Slashdot Mirror
Mac OS X Security Criticisms Countered
Paradox writes "In response to the recent PC Magazine story criticizing Mac OS X security, technologist/author Richard Forno has written a rebuttal criticizing the author and raising some good points about the fundamental differences between Windows and Mac OS X. Considering Lance Ulanoff's tone during his article, a rebuttal from the Mac OS X community was inevitable." Forno's conclusion: "Trustworthy computing must be more than a catchy marketing phrase. Ironically, despite a few hiccups along the way, it's becoming clear that Mac OS, not Windows, epitomizes Microsoft's new mantra of 'secure by design, default, and deployment'."
the bottom line is which are you going to trust anyway? the only computer that i would fully trust to protect my stuff would be a gentoo linux box custom made for a specific purpose. Self patching and very few applications installed for a person to take advantage of. the bottom line is though XP and Mac OSX may be "secure" they're not secure enough for anything important. (in my humble opinion.) I also work at a place where security is EVERYTHING so i guess i see it different... This pointless blathering about security shoudl convince no one of anything, especially when zealots are concerned.... I say use whatever works best for what you are doing. if you want REAL security, you shouldnt use either of those OS's
.....
.....
Contrary to his article, the small market segment held by Apple doesn't automatically make the Mac OS less vulnerable to attack or exploitation. Any competent security professional will tell you that "security through obscurity" - what Lance is referring to toward the end of his article - doesn't work. In other words, if, as he suggests, Mac OS was the dominant operating system, its users would still enjoy an inherently more secure and trustworthy computing environment even if the number of attacks against it increased. That's because unlike Windows, Mac OS was designed from the ground up with security in mind. Is it totally secure? Nothing will ever be totally secure. But when compared to Windows, Mac OS is proving to be a significantly more reliable and (exponentially) more secure computing environment for today's users, including this security professional.
As a rule, I treat everything that a 'technologist/author' says as worthless until they prove otherwise. It seems that 'technologist' is one of those titles that people attach to themselves when they don't posess any useful skills (to me, anyway).
As the parent said, this guys facts seem solid, but his attitude makes it difficult to take him seriously.
'I ain't a liar, baby, and I ain't proud I just want what I'm not allowed.' -- Violent Femmes, 36-24-36
... missed both UNIX and BSD.
Now what except the GUI is so specific to OS X that one may write an article related to security without at least touching the root(s).
CC.
TaijiQuan (Huang, 5 loosenings)
Are there any viruses/trojans for OS X?
I know there was the ssh deal a while back, but does anyone know of any remote r00ting of an OS X box anywhere?
The tone of the article has a lot to do with the assumption.
I mean, if I said, "I wish he'd just shut his mouth if he's not going to read the article," you can safely assume more malice there than if I said "He really should read the article before commenting," right?
I think Apple has shown the way Microsoft should follow if they wish to bring security and stability to the Windows platform. Apple migrated over to the underpinnings of BSD without compromising the distinctness that only Apple brings to the table. If Microsoft truly cared about "trustworthy computing," they'd shift their gears and concentrate on gluing the Windows GUI and other applications to whatever BSD platform they chose to annoint. After their acquisition last year (the VirtualPC crew), Microsoft has the talents necessary to bring decent emulation of older Windows flavors to their new products. But apparently they [Microsoft] are too stubborn for their own good. It sounds like Longhorn will now be delayed until 2006 or 2007, and every year they slip, the more people and institutions will slip away to Linux and OS X for the very ideal of "trustworthy computing" they profess. Windows is broken as an OS, but as a GUI "bundled" on top of BSD, it would prove to be the magic Microsoft's shareholders are now searching for. And since Microsoft has been infusing SCO with cash, Microsoft would be "safe" from any litigation from SCO in regard to BSD or Linux...
"Right now, somewhere in this world, Scott Baio is plowing a woman he doesn't love," - Peter Griffin, *Family Guy*
Umm... no. The problem of DLL hell is because programs (including Windows) all throw their DLLs into the winnt\system folder. New versions of DLLs overwrite old versions, files get left behind during uninstalls, etc. All this contributes to the long-standing problem of "DLL hell". Simply allowing multiple/separate copies in memory is something that all OSes (including Windows) have been able to do for many, many, many years.
Sorry bub, but it seems Microsoft pulled a fast one on you.
Javascript + Nintendo DSi = DSiCade
Snippets from the article: ..."system's FreeBSD foundation"... ..."the Unix-based Mac OS X system"... ..."not the same as the Unix 'root' account password"...
:)
and
and
You must be referring to the *original* article... the first makes no reference to BSD or UNIX. Based on that, I wholeheartedly agree with your assessment - I do not think that the original author had a real understanding of OS X, BSB, UINX, or for that matter, even Windows.
We would never actually read a serious article of this nature because any person that takes the time to do a security review of Windows would find so many holes they would never finish their article. And they'd probably have to write it twice. And it would be posted on the internet before they could publish it.*
*I may have exaggerated slightly on the last few points
The original "commentary" was not just chock full of factual errors, improper syllogisms, et. al. It was dripping with such a malice-filled glee at the notion that OS X might be as insecure as Windows that one has to wonder as to real root of the author's problems. He mentions how angered he is by the laughing of OS X users every time he has to deal with another Windows virus/trojan/bug. Are "commentaries" like his the sad, pathetic result of not working on an OS that "just works"?
I realize this is an oft-repeated truism, and obscurity alone doesn't make a system truly secure...but it certainly helps. To make an analogy, I know of many friends who have been robbed, even when their valuables were well-locked. However, those who put their valuables in places theives never think to look are generally the ones who keep them - good security is never perfect, and is generally at best a deterrent, at worst a challenge. Hell, security through obscurity is the whole basis for steganography, though most would recommend encryption as part of a "why not?" sort of preprocessing step.
As such, I think it's a given that Windows is at least less secure because of its market share. Whether Mac is more secure because of its obecurity is debatable - I'm sure there are a number of generic unix exploits that macs would suffer from, and the general unix community is very high profile.
-Looking for a job as a materials chemist or multivariat
Alright, just so I don't get dubbed Troll by any Mac Fan(atic)s out there - THIS IS NOT A DEFENSE OF THE WINDOWS OPERATING SYSTEM OR A COMPARISON BETWEEN THE MAC OS AND WINDOWS. If you read Lance's original article, it's not saying "Windows rule, Macs drool" on the basis of the security flaw he mentions. It's about something bigger, which is an underlying issue in the Mac community: fixation on image.
No serious, knowledgeable Mac user is going to sit down and tell you that "their" OS is descended from heaven, perfect and secure in every facet. Albeit, it's a LOT better than Windows, but it's got a couple issues of its own. But I know a lot of guys who bought Macs because "My old computer got a virus, and a guy told me Macs don't get viruses" or "I don't know anything about computers, but I want something that can't break." These guys need to read Lance's article because Macs CAN get viruses and do have the occasional security holes (though still nothing like Windows, but again THIS IS NOT A COMPARISON).
For the educated Mac user, Lance's article was "much ado about nothing." But there is a faction in the Mac community which claims that they know their OS is not invulnerable, but any criticism or discussion of a flaw results in personal attacks against the original author, their OS, their family, friends and pets, followed by an extensive feature-by-feature OS comparison. For these people, the security of the Mac OS has not been attacked; instead, their worth as individuals has been smeared (by means of their personal investment of self-worth in the Mac "image").
Long story short - I think the rebuttal was over the top and completely missed the point. But it nicely drew attention to a real problem: the Mac community needs to do something about the association of the Mac "image" with the identities of Mac users.
Sorry to cross-post (posted on previous discussion) but I'm lazy (and point still stands). Here's another rebuttal from me that uses no personal attacks or any of that crap:
/. and so seen by thousands) this paper shows up:
S X_ Shellcode_Assembly.pdf
/., not some backwater usenet), anyone could attack MacOSX boxes, *if* a vulnerability is discovered in it or in its running services.
Dear Mr. Ulanoff,
I am writing to you just to send you a couple of informative references on general computer security. I promise to stick to the basics, and I am sure you will dig deeper if interested.
One of the basics of remote exploits is the ability to -once a remote vulnerability is discovered-, send malicious code snippets that get executed with privileges on the target computer. For instance, they might be sent exploiting a buffer overflow bug or a flawed service left running on an open port.
