Cutting Through the OS X Security Rhetoric
TMO Reports - Cutting Through the OS X Security Rhetoric
by , 2:45 PM EDT, May 2nd, 2006
Much has been written about future, potential problems with OS X security, but so far no widespread documented issues have occurred. On the heels of Monday's report from The SANS Institute that Mac OS X vulnerabilities are on the rise, The Mac Observer took a look at some of the recent rhetoric surrounding the operating system's security.
With Apple launching a new series of TV ads, one of which touts the fact that Mac OS X is virus-free, it seems that the company will also need to combat some of the misinformation being spread by the media, as well as deal with accusations that it's not responding fast enough to vulnerabilities when they're reported.
For example, an Associated Press story that ran on CNN's Web site on Monday described a computer user named Benjamin Daines who had "clicked on a series of links that promised pictures of an unreleased update to his computer's operating system." According to the article, "a window opened on the screen and strange commands ran as if the machine was under the control of someone -- or something -- else."
The promised pictures of an unreleased OS X update sounded like the OSX/Leap-A Trojan horse that hit the Internet in February. While it affected very few users, it did prompt media reports that OS X was on the verge of suffering the same problems that have been plaguing the Windows world for the past several years.
When contacted for comment, Johannes B. Ullrich of The SANS Institute took exception with the attack being characterized as a virus, but he did say that it "sounds very much like the 0-day from earlier this year. The exploit would wrap a shell script inside an archive file, which would auto execute as the user access it via Safari. The user would typically see a command shell pop up."
He added: "We did see a number of uses of this exploit. I wouldn't characterize them as a virus, as they didn't self-replicate. They fall more in the category of 'bots' as they will then connect back to some kind of command and control server to allow the attacker to execute additional commands.
"Such a bot would be able to perform any action the user would be permitted to perform. For example, the bot would be able to connect to network services, send e-mail or modify/delete files owned by the user."
Apple Responding in a Microsoft-Like Manner?
Tom Ferris, a security researcher whose uncovering of five OS X vulnerabilities was publicized by Secunia last week, agreed with Mr. Ullrich's assessment when contacted via e-mail. He was also featured in that Associated Press story, warning that Apple's slowness to respond to security issues reminded him of Microsoft's attitude three years ago. ""They didn't know how to deal with security, and I think Apple is in the same situation now," he was quoted as saying.
An Apple spokeswoman told the AP reporter that Apple will fix the vulnerabilities reported by Mr. Ferris in its next OS X update. She also said that the issues wouldn't enable someone to execute code on a Mac and in fact haven't been exploited in any real world situations that the company is aware of.
Mr. Ferris, however, told The Mac Observer that it took Apple three attempts to fix a core vulnerability in Safari, and it's possible that that flaw is what was exploited in Mr. Daines' situation. He did add, though, that he would expect a malware author to "code the exploit in a way where you would not see anything pop up on your screen. It would just install his malware in the background, under the context of the logged in user."
Give and Take
Elsewhere on the Web, the recent flurry of OS X security talk prompted tech-oriented editorials on both sides of the issue. In a Washington Post blog, for example, Brian Krebs assembled an exhaustive list of the security patches issued by Apple over the past two years and found that the company averaged 91 days to fix each one. He wasn't able to determine the length of time for a fix for all of them, however, because in some cases either Apple or the researcher who found it wouldn't divulge a date.
Mr. Krebs started the project in January and was initially rebuffed by Apple when he asked to speak to someone there about it. Eventually, though, the company allowed him to talk to Bud Tribble, its vice-president of software technology, who said that the lag time between a vulnerability's discovery and a patch has a lot to do with the QA process. "[A Mac user] simply expects things to work with single button click, and that means we have to take time to do that correctly," he said.
Mr. Tribble also pointed out that Apple averaged around 50 days to patch the most critical bugs, although Mr. Krebs noted that the company wouldn't give discovery dates for about a third of them, so it wasn't possible to obtain independent confirmation of that figure. The Apple executive did say, however, that the company wants to improved its turnaround time for security fixes.
While it's obvious that Mac OS X is currently a more secure and stable operating system than Windows XP, several of the security experts contacted by Mr. Krebs felt that hackers are starting to pay more attention to it by virtue of Apple's higher profile, which could lead to an onslaught of malware that users aren't ready to counter. One also noted that with cracked copies of OS X running on cheap PCs, malware authors also now have an inexpensive way to develop their exploits.
