This week Apple released macOS Sierra to the public and, apart from some nice new features, it includes fixes for 65 security vulnerabilities and some tweaks to the operating system itself to improve security as well. A separate Safari 10 update was also released, which fixes 21 vulnerabilities, and is included with macOS Sierra 10.12.
As an added bonus, the list of vulnerability fixes in iOS 10 was amended to show 28 additional vulnerabilities that were addressed in the release. Apple did not release these details until Sierra was released, likely because both operating systems shared the same flaws. Publishing details on the flaws that were addressed in iOS 10 would have given those with malicious intent a nice roadmap of what to exploit in OS X.
There are many more entries on the list, but the trend is arbitrary code execution. In plain english, someone can run code on your Mac and give it commands to do something it should not be doing. Something you don’t want. This is why installing Mac OS upgrades and Security Updates is always a good idea. It’s nice of Apple to list all the vulnerabilities that were addressed, but this also, as mentioned earlier, gives someone with malicious intent a good idea of what to exploit on systems that are not updated.
For those not familiar with reading Apple Security bulletins, the addressed vulnerabilities mention “Available for: OS X El Capitan v10.11.6,” but this means the vulnerability was found in OS X El Capitan and fixed only if you update to macOS Sierra. The wording can make someone believe the fix applies to El Capitan as well. El Capitan itself did not receive any security updates, but will likely see some released alongside future Sierra updates (10.12.1, 10.12.2, and so forth) to cover some critical vulnerabilities.
Security was also implemented in the form of new features.
Gatekeeper
The option to allow unsigned applications has been removed from the System Preferences > Security & Privacy pane.
You can still get unsigned applications to open via other means, but this prevents unskilled users from accidentally (or intentionally, without realizing the possible consequences) set the “Anywhere” option.
Another new Gatekeeper feature is called Path Randomization. This feature is designed to prevent repackaging attacks or “dynamic library hijacks” (PDF), where a legit app can be tricked into loading malicious contents. Now an application is taken from its current location, placed in a random location on your Mac’s hard drive and executed from there. This way the application does not have access to potentially hidden and malicious resources that came in the container. dmg, zip and ISO files are good examples of such a container.
Differential Privacy
As the name implies, this is more a privacy feature than a security feature, but a nice one nevertheless. Basically this allows Apple to collect usage patterns that can help them improve products and services, without compromising individual privacy. This is done using machine learning and artificial intelligence on your Mac, so only anonymized usage statistics are sent to Apple. Helping Apple to improve their products will ultimately benefit us as users and now we get to do it while keeping our privacy.
Auto Unlock
Your Mac will unlock when you walk up to it and it will lock when you walk away — simply by wearing your Apple Watch.
Weak cipher suite removed
The RC4 cipher is a stream that’s used to negotiate an encryption between your browser and the website you visit. Several exploits are known that make the RC4 cipher insecure and no longer trusted, so Apple dropped it. The same goes for SSLv3, a cryptographic protocol that was found to be vulnerable.
Apple Pay on the web
Use your TouchID enabled iOS device or Apple Watch to pay online. With Apple Pay, your credit card number is not being stored or shared and transaction information is not kept — overall a faster and more secure process. For more information about Apple Pay, have a look here.
Web plugins disabled by default
Adobe Flash Player, Java and other plug-ins that can be exploited to load malicious content on your Mac are now disabled by default, but can be clicked by the user to activate.
Intego’s Mac security software has been updated to be fully compatible with macOS Sierra as well.
