Protecting yourself

1. Enable Parental controls and lock down all but the apps necessary to run
2. Disable your guest account
3. Run and maintain your firewall
4. Switch off services from your Sharing preference pane that you don't need
5. Patch /Library/Preferences/com.apple.ARDAgent.plist

As you can see in the video, this attack is only valuable if someone can run commands on your computer. To protect yourself from users that have access but aren't administrators, the easiest solution is to enable parental controls from System Preferences, locking down all but the apps they need to use. Disabling the guest account, closing ports, and running your firewall carefully are important as well. Taking care of your external connection is important, for if someone can establish a network connction to your machine it may be possible for a small flaw to be exploited in a running program, thereby giving a user just enough access to do what you just saw.

Patching ARDAgent's plist

A temporary fix for the problem has surfaced. Ironically, having ARDAgent running in the background prevents it from being accessd using the osascript command. TUAW has posted a detailed guide on how to make this work: http://tuaw.com/ardfix/

This page will be updated with more information as available. If you have a tip, contact Brent at .