Not everyone is crying fire at the first sign of smoke, however. Scott Bradner on Monday published a column at Network World in which he noted: "There have been a few actual OS X attacks found in the wild (that is, the software is being used, not just a security-expert exercise) but not many. Last I read, there were fewer than five, compared with many thousands for Windows (even if many were exploiting the same underlying vulnerabilities)."
"OS X is not going to be vulnerability-free," he concluded, "but I do expect it to show significantly fewer vulnerabilities than Windows has. That does not mean OS X users can ignore security -- at the very least, enable the built-in personal firewall -- but it does mean you should not stay with Windows because you think it will be safer."
Observer Comments
Apple I think responds far more quickly than Microsoft especially if they find something that is dangerous. But they're not going to drop everything for the knit picking that Sans and others say may be or could be type scenarios. It's a very big company with a lot of other things going on including the next major release of OSX. And so far nothing has been proven as a real virus in the wild that has infected anyone on a Mac running OSX.
A good reason for Apple's "slow" response time is because of how insignificant the threats are. You can't really expect them to pile in a million technician hours to fix a flaw that is basically theoretical or has only been seen in action once in the wild.
That being said, we should be weary of being over confident. Yes, OSX spanks Windows back to the stone age, but things are developing - always will be - and we should be careful not to allow our confidence in OSX make us blind to something which trips us up embarrassingly.
Apple has a great security record thus far, lets keep it that way.
Wed May 03, 2006 1:55 am Subject:
You've replaced one bit of begging the question by another. You're correct, to an extent, in saying that the pedestal placing requires proof. However, six years down the track without a guaranteed replication of a virus in the wild is pretty good empirical proof.
Also you claim that many errors go unnoticed - it's certainly possible - as far as we know, we've never had an undetected error. But you state that this is because it isn't a highly targeted OS - as well as question-begging, it's also a non-sequitur.
Wed May 03, 2006 6:09 am Subject: hmm i wonder is this article a retort or editorial?
This is how Windows users make themselves feel better about their choice of OS...They harp on one lonely Safari exploit and hype it up to make it sound like an actual OS security issue. Never mind the fact that the one Safari exploit in question (if it really even happened without being a setup by the person who conveniently had someone in the press who would listen to him rant) resulted in nothing serious happening and failed to replicate itself. Windows users need to get a grip, Mac OS X has a long way to go before it becomes anywhere near as big of a security problem as Windows...How laughable!
Micro$oft still has yet to fix the memory leak in IE that has existed since IE4. Go to any webmail system that uses a "rich text" message editor. Check your memory usage every time you reload the page with the rich text message editor and you'll see that you progressively lose free memory until you shut down and restart your computer. That problem has existed ever since 2000 and Micro$oft still hasn't fixed it...Suprised?
""One also noted that with cracked copies of OS X running on cheap PCs"
Like anything its always in the eye of the beholder. Only apple sells expensive computers?
This like all the anti-apple articles are nothing more than FUD."
No this is saying that the cheapest Mac will cost Ј449(gbp) and from a ten second look at dell.co.uk their cheapest PC is an Inspiron laptop at Ј300. I'm pretty sure if I could be bothered I could find a new pc for Ј150 that's cheap, and that was the point here...
sounds like you're being a little bit paranoid there...
""One also noted that with cracked copies of OS X running on cheap PCs"
Like anything its always in the eye of the beholder. Only apple sells expensive computers?
This like all the anti-apple articles are nothing more than FUD."
No this is saying that the cheapest Mac will cost Ј449(gbp) and from a ten second look at dell.co.uk their cheapest PC is an Inspiron laptop at Ј300. I'm pretty sure if I could be bothered I could find a new pc for Ј150 that's cheap, and that was the point here...
sounds like you're being a little bit paranoid there...
I just laugh at the mac occult and the people who defend a company...somethingyou cannot hug like your kids or wife but youre almost willing to get into it with anyone who says macs arent the best. I build my own pc's and yes I use macs at work ....when I have to. If you are pc builder you know that the hardware inside is ecaxtly the same. Only real difference is that You cant put a FX-60 in mac no matter how hard you try. Macs hardware is usually stepped back to about where laptops are as far as RAM and Video Cards. Until a mac shows me that my pc's are obsolete, then they are simply novel contenders
B34NS
"All software has bugs" is a whine that typifies what's wrong with the software development process and developers in general. They equate difficult with impossible.
