Security Firm: Apple Has More Security Holes Than Microsoft

PC World ^ | 22 Jul 2010 | Preston Gralla

[for-q-clinton]

Here's another blow to those insist that Apple products are rock solid and unhackable: The security company Secunia reports that Apple products have more vulnerabilities than those of any other company. Oracle came in second place, with Microsoft in third.

Secunia just issued a report that covers vulnerabilities for the first half of 2010, and it's not good news for Apple. The report (which you can download here) shows that Apple last had the most vulnerabilities of all vendors in 2005, before Oracle took over the top spot. And now Apple is on top again. You can see the chart, below.

The chart shows that Apple products consistently have more vulnerabilities than do Microsoft ones.

...

However, there will certainly be one surprise for those who believe that Microsoft products are particularly vulnerable --- Secunia reports that they're not. The primary vulnerabilities on PCs are not due to Microsoft programs, but rather third-party programs, it says:

...

The report then concludes:

Users and businesses must change their perception that Microsoft products pose the largest threat in order to allocate security resources effectively. General awareness on the risk of 3rd party programs must be established.

[antiRepublicrat]

Link to viruses written for a system that only has .5% of the install base.

I'll just let you do a search. Here's a few that didn't require any user intervention:

Witty worm, population of around 12,000 installations of ISS security software. Infected all vulnerable hosts in less than an hour. The worm was released the day after a patch was released for the exploit, and most administrators had not yet applied it (a good admin doesn't just patch his enterprise software without testing first).

SQL Slammer, population of maybe a few million installations of MSDE (often installed as part of a third-party software installation) and SQL Server. Infected up to 100,000 hosts within 10 minutes.

The 1998 AutoStart worm spread rapidly through the Mac community even in the age of disk-based transmission. The Mac population was at rock-bottom at this point. The prior year Michael Dell had famously said that Apple should close shop, and the successful iMac wouldn't be released until months later. Apple was at the height of its irrelevance and obscurity, and yet someone bothered to release a successful auto-spreading worm for the platform.

If you want a perfectly secure computer I suggest filling the case with cement and using it as a doorstop. If you want to actually use your computer, then for whatever reason OS X has the better track record of real-world security.

[SmokingJoe]

Do we get to discount that like the original article tries to shrug off Microsoft vulnerabilities because they come from 3rd parties?

The article original was based on a Secunia study that includes ALL vulnerabilities, including 3rd party ones, and Microsoft still smoked Apple.

“The original article is PP World spin, trying to use meaningless statistics and metrics to prove a point they want to prove.

The original article is based on tests from Secunia, one of the most reputable security firms in the business, and Apple products come first in security vulnerabilities.
No amount of spin on your part is going to change the reality on the groound

“As to your claim that Windows 7 is so much more secure, how about these recent stories (Google “Windows 7 virus” and go to “News”): “

Your link does not disprove the fact that Win 7 is more secure than OSX. It merely talks about a particular Windows security exploit.

Note that changing the query to “Mac OS X virus” only brings up stories about 1) Windows viruses or 2) The fact that Mac OS X doesn't have viruses.

It shows that fanatical, crazy Applpebots have gamed the search engines to hide Apple's products security vulnerabilities?
Kinda like how the loony left crazies gamed Google search so that a search on nasty traits usually came up with George Bush's name when Bush was in power?

[kevkrom]

Oh, wait. Now you're concerned about the severity and practicality of the vulnerability?

Odd, that's the point I've been making all along. Thanks for finally agreeing with me.

[kevkrom]

It shows that fanatical, crazy Applpebots have gamed the search engines to hide Apple's products security vulnerabilities?

Wow, adjust that tin-foil hat before you lose all oxygen to your brain. Are you seriously suggesting that there are stories about real-world, in-the-wild Mac OS X viruses, but that they're just buried because "crazy Applpebots have gamed the search engines"?

Seek mental health help, and then maybe I'll bother discussing the issue with you further.

[SmokingJoe]

If it doesn't get at the mac, what on earth are you up in arms about?
Every security exploit uses something or the other to get at the user. I don't care if it's the router that is not secure, or it's through the naivete of the humans that are using the operating system, if there is a way that hackers can get as the mac, its a security vulnerability.
The mac has never been as secure as Steve Jobs has been lying about in his PC versus Mac ads on TV, and Windows 7 has smoked Snow Leopard mac in every head to head security test I have seen.

[for-q-clinton]

Huh? When did I ever say severity and practicality don’t matter? It appears you are either having a conversation in your own head or are very poor at written communications.

And keep in mind I have not said that the virus you posted is not an issue. But by macbot issues it doesn’t count. So you agree with me the macbots are fools for having such stupid requirements.

