Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

Mac OS X security myth exposed
Techworld ^ | 24 June 2004 | Matthew Broersma, Techworld

Posted on 01/16/2005 12:04:57 PM PST by Bush2000


24 June 2004
Mac OS X security myth exposed
And thousands of other products and OSes given security rundown.

By Matthew Broersma, Techworld

Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia.

The stats, based on a database of security advisories for more than 3,500 products during 2003 and 2004 sheds light on the real security of enterprise applications and operating systems, according to the firm. Each product is broken down into pie charts demonstrating how many, what type and how significant security holes have been in each.

One thing the hard figures have shown is that OS X's reputation as a relatively secure operating system is unwarranted, Secunia said. This year and last year Secunia tallied 36 advisories on security issues with the software, many of them allowing attackers to remotely take over the system - comparable to figures on operating systems such as Windows XP Professional and Red Hat Enterprise Server.

"Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed."

Its new service, easily acessible on its website, allows enterprises to gather exact information on specific products, by collating advisories from a large number of third-party security firms. A few other organisations maintain comparable lists, including the Open Source Vulnerability Database (OSVDB) and the Common Vulnerabilities and Exposures (CVE) database, which provides common names for publicly known vulnerabilities.

Secunia said the new service could help companies keep an eye on the overall security of particular software - something that is often lost in the flood of advisories and the attendant hype. "Seen over a long period of time,the statistics may indicate whether a vendor has improved the quality of their products," said Secunia CTO Thomas Kristensen. He said the data could help IT managers get an idea of what kind of vulnerabilities are being found in their products, and prioritise what they respond to.

For example, Windows security holes generally receive a lot of press because of the software's popularity, but the statistics show that Windows isn't the subject of significantly more advisories than other operating systems. Windows XP Professional saw 46 advisories in 2003-2004, with 48 percent of vulnerabilities allowing remote attacks and 46 percent enabling system access, Secunia said.

Suse Linux Enterprise Server (SLES) 8 had 48 advisories in the same period, with 58 percent of the holes exploitable remotely and 37 percent enabling system access. Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year. Sixty-six percent of the vulnerabilities were remotely exploitable, with 25 granting system access.

Mac OS X doesn't stand out as particularly more secure than the competition, according to Secunia. Of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system. The proportion of critical bugs was also comparable with other software: 33 percent of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30 percent for XP Professional and 27 percent for SLES 8 and just 12 percent for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19 percent.

As for the old guard, Sun's Solaris 9 saw its share of problems, with 60 advisories in 2003-2004, 20 percent of which were "highly" or "extremely" critical, Secunia said.

Comparing product security is notoriously difficult, and has become a contentious issue recently with vendors using security as a selling point. A recent Forrester study comparing Windows and Linux vendor response times on security flaws was heavily criticised for its conclusion that Linux vendors took longer to release patches. Linux vendors attach more weight to more critical flaws, leaving unimportant bugs for later patching, something the study failed to factor in, according to Linux companies. Vendors also took issue with the study's method of ranking "critical" security bugs, which didn't agree with the vendors' own criteria.

Secunia agreed that straightforward comparisons aren't possible, partly because some products receive more scrutiny than others. Microsoft products are researched more because of their wide use, while open-source products are easier to analyse because researchers have general access to the source code, Kristensen said.

"A third factor is that Linux / Unix people are very concerned about privilege escalation vulnerabilities, while Windows people in general are not, especially because of the shatter-like attacks which have been known for six years or more," he said. "A product is not necessarily more secure because fewer vulnerabilities are discovered."


TOPICS: Business/Economy; Computers/Internet
KEYWORDS: computersecurity; kneepads; littleprecious; lowqualitycrap; macuser; paidshill; redmondpayroll; tech; trollfromredmond
Navigation: use the links below to view more comments.
first previous 1-20 ... 161-180181-200201-220 ... 281-286 next last
To: general_re
Sorry if I seem obtuse - I must have missed this latest episode ;)

Oops, wrong thread. here

181 posted on 01/18/2005 12:00:59 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 179 | View Replies]

To: antiRepublicrat
Except that they tend to unreasonable escalate the criticality of OS X bugs.

Oh, BS. You guys just don't like getting your noses rubbed in your own leavings...

Why does one version of Windows still have about 20 security bugs outstanding, and the Mac none?

