A Primer on OSX Security

July 30, 2010 | Tech, Tech Features

In the past year both Dave Gallagher and myself have had a personal laptop stolen. The experience highlighted the issue of security and our findings were depressing indeed. Here are a few points highlighted for your attention and further research. Neither Dave nor I are security experts and this should not be considered legal or professional advice; just a caution against taking security for granted.

Foreword

Anytime an article on security is published it raises the question on whether the author should highlight weaknesses. My personal stance on this is absolutely firm: the people who want to bypass your security already know everything I’m writing below. Literally an intelligent 10-year old could find the information in under 10 minutes using google, and much of the information is posted publicly in Apple’s own help documents. This article is to help honest people understand what is needed to guard themselves against dishonest people.

OSX Password

All Mac user accounts must have a password associated with them. This password is required to make any low-level changes to the system like installing applications or changing important system preferences. If you’ve disabled “Auto-Login” in the system [System Preferences > Security] panel then the password is required to log into the computer. In addition [System Preferences > Security] can be set so that the computer automatically logs you out after X minutes of inactivity and requires a password to log back in. This is a pretty good level of security right?

Breaking the OSX Password

How long does it take to break past the OSX password? Using a good password makes it next to impossible for someone else to guess or “crack” your OSX Password. But they don’t have to. Anyone can change your OSX password by inserting an OSX install DVD and booting from the DVD. They even have a step-by-step guide to do this on Apple.com. Bottom line: if someone has physical access to your computer and more than 5 minutes then your OSX password is useless.

But I use a Firmware Password!

OSX allows you to set a “firmware password” which is required before a user can boot from a DVD. Since the procedure above requires the user to boot from the OSX DVD the idea is that the Firmware Password will prevent someone from subverting your OSX Password. Unfortunately it’s really easy to subvert the firmware password.

Breaking a Firmware Password

The Firmware Password can be reset by opening the computer and physically removing one of the sticks of ram, then booting the computer holding command-option-P-R (the shortcut to reset the PRAM). That’s it – the firmware password has been reset and you can boot from an OSX DVD to reset the OSX Password. If the bad-guy has physical access to the computer this entire process requires a OSX DVD, a screwdriver, and less than 10 minutes and your system is completely unlocked.

So what Can I Do?

So far as I can find, the only way to truly secure your system is FileVault. It may be possible for the NSA or CIA to crack a FileVault password, but as far as I can find, it’s impossible for any average bad guy. So unless you’re carrying state-secrets you’re probably more than safe using a FileVault with a good, hard to guess password. FileVault encrypts the entire contents of your home folder where the vast majority of programs store their data. Your Desktop, Documents, Pictures, Music, and Settings files are are located within your Home folder.

The Damage Possible

Nearly everyone I know stores sensitive information on their computer, even if they don’t know it. Here are some of the things a thief might do after unlocking your computer:

• Open and view all the passwords you’ve stored on the computer by selecting “Remember this password” in any application
• Read your email (if you use Mail)
• Send email in your name to your contacts (“e.g. Hey Mom, I can’t remember my ATM PIN – do you remember it??”)
• Check popular websites to see if you are auto-logged in (e.g. your gmail/hotmail/AOL email)
• Go to banking websites and use the “forgot my password” to email your secure passwords to your email address or initiate a password reset

