Mac OS X Security Criticisms Countered

Paradox writes "In response to the recent PC Magazine story criticizing Mac OS X security, technologist/author Richard Forno has written a rebuttal criticizing the author and raising some good points about the fundamental differences between Windows and Mac OS X. Considering Lance Ulanoff's tone during his article, a rebuttal from the Mac OS X community was inevitable." Forno's conclusion: "Trustworthy computing must be more than a catchy marketing phrase. Ironically, despite a few hiccups along the way, it's becoming clear that Mac OS, not Windows, epitomizes Microsoft's new mantra of 'secure by design, default, and deployment'."

Comments

Slow site

[Anonymous Coward]

article text, reprinted as permitted by author. Enjoyez-vous.

Muckraking, the PC Way
Richard Forno
12 Dec 03
Copyright (c) 2003 by Author. Permission granted to reproduce in entirety with credit given.


Richard Forno is a security technologist, author, and the former Chief Security Officer at Network Solutions.


Since Apple released Mac OS X, even the PC industry trade publications have raved about its quality, design, and features. PC Magazine even gave Mac OS X "Panther" a 5-star rating in October 2003. Perhaps it was because Macs could now seamlessly fit into the Windows- dominated marketplace and satisfy Mac users refusing to relinquish their trusty systems and corporate IT staffs wanting to cut down on tech support calls. Whatever the reason, Mac OS X has proven itself as a worthy operating system for both consumers and business alike.

Of course, as with all operating systems, Mac OS X has had its share of technical problems and even a few major security vulnerabilities. Nearly all were quickly resolved by Apple via a downloaded patch or OS update. But in general, Mac OS X is solid, secure, and perhaps the most trustworthy mainstream computing environment available today. As a result, Mac users are generally immune to the incessant security problems plaguing their Windows counterparts, and that somehow bothers PC Magazine columnist Lance Ulanoff.

In a December 11 column [1] that epitomizes the concept of yellow journalism, he's "happy" that Mac OS X is vulnerable to a new and quite significant security vulnerability. The article was based on a security advisory by researcher Bill Carrel regarding a DHCP vulnerability in Mac OS X. Carrel reported the vulnerability to Apple in mid-October and, through responsible disclosure practices, waited for a prolonged period before releasing the exploit information publicly since Apple was slow in responding to Carrel's report (a common problem with all big software vendors.) Accordingly, Lance took this as a green light to launch into a snide tirade about how "Mac OS is just as vulnerable as Microsoft Windows" while penning paragraph after paragraph saying "I told you so" and calling anyone who disagrees with him a "Mac zealot."

In other words, you're either with him or with the "zealots." Where have we seen this narrow-minded extremist view before?

More to the point, his article is replete with factual errors. Had he done his homework instead of rushing to smear the Mac security community and fuel his Windows-based envy, he'd have known that not only did Apple tell Carrel on November 19 that a technical fix for the problem would be released in its December Mac OS X update, but that Apple released easy-to-read guidance (complete with screenshots) for users to mitigate this problem on November 26. Somehow he missed that.

Since he's obviously neither a technologist (despite writing for a technology magazine) nor a security expert, let's examine a few differences between Mac and Windows to see why Macintosh systems are, despite his crowing, whining, and wishing, inherently more secure than Windows systems.

The real security wisdom of Mac OS lies in its internal architecture and how the operating system works and interacts with applications. Its also something Microsoft unfortunately cant accomplish without a complete re-write of the Windows software -- starting with ripping out the bug-riddled Internet Explorer that serves as the Windows version of "Finder." (That alone would seriously improve Windows security, methinks.)

At the very least, from the all-important network perspective, unlike Windows, Mac OS X ships with nearly all internet services turned off by default. Place an out-of-the-box Mac OS X installation on a network, and an attacker doesnt have much to target in trying to compromise your system. A default installation of Windows, on the other hand, shows up like a big red bulls-eye on a network with numerous network services enabled and running. And, unlike Win

ok..

[junkymailbox]

not much comparison when you start comparing your security to windows security.

Attacking the author

[goldspider]

I did RTFA, and it would seem to me that the rebuttal would have sufficiently stood on the merit of the facts, without all the sniping at Ulanoff.

Tho Forno is mostly correct in his assertions, I would take him MUCH more seriously if his argument wasn't riddled with immature name-calling.

Re:Attacking the author

[palutke]

As a rule, I treat everything that a 'technologist/author' says as worthless until they prove otherwise. It seems that 'technologist' is one of those titles that people attach to themselves when they don't posess any useful skills (to me, anyway).

As the parent said, this guys facts seem solid, but his attitude makes it difficult to take him seriously.

