Pwn2Own Winner: 'Mac OS X is Less Secure Than Windows'

He continued: “The question is which is SAFER. Because Mac OS X is still relatively rare, it is actually a little safer. But it has nothing to do with it being more secure, but rather, that bad guys are entirely focused on Windows at the moment due to the overwhelming market share Windows has. At this time, I still don’t recommend anti-virus for Mac OS X users, because there simply isn’t much malware for that platform. However, if Mac OS X market share ever goes up, there will be a landslide of exploits and malware.”

When asked if Mac users should be worried, he responded: “They should definitely be a little worried.” However, there’s a perception among many computer users that Mac OS X is inherently secure while Windows isn’t, which Mr. Miller said is wrong: “Everything you could do on a Windows machine: turn it into a ‘bot,’ send spam, perform DDOS [distributed denial of service], etc. can be done from a compromised Mac.

“I have been talking about this issue for a while because I don’t want it to come to some large worm or other security issue to force Apple into action,although I’m afraid that is what it will probably take. I want to see Apple become more secure. Until the bottom line is affected, I don’t see major changes coming from them. Ironically, Microsoft spends a ton on security, is more secure, but is perceived as less secure!”

Mr. Miller also delved into the reasons why he thinks OS X is less secure, which he said boil down to “two technologies that Windows has that Mac OS X lacks, specifically, are Address Space Layout Randomization (ASLR) and a non-executable heap. These two things make it very hard to write exploits (the code that gains control of your computer) in Windows.” He noted that the iPhone has a non-executable heap, which is part of the reason why the smartphone wasn’t cracked during last week’s competition, and he said that he “heard a rumor that Snow Leopard [Mac OS X version 10.6] will have ASLR.”