Overall Recommendations

• Use a reasonably secure OSX password, set up a firmware password, and set up File Vault.
• Only store confidential documents in your user folder where File Vault will protect it.
• Turn your [System Preferences > Security] to disable automatic OSX login, and to require a password when coming back from a screen saver, set your screen saver to come on after only a few minutes of inactivity.
• Tier your passwords. Anything really important like bank accounts, tax information, etc., should be very secure passwords which are not directly related to your less important passwords. When creating throw-away accounts (e.g.  you have to create a username/password for a stupid giveaway) use a dedicated low-security and unrelated password like “nothing123″ so that anyone able to view such passwords cannot use them to access your important accounts.
• Do not use “auto logins” on any website or program which should be secure.
• Remember that many websites, even some financial websites, will email you your password with only a few (easy to guess/find) questions like date-of-birth. So whichever email address you use with secure accounts needs to be, itself, a high security password and should not be set to auto-login. For example a “hacker” (read: smart alec kid) gained access to one of Sarah Palin’s secure email address by using the “reset password” function which emailed the secure password to a much less secure email address.
• NEVER write your password down or type it into any document (only password entry fields). If needed write yourself clues on what the password is that are obscure/personal enough that they won’t be decipherable by anyone else. For instance if your password is “John4Galt2 you might remind yourself “Rand Also Can’t Remember” which easily jogs the memory of the originator but would be impossible to reverse engineer.
• If you ever suspect your computer or smart phone has been stolen immediately reset every password you have. If you have a smart phone which can be remotely wiped do so immediately as anyone who is stealing a phone in order to mine data off of it will know they only have a limited time to take advantage of it.
• If you have so many passwords you can’t keep track then consider creating an encrypted disk image file where you can type your passwords and other ultra-confidential information. Doing so in OSX takes only a few minutes.

_

New Mac Pros

July 27, 2010 | Tech

Apple Unveils New Mac Pro With Up to 12 Processing Cores

CUPERTINO, California—July 27, 2010—Apple® today unveiled a new Mac® Pro line with up to 12 processing cores and up to 50 percent greater performance than the previous generation.* Featuring the latest quad-core and 6-core Intel Xeon processors, all-new ATI graphics and the option for up to four 512GB solid state drives (SSD), the new Mac Pro continues to deliver amazing performance and expandability for the most demanding consumers and professionals.

Capture Integration is an Apple Reseller specializing in configuration and setting up mac systems for high-end photographic applications. Contact Us for advice in which components are worth upgrading through Apple, which components should be bought 3rd party, and how to set up your software and hardware configurations.

Visit the Product Page to browse possible configurations then give us a call.

Note the new Mac Pros were announced today (July 27) and pricing and specs have been released but they will not be available to order until sometime in August.

See updated article with more details.

_

Firmware Update for ALL P+ Back

July 15, 2010 | Tech, Tech Features

A new firmware, version 5.1.2, has been released for all Phase One P+ Backs (P20+, P21+, P25+, P30+, P40+, P45+, P65+). This firmware adds supports for several high-end compact flash cards including SanDisk Extreme 32/64GB (60/90MB) and Lexar 300X 16GB.

It is recommended for all users and is available for download here.

RZ Pro IID Users: This firwmare update adds a new functionality when using a P40+ or P65+ with an RZ Pro IID and studio strobes. This “RZ Pro IID” feature is added under the Camera Mode menu and allows normal latency to be used (increasing battery life) whereas previously in this setup you would need to use zero latency.

IMPORTANT NOTE:

• Windows Users: You should use Windows XP SP3, Vista, or Windows 7
• Mac Users: You should use 10.5.8 or 10.6.4 ONLY. Do not attempt to run this updater in 10.6.3. Bad things may happen.

_

Our Photokina Guarantee

July 5, 2010 | Promotion

First and foremost at Capture Integration we feel that our clients are our long term partners.  When we suggest a certain product we make sure that the necessary questions are asked in order to make certain the fit is right for the individual photographer.  By putting ourselves in the customers shoes, we always work hard to make sure that we would never suggest a solution that we ourselves would not feel 100% comfortable using personally.

With this said, It’s a Photokina year.  And in 60 days, there is a potential for new product announcements and price fluctuations.  If you buy a product today, what happens if the price drops on it just 2 months after investing in it?  Easy solution……..Capture Integration stands behind it’s customers. If Phase One or Leaf introduce a new higher resolution or larger sensor digial back at Photokina 2010 we will upgrade you the newer system at the difference in list price between the model you purchased and the new model introduced.

Your purchase is protected.   And you are still shooting for 60 days with the best products available on the marketplace.  This is our promise to you.

