Apple Submits Mac OS X For Security Evaluation

ranger8x writes "Apple has submitted Mac OS X and Mac OS X Server to the U.S. government's National Information Assurance Partnership to evaluate various security features. It seems Apple is looking for some respect by the government, and to 'get more exposure.'"

Comments

Wow!

[Drizzt Do'Urden]

Woo.. that's great!

Apple could bring a Trusted MacOS X before Microsoft get's it's Palladium out! :D

Not that's something interesting...

Not look for holes

[gbooker]

The testing doesn't look for holes in the operating system, but rather evaluates what security features are built into it.

I guess they needed this so that Windows could be used.

If that is the case, OS X should not have any trouble at all. Let's look at some of the security features:

• Root disabled by default
• SSH remote login
• Telnet not easy to turn on (should use SSH instead)
• Can disable auto login
• Any major system changes require authentication even if the current user is an admin
• Built in Firewall

I know this is a short list, but it demonstrates the point well. OS X has many security features that are inherant of a unix based OS. It will be nice to see OS X more accepted amoung the government.

Re:Not look for holes

[jellomizer]

There is also the fact that there is a Unix File system structor with file permissions.

Defaultly hidden Unix structure from the GUI

A real Multy User mode.

Re:Not look for holes

[TotallyUseless]

your work is done

Government Security

[Anonymous Coward]

The government thinks it's secure? Well, that changes everything! The government has an excellent traffic record in detecting security hazards.

Re:Government Security

[dbrutus]

Actually, they're testing to verify that if your admin knows what he's doing its securable as the OS is not inherently insecure by design (think Win9x for a broke by design example).

A good move.

[jellomizer]

If apple gets good marks on its security audit. And MS dosent do as well. It is an other thing to stick in MS face. And a way to prove that their OS is better designed then MSes stuff. Of course if it fails (which I think is unlikly) then Apple could be in a lot of trouble.

Re:A good move.

[Saint Fnordius]

According to what I saw, MS has put Windows 2000 up for EAL4 evaluation, with some funky exeptions. Apple is going for EAL3 evaluation first and probably did a lot of internal tests first.

Win2000 has been in the lab for a LONG time now, and still isn't certified. Is Microsoft playing the "submitted for" advertising game, hoping that it can run out the clock yet again?

gov't: a good market for apple

[larry bagina]

The Gov't could be a good market for apple,
particularly now that they use OS X
Gov't workers are getting tired of code red, nimda, etc, which hilite how insecure Windows is when not properly configured.
Even though it would require new hardware, OS X has an advantage over linux due to native MS Office support, as well as more commercial applications.

Re:gov't: a good market for apple

[Alan Partridge]

get a grip. Can you REALLY imagine a govt. dept. buying YOU a PC with a transparent keyboard? irrespective of how good it is, people ALWAYS see good design as frivolous. My IT mangler always goes for coal-black IBM shitstations whether they're appropriate or not. Ooh! a million quid for a rackmount case? certainly sir!

Re:gov't: a good market for apple

[dbrutus]

I would expect that as Apple's market shifts, its industrial design will shift too. Take a look at XServe, all brushed metal and easy to look at rack mount front plate and certainly no translucent plastic because it would be a negative for the market.

In fact, if there is any type of clone agreement that Steve Jobs might go for it would be a nice design shop that would simply design different cases in smaller runs than Apple would be comfortable doing. Imagine a 'Red Delicious, Inc.' that would simply design cases that have the same mount points as current models (and similar or superior cooling values) and put current model guts in them using channels that Apple is either uncomfortable using or is simply not feasible at the unit runs Apple would have to have.

Re:gov't: a good market for apple

[mumkin]

I don't know... I think that apple's pro line is moving in the right direction. The XServe and the TiBook look pretty gov-friendly already. Sure, you'd have a hard time slipping a flower power imac in, but Apple has left the candy colors behind it, and good riddance I say.

Imagine a flat panel imac with the entire case looking like its brushed metal underside instead of that cheap looking whiter-than-white plastic. I think those would fit in well in a government install. All net-booting Jaguar, too, for easy administration.

So yeah, while your IT mangler might not be inclined toward Apple, sometimes these decisions come from on high, with a bit of boot to back them up. Doncha think Tony Blair would just love to have some showpiece ministry completely kitted out with super-stylish yet oh-so practical imac workstations? Roll cameras, it's new labour, switching and thinking different.

Can it match up to Windows?

[Offwhite98]

Hah!

Well, I for one would prefer to run an enterprise system on top of a MacOS X Server with XServe than on top a Dell with Windows 2000. My day job has me on Windows all the time but on my own time I use an iBook with MacOS X and a FreeBSD server on a PC. From what I have seen with MacOS X security, I think Apple will get great marks.

