Mac OS X security myth exposed

Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia.

The stats, based on a database of security advisories for more than 3,500 products during 2003 and 2004 sheds light on the real security of enterprise applications and operating systems, according to the firm. Each product is broken down into pie charts demonstrating how many, what type and how significant security holes have been in each.

One thing the hard figures have shown is that OS X's reputation as a relatively secure operating system is unwarranted, Secunia said. This year and last year Secunia tallied 36 advisories on security issues with the software, many of them allowing attackers to remotely take over the system - comparable to figures on operating systems such as Windows XP Professional and Red Hat Enterprise Server.

"Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed."

Its new service, easily acessible on its website, allows enterprises to gather exact information on specific products, by collating advisories from a large number of third-party security firms. A few other organisations maintain comparable lists, including the Open Source Vulnerability Database (OSVDB) and the Common Vulnerabilities and Exposures (CVE) database, which provides common names for publicly known vulnerabilities.

Secunia said the new service could help companies keep an eye on the overall security of particular software - something that is often lost in the flood of advisories and the attendant hype. "Seen over a long period of time,the statistics may indicate whether a vendor has improved the quality of their products," said Secunia CTO Thomas Kristensen. He said the data could help IT managers get an idea of what kind of vulnerabilities are being found in their products, and prioritise what they respond to.

For example, Windows security holes generally receive a lot of press because of the software's popularity, but the statistics show that Windows isn't the subject of significantly more advisories than other operating systems. Windows XP Professional saw 46 advisories in 2003-2004, with 48 percent of vulnerabilities allowing remote attacks and 46 percent enabling system access, Secunia said.

Suse Linux Enterprise Server (SLES) 8 had 48 advisories in the same period, with 58 percent of the holes exploitable remotely and 37 percent enabling system access. Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year. Sixty-six percent of the vulnerabilities were remotely exploitable, with 25 granting system access.

Mac OS X doesn't stand out as particularly more secure than the competition, according to Secunia. Of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system. The proportion of critical bugs was also comparable with other software: 33 percent of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30 percent for XP Professional and 27 percent for SLES 8 and just 12 percent for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19 percent.

As for the old guard, Sun's Solaris 9 saw its share of problems, with 60 advisories in 2003-2004, 20 percent of which were "highly" or "extremely" critical, Secunia said.

Comparing product security is notoriously difficult, and has become a contentious issue recently with vendors using security as a selling point. A recent Forrester study comparing Windows and Linux vendor response times on security flaws was heavily criticised for its conclusion that Linux vendors took longer to release patches. Linux vendors attach more weight to more critical flaws, leaving unimportant bugs for later patching, something the study failed to factor in, according to Linux companies. Vendors also took issue with the study's method of ranking "critical" security bugs, which didn't agree with the vendors' own criteria.

Secunia agreed that straightforward comparisons aren't possible, partly because some products receive more scrutiny than others. Microsoft products are researched more because of their wide use, while open-source products are easier to analyse because researchers have general access to the source code, Kristensen said.

"A third factor is that Linux / Unix people are very concerned about privilege escalation vulnerabilities, while Windows people in general are not, especially because of the shatter-like attacks which have been known for six years or more," he said. "A product is not necessarily more secure because fewer vulnerabilities are discovered."

You're missing the point, which was that you blamed OEMs for improperly configuring Windows, while the configuration is the same as Microsoft's own. Besides, even if retail sales are a small percentage, it's still millions of machines.

Uh, dude. The default install of Red Hat installs a root account. That's it. It doesn't install a freaking user account. You have to add that, yourself. So lay off the indignation. It doesn't suit you.

They only lost the ability to tell OEMs they can't offer other OSs or install other software in the OS. Otherwise, the OEM's configure Microsoft-standard, as is evident by their config being the same as the retail config.

Wrong. You don't know SQUAT about what OEMs are allowed to do with Windows today. They can configure it any way they want to -- and the DOJ will kick MS's ass if it tries to say otherwise. The consent decree that MS signed specifically authorized OEMs to do so.

I can't find hard numbers of current sales, but extrapolate from this article citing 650,000 retail sales of XP during only two months in 2001 -- and that's when XP sales were lagging behind 98 sales.

No, do yourself a favor and don't extrapolate -- because extrapolation wouldn't be an accurate reflection of what happens in retail software markets. Software has a very short shelf life. It will only provide sales within the first 6 months. After that, sales turn into a trickle.

And where's the admin for the hundreds of millions of home installs? Is everyone supposed to become a computer expert just to be relatively secure?

Tell it to Red Hat. Or Suse. Or Mandrake. Because they ship exactly the same way.

And for business, do you mind paying for the extra admin work to make up for the shortcomings of the OS and its initial configuration? I'd prefer to save the money.

Considering that you would need to add user accounts anyway -- and differentiating those user accounts as restricted is TRIVIAL -- I'd go with the OS that the vast majority of the world uses. Not some untested wallflower OS from pansyland California...