_

Trade In H System

July 5, 2010 | Promotion

Read the Details of this promotion

_

Leaf Hot Summer Specials

July 5, 2010 | Promotion

Read the Details of this promotion

_

Firewire vs. USB

July 1, 2010 | Tech

by Doug Peterson, Head of Technical Services

Today I had a customer ask why digital backs used firewire and dSLRs use USB. It’s an explanation I give frequently but I thought I’d take this chance to blog about it to all you loyal readers. The below represents my personal unabashed view of why USB sucks and FireWire rocks (in high-end applications such as tethering high-res cameras).

USB and FW are both great specs on paper, but there are some very technical differences between them. Without getting too deep in technical jargon here are some differences:

• FireWire can provide more electrical power than USB over-the-cable
• Firewire 400 connectors are make a very tight physical connection* mini-USB as used on most dSLRs fall out very easily on their own and are therefore often accompanied by a screw-in holder of some kind, making it much harder to “unplug and go”
• Even in ideal situations the maximum sped of FW400 is higher than USB, the speed of FW800 is far higher (ignore the specs which say USB is slightly faster – this is the theoretical max speed and no USB device, not even high performance ones, come anywhere close to this speed).
• FireWire supports Daisy Chaining which is a fancy way of saying you can connect a FireWire device to a computer by connecting it to another FireWire device already connected to that computer. This has a lot of cool applications that most people don’t need or use.
• Finally the greatest difference of all may be the way the connection is managed. With USB the computer is asked to manage the transfers of data which means the CPU has to be monitoring/managing the connection anytime data will be transferred. With FireWire there is a chip on board the device which can communicate directly with the FW board so that no system resources are needed. As long as the computer has available system resources (meaning it’s not working very hard) the difference between these methods is minor. However when the computer is taxed (e.g. by heavy continuous shooting of a high-resolution camera and the processing/rendering required to show previews of those images) the difference can be huge because USB requires the CPU to “pay attention” to it to transfer new data, and if the CPU is swamped it cannot pay full attention to the USB. Whereas with Firewire the device and Firewire hub can continue to manage the transfer of new data by themselves. The practical result? Plug in a digital back like a P40+ and hold down the trigger and it will continue shooting the same speed for many dozens, or even hundreds of images in a row without changing speeds. Plug in a dSLR and hold down the trigger – you’ll have to wait until the camera has hit its buffer limit so that you’re watching the speed of transfer from the camera to computer rather than the speed of the camera to the camera-buffer. If your computer is fast enough to manage the connection to the camera and do the calculations of proxies (and anything else which is open and running) and still have headroom to manage the USB connection than the rate will not change. If however you have a slower computer or you start pushing the computer hard (checking focus at 100%, processing images, making adjustments to a batch of images, opening files in the background in photoshop etc) then the downloading of new images will crawl to a stand still making the camera feel lethargic and non-responsive.

So all of the above points make it sound like FireWire should be everywhere and USB nowhere. What’s up?

There is price to the last point. Since FireWire devices must manage themselves they must include the size/weight and most importantly cost of an onboard chip. These chips aren’t very expensive, but for many consumer electronics there are only cents worth of profit per item and the money spent on the FW chip just doesn’t make sense. Likewise adding FW ports to a computer is more expensive than USB ports and since most of the PC world is extremely price conscious many PCs did not include a FW port.

When Canon changed from the firewire port on the 1Ds II to the USB port on the 1Ds III it was a sad day for me. I understand why; Canon makes general purpose cameras used by a huge variety of users and many 1Ds III will never take a single tethered shot, and in the general market place many computers do not have a FW port. Cheaper and more readily available connectors won out over the better (but ever so slightly more expensive) technical solution.

*The older SCSI and Parallel/Printer port connectors were even better but were designed to be plugged in once rather than plugged and unplugged and were designed before hardly any “mobile” devices were available.

See more: http://www.usb-ware.com/firewire-vs-usb.htm

_

8/26 | Washington DC

July 1, 2010 | News

We sincerely regret that this event has been postponed. Everyone who has RSVP’d will be contacted personally by us to explain the situation and to ensure that we make right the inconvenience this causes.

_