[SmokingJoe]

Wow, adjust that tin-foil hat before you lose all oxygen to your brain.

Said the craziest, most stupid, most fanatical Applebot vermin on the planet. There is no crazy like an Applebot crazy.

“. Are you seriously suggesting that there are stories about real-world, in-the-wild Mac OS X viruses, but that they're just buried because “crazy Applpebots have gamed the search engines”? “

I am not merely suggesting, I am telling ya that search engines can and HAVE been gamed to display results that are favorable to one side or the other in any fight. Its not exactly new.
If you will bother to do a search here on FR, you will find plenty of posts about when Google was gamed to display George Bush's name, whenever someone did a search on the phrase “Miserable Failure”.
A quick look at SerachEngineland will show you what I am talking about:
http://searchengineland.com/google-kills-bushs-miserable-failure-search-other-google-bombs-10363

[for-q-clinton]

Ok now post a link to a virus that attacked the OS and not an application.

[stripes1776]

Yawn. We've been over this before, but let me point out again, the number of "vulnerabilities" is a meaningless metric. It is the severity of each vulnerability and the difference between whether it is a potential or actual vulnerability that matters.

Exactly. The report from Secunia points this out explicitly with the following comment:

The above graph is not an indication of the individual vendors’ security, as it is not possible to compare the vendors based on number of vulnerabilities alone. To assess the “performance” of vendors in terms of vulnerabilities one should rather look at the changes in the type of vulnerabilities, code quality, handling of vulnerability reports, ability to update users, quality of patches, ability to communicate to end users, number of products, complexity of product portfolio, and other factors which cannot be read out of mere aggregate numbers.

Simply quoting raw numbers measuring one narrow graph is meaningless. It is necessary to take all the rest of those factors into consideration.

[for-q-clinton]

Nevermind I see where you mentioned the Mac was attacked.

So do you see what is in common amongst all those? They were self-replicating viruses. In today’s world that is less and less likely (at least at the OS level). But malware is more and more common and it requires tricking users (typically) or getting them to visit a site.

We are mainly talking about malware and you come up with a virus. I guess by your definition windows 7 is rock solid since it hasn’t been attacked with a virus as you described and it has a larger install base.

[Fresh Wind]

Not the exact products you mentioned, but..

http://www.symantec.com/norton/macintosh/antivirus
http://www.mcafee.com/us/enterprise/products/system_security/clients/virusscan_for_mac.html

[for-q-clinton]

Funny. I bet she was hoping no one would check on that :-) More macbots spreading FUD about windows.

[La Lydia]

I don’t understand.

[for-q-clinton]

You said you went looking for AV products for the Mac and couldn’t find them...you even listed very specific names of products. But a quick search provided two such products and by the same vendors you implied didn’t even make such products for OSX.

[for-q-clinton]

Simply quoting raw numbers measuring one narrow graph is meaningless. It is necessary to take all the rest of those factors into consideration.

I agreee. That's why I've been using the pwn2own competition where OSX was the first one hacked for the past 3 years. And last year they got read/write access to OSX while Windows only gave up read access.

[La Lydia]

I looked on their websites and didn’t see anything offered for Macbooks. I don’t think I implied anything. Are you talking about something I don’t understand?

[for-q-clinton]

Sorry I appeared to have read too much into your comments. Many people that support apple spread FUD (fear uncertainty and doubt) about Windows so I lumped you in that group when I shouldn’t have.

[GOPJ]

Thanks for the ping.

[N3WBI3]

“I think what gets overlooked most of the time is that the reason Windows has been so targeted for years is because it is the most common OS being used.”

Some people overlook it, some people put too much stock into it.

Operating Systems (and note that this article is about vendors of software not the OS itself) are like any other complex engineered product.

If everyone in the world drove a Yugo except 5% that drove a Humvee would the lower body count in Humvees be due to the number or the engineering? or, likely, Both.

There have been viruses produced for cell phones that have a user base of less than 200K people. Also the Base of OSX is BSD which happens to run the DNS servers the make the web work (not Apples Darwin BSD but a BSD variant) so hacking *1* particular BSD server could be the mother of all hijacks.

[stripes1776]

I agreee. That's why I've been using the pwn2own competition where OSX was the first one hacked for the past 3 years. And last year they got read/write access to OSX while Windows only gave up read access.

Again you are looking at a very narrow situation. This is not a problem for Mac users. You would do everyone a better service if you focused on the security flaws of 3rd party software on Windows machines. Those are the real security threats that people are falling victim to in the everyday use of computers, not some obscure geek competition.