Documento de trabajo que permite reconocer y aplicar las funciones básicas en el uso del iMac en los diferentes campus de la Universidad Peruana de Ciencias Aplciadas (UPC).

Corporate informatics has undergone a number of changes in past few years. Used devices are becoming more independent from the OS, they rely more on provided services and the level of security. Cloud technologies are increasingly growing in significance and a large number of companies offer their employees BYOD (Bring Your Own Device). This thesis focuses on integration of Apple Mac computers into corporate environments, based on analysis of contemporary approaches and possibilities of dealing with integration. An important part of this thesis is research of chosen implemented solutions in the Czech republic. From both parts of this thesis it then offers recommendations, which are based on practical experience of companies that widely use and deal with integration of Mac computers.

The idea that writing is a process and not a product is now generally accepted in writing education, but discussions of digital scholarly communication often neglect the idea, in theory and in practice. This thesis report introduces a Mac OS X software package to support the early stages of the writing process, called Brouillon. Brouillon’s features include: the concatenation of discrete note files into notebooks; notes appearing in multiple notebooks; note intake from mobile devices via Dropbox; and an open standard file format. The report also provides a model of the organization of products of the writing process, with a focus on Brouillon’s most unusual feature, multi-notebook notes. It discusses difficulties in implementation and identifies possibilities for future improvement.

The thesis of this dissertation is that, despite widespread belief in the security community, systems are still vulnerable to attacks from malicious peripherals delivered over the PCI Express (PCIe) protocol. Malicious peripherals can be plugged directly into internal PCIe slots, or connected via an external Thunderbolt connection. To prove this thesis, we designed and built a new PCIe attack platform. We discovered that a simple platform was insufficient to carry out complex attacks, so created the first PCIe attack platform that runs a full, conventional OS. To allows us to conduct attacks against higher-level OS functionality built on PCIe, we made the attack platform emulate in detail the behaviour of an Intel 82574L Network Interface Controller (NIC), by using a device model extracted from the QEMU emulator. We discovered a number of vulnerabilities in the PCIe protocol itself, and with the way that the defence mechanisms it provides are used by modern OSs. The principal defence mechanism provided is the Input/Output Memory Management Unit (IOMMU). The remaps the address space used by peripherals in 4KiB chunks, and can prevent access to areas of address space that a peripheral should not be able to access. We found that, contrary to belief in the security community, the IOMMUs in modern systems were not designed to protect against attacks from malicious peripherals, but to allow virtual machines direct access to real hardware. We discovered that use of the IOMMU is patchy even in modern operating systems. Windows effectively does not use the IOMMU at all; macOS opens windows that are shared by all devices; Linux and FreeBSD map windows into host memory separately for each device, but only if poorly documented boot flags are used. These OSs make no effort to ensure that only data that should be visible to the devices is in the mapped windows. We created novel attacks that subverted control flow and read private data against systems running macOS, Linux and FreeBSD with the highest level of relevant protection enabled. These represent the first use of the relevant exploits in each case. In the final part of this thesis, we evaluate the suitability of a number of proposed general purpose and specific mitigations against DMA attacks, and make a number of recommendations about future directions in IOMMU software and hardware.

The goal of this thesis is to design and implement a library for data synchronization between multiple client's devices in the context of the ecosystem of a single application targeting the iOS, iPadOS or MacOS operating system. The work focuses on the simple integration of the library into existing applications using the Realm database system and on the simple way to connect the user interface with the synchronization process. I solved the chosen problem by designing a synchronization protocol primarily based on log synchronization to distribute changes between the client and the server, implementing a library to monitor changes in the client's database and distribute them to the server, and implementing a server library to integrate received changes and distribute them with help of notifications. The solution provides an easy way to implement data synchronization between multiple devices using custom database server and with the ability to define how to handle new changes of objects presented in the user interface during the synchronization. Created library can be quickly and easily integrated and thus effectively speed up the application development process.

Cloud storage services allow users to store and access data in a secure and flexible manner. In recent years, cloud storage services have seen rapid growth in popularity as well as in technological progress and hundreds of millions of users use these services to store thousands of petabytes of data. Additionally, the synchronization of data that is essential for these types of services stands for a significant amount of the total internet traffic. In this thesis, seven cloud storage applications were tested under controlled experiments during the synchronization process to determine feature support and measure performance metrics. Special focus was put on comparing applications that perform client side encryption of user data to applicationsthat do not. The results show a great variation in feature support and performance between the different applications and that client side encryption introduces some limitations to other features but that it does not necessarily impact performance negatively. The results provide insights and enhances the understanding of the advantages and disadvantages that come with certain design choices of cloud storage applications. These insights will help future technological development of cloud storage services.

Práca sa zaoberá problematikou kontroly a blokovania externých zariadení v operačnom systéme Apple macOS za účelom ochrany pred únikom citlivých dát. Implementované riešenie ukazuje zvolené prístupy pre blokovanie externých a cloudových diskov. Pre blokovanie USB diskov bol použitý DiskAbitration framework, čo je najvodnejšie riešenie tohto typu úlohy. Avšak cloudové disky sú v skutočnosti synchronizované zložky a úlohu nehrajú ovládače ani strom pripojených zariadení. Ku kontrole operácií v cloudových diskoch bol použitý Endpoint Security framework. Aktuálne podporovaní cloudový poskytovatelia sú iCloud a Dropbox a prístup k nim môže byť obmedzený úplne alebo iba na čítanie. Schopnosť synchronizácie vzdialenýh zmien bola zachovaná avšak v prípade Dropboxu si to žiada nepoužívať ich aplikáciu na správu súborov.