Slashdot Mirror
PC Mag - Mac OS X Insecure
Suki writes "In this recent story a PC Mag writer concludes that "Panther and Jaguar were not better at outrunning vulnerabilities than Windows" and as my personal fav. ends by asking "How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here." The article discusses many previous Windows security holes against a recent Mac OS X security flaw."
I can feel a big commentary fight coming on this post :)
Pro-MACs on my left, pro-PCs on my right.
Ready ?
FIGHT
Can someone tell him that HIS WEBSITE IS NOT A BLOG, OTHERWISE HE WOULD BE INUNDATED WITH REPLIES!!!!
Thank you. ;-)
I'm a leaf on the wind. Watch how I soar.
so I guess I am safe.
I do the majority of my computing work on my TI-92. Havn't had a virus yet!
paintball
We do not want to encourage behavior like this, do we? Reading the article, sheesh, what's next, checking for duplicates before posting?
Sigs for Nerds. Sigs that Matter.
It's about time Apple did something about the POS security in OS X!
Obliteracy: Words with explosions
That's the sound of no one caring what you think, Lance.
A series of what ifs, followed by the reaction of imaginary mac fields that exist only in Lance's head.
And the whole "Macs don't suffer viruses because there's so few" myth was dead and buried long ago. Sheesh. Who cares? If Lance is happy with his bloated, cheerless, abominable bugfest of an OS, more power to him.
And now, Obligatory Car Analogy: it's like Lance is sitting by the side of the road with his Chevy Vega that just flew to pieces for the fifth time that week, and he's pointing at the Lexus that just sped by because it had a defective radio knob that just fell off.
--- Ban humanity.
unless the patch from microsoft doesn't work again.
> My Mac never has never told anyone ILOVEYOU.
Poor thing. Perhaps you could get it another Mac to play with?
Yes -- this would have been nearly impossible to guess..
Roving Web-Teleoperated Robot
Holy crap! You mean that if some ass-taco gets physical access to my network and can set up a rogue DHCP server he'll be able to get root access to my Mac (unless of course I took the 5 minutes to read the technote article and disable all my unused directory services)?
Dammit! I'm gonna' go back to my OpenVMS box!
If what this guy really wants is absolute security right out of the box, I guess he'll have to do the same.
You are attempting to read sigs. Cancel or Allow?
An e-mail address! Quick, send him an Outlook virus!
Overheard whispers: "He's not going do it" "Yes, he is - you didn't see last months rant against one button mice?" "I dare you" "I bet his ethernet cables not plugged in" "It's been a pleasure working with you" "I knew he was an idiot, but nobody's that dumb" "Didn't his last article get taken out by the Melissa virus?"
How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here.
I think you can add Lance Ulanoff to the list of things that are "insecure".
Quick, send him an Outlook virus!
I think I already did.
The ______ Agenda
No, he's doing the reasonable Mac observance that 50 versions of a greeting card program does not count.
You can tell a great deal about the character of a man by observing those who hate him.
thanks for the supporting evidence. very convincing. I SAY the Doublemint Gum twins rule the world as part of a secret cabal that includes Cobra Commander and Billie Holiday.
"the starry sky above and the moral law within"-Kant
192.168.0.10
Because of the hundreds of holes in Windows some attacker can compromise a Windows server in the local subnet and then use it to spoof the DHCP servers to gain access to the Mac.
"How cocky are you feeling now, Mac elite?"....Aha! At least they are now recognising that we are an elite! ;-)
"This is crazy, you realise we could all go to jail for this?" - my manager, somewhere I used to work.
1. Notice flagging readership, reduced ad revenue
2. Write audacious, insupportable story that will anger people
3. Submit to Slashdot
4. Profit!
I'm using Windows...I don't feel like I have to defend myself...I'm not being attacked.
Umm... you are aware that this is Slashdot, right?
Overcaffeinated. Angry geeks.
You know I once found a user on my WI-FI hub. I was all exited untill I found out he was so rude as to not leave any shares open with mp3s in them. I disconected him after running a dict. atack. No share, good password, your off my net buddy.
No. The site appears to be Slashdot, and the URL above seems to point to slashdot.org, but this is really a hoax taking advantage of an Internet Explorer exploit allowing, through JavaScript, the location in the address bar to be spoofed.
A bug in Windows 3.1 and forward allows a malicious attacker with access to the local network to hijack your machine and run any program he wants on the users machine.
The attack goes like this:
He sets up a DHCP server
Feeeds computers booting with fake IPs for DNS and WINS servers.
Redirects the NETLOGON server shares to a share under his control. Makes sure the login script runs his software.
It is thus recommended that all Windows users, especially coorporate users, disables DHCP in the TCP/IP settings, until Microsoft starts shippign support for DHCPS - which is DHCP over SSL/TLS.
It is important to do this, since if only some users does it, it might be difficult for thew machines to connect to each other.
But even back then, I had this gnawing suspicion that 18-month software development cycles could somehow hurt the platform. Before the tide really turned, however, I switched to PCs. I had joined PC Magazine, and the editorial staff used them.
That's the Mac's problem! He has nailed it! Apple develops new and vastly improved features (in the range of 150+) - basically an overhaul of the operating system - every 18 months. Rather than this whole OS X thing, they should have just created a new theme for OS 9 (oooh, maybe with Green highlights) and changed its name every so often...
If you can't taste the sarcasm, just smile and nod...
Disclaimer: This comment was generated by a Flock of Trained Microsoft Programmers for Aqua_Geek.
in fact, it is easier because you can always use your MS Virus Creation Tool (R) and from there click on the check boxes and select the vulnerability you want to exploit.
When you think about it, there are probably hundreds of Macs connected to the Internet these days. Imagine the mess if all of them were compromised at once.
Why would one read about Macintosh, or for that matter any, news from PC Magazine. I don't consider it a valid source. Now I will go read it, maybe he cites a valid source.
We all know the mac has a huge security risk. It's a major issue. From now on OS X is as virus prone as XP. And Apple's DRM has been Hacked. People are pirating the iTMS as we speak.
;-)
And in other news, SCO really was attacked from outside by an evil DDOS. Those Open Source Commy Bastards.
Believe everything you read folks.
I think, therefore I am...I think.
Motion in the gloom of a side street catches your eye. You turn to see what it is. There, in the vomit and urine stench of a gutter, you see a form rising. You see the whites of someone'e eyes. The stench and filth turn your stomach but you stare transfixed. You think of calling an ambulance for the poor trashed bastard. There, it's a man! It's Bill Gates!
He points a finger and thunders with all of his might, "You are no better than I am!"
Friends don't help friends install M$ junk.
You can't ignore him. The Windows fanatics are all behind him! Both of them!
Kevin Gilhooly
Migrant Programmer
Well, I don't know what you've done to your system, but all I have to do is go to the 'go' menu and select 'go to folder' and then type in /etc. the GUI is protected only as far as the user's knowledge of the system.
/etc and changing the owner from system to me. The admin password to enable this is MY password, not root's.
:P
I can also easily change the owner of said folder by clicking onto column view and then viewing the info of
As I said earlier, the system is protected as far as the user's knowledge of the system. From the looks of things, your system is protected just fine.
In Soviet Russia, the monkey spanks you!
>Apple's response was that it doesn't happen in Panther, so just upgrade.
Those BASTARDS! How can you get any work done in Jaguar without this critical feature. I just can't believe that somebody inside Apple decided not to backport this.
*cough*
Jesus Christ.
Please also keep us posted on the progress of the bug whereby a 20" iMac cooled to nearly absolute zero incorrectly reports a temperature value of MAXINT. That one's really slowing me down at work and if they don't fix it soon I'm gonna have no choice but to switch back to Windows.
If you were a Linux user, this type of thing would be an old hat who was beaten to death.
I remember in the days of Win98. With every single Linux security story, the WinNuts would cry: "See! See! Linux is just as insecure as Windows!" They would even do this on stories about local compromises, yet Win98 has no local security whatsoever. No permissions. Nothing. It doesn't even keep track of which users own a file. And they'd still insist it overshadows all the Windows holes, which were in effect root level remote compromises.
I especially love when they'd play numbers games. They'd say Linux has twice as many vulnerabilities as Windows this month/year, yet if one would actually look at the reports, one would see the Linux ones weren't nearly as serious. Nearly all Windows ones would say something like "one packet from the internet will cause arbitrary code execution with admin rights." Yet the Linux "vulnerablilties" would be mostly obscure crap from packages almost no one uses. "Video game Boogerman3D will allow any user to change the high score list." Oh no! Some user might give himself a billion point high score...what do I do???
Welcome to the real world. Where a bunch of lusers try to point out the "inferiority" of your OS by claiming your relatively obscure and unimportant security flaws are much worse than glaring and suicidal ones.
Apple Magazine: PCs insecure
"And I for one welcome our new insect overlords."