Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

Mac OS X security myth exposed
Techworld ^ | 24 June 2004 | Matthew Broersma, Techworld

Posted on 01/16/2005 12:04:57 PM PST by Bush2000


24 June 2004
Mac OS X security myth exposed
And thousands of other products and OSes given security rundown.

By Matthew Broersma, Techworld

Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia.

The stats, based on a database of security advisories for more than 3,500 products during 2003 and 2004 sheds light on the real security of enterprise applications and operating systems, according to the firm. Each product is broken down into pie charts demonstrating how many, what type and how significant security holes have been in each.

One thing the hard figures have shown is that OS X's reputation as a relatively secure operating system is unwarranted, Secunia said. This year and last year Secunia tallied 36 advisories on security issues with the software, many of them allowing attackers to remotely take over the system - comparable to figures on operating systems such as Windows XP Professional and Red Hat Enterprise Server.

"Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed."

Its new service, easily acessible on its website, allows enterprises to gather exact information on specific products, by collating advisories from a large number of third-party security firms. A few other organisations maintain comparable lists, including the Open Source Vulnerability Database (OSVDB) and the Common Vulnerabilities and Exposures (CVE) database, which provides common names for publicly known vulnerabilities.

Secunia said the new service could help companies keep an eye on the overall security of particular software - something that is often lost in the flood of advisories and the attendant hype. "Seen over a long period of time,the statistics may indicate whether a vendor has improved the quality of their products," said Secunia CTO Thomas Kristensen. He said the data could help IT managers get an idea of what kind of vulnerabilities are being found in their products, and prioritise what they respond to.

For example, Windows security holes generally receive a lot of press because of the software's popularity, but the statistics show that Windows isn't the subject of significantly more advisories than other operating systems. Windows XP Professional saw 46 advisories in 2003-2004, with 48 percent of vulnerabilities allowing remote attacks and 46 percent enabling system access, Secunia said.

Suse Linux Enterprise Server (SLES) 8 had 48 advisories in the same period, with 58 percent of the holes exploitable remotely and 37 percent enabling system access. Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year. Sixty-six percent of the vulnerabilities were remotely exploitable, with 25 granting system access.

Mac OS X doesn't stand out as particularly more secure than the competition, according to Secunia. Of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system. The proportion of critical bugs was also comparable with other software: 33 percent of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30 percent for XP Professional and 27 percent for SLES 8 and just 12 percent for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19 percent.

As for the old guard, Sun's Solaris 9 saw its share of problems, with 60 advisories in 2003-2004, 20 percent of which were "highly" or "extremely" critical, Secunia said.

Comparing product security is notoriously difficult, and has become a contentious issue recently with vendors using security as a selling point. A recent Forrester study comparing Windows and Linux vendor response times on security flaws was heavily criticised for its conclusion that Linux vendors took longer to release patches. Linux vendors attach more weight to more critical flaws, leaving unimportant bugs for later patching, something the study failed to factor in, according to Linux companies. Vendors also took issue with the study's method of ranking "critical" security bugs, which didn't agree with the vendors' own criteria.

Secunia agreed that straightforward comparisons aren't possible, partly because some products receive more scrutiny than others. Microsoft products are researched more because of their wide use, while open-source products are easier to analyse because researchers have general access to the source code, Kristensen said.

"A third factor is that Linux / Unix people are very concerned about privilege escalation vulnerabilities, while Windows people in general are not, especially because of the shatter-like attacks which have been known for six years or more," he said. "A product is not necessarily more secure because fewer vulnerabilities are discovered."


TOPICS: Business/Economy; Computers/Internet
KEYWORDS: computersecurity; kneepads; littleprecious; lowqualitycrap; macuser; paidshill; redmondpayroll; tech; trollfromredmond
Navigation: use the links below to view more comments.
first previous 1-20 ... 61-8081-100101-120 ... 281-286 next last
To: Bush2000
Uh, HAL, you obviously didn't read this article.

I read it the first time it was posted - seven months ago.

It's even less relevant today.