From my reading, some of the issues are general problems that can't be patched, pose no practical risk, or have simple procedural workarounds:

Example: "NOTE: This is a general problem with personal firewalls and can be exploited via any program granted access through the firewall without user interaction. It is a known issue and have been discussed in the security community about 2 years ago. PoC exploit code has also priorly been released by Oliver Lavery."

Another: "Secunia is currently not aware of a solution."

Another: "Use another Java implementation. [MS was barred from updating MSJVM by Sun]"

Another: Grant only trusted [local] users access to affected systems"

Another: "Restrict traffic in border routers and firewalls."

Do you think that has any impact on real-world security?

Of course it does. But the extent of the impact is debatable.
182 posted on 01/18/2005 12:02:19 PM PST by Bush2000
[ Post Reply | Private Reply | To 175 | View Replies]

To: antiRepublicrat
The requested document does not exist on this server.

You're having a rough day, eh? "The requested document does not exist on this server. "
183 posted on 01/18/2005 12:03:41 PM PST by Bush2000
[ Post Reply | Private Reply | To 181 | View Replies]

To: Bush2000
You're having a rough day, eh?

Very rough day. here

184 posted on 01/18/2005 12:06:01 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 183 | View Replies]

To: Bush2000
Another: "Secunia is currently not aware of a solution."

That's actually pretty bad. Their network architecture is so bad that they can't find a solution to fragmented packets?

Otherwise, you seem to believe their "critical" ratings for OS X, but excuse "extremely critical" ratings for Windows since they can be somewhat mitigated by shutting off possibly needed things or buying extra stuff.

185 posted on 01/18/2005 12:12:15 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 182 | View Replies]

To: Bush2000
There have been many buffer overflow exploits in kernel-land which lead to elevate privilege.

Okay, show me the chain of exploits that would enable a remote computer to gain root access (or something effectively root access) on an OS X system with root turned off. I'm not saying it can't theoretically be done (I know it's been accomplished locally), I'd just like to see how it's been done remotely.

186 posted on 01/18/2005 12:18:28 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 180 | View Replies]

To: antiRepublicrat
Okay, show me the chain of exploits that would enable a remote computer to gain root access (or something effectively root access) on an OS X system with root turned off. I'm not saying it can't theoretically be done (I know it's been accomplished locally), I'd just like to see how it's been done remotely.

Piece of cake. First, our hacker hijacks a web server (not a big deal -- Apache and other servers have a fair number of exploitable issues) and installs a web page. Or, I lure you to my own webpage. I embed a "help:runscript" sequence of commands within the page.

You download the page. You run the script/executable because your Mac OS X box is vulnerable to the following exploit:

http://secunia.com/advisories/11622/

Now able to run arbitrary code, our hacker exploits the following kernel buffer overflow in Mac OS X:

http://www3.ca.com/securityadvisor/vulninfo/Vuln.aspx?ID=26449 Bingo. Hacker owns your box. Didn't have root access at the time of the exploit -- but does now.
187 posted on 01/18/2005 2:50:36 PM PST by Bush2000
[ Post Reply | Private Reply | To 186 | View Replies]

To: antiRepublicrat
That's actually pretty bad. Their network architecture is so bad that they can't find a solution to fragmented packets?

There's no reason to. They can be eliminated with any cheapware packet filtering firewall.

Otherwise, you seem to believe their "critical" ratings for OS X, but excuse "extremely critical" ratings for Windows since they can be somewhat mitigated by shutting off possibly needed things or buying extra stuff.

Whoa, not at all. I'm not saying that critical or extremely critical exploits should be excused. They're serious. By definition, they should be fixed immediately. But you Mac guys tend to excuse any critical OS X bug -- no matter how serious -- and when I point out that you're being ridiculous, you pull out that "SHOW ME AN EXPLOIT IN THE WILD" crap; as if the absence of a mechanical implementation of the exploit makes the security problem go away. Sheez. Look, you can pull that crap with newbies, but it just doesn't fly with pros.
188 posted on 01/18/2005 2:55:26 PM PST by Bush2000
[ Post Reply | Private Reply | To 185 | View Replies]

To: HAL9000
Mac OS X worms, viruses and spyware: near zero.

