Slashdot Mirror
PC Mag - Mac OS X Insecure
Suki writes "In this recent story a PC Mag writer concludes that "Panther and Jaguar were not better at outrunning vulnerabilities than Windows" and as my personal fav. ends by asking "How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here." The article discusses many previous Windows security holes against a recent Mac OS X security flaw."
He raises good points (I actually read the article), but one thing that OSX will always have over current versions of Windows, however, is the fact that in OSX you don't run as root/admin by default when you start off or create new users.
Until this is fixed, the same attacks will be much more effective against Windows users just because of the rights the current user has on the box.
dmiessler.com -- grep understanding knowledge
and a known patch is on the way. it's a very easy vulnerability to avoid. there's no virus yet...
was it worth the rant, or has he just been waiting a long time to make it?
Creationists are a lot like zombies. Slow, but powerful and numerous. And they all want to eat our brains.
He's basically saying that since there was one widely-reported Mac security hole, Macs are as insecure as Windows? Odd comparison.
Mind you, I'm not too overwhelmed with his research; if he'd been paying attention, he'd have caught the SSH vulnerability the other month. It's not like Macs have been immune, and nobody with any clue claims they are.
What you can claim accurately is that Apple fixes holes promptly and fairly quickly, and that the MacOS X architecture does not have flaws which result in two or three active IE holes in the wild right now.
Apple isn't perfect, they're just pretty good. Microsoft isn't evil, they're just not as good as they should be. It's perfectly reasonable to use those two facts in making one's security decisions.
Can someone tell him that HIS WEBSITE IS NOT A BLOG, OTHERWISE HE WOULD BE INUNDATED WITH REPLIES!!!!
Thank you. ;-)
I'm a leaf on the wind. Watch how I soar.
It's pretty sad when Windows-users feel they have to start defending themselves by pointing out that other operating systems are vulnerable too. The last paragraph pretty much says all in that regard...
But the mindlessly superior retort is always the same, "No, it's because the Apple OS does not have the same holes as Windows. OS X is just a better operating system."
Whatever. All OSes have their inherent problems, but next month, when Microsoft racks up another suit of deathly insecure vulnerabilities, OS X will probably be fixed and free from defects for another couple of months.
I'm not a Mac fanatic, but it's because OS X is based on Unix, and Unix is more elegant in its design that gives OS X its better security.
Ruby on Rails Screencast
Mac OS X gets one flaw and it's suddenly on par with the truckload of Windows security problems? What a funny little man...
The hole he's referring to requires some particular circumstances before it's even viable.
The attacker must:
Be on your local network
Already have control of your DHCP server
If both of the above are true, you already have much more serious problems.
While I agree that remote root/admin is bad juju, in this case it's hardly equivalent to the Windows remote admin exploits to which he's comparing it.
First, let's get the obvious stuff out of the way. THIS VULNERABILITY IS NOT ON BY DEFAULT ON OSX! You have to go into an obscure app (Directory Access) that most users don't know about, and turn on an option that most users don't need, in order to be vulnerable. Also, this vulnerability was never exploited.
How can this idiot compare that to the hundreds of millions of computers ACTUALLY INFECTED by Windows vulnerabilities like Nimda, Code Red, Melissa, Klez, Sobig.f, and thousands of others? Using Windows is like buying random illegal drugs on the street to treat a headache.
The MacOS is not without its flaws, but Windows is the swiss cheese of the secure computing world. It's very telling that the author didn't allow for any feedback or provide his email address.
- Vincit qui patitur.
I do the majority of my computing work on my TI-92. Havn't had a virus yet!
paintball
> a recent OS X security flaw
That's the significant word, I think. A single one
They will never know the simple pleasure of a monkey knife fight
We do not want to encourage behavior like this, do we? Reading the article, sheesh, what's next, checking for duplicates before posting?
Sigs for Nerds. Sigs that Matter.
The earlier slashdot story is here: http://apple.slashdot.org/article.pl?sid=03/11/28/ 2226226&mode=thread&tid=126&tid=172&tid=179&tid=18 5&tid=190
Dave Schroeder writes, "This isn't so much of a root vulnerability as a default configuration that trusts the integrity of the local network services. This functionality has been around since NeXTSTEP, and is designed to allow for auto-configuration of new servers/machines brought into the network."