I've been doing this for 35 years now, in arenas where bugs are not allowed but which require VERY large bodies of code, and I can assure you that bug-free software IS possible. It's really not even all that hard to accomplish.
All it requires is desire, an intelligent approach, dvelopers who are competent and non-defeatist, a commitment to realistic procedures and testing, and sane management of the effort.
IOW, it requires all the things MicroSnot ineptitude has conditioned the world not to expect.
Apple needs to be more proactive in dealing with potential exploits and the huge quantity of FUD that is being endlessly regurgitated by the malicious and the ignorantti in the world's press. I think Apple should appoint single-point a public face to coordinate fixes and to respond to the press and put things in perspective. This would go a long way to preventing the inevitable public perception of Macs as a security risk. Further, I think Apple should include anti-virus software in the OS, with an easily understood preference panel, if only to prevent forwarding viruses to PC users and to protect Boot Camp and Parallel users. Open source ClamAV would probably be a great start.
Wed May 03, 2006 3:52 pm Subject: Re: all I hve to say is LOL
Wed May 03, 2006 4:06 pm Subject: Core Inherent Issues Between Windows and OS X
For all the guests saying "it's only time..." or "it's such a small target audience" or "OS X security is theoretical" ... let me just slap some sense into yo lame arses.
If you've already forgotten, Microsoft started it's days in DOS, and _to_ _this_ _day_ DOS is still the underpinning to Windows. Windows is *only* just that, a "windowing system" built on top of an OS.
Mac has done the same thing, but the system it's built on top of has YEARS of experience in network environment before DOS even existed in the form that is MS-DOS. Finally, in the 90s, Microsoft thought they better do something about the network thing. Meanwhile, all of us were starting to surf because of interlinked servers running, you guessed it, variants of Unix, allowed us to connect.
Do you see my point? Where you scoff at the security of OS X as being theoretical, or over-hyped, or whatever, you're basically saying that the engine it runs on, which has been out there in the real world, standing firm and strong because of so many individuals making it more and more robust, is just a figment of our imagination.
Grow up, do some research, read about the machines you work and live on before spouting such ignorant blissful ideas.
Unless Gates gives the command to rewrite Windows on top of a *nix variant, there will ALWAYS be an inequality between the OS X and Windows, and one will always be playing catch up.
You can compare stats of servers, home use, business use, real use, virtual use, whatever you can think of and each and every time, you will find a *nix variant will continue to dominate in terms of reliability, security, and modularity.
QuoteLaurieF wrote:
You've replaced one bit of begging the question by another. You're correct, to an extent, in saying that the pedestal placing requires proof. However, six years down the track without a guaranteed replication of a virus in the wild is pretty good empirical proof.
Also you claim that many errors go unnoticed - it's certainly possible - as far as we know, we've never had an undetected error. But you state that this is because it isn't a highly targeted OS - as well as question-begging, it's also a non-sequitur.
The more software is scrutinized the more problems that will be found, real or perceived (some problems are purely in the eye of the beholder). Since OS X isn’t as highly targeted as Windows, stating there is no problem is fallacy in itself. I would love to see all the virus writers move their efforts to OS X and see how it holds up. Viruses aren’t always based on security holes in the software either. Go play your philosophical games on the ignorant.
To the poster that stated he works on large code projects that have no errors, LOL! Name them!
Quotemetavurt wrote:
For all the guests saying "it's only time..." or "it's such a small target audience" or "OS X security is theoretical" ... let me just slap some sense into yo lame arses.
If you've already forgotten, Microsoft started it's days in DOS, and _to_ _this_ _day_ DOS is still the underpinning to Windows. Windows is *only* just that, a "windowing system" built on top of an OS.
Mac has done the same thing, but the system it's built on top of has YEARS of experience in network environment before DOS even existed in the form that is MS-DOS. Finally, in the 90s, Microsoft thought they better do something about the network thing. Meanwhile, all of us were starting to surf because of interlinked servers running, you guessed it, variants of Unix, allowed us to connect.
Do you see my point? Where you scoff at the security of OS X as being theoretical, or over-hyped, or whatever, you're basically saying that the engine it runs on, which has been out there in the real world, standing firm and strong because of so many individuals making it more and more robust, is just a figment of our imagination.
Grow up, do some research, read about the machines you work and live on before spouting such ignorant blissful ideas.