Which will change, if Mac ever gets a respectable market share. Even among those who are not religiously motivated (as many anti-MS hackers appear to be), most hackers are smart enough to put their efforts toward the systems that are best able to propagate their work.

With over 90% of the user market, Windows is by far the most desirable target.

But again, we cannot neglect the religious aspects of this: there are those -- and I suspect there are/will be several on this very thread -- whose antipathy toward Microsoft is rather resembles militant Islam.... ;-)

189 posted on 01/18/2005 2:56:23 PM PST by r9etb
[ Post Reply | Private Reply | To 6 | View Replies]

To: Bush2000

Dang, I just paid $9,000 for my custom designed Apple G6¼ dual processor with cinema display. I'm going to cancel my order. Dell has something on special that can do the same for $500... I saw a spacial on Viewsonic 19" LCDs for $299.


190 posted on 01/18/2005 3:04:27 PM PST by dennisw (G_D: Against Amelek for all generations.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: r9etb
With over 90% of the user market, Windows is by far the most desirable target.

And yet, somehow according to Secunia, the number of exploits is comparable. Which basically debunks their so-called "quality".
191 posted on 01/18/2005 3:10:40 PM PST by Bush2000
[ Post Reply | Private Reply | To 189 | View Replies]

To: dennisw

I don't know what's funnier: You spending $9,000 on a Mac boutique toy or AntiRepublicrat/Swordmaker's delusions that Macs are secure.


192 posted on 01/18/2005 3:13:30 PM PST by Bush2000
[ Post Reply | Private Reply | To 190 | View Replies]

To: dennisw

LCD displays vary quite a bit in quality, and Apple's are among the best. One of their unusual features is their aspect ratio, which is good for watching (or editing) movies.


193 posted on 01/18/2005 3:15:33 PM PST by js1138 (D*mn, I Missed!)
[ Post Reply | Private Reply | To 190 | View Replies]

To: js1138

There are a few wide aspect LCD monitors out there.

http://accessories.us.dell.com/sna/productdetail.aspx?sku=320-4111&cs=19&c=us&l=en


194 posted on 01/18/2005 4:44:20 PM PST by dennisw (G_D: Against Amelek for all generations.)
[ Post Reply | Private Reply | To 193 | View Replies]

To: Bush2000
They're serious. By definition, they should be fixed immediately.

Yet you blew off things Microsoft hasn't fixed in months.

I think there are two kinds of securities we're talking about. One's theoretical, which systems have more discovered flaws and/or have built-in mitigating or denigrating features, and what's been patched. For this I'd say Mac is a little ahead, even by Secunia's list.

The other is practical: If I run this, what are my chances of getting nailed? Due to a complete lack of anything in the wild, Mac definitely is, in a very practical sense, far more secure than Windows.

195 posted on 01/18/2005 7:48:36 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 188 | View Replies]

To: Bush2000

Close, but I didn't see anything about the attacker being able to activate and gain control of root using the second exploit.


196 posted on 01/18/2005 7:50:53 PM PST by antiRepublicrat
[ Post Reply | Private Reply | To 187 | View Replies]

To: Bush2000
"Two vulnerabilities have been reported in Mac OS X, allowing malicious web sites to compromise a vulnerable system.

1) The problem is that the "help" URI handler allows execution of arbitrary local scripts (.scpt) via the classic directory traversal character sequence using "help:runscript".

2) It is also possible to silently place arbitrary files in a known location, including script files, on a user's system using the "disk" URI handler. Files on disk images can be executed without using the "help" URI handler."

Both of these UNEXPLOITED vulnerabilities were fixed, long ago. Did you read the part about local scripts? This may have worked if there was a script already on the computer that could be called to do something malicious. Of course, you hypothesize, there IS a malware script installed on the user's computer because the malicious script downloaded a disk image file as described in vulnerability number 2 which then installed the script that would download the disk image that install the script that would download the disk image... oh, wait, that's a circular argument with no beginning. Unless the user has been tricked into previously downloading and mounting the disk image with the malicious script, then the script would NOT EXIST for the help handler to call it.

Both of these "vulnerabilities" were demonstrated only as "proofs of concepts" and were expeditiously fixed.

