Posted on 01/26/2006 3:25:15 PM PST by Salo
OS X contains unpatched security flaws of a type that were fixed on alternative operating systems more than a decade ago, according to a security researcher credited with finding numerous bugs in Apple's increasingly popular platform.
Neil Archibald, senior security researcher at software security specialists Suresec, told ZDNet Australia that as Apple's market share increases, OS X will come under more scrutiny by security researchers, who he believes will find plenty of "low-hanging bugs".
Archibald, who has already discovered a number of security vulnerabilities in OS X, speculates that should Apple's market share continue to increase, users of the platform could actually end up less secure than users of other platforms such as Microsoft Windows or Linux.
"The only thing which has kept Mac OS X relatively safe up until now is the fact that the market share is significantly lower than that of Microsoft Windows or the more common UNIX platforms.… If this situation was to change, in my opinion, things could be a lot worse on Mac OS X than they currently are on other operating systems, regarding security vulnerabilities," said Archibald.
Archibald said his opinion is justified because Apple does not use software auditing tools to scan enough of its software. These types of tools have been heavily employed by Microsoft since the company launched its Trustworthy Computing initiative, in order to discover simple coding mistakes that could allow, for example, buffer overflow errors.
"The code that Apple uses in its applications and libraries is relatively under-audited, which leaves a lot of low hanging bugs.… Some of the security vulnerabilities we've seen during research on OS X were fixed on most other operating systems 10 to 15 years ago," said Archibald.
To prove his point, Archibald gave a number of examples.
In August last year, Apple patched the "dsidentity" bug, which was discovered by Archibald and affected OS X versions 10.4.x up to 10.4.2.
This "trivial" bug, according to Archibald, could easily have been exploited to grant a non-privileged user with admin rights and allow that user to create and remove "root" user accounts.
"Bugs like this require a simple glance over the code to notice and are long dead on other operating systems.… When we spoke to Apple on the phone about this issue, the security team had never even heard of the application, and burst out laughing at the simplicity of the vulnerability," said Archibald.
He also described another recently patched flaw in OS X's memory allocator that could allow certain applications to overwrite any file on the system and gain root privileges.
Another vulnerability described by Archibald could allow memory corruption and hand control of a process over to an attacker: "At the time of writing, the vulnerability remains unpatched. However Apple is aware it exists."
Software auditing is not the only thing Apple underutilises, according to Archibald, who also criticised the manner in which the Mac maker deals with security researchers that discover vulnerabilities.
"In my experience -- which is also the experience of some of my peers -- Apple has been very slow to respond to reported security vulnerabilities. It expects security researchers to wait indefinitely to release the vulnerabilities and offers no incentive for them to do so," said Archibald.
Apple's impressive security record is likely to be tarnished if the company continues to grow its market share while undervaluing security researchers and not properly auditing its code: "During the small time Suresec researchers spent auditing Mac OS X, many vulnerabilities like this turned up. Suresec is currently aware of many bugs which exist by default in the latest version of Mac OS X, on both the Intel and PPC Architecture."
Apple refused to comment on Archibald's views. A spokesperson for Apple told ZDNet Australia that the company is "not going to comment on what other people say about Mac OS X".
"There's a lot of information on Mac OS X security on our Web site and we've done a great deal to ensure Mac OS X is a stable and secure platform for our customers, large and small," the spokesperson added.
Pings
Does Mac have any listeners running in a default install?
If there's no way to connect, hackers will have to try to trick you into installing their malware.
""Bugs like this require a simple glance over the code to notice and are long dead on other operating systems.… When we spoke to Apple on the phone about this issue, the security team had never even heard of the application, and burst out laughing at the simplicity of the vulnerability," said Archibald"
Interesting
When you've swallowed the cult's line long enough you can only function in denial...
I knew it was a matter of time.
To my view, most of the bugs, hacking, malware and spyware has been written on MACs and of course targeting Windows. Now that it's more "cutting edge" to target OS X, well, it's just a matter of time.
But, does this now make up for even a tiny amount of the ridicule that's been written by MAC people about Windows and those of who use it?
Mac OS X is *nix
I've spoken with a whole lot of "technicians" on the phone with computer whatnots and cable companies and I often know far more than they do. "Customer Service" workers are there to contend with answering the calls. Shouldn't even begin to anticipate highly, if even at all, intelligent comments from them. They're there to interact with issues like, "have you deleted your temporary internet files recently" and things like that, to answer questions similar to, "why do I keep seeing popups on my monitor?"
So, using all the lopic their brains can contain, Windows supporters conclude that it wouldn't be wise to use OS X today because it might be less safe untold years from now.
Then, Windows supporters apparently assume that Apple will code its OS in a vacuum as it becomes more popular and, as OS X starts to receive more and more attacks, Apple will steadfastly refuse to adjust and modify its policies and procedures.
Hah-hah!
"Mac OS X is *nix"
Bingo. Mac is BSD. Mac has been safe for 2 reasons, small market share, and proprietary hardware. Now that OS X will run on Intel, and Mac seems to be gaining in market share, they will become a more attractive target.
However, the Mac zealots will point out, correctly, that for some time to come you'll still be safer on a Mac.
"So, using all the lopic their brains can contain, Windows supporters conclude that it wouldn't be wise to use OS X today because it might be less safe untold years from now. "
See, it's trollish responses like that that cause people to view Mac users as zealots as opposed to someone who just likes another flavor.
Not all Windows users are stupid. Not all Mac users are smart. Some Mac users even check for typos on their posts. :)
It is based on BSD Unix which was designed for DARPA
in the late 70s & 80s to be hack proof.
And, that would be YOU, right?
spell check is for wimps.
"spell check is for wimps."
Right, some of us can actually spell without it. But, you are a Mac user, so I can understand the shortcomings.
"And, that would be YOU, right?"
Actually, I use Windows. Always have. I'm a computer professional who is also a hobbyist. Macs were never hobbyist friendly. But it is an interesting platform, and I can understand why someone would choose Mac.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.