And hopefully they will show they do not need some Palladium system to secure their OS. That is just silliness by Microsoft. They seem to be blaming the hardware for the OS being so insecure all this time.

Re:Can it match up to Windows?

[Anonymous Coward]

are you that guy that did that commercial for apple about switching? you know, that "Windows LAN Administrator" ...

Smart Move

[toupsie]

Apple has been really turning around its marketing in the last few months. More agressive. I think when Steve Jobs came back to Apple, he saw that he needed to cement his base customers like a politician does when they start a political campaign. Preach to the converted, assure them of their choice and then reach out to the rest. Apple first started giving historical Mac users something to crow about -- Mac OS X, Dual G4s (proud owner) and lately, the iPod. Now Apple is gunning for the Windows user in its switch campaign.

Now with this move, Jobs is deftly putting a thumb in the eye of Gates. Microsoft talks about 2006 for security, Apple says, "Hey, why not today?". Having a respected third party audit will ring loud against Microsoft's tight lipped security policy. Apple already exposes the base source code for Mac OS X called Darwin to anyone that wants to take the time to download it.

I had something else important to point out but the FedEx guy just showed up with Warcraft III. I am sure you will understand...

What OS X needs for better security

[EccentricAnomaly]

OS X has good security, but it has lots of room for improvement. It needs:

• longer than 8 character passwords
• checking for good passwords, password expiration, etc.
• let the user turn off the option where you can login with "John Doe" instead of your username
• let the user turn off the 'helpful' feature that puts the last user's name on the login screen
• put a checkbox in the installation process to install a system with maximum security options... stuff like no list of users on the login screen and no web server installed at all, etc.

Just a few ideas...

Re:What OS X needs for better security

[jeffy124]

excellent points, especially the username list & 8 char limit.

just a comment: the default install includes various servers, yet they're all disabled by default. only after a completed install can those services be enabled.

Re:What OS X needs for better security

[Zoop]

let the user turn off the 'helpful' feature that puts the last user's name on the login screen

You can do this:

System Preferences->Login->Login Window->Display Login Window as->Name and password entry fields

This displays a blank name field instead of the picture/name combo. I don't at work since the PC admin has an account on this box too, but then, he rarely has to mess with it so he's apt to forget it. ;-)

Re:What OS X needs for better security

[EccentricAnomaly]

yeah, but an organization might want to remove the web servers on their machines so that some user doesn't set up a web server or some other service and create a possible security hole.

I guess this wouldn't be a problem if users could get by without administrator access, but Mac vendors don't seem to understand that software installs should rarely require admin password. Why does internet explorer require an administrator password to install?

Re:What OS X needs for better security

[wka]

Even after showing name and password fields, the name of the last user who logged in is displayed by default in the username field. This tool from Apple allows you to turn this behavior off.

Re:What OS X needs for better security

[softsign]

What? I should hope that any install which adds or changes system-wide libraries requires an admin password. Applications that are a self-contained bundle (e.g. Mozilla) don't require any password (or even installer) because an admin user is in group 'admin' and is allowed to write to /Applications for example.

The reason IE requires a password to install is because it makes changes to directories that a regular user doesn't have permission to change . This is a good practice. Otherwise, what's to stop some dumbass from tearing out critical config files or libraries?

Re:What OS X needs for better security

[EccentricAnomaly]

But why does IE need to change system-wide libraries?? It's just a web browser! There's no good reason for a web browser to mess with my system libraries. Just look at Omniweb, it plays nice.

Good OS X apps put everything in their own ".app" directory so you can install and uninstall the app easily.

You don't even need to be in the admin group to install software on OS X... You can create an "~/Applications" directory in your user directory and install software there. Well written apps function just as well from ~/Applications as /Applications.

Re:What OS X needs for better security

[EccentricAnomaly]

I should clarify... I don't mean that installers should access these directories and file without asking for the administrator password, I mean that installers shouldn't access these directories at all. 90% of OS X installers that ask for an admin password shouldn't be doing whatever they are doing that needs the admin password.

If there's a danger of regular user mucking up some critical config file or library why should so many installers be messing with these config files and libraries??

Re:What OS X needs for better security

[Anonymous Coward]

regarding 8 character passwords, that should be easy to fix. But regardless, it's pretty insignificant. Guessing passwords is not a very common way for an intruder to gain access to a machine.. It's just too much of a pain.

Checking for good passwords, password expiration - Not a bad idea.. It's possible now, just not through the gui:(

Letting user login with full name - Not really important, it only works locally anyway.

Let the user turn off the 'helpful feature that puts the last user's name in the login screen - Not very important either, but more options never hurt.

You can disable the list of users at the login screen already, the web server is disabled by default.