"OS X contains a buffer overflow vulnerability that might allow attackers to cause a denial of service condition or possibly gain sensitive information. The vulnerability is due to improper bounds checking performed on long command line arguments supplied by the user. Local and remote attackers can exploit this vulnerability to cause the kernel to crash, or to possibly view portions of kernel memory."

It is a long way from "cause the kernel to crash," to "owning the box". If the Kernel crashes, the computer stops working... bummer for the user currently on the system... but it also stops working for the hacker trying to invade it. They then postulate the ability "to possibly view portions of kernel memory". This vulnerability DID allow random bits of the Kernel to be accessed and viewed... but it was just that random bits... very small bits. That is also a long way from "owning the box".

We Mac users welcome people finding and reporting vulnerabilities in OSX and its underlying UNIX core. If the vulnerabilities are not found and fixed, then THEY MIGHT BE EXPLOITED. Apple doesn't ignore the vulnerabilities... it fixes them. In addition, it is not just Apple who is hard at work finding and fixing vulnerabilities... it is all the other providers of the Open Source Applications and Libraries that make up the package called BSDUnix.

197 posted on 01/18/2005 9:06:24 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 187 | View Replies]

To: Bush2000
What's so denigrating about "fan boy"

It is because YOU intend it to be. YOU use it to belittle your opponents and to make others think less of their positions. It is a form of ad hominem attack.

It correctly states that you are a boy (true) and a fan of Apple (also true).

I stopped being a "boy" over 35 years ago. I will admit to being a person who has selected to use a computer using Apple's Macintosh OSX operating system. I made this selection from the position of being a professional in the computer industry with over 30 years of experience and a very good knowledge of several operating systems including the various incarnations of Windows. In other words, Bush, I made an informed selection based on experience... lots of it.

You know, it used to be fun to work on Windows computers for my clients... I can no longer say that. It is tiresome and not a bit boring to once again clean out spy-ware, ad-ware, and other crap that can and does infest those boxes.

When I want to use my computer, I prefer to go home and use my computer without worrying about such malicious sh!t, nor do I want my computer to have to spend MY productive time checking for various forms of spy-ware, intercepting pop-ups, downloading virus specifications, ad-ware definitions, and spy-ware cleaners. I just want to safely surf the web, receive any email that comes to me that might include JPEG images or even other attachments, and do my work without worry that some SPY is logging everything I do. It is my well qualified opinion that the Macintosh using the latest updated and yes, patched, version of OSX offers the best way to do that. In my experienced opinion, the Mac offers the best opportunity for computer users to WORK with a computer and not work ON IT. I want other computer users to have the same experience.

What I cannot understand is why YOU have appointed yourself as the guardian intent on preventing anyone from using a Macintosh and computing safely... so much so that you invade any and every thread on FreeRepublic that even hints of the capabilities of the Mac and start spewing insults and knocking everything about the Mac.

You call us LIARS, you generalize everyone who uses a Mac, you make ridiculous claims like "No businesses use Macs" when thousands, if not hundreds of thousands, do. We repeatedly refute your assertions yet you never go away. You ALWAYS come back with the same tired and often outdated arguments.

Frankly, Bush, you resemble a particularly tenacious ad-ware... one that is impossible to remove.

198 posted on 01/18/2005 9:38:00 PM PST by Swordmaker (Tagline now open, please ring bell.)
[ Post Reply | Private Reply | To 167 | View Replies]

Comment #199 Removed by Moderator

To: Bush2000
I don't know what's funnier: You spending $9,000 on a Mac boutique toy or AntiRepublicrat/Swordmaker's delusions that Macs are secure.

Let's see, he got a computer that can run with all but the fastest Intel desktop systems out there, one of the fastest video cards on the market, and about the best flat panel monitor on the market (which was 1/3 of his purchase price). $9K isn't much to spend if you make money off the machine.

Considering you're smart and buy your RAM for both cheaper than either Dell or Apple will sell it to you, the G5 fully configured to run with the big monitor won't cost you any more than a Dell workstation of approximately the same performance. And with Tiger you'll get an instant performance upgrade when most of the image and video processing can be offloaded onto the video card.

Add to that the fact that you won't have a loud wind tunnel on your desktop and it's a pretty good deal.

200 posted on 01/19/2005 7:50:56 AM PST by antiRepublicrat
[ Post Reply | Private Reply | To 192 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-20 ... 161-180181-200201-220 ... 281-286 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson