Slashdot Mirror
PC Mag - Mac OS X Insecure
Suki writes "In this recent story a PC Mag writer concludes that "Panther and Jaguar were not better at outrunning vulnerabilities than Windows" and as my personal fav. ends by asking "How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here." The article discusses many previous Windows security holes against a recent Mac OS X security flaw."
It sounds like this is just the same "Flaw" in OSX's DHCP settup. There was a thread on this earlier. They essentially use a server to assign a number of items as well as IP. If I reacall correctly, this was never that big of a security flaw (at least not moreso than any other standard DHCP setup)
This is just some guy on a soapbox blabering on about how this "flaw" proves that OSX is just as bad as any Microsoft product. Hopefully others can see past this guy's rhetoric.
There should be a moderation category "Dumbest Comment EVER"
... that you don't put your email in your attribution or anywhere in the article.. Luckily, thanks to Google, your bio reveals your email to be:
Lance_Ulanoff@ziffdavis.com
Share and enjoy!
If you don't use a DHCP / LDAP server then its recommended that you turn it off.
This is from the apple site:
You don't use a directory service
lol yes silly ac, but the first rule of computer secutity is that if the "bad guy" has physical access to the machine, the game's over. The "good guys" lose, and the "bad guys" win.
If I've used my 1337 cat-burgular skills to break into Exodus, and actually have access to the machine itself; I'm not going to waste time useing my 1337 hacking skills or my (presumably) equally-1337 CD of hacking tools. I'll simply crack open the machine, rip out the drive, take it home, and read the data I want at my leisure.
cya,
john
Imagine all the people...
"Actually to be fair, you don't run as the administrator account in XP by default."
As others have noted, yes, you do. The main user you are asked to create when you setup a machine is an admin, and that is the account that most home users use.
dmiessler.com -- grep understanding knowledge
Meanwhile, we can already see what happens when Apple has a broadly popular product that cuts across platforms. The Apple iPod is the number one MP3 player, and now that its companion computer utility, iTunes, is available for both the Mac and the PC, it has become a hack target. In fact, Jon Lech Johansen, the same Norwegian who cracked the DVD security code, recently circumvented the iTunes music protection scheme.
An event like that occurring makes sense to me, since iTunes' popularity makes it a target worth hacking -- and whatever mystical Mac mojo there may be, it didn't go far in protecting a popular Apple product.Steve Jobs stated when the iTunes music store was announced that the DRM would be hacked. The point was to provide a DRM solution that was not restrictive to honest users. That was delivered.
His email address: Lance_Ulanoff@ziffdavis.com
His brief bio here
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
I could be wrong on this, but I believe home doesn't even ask you to set up a user. It just sets up Administrator as the default account, with no password. I should know for sure, but it's been 6 weeks or so since I did a Home install, but at any rate I think that's how it works.
"Windows Me offers tremendous reliability and stability improvements..." -- Paul Thurott
No power user account in XP home, either they can do everything (administrator) or nothing (user).
Jaysyn
There is a war going on for your mind.
AFAIK, Joe Blow can write to / on a new 10.2 install. This is madness.
/etc/hosts >> /hosts.txt
/dev/null to /bin/bash (or whatever). apparently somebody at apple actually thought about security BEFORE they shipped the product. evn if yo install any application, the best you can do is install it into ~/Applications. if you want to install it into /Applications, then it asks for a admin user AND a password. make shit up in chat rooms. not /.
then, apparently, you don't know jack. you absolutely cannot write to / unless you (and follow this carefully):
1) open up a terminal
2) type sudo
3) then type say: cat
4) type password
you my friend, are full of shit. now, if like me, you create another user, which i always run at, then i have to open the term, su to an admin user, then sudo. osx turns off root by default. to enable it, you have to go into net info, and specifically enable root, THEN, you have to change it's terminal from
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
Actually, Power Users can do almost everything an Admin can do. They can't create Admin accounts, and they can install most programs. A nice reference table comparing accounts is at http://www.bc.edu/offices/help/meta-elements/doc/a rticles/html/SW-WinXPUserAccounts.shtml
Wrong. Windows is easier to write viruses for. You simply have to get someone to open an email message in Outlook, and a virus will automatically spread itself. If you wrote a virus for Mac OS (or linux, or any other OS), it would have to convince every person it was sent to, not only to open the email message but to intentionally run it. There's where the problem with Windows lies, and why no other OS is as virus-prone as Windows.
Anyone notice this?
Please, please, tell me that he's not trying to convince us of his "Apple cred" by noting that the last time he used a Mac in a serious capacity was ten years ago?
Bryan Chaffin from The Mac Observer goes into some of the points mentioned in the original article: The Back Page: PC Apologist Asks If We Mac Users Are Now Humble
One interesting point made is that those who say that Mac OS X suffers fewer security and virus problems than Windows only because there are fewer Mac users just don't have a leg to stand on.
"HAHAHAHAH!! Mac OS X isn't perfect! Duh, I'm so smart!"
Is this guy for real? How does a vulnerability which involves an attacker having to break into your home network (much less a corporate one), take over a machine and then set it up as a rogue DHCP server anywhere near equivalent to something like Blaster, which spread automatically, with no machine spoofing required? Honestly, if your network is so utterly open to attack that it's a trivial task to spoof a DHCP server, there are bigger problems than OS X's security flaw there.
The claim that Mac OS X would have more viruses if it was more popular holds some merit, but it says nothing about the lethality of those viruses. OS X has all sharing network services off by default, unlike Windows, shutting down a large avenue for virus propagation. Mail shows the entire file name of an attachment, preventing attackers from hiding extensions. Mail also does not automatically execute attachments. Furthermore, any application wishing to do anything as administrator has to ask for a password by default, and root is disabled by default. This is not the case in Windows, where tales of administrator accounts with blank passwords abound. While there may be more attempts at writing viruses for OS X if it was more popular, far fewer of them would actually reach the scale of damage that things like Blaster did. Windows is an ideal virus propagation platform not just because it's popular, but more importantly, because it's default setup is insecure as well.
Control panel -> Administrative Tools -> services. easy as pie. That's not to say that the average windows user has a clue what a service is, let alone how to turn it off. The problem is that unnecessary services are on by default. But, hey, it's the age old compromise; out of the box simplicity vs. configurability.
Sure, unless you happen to turn off the RPC service, in which case the services panel will no longer work! Classic MS incestuous garbage; in order to use the GUI to enable/disable services you must have the (formerly horribly insecure) Remote Procedure Call service running!
How does a default setting regarding a specific directory's permissions plus the fact it doesn't use /etc/passwd make it "unfit for production"?
/etc. That's just how it works. It uses the NetInfo database. This is one of the few actually well-documented parts of OS X. /etc is a vestigial limb, it's a dummy file which is involved in startup but it is not actually used for real user info. It's used in single user mode because single user mode is an emergency startup mode used for debugging, and NetInfo doesn't launch in this mode unless you launch it, because part of the single user mode's hypothetical purpose is to debug problems with NetInfo!
OS X doesn't use
You might as well call Linux unfit for production because you can do some potentially nasty security-related things in some versions of Lilo.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts