PEBLOG

At 7:00 p.m. on July 20th, Charles will be presenting our ever-popular PEBMAC Tips and Tricks demonstration for Denver Apple Pi, Denver’s oldest Apple User Group. The address is 12700 West 27th Avenue in Lakewood.

Come on out and see us! I promise we don’t bite. At least, not very hard.

On a sad day for the Mac community, the first real example of spyware on the Mac has surfaced. I’m going to have to agree with security company Intego’s assessment that this software—known as OSX/OpinionSpy—is high risk. The potential for loss of privacy is very high, though the threat of infection is low because it requires you to download and install it. Therefore, it can’t spread by itself.

Apparently a company called 7Art has been releasing a collection of screen savers for the Mac that also install software that purports to perform “market research.” This “market research” is rather insidious, causing the following:

• It installs a process that runs as root, which gives it full access to the machine. If the process is quit, it automatically relaunches.
• It opens port 8254 for HTTP access, potentially bypassing your firewall.
• It scans every hard drive and file it can find and gathers information, although what type isn’t yet known.
• It scans network activity, potentially gathering lots of information, especially in a school or business environment.
• It modifies Firefox, iChat, and Safari, and copies personal data from these applications.
• It regularly sends collected encrypted data to a number of servers on ports 80 and 443. This can include not only iChat headers, but e-mails (eek!).
• It can cause Macs to eventually become unresponsive, forcing a reboot.

This is just a bit of the joy that this program will bring to your Mac. Uninstalling the original application that installed it won’t get rid of it, either.

So how can you check whether you’re infected? Well you can buy Intego’s anti-virus software, but here at PEBMAC World Headquarters we’re still not fans of anti-virus software as it tends to cause more problems than it fixes (this may change eventually as more threats become evident). Alternatively, pop open Activity Monitor (which resides in your Applications > Utilities folder), select “All Processes” in the upper right of the window, and do a search for “premiereopinion.” If you find it, you’re infected.

Here’s a list of the known applications that install the spyware:

Secret Land ScreenSaver v.2.8
Color Therapy Clock ScreenSaver v.2.8
7art Foliage Clock ScreenSaver v.2.8
Nature Harmony Clock ScreenSaver v.2.8
Fiesta Clock ScreenSaver v.2.8
Fractal Sun Clock ScreenSaver v.2.8
Full Moon Clock ScreenSaver v.2.8
Sky Flight Clock ScreenSaver v.2.8
Sunny Bubbles Clock ScreenSaver v.2.9
Everlasting Flowering Clock ScreenSaver v.2.8
Magic Forest Clock ScreenSaver v.2.8
Freezelight Clock ScreenSaver v.2.9
Precious Stone Clock ScreenSaver v.2.8
Silver Snow Clock ScreenSaver v.2.8
Water Color Clock ScreenSaver v.2.8
Love Dance Clock ScreenSaver v.2.8
Galaxy Rhythm Clock ScreenSaver v.2.8
7art Eternal Love Clock ScreenSaver v.2.8
Fire Element Clock ScreenSaver v.2.8
Water Element Clock ScreenSaver v.2.8
Emerald Clock ScreenSaver v.2.8
Radiating Clock ScreenSaver v.2.8
Rocket Clock ScreenSaver v.2.8
Serenity Clock ScreenSaver v.2.8
Gravity Free Clock ScreenSaver v.2.8
Crystal Clock ScreenSaver v.2.6
One World Clock ScreenSaver v.2.8
Sky Watch ScreenSaver v.2.8
Lighthouse Clock ScreenSaver v.2.8
MishInc FLV To Mp3

If you have installed any of these applications or think you may be infected, give us a call as soon as possible.

THE SHORT VERSION:
Some Gmail accounts have been hacked.
If you use Gmail, you need to change your password as soon as possible.
If you use the same password on Google as on other sites, be sure to change all of those passwords as well (use a different password for each site).

THE LONG VERSION:
Apparently there’s been a rash of Gmail accounts being hacked lately, and we’ve seen a couple of our customers affected so far. The account passwords are compromised and the accounts are then used to send email out to people in your address book with a link selling Viagra or the like. It does not mean your machine is infected with a virus (so far, we still haven’t seen any viruses on the Mac), but it does mean that your information is at risk, particularly if you use the same password for Gmail that you use for accounts on other websites.

Google hasn’t said much about this yet, but they insist that this is not related to their password system being hacked by the Chinese government in January.

If you use the same password on Gmail as you do on other services such as Facebook or MySpace, be sure to change those passwords as soon as possible, and make sure that they’re different on every site. If you use the same password everywhere, it’s equivalent to having a master key that starts your car, opens your house, opens your post office box, and so on. If someone gets that key, they can get into everything—and the more places you use it, the more likely it is to be stolen.

To change your password, go to Gmail, log into your account, click on Settings (at the top-right of the screen), and then click on Accounts and Import. The link to change your password is at the bottom, labeled “Google Account settings.”

You can see whether your account has already been compromised. Check the Sent mail, and if you see anything you don’t recognize it means your account has been hacked.

There’s more information available here. Let us know if you have any questions!

Our presentation at the Apple Store in Cherry Creek has been moved to 8 a.m. on Wednesday the 21st. So get up early and come meet us there!

Every Wednesday night at the Twenty-Ninth Street Apple Store in Boulder, they put on a free business night with different kinds of fascinating topics and information. This Wednesday (April 21), they’re having a “Going Green for Business” event that sounds all sorts of fun. Here’s the description from their site:

In this workshop, meet local business owners and consultants who use Apple products to “green” their businesses. Drop by to network with fellow environmentally conscious business people, learn about Apple and the environment, and find out how to integrate new green technology into your business.

If you’re interested in finding out more about the Boulder Apple events, visit the store’s website here to check out their schedule and register for any of their free workshops. We like hanging out there, too, even if we’re constantly distracted by all of the shiny sexy technology that’s just lying around everywhere.

Come out to the Cherry Creek Apple Store on April 21st at 6:00 p.m. to watch Charles give a presentation on tips and tricks for your Mac. We’ll see you there!