Unless Gates gives the command to rewrite Windows on top of a *nix variant, there will ALWAYS be an inequality between the OS X and Windows, and one will always be playing catch up.
You can compare stats of servers, home use, business use, real use, virtual use, whatever you can think of and each and every time, you will find a *nix variant will continue to dominate in terms of reliability, security, and modularity.
You think Windows sits on top of DOS! Not since NT. ummm research? Anyway the best OS is VMS!
Wed May 03, 2006 9:28 pm Subject:
Thu May 04, 2006 5:32 am Subject: Faws in OS X do not automatically equate to insecurity
Just to make a simple but completely ignored point by the Windows centric press. The recently discovered software flaws in OS X do not automatically equate to insecurity. A vulnerability must be exploited with malicious code and the execution of malicious code is much more difficult in OS X than Windows. There is no real substance to any of these recent reports of OS X insecurity, until a malicious exploit is discovered "in the wild" that uses a vulnerability or flaw in OS X. This is just more FUD sponsored by a little company from Redmond, Washington.
Fri May 05, 2006 8:58 pm Subject: Re: Metavurt
You really need to research before posting. 
"If you've already forgotten, Microsoft started it's days in DOS, and _to_ _this_ _day_ DOS is still the underpinning to Windows. Windows is *only* just that, a "windowing system" built on top of an OS."
This was true of the 9x line. It is not true of the NT line, which was designed by the same person who designed DEC's VMS. See here:
http://www.windowsitpro.com/Articles/Index.cfm?IssueID=97&ArticleID=4494
A quote "Most of NT's lead developers, including VMS's chief architect, came from Digital, and their background heavily influenced NT's development"
XP's DOS box is backwardly compatible, but it is not "the underpinnings" of Windows. Windows XP is not a shell on top of DOS, any more than OS X is a shell on top of MacOS 9.
The rest of your post is equally clueless.
And speaking of security, TMO was hacked this morning, as a matter of curiousity what kind of servers does TMO run on? Bryan?
Fri May 05, 2006 10:13 pm Subject:
Comments are currently closed. Please email the author instead.
Recent Headlines - Updated July 4th
- Fri, 10:29 AM
- News - Apple Warns of Learning Interchange Security Breach
- 7:30 AM
- News - Happy Fourth of July!
- Thu, 6:07 PM
- TMO Scoop - Psystar Moves to Drop Bankruptcy Ahead of Apple Legal Battle
- 5:37 PM
- News - Uncomfirmed Reports Say Apple & Nvidia On The Outs
- 4:57 PM
- News - Microsoft Sick Over Barf Ad
- 4:09 PM
- Product News - KRK Ships R6 Passive Studio Monitor for Recording
- 3:45 PM
- John Martellaro's Blog - Particle Debris (week ending 7/2) Juiced, Joost and Goosed
- 3:12 PM
- Product News - ExactScan 2 Pro Released
- 1:56 PM
- Deal Brothers - Apple TV with 160GB Hard Drive: $324.00 Delivered
- 12:46 PM
- TMO Appearances - TMO Appearances Jeff Gamet Shares iPhone Apps on MacJury
- 10:41 AM
- Product News - Art Text 2.2 Adds New Templates, Layer Options
- 10:04 AM
- Hot Forum Topic - Deciphering Mac Sales
The Mac Observer Reader Specials
- Download Typestyler, still the Ultimate Styling Tool for Internet, Print and Video Graphics. Works great in Classic with a Native OS X Version on the way. Free Tryout: www.typestyler.com
OWC:
OWC Mercury On-The-Go FW400/800/USB2/eSATA Portables. High Performance A/V Rated. Bus Powered. Up to 500GB in the Palm of your Hand. Macworld Editor's Choice. CNET 'Very Good.' From $75.99!
If you're using a Mac, then you've gotta check out Full Tilt Poker for Mac. This Full Tilt Poker bonus code does the unthinkable, it actually rewards!
RamJet Memory: MacBook and MacBook Pro 4GB kits for $57.99! Mac Pro 4GB Kits $99.99! iMac and Mac mini 4GB Kits for $57.99! 1TB SATA Hard Drives for $109.99! Click hereFor the latest Apple products use Ciao, a price comparison website, to find laptops like MacBook Air. Then find the best prices on MP3 players and use our comparison tool to evaluate mobile phones like the Apple iPhone.
Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.