Re:What OS X needs for better security

[softsign]

I agree 100%. A well-behaved OS X app should be self-contained, write its prefs to ~/Library/Preferences, etc, etc...

I think the reason IE doesn't do this is laziness on the part of the developers... It's an app ported (carbonized) from OS 9. OS 9 apps had free reign to run roughshod over the directory tree. It was (and is) bad practice, but there was nothing stopping you. They just haven't bothered to make it self-contained for whatever reason.

Re:What OS X needs for better security

[tbmaddux]

I don't like password expiration. I have a good unique password for each machine already, never been guessed, why change it unless my machine has been compromised? Password expiration is a bad idea that encourages people to make bad password choices since their new passwords are harder to remember.

Great point about removing the last-person-who-logged-in listing. When I logout, I'm almost never the next person to log back in! Why would I logout if I were? Get rid of that.

Web servers -- Apache is installed by default, but disabled, and only admins can turn it on (presumably admins can be trusted not to screw up, security-wise).

An improvement I'd like: MacOS X has ipfw built-in but disabled, and while apps like Brickhouse are out there to interface with it, I'd like to see a built in OS tool. Maybe in Jaguar? And where's my built in GPG/PGP with GUI? This is Apple, right? Gimme my GUI!

Re:What OS X needs for better security

[Alex Thorpe]

Password expiration? Having to change each month, without reusing any passwords? Uh-uh, not on MY home machine! Perhaps as an option that's off by default.

Re:What OS X needs for better security

[Anonymous Coward]

Sorry for the anonymous login. I have too many web accounts to remember now as it is. A few issues to address in this post though:

longer than 8 character passwords

--As I understand it this is more of a Unix/Linux limitation than an Apple one.

* checking for good passwords, password expiration, etc.

--This is a great idea, but should be an option for administrators to select. Not your garden variety user.

* let the user turn off the option where you can login with "John Doe" instead of your username

--Not sure what your talking about here, unless you mean the Other User option. Which I find very helpful on machines where root access needs to be enabled for one reason or another. Also, this is off by default, but can be turned on in the Prefs.

* let the user turn off the 'helpful' feature that puts the last user's name on the login screen

--This can be turned off via the shell, but an administrator tool to do this would be nice.

* put a checkbox in the installation process to install a system with maximum security options... stuff like no list of users on the login screen and no web server installed at all, etc.

--Apple took security very seriously with OS X. I remember my Apple Systems Engineer selling very highly the fact that OS X shipped with only five ports open. As for Apache, it is off by default. Unless you switch it on, it won't come on by itself. Also, list of users can be turned off in the Prefs.

OS X is high security, right out of the box.

Re:What OS X needs for better security

[dbrutus]

http://www.sente.ch/software/GPGMail/ is probably your best front end for GPG right now. Given the limitations of encryption in various countries, I would guess that GPG would not be available in the default install until a lot more countries get their act together and remove encryption restrictions.

Then again, I'd be much more interested in a Fink GUI (which would get me GPG et al) first.

Re:What OS X needs for better security

[ranger8x]

Passwords that need to be reset after a certain time certainly have thier uses... in a busy office for example, but for the average home user, this will cause confusion, and forgotten passwords. or, to remember what this week's password is, people will end up writing on a post-it and sticking it to the monitor. that negates any security benefits it might have had.

Re:What OS X needs for better security

[usr122122121]

Then again, I'd be much more interested in a Fink GUI (which would get me GPG et al) first.

Check out FinkCommander, It has gotten rave reviews.

No affiliation, just observation.

Re:What OS X needs for better security

[Anonymous Coward]

Why does changing passwords every month or two make a system more secure. Isn't it better to choose a good password in the first place than requiring them to change it all the time? Constant changing of passwords essentially requires the user to make weak passwords in order to remember them, IMHO.

Re:What OS X needs for better security

[Johnny Mnemonic]

* let the user turn off the option where you can login with "John Doe" instead of your username
--Not sure what your talking about here, unless you mean the Other User option. Which I find very helpful on machines where root access needs to be enabled for one reason or another. Also, this is off by default, but can be turned on in the Prefs.

I'm pretty sure that he means disabling the use of "Steve Jobs" as a login, instead of the Unix-y name "sjobs". I don't particularly see this as a useful security feature; I suppose it gives you one less chance to guess the right answer--you may know your targets full name, but you may not know if they've chosen 'stevej' or 'sjobs'. Whatever.

* let the user turn off the 'helpful' feature that puts the last user's name on the login screen --This can be turned off via the shell, but an administrator tool to do this would be nice.

Noted above by others, but I'll note it again since I also dislike it: there's a utility to do just this located in kBase 106691. Basically just a script to flip a bit you can also access from the term.