Re:Attacking the author

[Bill, Shooter of Bul]

Exactly. The original article may have been flaimbait, but it really didn't require another article to point out all of the obvious flaws. Even if it did, this author could have avoided sinking to his level.

Re:Attacking the author

[Oculus Habent]

Every work day, I use Mac OS X 10.3, Windows XP Pro, 2k Pro, NT 4, and 98 - sometimes 95, too. I like my Mac. I could go into why, but no one asked me, so I won't. How the original story managed to make some sort of grade for acceptability at PC Magazine makes me less interested in the publication.

I concur will your view - the correct answer, said rudely, still isn't right.

Re:Attacking the author

[On Lawn]

So in short,

Technologist is to technology what Waitress is to acting?

trust

[rwven]

the bottom line is which are you going to trust anyway? the only computer that i would fully trust to protect my stuff would be a gentoo linux box custom made for a specific purpose. Self patching and very few applications installed for a person to take advantage of. the bottom line is though XP and Mac OSX may be "secure" they're not secure enough for anything important. (in my humble opinion.) I also work at a place where security is EVERYTHING so i guess i see it different... This pointless blathering about security shoudl convince no one of anything, especially when zealots are concerned.... I say use whatever works best for what you are doing. if you want REAL security, you shouldnt use either of those OS's

Re:trust

[telbij]

So you're saying there's no middle ground... either you need security and run Gentoo or you need to do some real work and then take your pick?

In the real world where a person may need to run various applications and perform unforeseen tasks, security is still a consideration. I myself run OS X because (among other reasons) I don't like having system performance degrade over time, or worry about opening emails. Is having my system hacked the end of the world? No, but I'll take the better odds any day.

Re:trust

[ducomputergeek]

Security was everything at one of the places I worked. We had a special lead incased steel room with computer monitors and armed gaurds to get in and out with at least three different methods of Identity conformation. Those units in that room were not networked and media could go in, but not out. When it was time for something to go, the nice distructo matic guys came in, busted the monitors, all the hardware and ran magnates over everything just to make sure. Granted that was a DoD contractor and much of the work in those rooms were even above my security clearance. That's about as secure as you can get, and yes some of the computers ran windows.

As far as that goes, no operating system is 100% secure. The only way its secure is if its off. If you require a password to log on, its vunerable. If to nothing else, someone else on the inside figuring out that password. 80% of all the breaches we see are inside jobs. Either disgruntaled employee, sys admins don't remove passwords of terminated or former employees, or a hacker goes calls on the phone saying, "I'm joe from department x or branch y, and I forgot my password".

Even now, we have an internal network of 3 computers linked to a server that manages our accounting data. None of those boxes are connected to the Internet. That only leaves the possiblity of a breach from within or a unit being stolen physically from our office.

We do a lot of IT consulting and expaning into security, and the one question we always have to ask ourselves and clients, "Okay, nothing is going to be 100% secure, where do you draw the line?" Granted, most of our clients have 20 or fewer employees and aren't doing a lot that needs governmental levels of security. Usually Zone Alarm Pro and Norton is about the best defense these people are going to get for the money. Some larger companies elect on having a dedicated hardware firewall installed or an *BSD box configured as a firewall too.

Now on the desk of an average employee sets either a PowerMac G4 of various speeds, an iMac, iBook (yeah, I'm the President and I have an iBook), or a powerbook all running OS X.2 with my business partner's Powerbook the only 10.3 at the moment. We don't worry about the worm of the week on our machines.

At the end of the day, the way in which Windows is built and the intergration of IE, MP, etc. there is only so much you can do, and saying "Switch to Linux" often isn't the answer as well, at least to our small business clients. And I will defend that position with one word: Quickbooks. At least with Macintosh, they can have their Office, QuickBooks, Email, and Internet with a system they can understand, and provides more security than windows out of the box. Perfect, no, practical, yes.

Re:trust

[mattdm]

When it was time for something to go, the nice distructo matic guys came in, busted the monitors, all the hardware and ran magnates over everything just to make sure.

What, like, Andrew Carnegie and John D. Rockefeller had to jog on the broken computers? How does that help? Man, I just don't understand security these days.

I'll take Zealots for 500, Alex

[TimTheFoolMan]

'In other words, you're either with him [Lance Ulanoff] or with the "zealots."'

If I have to choose sides, I'll go with the Zealots on this one. Apple's security and responses to breaches (so far) have been light years ahead of what I've dealt with from MS.

Tim

Cockiness

[fiannaFailMan]

From the original article:

How cocky are you feeling now, Mac elite?

As cocky as ever, thank you very much.

*sigh*

[Oculus Habent]

The PC Magazine story was just about that - a story.

It wasn't a report. It wasn't an account. It wasn't an investigation. It wasn't supported by facts. It wasn't supported by logic. It was an opinion piece that, from my view, wasn't well thought or well written.

It's unfortunate that people need to write rebuttals to this sort of journalism, but some naive readers out there will simply take it at face value because it's in print, so it must be true.

Re:*sigh*

[ack154]

But what if many people read that and don't see it as just a "story"? What if people take it for what he wrote? (Essentially saying Mac is "as bad as" Windows based on this one vulnerability he mentioned).

While this new article does take maybe too much aim at the original author, it should at least help clarify what is really going on.

I'm far from a security expert or anything, but I would be far more apt to trust Mac OS security out of the box than Windows security...

Re:*sigh*

[Ringel]

It wasn't a report. It wasn't an account. It wasn't an investigation. It wasn't supported by facts. It wasn't supported by logic. It was an opinion piece that, from my view, wasn't well thought or well written.

Unfortunately, it is exactly that type of disingenuousness that is the hallmark of yellow journalism. You don't get to ex post facto decide whether something is a story or journalism. I assure you that there is no field for "story" or "journalism" in any standard bibliographic form. This is how people like Ann Coulter get away with slander, and then take a "ha ha only kidding just my opinion" stance to defend themselves.

As soon as a story is referenced, it becomes a reference, regardless of what the original motivations were.

Re:*sigh*

[Oculus Habent]

The original article was poor. It shouldn't have made it to publication. There should have been an alarm in the mind of some editor, reviewer... someone.

The basis for a rebuttal is valid and appropriate. A correction by the author would be better, but we tend towards sensational announcements and very, very quiet retractions.

Re:*sigh*

[hellfire]

I disagree with you for several reasons:

1) If Lance can post something regarding his opinion of an operating system, then Richard can post his opinion of Lance's article.

2) Everyone's entitled to an opinion, but not all opinions are equally valid. This is a fundamental point of epistomology. Lance is spreading FUD. What his motivation is, is unclear. But that doesn't give Lance the right to be spreading false accusations. Someone has to stand up and say so. If I were as good a writer as Richard I might have done it.

3) Lance KNOWS what he's doing, and either he know he's wrong or he's so blinded by his opinion that he can't reason properly. However, some people are going to think he's right. That's not fair to anyone who enjoys using Apple products or is one of these "mac zealots" who want to expand the user base.

4) This isn't in the same degree as some gross mischaracterizations that the media is known for (such as overblowing safety warnings or terrorism alerts, or incorrectly running news stories on urban legends and hoaxes which aren't true; yes that has happened before and continues to do so!), but every article, factual or opinionated, that contains false facts must be refuted. The journalism industry is taken for granted, at least in America, and when one of them screws up in order to get more money or get a promotion or because someone ordered them to, or some other sleazy means, then better journalists, or the public in general, should stand up and say the media is dead wrong.

Curious..

[Metallic Matty]

You could have found a fairly accurate rebuttle right here at . as well.

Minus the trolls and such.

Re:Curious..

[danigiri]

Sorry to cross-post (posted on previous discussion) but I'm lazy (and point still stands). Here's another rebuttal from me that uses no personal attacks or any of that crap:

Dear Mr. Ulanoff,

I am writing to you just to send you a couple of informative references on general computer security. I promise to stick to the basics, and I am sure you will dig deeper if interested.

One of the basics of remote exploits is the ability to -once a remote vulnerability is discovered-, send malicious code snippets that get executed with privileges on the target computer. For instance, they might be sent exploiting a buffer overflow bug or a flawed service left running on an open port.

This is well known in the MS Windows world and even Linux, as they commonly share the same underlying hardware architecture (namely x86). There is plenty of information on how to build such malicious code snippets (basically anyone knowledgeable in x86 assembler can do it) as well as pre-built apps and scripts to send them. This is well known. It is also well known that a vulnerability must be present for the code to be able to be executed at all.

It is a common myth that -by following this logic-, other platforms that are less used, like for example MacOSX (subject of a security article of your own), are more secure because technical knowledge about them is less common (eg. PPC assembler language) and are not so commonly used. One might think the malicious code needs to be built by real gurus, few in number, that have no interest in doing that.

*However*, doing a trivial search on Google (also published on /. and so seen by thousands) this paper shows up:

http://www.securiteam.com/securityreviews/PPC_OS X_ Shellcode_Assembly.pdf

Is a no-nonsense compilation of MacOSX PPC malicious payloads and the rationale behind them. After copy-pasting from it, anyone can do remote attacks on MacOSX, *provided* a vulnerability is actually found. No vulnerability, no attack. The paper requires a low level of technical knowledge and actually has little merit (apart from being somewhat clear and concise).

So, using information freely available, easily found, in common knowledge (published on /., not some backwater usenet), anyone could attack MacOSX boxes, *if* a vulnerability is discovered in it or in its running services.

So it *cannot* be possibly said that MacOSX achieves its high level of security by obscurity. It accomplishes it by *design*.

It is really sad that the old argument of 'security by obscurity' is being raised over and over. Read that paper.

Mr. Ulanoff, I promised you two links and I have provided only one. The other is not actually a link but a reference. Just walk to your nearest technical bookstore or Computer Science library, look for the PPC assembly and architecture books that have been publicily available for years. My cheapo college library has them, yours surely has.

I am looking forward to further informed security articles by you. Please do not hesitate to mail me should you need further references on this or any other technical question.

Best regards,

xxxxxxx

The main difference

[LinuxMacWin]

.....

Contrary to his article, the small market segment held by Apple doesn't automatically make the Mac OS less vulnerable to attack or exploitation. Any competent security professional will tell you that "security through obscurity" - what Lance is referring to toward the end of his article - doesn't work. In other words, if, as he suggests, Mac OS was the dominant operating system, its users would still enjoy an inherently more secure and trustworthy computing environment even if the number of attacks against it increased. That's because unlike Windows, Mac OS was designed from the ground up with security in mind. Is it totally secure? Nothing will ever be totally secure. But when compared to Windows, Mac OS is proving to be a significantly more reliable and (exponentially) more secure computing environment for today's users, including this security professional. .....

Re:The main difference

[Trurl's Machine]

Any competent security professional will tell you that "security through obscurity" - what Lance is referring to toward the end of his article - doesn't work.

Please observe that the term "security through obscurity" is often used in two slightly different meanings, one that obviously doesn't work and one that is at least not so obvious. Let me separate them:
THE ONE THAT OBVIOUSLY DOES NOT WORK is "let us make our system as obscure as possible by refusing to supply any extensive documentation to the public, not to mention the source code; the less anyone knows about our system the better". Microsoft often resorted (still resorts?) to this kind of "s-t-o" strategy. It doesn't work, because sooner or later the internal documentation will leak, malicious crackers will get it anyway and the bona fide hackers won't provide you with their valuable security alerts, patches etc. This meaning of "s-t-o" has actually nothing to do with the popularity of a given system - it's a matter of a vendor's strategy, not a market share.
THE ONE THAT IS NOT THAT OBVIOUS AFTER ALL is "let us maximize our security by choosing a system that is not-so-popular, so at least the script kiddies would have to do some homework before they could even try to log in to our network, not to mention use any actual exploits". To some extent it works - script kiddies by very definition go for an easy prey and a not-so-popular system is not one.

Now, please observe that MacOS X does indeed offer "s-t-o", but only in the latter, not-so-obvious meaning. In the first meaning, it is not obscure at all. Everything related to network, communications, protocols etc. is open in MacOS X - only the GUI layer is proprietary.

I don't like the "security through obscurity doesn't work" mantra just because it is a mantra - people seem to just repeat it, without backing it with any examples. In some cases it's obvious, but in some - it is not. Just wanted to clarify that.

The wierd thing...

[stuffedmonkey]

is that Mac os 9 was completly safe to the outside world. AFIK there were no remote holes - now it did crash every ten to fifteen minutes on me, but I've never seen remote vulnerablitly. Wasn't the army using a few G4 towers with Webstar as html servers? I wouldn't go back to 9 from 10.3 - but it was amazingly secure.

Re:The wierd thing...

[Trurl's Machine]

is that Mac os 9 was completly safe to the outside world. AFIK there were no remote holes - now it did crash every ten to fifteen minutes on me, but I've never seen remote vulnerablitly.

You can see one anytime you want by just checking this test site. It works in a similar way as the infamous autostart worm that plagued MacOS Classic machines. The vulnerability works as follows:

1. You click on a link on a website like the above. It starts to download a stuffit-packed disk image to your desktop [without asking; that's the default configuration]
2. Stuffit unpacks and mounts the image [without asking; that's the default configuration]
3. Classic QuickTime sees a newly mounted image and initiates Autostart procedure [DEFAULT CONFIGURATION!]
4. Bingo - you allowed a remote source to execute arbitrary code on your system; and even under MacOS X, it started as a Classic layer process so it runs actually as root

The test site "attacks" you only with a very simple AppleScript applet that only opens your trashcan and that's it. But just think of the possibilites for a really malicious use. It was a very severe vulnerability for all vanilla-configured MacOS 9 (and earlier) machines; but unfortunately, also MacOS X machines with their Classic layer configured as the vanilla MacOS 9 were affected. THIS INCLUDES the MacOS X 10.3 "Panther". In fact, Classic layer always was and still is the biggest security hole in MacOS X, but that's another story. Anyway, Apple was crazy to provide Autostart option in QuickTime (who needs it, anyway?) but it was even more crazy to provide it as the DEFAULT configuration.

I have not heard of one successful r00ting of OS X

[teamhasnoi]

Are there *any*? With a generic default install of 10.3 (plus net connection), are there any remote exploits? I'm guessing that any exploit that has been found is due to 3rd party software.

Are there any viruses/trojans for OS X?

I know there was the ssh deal a while back, but does anyone know of any remote r00ting of an OS X box anywhere?

Re:Don't always assume a smear campaing

[proj_2501]

"or wrong, never fully read it or the rebuttal"

so why comment on the relationship between the two if you are obviously misinformed and you admit it?

Re:Don't always assume a smear campaing

[EvilFrog]

The tone of the article has a lot to do with the assumption.

I mean, if I said, "I wish he'd just shut his mouth if he's not going to read the article," you can safely assume more malice there than if I said "He really should read the article before commenting," right?

Audit. WAS: Re:trust

[voixderaison]

If you work in a place where "security is EVERYTHING", then you should know that trust is *not* the bottom line.

Don't trust vendors.
Don't trust open source.
Trust no one.
Audit.

Re:Don't always assume a smear campaing

[pyros]

Not to say the original article was right (or wrong, never fully read it or the rebuttal) but it's shortsighted to assume criticism comes from zealous hate.

It's not too much of an assumption. The author of the orinigal piece said he was glad that there was finally a big vulnerability for Mac OS, and that he was tired of Mac users looking smug when SAMS edition Conquer the Internet in 12 Hours outlook viruses pass them over. The whole piece just had a tone of "I'm really sick of people bragging about Mac OS."

stubborn institutional pride/hubris, etc...

[The Lynxpro]

I think Apple has shown the way Microsoft should follow if they wish to bring security and stability to the Windows platform. Apple migrated over to the underpinnings of BSD without compromising the distinctness that only Apple brings to the table. If Microsoft truly cared about "trustworthy computing," they'd shift their gears and concentrate on gluing the Windows GUI and other applications to whatever BSD platform they chose to annoint. After their acquisition last year (the VirtualPC crew), Microsoft has the talents necessary to bring decent emulation of older Windows flavors to their new products. But apparently they [Microsoft] are too stubborn for their own good. It sounds like Longhorn will now be delayed until 2006 or 2007, and every year they slip, the more people and institutions will slip away to Linux and OS X for the very ideal of "trustworthy computing" they profess. Windows is broken as an OS, but as a GUI "bundled" on top of BSD, it would prove to be the magic Microsoft's shareholders are now searching for. And since Microsoft has been infusing SCO with cash, Microsoft would be "safe" from any litigation from SCO in regard to BSD or Linux...

Re:stubborn institutional pride/hubris, etc...

[zgwortz962]

Honestly, Microsoft trying to put a Windows GUI on top of BSD is probably a bad move for them. The problem, as is always the issue with new OSes, is drivers.

Apple was able to get away with Mac OS X on top of BSD, using their own modern driver architecture (IOKit) because they had a relatively small hardware subset that they had to support (and you'll note they didn't even *try* and support a whole bunch of their older machines...). And it still took them 4 years to get the first version out the door.

For Microsoft to to the same thing would be tons more complicated, given the ungodly amount of hardware they have to support.

(Drivers are the long term bane of Linux and BSD as well -- The Linux driver model is, IMHO, a horribly antiquated mess needing a complete tear out and replacement. It's not going to get that anytime soon for the same reasons outlined above - too many new drivers to support. I'm not familiar with the BSD model, but if it's anything like the over 20 year old UNIX device model, I'm *very* glad Apple chose to use IOKit instead...)

IMHO, if Microsoft wants to produce a truly stable OS, they need to tear their kernel development away from the rest of the OS, and put everything else (especially IE) in a nice isolated sandbox. I would say the vast majority of Windows security holes are there because MS tries to integrate way too much high level functionality into the core OS.

Of course, if they do that, then they risk people adding their own sandboxes on top of their core OS (like Java...) and losing control of the application developers who currently are slaved to that highly integrated high level functionality...

Can't resist... feeding... the... Troll

[kylef]

You are right, of course. But expecting Forno to avoid name-calling would mean expecting him to avoid feeding the Troll. This one was so cute, and looked so hungry... Maybe just a LITTLE food would be okay...

Crap. Slashdot picked it up. So much for keeping the Troll population down this Christmas season!

Better read than the PC Mag Article

[OS24Ever]

This at least had some bullets that backed up the statements.

The PC Mag article read as a 'neener neener neener I hate you' article vs. something with content.

Re:Don't always assume a smear campaing

[NaugaHunter]

From the original article:
How cocky are you feeling now, Mac elite?

While the original article's criticism may not have come from "zealous hate", it certainly didn't come from impartial journalism. This and other statements like it definitely tinted it from simple reporting to an apparent attack, complete with the subliminal childish prat-calls.

This seems awfully long-winded...

[WIAKywbfatw]

Hey, reading this is slow going. Anyone got a link to the PowerPoint slideshow version for dummies?

MS should learn from ship builders

[nv5]

One of the great breakthroughs in safety design came when ships started to be built with compartments, which would prevent a single hull puncture to sink the whole ship. (Sadly the Titanic's compartments were all aligned in one dimension, so when the puncture was very long, it compromised all compartments).

One of my greatest concerns with MS attitude towards design of their "ships", especially Windows and Office is, that they are integrated way too much. So any security "puncture" spills over way too easily into the rest of the ship. As a very annoying side effect, one ends up re-booting for way too many MS patches. Why should I have to reboot, if I patch my browser or e-mail client?

Of course, MSIE, Outlook and MS Office vulnerabilities have been a lot less worrying for me, since fully switching to Mozilla and OpenOffice over a year ago!

a few things

[BigBir3d]

Firstly, my new office machine is a Dell with XP Pro. My home machines are iBook with 10.3, and a ThinkPad with Mandrake 9.x (uptime near 60 days now). All 3 are stable machines that do what I want, when I want. The Thinkpad was the #1 machine until I had enough scratch to buy the iBook (apple.com does nice refurb sales from time to time). When sobig and the other malicious worms of 2003 came out, my office was all win98 machines, and a NT 4.0 server. Due to reading /. and using Norton Antivirus, the only machine affected by the onslaught were the machines I was not "allowed" to touch (#1 computer guy {I am the secondary guy}, and the owner of the company {"I did that already"}. In short, you can run any of these machines safely, with most all of the latest software. It just helps if you are not an idiot.

PEBKAC

Deservedly

[burgburgburg]

The original "commentary" was not just chock full of factual errors, improper syllogisms, et. al. It was dripping with such a malice-filled glee at the notion that OS X might be as insecure as Windows that one has to wonder as to real root of the author's problems. He mentions how angered he is by the laughing of OS X users every time he has to deal with another Windows virus/trojan/bug. Are "commentaries" like his the sad, pathetic result of not working on an OS that "just works"?

Re:Don't always assume a smear campaing

[antiMStroll]

There's and easy way to confirm or dispute the contention. Read the damn article. But since that's too troublesome for the moderators, enjoy some choice cut'n'paste:

I know this is wrong, but in one respect I was happy to learn earlier this month about the discovery of a significant security hole in the Jaguar and Panther...

I was tired of the "We use Macs because they don't get attacked by viruses and hackers" refrain from Mac nuts.

I generally counter with what is apparently a secret carefully hidden from Mac zealots:...

But the mindlessly superior retort is always the same....

Given this recent development, my question is, "Will you be stuffing that superior attitude in your crow or eating it separately, sir?"

Those quotes alone comprise half the first few paragraphs. See, that wasn't too hard, was it?

security through obscurity

[siskbc]

"security through obscurity" - what Lance is referring to toward the end of his article - doesn't work.

I realize this is an oft-repeated truism, and obscurity alone doesn't make a system truly secure...but it certainly helps. To make an analogy, I know of many friends who have been robbed, even when their valuables were well-locked. However, those who put their valuables in places theives never think to look are generally the ones who keep them - good security is never perfect, and is generally at best a deterrent, at worst a challenge. Hell, security through obscurity is the whole basis for steganography, though most would recommend encryption as part of a "why not?" sort of preprocessing step.

As such, I think it's a given that Windows is at least less secure because of its market share. Whether Mac is more secure because of its obecurity is debatable - I'm sure there are a number of generic unix exploits that macs would suffer from, and the general unix community is very high profile.

Reply to rebuttal

[Micro$will]

To: Richard Forno
From: Lance Ulanoff
Subject: Re: Mac Security

YHL YHBT HAND

Re:Mac Elite loves to feel cocky...

[Dutchmaan]

With all due respect any "elite" user is pretty abhorrent to be around...

I'm sure we all know a:

Mac Zealot
Microsft Apologist
Pompus Unix Geek

Not a fair comparison

[andman42]

Ironically, despite a few hiccups along the way, it's becoming clear that Mac OS, not Windows, epitomizes Microsoft's new mantra of "secure by design, default, and deployment."

That is true, right now, but it is not a fair comparison.

Look, I'm no MS fan, but they have not released an operating system since they started their "trustworthy" initiative. The Windows operating systems being discussed are old (WinXP came out in 2001), and obviously full of holes--so full of holes that MS had to start this whole focus on security.

So comparing anything to an admittedly weak and insecure operating system is just plain silly. Everyone knows Windows is insecure. Saying MacOSX is more secure than Windows means nothing, and in fact makes OSX security look comparable to that of Windows when in fact it is far better (regardless of what that PCMagazine moron wants to believe).

So, how about we give MS a chance and at least wait for them to release an OS under their "secure by design, default, and deployment" banner before we start ripping it. We may be pleasantly surprised (although I doubt it).

Re:Not a fair comparison

[danigiri]

Look, I'm no MS fan, but they have not released an operating system since they started their "trustworthy" initiative. The Windows operating systems being discussed are old (WinXP came out in 2001), and obviously full of holes--so full of holes that MS had to start this whole focus on security.

XP might be old, but it is what people are allowed to buy *now*, so your point does not apply. It is insecure *now* and it is being sold *now* (read, not discontinued or the like).

So, how about we give MS a chance and at least wait for them to release an OS under their "secure by design, default, and deployment" banner before we start ripping it. We may be pleasantly surprised (although I doubt it).

I have just installed a network of computers, loaded with MS software I just bought. I need to be secure now, not in 2-3 years time.

dani++

Yeah yeah.

[mindstrm]

My summary of the situation:

- Nothing is totally secure, if it's at all useful.

- Windows is demonstrably NOT secure. IT's been riddled with nasty bugs for years.. and for Joe Average, WHY doesn't matter.

- OS X is without question far more secure than windows, and less buggy. That is not to say it's immune, or that it can't be hurt ever, but several factors both in low-level design, and in user interface design, specifically how easily users can turn on and off certain services, makes it less prone to exploits.

- Yes, it has a smaller market share, and hence, less attention is focused on it, and that certainly IS a factor.. but it doesn't change the fact that mac users don't have to worry about viruses on a dialy basis at the moment. It also isn't the only factor, and hardly means "Oh it's just as insecure as windows"

The #1 insecurities in windows are related to bad design... and a narrow interpretation of how the computer will be used in a network environment. Having all these services listening by default is bad. Having them difficult to shut off is even worse.

Mac Zealots or AnitMac Zealots

[Salvo]

I recently switched to MacOSX from BeOS. In my experience chatting to the Mac Community out there, they are not more fanatical than Any other Community. I've know Car Clubs who are more obsessive than the Macintosh Community.

The only fanatics I've ran accross in the MacOSX World are the AntiMac Fanatics. For whatever reason, these individuals *hate* Macs. Not just Dislike Macs, but actively *hate* them, with a passion remeniscant of Religious Fundamentalists.

People who rebute these AntiMac Fanatics are Labeled Mac Zealots. This is only a half truth, they are really just qualifiers of the AntiMac FUD.

Anti-OS sentiments aren't restricted to MacOS, though, There are plenty of AntiMS, AntiLinux, AntiBSD and Anti[insert favourite OS here] Fanatics. Are you one of them?

So blown out of proportion ...

[Zwoop]

I still don't understand why this security "hole" got so much attention... Are people struggling to find problems with MacOSX? First of all, attacks like this is nothing new, just remember the old YP/NIS problems with broadcasting for the server, to mention just one example.

Secondly, when we wrote the DHCP LDAP option specs way back when, we explicitly documented this problem in the security section:

5. Security considerations

Security considerations discussed in [3], particularly with respect to the
provision of authentication information, are directly applicable here.
Additionally, it should be noted that providing LDAP server information by
a broadcast protocol such as DHCP may allow unauthorized clients to learn
the location of and authentication information for LDAP servers and hence
pose as valid clients. This presents a security problem when sensitive
information, such as user passwords, is published via LDAP servers.

The DHCP protocol provides no mechanisms for the client to verify the
validity and correctness of the received information. The security
considerations in [1] discuss several weaknesses, particularly the problem
with unauthorized DHCP servers.

This was written in 1997, note the last paragraph above. These issues has been discusses and documented in several RFCs, many years ago...

-- Leif

Re:Mac Elite loves to feel cocky...

[KevCo]

But now you can be a Mac Zealot and a Pompus Unix Geek at the same time! Its great!

Re:Don't always assume a smear campaing

[all your mwbassguy a]

Macs CAN get viruses
which viruses would these be? there are still no virii that attack mac os x.

Re:Interesting Article

[bovinewasteproduct]

Windows XP doesn't suffer from that issue

Considering that only about 8% of the windows users are running XP (95, 98 and 2000 are the majority), then his comments still stand. The recent spate of articles on MS dropping support for Win98 has posted the ratios quite clearly.

BWP

Re:Mac Elite loves to feel cocky...

[southpolesammy]

Pompus Unix Geek

Wally -- "Wait a minute, that beard, those suspenders, that smug expression!"
Wally -- "You're one of those condescending UNIX computer users!"
UNIX-guy-- "Here's a nickel, kid. Get yourself a better computer."

--Dilbert, c. 1994

Everything is relational..

[msimm]

Its brilliant! Windows safer by design will prove that everyone is at least as insecure as they are! Bammo! Acceptably secure operating system.

I smell a Monty Python skit in here somewhere!

Re:OSX is weak - here is some homework.

[pHDNgell]

The original point was about / being writable. The problem is that if / is writable (but not sticky), then it'd be possible to do this:

cp -r etc myetc; mv etc etc.old ; mv myetc etc

And then you control etc.

However, due to the sticky bit:

dustin2wti:/tmp/test 520% ls -ld . etc
drwxrwxr-t 3 root admin 102 15 Dec 14:10 ./
drwxr-xr-x 2 root wheel 68 15 Dec 14:10 etc/
dustin2wti:/tmp/test 521% mv etc newetc
mv: rename etc to newetc: Operation not permitted

(because of the sticky bit and my lack of ownership over etc)

Remember, renames are *directory* modifications, not file modifications. The sticky bit fills in the difference.

Re:Don't always assume a smear campaing

[azav]

Macs CAN get virii. True. However, I was one of the first ten people in the world to identify the mac WDEF virus in 1990-1991. I've followed the virus trail since 1989 to this day on macs and pcs. I even did virus protection for fortune 500 companies once.

PCs are open holes with regards to virii.

Macs are a dream in this respect. Even the old OS 9 & lesser.

Obscurity DOES play a part. A small part. The win 95/98 verisons of windows that are STILL being used are horrors. The newer versions are much better (Me, 2000, XP) but still, the win computer ships with the doors unlocked and open. And the solutions made to close them are subpar. What if I WANT to email a .exe to a coworker?

I could regail you with tales of the reocurring Scsvr/brasil/ops32 virus at our old office but and all the times our pcs went down but I won't. The time wasted cost us enough.

The original reporter is a bitter man who is upset that the one part of the mac he chooses to address is much better than the same area on the pc and is despirate to "fight back" and say "nyah, nyah, I tooold you" to the mac crowd, painting them as elitist pinkie pointing beret toting espresso drinkers.

We need more rebuttals like the one that started this thread. I know many who claim that "less macs = less mac virii you stooge" without closely examining the situation.

At last check, there were about 60 mac virii. At most 100.
How many win virii are there out there? 50 thousand? 60 thousand?

The more the correct message gets published by competent professionals, the less win/mac virii FUD will be going around.

Cheers,

I said it...

[daveschroeder]

...once, Apple said it, and advertized it, but I'll say it again:

This isn't so much of a root vulnerability as a default configuration that trusts the integrity of the local network services. This functionality has been around since NeXTSTEP, and is designed to allow for auto-configuration of new servers/machines brought into the network. The quick 'fix' for the vast majority of users who choose to implement it is to uncheck LDAPv3 and NetInfo altogether in Directory Access. Or, if LDAP services are used, just uncheck 'Use DHCP-supplied LDAP Server' in LDAPv3. ... One could argue that these features should be off by default, but if they are, it kind of wrecks the whole auto-configuration scheme. [There is a certain level of implicit trust of the local network that is assumed.]

This functionality - yes, functionality - has been in Mac OS X and its predecessors for YEARS. Just because all of a sudden someone paints it as a root exploit does not make it so. This is nothing like the standard fare of Windows remote exploits, some of which can be exploited against unpatched machines from any location on earth, at will, remotely, at any time, against any unprotected vulnerable machine. This "exploit" requires that a roque DHCP server be set up on your local network (!), and that a machine be rebooted (or otherwise perform a DHCP request) in this malicious environment. I repeat: just calling something a root exploit does not make it so.

Perhaps it's time to have a larger discussion about how much you can really trust your local network infrastructure services, be they in a home environment or in a corporate setting, because that's what this is really about.

Should Mac OS X have this default behavior?

What are the tradeoffs?

And so on.

I just find the distinct lack of understanding of this issue astounding.

(Note: and no, this isn't an issue of Apple glossing over something by calling something a "feature" when it's really an "exploit", as you could argue for some of MS's exploits. This really is a feature, and one that can be taken advantage of by rogue services on your network...like just about anything can in one way or another. If you're being affected by this so-called "exploit", you've got bigger problems on your hands...)

What I think is funny...

[dfj225]

Is how many people, when they write about OS X credit Apple with coming up with the secure design or other features. If anyone should be credited, it should be the people who develop FreeBSD, because that is the real reason why OS X is secure.

Re:What I think is funny...

[sakusha]

You are right, BSD developers deserve credit. But you missed one extremely obvious point: that includes Apple. Apple's programmers contributing BSD code back to the source tree. Apple's efforts have brought more users and more programmers to BSD than ever before. Apple is the largest Unix vendor in the world.