Macs are suprerior.

The article deliberately does not deal with empirical occurences. Theoretical designs to crash Mac OS X exists but are not practically implemented.

I have a standing challenge to my graduate students. Show me a PC notebook that you successfully maintain and keep for two years of grad school.

In ten years, no PC notebooks have survived. All my Mac notebooks still work (including Pre OS X).

Macs are suprerior.

Oh, well, if you say so ... /SARCASM

The article deliberately does not deal with empirical occurences. Theoretical designs to crash Mac OS X exists but are not practically implemented.

Get real. The software engineering of OS X is fundamentally the same as the software engineering that goes into BSD and Linux and Windows and Solaris. And the bug counts validate that.

I have a standing challenge to my graduate students. Show me a PC notebook that you successfully maintain and keep for two years of grad school.

Perhaps that's more a reflection of IQ-challenged grad students than than empirical evidence. Here's a tip: Most of those kids are running crap on their machines (IM, file-sharing, etc) that is specifically laden with spyware. It's no wonder that you can't find any students who can accomplish such a feat.

In ten years, no PC notebooks have survived. All my Mac notebooks still work (including Pre OS X).

Try administering them properly, chief. Until then, you're blowing smoke...

"Try administering them properly chief . . ."

Ahh, there it is-- the PC world in a nutshell. With enough IT support, PCs are awesome. Believe me, I have noticed at my university the extravagant resources dedicated to propping up your view.

Unfortunately-- probably due to my limited mental capacities as a mac user-- I would like the computer to work with ease comparable to any other technological device I work with. This is most certainly not the case with PCs. I work in labs with PCs and Macs. The Macs work better.

Were it not for IT personnel insistence and preference for PCs (at least at my work site), the monopoly would be hard to maintain. I wonder why the IT people like PCs so much? I am not smart enough as a Mac user to figure this out.

Maybe you have some insight.

Ahh, there it is-- the PC world in a nutshell. With enough IT support, PCs are awesome. Believe me, I have noticed at my university the extravagant resources dedicated to propping up your view.

Nah, chief. It's simple. Install RESTRICTED USER ACCOUNTS on your notebook PCs. I know that's a foreign concept. Yeah, imagine ... tell your grad students not to run in ADMINISTRATOR MODE -- and then tell me how your little experiment goes ...

Uh, dude. The default install of Red Hat installs a root account. That's it. It doesn't install a freaking user account.

Have I ever claimed that Linux is ready for general home use? I'll be the first to say that it sucks for almost all home users. But if you are in the enterprise, a standard install, after making basic user accounts, is generally more locked-down than a Windows install.

You don't know SQUAT about what OEMs are allowed to do with Windows today.

I do know they apparently follow Microsoft's example in how to configure Windows. First you want the users to make up for Microsoft's shortcomings, now you want to lay that on the OEMs?

No, do yourself a favor and don't extrapolate -- because extrapolation wouldn't be an accurate reflection of what happens in retail software markets. Software has a very short shelf life. It will only provide sales within the first 6 months. After that, sales turn into a trickle.

That figure was from before retail sales of XP even hit their high, still being second to a years-old OS. It would be extremely illogical to assume that these sales dropped to nothing immediately after this article, and therefore sales were not able to reach the millions of copies sold that I claimed.

Admit it, there are millions of retail copies of XP out there, all configured by Microsoft, all approximately the same as the OEM configs. I have one of these retail installs, an upgrade for that machine that started as a 486/66.

I'd go with the OS that the vast majority of the world uses. Not some untested wallflower OS from pansyland California...

You mean the one that by default doesn't even enable the root account (= "Administrator" in Winodws)?

Untested? Dude, the core of that "untested" OS is the extremely tested BSD, which has been working in a networked environment since before Bill's OS even realized you could hook two computers together.

I know that's a foreign concept. Yeah, imagine ... tell your grad students not to run in ADMINISTRATOR MODE -- and then tell me how your little experiment goes ...

I'd like something in between. Where you're still able to get your work done like you could as Administrator, but without Administrator's abilities to hose the entire system.

You could create that with a lot of group permissions tweaking in XP, or you could get it with a standard install of OS X. Hmmm, I wonder which is easier for 99.99% of users out there?

Have I ever claimed that Linux is ready for general home use? I'll be the first to say that it sucks for almost all home users.

Ergo, initial Linux setup is no better than Windows.

But if you are in the enterprise, a standard install, after making basic user accounts, is generally more locked-down than a Windows install.

Nonsense. The key words in your statement were "after making basic user accounts". Linux doesn't force you to create user accounts. Neither does Windows. You need to take the initiative. But you want to pretend that the effort to do the same with Windows is somehow different than the effort that you would have to put into creating basic user accounts under Linux. Which is nonsense.

I do know they apparently follow Microsoft's example in how to configure Windows. First you want the users to make up for Microsoft's shortcomings, now you want to lay that on the OEMs?

No, I'm putting responsibility on the ADMINISTRATOR of the operating system. OEMs are installing the OS for you. They therefore need to take responsibility for the state of the box before it gets delivered to you.

That figure was from before retail sales of XP even hit their high, still being second to a years-old OS. It would be extremely illogical to assume that these sales dropped to nothing immediately after this article, and therefore sales were not able to reach the millions of copies sold that I claimed.

It would be illogical to conclude that the sales rate climbed after the first six months of release.

Admit it, there are millions of retail copies of XP out there, all configured by Microsoft, all approximately the same as the OEM configs. I have one of these retail installs, an upgrade for that machine that started as a 486/66.

Less than 1% of all installs are retail. It's an insignificant number.

Two words: job security. I sit before you admitting my guilt of having previously been a beneficiary of the needless Microsoft/IT Tech job security racket.

Dude, your job security is a result of your poor administration skills. You admit that you won't lock down machines -- even though common sense dictates that you need to do so. Don't blame your poor admin skills on the OS.

Dude, your job security is a result of your poor administration skills. You admit that you won't lock down machines -- even though common sense dictates that you need to do so.

I did lock down those machines, and even with a lockdown script I had (closed ports, shutdown services, etc.) it still took quite some time to admin all those Windows boxes. Dealing with constant critical updates was a pain. I rarely had to touch the Linux boxes though.

And don't go on about auto updates. Every update had to be tested before it could be installed, both to check for incompatibilities and to make sure the update didn't restart any services or something. That did happen -- without telling me, Microsoft started a service I had previously disabled for security reasons. Would you call that good security practice by Microsoft?

Don't blame your poor admin skills on the OS.

I'm blaming the OS for making me use too much of my time administering it.

Ergo, initial Linux setup is no better than Windows.

As far as initial accounts go, no. That's one reason why I don't think it's ready for home use, just like Windows isn't in that respect.

They therefore need to take responsibility for the state of the box before it gets delivered to you.

Why don't you become an OEM then, and be the first to offer this service? It's actually a pretty good idea. And what about the millions of copies of XP shipped by Microsoft at retail? Do they have a responsibility to configure it well?

It would be illogical to conclude that the sales rate climbed after the first six months of release.

That 650,000 was the two months following the initial release. Microsoft also claimed stores couldn't keep retail copies stocked. Plus, the XP retail install is the same as the XP corporate license install except for the need for activation, so add all those corporate licenses.

Less than 1% of all installs are retail. It's an insignificant number.

There you go, millions. Whether its an insignificant number doesn't matter. What matters is that Microsoft's practice is to ship poorly configured Windows installs. Are you incapable of admitting that Microsoft can do wrong?

Nope. PC problems are more serious than administrator settings. PCs are cheaper. They generally use parts that fail more easily. I have seen many more screen failures, power packs, and battery failures on PCs than on Macs.

The notebooks I am referring to are not lab computers-- though I am familiar with that setting as well. The personal notebook computers of students do not work. Answers to my post show that if PCs are shared they become even more vulnerable. Macs have administrator settings which I do use. But even when Macs lack administration authorizations, they tend to fail and be corrupted less (in my 10 years of experience at this university).

IT support is in a racket with Windows/Microsoft-- let's admit it.

I am not even talking about software here. Microsoft Word is probably the only slightly interesting software that is generally useful. iTunes and various multimedia softwares from Apple blow the PC away or force it into anemic emulations.

Nope. PC problems are more serious than administrator settings. PCs are cheaper. They generally use parts that fail more easily. I have seen many more screen failures, power packs, and battery failures on PCs than on Macs.

Reality check: There are plenty of examples of Macs turning into hotplates, frying their batteries, etc. I love the anecdote about Macs potentially exploding. Oh, yeah. There's real quality control there. Nice. /SARCASM

Apple recalls overheating batteries
Apple recalls power adapters
Cubes suck ass
What can I do about my overheating Titanium PowerBook G4?

Macs have always had a problem with power management and heat. Some things never change.

The notebooks I am referring to are not lab computers-- though I am familiar with that setting as well. The personal notebook computers of students do not work. Answers to my post show that if PCs are shared they become even more vulnerable.

Duh. They're being run in Administrator mode. Of course they're vulnerable to these dumbass kids installing crapware on them. They shouldn't be run in anything other than a Restricted account.

Macs have administrator settings which I do use. But even when Macs lack administration authorizations, they tend to fail and be corrupted less (in my 10 years of experience at this university).

Statistically, there are far fewer of them. Hence, your anecdotal "evidence" is based on skewed averages.

IT support is in a racket with Windows/Microsoft-- let's admit it.

Many IT shops are simply incompetent. Yours is no exception.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.