* put a checkbox in the installation process to install a system with maximum security options... stuff like no list of users on the login screen and no web server installed at all, etc

Finally, you can be quite a bit more secure by installing without the BSD tools installed. I dunno if this installs Apache, but it would disable all command line tools. I'm only speculating about that, actually, as I have never done an install like that--as a matter of fact, I rush right out to install the dev tools as soon as possible. But the security minded may want to try it.

Re:What OS X needs for better security

[foniksonik]

You also have the option of declining an install. Any app that requests admin auth can be declined by virtue of the process.

Don't like IE?... use Mozilla! which so far has got to be the best user experience in a browser I've ever had (flash performance or lack thereof not being a big issue... try Chimera's latest builds if you want to see Windows speed flash on OS X).

Re:What OS X needs for better security

[stripes]

Finally, you can be quite a bit more secure by installing without the BSD tools installed. I dunno if this installs Apache, but it would disable all command line tools. I'm only speculating about that, actually, as I have never done an install like that--as a matter of fact, I rush right out to install the dev tools as soon as possible. But the security minded may want to try it.

I assume you mean stuff like the shell, cp, and mv? You can't really not have those. Some of the GUI stuff could in theory depend on it...and in particular one does.

The apple "package" installer (which is actually pretty good!) will look for several "scripts" during the install, and run them. They are almost always shell scripts, and need the fileutils. Go look at your package reciepts and poke around, you can see some examples. I don't know if any use perl or not, but...

The normal boot process may well also need them.

Re:What OS X needs for better security

[EccentricAnomaly]

put a checkbox in the installation process to install a system with maximum security options... stuff like no list of users on the login screen and no web server installed at all, etc.

I should clarify here... I mean give the guy administering a group of machines a simple little checkbox that doesn't even install Apache rather than just disabling it. This is so that a user with administrator password doesn't turn on the web server by clicking the "enable web sharing" box but has to do a little bit of extra work so as to ensure that the user really knows what they are doing.

And I'd like to be able to set a checkbox at instillation time that locks down all of the little things that you have to remember to lock down after the install, like disabling the list of the users on a system.

Perhaps, the best way to do this stuff is just have the sysadmins burn their own CD with their own custom OS X install.

Also, i'm not talking about security options for the average home user. I think Apple has great security for home users. I'm talking about stuff that you want for macs running at atomicsecrets.gov.

Re:What OS X needs for better security

[crooksm]

Even 'mere' 8 character passwords are beyond the current ability of a brute force attack. Assuming the user keeps to upper/lower case characters (no special characters) there are still 52*52*52*etc, 53,459,728,531,456 possible combinations.

Re:I submit this post...

[Anonymous Coward]

Use the Preview Button! Check those URLs! Don't forget the http://!

Dear Apple

[Anonymous Coward]

Dear Apple,

I ama homosexual. I boughtan Apple computer because of its well earned reputation for being "the" gay computer. Since I have become an Apple owner, I have been exposed to a whole new world of gay friends. It is really a pleasure to meet and compute with other homos such as myself. I plan on using my new Apple computer as a way to entice and recruit young schoolboys into the homosexual lifestyle; it would be so helpful if you could produce more software which would appeal to young boys. Thanks in advance.

with much gayness,

Father Randy O'Day, S.J.

Re:Dear Apple

[Anonymous Coward]

You need a nintendo and rum laced Twinkies.

Apple security will be hurt by lazy users

[Anonymous Coward]

Many apple users I know off do not upgrade any software at all. I predict that they will be wiped out by a nasty exploit and wonder what has hit them.
I foresee the end of Apple and the golden age of Microsoft.

Re:Apple security will be hurt by lazy users

[Anonymous Coward]

I'm not a fucking troll arsehole. Just a man who can see the future.

Re:Apple security will be hurt by lazy users

[Anonymous Coward]

You may want to examine the `Software Update' program under OS X at some point in time.

foad kthx.

Re:Apple security will be hurt by lazy users

[Anonymous Coward]

That and the fact that virii for the Mac OS are even more rare than a reliable MS product. In fact, last time I checked there were no known OS X virii.

Re:Apple security will be hurt by lazy users

[ScottKin]

Well - since OS X is built on Darwin...which is built from FreeBSD...every FreeBSD liability is automatically included FOR FREE (as in "no-cost-to-the-consumer") by Apple!!

How nice of them to do that for you - but of course, no *nix-lover ever wants any of the "unwashed & unblessed" Windows users to think that *nix is not secure by default - it's their "digital playtime" to patch their *nix OS; in fact, it's almost a game for them to keep up-to-date with the latest patches on top of providing *nix SysAdmins with job security.

Purely Amazing!

ScottKin

Apple and the upgrade exploit

[theolein]

If Apple wants their computer and OS to pass the testing I think they should get the upgrade vulnerability patched pretty soon.