There should be a moderation category "Dumbest Comment EVER"
... that you don't put your email in your attribution or anywhere in the article.. Luckily, thanks to Google, your bio reveals your email to be:
Lance_Ulanoff@ziffdavis.com
Share and enjoy!
So an attacker who can gain access to your network -- over a wired connection or wirelessly -- can trick an affected system into trusting a rogue machine, and when the compromised machine reboots, take it over and even attack other systems on the network.
So, a guy has to get on my network, set up another machine as a trusted server, wait for me to reboot, and then...? Is this a fair comparison to email viruses, etc...?
My cube's been up for 90 days. I plan to take it down and upgrade it eventually. Does this mean I'm going to be vulnerable?
Whatever.
-- The world is watching America, and America is watching TV.
It's about time Apple did something about the POS security in OS X!
Obliteracy: Words with explosions
I can feel a big commentary fight coming on this post :)
Pro-MACs on my left, pro-PCs on my right.
I think Rush Limbaugh might take offense at being placed on the Left.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
That's the sound of no one caring what you think, Lance.
A series of what ifs, followed by the reaction of imaginary mac fields that exist only in Lance's head.
And the whole "Macs don't suffer viruses because there's so few" myth was dead and buried long ago. Sheesh. Who cares? If Lance is happy with his bloated, cheerless, abominable bugfest of an OS, more power to him.
And now, Obligatory Car Analogy: it's like Lance is sitting by the side of the road with his Chevy Vega that just flew to pieces for the fifth time that week, and he's pointing at the Lexus that just sped by because it had a defective radio knob that just fell off.
--- Ban humanity.
Excellent comments. Please post them in our forum:
s p,
http://discuss.pcmag.com/pcmag/start/?msg=32413
-----Original Message-----
From: ***
Sent: Thursday, December 11, 2003 10:24 AM
To: Ulanoff, Lance
Subject: Eureka
Hello.
in your piece at http://www.pcmag.com/article2/0,4149,1408953,00.a
you have this to say in conclusion:
Ultimately, those on the Mac fringe have to face facts: Panther and Jaguar were not better at outrunning vulnerabilities than Windows. I expect other gaps will emerge, and while the Mac OS may still draw far fewer attacks, this discovery might suck a little wind (or is it Windows?) out of Mac radicals' sails. They can scarcely claim this was a minor hole. OS root access is serious stuff. How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here.
So, that's all it takes for you? One potentially serious loophole in an
OS to declare it "no better at outrunning vulnerabilities than
windows"?
Have you recently counted the number of Cert advisory reports that have
come out for XP? Last I checked, more than a month ago, it was in the
40-some range. For XP alone. This year only. For the past few weeks,
those reports have come in bundles of 3-to-5 at a time. Nearly every
other week.
While gaining root access is serious on a Unix machine, you also need
to point out the fact that to be able to gain access to this loophole,
you absolutely need to be on the same subnet as the compromised
computer. Therefore shielding 60%-some percent of home Mac installation
(as those connect to the interner through some phone connection like
PPP) and a great deal (don't have numbers) of the remaining 40% still
not at risk, provided their Cable or ISDN, [A]DSL ISPs have done their
work properly.
It's not like one could attack the entire machine simply by sending an
email containing some VBL script. Right?
Of course I'm a Mac head. And I'm still as cocky as I've been since
roughly 1988. Because every time I see those IT folks around here
struggling to keep the company running when the next wave of Win
trouble appears, I'll be smiling at my desk, uninterrupted, and
occasionally offering to help (okay... I'm just pointing them to some
Linux site or Apple.com... but hey... I seriously believe that would
help
them).
Keep us entertained.
Have a good day.
- Number of Macs reported/suspected to be cracked by recent vulnerabilities: ZERO
- Number of Windows PCs known to be cracked by recent vulnerabilities: MILLIONS
So... I'm feeling pretty damn cocky, thanks for asking.Sorry, but this is nonsense. UNIX *is* more secure than Windows, but Windows was *designed* with more security in mind. UNIX comes from an academic background where loose and free access is the norm (or was in the 70s). All of the security trappings are post-hoc.
Now if you want to say that UNIX's technical excellence is demonstrated by the fact that even security being a crude add-on, it's still superior to Windows' baked-in attempts, then you would of course be right. But UNIX was never designed for security from the ground up...
Advice: on VPS providers
I've been a Mac user for four years now, but I still regularly use Windows and occasionally Linux. To me, Mr. Ulanoff seems to embody the worst type of Mac user - the cynical ex-user. All the Mac users I've talked to aren't snobby or "elite" but almost every single ex-mac user is. It's almost like they were upset that they had to leave MacOS and now all they do is spit insults at anyone who thinks that Macs are cool.
I feel bad for anyone who feels the need to put a group of users down simply due to their choice in tools. That goes for the "Mac elite" that Mr. Ulanoff has to deal with as well.
You can find a better article about the OS X vs. Windows with respect to viruses here.
I have never been able to shake my perception of PC Magazine/ZD as just a shill for their biggest advertisers. Just ask yourself: Who butters their bread?
I understand that a lot of you here on Slashdot are new to the Mac (since OS X) but those of us who have been on Macs for longer recognize this type of junk tech writing for exactly what it is: an attempt to stir the shit and increase readership. It's probably easier to sell advertising on your site or magazine if you can create just the right anti-Mac tempest in a teapot and sell a few more copies or increase your web site hits. This tactic used to run under the headline "Apple going out of business" or "Apple to close up." Now that's mutated into a "critique" of security or speed claims or whatever. Sadly, there is a fraction of Mac users out there who are still willing to take this bait and play into the game. I'm not even looking at the article. Been there, done that. I recommend that you stare out the window and observe the slow but steady growth of the grass outside--that would be far more productive that playing into this kind of shameless, professional trolling masquerading as tech reporting.
--Rick "If it isn't broken, take it apart and find out why."
Wrong. There is something to be said for how security is considered in the design of an OS. For Windows, it wasn't much of a consideration, which contributed heavily to why there have been so many systemic vulnerabilities.
The system was designed to be user-friendly, not secure. They got their market-share because of that fact. I think it is much easier to make a secure system user-friendly than to make a user-friendly system secure. Microsoft is finding that out as well. You reap what you sow.
My beliefs do not require that you agree with them.
Notes From Under *nix: blas.phemo.us
Is being secure the same as security? Let us take a look and see. Starting out let us compare raw numbers.
Building A has one broken window, that is kind of small and can only be breached if you can get passed the outer gate (with its own security), and have the right (specialized) equipment.
Building B has many broken windows, and windows breaks as fast as they fix them. Many of the broken windows can be breached from down the street. The latest broken window could allow anyone to imitate building C, and only when you have entered the building do you realize that you have been duped into entering Goat's house of cx.
Which building is more secure?
The issue is that security is offered in LEVELS. No place is 100% secure, however some places offer much higher levels of security, providing a safer place to be.
So which building is more secure?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Meanwhile, we can already see what happens when Apple has a broadly popular product that cuts across platforms. The Apple iPod is the number one MP3 player, and now that its companion computer utility, iTunes, is available for both the Mac and the PC, it has become a hack target. In fact, Jon Lech Johansen, the same Norwegian who cracked the DVD security code, recently circumvented the iTunes music protection scheme.
An event like that occurring makes sense to me, since iTunes' popularity makes it a target worth hacking -- and whatever mystical Mac mojo there may be, it didn't go far in protecting a popular Apple product.Steve Jobs stated when the iTunes music store was announced that the DRM would be hacked. The point was to provide a DRM solution that was not restrictive to honest users. That was delivered.
His email address: Lance_Ulanoff@ziffdavis.com
His brief bio here
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Pro-MACs on my left, pro-PCs on my right.
I'm Stuck in the Middle with you.
Yes I'm stuck in the middle with Linux.
Overheard whispers: "He's not going do it" "Yes, he is - you didn't see last months rant against one button mice?" "I dare you" "I bet his ethernet cables not plugged in" "It's been a pleasure working with you" "I knew he was an idiot, but nobody's that dumb" "Didn't his last article get taken out by the Melissa virus?"
How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here.
I think you can add Lance Ulanoff to the list of things that are "insecure".
Quick, send him an Outlook virus!
I think I already did.
