Apple Patch Released, But Is It Enough?

entenman writes "Apple Computer's security update train rumbled into the station with fixes for a whopping 43 Mac OS X and QuickTime vulnerabilities. The Security Update patches 31 flaws in the Mac OS X, most of them serious enough to cause 'arbitrary code execution attacks.'" Unfortunately, InfoWorldMike writes "InfoWorld.com reports that Independent researcher Tom Ferris said there were still holes in Safari, QuickTime, and iTunes that he reported to Apple but were not patched in the latest release on Thursday. Ferris told InfoWorld he is considering releasing the details of the unpatched holes on May 14 on his Web site. He also says he has found new holes in OS X affecting TIFF format files and BOMArchiver, an application used to compress files. He did not provide details about the flaws or proof of their existence."

Comments

Stupidity

[Phroggy]

and there is debate about whether Apple's shift to the same Intel architecture used by Microsoft Windows will change the security posture of Mac systems.

Let's settle this debate.

No.

Changing CPU architectures will have absolutely effect on security.

Switching to Intel will make it easier for game developers to port their code, which will lead to more games available for the Mac. This, combined with the ability to dual-boot to Windows and eventually the ability to run Windows apps through virtualization, makes the Mac platform more appealing to consumers, which will probably lead to an increase in Apple's market share. This could lead to more malware creators taking an interest in the Mac platform, which would lead to more security holes in Mac OS X being exploited (which is not the same as more security holes existing).

Re:Stupidity

[Anonymous Coward]

I think you underestimate the importance of assembly language when coding exploits. There are plenty of crackers out there who know x86 ASM. There are *far* fewer who know PPC ASM.

You have to make the initial exploit to get "in." Once you are in you can use most standard unix libraries to do whatever you want. The hard part with PPC was finding someone who knew how to code the inital exploiit and the carefully crafted shellcode (with no null bytes, etc.). With Mac moving to Intel this part is MUCh easier for the people who know x86 ASM.

Re:Stupidity

[suv4x4]

Let's settle this debate.

No.

Changing CPU architectures will have absolutely effect on security.

The FAQ says that people frequently get modded insightful just because they seem confident, and apparently you prove them right.

The truth is the Intel processor is a lot more prone to buffer overflow attacks, which is what most exploits on Windows are based on. This is why the no-execute command was introduced in later chips but OSX doesn't take a lot (if any) advantage of it.

Also don't forget: most hackers have self-assembled Intel/AMD machines... that certainly counts.

Re:Stupidity

[CODiNE]

You mentioned avoiding null bytes, I seem to recall reading that on PPC that's much harder to pull off because of many RISC ops tend to have a byte of null padding that smaller CISC ops don't need. So besides having to learn a new asm, its also much harder to exploit... PPC did have a real advantage here.

Re:Stupidity

[Have Blue]

The truth is the Intel processor is a lot more prone to buffer overflow attacks

Bullshit. Buffer overflows are a software problem and have nothing to do with the CPU. The PowerPC would have been just as vulnerable, when running identical code.

And building your own PC teaches you absolutely nothing about discovering vulnerabilities.

Re:Stupidity

[ImaNihilist]

And building your own PC teaches you absolutely nothing about discovering vulnerabilities. Sure it does. It teaches you that all systems, regardless of CPU and OS, are vunerable to static electricity. Thus, the best "hacks" are to break into someones house with a ballon, find their PC, open it, rub the ballon on their head, and then start touching the motherboard.

Re:Stupidity

[morgan_greywolf]

What the parent poster is trying to say is this:

If you have a hand-build Intel or AMD box, what chip do you have the most access to? The chip that's in your box! If you're building and trying out exploits that use fuzzing techniques, the best way to do that is with your own equipment. It gives you a playground with which you can run the target OS and/or app in a debugger and watch what happens in realtime when you send different types of data.

So in that respect, you gained a little bit of security through obscurity by running on PPC. Now that Macs are running Intel, all bets are off -- these same crackers can now just run Mac OS X on their own box and they've got they're own playground even without having a Mac.

Re:Stupidity

[Aqua OS X]

"Switching to Intel will make it easier for game developers to port their code, which will lead to more games available for the Mac."

Actually, no.

For the time being it means developers must make universal binaries of games. Many Mac game developers have noted that ports will have increased development times for the next few years.

Porting will speed up when PPC hardware is irrelevant and Intel only builds are acceptable.

Re:Stupidity

[suv4x4]

Bullshit. Buffer overflows are a software problem and have nothing to do with the CPU. The PowerPC would have been just as vulnerable, when running identical code.

PPC makes it much harder (thought not impossible) to run code after overflow since it'll clear the stack.

And building your own PC teaches you absolutely nothing about discovering vulnerabilities.

I'm saying they have (hacked) OSX compatible machines, where previously they didn't.
The fact they are self assembled is just because they are cheap (which Apple computers are not).

I wish people don't just jump to quick conclusions and call "bullshit" without thinking through.

Re:Stupidity

[neonstz]

Switching to Intel will make it easier for game developers to port their code, which will lead to more games available for the Mac.

No. Most, if not all, games today are coded in C/C++ (with maybe a tiny bit of assembler). The problem with porting games to the Mac is not the CPU instruction set but the available APIs. There is no DirectX on Mac. In addition many games are using 3rd party libraries so these have to be available for Mac too.

Re:Stupidity

[Anonymous Coward]

As others have said, you aren't totally correct:
1) architectures with variable-length instruction words are easier to exploit since it is easier to write code sequences which don't include null bytes
2) changing architectures will have essentially no effect on ease of portability of existing applications. As has been pointed out already, portability has more to do with API than architecture (in almost all modern code, endian is the only aspect of architecture which effects the architecture-dependent side of portability)

Re:Stupidity

[Phroggy]

I didn't say that switching to Intel has made it easier, I said it will make it easier; I expect to start seeing Intel-only games pretty soon, while other apps will be universal for a long time.

Re:Stupidity

[Ulrich Hobelmann]

PPC makes it much harder ... to run code after overflow since it'll clear the stack.

Clear what stack? The only meaningful difference between PPC and x86 regarding buffer overflows is that PPC has more registers (including a link register which won't be saved by leaf procedures), and that the x86 CALL instruction pushes its value on the stack.

A buffer overflow would simply overflow some buffer, and be engineered so that it will overwrite the stack frame's return address to call some other code (which is also in the overflowed buffer).

Now on Intel every procedure has a return location on the stack, while on PPC only non-leaf procedures do, but since all computation happens in the context of *some* call stack, there will always be a parent procedure that has a return value that just waits to be overwritten.

I'm not sure how PPC can "clear" the stack, or with what purpose.

Re:Stupidity

[Anonymous Coward]

Actually, stupid, x86 is more succeptible. E.g., for string overflows, try and write a non-trivial piece of code on a non-x86 architecture that doesn't contain a single null byte. Go on, try it.

Re:Stupidity

[cnettel]

On the other hand, it's easy to introduce endian dependencies in C/C++ code. Those will be a non-issue for a MacTel-only port.

Re:Stupidity

[Anonymous Coward]

Unfortunately the PowerPC wasn't checking whether the padding bits were zero. You could put in anything. Google for "Smashing The Mac For Fun & Profit" for details.

Re:Stupidity

[Jared Lundell]

Buffer overflows are a software problem and have nothing to do with the CPU. The PowerPC would have been just as vulnerable, when running identical code.

That's not entirely true. Buffer overflows are exploited at the assembly level, not at the source code level. So the point is that, even if a PPC is running the same source code, it's not running the same assembly, since it uses a different ISA.

More to the point, the simplest and most common buffer overflow attacks rely on the fact that the user stack traditionally grows down. Since buffers are addressed upwards, writing of the end of a buffer can overwrite a previous stack frame and return address. If the user stack were to grow upwards instead, this wouldn't be nearly the problem it is, since writing past the end of a buffer would result in corruption of other user variables or some unused memory, instead of changing the return address of a function.

Even though stacks growing down is really just a convention which could be changed by the compiler, the x86 instruction set supports and almost enforces that convention. The x86 push and pop instructions that are used to handle stack frames expect that the stack grows down and wouldn't work for a stack growing upward. I don't know PPC assembly, so I can't say if it does the same thing.

Put simply, it is possible to create and instruction set architecture that is less vulnerable to buffer overflows than x86 is. Whether PPC is that ISA, I don't know, but it would be possible to create one.

Re:Stupidity

[Nimey]

Perhaps I misunderstand, but isn't the whole point of RISC that its ops are smaller and of uniform size?

Re:Stupidity

[dakryx]

What exactly is shellcode for those uninitiated in the world of assembly?

Re:Stupidity

[dfghjk]

no. the whole point of risc is an instruction set that's easier to execute. that includes uniform size but not necessarily smaller.

Re:Stupidity

[strstrep]

Right. On a CISC machine, an opcode could require anything from (as an example) 1-18 bytes to encode. On a RISC machine, everything would be a certain length, say 4 bytes. Now if the specified instruction (noop for example) only requires one byte, then the rest of the opcode would be insignificant.

Re:Stupidity

[bealzabobs_youruncle]

"Also don't forget: most hackers have self-assembled Intel/AMD machines... that certainly counts."

I've built literally hundreds of PCs for myself, friends, family, co-workers and clients. I couldn't craft an exploit if you paid me too.

Re:Stupidity

[Ragingguppy]

You know its funny. Post the same argument to the wine project and they will argue no the Linux platform is more secure then windows and therefore wine will be more secure. Excuse me not when you can run all the same programs with an emulator.

In MHO I think that any project that allows programs to run the same binary code on different platforms will have that effect no matter what. The security system in Mac OS or Linux may reduce the impact that such viruses will have on the system. It won't prevent the virus from spreading. And since spreading viruses is also a problem on the Internet. I think some work shouldn't be done.

Re:Stupidity

[iabervon]

I don't think PPC is different from x86 this way, but on HP Unix machines (don't remember the CPU), the stack grew the opposite direction. This meant that stack buffer overflows of buffers declared last in their functions (which is pretty common) would overflow directly into unused stack space, rather than into the stack frame's return address. So the attacker's data would go into an area that had undefined data anyway. I've had the exact same source code (with a buffer declared too small) overwrite a local variable on Linux, while it caused part of the buffer to be clobbered by a function call on HP/UX.

The OS is limited in its choice of stack direction by the opcodes the processor has for push and pop, and the way it handles the stack when taking an interrupt (as well as calling conventions that libraries expect to use).

I don't think PPC is less safe than x86 in this way, and I doubt OS X is full of flaws that aren't exploitable on the original architecture, but it's not completely irrelevant.

Re:Stupidity

[Ohreally_factor]

I'm still not clear on how building one's own PC enters into it. What practical advantage does the system builder have over the guy who buys a system from Dell?

Re:Stupidity

[ninja_assault_kitten]

You obviously know very little about application security.

The hardware architecture has a very significant impact. This is because the number of researchers familar with x86 memory management and shell code is significantly greater than PPC or any alternative architecture.

Re:Stupidity

[dorkygeek]

Oh c'mon, how to understand is this?!! Kids who build their own machines are l33t. Further, h4x0rs are l33t. By the virtue of transitivity, people building their own boxen are l33t h4x0rs.

Re:Stupidity

[TheRaven64]

OpenBSD is also close to immune to this kind of attack. On OpenBSD, the address immediately before the return address on the stack has a canary value stored in it. This is checked before returning, and if it has been modified then the program is terminated. To prevent the attacker being able to write just around the canary there are two additional protections:

1. The canary is a random value. This means that you need to be able to execute arbitrary code to determine its value, and if you can do that then you don't need this kind of exploit.
2. There is a randomly sized gap between the canary and the rest of the stack frame, so even if you know the value of the canary it is almost impossible to determine where you should write it, and where you should write your fake return address for the exploit to actually work.

Re:Stupidity

[Zwaxy]

Wikipedia says:

A shellcode is a relocatable piece of machine code used as the payload in the exploitation of a software bug which allows an unauthorised user to communicate with the computer via the operating system's command line as a result of exploiting a vulnerability in software running on the machine. Normally stored as a null terminated string, it cannot contain null characters.

Re:Stupidity

[LO0G]

There are processor architectures that make stack overflows orders of magnitude harder. For instance, processors with a grow down stack architecture are way easier to exploit than processors with a grow up stack architecture (grow down means that a forward memory copy can overwrite the return address thus enabling the attacker to control the return address, that's a classic buffer overflow).

There are other processor features that make stack overflows harder, NX being a classic example (also mentioned above). The processors calling convention can also help - if your processor operates with three stacks, one for parameters, one for local data, the third for data flow, it renders the return stack immune from overflow of local data buffers, and mitigates the damage that can be caused by an overflow.

So yes, buffer overflows are a software problem. But the damage that they can cause is strictly a processor architecture issue.

Re:Stupidity

[petermgreen]

imo porting windows-mac universal binary should be easier than porting windows-mac powerpc without using an intel mac.

If you port windows->intel mac->powerpc mac then you can seperate out troubleshooting the mac issues from troubleshooting the endian issues.

Re:Stupidity

[Firehed]

Offtopic, I know, but shouldn't people that are smart enough to know ASM, (of any architecture), then take that knowlege to exploit software, and turn that exploit into something that can do any number of arguably-useful things be doing something that HELPS society? The real hackers here (not the script kiddies) are among the technological elite, yet they waste their talents to do things that are illegal, immoral, and really Goddamned annoying.

Re:Stupidity

[Durandal64]

While it's true that you do have to have a shell code to make an exploit (at least of the buffer overflow variety, of which virtually every one of these fixes was), the simple fact is that shell code for both x86 and PowerPC / Mac OS X is readily available. Once you have that, it's a simple matter of making C do the requisite magic to insert the code into the vulnerable program. Unless a particular exploit demands a particular kind of shell code (i.e. the buffer is exceedingly short), you should be able to use one shell code for just about anything.

And crafting a code with no NULL bytes isn't any easier or harder on PowerPC than it is on x86. On PowerPC, it's a matter of finding out which bytes in an instruction are reserved and can be changed. Or just putting dummy operations in the code to avoid having to put a zero value in one of the registers. That kind of thing isn't very difficult for someone with x86 assembler experience to pick up. (Possible sources of confusion might be PowerPC's lack of a real program counter register or the fixed stack frame size, but that doesn't really factor in when it comes to writing a shell code, and it can even make inserting that code into the process at the right offset easier in some cases.)

The basic fact of the matter is that switching architectures doesn't magically create software vulnerabilities. It's still up to software writers to not do stupid things like copy a variable-sized byte stream to a fixed-size buffer with no bounds checking or run the process as root when it doesn't need to be. A buffer overflow is still a buffer overflow, regardless of the architecture it's on.

Re:Stupidity

[Idaho]

You mentioned avoiding null bytes, I seem to recall reading that on PPC that's much harder to pull off because of many RISC ops tend to have a byte of null padding that smaller CISC ops don't need. So besides having to learn a new asm, its also much harder to exploit... PPC did have a real advantage here.

No. You just need to write an encoder/decoder, which itself does not contain ops containing nulls, and which will encode (and decode) any string of assembled binary code into one that does not contain nulls.

Now you're gonna say "yes, but that's an awful lot of work". Indeed. However, at least for x86 there are kits that you can just download (metasploit, etc.) and be done with it. Nothing hard about that. It's a matter of time before someone will construct something similar for PPC.

Re:Stupidity

[nathanh]

Let's settle this debate.

No.

Wow, well I'm glad you settled the debate.

Unfortunately you're wrong. Many kinds of exploits rely on assembly language to effect their "magic". Changing the underlying CPU architecture will affect the security landscape by opening the doors to experienced x86 exploit writers and their existing techniques.

Switching to Intel will make it easier for game developers to port their code,

It's amazing that you can (correctly) recognise that the Intel CPU in the Mac will make it easier to port games, but you can't recognise that it will also make it easier for exploits writers to port exploits. The CPU isn't 100% of the story - the OS and the applications and even the high-level language (Objective-C) all play a part - but the CPU is still a key factor.

Re:Stupidity

[raddan]

Not necessarily. Some architectures allow you to mark data as either writeable or executable (aka, "W XOR X"). This feature exists on Alpha, Sparc, AMD64 (to name a few), but not on i386 until recently. With regard to the current debate (PPC vs. i386), I think it's a moot point, because, unless I'm mistaken, this feature doesn't exist on PPC either. Of course, the OS has to know that feature is there and use it, and I don't think either Windows or the MacOS do this either.

Re:Stupidity

[Anonymous Coward]

I imagine the point is that the PPC memory space is riddled with nulls, so getting to the overflow in general would be harder.
Not just constructing the execution code.

Re:Stupidity

[Listen Up]

This, combined with the ability to dual-boot to Windows and eventually the ability to run Windows apps through virtualization, makes the Mac platform more appealing to consumers, which will probably lead to an increase in Apple's market share.

Already done:

http://www.parallels.com/en/products/workstation/m ac/

Our company is already using Parallels as part of our full-time Java development and support. It is excellent product.

Re:Stupidity

[prockcore]

Clear what stack? The only meaningful difference between PPC and x86 regarding buffer overflows is that PPC has more registers (including a link register which won't be saved by leaf procedures), and that the x86 CALL instruction pushes its value on the stack.

Wrong. The PPC stack grows the opposite way.. you overflow a buffer on PPC and you're writing into unused stack space, you overflow a buffer on x86 and you're overwriting the return address of the function.

I don't have any idea what the GP means with the "clear the stack" thing though.

Re:Stupidity

[Ulrich Hobelmann]

The PPC stack grows the opposite way.

Ahuh. Would you then care to explain why on PPC any typical gcc-compiled function decrements the stack pointer on function entry and re-increments it when it's done, just like on x86?

Re:Stupidity

[epee1221]

It's also not a complete fix because it still doesn't deal with the problem of overwriting a return address stored on the stack.

What purpose?

[samkass]

What purpose would publishing the details on his site serve, other than as a kind of security vulnerability "first post!" type of thing?

Re:What purpose?

[Phroggy]

What purpose would publishing the details on his site serve, other than as a kind of security vulnerability "first post!" type of thing?

In theory, it's possible that black-hats have already discovered the flaw, and will exploit it without telling anyone. If they've already figured it out, then releasing details to the public won't make the situation significantly worse. However, public embarassment will prompt the company to release a fix more quickly.

I'm not saying I agree with this theory.

Re:What purpose?

[flooey]

What purpose would publishing the details on his site serve, other than as a kind of security vulnerability "first post!" type of thing?

The theory is that a policy of reporting security vulnerabilities to vendors and then revealing them publicly after a reasonable amount of time, regardless of if a patch is available, will encourage vendors to patch holes more quickly (since they know they're working against the clock). Of course, there are debates about whether this is effective, whether it's a good thing overall, and what constitutes a reasonable amount of time.

Re:What purpose?

[lancejjj]

Purpose? Easy... he makes money by promoting himself.

If you check out his web site, it seems that he's trying to maximize advertising revenue. Not only does he have many ads, he also has many Amazon referal links. In addition, he is directly selling advertising:

From his website:

Want to advertise on the Security-Protocols website?

Below are our rates:
Banner Advertising:
10,000 impressions = $75
20,000 impressions = $135
30,000 impressions = $180

Re:What purpose?

[Catbeller]

then the test of this is the presence of exploits, and soon. if none arise, then something is amiss in the calculations of risk.

Re:What purpose?

[Phroggy]

And if none arise even after the vulnerabilities are made public..?

Re:What purpose?

[Catbeller]

Then apparently Apple has divine protection, or the exploits are worthless. Someone would have used them by now, even if just to be the first to succeed.

Re:What purpose?

[flobberchops]

Banner Advertising: 10,000 impressions = $75 20,000 impressions = $135 30,000 impressions = $180 Slashdotting = Priceless

Re:What purpose?

[Anonymous Coward]

So why can't Apple pay him a sum and make him sign an NDA.

Re:What purpose?

[Anonymous Coward]

I'm surprised people still take this guy seriously. He's _not_ a security researcher, in fact a browsing of the bugzilla archives will uncover lots of "bug reports" and "vulnerabilities" that are simply wrong. Check this out (won't work from slashdot, copy and paste into a new tab/window):

https://bugzilla.mozilla.org/show_bug.cgi?query_fo rmat=specific&order=relevance+desc&bug_status=__op en__&id=303433

Read through it and you'll see the guy is a complete hack. He even issued an advisory when he didn't even understand the kind of overflow. ... posting from work so I'm AC for now ...

Re:What purpose?

[JM Apocalypse]

Hah! If I made those rates I'd be a millionaire.

Relativity

[ImaNihilist]

Good thing I use Microsoft® Windows XP so I don't have to worry about things like this.

Re:Relativity

[Anonymous Coward]

I thought the obvious sarcasm in that post was amusing. I would have given you a +1 funny. Apparently there is an overzealous moderator out there who needs a humor injection stat.

Re:Relativity

[Golias]

Whoever modded you down "Troll" has obviously not heard of sarcasm.

Anyway. The difference between Mac OS X and XP can be summarized thus:

Every time a potential breach of OS X security is discovered, it's front-page headline news on Slashdot.

If a new actual virus or worm comes along for Windows, making it ever more sure that you still can't even put a new Windows box online to download patches until after the patches you need are already installed... it's business as usual.

Windows users concerned about they penis size go on chanting "B B B But that's only because the Mac is less popular, so nobody bothers to write malware for it. Wait until the Mac gets more popular, then you'll be in a world of hurt!!!1!"

Whatever. The Mac is probably never going to see double-digit market share, and even if it does, it's still vastly more secure than Windows is, and you all know it. So there's no need to worry about such a scenario ever happening.

So I use Macs.

If the market dominance of Windows has anything to do with Macs being relatively free of haX0r attention, then I just gotta say to all you stubborn Windows users out there:

Hey man, thanks for taking one for the team.

Re:Relativity

[Haeleth]

Hey man, thanks for taking one for the team.

You can thank me when I've actually taken one. I've been a Windows user for going on 15 years now, and I still haven't ever been hacked, rooted, afflicted with spyware, or even infected by a single virus of any sort.

I wonder what I'm doing wrong...

Re:Relativity

[ImaNihilist]

Then how the hell are you posting this message? Let's look at this seriously. The probability that you have never been, "hacked, rooted, afflicted with spyware, or even infected by a single virus of any sort" in 15 years of using Windows is (or ANY platform for that matter), effectively, zero. Come on. No spyware? Be realistic. I'm a Windows user too, but let's be realistic. Unless today is the first day you put your computer on the internet, what you say is impossible.

Re:Relativity

[Anonymous Coward]

I have a friend who keeps trying to convince me he's never had a problem with Windows. Every time he does, I have to remind him of that time I was at his place when his XP box was rooted and netstat showed thousands of open connections.

Now don't get me wrong, I'm not trying to associate you with this behavior, I just think it's funny how he always conveniently forgets that whenever we talk about Windows "security."

Re:Relativity

[CaymanIslandCarpedie]

Apparently your not visiting enough warez and shaddy porn sites. Get with it man! ;-)

Re:Relativity

[lubricated]

I've been a Windows user for going on 15 years now, and I still haven't ever been hacked, rooted, afflicted with spyware, or even infected by a single virus of any sort.
That you know of.

Re:Relativity

[BasilBrush]

15 years? Child. Yes in all probability you have been "hacked, rooted, afflicted with spyware, or even infected by a single virus". You just haven't noticed.

Re:Relativity

[skinfitz]

Every time a potential breach of OS X security is discovered, it's front-page headline news on Slashdot.

...and every time an actual breach is discovered, it oddly never appears on the front page.

Weird huh?

Re:Relativity

[Wordsmith]

It most certainly is possible. I won't go as far as the grandparent, but close. I've never been -harmfully- afflicted by being hacked, rooted, or infected with a virus or spyware. I've almost never run into any of those at all - but once every couple of years something crops up.

I've (very) occasionally caught a virus present on the machine before it was ever executed or did any harm. I've (very) rarely wound up with spyware - but nothing major, and nothing that couldn't either be uninstalled via its own well-behaved uninstaller or removed easily via something like adaware.

Why? Because I don't run or install software if common sense says the source might be shady. The one or two spyware incidents I've had were with semi-legit software - it probably told me in a Eula all about the nasty reporting it wanted to do, and I clicked through - that, as spyware goes, was relatively benign.

Now my old roommate's machine, with the same basic setup, was another story. It was amazing she could move the mouse with all the crap going on in the background from various malware. Different computing use habits, I suppose.

Re:Relativity

[badstate]

it's still vastly more secure than Windows is, and you all know it.

Actually, I don't know it. Care to offer some proof?"

Re:Relativity

[NutscrapeSucks]

Good job being a prick and getting modded up for it.

But just rhetorically, are you 100.000% positive that your Mac hasn't been rooted? Absolutely 100%? Running tripwire scans ain't exactly normal practice.

Re:Relativity

[toddestan]

It's not that hard if you know what you're doing and most importantly, use your common sense. I can't make the claim that the parent did, as I did get a virus from a floppy disk back when Windows 3.1 was all the rage, but I can say I have managed 10 years without anything nastier than a tracking cookie on my Windows boxes.

Re:Relativity

[steeviant]

Uh huh, so lets phrase that a different way... you mention that you caught viruses on the machine before they could execute. Unless you manually check all the instructions before they reach the CPU then this indicates pretty clearly you'd be running virus checking software. You also mention the need to use adaware from time to time.

So to get this straight, you run an operating system that has so many security problems that you need to run at least two other programs just to make sure that you aren't infected by anything. At least one of those programs is an intensive application that has to scan every potentially harmful file before it can be used.

Despite having effectively ended up with a less powerful computer with less memory, and still having to very carefully modify your behaviour while using your computer because of the OS vendors poor security practices you're still defending their operating system (and effectively their reputation). Bizarre.

And people say Apple and Linux fans are zealots.

Re:Relativity

[Wordsmith]

"So to get this straight, you run an operating system that has so many security problems that you need to run at least two other programs just to make sure that you aren't infected by anything. At least one of those programs is an intensive application that has to scan every potentially harmful file before it can be used."

First of all, neither of those applications is intensive or running all the time. I use a virus scan on executables before running them; I don't leave it doing live monitoring, because that's a waste.

Second of all, can you think of an operating system for which those types of precautions aren't a good idea? If I was using a Mac, I'd feel nice knowing that there've been no widespread viruses and little spyware, but I'd still check for them from time to time. It's just good practice.

Re:Relativity

[arminw]

.......Why? Because I don't run or install software if common sense says the source might be shady......

The problem is, unless the right protection software is already on your computer, you'd never know whether a rootkit ala Sony isn't running on your system. The makers of botnets don't want to mess up your computer, but just use it occasionally for their own nefarious purposes, without you even becoming suspicious. Because most Windows users run as admin and thereby have full access to every spot on the HD, also means that any code they may pick up somewhere, either purposely or by someone's stealth, will have free reign of the ENTIRE computer. On Macs that is not the case and that alone makes Macs more secure. Malware may mess up a user account, but there is no way it can imbed itself so deeply in the system so even the best experts can't eradicate it. If it were so easy to infect Macs, someone would have done it already, if only for the bragging rights that they managed to infect even a few hundred Macs, not the thousands or even millions of Widows machines that are still being hosed by old, well known malware, because their users have not taken the extra effort needed to protect their computers. Malware that warns the users by asking for a password isn't really a danger to even mildly knowledgeable persons. Any user should and could know that a picture music, e-mail or other file shouldn't ask for an admin password to be accessed.

Re:Relativity

[steeviant]

"First of all, neither of those applications is intensive or running all the time. I use a virus scan on executables before running them; I don't leave it doing live monitoring, because that's a waste."

Right, so you don't really check for viruses, because in Windows that malware could be hiding in an MP3, a WAV, a WMV, a DOC or a JPG just to mention a few, viruses don't just hide in executables these days you know.

Since you've indicated you don't run a resident scan and only check executables, I can deduce that you're not really qualified to comment on whether your computer is riddled with malware or not, which pretty much makes any further discussion on the subject more pointless than an upside down bed of nails.

Re:Relativity

[klez23]

kinda interesting that those actual exploits you dug up were two years old.

love,
fanboy

Re:Relativity

[OptimusPaul]

I know you said rhetorically... but I had to answer, I don't know about any other Mac users, but I have no clue if my Mac has been rooted or infected with anything. This shit scares the crap out of me, and to be on the safe side I just get a new Mac every month or so and burn the old one. You may say I'm crazy, but I don't want "Malware" on my computer, shit I don't even like having tupperware in the house, who knows what's it's doing to my kitchen.

Re:Relativity

[Anonymous Coward]

"Right, so you don't really check for viruses, because in Windows that malware could be hiding in an MP3, a WAV, a WMV, a DOC or a JPG just to mention a few, viruses don't just hide in executables these days you know."

Yeah, I know. But malware in those files are even easier to avoid. Use VLC Player, OpenOffice, and other alternatives, and turn off the preview pane in explorer. I can attest that there are a few Windows users out there that can use the OS and avoid malware. It's entirely about computing habits. Windows has a shit-ton of security holes, to be sure. But you can learn the pitfalls of the system and avoid them, despite what the headlines and summaries here would have you think.

On the other hand, if you have to put forth that much effort into learning a system, I think learning a Linux-based OS might be the better move.

BTW, please stop using the terms malware and viruses interchangably. They aren't. Viruses replicate themselves.

Re:Relativity

[Ohreally_factor]

How does one check for non-existent viruses?

Re:Relativity

[steeviant]

Viruses are a subset of Malware, Malware = MALicious softWARE. I would argue that there are an extremely small subset of Viruses which aren't malicious (at any rate they're not what I'm talking about), and an even smaller subset, diminishing to the point of zero, which aren't software.

All malware are not viruses, but all viruses can be considered malware.

Re:Relativity

[Achromatic1978]

On my latest reinstall - something I do do regularly, because I install a huge amount of software, and remove it (I shouldn't have to, but that's another story) - I decided my philosophy would be this:

Stuff I had to have, each and every day. Stuff that was core to what I did. As well as AdAware and SAV Corp Edition - would all be installed on my laptop. First thing I would then do is install VMware, and make up another installation of XP where anything irrelevant/occasional use/ 'possibly shady' would end up installed. It runs happily, as the laptop is a 2.0GHz Pentium M, with 2GB of RAM (I give the VM 1 gig RAM), and my 'base' is far cleaner.

Re:Relativity

[Anonymous Coward]

What the flying fuck has that to do with anything?

"You're not allowed to point to historical events! Only brand new ones!"

Fucking fanboy. Starts stomping his foot and crying, throwing a tantrum when anyone dares point out an imperfection in his beloved Mac.

Re:Relativity

[Golias]

Wow. That was the best you could do, combing through past articles over a two-year span.

A virus which requires telnet to be on (it's off by default), another that requires ssh to be turned on (ditto), and a third which requires physical access to the machine.

All of which were hyped up on slashdot as if Mac users actually had a reason to be worried, when almost all of them did not.

Thanks for proving my point.

Re:Relativity

[Whiney Mac Fanboy]

love,
fanboy

Hey! At least you admit it :-)

None of the other fanboys apart from you & me do!

Re:Relativity

[squiggleslash]

Because most Windows users run as admin and thereby have full access to every spot on the HD, also means that any code they may pick up somewhere, either purposely or by someone's stealth, will have free reign of the ENTIRE computer. On Macs that is not the case and that alone makes Macs more secure.

Most Mac users run as admin too. While it's slightly harder to access the entire hard disk in the Mac's version of admin, key areas such as /Applications can be accessed and modified as an admin user without further authentication.

There are some ridiculously stupid aspects to certain subsystems of Windows that create big holes (ActiveX springs to mind), but while I don't like ordinary users being "admin" either, the fact is 99% of Mac OS X users are admin just as 99% of Windows users are, so this is an area OS X most certainly isn't more secure than Windows. Most OS X users are admin because:

- The initial account you set up during the installation process is an admin account

- You're encouraged to treat it as your default account, given it's based upon the name you enter when registering Mac OS X

- Mac OS X has no manual, and no messages are presented, or warnings given, suggesting you should be using a separate account for your day to day use.

Re:Relativity

[shish]

To balance the complainers I should throw in a "me too", and add in that the only time *any* of my boxes have been broken into was when one of my users set a weak password on the linux server...

As pointed out, it's pretty hard to prove a lack of infection; but I've never had any computer problems I couldn't find the source of, and tcpdump on the router never shows anything suspicious~ (except the time mentioned above, when the shell server tried to contact an IRC server)

Re:Relativity

[nsayer]

I've (very) occasionally caught a virus present on the machine before it was ever executed or did any harm. I've (very) rarely wound up with spyware - but nothing major, and nothing that couldn't either be uninstalled via its own well-behaved uninstaller or removed easily via something like adaware.

There is no cannibalism in the British navy, absolutely none, and when I say none, I mean there is a certain amount. More than we would care to admit. Jenkins! No!

Re:Relativity

[dioscaido]

I dunno. Now that Mac's popularity and attention is starting to increase, they are starting to have quite a few vulnerabilities. XP's 'patch tuesdays' lately only patch a small handful of issues, while OSX's patches as of late have surprisingly big, patch more vulnerabilities than I can count with my fingers and toes put together.

Re:Relativity

[SilentChris]

Slashdot's methodology in Mac vs. Windows XP security posts has nothing to do with Windows XP users being "used" to a buggy system. It has to do with Apple marketing's misguided attempts to sell the machine as more secure. (See http://www.apple.com/getamac). When you SAY your machine is more secure than the other guys, you naturally invite comparisons.

For example, Microsoft routinely touts the security of their server OSes. So everytime one is launched, or a new SP comes out for them, Slashdot posts abound, hacker contests get held, and everyone tries to crack the box. When they do, it gets more posts on Slashdot. When they don't, it's quietly shoved off to the side.

Notice that Microsoft very rarely touts the security of Windows XP -- despite the fact that they're have almost identical codebases. They're marketed as completely different from the server OSes. Apple doesn't do this. Their desktop boxes, they claim, are as secure as their servers. Right or wrong, that's a dangerous claim o make.

The reality is that software is software, and people make mistakes coding software (including Apple). Hackers like having a large number of machines to attack, so as Apples become more popular, more vulnerabilities are going to pop up.

I buy my family Macs, but it has nothing to do with the security of the machine. I buy them because Spyware hasn't really targetted the platform and the kids in particular tend to download P2P apps. I'm not so foolhearty as to believe "Windows users take one for the team". We all do.

Re:Relativity

[skinfitz]

You're not doing the:

"B B B But that's only because the xxx service was turned on and I dont use that service (well I do really but I say I don't) so that means the exploit / virus / trojan doesn't count !!!1!""

...are you?

Re:Relativity

[arminw]

.....Mac OS X has no manual, and no messages are presented, or warnings given, suggesting you should be using a separate account for your day to day use......

That is indeed a sad security oversight on the part of Apple, which I hope they will fix in the next iteration of OSX. I have set up a good number of Macs for people and always make a normal user account that doesn't have admin privileges. Even so, the default OSX admin account doesn't automatically allow the user to do do anything he/she wants to without entering their password each time certain areas of the system need to be written to.

A standard, non-admin user account on OSX allows the normal running of every program, which unfortunately is NOT the case in Windows. Many Windows programs hail back to the single user days, when there was only one user who had total access to the computer. It was/is after all a PERSONAL computer. The UNIX heritage of OSX started right at its inception as a multi-user, networked system in academic and scientific settings. The multi-user and networking capability of Windows was added as an afterthought. This is why there are still the vestiges of single user, insecure programs that will not work properly, unless the user is granted full, unfettered access to the whole computer. This is not DIRECTLY the fault of MS, but by the fact that they allow their software developers to still get away with this laziness by giving all users full access to the computer by default. All their promises of better security in the long promised VISA will be only so much hot air, if they still allow programs to be made which will only work in an admin account. Of course if they do fix this, many, if not most existing programs will break and will need modifications. Up until now MS has always chosen backward compatibility over security, so cross your fingers, but don't hold your breath that this will change.