81 posted on 01/16/2005 4:30:16 PM PST by HAL9000 (Spreading terrorist beheading propaganda videos is an Act of Treason!)
[ Post Reply | Private Reply | To 75 | View Replies]

To: rwfromkansas; Vermonter
yeah, but they're ALL FIXED - unlike 1/4 of the windows ones that STILL AREN'T.
(read posting #4 again)
82 posted on 01/16/2005 5:52:13 PM PST by solitas (just tryin' to make a bad pun worse)
[ Post Reply | Private Reply | To 37 | View Replies]

To: Bush2000; antiRepublicrat; Action-America; eno_; N3WBI3; zeugma; TechJunkYard; ShorelineMike; ...

Bush2000 felt it necessary to REPOST this June 2004 article slamming OSX security by Secunia - - PING!

If you want on or off the Mac Ping List, Freepmail me.


83 posted on 01/16/2005 9:29:44 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

Oh maybe bush2000 was bored today and needed some excitement. All that football yesterday is a let down!


84 posted on 01/16/2005 9:31:17 PM PST by cyborg (http://mentalmumblings.blogspot.com/)
[ Post Reply | Private Reply | To 83 | View Replies]

To: solitas; Vermonter
yeah, but they're ALL FIXED - unlike 1/4 of the windows ones that STILL AREN'T. (read posting #4 again)

So what. FIXED doesn't mean all machines affected have been PATCHED. Get a clue.
85 posted on 01/16/2005 9:32:27 PM PST by Bush2000
[ Post Reply | Private Reply | To 82 | View Replies]

To: Swordmaker
Bush2000 felt it necessary to REPOST this June 2004 article slamming OSX security by Secunia - - PING!

It's just as relevant today as it was 6 months ago.
86 posted on 01/16/2005 9:33:57 PM PST by Bush2000
[ Post Reply | Private Reply | To 83 | View Replies]

To: Bush2000; Swordmaker
Didn't See You Over Here, B2k... where experts warn of trick to bypass IE download warnings
87 posted on 01/16/2005 9:34:56 PM PST by IncPen (Beware the fury of a patient man.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: js1138
I would guess they are not in the habit of downloading patches on a regular basis.

Not true. Mac's do a regular check automatically for updates and announces their availability on your desk top. It's so easy and transparent that most Mac users are up-to-date.

88 posted on 01/16/2005 9:41:31 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 70 | View Replies]

To: cyborg

Yawn...


89 posted on 01/16/2005 9:55:31 PM PST by John Valentine
[ Post Reply | Private Reply | To 17 | View Replies]

To: js1138
I would guess they are not in the habit of downloading patches on a regular basis.

WAAAAY Wrong!

Apple provides security upgrades regularly, and they are almost automatic. They aren't completely automatic because no executable software can be installed or patched on a Mac without a specific, password protected, permission.

90 posted on 01/16/2005 9:59:04 PM PST by John Valentine
[ Post Reply | Private Reply | To 70 | View Replies]

To: Bush2000
It's just as relevant today as it was 6 months ago.

As I said then (and I was the original poster of the article), the 19 "critical" security issues identified by Secunia were far from "critical". The only one that I considered critical was the last one that allowed a dick image to be automatically downloarded, mounted, and execute a script that could do damage to the user's home directory without user intervention. THAT was fixed quite rapidly.

Of the "36 advisories published (by Secunia) in 2003-2004, 90% of them REQUIRED that to be effective, the system under attack had to be booted into a "Root" account... which is turned off by default in OSX (and requires a seperate password to be activated) to avoid such exploits! Many of them required that the exploiter HAD TO BE OPERATING AT THE KEYBOARD OF THE COMPUTER HE WAS ATTEMPTING TO HACK... with Root activated! IF the hacker had this kind of access to the physical computer, he ALREADY owned it.

Secunia chose to ignore this "root" requirement for their "exploits" to be of any danger thus ignoring one of the primary security measures available to Mac users. 99% of Mac users will never have to operate in Root... but 99% of Windows users operate as an "Administrator", the Windows equivalent to root by default!

Bushie, you keep claiming that we cannot know that NO ONE was hit by any of these security issues... and you are right... but NO ONE HAS REPORTED ANY! NO ONE HAS DEMONSTRATED A SUCCESSFUL BREECH OF OSX WITH ITS NATIVE SECURITY ACTIVATED EXCEPT FOR A COUPLE OF PROOFS OF CONCEPT THAT WERE RAPIDLY FIXED! NO ONE HAS DEMONSTRATED A VIRUS IN THE WILD!