The ______ Agenda
AFAIK, Joe Blow can write to / on a new 10.2 install. This is madness.
/etc/hosts >> /hosts.txt
/dev/null to /bin/bash (or whatever). apparently somebody at apple actually thought about security BEFORE they shipped the product. evn if yo install any application, the best you can do is install it into ~/Applications. if you want to install it into /Applications, then it asks for a admin user AND a password. make shit up in chat rooms. not /.
then, apparently, you don't know jack. you absolutely cannot write to / unless you (and follow this carefully):
1) open up a terminal
2) type sudo
3) then type say: cat
4) type password
you my friend, are full of shit. now, if like me, you create another user, which i always run at, then i have to open the term, su to an admin user, then sudo. osx turns off root by default. to enable it, you have to go into net info, and specifically enable root, THEN, you have to change it's terminal from
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
No, he's doing the reasonable Mac observance that 50 versions of a greeting card program does not count.
You can tell a great deal about the character of a man by observing those who hate him.
Then you can go here to discuss what a steaming load this "commentary" is. Oh, my gosh. Someone who already has access to your network can put a malicious machine on it that will lead to your Mac being owned when it reboots. That's so freakin' simple. Not like those astonishingly difficult Windows attacks of sending emails, setting up websites and/or having users download spyware. The sky is obviously falling. AAAAAHHHHHHH!
Personally I would not have made that choice, but at least there was check box to turn off the default DNS trust. If only windows came with checkboxes to remove its bugs. And I dont mean like checkboxes that say "turn off scripting and cripple my browser please".
In fact mac has not even fixed the so-called hole because its not neccessarily a mistake.
In any case the SSH vulnerability, and the screen-locker vulnerability were in fact true holes created by mistakes. These are what should be scrutinized. But these did not lead to widesperead network worms at least. they did not arrise out of a insecure by desing attitude that pervades all the Active-X philosopy, the power-user-by-default philosophy, the standards crushing embrace-and-extend, the optional log-in password philosophy, or the add features rather than fix bugs philosophy that rightfully inspires all the anti-windows zealotry.
Some drink at the fountain of knowledge. Others just gargle.
Shouldn't that be:
Stuck in the middle with GNU..?
"How cocky are you feeling now, Mac elite?"....Aha! At least they are now recognising that we are an elite! ;-)
"This is crazy, you realise we could all go to jail for this?" - my manager, somewhere I used to work.
Anyone notice this?
Please, please, tell me that he's not trying to convince us of his "Apple cred" by noting that the last time he used a Mac in a serious capacity was ten years ago?
OSX has the out of box simplicity edge while still having all these services off?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Bryan Chaffin from The Mac Observer goes into some of the points mentioned in the original article: The Back Page: PC Apologist Asks If We Mac Users Are Now Humble
One interesting point made is that those who say that Mac OS X suffers fewer security and virus problems than Windows only because there are fewer Mac users just don't have a leg to stand on.
After reading the article, I bave two things to say:
1. These aren't exactly easily exploitable remote root's like windows has had 50 of. There really is no comparison.
2. Installing XP yesterday, I was r00ted before I could get to Windows Update. This is just. plain. ridiculous.
I don't know about you guys, but there really is no question of what OS to use if you really want it to work right, be stable, and be secure. NO QUESTION. "usability" is close enough in Linux for me. AND ISN'T A VIRUS EVERY FIFTEEN MINUTES SOME SORT OF USABILITY PROBLEM?>??
Who is this Anonymous Coward character, how does he post so much, and why is he always such a whore?
Unix is more elegant, but the fact that it grew up together with the Internet as a networked OS. This was not an afterthought. Neither was multiple users and security. When you work with something long enough, it becomes second nature and solid and secure. How did Windows start out? Single user. No Internet. No concept of services/daemons. You machine was its own little island. It was all about the single user GUI in the office to do one task.
And anyway, if XP is so secure, why are they scrapping it for a complete new rewrite - again? It's because it can't be fixed and it has more security leaks than a seive. Microsoft has tried and tried to reshape the Internet into what they want it to be and, thank god, it's failing. And in a way so stupendous that now those that get sacked regularly gotta go off and complain about it. Well boo hoo to them. I've never experienced a virus or worm on OS X or Linux/Unix and I don't suppose I will be anytime soon. There's a reason for that and m$ still doesn't get it.
A bug in Windows 3.1 and forward allows a malicious attacker with access to the local network to hijack your machine and run any program he wants on the users machine.
The attack goes like this:
He sets up a DHCP server
Feeeds computers booting with fake IPs for DNS and WINS servers.
Redirects the NETLOGON server shares to a share under his control. Makes sure the login script runs his software.
It is thus recommended that all Windows users, especially coorporate users, disables DHCP in the TCP/IP settings, until Microsoft starts shippign support for DHCPS - which is DHCP over SSL/TLS.
It is important to do this, since if only some users does it, it might be difficult for thew machines to connect to each other.
"HAHAHAHAH!! Mac OS X isn't perfect! Duh, I'm so smart!"
Is this guy for real? How does a vulnerability which involves an attacker having to break into your home network (much less a corporate one), take over a machine and then set it up as a rogue DHCP server anywhere near equivalent to something like Blaster, which spread automatically, with no machine spoofing required? Honestly, if your network is so utterly open to attack that it's a trivial task to spoof a DHCP server, there are bigger problems than OS X's security flaw there.
The claim that Mac OS X would have more viruses if it was more popular holds some merit, but it says nothing about the lethality of those viruses. OS X has all sharing network services off by default, unlike Windows, shutting down a large avenue for virus propagation. Mail shows the entire file name of an attachment, preventing attackers from hiding extensions. Mail also does not automatically execute attachments. Furthermore, any application wishing to do anything as administrator has to ask for a password by default, and root is disabled by default. This is not the case in Windows, where tales of administrator accounts with blank passwords abound. While there may be more attempts at writing viruses for OS X if it was more popular, far fewer of them would actually reach the scale of damage that things like Blaster did. Windows is an ideal virus propagation platform not just because it's popular, but more importantly, because it's default setup is insecure as well.
I'll admit, right away, that I'm a Mac user. Then again, I'm also a Windows user, Linux user, SunOS user, etc. I'm really not *that* platform dependant. I guess I really don't understand the reasoning behind arguing over an OS. The argument is rather petty if you are not doing anything to improve upon the security of the operating system you favor. No OS is perfect, and no OS is totally secure.
I did find a few problems with the article (beside the fact that the author was bashing mac users who bash windows users...circular logic, anyone?). The author claimed that due to the fact that DVD Jon cracked quicktime encryption of ACC streams (used by the iTunes Music Store) doesn't mean it's going to bring either the MacOS or Windows to its knees. It's a f**king MP3 player for Chrissakes. Sure, vulnerability that could circumvent OS security might exist within iTunes, but the specific nature of DVD Jon's crack has nothing to do with OS security.
The author made this claim about the cross-platform iTunes "exploit" while failing to mention anything at all about Macros, and the possible for viruses that accompany them. To me, it seems that the author was grasping at straws without having any concrete evidence to back up his claims.
Whenever I read an article from one side of the OS wars bashing the other side, I tend to think that the author was in danger of missing his deadline and needed to come up with something in a hurry. Why does this issue never get old? Perhaps we should think about ways to make our OS of choice more secure rather than bashing others' flaws.
AgentOJ
But even back then, I had this gnawing suspicion that 18-month software development cycles could somehow hurt the platform. Before the tide really turned, however, I switched to PCs. I had joined PC Magazine, and the editorial staff used them.
That's the Mac's problem! He has nailed it! Apple develops new and vastly improved features (in the range of 150+) - basically an overhaul of the operating system - every 18 months. Rather than this whole OS X thing, they should have just created a new theme for OS 9 (oooh, maybe with Green highlights) and changed its name every so often...
If you can't taste the sarcasm, just smile and nod...
Disclaimer: This comment was generated by a Flock of Trained Microsoft Programmers for Aqua_Geek.
I have a router now - see, I can learn :)
Some people tell me I should set up an old PC to run Linux and configure that as a router, but they don't seem to understand that:
* That requires significant effort on my part
* My router is small (paperback book size)
* It doesn't make loads of noise and consume loads of power.
* When I occasionally get problems with my connection (about once every 2 months), whatever the problem, it's usually solved by toggling the router power switch, and takes a few seconds.
But you can't tell some people...