus scanner and security updates are frequently updated with the newest protection.

-Stay ahead of the curve by educating yourself with the current viruses and other problems infecting computers.

-Happy surfing!

[infosecisland]

Researchers spot new Mac OS X malware

Security researchers from Sophos have spotted a new piece of malware targeting Mac OS X users.

According to the company, the BlackHole RAT release is still under development, and appears to be using the source code of a popular Windows trojan horse known as darkComet.

The screen lock feature reads:

Hello I’m the BlackHole Remote Administration Tool. I’m a trojan horse, so I have infected your Mac Computer. I know, most people think that Macs can’t be infected, but look, you ARE infected! I have full controll over your Computer and I can do everything I want, and you can do nothing to prevent it. So, Im a very new virus, under Development, so there will be much more functions when I’m finished. But for now, it’s okay what I can do. To show you what I can do, I will reboot your Computer after you have clicked the Button right down.

Open source malware is an inseparable part of the cybercrime ecosystem, allowing novice cybercriminals to quickly catch up with that used to be sophisticated propagation tactics, a few years ago.

With open source malware now every day’s reality, it shouldn’t be surprising the the growth of malware is reaching such epic proportions of the overall picture. Although rate, malware releases for Mac OS X are only going to get more popular with the time, given the under served market segment, combined with the countless number of malware coders.

The company emphasizes the fact the BlackHole RAT isn’t spreading in the wild, and urges users to exercise extra caution when downloading freeware applications, or even worse, pirated releases. A short clip showing the trojan horse in action can be seen here.

[ZDNet]

Apple invites security experts to review Lion developer preview

CNET reports that Apple has sent notice to a few big-time security experts, including some folks who've attacked OS X security in the past, to check out the developer preview of OS X Lion. "As you have reported Mac OS X security issues in the past," the letter reportedly tells the researchers, "I thought that you might be interested in taking a look at this. It contains several improvements in the area of security countermeasures."

Note that this isn't actual consulting on the part of these researchers, though they are getting a preview copy of the OS for free. Dino Dai Zovi is one of the experts that Apple invited to check out the system, and he lauds the move on Twitter, stating that it "looks to be a step in the direction of opening up a bit and inviting more dialogue with external researchers."

Good for Apple, in that case. Hopefully the outcome of all of this is a more secure operating system, and we can all appreciate that for sure.

[AppleInsider] via [TUAW]