Re:Relativity

[Golias]

You don't really know what "off by default" means, do you?

For the telnet or ssh exploits to work, you need to go out of your way to turn those services on. Most Mac users will never turn either of those on, therefore would not be impacted by these exploits.

Re:Relativity

[skinfitz]

Actually it's evidently you who doesn't know the difference between a service and a protocol handler.

Re:Relativity

[Anonymous Coward]

Heh, you might want to run ad-aware or spybot. You'd be surprised what it will pick up.

Your Win box has been compromised many times and is running processes that you don't know about at this very moment.

Sorry you're so naive.

Re:Relativity

[dave1212]

Haha, I know, eh. What a maroon.

I especially liked the part about using a piece of spyware's own uninstaller and trusting it to do what it says. Wow.

Re:Relativity

[Anonymous Coward]

nice. fuck that ms fanboy nutscrape. talk about a waste of bandwidth.

Re:Relativity

[2nd Post!]

If it is evident, please explain then. To my knowledge my Mac has no ssh or telnet servers operational, out of the box, so that any requests on those ports do nothing. It is as if you made a http or ftp request when neither of those servers are operational as well.

So what is the vulnerability you are exposing when I have no servers/services operational?

Re:Relativity

[skinfitz]

Would you like me to send someone around to read the links to you?

what a ego

[falcon5768]

Ferris told InfoWorld he is considering releasing the details of the unpatched holes on May 14 on his Web site.

I.E Im a giant penis and I would rather expose vulnerabilites that could potentially damage systems rather than wait for the coders at Apple to make sure everything is accounted for and put into a patch that wont effect other things that I didnt forsee.

Its one thing to find holes and tell Apple and people you did, and send the info to Apple. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.

Re:what a ego

[Anonymous Coward]

You just don't get it,

I'd explain but you won't read it. (as you obviously never have in the past).

Re:what a ego

[0racle]

Yet when MS, Oracle or Cisco ask that security researchers hold back found flaws until they can fix them Slashdot gets all up in arms about them trying to stifle researchers.

I guess Apple is still small enough that they can do no wrong.

Re:what a ego

[falcon5768]

no I feel the same way there too. Its not stifling research its preventing exploits from happening before they are ready to patch them. All releasing these things does is cause a exploit to happen much faster than a patch can be made to fix it.

Now if the SAME people coded a patch AND released the exploit, then I wouldnt feel the way I do. But they arnt, they are just feeling smug in proving something doesnt work while not helping in any wya to address it.

Re:what a ego

[giorgiofr]

But you need to put a bit of pressure onto the company, otherwise they will wait forever because after all, it's not like anyone's gonna know about this. Meanwhile blackhats discover and exploit the vuln. Zero-days would look god-sent in comparison.

Re:what a ego

[Anonymous Coward]

Damn, you beat to me to easiest +5 insightful post imaginable. As soon as I read the headline I knew your post would rear its obvious head in response to Apple apologists.

Re:what a ego

[falconwolf]

I.E Im a giant penis and I would rather expose vulnerabilites that could potentially damage systems rather than wait for the coders at Apple to make sure everything is accounted for and put into a patch that wont effect other things that I didnt forsee.

Its one thing to find holes and tell Apple and people you did, and send the info to Apple. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.

You may not like someone releasing details about security holes before a vender does but I look at as allowing users with the ability to correct a problem to know about it to begin with. I'd rather have the info so I can take some sort of action to protect myself rather than have only some miscreaton or vandel know about it. It's not knowledge that's dangerous it's knowledge that only a few have that is dangerous, a twist on open source's idea of many working on something.

Falcon

Re:what a ego

[kfg]

I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes . . .

You're a very confused person, ain'tcha? I've tried three times to formulate a reasonable response to the above; and failed due to the lack of reasoning in the source material.

I've been pretty much left with, "Wa'choo talkin' 'bout, Willis?"

. . .and make everyones life misserable.

Ignorance is bliss I guess. Don't worry, be happy. Just close your eyes and make the bad guys disappear. Every two year old knows that trick.

Funny how three years olds forget it, isn't it?

KFG

Re:what a ego

[mindstormpt]

I remember reading he warned Apple of some vulnerabilites in January. If these are still the same ones, then he already waited too long.

Re:what a ego

[PhrackCreak]

Puh-lease.

1. Falco5768 is not slashdot.
2. There are at at least a few articles which are critical of Apple's security policies.
3. Apple has not actually stifled this person. They patched something. They may have failed to patch other holes. I hope they will work as quickly as possible to patch all exploits they know.
4. Note that the grandparent post is not yet modded very highly.

In future posts, please do not clump everyone on slashdot in to one unified entity.
In future posts, only include actual facts instead of implied conjecture into actions that have not occurred.

Re:what a ego

[Anonymous Coward]

Let's try this to see how you feel:

I.E Im a giant penis and I would rather expose vulnerabilites that could potentially damage systems rather than wait for the coders at Microsoft to make sure everything is accounted for and put into a patch that wont effect other things that I didnt forsee.

Its one thing to find holes and tell Microsoft and people you did, and send the info to Microsoft. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.

There's a given amount of time that's reasonable - from the article it seems that he's waited a reasonable amount of time and Apple hasn't done anything about it.

Re:what a ego

[Anonymous Coward]

4. Note that the grandparent post is not yet modded very highly.

It is now.

I've never seen a post calling a "security researcher" for Windows or Linux a "Giant Penis" get modded +5 Insightful before. But that's Slashdot + iProduct for ya.

Re:what a ego

[Scudsucker]

Yet when MS, Oracle or Cisco ask that security researchers hold back found flaws until they can fix them Slashdot gets all up in arms about them trying to stifle researchers.

That's because in Microsoft's case at least, they are habitually lazy about releasing security flaws, despite the craptacular security record of their products. Sometimes they wont pay any attention to flaws until they start crashing networks all over the world.

Contrast that to Apple's record...zero viruses, zero worms, and no exploits that have led to widespread compromises in OS X systems. And Apple has been timely enough in their security patching that I'm confidant that the unfixed problems, if they actually are serious, will be fixed with the next update in the next month or so.

I guess Apple is still small enough that they can do no wrong.

I love it when these dicussions pop up, because there's always some asshats who think they are so clever for pointing out "Slashdot groupthink", when they are actually the pot calling the kettle black.

Re:what a ego

[Ohreally_factor]

In future posts, please do not clump everyone on slashdot in to one unified entity.

Yeah, we hate that.

Re:what a ego

[Anonymous Coward]

No, he isn't a giant penis, but you are a dickhead. Security advisories are supposed to be acted on within a fortnight. These obviously weren't. Full disclosure means users (like yourself, dickhead) are supposed to have a chance to defend themselves.

There is no point debating full disclosure in here, even if all you idiots act as if there is no security industry which has gone through this years ago and as if you all are some sort of security experts yourself, which it is embarrassingly obvious you aren't.

There is something endemically suspicious about a bunch of PFYs who have nothing better to do than hang out at Apple /.

Today's word is 'ingrown'.

PS. It's 'what aN ego', dickhead.

Tom Ferris

[Anonymous Coward]

Who exactly is "[i]ndependent researcher Tom Ferris" (and why was independent capitalized in the original quote)? And why should we listen to him?

Re:Tom Ferris

[rackrent]

My only experience with someone named "Ferris" who happened to know computers was someone who changed his excessive high school absences from nine times (nine times?) to 0

Re:Tom Ferris

[Anonymous Coward]

In this context i think it's important to note that Ferris Bueller used a Mac to perform that feat. Not that i think that helped him do so in some way, i just thought it was interesting.

Re:Tom Ferris

[generic-man]

He used a computer with a monochrome full-screen terminal emulator. Later in the movie I remember him using a program that reminded me very much of Deluxe Paint, an Amiga program. I don't think Bueller was a Mac guy, but his family was certainly wealthy enough to afford one of those expensive 1986-era Macs anyway. :)

Re:Tom Ferris

[Anonymous Coward]

The shooting script says Ferris Bueller was using a Macintosh in his bedroom.

52 INT. FERRIS' ROOM 52

Ferris is at his Macintosh computer. He has his record up
on the screen.

FERRIS
I wanted a car. I got a computer. How's
that for being born under a bad sign?

and

61 INT. FERRIS' ROOM 61

He's on the telephone. As he speaks he does a little
MacPainting on his MacIntosh. A Modigliani nude.

FERRIS
Cameron, if you're not over here
in fifteen minutes, you can find
a new best friend. I'm serious, man.
This is bullshit, making me wait
around the house for you.

Re:Tom Ferris

[generic-man]

Touché. I've been out-Ferris-fanned. :)

Re:Tom Ferris

[Anonymous Coward]

The nature of memory is very interesting. You had both scenes but the way your mind stored them and the intervening time resulted in certain changes (perhaps, biases) coming forth and reworking the memory. Perfect memory is one of the greater mythologies of human society.

Re:Tom Ferris

[Anonymous Coward]

There's a coincidence! I just saw this movie again recently, and I can attest that the number of absent days was changed from nine to two, not to zero.

Yeah, I know it's really important to clear that up.

extortion?

[v1]

I'd like to see Apple fix security problems as quickly as possible, but this guy threatening to release exploit information a few days after the first patch to go out after the notification? That seems like they are expecting an awful lot from Apple - certainly they want to take a few weeks to analyze their patch and make sure it doesn't break a bunch of things. Apple should not be forced to make an ill-prepared and possibly buggy patch release due to the threats of this "analyst". If he had given several months of warning I could see the justification, but it looks like he is doing this to get some publicity because he knows Apple won't rush something like this, not to the degree this fellow is demanding.

Re:extortion?

[flooey]

If he had given several months of warning I could see the justification,...

Well, the article says the vulnerabilities he's considering disclosing were reported to Apple before this patch, though when isn't specified. So it's possible Apple's had the info for some time.

Re:extortion?

[suv4x4]

That seems like they are expecting an awful lot from Apple - certainly they want to take a few weeks to analyze their patch and make sure it doesn't break a bunch of things.

No shit, eh. I wonder how it's expecting an awful lot from Apple, but when Microsoft is in the same situation we have the default thread with posts about how Microsoft is slow and sucks.

Also isn't everyone sick of having the same discussion over and over and over when someone mentions "Microsoft" or "Apple" (or both).

They'll just release the patch when they release it.

Re:extortion?

[I'm Don Giovanni]

"That seems like they are expecting an awful lot from Apple "

Well, Apple *is* advertising their security in their latest ads, so they should have no problems meeting these expectations.

Re:extortion?

[Anonymous Coward]

certainly they want to take a few weeks to analyze their patch and make sure it doesn't break a bunch of things.

You know, I hear this excuse trotted out all the time, and to be honest I think it's complete bullshit. The vast majority of vulnerabilities are simple programmer oversights, not design flaws. I can understand why a design flaw would require lots of testing, but why would a simple patch to stop a buffer from overflowing break anything? Surely anything that broke would already be overflowing the buffer and corrupting memory without the patch?

Re:extortion?

[Lauwenmark]

certainly they want to take a few weeks to analyze their patch and make sure it doesn't break a bunch of things.
Wonderful. I'm sure that system administrators will be more than happy to hear that known security breaches take "a few weeks" to be closed.

I hardly see a delay for security fixes measured in weeks as compatible with the claim of being the OS that "delivers the highest level of security through the adoption of industry standards, open software development and wise architectural decisions".

Or maybe we're supposed to believe that hackers will wait "a few weeks" to give Apple enough time to get a fair chance against them ?

Re:extortion?

[Anonymous Coward]

That seems like they are expecting an awful lot from Apple

Uhm, hate to break it to you, but Apple SHOULDN'T SHIP SECURITY HOLES TO BEGIN WITH. Neither should any other company. Apple *already* fucked up. They already fell short of expectations.

People who find security holes in products should post full details and working exploits, the moment they find them. Anything less is just rewarding incompetence.

Re:extortion?

[NightHwk1]

Oh, come on. Even the mighty OpenBSD has had vulnerabilities. It's a little unrealistic to expect every piece of software (or even just the stuff distributed with an OS) to be perfectly secure and bug-free.

Or maybe having an open-source license excuses them from your standards?

Plus, posting exploit information before sending a nice email to the developer is just irresponsible. How would that benefit anyone other than script kiddies?

Re:extortion?

[Lars T.]

Actually, people complain more about things like this (unfixed, reported more than 3 years ago). Or when there are exploits out in the wild, and Microsoft says they won't release a fix until their monthly patchday.

Re:extortion?

[arminw]

.....Well, Apple *is* advertising their security in their latest ads.....

Why shouldn't they advertise the superior security of Macs running OSX? Anybody can talk about potential, theoretical exploits. Until an actual malware shows up which is NOT based on social engineering, they should rightly let everyone know that their computers are much more secure. Here now is the opportunity of the world's best hackers to put egg all over Apple's face. NO computer can ever be made totally secure, especially against clever social engineering techniques. There are many actual real, nasty malwares out for Windows that do NOT depend on social engineering, but just connecting their box to the Internet. So far, AFAIK there is nothing like that for OSX.

Re:extortion?

[arminw]

....People who find security holes in products should post full details and working exploits, the moment they find them......

Maybe that would be OK if the hole depends on user action, such as putting in a password. Someone merely connecting a computer to the internet, opening an e-mail or going to a website should NEVER infect a computer. AFAIK all of the exploits for Macs require some kind of user action giving them an indication that something strange is going on. Any common user action should never ask for a password and without a password Malware has a hard time on the Mac.

Re:extortion?

[SilentChris]

"Apple should not be forced to make an ill-prepared and possibly buggy patch release due to the threats of this "analyst"."

And yet people do this MS all the time. Hmm...

Re:extortion?

[v1]

Possibly a very good point, but I would be interested to see the statistics of bugs found per month in windows vs bugs found in OS X, of the "remote exploit" / "remote execution of arbitrary code" variety. If you don't want people running around screaming their heads off over your bugs, it's necessary to have at least a little dilligence in trying to prevent them from happening in the first place, and I seriously question whether microsoft makes an honest effort. Not that this justifies premature release of exploit information, but I believe in that case it should be expected nevertheless.

Quicktime?

[DeadPrez]

Its all about VLC. It sometimes works kinda weird on my mactel but its a pretty good Quicktime replacement.

Re:Quicktime?

[John Nowak]

Quicktime is much more than the Player. It is a very rich API that lets you do some great things, albeit often with some suffering, as it is getting a bit old...

Even if you use VLC (I do), there's no chance of escaping Quicktime.

Re:Quicktime?

[ImaNihilist]

But what if you *gasp* really like QuickTime? It's strange, as a Windows user, that I actually like QuickTime despite the fact it constantly crashes in Windows, on websites, and is slow as crap on Windows XP. It's very streamlined and simple. I prefer it loads over WMP. The lack of draconian DRM is a plus too.

Re:Quicktime?

[LocoMan]

I personally like quicktime (even on PC) for two things. One is movie trailers. My net connection is kinda "fast" (for venezuelan standards), but it's not very constant, so I always get buffering stops on streamed media. I much prefer quicktime's way to present them (at least on the trailers in quicktime.com) where I can select the highest quality trailer, leave it leading in a tab in the background while I do something else, and then come back once it's fully loaded and watch it without interruption.

The other thing is when I'm doing 3D animations. So far no other video codec allows natively so easily to go frame by frame (left and right arrow), so I like to render quick previews in quicktime format, see it at normal speed until something pops up as wrong and then go frame by frame to see what it is.. :)

Re:Quicktime?

[ATPTourFan]

The latest version of VLC, 0.8.5, is Intel native as a universal binary. You may want to upgrade.

Re:Quicktime?

[Anonymous Coward]

>>Quicktime is much more than the Player

Yes. Like the feature they have provided for the Windows port - that it reinserts itself in the system startup even if you explicitly set it not to do that.

VLC definitely lacks that feature.

Hats off to Mac Zealotry!

Re:Quicktime?

[cosminn]

Quicktime is much more than the Player. It is a very rich API that lets you do some great things

So if Apple uses this excuse it's supposed to be all good, but in the case of MS and the EU, it's bullshit?!

Re:Quicktime?

[feijai]

Um, because Microsoft has a monopoly, and uses its API as a monopoly-propogation mechanism? How many times do we have to clue you dufuses in that certain rules ONLY APPLY TO MONOPOLIES?

Re:Quicktime?

[John Nowak]

No Mac zealotry here. I realize that Quicktime is a pain in the ass on Windows. However, the API is very powerful, and you can program some great things if you take advantage of it. Many programs do, hence you cannot escape it, even if you use VLC/mplayer/etc. Quicktime is much, much more than video playback.

Re:Quicktime?

[jbreidbord]

If I recall, this version of VLC to which you refer is not technically a universal binary but, rather, has been precompiled for Windows. http://www.videolan.org/vlc/

Re:Quicktime?

[Anonymous Coward]

Quicktime is much, much more than video playback.

It's like WMP (GUI) + DirectShow (or VfW) (API) + .AVI (container) + the codec, except with one name.

(for clarification)

Re:Quicktime?

[cosminn]

Microsoft was not found a monopoly in EU. They do have a monopoly, but legally that remains to be proven outside the US

Re:Quicktime?

[abdulla]

Now that doesn't help me with playing videos in Front Row, now does it? VLC isn't the perfect replace for all situations. Now only if Flip4Mac would go universal, that'd solve all my issues.

Re:Quicktime?

[feijai]

Your circular point being... ? The EU is presently after Microsoft in court, arguing that it should be fined a whopping sum because of unfair trade due to monopolistic status. Just because the court hasn't ruled yet doesn't mean that the EU shouldn't be going after Microsoft in a way it's not going after Apple.

Re:Quicktime?

[cosminn]

The EU is saying MS should ship an OS without WMP.
Microsoft says it's part of the Windows core, that it is part of the underalying video engine and the API is tied with the OS.

EU says that's BS, that WMP is just an app that can be removed.
Apple says Quicktime is part of the underlaying video engine and the API is tied with the OS.

So either call BS on Apple or on the EU, and while I agree MS gets special "care" becuse it's got 95% of the market, that "care" only goes so far.
k
If MS would be selling Windows without WMP, IE, Notepad, Outloo etc, it'd be like people buying Darwin.

You don't want to use WMP, IE, Outlook? Don't...If your computer would come without IE, how would you go get Firefox or Opera? (w/o booting on a live CD and installing a linux distro :-p)

For MS it would be much more profitable to sell all thost apps instead of bundling them with Windows, but it jus doesn't make sense, and right now I feel the EU doesn't make sense with some of the things they ask.

Special treatment because you're a monopoly != double standards

Re:Since I hate smug Mac users, let me be the firs

[noidentity]

"Since I hate smug Mac users, let me be the first. . .to say hahahaha hahahaha ha ha ha ha ha hahaha hah ha hahahahahahaha HA!!"

Yeah, us Mac users and our potential vulnerabilities. All the potential data I haven't lost has really cost me.

And smug people suck, no matter what computer they choose.

Open "safe" files strikes again

[noidentity]

from the updater notes: " When Safari's "Open `safe' files after downloading" option is enabled, archives will be automatically expanded. If the archive contains a symbolic link, the target symlink may be moved to the user's desktop and launched."

OK, second time this "Open 'safe' files is a lie. WHY THE HELL IS THAT OPTION STILL THERE?" I never trusted that open from the moment I first saw the checkbox. I guess that's why they put "safe" in quotes. Buy our "free" product for only $9.95!

Re:Open "safe" files strikes again

[tuxedobob]

You're right. Safe is in quotes. And that means exactly what it should. The files in question are probably safe, but you really can't be sure.

Re:Open "safe" files strikes again

[tvjunky]

Buy our "free" product for only $9.95!

Why not buy it for $18,000?

Re:Open "safe" files strikes again

[argent]

OK, second time this "Open 'safe' files is a lie.

About the fourth, actually.

I've been trying to get Apple's attention on this one for two years now.

WHY THE HELL IS THAT OPTION STILL THERE?

They figure popping up more annoying dialogs that people reflexively approve worked so well for Microsoft over the past 10 years they ought to give it a try?

Re:Open "safe" files strikes again

[argent]

The files in question are probably safe, but you really can't be sure.

If you can't be sure don't open them.

Really.

Treat all downloaded files as dangerous.

Only open them using applications that you know were designed to open unsafe files, because they are in a list of safe applications, one that either you or the OS manages. Because it's not that "these files are safe", it's "the applications we use to open these files are safe". And you can't know that if you're using a list of both safe and unsafe applications to open them with!

Re:Open "safe" files strikes again

[ioErr]

It's not so easy, removing features, even if they are unsafe. Tends to make your users whine. It's going to take a real disaster before the open 'safe' files option is removed.

Re:Open "safe" files strikes again

[aristotle-dude]

OK, second time this "Open 'safe' files is a lie. WHY THE HELL IS THAT OPTION STILL THERE?" I never trusted that open from the moment I first saw the checkbox. I guess that's why they put "safe" in quotes. It is an option that if enabled, provides novice users with an easier to use interface. Do you have a problem with a company catering to all levels of users? If you do not trust anything on the net, then disable it and quit your whining.

Is it enough? Yes.

[sootman]

Considering that there has not been one real, severe, in-the-wild, massively spread, substantial, damage-causing virus in the five year history of Mac OS X, I would say yes, the boys and girls in Cupertino are doing just fine. Thank you very much for all your hard work, and all naysaying columnists and pundits can go screw.

Re:Is it enough? Yes.

[theid0]

Thank you very much for all your hard work, and all naysaying columnists and pundits can go screw.

Please don't say that. We've got enough of them running around already without telling them to breed!

Re:Is it enough? Yes.

[0biter]

Proactivity and forward-thinking are great, and as Mac user I appreciate the concerned public contributing freely to the improvement of my OS of choice. But not since The Bird Flu Pandemic and the War on Terror has there been a more consistent media story about the imagined and unexperienced than the OSX security threats. This is simply an imagined news story about events that have not yet occurred. I would have to assume these stories exist for the benefit of the sensationalist media itself rather than the public interest.

Re:Is it enough? Yes.

[NutscrapeSucks]

I'm trying to figure out your point in the relationship to the story and why it's insightful.

Are you arguing that it's "enough" for Apple to not patch known problems? That because Apple has a good track record that they can be lax? That Apple should imitate Microsoft's policies of the late 1990s and not take "gray hats" seriously?

If so, that's a pretty stupid and reactionary attitude. I think most Mac users, including myself, are not slobbering "macz rulez" and want Apple to take an aggressive stance towards security issues in order to prevent the Windowns situation from ever happening.

Hey, some of us remember the days when Windows NT 4.0 was considered relatively immune to hackers when compared to *nix systems. Things can change if the vendor is idiotic.

Re:Is it enough? Yes.

[IamTheRealMike]

BeOS had no exploits for it despite having no security system at all (not even multi-user support). Did they do their job just fine then?

Re:Is it enough? Yes.

[sootman]

I'm trying to figure out your point in the relationship to the story and why it's insightful.

a) there was a story?
b) my comment is just inherently insightful, ergo the mods. (they don't RTFAs, either.)

In all seriousness, my comment was more a reply to the tone of the summary than any particular points is the articles. (Though I don't know why this guy is freaking out that Apple isn't work overtime to get patches out for undisclosed bugs overnight. All vendors often have gaps between when someone announces a potential vulnerability and when a suitable patch comes out. This is nothing new.)

Are you arguing that it's "enough" for Apple to not patch known problems? That because Apple has a good track record that they can be lax? That Apple should imitate Microsoft's policies of the late 1990s and not take "gray hats" seriously?

I'm going by the dictionary definition of "enough:" "sufficient to meet a need or satisfy a desire; adequate." I would say Apple's track record shows they're doing "enough" with regard to security for the most part. )I think the worst thing they've done so far wasn't even security-related--it was that buggy update that erased hard drives with spaces for the first character in their names.) That's why "enough" != "everything possible." For example: Am I eating as many vegetables as I should? Probably not. Am I eating enough to keep myself from imminent death? Since I've been eating this way for a couple decades, I'd say yes. In that sense, I'm eating "enough" vegetables.

Now, do I want Apple to become lax and sloppy? Of course not. Could they be doing more? Absolutely.* But, overall, since you could probably fit all the people who have lost data to OS X viruses in a small room, I'd say that their effort--the result of which is a handful of infections out of millions of machines--counts as 'enough.'

* While I don't think Tom Ferris should be making a big stink about Apple's turnaround time, I would very much like to see them fix whatever he found this week. I'd like to see them patch whatever holes the winner of the 'rm-my-mac' contest** used to escalate privileges. (Sure, that required a local account in the first place, but a flaw is a flaw.) Mostly, I'd like to see them have Safari's "Open 'safe' files" option UNchecked by default--I agree with others, that's an accident waiting to happen.

** nice to see he finally put up something of a postmortem. http://rm-my-mac.wideopenbsd.org/

Re:Is it enough? Yes.

[nuggetman]

BeOS had no exploits for it despite having no security system at all (not even multi-user support). Did they do their job just fine then?


No, they just had no users so there was nothing to exploit. That's why Be is no more.

Re:Is it enough? Yes.

[Anonymous Coward]

Did they do their job just fine then?

Security wise, that would seem to be the case, yes. Any more questions, Captain Obvious?

Re:Is it enough? Yes.

[Anonymous Coward]

Considering that there has not been one real, severe, in-the-wild, massively spread, substantial, damage-causing virus in the five year history of Mac OS X, I would say yes, the boys and girls in Cupertino are doing just fine.

In the entire history of computing there has never been an exploit.. that was covered with peanut butter.

Still doesn't make you invulnerable.

Re:Is it enough? Yes.

[sootman]

Wow. A flamebait mod for saying Apple is doing well and pointing out the FACT that there has not been one serious virus in OS X's five year history. Now I've seen everything.

Sue Sue Sudio

[Frankie70]

Ferris told InfoWorld he is considering releasing the details of the unpatched holes on May 14 on his Web site.


Apple will then just have to take him to court like they do with everybody else, won't they?

Re:Sue Sue Sudio

[mindstormpt]

Of course not. It's a website instead of a blog and he's not an Apple fan.

Re:Sue Sue Sudio

[Haeleth]

I thought Apple only sued people who tried to share news about their forthcoming products?

Uh-oh...

iMal®. Be owned. With style.

Confusing security dialogs. Expensive anti-virus subscriptions. Intrusive firewalls. Some operating systems make losing all your data difficult, and something as simple as having your identity stolen can take months.

iMal® just infects.

No hassle. No decisions. Simply fail to update OS X®, and sit back while iMal® installs itself on your Mac®. Because there's no anti-virus software to choose from, you can be assured that your zombie computer will be sending spam sooner than any PC ever has - and up to 4 times faster. And it's Universal. iMal® just works, whether you're using the latest MacBook Pro or an older G5 system.*

iMal®. Simply infectious.

No purchase is required. iMal® will install itself automatically before the next security patch is released. And it will share itself with all your friends, without you having to lift a finger. It's like a virus. But shiny.

* iMal® requires security features only present in the latest OS X® 10.4 Tiger®. Users of older systems will have to upgrade in order to be taken advantage of by this product.

Would it be better if they waited another month?

[ShyGuy91284]

The way I see it, they probably intend on patching the other problems, but they decided to get a decent amount done, and then release the update. Much like how Microsoft's once-a-month releases could give some time for the vulnerabilities to be taken advantage of (I recall that release cycle, I'm not sure if they are still done anymore though), if they waited for all patches to be done in this case, it may have prolonged the wait by quite a bit longer.

Re:Its been stated before but...

[Anonymous Coward]

Silly person, what's the point in doing the "omg you guyz so biased" karma whore if you're not logged in.

What about NX?

[DaHat]

You don't think that NX support within the CPU could help at all?

Sure it's not a complete solution, it is at least another layer of protection to keep users safe and is more than what they had with PPC's... provided they are using it today.

Re:What about NX?

[Anonymous Coward]

Didn't PPC already have technology like NX for a long time?

Re:What about NX?

[Phroggy]

Although this sort of mechanism has been around for years in various other processor architectures such as Sun's SPARC, Alpha, IBM's PowerPC, and even Intel's IA-64 architecture...

Not surprised

[frostilicus2]

I think that this is inevitable. Mac OS X is a desktop OS, desktop customers demand shiny new features and Apple needs to compete with Microsoft in adding such features, otherwise it will fall behind in market share. These new features make for a supremely usable OS, but it means that development is always too fast. Security flaws are invariably human logic errors, and when a lot of new code is written really fast, errors are made. Conversely, take OpenBSD, its pace of development is slow and thorough and due to its comprehensive code audit (which slows development) very few security holes are found in the code. As complexity escalates, so will the number of bugs and until Apple's workforce is replaced with androids (Which I'm sure will have a negative impact on its cool reputation) errors will continue to be made.

Although inevitable, we need not accept that there should be quite as many flaws as there are - Apple is in a uniquely privilege position over microsoft in using the unix permission system and the mature core that mach and FreeBSD provides, it must not become complacent. Increasingly, it appears that Apple is becoming sloppy - There are reports of Apple not using automated bound checking and the such. Such arrogance is inexcusable from any developer, and as Apple's popularity increases poor security will invariably become more of an issue. Its time for Apple to seriously take stock of this issue.

Re:Not surprised

[Homology]

Conversely, take OpenBSD, its pace of development is slow and thorough and due to its comprehensive code audit (which slows development) very few security holes are found in the code.

Depends what you mean by "slow", since it's a question of scope. Apple does alot of graphical userland applications, the most visible part to most users, but that is clearly not a priority of OpenBSD (unluss you want them to develop their own "KDE" look-alike). Apple development hardware drivers are limited to the limited selection hardware they support, and the binary blobs (or surce code/docs under NDA) given to them by their partners. For an open source OS like OpenBSD, development of drivers is a very big part of what they do.

Re:Not surprised

[just_forget_it]

I think that this is inevitable. Mac OS X is a desktop OS, desktop customers demand shiny new features and Apple needs to compete with Microsoft in adding such features, otherwise it will fall behind in market share.

I don't think Apple has much to worry about in the features department. It's Microsoft that has been playing a long, slow game of catch-up-to-apple for the last 20 years. Windows came out a year after Mac OS and it wasn't as good (couldn't have overlapping Windows, etc). It took ten years for Windows users to get a trash can, another six to get desktop icons that snap to a predifined "grid."

Apple's operating systems are consistently 5-10 years ahead of Microsoft in the feature category. I used to laugh at all the Windows/PC fanboys that would make fun of Apple, labelling their solutions as something for children. In 2001, the joke was on them, when Windows XP, the most kiddie, fisher-price-y looking OS that has ever existed came out. The color scheme is horrible, the OS itself is plagued with security holes which revealed that XP is merely a new, colorful dress on the same old skank.

Apple has released 4 distinct versions of OS X, Microsoft has released 1, and it looks like the next one is going to be another year still. Apple keeping up with Microsoft? What a joke.

Re:Not surprised

[Deltaspectre]

Microsoft released a version of OS X!?

No wonder Windows is suffering if they're spending so much time on OS X...

Re:Not surprised

[solitas]

Wow. I'd've modded you up if I hadn't just posted this...

--
"Any huge OS/app/whatever is bound to have inconsistencies in it - it's only a matter how badly developers lose track of what's-really-going-on-everywhere-at-once." (JLP 1998)

Re:Not surprised

[toddestan]

Apple has released 4 distinct versions of OS X, Microsoft has released 1, and it looks like the next one is going to be another year still. Apple keeping up with Microsoft? What a joke.

Actually, by my count, Apple has released 5 distinct versions of OSX. That would be 10.0, 10.1, 10.2, 10.3, and 10.4. You can even make the arguement that 10.4 PPC and 10.4 Intel should be counted seperately, making it 6.

On the other hand, I count exactly 0 releases of OSX by Microsoft.

Re:Not surprised

[The Bungi]

Yes, and all of them at the very accessible price point of $139.99!

Re:Not surprised

[yabos]

But, since the beginning OS X has been compiled for Intel anyways so you may say that there are 10 versions.

Re:Not surprised

[Achromatic1978]

How do you define a distinct version of OSX? Without trolling, I'd say that most of the feature improvements between OSX versions are incremental, with the occasional new feature thrown in. A lot like XP - SP1 offered some incremental improvements, SP2 offered new features. So why do these not get counted? I mean, just because it's not Windows XP Avocado, Windows XP SP1 Blueberry, and Windows XP SP2 Canteloupe doesn't negate the fact that there are perhaps more similarities between the 'releases' than your post otherwise admits.

But yes, the default XP theme was / is fucking horrible. :)

Re:Not surprised

[just_forget_it]

Yes, I see your point. How do you really define a new "version" anyway? My point is that Microsoft's updates are for the most part just bug fixes and upgrades of current software. Sure, things like Windows Firewall were added in SP2, but that's about it. I mean ooooo, windows movie maker upgrades to 2.0 in this service pack, wow!

On the other hand, look at Apple's features compared to XP. Does Windows have anything like spotlight? Expose? Automator? Dashboard? Sure, those could be considered "Fancy bells and whistles" but does Windows doesn't even have a calendar program. There's nothing like moving videos around your desktop while playing and having them not skip a beat because of Quartz Extreme. Now, you can get a lot of these features in Windows, but they're through third parties and not part of the OS.

Re:Not surprised

[dave1212]

Apple needs to compete with Microsoft in adding such features, otherwise it will fall behind in market share.

Huh? Try it the other way around. Apple doesn't have to worry about losing market share. That's just stupid.

Apple is also not in a 'Apple is in a uniquely privilege (sic) position over microsoft in using the unix permission system'. They chose it. You make it sound like it was just good luck for Apple, or bad luck for MS.

NX on PowerPC

[r00t]

The standard desktop chips provide it with 256 MB resolution. This is decent. You could make the stack unexecutable this way, and probably the heap too.

Re:NX on PowerPC

[Guy Harris]

The standard desktop chips provide it with 256 MB resolution.

And, at least according to "PowerPC Operating Environment Architecture Book III Version 2.01", there's also a per-page no-execute bit; I don't know whether that's a feature that was added later than the per-segment no-execute bit (which I assume is what you were referring to).

Re:NX on PowerPC

[r00t]

I'm not seeing that in the revision 1 book for 32-bit processors.

I'll guess: bit 29 in word 1 (30th bit, 2nd word) of the PTE

I have 4 reserved bits in word 1: 20,21,22,29

Re:NX on PowerPC

[Guy Harris]

I'll guess: bit 29 in word 1 (30th bit, 2nd word) of the PTE

The PTE in the 64-bit documentation has two 64-bit words; bit 61 of the 2nd word is the no-execute bit.

It appears that bit 29 in the 32-bit PTE would correspond to bit 61 of the 64-bit PTE. I don't know whether any 32-bit PPCs implement that bit as an NX bit.

x86 is coherent

[r00t]

On x86, you can reliably execute code that has been freshly written to memory. This is because the CPU invalidates the instruction cache automatically as needed.

PowerPC chips don't do this. If you try to execute something freshly written to memory, you may instead execute the prior data.

Re:x86 is coherent

[sqlrob]

You have the same problem on x86. That's an anti-debugging trick. Debugger executes new code, straight run through executes old.

Re:x86 is coherent

[r00t]

That's an old trick on x86, involving the instruction prefetch queue. Perhaps it still works. The prefetch queue is frequently flushed. I think a mere jmp will do the job.

Non-x86 CPUs will cache many kB or even MB, right across jumps and calls and even system calls.

the alternative

[r00t]

He could sell the exploits to:

a. spammers
b. Chinese government
c. US government
d. credit card fraud groups (mafia-like)
e. Israeli government
f. French government
g. Russian government

It all depends: does he like dollars, euros, credit card numbers, whores...?

Re:the alternative

[Anonymous Coward]

Nobody's going to pay a dime for Mac exploits because nobody gives a shit about the Apple platform.

Re:the alternative

[tuxedobob]

Just out of curiositity, which of those options results in whores?

Only learning that first assembly language is hard

[AHumbleOpinion]

I think you underestimate the importance of assembly language when coding exploits. There are plenty of crackers out there who know x86 ASM. There are *far* fewer who know PPC ASM.

I think you overestimate the effort required to learn PPC once you know x86. The first assembly language you learn is difficult, especially if it is x86, but for subsequent ones it is far less difficult. After many years of x86 I wrote my first serious PPC code, it beat Apple's MrC compiler quite easily.

Talk about timing...

[UOZaphod]

I enjoyed today's (semi-relevant) Ctrl+Alt+Del comic

Re:Talk about timing...

[tuxedobob]

Heh. Okay, granted, the Apple commercials are pretty transparent, but I doubt a comic called Ctrl+Alt+Del is going to have an objective opinion of them.

It also looks like the classic "if you have no rebuttal, just make fun of them" deal.

Re:Talk about timing...

[SPY_jmr1]

you should go back and read through the archives, besides the fact that they're a riot, it isn't a windows-worshiping temple...

I think the name is just a catchy techno-geek-ish sounding title. And it works; it got us talking about it, on the biggest techno-geek site on planet earth, didn't it?

Spy

Re:Talk about timing...

[WilliamSChips]

The Ctrl+Alt+Del comic is mostly just Mac-bashing. I think that one or two of their comics might be funny, but I'm not sure. The only webcomic I read regularly is GPF

Re:Talk about timing...

[Anonymous Coward]

Didn't Ethan marry Windows XP? He joined a black-panther-esque pro-Mac group and was brought to his senses by their wedding photo. The picture still hangs in their living room (check the first episode of the animated series).

Re:Talk about timing...

[snuf23]

Well let's see the recent Mac ads have implied:

That Intel chips were only used for "boring" tasks prior to there inclusion in a Mac. I'd certainly argue Half Life 2 was not exactly boring and that's just one example in entertainment - I'm not even going to get into innovation in open source on the x86 platform.
That Intel chips perform better in Macs. Things like direct benchmarking of World of Warcraft on Intel Macs vs XP (I'm talking about the universal binary of WoW) certainly put that in doubt.
That PCs are boring, fat people that can only run spreadsheets. Uh huh sure.

When you are hitting that low I think a "just make fun of them" is a fine rebuttal.
I'll give them the virus point for sure, but I don't think it's all that wise to tout security as those there is no potential for break ins. Remember Oracle's "unbreakable" ad campaign? Remember the shitload of exploits that came out after that?

Re:Its been stated before but...

[heinousjay]

Perhaps he chose to post AC because anything that goes against groupthink is inevitably modded down? Typically as Troll (Slashdot definition: I disagree with your opinion) or Flamebait (Slashdot definition: I disagree with your opinion)

non-NX CPUs irrelevant, not shipped by Apple

[AHumbleOpinion]

The truth is the Intel processor is a lot more prone to buffer overflow attacks, which is what most exploits on Windows are based on. This is why the no-execute command was introduced in later chips but OSX doesn't take a lot (if any) advantage of it.

Sorry, but no. The historical problems with x86 are irrelevant. Apple did not ship retail computers with those CPUs. The Core Duo and Solo CPUs support no-execute. The vulnerability does not lie with the CPU, it lies with Apple failing to use that capability of the CPU.

Also don't forget: most hackers have self-assembled Intel/AMD machines... that certainly counts.

Sorry, but again, no. What mischief occurs on these machines is irrelevant to Apple and the Apple market in general. These machines are running a hacked Mac OS X that requires skill beyond that of nearly all PC users and it will likely be a fairly unreliable system as it may break every software update. Having to rely on hacks from a 3rd party is a bit of a security risk itself. Sure it will be loads of fun to get Mac OS X running on a homebrew system, but these system will be novelties and fun topics of conversation, very rarely will they have serious users.

The FAQ says that people frequently get modded insightful just because they seem confident, and apparently you prove them right.

Actually you just proved them right as well.

Re:non-NX CPUs irrelevant, not shipped by Apple

[suv4x4]

The Core Duo and Solo CPUs support no-execute. The vulnerability does not lie with the CPU, it lies with Apple failing to use that capability of the CPU.

I love it when people repeat what I said in attempt to argue :) See again what I said and compare it to what I quoted from you.

Having to rely on hacks from a 3rd party is a bit of a security risk itself. Sure it will be loads of fun to get Mac OS X running on a homebrew system, but these system will be novelties and fun topics of conversation, very rarely will they have serious users.

I'd say put your shit together. We're talking hackers here. You think they will be confused in installing and using OSX when there a simple quide with steps and installations all over the web? My dog can install it.

And you can bet that if they find an exploit in Safari from hacked OSX 10.4, it'll work on Safari from original OSX 10.4, since the hacked components are related to the BIOS support and the TPM chip, and nothing to do with 99.99% of the OS.

Re:non-NX CPUs irrelevant, not shipped by Apple

[Ohreally_factor]

You think they will be confused in installing and using OSX when there a simple quide with steps and installations all over the web? My dog can install it.

Oh, jeez! Well, that explains a lot.

Dude, I have to tell you something that's kind of embarrassing. I think I had cybersex with your dog last night. Sorry.

Re:non-NX CPUs irrelevant, not shipped by Apple

[AHumbleOpinion]

"Having to rely on hacks from a 3rd party is a bit of a security risk itself. Sure it will be loads of fun to get Mac OS X running on a homebrew system, but these system will be novelties and fun topics of conversation, very rarely will they have serious users."

I'd say put your shit together. We're talking hackers here. You think they will be confused in installing and using OSX when there a simple quide with steps and installations all over the web? My dog can install it. And you can bet that if they find an exploit in Safari from hacked OSX 10.4, it'll work on Safari from original OSX 10.4, since the hacked components are related to the BIOS support and the TPM chip, and nothing to do with 99.99% of the OS.

No only you are talking hackers only, which is a pretty useless thing to do. The real point here is that what hackers do on their own system is irrelevant. If they can't use it to exploit someone else's system it's pointless in a discussion about MacOS X security. If it's your machine of course you can do anything. You can put the HD in another machine and hex edit the code all you want.

doing something

[falconwolf]

Now if the SAME people coded a patch AND released the exploit, then I wouldnt feel the way I do. But they arnt, they are just feeling smug in proving something doesnt work while not helping in any wya to address it.

So you don't think letting users know there's a problem is helpful? Nobody should ever say anything, because someone else will exploit the knowledge? More than likely if there's a problem more than one person can find it and it's not just the good guys who find them.

Falcon

Re:doing something

[CaymanIslandCarpedie]

So you don't think letting users know there's a problem is helpful?

I think he's saying they can tell them there is a problem, but not tell them what the problem is. That seems a bit silly to me, but seems a popular view now-a-days. Personally, reguardless of what company it is I think it is thier responsibility to keep the product secure and anyone who finds a problem is free to tell whoever they want about it. I know this is "bad" now, but isn't that what we always used to do? But now there are bad people out there!!! We'll to me its much like the US today where people say we need to give up privacy for security except substitute knowledge for privacy. If you find a problem you are free to tell whom ever you want. Now proper eticate should be to at least also point it out to the person whose product it is, but I don't think you should be railed against even if you don't.

I realized analagies suck and this is a really bad and extreme one but consider: If you find there is a flaw in all cars which could cause them to spontaniously explode, should you have to wait until the car companies fix the problem before you tell anyone? The corporations will sure say you should and if you don't you'll ruin thier companies so thier friends in congress will tend to side with them and even make it illegal, but on principal I think telling people about problems is never bad.

Re:doing something

[EvanED]

I think he's saying they can tell them there is a problem, but not tell them what the problem is.

Not according to the blurb ("InfoWorld.com reports that Independent researcher Tom Ferris said there were still holes in Safari, QuickTime, and iTunes that he reported to Apple") or the article ("the latest patch doesn't cover other critical holes he reported to Apple").

If you find there is a flaw in all cars which could cause them to spontaniously explode, should you have to wait until the car companies fix the problem before you tell anyone?

Your analogy is flawed because general knowledge of the problem won't increase the probability that they'll spontaneously explode. Releasing information about an exploit MAY reveal it to bad guys as well. And just as a lot of the time black hats find vulnerabilities before white hats, a lot of the time the white hats are no doubt first. And in those cases, you DON'T want to release information.

My general thought I think is somewhat the norm. If you find a vulnerability, report it only to the company. Give them a "reasonable" time to patch it. (Defining what is reasonable is the hard part. Maybe a couple weeks? For MS, I'd say wait until after the first "patch tuesday" after a week or two from when you notify them. For other vendors that follow a similar schedule, wait until the corresponding time.) If they patch it within that period, wait another couple weeks for the patches to spread to at least a fair number of machines. After those weeks, or if a patch ISN'T released, or if a black hat exploit is released at any point in the process (including the patch development stage), release information. It's sorta complicated, but each rule is there for a reason.

Re:doing something

[EvanED]

Oops, ignore my first comment in my other reply. I misread your post.

Re:doing something

[arminw]

.....If you find there is a flaw in all cars which could cause them to spontaniously explode,.....

There is a flaw in cars that causes them to explode. It requires that the driver run the car into a 6 foot diameter oak tree or heavy concrete wall at 100 mph or faster or drive off a 100 foot cliff. No Mac has ever yet gotten a malware attack AFAIK, without some action of a stupid user. Unfortunately, the only stupidity a Windows user has to do in order to get their, computer messed up, is to connect it to the Internet, especially without a good firewall.

Re:doing something

[falconwolf]

Releasing information about an exploit MAY reveal it to bad guys as well. And just as a lot of the time black hats find vulnerabilities before white hats, a lot of the time the white hats are no doubt first. And in those cases, you DON'T want to release information.

If no one says anything about until a black hat, cracker, or script kiddie exploits it, thing of the damage that can happen when it is exploited. If I know nothing about it before I'm attacked then it's too late, but if I know ahead of tyme I can do something to prevent an exploit or to minimize the damage. I'd rather know than be blind even if you don't.

Falcon

Re:doing something

[EvanED]

I'd rather know too. But, take a risk-benefit analysis. If there is a widespread vulnerabiblity and it's not being exploited, probably black hats don't know about it. If you then release the exploit, they can start expoliting it. Even if YOU would take steps to prevent, many others wouldn't because they don't keep on top of third party security alerts and fixes. The person releasing the exploit must worry about them too. Also, even if you say every man for himself and if they don't patch then they deserve what they get, then you could still be affected by excess network traffic (think code red), DOS attacks, etc.

I'm not opposed at all to saying "hey, I found a vulnerability in the RPC server, you should turn it off at least until MS releases a patch", but I am definitely opposed to saying "hey, I found a vulnerability in the RPC server, and here's a proof-of-concept exploit" before the vendor has a chance to patch. Doing so is, IMO, irresponsibly and the Internet equivalent to antisocial behavior.

No overestimate, it is a real barrier

[Anonymous Coward]

Back in 1999, LinuxPPC decided to mock Microsoft's putting a Windows 2000 machine on the internet to see who would break into it by putting their own up and saying that whoever cracked it first would get the machine.

Their machine had a default install, with default sets of applications.

It took months before anyone cracked the machine. When it was cracked, the hole used to do it was a well-known buffer overflow that had widely known x86 exploits at the time they put the machine up. An Intel machine treated that way would have been instant toast. What took time was that nobody had written a PPC exploit. Therefore none of the automated tools that the script kiddies had would crack the machine.

Sure, for someone knowledgable, it wasn't a hard transition. But the major outside security threat for most of us is not from someone knowledgable, it is from people who are not knowledgable using tools written by people that are. Those people are NOT going to be able to make the transition easily.

It used to be that people would write an application for Windows then recompile for Macs. The result is that the exploit that worked against a Windows version of the application would likely not work on the Mac version. Since there are more Intel machines, odds were pretty good that nobody would get around to writing a Mac version of the exploit for some time. But now the odds are much better that the Windows exploit which the script kiddies are likely to have will work against the same application running on a Mac. Which does make the Mac less secure in practice going forward.

Re:No overestimate, it is a real barrier

[cnettel]

Well, a prepared exploit is of course dependent on the architecture. But that's not the ONLY thing it needs. It would reasonably also need some system call (or be highly dependent on the specific calling convention the application was compiled with, to modify the stack to indirectly trick other code into full exploitation). Those will generally still be different.

Re:No overestimate, it is a real barrier

[Haeleth]

So it took months to crack the machine. Big deal. Where are the figures on how many people tried and failed? Where is the information on how sophisticated their attacks were - were they actually skilled hackers, or script kiddies, or even just interested passers-by?

The simple fact of the matter is that without those figures the whole thing is meaningless, and even with them, that kind of competition would be worthless, and tell you absolutely nothing about the actual security of a system. They're PR exercises, nothing more.

Re:No overestimate, it is a real barrier

[misleb]

It used to be that people would write an application for Windows then recompile for Macs.

Recompile?? Don't you mean "port?" You don't just recompile a Windows program for a Mac. You have to port it because the platforms are so vastly different. And even then, you usually have to code the Windows program in such a way that it can be easily ported... which most aren't. So how many Mac apps today are compiled from Windows source? Maybe parts of Adobe products at best. And how much of that is in a position to be exploited in a meaningful way? Almost none.

The result is that the exploit that worked against a Windows version of the application would likely not work on the Mac version. Since there are more Intel machines, odds were pretty good that nobody would get around to writing a Mac version of the exploit for some time. But now the odds are much better that the Windows exploit which the script kiddies are likely to have will work against the same application running on a Mac. Which does make the Mac less secure in practice going forward.

Since there are very few Windows apps "recompiled" for Macs, this is a moot point. If more exploits come from OS X running on x86, it will be because of more general x86 assembly knowledge, not common applicaiton level exploits. OS X exploits will still have to be written from scratch using a different set of exploitable holes. It'll just be a little easier because nobody has to learn a new assembly language (PPC).

-matthew

oh for god sakes

[John Nowak]

How is responding to an "I'll avoid Quicktime issues by using VLC" post with a brief explaination of why that won't work offtopic? There's a serious lack of reading comprehension skills being shown here.

Cease and Desist

[simpl3x]

Well at least they know when to get the cease and desist order out by. It's always nice to have a heads up!

Re:Since I hate smug Mac users, let me be the firs

[ZachPruckowski]

So 100,000 birds in the hand are worth 20 in the bush?

I mean, note the word "potential". There are thousands of vulnerabilities that have been exploited on Windows, and like 20 potential on Macs, and that's equal? The day you'll trade me 100,000 dollars for a chance at 20 bucks is the day I'll toss my Apple in the trash.

Grow up kids!

[Deorus]

> Its one thing to find holes and tell Apple and people you did, and send the info to Apple. But I am so sick of these people who feel that if said company doesnt respond NOW they are then in the right to exploit said holes and make everyones life misserable.

What do you mean? That he doesn't have the right to disclose what he found? Does his constitutional rights make you sick? Well then I think that YOU are the one with a problem. You should be thanking him for warning Apple. I know many who would have kept it secret and written all kinds of worms just to make fun of fanboys like you, and I guess that's what you're really asking for with your complaints.

Here goes my karma... ;-)

Re:Grow up kids!

[Anonymous Coward]

English not your first language? "To be in the right" should, in the context the grandparent used it, be interpreted as "to be morally justified in one's actions". It has nothing to do with your constitutional rights.

Re:Grow up kids!

[Anonymous Coward]

Does his constitutional rights make you sick?

Way to frame the debate. I have a constitutional right to tell people I think they're ugly too. Does that mean it's moral to walk around doing so without any particular reason?

Try shades of grey sometimes. It's the new black and white.

Here goes my karma... ;-)

Yeah, it should. If not for your incoherent post, at least for this crap. Why does every fucking Slashbot loser have to pre- or suffix his post with "I'll probably lose a lot of karma for this, but ...", "Oh well, there goes my karma ..." or "Let the downmods begin"? If you have something to say, just say it. Don't preemptively whine that people might not like it.

Re:Grow up kids!

[Deorus]

> Way to frame the debate. I have a constitutional right to tell people I think they're ugly too. Does that mean it's moral to walk around doing so without any particular reason?

It doesn't mean it's moral, but why should you be bothered? One thing is to have good faith because it makes you feel better, another completely different thing is to expect others respect the same values as you do. Being morally right also means being tolerat towards others, even when they don't share your opinions. Morality is a rather subjective topic, never bring it up in a discussion, because what you think is right others might not and vice versa.

> Yeah, it should. If not for your incoherent post, at least for this crap. Why does every fucking Slashbot loser have to pre- or suffix his post with "I'll probably lose a lot of karma for this, but ...", "Oh well, there goes my karma ..." or "Let the downmods begin"? If you have something to say, just say it. Don't preemptively whine that people might not like it.

With the huge crowd of Mac fanboys slashdot has, negative moderation is to be expected when someone tries to point out their collective bias. If I was really concerned about my karma I would have posted as anonymous, just like you did. ;-)

Re:Grow up kids!

[Jay Random the Other]

What do you mean? That he doesn't have the right to disclose what he found? Does his constitutional rights make you sick?

HAVING the right is not the same thing as BEING right. Just because you have the constitutional right to make a public nuisance of yourself while helping crackers and malware perps do their malicious business, doesn't mean it's a good idea.

So what do YOU mean? That people don't have the right to complain if he discloses what he found? Do THEIR constitutional rights make YOU sick? Sauce for the goose, Deorus.

Wrong and wrong.

[LKM]

Changing CPU architectures will have absolutely effect on security.

Wrong. For example, to exploit buffer overflows, you need to write assembly. More people know Intel assembly than PPC assembly. That makes attacks on Intel Macs more likely than on PPC Macs. This is most definitely "an effect on security."

Switching to Intel will make it easier for game developers to port their code

Wrong. Most modern games contain no or very little assembly code. The chipset doesn't matter when porting games. DirectX would matter, but it's not available on Macs either way.

eventually the ability to run Windows apps through virtualization

Eventualy? It's already here, running on my Mac right now.

Mac vulnerable == panicking =:E

[BadassJesus]

On XP I have bunch of monitoring and firewalling software. On Mac I only have the knowledge that my OS is bullet proof. Now the second is not valid anymore. Oh my...

Re:Mac vulnerable == panicking =:E

[Professor_UNIX]

On XP I have bunch of monitoring and firewalling software. On Mac I only have the knowledge that my OS is bullet proof. Now the second is not valid anymore. Oh my...

Unless you disabled it you also have firewalling and monitoring.

Re:Mac vulnerable == panicking =:E

[Ohreally_factor]

You turned off the built in firewall on your mac?*

Oh, wait. You've obviously never ben within five feet of a mac.

You turned off the imaginary built in firewall on your imaginary mac?

*Built in firewall standard on OS X

Re:Mac vulnerable == panicking =:E

[laffer1]

firewall != security

Mac OSX is vulnerable just like ANY operating system. Use software update religiously.

Simply installing a firewall does not protect you from security holes. Most problems arise from user error like clicking on a file attachment, running a program from an untrusted source, etc. Macs can't help you there. Less people try to write malware or viruses for macs, but that doesn't mean it can't happen.

Also, remember that microsoft releases patches for previous os releases longer than apple does. If you use OSX, please always buy the latest version by the .2 revision. It ensures you can actually patch the damn thing. 10.2 does not receive updates anymore. (problem at work) Its possible to easily DoS attack the samba service on 10.2.8 server for example. I think apple should be criticized for their lack of patching older versions, at least the server version.

Apple recommends on their own website to run a firewall, purchase an antivirus solution and even buy a 100 dollar defrag program! It does feel like windows now, but we must all accept this. If you don't like it, there's always other operating systems that no one cares about like OpenBSD. :)

buffer overflow

[falconwolf]

Bullshit. Buffer overflows are a software problem and have nothing to do with the CPU. The PowerPC would have been just as vulnerable, when running identical code.

Can a buffer overflow be a cpu as well as a software problem? According to this wiki article NX bit if a cpu designates the data area of memory with an NX attribute then no code can run from within that memory thus proeventing buffer overflows from executing code. If thye have it wrong then maybe you can help them edit this article., well that is if someone else didn't already edit it to give false info.

Falcon

Re:buffer overflow

[TheRaven64]

Setting the NX bit on the stack means you can't put arbitrary code on the stack. You can, however, still overwrite the return address (since this is data, not code) and jump to an arbitrary point in executable code. This is exactly the same on PowerPC as on modern Intel chips as on PowerPC, since PowerPC has had page-level protection since its creation.

It is worth noting that OpenBSD has some protection against this, since libraries are loaded at random points in the process's address space, making it much harder for an attacker to find a good jump target for this kind of attack (all they can consistently do is crash the code).

The truth...

[Anonymous Coward]

Any OS or browser which allows any scripting code of any kind not originating on your system to run for any reason is bullshit. Use but you can't abuse.

Give me REAL WORLD proof

[a_greer2005]

I hear, every nonth or so, now a days that "OSX is as volnerable as Windows" yet I have yet to see one attack in the real world that doesnt requier utter user stupidity (hint -- a web-app should never need your root/"admin" password)

Please someone, give me a web address that will install spy/crudware without my consent automaticly, show me how, with no user intervention, an unpatched box can be hacked to hell by spamers to use in botnets in under 2 minutes...show me this or shut the fuck up!

I understand that OSX isnt perfectly secure, it has its bugs, so does BSD as a whole, but the holes get FIXED and not denied for months untill the hole is used to destry hundreds of thousands of PCs.

Re:Give me REAL WORLD proof

[argent]

but the holes get FIXED and not denied for months untill the hole is used to destry hundreds of thousands of PCs.

Safari still has "Open Safe Files after Downloading", still uses Launchservices to find the loader for safe files, and still treats installers and archives as "safe files".

This is a flaw that's been left unfixed for two years. This isn't as bad as Microsoft leaving ActiveX around for 10, but still...

Re:Give me REAL WORLD proof

[IamTheRealMike]

Did you read the article? A lot of these flaws are in net-facing code like Safari or QuickTime. Arbitrary code execution due to a corrupted movie ... well, there you go, that's an "instant malware by web browsing" attack right there.

An admin account solves nothing, btw. Not only are privilege escalation exploits numerous but you don't need root/administrator access to do most of the things botnets do.

Re:Give me REAL WORLD proof

[Anonymous Coward]

like the gp said, examples please? show me a site that installs malware by browsing. it's easy to say "there you go, there's an attack right there" but if thats the case why isnt it being exploited? there are plenty of people running out of date macs yet still no increase in OS X malware.

heck, show me osx malware at all (besides norton antivirus), even something i'd have to be an idiot and run myself. and not that proof of concept virus with no payload, something that actually does something negative. seems to me everyone likes speculating about how bad osx security is since patch X came out, but for whatever reason the hackers never bother exploiting it.

Re:Give me REAL WORLD proof

[snuf23]

"but if thats the case why isnt it being exploited?"

Why do you think? Spyware and bot nets are being used to make money. Would you waste your time creating a program for such purposes that had as limited a number of potential targets?
For examples sake let's just say there are two bugs - one on Windows and one on Mac. Both are exploitable. Would you target the platform with the small percentage of installed systems?
I wouldn't put it past a malicious hacker to do a Mac virus or worm etc. as a challenge. Someday it'll probably happen, but there simply isn't market for it whereas on Windows development of these programs HAS become a market.

Re:Give me REAL WORLD proof

[Anonymous Coward]

but for whatever reason the hackers never bother exploiting it.

You've answered your own question right there. You are talking about 4-5% of the net population vs around 90%. Who would you target? This isn't hacking for fun anymore, it's big business, amassing a very large number of users for botnet/malware exploitation.

Security by oscurity

[xswl0931]

Guess what, security by oscurity is no security. It's the same as if you just had a taller fence. Sure it'll slow them down, but if someone WANTED to exploit a PPC based OS, they would spend the time to learn PPC. So why don't people want to spend the time to exploit PPC? Because 90% of the potential systems to hack is Windows.

Re:Security by oscurity

[Ohreally_factor]

I think someone hacked your spellchecker and caused a buffer overflow. I'd look into it, no matter how oscure it is.

Re:Security by oscurity

[steeviant]

I'm so sick of hearing people tout this crap over and over... the truth is that security by obscurity does work, and you just highlighted that it does in fact work by noting that there are far fewer people attacking PPC than x86, that situation is only going to get better not worse, with Apple moving away from the PPC platform.

Ever since my company made it policy to move SSH away from the standard ports, the number of dictionary attacks and exploits has gone down from upwards of 20 a day across all our machines down to zero (0). Even though any automated scanning tool worth it's salt could easily identify that it's SSH running on an obscure port from the banner.

Security by obscurity is enough to break the default configuration of most automated scanning tools, which in turn is enough to stop most of the people out there attacking servers at random.

The great thing about using security by obscurity is that by effectively foiling most automated scanning tools, we limit our focus to only people who are genuinely trying to hack us, rather than just anyone, and can focus on tracking them down and turning them over to the authorities.

Security by obscurity does work, it doesn't devalue your other forms of security, and should be considered a useful and valid part of the arsenal of security defences that can be deployed to protect things.

Anyone who says otherwise has obviously never worked in a situation where their security knowledge actually made any difference. It's obvious that an SSH server getting blasted 20 times a day by attackers is at least 20 times more likely to be hacked than one that's hit 0 times a day, and security by obscurity can make that difference.

Re:Security by oscurity

[angst_ridden_hipster]

I agree that people repeat that "security by obscurity doesn't work" without really understanding the concept. I mean, what is a password but an obscured piece of information? Still, the origin of the phrase is attacking the idea that an obscured algorithm will protect you; you have to assume that an attacker will capture one of your en/de-cryption devices, and learn the algorithm.

That being said, I disagree with your assertion that 20 dictionary attacks a day is 20 times more likely to get into an SSH server than 0 dictionary attacks. If your passwords are any good, they won't get in either way.

Yes, your "obscure" port protects you from the dumber automated scripts. That could buy you a little time if a genuine vulnerability shows up in the sshd. But it's only a matter of time before the stupid scripts scan for sshd on other ports.

Then you'll have to switch to port knocking ;)

Re:Security by oscurity

[steeviant]

Heh, we have yet to encounter even a port scan on our obscure SSH port, let alone any kind of attack, so it's safe to say that script kiddies don't want to spend the time scanning all 65,000 ports on every computer when they can get a similar yield by only harvesting those computers that answer on port 22.

It's also probably safe to assume that if someone has the intelligence to change the port that SSH is listening on that they are also clever enough to keep it up to date and securely configured. :)

Moving your potentially vulnerable services to a different port is effectively putting yourself in the too-hard basket as far as auto-scanning script kiddies are concerned, but doesn't do anything to stop attackers who are targetting you.

Unfortunately the soft pink human underbelly of your network is the most glaring weak point for attackers targetting your systems, and we can't really firewall their voice-boxes and fingers if we expect to keep doing business.

Re:Security by oscurity

[Scudsucker]

I'd look into it, no matter how oscure it is.

Typo, or attempted irony?

Re:Security by oscurity

[angst_ridden_hipster]

Heh, we have yet to encounter even a port scan on our obscure SSH port, let alone any kind of attack, so it's safe to say that script kiddies don't want to spend the time scanning all 65,000 ports on every computer when they can get a similar yield by only harvesting those computers that answer on port 22.

True, especially since it's easier to defend against broad, repeated scans (assuming they don't have a good way of doing it from distributed hosts).

Still, I'd argue your defense isn't as much one of obscurity as it is one of heterogeneity. If everyone ran sshd on a different port, the attack vectors would be different.

t's also probably safe to assume that if someone has the intelligence to change the port that SSH is listening on that they are also clever enough to keep it up to date and securely configured.

I wasn't suggesting that you weren't keeping your sshd up to date. I was thinking more along the lines of a 0-day exploit kind of situation. The first attack scripts will go for the easy targets.

Which kind of brings me full circle. Obscurity, in this case, is more a means to heterogeneity. One powerful way of being secure is just being a little more difficult a target than the next guy. Burglars will go to the house without a dog (or without an alarm system). Sure, a determined burglar will still be able to get into a protected house, but why bother? As the marketing folks say, they'll go for the low hanging fruit.

That is, unless the fruit you're protecting is really, really juicy.

OK, I've mangled enough metaphors to traumatize an entire English Department, so I'd best stop here.

Unfortunately the soft pink human underbelly of your network is the most glaring weak point for attackers targetting your systems, and we can't really firewall their voice-boxes and fingers if we expect to keep doing business.

I often think security would be so easy if we just didn't have those darn users...

Re:Security by oscurity

[steeviant]

I often think security would be so easy if we just didn't have those darn users...

Indeed, and the IT business would run so much more smoothly without those darn customers who keep breaking things too. :)

Re:Security by oscurity

[fatphil]

Look at its parent post.

Re:Security by oscurity

[ejtttje]

I think it's also important to keep in mind whether people are talking about "theoretical" security, or "practical" security. Theorists are concerned with being impenitrable by nature, with as few secrets on your part as possible -- the assumption being that the spread of information is inevitable. In this view, obscurity is only a short-term, O(1), solution.

Of course, we all know there's a big difference between theory and practice... I agree that obscurity is a valuable tool in the arsenal, but it's only a bandaid compared to the theory side of things... obscurity may protect you against the common script kiddie nuisance, but you need theory to protect you against the professional cracker, which is the real danger to whatever you're trying to protect.

From that perspective, one could argue it's better to let the script kiddies bang on your system to ensure it's secure. If they do get through, the worst you get is a spambot or some other relatively obvious, but minor, mess to clean up, and you know you've got a hole to fix. But if you left that unknown hole sitting around, when the real cracker comes, he's going after your corporate business plans and new prototypes, and he's probably not going to be as obvious about it... which leaves you in for a surprise when your competitors beat you to market with a cheap copy of what you've been working on, costing you far more than the script kiddie cleanup ever would. Just a thought.

Re:Security by oscurity

[steeviant]

If I had mod points and hadn't already commented, I'd mark you +1 insightful too. You've succinctly summed up why both viewpoints are valid, it's like you have four feet so you can be in both sets of shoes at once. :)

It's comments like yours that make this place worthwhile.

Re:Security by oscurity

[Scudsucker]

Thus the question. Duh. And it's curious that someone modded me down as "offtopic" but not anyone else in the thread.

Re:Security by oscurity

[Anonymous Coward]

Here's how it works:

This post is insightful!

Up, please.

Re:Security by oscurity

[mcrbids]

It is definitely true that "security by obscurity" works, and anybody who knows anything realizes that.

What craps me out is how typically those who wail about "security by obscurity" don't understand that the issue is that security by obscurity isn't supposed to be your primary form of security. Sure, use obscurity to reduce your vulnerability footprint. But don't use it as your *only* security! Layer it with something else.

Move your ports, but require a strong password, or use RSA keys. (my favorite) If you're paranoid, use RSA keys along with a strongly defined password, on a funny port, with a firewall that blocks any connections from all but a few trusted IP addresses. Get even more paranoid: trap inbound connection attempts on port 22, and set up a script to automatically block the IP of anybody trying to connect on that port for 24 hours. Since you don't use 22, there's nothing lost by doing this!

But too commonly, those who wail the loudest about "security by obscurity" act as though using *any* form of obscurity is somehow bad, like you'll come down with a disease if you do - and they are the clueless dolts you definitely don't want to have managing your company network!

Re:Security by oscurity

[Crispy Critters]

Security by obscurity does work,"

No, it doesn't. What you are talking about is not security by obscurity.

SSH is already pretty secure. Switching to a different port may add another layer to the security.

Security by obscurity means taking a manifestly and trivially insecure protocol and trying to obscure it, rather than secure it, like running it on a different port instead of switching to a secure protocol. Like say allowing all X connections to blast through you firewall and connect to any machine (xhosts +), but running X on port 9000.

You can improve security with obscurity, but you cannot create security solely by obscurity.

Re:Security by oscurity

[steeviant]

SSH is already pretty secure. Switching to a different port may add another layer to the security.

SSH is not what I would call a secure protocol, it's entire purpose in life is to allow remote users to have control of the computer. SSH has probably seen more, and worse vulnerabilities than just about any other protocol barring the unencrypted protocols it replaced. Just because it's hard for someone to intercept your traffic in transit doesn't make it secure against buffer overflows and dictionary attacks.

Personally I think that moving SSH from it's original port to an obscure high numbered port could easily be the difference between being rooted or not. That IS creating security through obscurity regardless of how 'secure' SSH appears to be.

Re:Security by oscurity

[Senzei]

OK, I've mangled enough metaphors to traumatize an entire English Department, so I'd best stop here.

Slashdot: Torturing english departments through misused metaphors since 1997.

Re:Security by oscurity

[angst_ridden_hipster]

What I meant to say was:

I've mangled more metaphors than a bull in a china shop, so I'll park it on a dime here, and let it go to pasture.

Or something along those lines.

Holiday weekend

[a_greer2005]

Sorry to reply to self but I have one more thought:

They could have waited untill Monday, but Apple acctually released them in a HOLIDAY weekend...Someone (maybe a whole dev group) acctually came in, and got the patches out today, they could have waited till next week, hell, they could have waited till 10.4.7 if they wanted to, they didnt, THAT is what sets them apart from MS

Re:Holiday weekend

[Tim C]

Ah yes, this argument again.

MS releases its patches on a given day because that's what corporate IT departments have demanded.

See? They listen to their customers, and their biggest customers (by far) are corporate IT departments.

Don't blame MS for bowing to customer pressure, blame the customers for bringing that pressure to bear in the first place.

(Astute readers will have noticed that I've ignored the huge difference in effort required to test patches against a small list of tightly-controlled hardware platforms, vs any old pieces of PC crap that can be coerced into working together. That is on purpose, as it should be immediately obvious to anyone with any experience of development or IT work.)

Hahahaha!

[Anonymous Coward]

I love it when 13-year-olds post on Slashdot!

Are MACs more secure or just less attacked?

[NeoSlash]

I run both and my new MAC has been patched more than my new PC and Adobe alone has released at least twice as many patches this year for my MAC than for my PC.

Re:Are MACs more secure or just less attacked?

[CountBrass]

I call bullshit. No genuine Mac user would call it a MAC (which is something completely different).

Re:Are MACs more secure or just less attacked?

[Anonymous Coward]

Silly troll. You must try harder if you are to get the bites.
Nobody is going to be pulled in by spelling Mac as MAC, or mentioning third party application patching which has no bearing on the actual OS.
Go look at the famous Apple troll about taking 20 minutes to copy a 17MB file. That should give you some pointers.

Re:Are MACs more secure or just less attacked?

[GaryPatterson]

Good troll, completely unbelievable.

Also, Adobe have nothing to do with Apple, so their patches (if true) are all about fixing their own code. You might like to follow your own point next time you post.

Re:Are MACs more secure or just less attacked?

[Achromatic1978]

Wow, is the Koolaid that strong that merely opening your new Apple box (hint: "my new MAC" in OP statement) immediately turns one into a devout fan, who knows better than not to commit the two cardinal heresies: "The system shall be called Mac. Not MAC, nor Macintosh. For lo, the name is Mac, and only Mac." and "It's OS X, not OSX, nor OS 10, nor OS/X! Unbeliever! Burn him, and forever banish his Mighty Mouse!"?

When some refers to how they have a "Windows computer", are they an unbeliever too, because they don't call it an "x86 compatible PC running the Windows OS", too?

Missing the point

[mrraven]

It's not that there are no vulnerabilities, all complex code contains multiple vulnerabilities, it's that Macs being set up with a user level account as opposed to Windows default admin account are much less liable to being actually exploited. The same can of course be said for most Linux distros which are also set up with a default user level account.

Vista will probably help IF it's ever released and as I read on here on slashot the way Vista handles admin tasks (at least in it's current release state) involves an infuriating number of dialog boxes. I'll stick with my mac for now so I can just get some work done (shrug).

I guess this is what I get for responding to a troll.

Re:Missing the point

[argent]

it's that Macs being set up with a user level account as opposed to Windows default admin account are much less liable to being actually exploited

The value of the default user account is overrated.

I can think of a dozen ways to take advantage of a default non-admin account to hide and spread a virus, and that's not even taking advantage of the sudo timing problem.

The biggest advantage is that Safari is less stupid about security than IE. But Apple's working on eliminating that and making Safari just as annoying and insecure. :P

Re:Missing the point

[mrraven]

No one makes you use Safari on a Mac, I use Firefox. Camino and Opera are other possibilities under OS X. Yes Firefox may be bloated and slow but it's pretty secure and I like the flexibility of plugins. I haven't had any problems with malware or any successful attacks against my OS X box and notebook since switching 3 years ago. The same would be true of Linux or BSD I'm sure. A Windows box on the otherhand I notice will pick up at least a dozen pieces of malware according to adaware or spybot search and destroy after just a couple of days of web surfing and yes that's with a firewall and Firefox.

Re:Missing the point

[wirelessbuzzers]

...Macs being set up with a user level account as opposed to Windows default admin account are much less liable to being actually exploited.

I'm sick and tired of this line. It doesn't matter that Macs or Linux have a user-level account by default, unless you're on a locked-down multi-user machine. And even then it doesn't matter much.

Attackers don't need root on your machine for the vast majority of exploits. They can steal all your data, install spambots and adservers on your machine, listen from IRC and attack other computers all they like with a user-level account. They might not be able to put in a rootkit, but that doesn't help you unless other users are looking at your account to make sure it hasn't been compromised.

Furthermore, the account you get on OS X might as well be root: the default user is an admin, who can install and modify applications without even invoking sudo. He just can't modify the kernel, darn. Furthermore, it's very common for OS X, Windows and Linux to have local root exploits. A bunch of Linux compute servers in our CS department got compromised this way: someone broke into a user account (no idea how it was compromised) and escalated to root. And obviously we patch, but not as often as you might like, because people have long-running computations on these servers so they can't be restarted every week.

Even in the absence of local root exploits, you can get root by keylogging (gtk)sudo. Even if sudo implemented some kind of armored pathway from the keyboard driver, you could hack it by putting up a fake dialog. Even if that were prevented (by some kind of private system-wide image or something), I wouldn't trust the update manager to be Shatter-resistant.

For home users, no widely deployed desktop operating system has any significant measure of security once someone has compromised the main user account, and none ever has. Microsoft's red/green and other virtualization solutions might fix this eventually, or at least alleviate the problem, but don't pretend that Linux or OS X is in any better a position than Windows.

And yes, I am a computer security expert. Or at least, I'm studying to become one.

Re:Missing the point

[Watson Ladd]

Yes it does. If I reboot and arbtrary code was running with my account privilages, all applications are still intact. I can use a different user account, copy my files over, delete my account, and remake it, copy the files back.. Yeah its a PITA, but it beats getting PWND.

Re:Missing the point

[wirelessbuzzers]

Yes it does. If I reboot and arbtrary code was running with my account privilages, all applications are still intact. I can use a different user account, copy my files over, delete my account, and remake it, copy the files back.. Yeah its a PITA, but it beats getting PWND.

This works... assuming that they haven't escalated, either by a local kernel exploit or by keylogging your password, and on a Mac, additionally assuming you aren't running as an "admin" user (the default user type, which is short of root but can modify applications, services, firewall settings, ...), and assuming they didn't backdoor any of your files. But in practice, it's easier to reformat and reinstall than to verify the first of these; the second is almost always true on a Mac; and the third is hard to verify at all on any platform.

You could, of course, be running TripWire or Osiris or something equivalent. Which is itself a pain, but if you get hacked, it makes it easier to verify at least that you haven't been rooted, and possibly that your setting haven't been backdoored.

Re:Missing the point

[mrraven]

Bzzzzt... have you ever used a mac or are you just talking shit? You most certainly do have to enter a root level password to modify the firewall. Do I really need to post a screen shot of the sudo gui asking for the password?

Re:Missing the point

[argent]

No one makes you use Safari on a Mac, I use Firefox.

I use Camino.

No one makes you use IE on Windows. I use Firefox.

It doesn't matter what "I" use or "you" use, it matters what the average person uses. If the average Mac owner uses Safari, then problems in Safari are everyone's concern whether they use it or not.

A Windows box on the otherhand I notice will pick up at least a dozen pieces of malware according to adaware or spybot search and destroy after just a couple of days of web surfing and yes that's with a firewall and Firefox.

You're doing something seriously wrong. The only "antivirus" I use on Windows is "no networked applications that use the MS HTML control other than Windows Update" and a firewall. I've yet to be infected while using Firefox and an external firewall or the XP internal firewall.

Bear in mind that to really "not use IE" you have to "not use IE, Outlook, Windows Media Player, RealPlayer, ...". ANY application that uses the MS HTML control on untrusted objects is a potential target.

Re:Missing the point

[wirelessbuzzers]

I owned a Mac for 3 years, and my family has had a Mac for the past for 15-odd years.

I had thought that you only needed a root-level password to change the firewall settings if you had clicked the lock icon. I'm not sure about this, because I always clicked the lock icon. I sold my Mac last year and am running Linux now, so I can't check it; it also might be different under Tiger.

Anyway, the firewall isn't the point. An attacker with access to your account can steal or destroy your data (FileVault doesn't protect you at all here). He can serve ads to your desktop. He can run an IRC zombiebot, a spambot, whatever (the OS X firewall doesn't block outgoing connections unless you manually edit ipfw config files as root, and anyway, who would block outgoing SMTP?). He can steal your email password, your bank password, your PayPal password, your SSN and personal info, your credit card number. He can backdoor your .bashrc, your preferences files, your folder actions, your applescripts, your mail filter rules, probably plenty of other things. If you're admin, he can also backdoor your applications, and he can keylog your password and escalate to root. If you're not admin, he can still probably escalate by a local root attack. Even if he can't escalate and install a rootkit, he can arrange that all these changes are invisible to you, if not to other users.

On any widely-deployed desktop OS, current or past, Free or proprietary, you are thoroughly owned if an experienced attacker has access to your account. This is one of the biggest and most important open problems in computer security, and it will probably be open for another decade.

Re:Missing the point

[mrraven]

Why wouldn't you click on the lock? We are talking about security, right security guy?

Re:Missing the point

[Anonymous Coward]

A Windows box on the otherhand I notice will pick up at least a dozen pieces of malware according to adaware or spybot search and destroy after just a couple of days of web surfing and yes that's with a firewall and Firefox.

>You're doing something seriously wrong.

My wild guess would be that he, like a lot of people, include the all the cookies which Adaware and likes for some inane reason includes in their scan results lumped together with real malware. And you get the "my god I have 30 malwares on my system just from last few days, good thing I'm running Adaware.." from quite innocent tracking cookies (you may have privacy issues with them, but that's another thing and should be treated differently).

Re:Missing the point

[wirelessbuzzers]

Why wouldn't you click on the lock? We are talking about security, right security guy?

I did click the lock. I didn't run as admin. I ran Osiris. I took regular backups. All these things were a hassle, and it still would have ruined my day if my account had gotten hacked.

Security isn't about what paranoid people can do to lock down their machines. It's about what everyone else does. It's about the default. My dad (a history professor), my sister (a film person), and probably even my roommate (math/physics/cs) don't click the lock. They also don't make regular backups. They definitely don't run Osiris. They all run as admin, because that's the default.

Intel is the cause

[alxtoth]

Before Intel, it made no sense to steal Mac OS X because there was no (sensible) gear to run it natively. Now all it takes is a standard PC. There are more tinkerers. This means that move to Intel created, indirectly, a higher security risk

Re:Intel is the cause

[Slithe]

Oh no? PearPC has allowed one to run the PPC version of OSX on a regular x86 box for quite some time now. Plus, old G4's are pretty cheap.

Re:Its been stated before but...

[Anonymous Coward]

Perhaps he chose to post AC because anything that goes against groupthink is inevitably modded down?

You mean like your post was modded down? Oh wait -

Hey dummy, the patch was released on the 11th.

[Anonymous Coward]

Not today. Reading Comprehension FTW.

Ummm, no...

[DavidD_CA]

Maybe that's because you're only reading the Apple section of Slashdot.

I read the front page headlines only, and I can promise you that every little exploit that affects IE or Windows makes it to the headlines here. Slashdot effectively goes out of its way to point out these exploits.

On the other hand, of the 40-some patches that were just released according to today's article, I had no idea about. Maybe 2 or 3 of them made it to headlines, the rest were very quiet.

Re:Ummm, no...

[Anonymous Coward]

No way dude, windows has more potential exploits than /. has frontpage stories, therefore that is impossible.

MACs are more secure, Apple's trying to fix that

[argent]

One reason *everyone* is more secure than Microsoft Windows is that only Windows has implemented anything even vaguely as bad as the ActiveX/Windows Desktop/IE integration mess.

On the other hand, just about everyone to some degree or another commits the sin of trusting untrustable files. Even the darling of the security set, Firefox, has an installation mechanism that involves executing files directly from the Internet without a user's explicit request.

Apple has "Open safe files after downloading" compounded by the unforgivable sin of treating things like archivers or installers as "safe" files.

I've written about this before.

On a security level, this is like shaking hands after sneezing, compared to Microsoft's fascination with running barefoot through a "Hot Ward" and snogging the Ebola patients, but it's still unacceptable.

Re:Since I hate smug Mac users, let me be the firs

[Anonymous Coward]

And the point of GP was that Mac Users Are Always Smug.

Because repeating something often enough makes it true, right. We have always been at war with Eurasia.

Re:Is it enough? NO!

[argent]

Until Apple quits copying Microsoft's bad ideas, like opening files from the Internet using the Desktop launch service, they're just asking someone to waltz in and take advantage of them.

No, adding more annoying dialogs won't help. People learn to ignore them.

never been kissed (by The Grim Reaper)

[Gary W. Longsine]

"I won't go as far as the grandparent, but close. I've never been -harmfully- afflicted by being hacked, rooted, or infected with a virus or spyware. I've almost never run into any of those at all - but once every couple of years something crops up."

Well, so far as you know. One of my clients used to think that, too, and reapeated it as a mantra for years, until I showed them clear evidence that about 200 of their systems were under the direct control of a remote cracker during a worm outbreak. Hard drives and shared filesystems were scanned. Files were uploaded to remote servers under cracker control.

Most organizations (and most people) just don't want to believe exactly how bad it really is when a PC gets infected with malware these days. They don't want to know because if they remain in the dark about it they don't have to do anything to fix it.

jeez...give apple some credit, dude

[Anonymous Coward]

Maybe they couldn't patch EVERYTHING without breaking something.

They will patch it, but 43 sounds like plenty for one update to me.

Wait a minute!

[scolen2]

Wait... So what you're saying is that Apple Computer fixed something that could cuase a security issue before they were forced to due to a virus outbreak? Wow, they shold be ashamed of themselves for now following standard practiaces.

Re:Wait a minute!

[Achromatic1978]

Huzzah! Here, loyal Applehead, take your $20 discount voucher for the Apple Store as a reward for your fine trolling on Slapdash, I mean, err, Slashdot. Yeah, we all know, Microsoft, I mean, err, Micro$oft, has never ever released a Security Update for Windows, I mean, err, Windoze/Winblows, without there first being a worldwide outbreak of malicious activity as a direct result.

The threat is not viruses, it is root kits

[Anonymous Coward]

There won't be a significant virus threat with macs similar to the Winows OS. Viruses that crash the OS was popular due to the limited multi-user network capability of Windows. Mac OS X is designed and operates as a feature rich multi-user OS which makes root kits more popular. Why crash a computer when you can own it.

Re:Its been stated before but...

[heinousjay]

My post talks about being modded down. By rule, it gets modded up. This one should be modded down, however, I just screwed system by talking about both directions. It will probably be ignored.

SElinux extensions ported to OS X and Darwin

[Danathar]

I REALLY hope that Apple is planning to port (or participate in the ports already in progress) to get the NSA's MAC controls into Mach Microkernel.

OS X would be a WHOLE lot more secure with them in place.

Re:SElinux extensions ported to OS X and Darwin

[oudzeeman]

It would be even better if they ported them into the Xnu kernel. OS X uses the Xnu kernel, which contains Mach (3.0 I think) code and Free BSD code (these are fused into a monolithic kernel). OS X does not use the Mach Microkernel (but it borrows a lot of code from Mach).

Re:SElinux extensions ported to OS X and Darwin

[Anonymous Coward]

I'm sure they will eventually. If there is one thing Apple is good at, it is taking code from open source and putting into OS X without giving anything back.

Re:MACs are more secure, Apple's trying to fix tha

[WilliamSChips]

This is why we need capabilities. Very badly.

Sure it will, makes it better

[SuperKendall]

Changing CPU architectures will have absolutely effect on security.

Actually, it will; it has the effect of making the istuation better.

Think about it. For OS X, the clock has been reset on when we can expect the first real virus or exploit to arrive. Even if you were to agree that it's somewhat easier to write Intel viruses then you have to say - why write one now, when there are not that many intel Macs out yet?

Now a virus writer has a choice. Write an exploit for tens of millions of computers in the market but are slowly declining as people upgrade systems, or target the Intel macs with a much lower user population.

While technically it's probably possible to write a "universal binary" sort of virus it would be hard as with an exploit you get one shot at ejecting code, and it has to work on the platform where it ends up.

So OS X by switching platforms has probably bought itself at least two more years from any kind of serious real-life exploit problem.

Re:MACs are more secure, Apple's trying to fix tha

[argent]

No, we don't need capabilities. We don't need mandatory access control. We don't need low-privilege browsers. We don't even need multi-user security on a single-user machine. All that stuff is great for limiting the damage once a vulberability has been exploited, but before any of those things we need applications that doen't have vulnerabilities deliberated included as part of the design. THAT is where the biggest problem is... not in bugs that can be fixed without inconveniencing anyone, but in design features that are inherently insecure and that they don't want to change because people are used to the way it works, because applications depend on the way it works.

But you can change these things even if you don't want to. If UNIX systems can ship with the Berkeley "r-suite" disabled or missing, then Windows can abandon Active Desktop and browser-integration with .NET, and Apple can abandon "Open Safe Files" and sharing helper application bindings between the Finder and Safari.

Just because it's Apple...

[Sithgunner]

I'm keep saying this but it's so funny that these people when it comes to Apple, says 'fixes whopping 43 bugs' lol. When it comes to MS, they go like 'omfg 43 bugs I was living with, geez is MS selling such a trash?'

Keep going, because it just sounds totally funny.
Not that I blame Apple for fixing bugs, but they do ship quite a buggy software in the first place, but people never tend to pick on Apple anyway.

Holes?

[Anonymous Coward]

Tom Ferris said there were still holes in Safari, QuickTime, and iTunes

I thought that every peice of code ever written at least has some holes.

Re:Holes? - here is one unpatched xploit (safari)

[Anonymous Coward]

there are unpatched exploits and DOS in latest may 11th safari still.

one cpu stealer is at www.niftyspot.com/safari_LostCities/

apple knew about it for a month and the other worse unpatched exploits for over 2 or 3 weeks... still unpatched.

Tom Ferris is a dork

[Anonymous Coward]

...trying to get attention and page views. He is just calling any application crash a "security vulnerability", which is maybe defensible, in a rather strained sense, but has nothing to do with practical exploits.

Re: here is one unpatched safari exploit !

[Anonymous Coward]

here is one unpatched exploit ! its the most innocent one, a mere 100% cpu stealer denial of service

there are unpatched exploits and DOS in latest may 11th safari still.

code is at www.niftyspot.com/safari_LostCities/

apple knew about that for a month and the other worse unpatched exploits for over 2 or 3 weeks... still unpatched.

i am not such a osx whiner fool that I would promote actual good code insertion exploits, but I give apple about 5 or 6 more days before I get touchy about it. After all apple ignores safari exploits. that web site is one example of many

There can be more than just an ego...

[Xenographic]

You are, of course, correct that he does not speak for Slashdot, however I would like to point out that there are many valid reasons for releasing full details on an unpatched hole. In particular:

* If they are taking an unreasonable amount of time to patch the hole (Microsoft often does this--l0pht bragged about making one "theoretical" hole they ignored practical)
* If it is already being exploited (this is so that more knowledgeable people than the vendors can make work-arounds, e.g. as was done with that nasty WMF hole last Dec.)
* Because the security reseracher feels as if they're being extorted into silence (Lynn vs. Cisco)

There are, of course, guidelines for "responsible disclosure" (trying to give the vendor a *chance* to fix it, but going public if they pull any crap) and a debate over "full disclosure" (the theory being that it forces vendors to pay attention to security... or else), but I won't get into that here.

It's far more than, as GP put it, "being a giant penis" to release these things--no one can rightfully make such a determination without analyzing the facts pertinent to the disclosure, especially all private correspondance between the researcher and the software maker.

Re:Only learning that first assembly language is h

[LanimilbusLE]

It is true that learning another instruction set is not difficult. However, I must ask what the motivation for learning the instruction set is when such a small number of computers run the architecture?

Re:Since I hate smug Mac users, let me be the firs

[Anonymous Coward]

are you really that ignorant? there are more than 20 exploitable in the last patch, there have been hundreds in the last year. from an actual exploitable hole stat apple sucks badly, just because people have CHOSEN not to exploit it doesn't make it good.

Re:Since I hate smug Mac users, let me be the firs

[toadlife]

"There are thousands of vulnerabilities that have been exploited on Windows, and like 20 potential on Macs, and that's equal?"

Exaggerate much?

Who are "these people"?

[argent]

people never tend to pick on Apple anyway

ORLY?

The worst of Apple's bugs tend to be at the "You know, you really ought to wash your hands after using a public restroom" level.

Microsoft's are more at the "You know, you probably ought to wear protection when having anonymous sex in public restrooms" level.

The whole idea of a web page being able to download and execute code outside the sandbox is just so horribly alien to any kind of sane security model that I'm still boggled at it. And doubly boggled that someone at Microsoft hasn't gone to jail for it yet.

Sometimes you can have features and security!

[argent]

It's not so easy, removing features, even if they are unsafe.

I know, that's why my recommendation doesn't remove any user-visible features, and even improves the user experience by removing the perceived need for warning dialogs before doing "unsafe" things, and provides a more versatile and flexible tool for managing the whole process.

It would, as far as the user's concerned, add features. And improve security as well.

Use all the security in UNIX first!

[argent]

OS X would be a WHOLE lot more secure with them in place.

Not really, mandatory access control adds a lot of inconvenience and, for most people, the kinds of MAC they're likely to put up with can already be implemented in the existing OS.

They're not using groups to separate responsibility for system preferences.

They're not providing a way to use chroot to create stronger internal sandboxes.

They're bypassing traverse checking in the OS-9 compatible "aliases", and probably Spotlight as well.

They haven't ported jails or secure levels from FreeBSD.

They haven't a consistent emulation of the classic Mac file system semantics on top of foreign file systems, so they probably won't be incorporating any non-HFS+ file systems with tighter security (not just secure levels in FreeBSD, but anything from TrustedBSD or any of the Linux file systems).

Re:Use all the security in UNIX first!

[Danathar]

In the perfect world everybody would wake up, write secure code, release secure OS's (that are configured correctly) and there would be no need to write low level "nets" to catch things like buffer overruns. I used to think as you do. Telling everybody there was no need for stuff like SELinux because correctly configured apps and OS's will work. Guess what? The world still creates apps with buffer overuns and releases OS's that are not secure!

In reality I don't see this happening ANY time soon. MAC provides a good low layer protection to keep a vulnerability in some software from becoming root compromise. You don't need it for everything (like in Fedora core 2 it was on for everything by default and it broke lots of stuff). But! if you use it selectively on things that people use (like browsers, email) and daemons (Apache, SSH, Mail servers) that are open to the world, things would be a lot less dangerous.

My opinion of course

Re:Use all the security in UNIX first!

[argent]

Telling everybody there was no need for stuff like SELinux because correctly configured apps and OS's will work.

First, that begs the question: What is SELinux but another attempt at creating a "correctly configured OS"? Having a bunch of fine-graned permissions and even mandatory access controls (though I'm far from convinced that MAC is actually suitable for this job... have you used a system with real orange-book MAC implemented?) that have to be "correctly configured" to allow users to continue to work and actually improve security doesn't get you anything by itself.

Second, what I'm saying is that the value of time spent on using the tools already available is far far greater than the value of making it slightly harder to hide an exploit from an average user, and is far more likely to be accepted by the average user than a bunch of low level restrictions. There is an immediate need for, and an immediate security win from, decreasing the surface area available for attack in the first place. That's what we need right now, not a bunch of extra security levels that will take years to be properly configured so they can be turned on by default.

MAC provides a good low layer protection to keep a vulnerability in some software from becoming root compromise.

In a single user system the difference between a root compromise and a non-root compromise is a lot less relevant than the difference between no compromise and a remote user compromise.

And... how would you apply MAC to prevent a root compromise?

Re:Since I hate smug Mac users, let me be the firs

[LLcj]

hmm, I just hate smug people.

Re:Since I hate smug Mac users, let me be the firs

[SilentChris]

I don't see where you're getting the 100,000 vs. 20 numbers. Are you implying that Windows has as many as 100,000 unpatched vulnerabilities (and that Apple has as few as 20)? Source, please?

Re:MACs are more secure, Apple's trying to fix tha

[SilentChris]

"browser-integration with .NET" .NET's pretty darn secure. MS Research did a pretty good job putting it together. Certainly as secure as anything else that runs in a sandbox (Java, Flash, Shockwave, etC).

Tracking cookies on Mac/Linux, how to remove?

[mrraven]

Yes I think you are right about the tracking cookies and yes I don't like them. And yes I'm sure they are on my Mac as well. Is there any tool for removing tracking cookies from Firefox on Macs and Linux boxes? I think this a fairly serious and as far as I know overlooked problem on *nix boxes.

windows and a firewall

[falconwolf]

Yeah, I don't really know how well it rates though I've heard some good stuff and nothing bad yet, but I have, use, and keep updated ZoneAlarm . Some of what I like about it is that it allows me to block embedded objects, java, and scripts on a website by website basis. If I want one website to be able to use any of these I can yet I can still block another from using them. Unfortunately it doesn't work with Netscape over 4.x or with Firefox and that I know of neither of these allows any of the above to be blocked by website, they're either allow all or block all.

Falcon

Re:windows and a firewall

[arminw]

.....Unfortunately it doesn't work with Netscape over 4.x or with Firefox and that I know of neither of these allows any of the above to be blocked by website, they're either allow all or block all.....

Zone Alarm is a fine program, but it needs to be on each computer. Alternatively, one computer can also be set up as a router/NAT etc, but most be running at all times. Running a whole computer 27/7 just for that adds up in energy cost an maintenance expense.

We have a number of computers, both OSX and Windows on our network. We use a relatively inexpensive router/NAT/Fireawall with built in wired/wireless access and DHCP service. It can permit or deny access by type of service, time of day/week, port numbers, address, URL or keyword phrases. It uses a web interface, but is still a bit of work to set up properly. Once set up, nobody on the network can access forbidden content, regardless which computer or browser they use. It also has various logging capabilities and can be set up to e-mail these logs and intrusion alerts.

Sort of answered Q. but no spybot app for Mac?

[mrraven]

I guess this sort of answers the tracking cookie question. You can either have a cookie free system and no automatic logins or tracking cookies and no automatic login. Perhaps it's time for spybot like program for Macs and Linux just to remove tracking cookies?

"Firefox has two handy options with cookie settings that are worth being aware of: When enabling cookies you can choose to allow cookies "for the originating website only". You can also choose to delete all cookies when Firefox closes. The former setting blocks advertiser tracking cookies from companies such as Doubleclick, used to follow you around the Internet to watch your "consumer behavior". The latter setting blocks permanent cookies, which will prevent websites from tagging you with a permanent ID marker, but it will also mean that websites cannot save your password or personal preference settings."

http://www.jsware.net/jsware/foxtips.php3

Re:MACs are more secure, Apple's trying to fix tha

[argent]

"browser-integration with .NET" .NET's pretty darn secure.

Is it?

Enlighten me.

Is there a mechanism whereby an object in Internet or even LocalIntranet can request the execution of an arbitrarily specified object in the MyComputer zone? If so, does the user get a dialog asking whether this execution should be permitted, or is it unconditionally denied regardless of the user's settings? Is it possible for a user to specify that a specific object (based on any criteria, whether URL or certificate or address or strong name) be granted this right at the time the request is made?

Unless the answers are "no" or "yes, denied, no" then it's not "pretty darned secure".

Re:buffer overflow and NX bit

[falconwolf]

Ok, thanks for the clarification, it clears up some of my confusion.

Falcon

Re:MACs are more secure, Apple's trying to fix tha

[SilentChris]

"Is there a mechanism whereby an object in Internet or even LocalIntranet can request the execution of an arbitrarily specified object in the MyComputer zone?"

Well, no, there isn't. By default, .NET assemblies are given "No Trust" (not allowed to execute) in the Internet zone. (Go into the control panel, Administrative Tools folder, .NET Configuration and bring up Runtime Security Policy). They're currently given "Medium Trust" to Local Intranet, but that's still fairly limited. And that will likely change in IE 7 because they're redoing zones. Zones were an IE 4 convention and they were stupid to begin with.

The word "arbitrary specified object in the My Computer zone" is kind of confusing. Do you mean benign stuff like the keyboard or actual file system objects? Regardless, no, Internet and Local Intranet don't have that kind of access in .NET.

"Is it possible for a user to specify that a specific object (based on any criteria, whether URL or certificate or address or strong name) be granted this right at the time the request is made?"

No, there isn't. The user isn't given a dialog box -- they're told the assembly doesn't have permission to run. The user can change the assembly's trust level in .NET Configuration (which goes far beyond the IE "zones") but there's no "click this button to wipe your system32" button or anything if a user comes across a rogue assembly.

Although, I don't know why that condition is relevant. The dialog boxes are there so users aren't completely annoyed, trying to find where to grant apps access. Java, Flash, etc. all do this. I've seen (and written) Java dialog boxes that grant bytecode access to do some pretty heinous things (one click access to read/write on system32, for example). The only reason, I think, that people don't bring this up in Java security discussions is that very few people actually run Java apps in browsers in the first place.

But to answer your questions "no, N/A, no". Hence my opinion "pretty darn secure".

Re:Holes? - here is one unpatched xploit (safari)

[5plicer]

Here's the source code for the page:

<HTML>
<TABLE>
<TR><TD ROWSPAN=2000000000>

Re:MACs are more secure, Apple's trying to fix tha

[argent]

Internet and Local Intranet don't have that kind of access in .NET.

You mean that if a web page does something like "location = 'file:///c|/...'", or gives the user a link to a local file that the user clicks on, it won't load the specified file? Doesn't matter whether the file is visible in the context of the untrusted document, the question is whether the file can be loaded at all.

The dialog boxes are there so users aren't completely annoyed, trying to find where to grant apps access.

I have had the same people come to me multiple times saying "Peter, I did it again, a dialog bax came up and asked me if I wanted to run something, and now my computer's acting strange. Can you help?"

Technically speaking, this is a social engineering attack, but because users are presented with so many warning dialogs they're trained to automatically approve them. Because they need to approve so many of them just to get their work done. So an approval dialog (no matter how worded) doesn't have enough of an effect on security to matter.

Perhaps it's time to quit worrying about cookies?

[argent]

Perhaps it's time for spybot like program for Macs and Linux just to remove tracking cookies?

Perhaps it's time to quit worrying about cookies?

Safari has a similar option to "Accept cookies only from sites you navigate to".

Camino lets you "Accept cookies only from sites you visit".

And advertisers know about this feature, so they use other tricks like correlating your IP address with referrers or using tagged URLs to gather the information they're looking for.

Re:windows, OSX, and a firewall

[falconwolf]

We have a number of computers, both OSX and Windows on our network. We use a relatively inexpensive router/NAT/Fireawall with built in wired/wireless access and DHCP service. It can permit or deny access by type of service, time of day/week, port numbers, address, URL or keyword phrases. It uses a web interface, but is still a bit of work to set up properly. Once set up, nobody on the network can access forbidden content, regardless which computer or browser they use. It also has various logging capabilities and can be set up to e-mail these logs and intrusion alerts.

All I use right now is one PC and previously I had a difficult tyme justifying a router, however I plan on getting a Mac by the end of the month, so I'll get a router then. Networking and a router will make much more sense when I get the Mac.

Falcon

Re:Since I hate smug Mac users, let me be the firs

[Anonymous Coward]

"Source, please?"

Here is his source.

Re:MACs are more secure, Apple's trying to fix tha

[SilentChris]

"You mean that if a web page does something like "location = 'file:///c|/...'", or gives the user a link to a local file that the user clicks on, it won't load the specified file? Doesn't matter whether the file is visible in the context of the untrusted document, the question is whether the file can be loaded at all."

Um... ok, I think you're confusing things here. Originally you were talking about file system objects. E.g., an assembly gets loaded by the browser and code within the assembly calls routines to perform file operations. In that case, the CLR would prevent the operations from going through based on the security settings (which, by default, wouldn't allow access to those kinds of routines from Internet or Local Intranet zones).

But .NET file system objects don't use "file:///c|/", so I'm not really sure what you're talking about here. Do you mean if a user clicks a hyperlink on an HTML document in a web browser (which has very little to do with .NET, by the way), would it open the file? Well, that's the browser's concern, not Java/.NET/etc. Any modern day browser would ask the user if they want to open the file, whether it was a click or a redirect.

Just to make clear, though, that has nothing to do with .NET. You seem to be talking about a standard browser open.

In reference to dialog boxes asking users to do stupid things, it's a tough nut to crack, honestly. There's a very thin line between completely locking down the UI and not driving users crazy.

Let me give you an example: on Friday I was working on a Mac (an OS lauded for its usability). I had to save a Perl file on the root of the hard drive, so it asked me for the admin password. No problem. Later on, I had to do some work on the file and it asked me for the password when I opened it. Understandable.

Now, I'm working on this file, and I save it a few times. EVERY SINGLE TIME I hit Ctrl-S, it asks me for the password. Why? I already gave it the password when I opened the file. The text editor process should be given free reign to make changes to the file when I need to save it. It shouldn't ask me repeatedly. If I close the text editor, logoff or reboot, that's the only time it should ask for the password again.

And you're right, it's a social engineering issue. However, no manner of code is going to fix this problem. You either take the attitude that the user needs to get work done and can't be bothered to repeatedly enter passwords (even though they have the potential to wreck the machine) or you distrust them completely and repeatedly ask for passwords.

When Vista comes out, this isn't going to go away. People are still going to go through the "click Yes repeatedly" process when they get a dialog box. Except this time they'll get in the habit of entering their admin password. Either way, they won't actually look at what the program is accessing or changing. They just want that P2P/screensaver/stupid bug that tells the weather installed.

Re:MACs are more secure, Apple's trying to fix tha

[argent]

Any modern day browser would ask the user if they want to open the file, whether it was a click or a redirect.

Just to make clear, though, that has nothing to do with .NET. You seem to be talking about a standard browser open.

I'm talking about the integration of the browser with locally executed unsandboxed code, whether that's implemented using ActiveX, .NET, or even Firefox's XUL.

The browser should not ask the user for permission to open a "file://" URL, because it should not be able to do anything "unsafe" just because the document is in the "My Computer" zone. Or any other zone. The browser shouldn't allow a document to do anything "unsafe", period, regardless of where the file is or what type of file the browser thinks it is.

I had to save a Perl file on the root of the hard drive, so it asked me for the admin password. No problem. Later on, I had to do some work on the file and it asked me for the password when I opened it. Understandable.

Now, I'm working on this file, and I save it a few times. EVERY SINGLE TIME I hit Ctrl-S, it asks me for the password. Why?

Because you're entering a new security domain ... running the "save file" procedure in a hidden "root" subprocess ... every time you save. The problem is that the system made it too easy to routinely change your security domain. Rather than saving the file to the root directory of your system disk, you should have kept the working copy of the file (the one you're editing) in your own directory (eg, on the desktop or in documents), and put it in the write-protected root of the file system (if you had to) only when it was working.

This dialog isn't really the same kind of thing as the one I'm talking about, though. It's not there to warn the user that they're doing something dangerous, it's to verify to the system that the person who's requesting the action is really the account owner... which is why it asks every time.

The perception that this password dialog has something to do with "keeping you from accidentally doing something dangerous", like the typical approval dialog, is a common and mistaken one. It's got nothing to do with that at all.

The solution isn't to make the dialogs better, or to make the dialogs go away, it's to design the system so that the dialogs aren't necessary, to make it easy and obvious how to work without being interrupted by them. Apple made a mistake here... the editor should have offered to save the file somewhere else, and moving it back into the protected directory should have been a separate process... so it was clear that editing the file in place wasn't a normal thing to do. ... so ...

Getting back to the Windows example, the privileges granted a document by an application should not be related to the zone the document is in. They should be related to the security domain the application is in and the role within that domain the application plays.

That is, the HTML display component (Webcore in Safari, Gecko in Firefox, KHTML in Konqueror, the HTML control in Internet Explorer) should not have a built-in mechanism to grant local user privileges to a document or a component of a document at all. Not via ActiveX, not .NET, nor active scripts. That mechanism should be managed by the application that is using the control, preferably by installing an extension in the component as Dashboard on the Mac or the KDE desktop do. Any application that is used to display untrusted content (Mail.app, Safari.app, Outlook, Internet Explorer, Firefox, Konqueror) must not provide that extension. Applications that need to execute unsandboxed code (such as Windows Update, the Windows control panel, or Dashboard) should be (and in the case of Dashboard, are) implemented as shells that don't load sources of untrusted content at all.

Do this, and you don't need any "I'm about to do something stupid" dialo

update screwed up

[Niteshade]

Am I the only one who's system was royally screwed by this update?

What's the point of patching Mac OS X

[IDontLinkMondays]

First, of all, patching OS X is in violation of Apple's advertising campaign. You would have to reboot your computer and Macs don't need to be rebooted. So, you couldn't patch if you wanted to. Second, Mac is secure from viruses and trojans, so patching is obviously useless, there is no need for security patches.

If you look at it from my point of view, there is no point to patching a Mac because even with all the root problems and such, the real problem with Macs are the users. As it says on my blog, http://64now.com/ all that needs to be done to make an easily spread virus for a Mac is to download ffmpeg for mac, make an installer based on Apple's installer system, require the user to enter their administration password, install the backdoor or security hole, even disabling firewalling while you're at it, then package it and stick it on Version Tracker. It would be months before anyone knew there was a security hole and it will have been installed on a large percentage of the computers out there.... even the ones run by computer competant users.

Antivirus software for Mac is designed to block known viruses. They lack the advanced features such as sandboxing like those found on PCs since there are really not that many creative viruses on Macs. For the most part, the only purpose for virus scanning software on Mac is to make sure you're not receiving a PC virus and sending it out again to a PC user.

So, thanks to Apple that advertises that their machines are bulletproof and users shouldn't worry about security on their machines, all these fancy hacks are a waste of time, take advantage of the users' trust and you don't need rootkits.