This is well known in the MS Windows world and even Linux, as they commonly share the same underlying hardware architecture (namely x86). There is plenty of information on how to build such malicious code snippets (basically anyone knowledgeable in x86 assembler can do it) as well as pre-built apps and scripts to send them. This is well known. It is also well known that a vulnerability must be present for the code to be able to be executed at all.
It is a common myth that -by following this logic-, other platforms that are less used, like for example MacOSX (subject of a security article of your own), are more secure because technical knowledge about them is less common (eg. PPC assembler language) and are not so commonly used. One might think the malicious code needs to be built by real gurus, few in number, that have no interest in doing that.
*However*, doing a trivial search on Google (also published on
http://www.securiteam.com/securityreviews/PPC_O
Is a no-nonsense compilation of MacOSX PPC malicious payloads and the rationale behind them. After copy-pasting from it, anyone can do remote attacks on MacOSX, *provided* a vulnerability is actually found. No vulnerability, no attack. The paper requires a low level of technical knowledge and actually has little merit (apart from being somewhat clear and concise).
So, using information freely available, easily found, in common knowledge (published on
So it *cannot* be possibly said that MacOSX achieves its high level of security by obscurity. It accomplishes it by *design*.
It is really sad that the old argument of 'security by obscurity' is being raised over and over. Read that paper.
Mr. Ulanoff, I promised you two links and I have provided only one. The other is not actually a link but a reference. Just walk to your nearest technical bookstore or Computer Science library, look for the PPC assembly and architecture books that have been publicily available for years. My cheapo college library has them, yours surely has.
I am looking forward to further informed security articles by you. Please do not hesitate to mail me should you need further references on this or any other technical question.
Best regards,
xxxxxxx
Ironically, despite a few hiccups along the way, it's becoming clear that Mac OS, not Windows, epitomizes Microsoft's new mantra of "secure by design, default, and deployment."
That is true, right now, but it is not a fair comparison.
Look, I'm no MS fan, but they have not released an operating system since they started their "trustworthy" initiative. The Windows operating systems being discussed are old (WinXP came out in 2001), and obviously full of holes--so full of holes that MS had to start this whole focus on security.
So comparing anything to an admittedly weak and insecure operating system is just plain silly. Everyone knows Windows is insecure. Saying MacOSX is more secure than Windows means nothing, and in fact makes OSX security look comparable to that of Windows when in fact it is far better (regardless of what that PCMagazine moron wants to believe).
So, how about we give MS a chance and at least wait for them to release an OS under their "secure by design, default, and deployment" banner before we start ripping it. We may be pleasantly surprised (although I doubt it).
Are you going to explain why Joe Blow's ability to create files in the root directory is a security risk, since he can only remove files that he himself owns? I hope you're not just trying to hide behind "sticky bit" jargon and lofty claims of "weakening a security model that has already had significant difficulties."
Unlimited growth == Cancer.
The only fanatics I've ran accross in the MacOSX World are the AntiMac Fanatics.
There's some kind of fundamental truth there. For example: I was a vegetarian for a decade, and during that time I noticed there was a type of person who looked upon my eating habits as a personal attack. These people would try to drag me into an argument about how I wasn't enough protein, etc. I realized I couldn't win: If I shrug it off, I'm a mindless cultist. If I try to disabuse them of their notions, I'm a fanatic.
Later I started eating meat and bought a Mac, and now I run into the OS version of these people.
One man's -1 Flamebait is another man's +5 Funny.
http://www.securityfocus.com/archive/1/347578
captures my sentiments. I know, shared libraries create efficiencies, but at least for me, at too high of a price in terms of security. It may very well be a personal bias, but I'd rather spend a bit more on extra disk space and RAM for the extra security of more compartementalized applications.
When you statically link libraries, each time you get a security fix for a library you have to rebuild ALL of the effected applications and redeploy them. Forget one, and you're still vulnerable. With dynamically linked libraries, when you replace the library all of your applications get the fix.
I don't see a security benefit to statically linking a library instead of using a shared library -- if the shared library can be compromised, any of the applications that statically link to that library can be compromised as well.