You want to prove that Macs are just as insecure as Windows? There is an easy way to do that: FIND or CREATE a virus or spyware/adware that will self propagate, auto-install, and spread to Mac OSX computers. This challenge has been out there for FOUR YEARS and no one has risen (or descended into the gutter) to it.

IT should also be noted that Secunia was pushing a new "Mac Security" package that they wanted to sell... they were unsuccessful.

So, you are also right that this article, which was thouroughly debunked and laughed about seven months ago, IS as relevant today as then... none what-so-ever. It was so relevant then that it only generated about 20 responses.

Go back to the original posting and refresh your memory. I invite other readers to do the same.

91 posted on 01/16/2005 10:13:02 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 86 | View Replies]

To: Swordmaker
last one that allowed a dick image to be automatically downloarded,

Dang! That exploit COULD have "downloarded" an image of a male sexual organ, but that is not what I intended to type before my tired fingers made two typos within six words of each other...

"dick image = disk image

downloarded = downloaded

92 posted on 01/16/2005 10:16:56 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 91 | View Replies]

To: Doohickey

Try to run windows on a g4..


93 posted on 01/16/2005 10:25:45 PM PST by N3WBI3
[ Post Reply | Private Reply | To 26 | View Replies]

To: rwfromkansas; Bush2000
So guys how many of these respective vulnerabilities are unpatched? let me check...

OSX: Currently, 0 out of 41 Secunia advisories, is marked as "Unpatched" in the Secunia database.

WIN XPCurrently, 17 out of 73 Secunia advisories, is marked as "Unpatched" in the Secunia database.

So I can have OS with no currently known vulnerabilities os Windows which according to your own source with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical

Oh yea, thats a hard choice...

94 posted on 01/16/2005 10:33:33 PM PST by N3WBI3
[ Post Reply | Private Reply | To 34 | View Replies]

To: Bush2000

You obviously did not look at unpatched errors, OSx has Zero and XP has in the area of 20..


95 posted on 01/16/2005 10:39:53 PM PST by N3WBI3
[ Post Reply | Private Reply | To 75 | View Replies]

To: N3WBI3

True. But, the fact remains Max OSX is not so immune as the adherents of the Apple religion would like people to believe.


96 posted on 01/16/2005 10:42:09 PM PST by rwfromkansas ("War is an ugly thing, but...the decayed feeling...which thinks nothing worth war, is worse." -Mill)
[ Post Reply | Private Reply | To 94 | View Replies]

To: Bush2000
XP home has one or more *Highly Critical* Problems
97 posted on 01/16/2005 10:42:12 PM PST by N3WBI3
[ Post Reply | Private Reply | To 76 | View Replies]

To: IncPen
Didn't See You Over Here, B2k... where experts warn of trick to bypass IE download warnings

Why? It's just not that important. You can't make me download anything.
98 posted on 01/16/2005 10:48:40 PM PST by Bush2000
[ Post Reply | Private Reply | To 87 | View Replies]

To: Swordmaker
It's so easy and transparent that most Mac users are up-to-date.

Ah, but most isn't all -- and therein lies the problem. The existence of a patch doesn't mean people will apply said patch.
99 posted on 01/16/2005 10:50:18 PM PST by Bush2000
[ Post Reply | Private Reply | To 88 | View Replies]

To: rwfromkansas
I will put to you the same challenge I have put the b2k on multiple occasions. Find a post when a Mac user said their OS was invulnerable, Find a post when a Linux user said their os was invulnerable, or find a post when a firefox user said their product was invulnerable. Windows fanatics on FR hear people say that all the time but they can never link to someone saying it..

What you will find is Mac users saying their system is better architecture and given the fact mac has fewer discovered vulnerabilities, fewer unpatched vulnerabilities, and the nature of the vulnerabilities found thats not a bad foot to be standing on.

100 posted on 01/16/2005 10:52:38 PM PST by N3WBI3
[ Post Reply | Private Reply | To 96 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-20 ... 61-8081-100101-120 ... 281-286 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson