Apple Asks Security Experts To Examine OS X Lion

An anonymous reader writes "For as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true. But Apple's looking to change that. This past Thursday, Apple doled out a beta of OS X Lion to developers. In conjunction with that, Apple is also reaching out to noted security experts and offering them free previews of OS X 10.7 so that they can take a look at Apple's new security measures and reach back to Apple with any thoughts and concerns they might have. Indeed, Apple is becoming a lot more security conscious these days, not only in terms of reaching out to security researchers but also in its personnel hires."

Comments

Am I reading this correctly?

[Anonymous Coward]

as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true.

I'm sorry, what? Windows is "safer" than OS X? "In fact"?

Re:Am I reading this correctly?

[Tangential]

I had the same thought? I've never seen a credible security report that claimed OS X is more insecure than any flavor of Windows.

Re:Am I reading this correctly?

[fuzzyfuzzyfungus]

TFS is poorly worded; but refers to the fact that(while Windows suffers the, er, Lion's... share of attacks) Microsoft has been much more aggressive with rolling out architectural changes like ASLR, driver signing, etc. In pwn2own and like contests, the Windows systems are now most typically taken down by flaws in the (still deeply sucktastic) set of commonly used 3rd party software.

Re:Am I reading this correctly?

[Colonel Korn]

as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true.

I'm sorry, what? Windows is "safer" than OS X? "In fact"?

Every single year, OSX loses the Pwn2Own competition first. Windows and Linux always go down on the same day. No matter what version has been current, OSX has always been less secure than Windows when both are up to date on patches. If Apple changes its security culture, it could mean big things for Apple in corporate environments.

Re:Am I reading this correctly?

[Anonymous Coward]

If Apple changes its security culture, it could mean big things for Apple in corporate environments.

I don't think I'll live to see the day that I hear, "Nobody ever got fired for buying Apple," like I've heard for both IBM and Microsoft.

Corporations buy the OS that the applications run on. Period. Security will forever be a redheaded stepchild.

Re:Am I reading this correctly?

[polaris20]

The wording is indeed poor. Charlie Miller (made famous by Pwn2Own, hacking OS X and iOS) has stated several times that OS X is not more secure than Windows, it is safer. Safer != Secure. He goes on to say he prefers OS X, and still recommends it over Windows. Would you rather be the guy wearing a bullet proof vest running into gun fire, or the guy wearing just a T-shirt, but not even in the same county? Until OS X reaches a level of market penetration that Windows has, it'll continue to be less attractive to hackers for profit. Sorry OS X users (myself included): our OS isn't the most secure out there. Security by obscurity isn't security.

Re:Am I reading this correctly?

[Anonymous Coward]

Every single year, OSX loses the Pwn2Own competition first.

Could just be that the hackers want the mac the most ;-)

Re:Am I reading this correctly?

[Anonymous Coward]

Pwn2Own has never been about "which is more secure". It's *always* been about glory and headlines. It's also been said at least twice (2009 and 2010) that a primary motivation for hacking the Macbook was because it was considered more valuable.

Want to see which is the most secure OS? Hook a Win 7, OS X, and standard Linux install (let's say Ubuntu) up to an unfiltered network port and see which drops first.

Re:Am I reading this correctly?

[Anonymous Coward]

You do know that in the pwn2own competitions the first person to successfully compromise the OS through the browser gets to keep the laptop (as well as other prizes)? If one wanted the shiny Apple computer, then they would go after that one first. People also know what's on the table, too, because it's announced that it'll be using Safari on the Mac version of the target computers. If a hunter knows their target, and knows a vulnerability, they can take it down easily.

Also, one competition, especially one with such prizes as the actual computer being targeted, is hardly a measure of overall security and system design.

Re:Am I reading this correctly?

[Anonymous Coward]

Perhaps, but Microsoft is fixing arbitrary remote code execution vulnerabilities almost every single Patch Tuesday. I guess it's good that they are fixing them, but I would feel better if they didn't have the bugs in the first place (or at least if they didn't have so fucking many of them). I don't really pay attention to Apple's security record, but there's no way it can be worse than Microsoft's has been (though they are improving recently).

Re:Am I reading this correctly?

[node 3]

You mean, once the contest enters the phase where you can run a program remotely, people attack the Mac first, because they want to win the Mac, and Windows and Linux are successfully attacked minutes later.

Re:Am I reading this correctly?

[daver00]

http://www.wired.com/gadgetlab/2009/09/security-snow-leopard/

http://www.tomshardware.com/news/hack-windows-security-snow-leopard,8704.html

Re:Am I reading this correctly?

[n0-0p]

You're joking, right? Apple is historically months behind in patching publicly disclosed vulnerabilities in core libraries they share with other Unix-like systems (Samba and Java are two key examples). Overall code robustness is abysmal in any Apple product I've assessed--they fall over with trivial fuzzing or a few hours of analysis. They're an absolute pain in the ass to deal with when trying to resolve a responsibly reported vulnerability: they often don't seem to have qualified people triaging inbound reports, and when they do finally acknowledge the correct severity of a reported issue it can take years before they finally push out a fix. And to top it all off, their core security counter-measures (e.g. ASLR and NX) are useless as anything more than marketing fluff because they're not implemented consistently.

Seriously, I've been in the security field for almost 15 years and dealt with reporting vulnerabilities to dozens of companies. Microsoft is a pain to deal with because of their compatibility matrices and long release cycles, but they're generally competent. Whereas Apple is just an absolute train-wreck. The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort. If they ever cross the magic 15% threshold they're in for a very rude awakening.

Re:Am I reading this correctly?

[kimvette]

I'm sorry, what? Windows is "safer" than OS X? "In fact"?

Of course it is; look at how many patches Microsoft releases to improve Windows security. If Apple were better at their job they would release more patches, would they not? Obviously if Apple isn't constantly in firefight modes releasing patches, they're just being lazy. ;)

Re:Am I reading this correctly?

[Anonymous Coward]

Every single year, OSX loses the Pwn2Own competition first.

Because Pwn2Own competition directly correlates to real world scenarios.

No matter what version has been current, OSX has always been less secure than Windows when both are up to date on patches.

A metric you just made up.

If Apple changes its security culture, it could mean big things for Apple in corporate environments.

All the OSX trojans, malware, and spyware is the reason why corporations stay away from OSX. When you need security you reach for a PC running Windows.

I honestly can't tell if you're trolling or genuinely believe what you typed. Since the early introduction of OSX every security "expert" and tech pundit has been shouting about OSX being insecure and prone to viruses. It's year 2011 and we've yet to see an exploit in the wild that wrecks havoc on Macs in practice. Every grave OSX vulnerability lives and dies on the seldom-read blogs of researchers.

Re:Am I reading this correctly?

[Cheech Wizard]

I've been hearing "The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort." for so many years the effect has worn off. Year after year - You know, it really gets old hearing that excuse. If that really is the case, I hope it continues.

Re:Am I reading this correctly?

[Anubis IV]

So it may be less secure. That doesn't mean that it isn't safer. If I had an unlocked house in the middle of the countryside with no one else around, I'd be safe, but not secure. If I had an apartment in the ghetto with with bars on the windows and locks on the doors, I'd be secure, but hardly safe. Granted, the situations aren't that extreme here, but it bugs me when people conflate the two. While I don't believe that security through obscurity is solely responsible for the general lack of Mac malware, there definitely are less people making an effort at exploiting it compared to Windows.

Re:Am I reading this correctly?

[Kitkoan]

You mean, once the contest enters the phase where you can run a program remotely, people attack the Mac first, because they want to win the Mac, and Windows and Linux are successfully attacked minutes later.

No, he means exactly what he said. OSX is less secure then Windows. Charlie Miller (the guy who takes down the Macs first) has mentioned this in an interview here. While Apple has improved their security, they are still behind Windows.

Many pundits have made a lot of the fact that the Mac was the first to be exploited in the Pwn2Own contest. Was the choice of the Mac as the first target because the hardware/operating system combo was more desirable as a prize than the commodity Windows laptops of the other competitors? Or was it just because Macintosh exploits occur with much less frequency than Windows exploits and would therefore be more newsworthy?

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)

Re:Am I reading this correctly?

[Shikaku]

Do you really think you are going to get a malware author to comment on why they don't write viruses for Macs?

Re:Am I reading this correctly?

[F.Ultra]

Windows and Linux always go down on the same day.

That's strange since Linux has never been a target at Pwn2Own...

Re:Am I reading this correctly?

[F.Ultra]

O wait, Linux was in the 2008 competition but no one hacked it, and in 2009 and 2010 Linux was no longer in the competition.

Re:Am I reading this correctly?

[Anonymous Coward]

And they will still be saying that when/if Mac reaches 49% of the market. "It's less than half of the computers sold, not a big enough target".

Re:Am I reading this correctly?

[Anonymous Coward]

Baloney, Apple had ACL and Code signing, memory randomization, and disk encryption long before Windows rolled theirs out.

Re:Am I reading this correctly?

[Kenja]

"We should switch to IBM Lotus Domino/Notes!"

"You're fired."

Re:Am I reading this correctly?

[ZeissIcon]

From the Charlie Miller interview mentioned elsewhere in this thread...

Another question from the Twittersphere: What OS/browser pairing to you use? Do you do anything special (beyond default settings) to secure yourself while browsing?

You're not trying to pwn me are you??? Have you ever heard the saying about the cobbler's kids not having shoes? That's me, I'm afraid. I use Safari on OSX with no special settings. This isn't the most secure combination, by any stretch of the imagination, but I like it. It's designed by Apple engineers to be easy to use and 'just work' and it does. The risk of malware is low, and hey, I'm a security expert right :) The risk of a targeted attack is real, except I don't think I'm important enough to be targeted! So I rely on security by obscurity, I guess

Re:Am I reading this correctly?

[mr100percent]

OK, I'll bite. What does Apple have to do to "change their security culture"?

Use POSIX-standards of security and auditing? Check.
Have noted security experts examine their OS before its released? Yeah, that's TFA.
What is missing?

Re:Am I reading this correctly?

[Guy Harris]

Baloney, Apple had ACL and Code signing, memory randomization, and disk encryption long before Windows rolled theirs out.

Not true for "ACL", if by that you mean "supporting ACLs on files"; NT had that in NTFS since Day One, OS X picked it up later (it originally just had the UNIX permission-bits model - ACLs showed up in either Tiger or Leopard, I forget which). I can't speak for the others, as I don't know when they showed up in Windows, but I'd still not assume OS X had them first.

Re:Am I reading this correctly?

[node 3]

You mean, once the contest enters the phase where you can run a program remotely, people attack the Mac first, because they want to win the Mac, and Windows and Linux are successfully attacked minutes later.

No, he means exactly what he said. OSX is less secure then Windows.
[snip]

None of which disputes what I wrote. Pwn2own goes for the Macs first, and every other system falls right afterwards. That's because they all fall at the same part. And in spite of how you interpreted the situation, Mac OS X is vastly more secure than Windows. It's possible Windows is theoretically more secure, but theory doesn't hold as much weight as reality, and reality is that on Windows, you need to be mindful of malware, and on Macs you don't.

In *theory* Windows *might* be more secure.
In practice, Mac is significantly more secure.

And Apple's current move with Lion shows they want to keep Mac OS X more secure in practice.

Re:Am I reading this correctly?

[Anonymous Coward]

That would pretty clearly be the OS X install that would drop first. In case you haven't been paying attention to the thread, simple fuzzing of IP packets will likely take the Mac out. Win 7 has a firewall by default and isn't allowing packets to reach anything vulnerable anyway. It is pretty much a toss up on whether the Win 7 or the Linux would stay up the longest.

Re:Am I reading this correctly?

[Kitkoan]

You missed the last part of Charlie Millers answer to the question about security on Apple about how it compares to Windows.

now its mostly comparable (although still slightly behind).

That means that OSX security is mostly comparable but still slightly behind, ie not as good/less secure.

Re:Am I reading this correctly?

[Anonymous Coward]

> If Apple changes its security culture, it could mean big things for Apple in corporate environments.

Meh. There are lots of reasons Macs aren't in corporate enviornments, and IMHO, this one is way down the list. If corporate IT is willing to run unpatched completely insecure systems (HBGary anyone?), then the speediness of Apple's updates obviously means nothing.

There's lots of comments about security _theory_ here, but the simple fact of the matter is that corporate networks go down when the MS boxes are hacked, what, 99 times out of 100?

Re:Am I reading this correctly?

[PsychoSlashDot]

I've been hearing "The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort." for so many years the effect has worn off. Year after year - You know, it really gets old hearing that excuse. If that really is the case, I hope it continues.

I completely sympathize. I've become tired of the same old excuses why faster-than-light travel isn't possible, just like you and the Apple malware thing. I mean, come on. Why don't they come up with new material?

10% of the personal computing market is Apple. That's it. Now, sure some of the remaining 90% aren't running Windows, but we know that since 2011 is The Year of Linux, the conversion isn't complete, so as of today the majority are.

Some excuses are repeated because they're... valid.

Re:Am I reading this correctly?

[Cronock]

Every single year, OSX loses the Pwn2Own competition first.

Could just be that the hackers want the mac the most ;-)

Not to mention you get more press.

Re:Am I reading this correctly?

[bdsesq]

OS X doesn't fail. It is either Java or Flash that gets the system in trouble.
You may have noticed that the Pwn2Own contest is run against stock systems.
Now that flash and java are not on the system when it ships lets see who fails first.

And just as a side note the person who crashes OS X first is an Apple hater.
If he was a windows hater I wonder which system would go down first......

Even with that OS X passes the first day of testing. So does windows.
It is only when they can get to the keyboard and send the browser to a website that the system gets in trouble.
 

Re:Am I reading this correctly?

[yuhong]

I think it is a lot about the arrogance set by fanboys etc.

Re:Am I reading this correctly?

[Anonymous Coward]

someone refusing to give their opinion on the internet?

Re:Am I reading this correctly?

[Anonymous Coward]

You know, that's the very excuse I kept hearing about Firefox. Coincidence?

Re:Am I reading this correctly?

[Concerned Onlooker]

Watch out. Just a few year ago you would have said "5% of the personal computing market is Apple."

Re:Am I reading this correctly?

[Anonymous Coward]

It's also been said at least twice (2009 and 2010)

Care to source that? Only thing I can find is this:

Any security expert knows that Mac OS X is less secure than Windows. The question is which is SAFER. Because Mac OS X is still relatively rare, it is actually a little safer. But it has nothing to do with it being more secure, but rather, that bad guys are entirely focused on Windows at the moment due to the overwhelming market share Windows has. At this time, I still don't recommend anti-virus for Mac OS X users, because there simply isn't much malware for that platform. However, if Mac OS X market share ever goes up, there will be a landslide of exploits and malware.

Sounds like the most expensive laptop is the easiest one to hack, according to the competitors. Who wouldn't go for it?

http://www.macobserver.com/tmo/article/pwn2own_winner_mac_os_x_is_less_secure_than_windows/

Re:Am I reading this correctly?

[PCM2]

I don't know much about Apple's "security culture," but since you're asking what's missing from your list, the missing piece would be acting upon the information they receive and releasing security patches on a timely basis.

Re:Am I reading this correctly?

[Anonymous Coward]

Is that Apple's fault? When a reporter falsely attributed the quote to Steve Jobs "It's only a phone," the non-Apple tech crowd all rushed to criticize him, look at how much he doesn't care for his customers, etc. You can't blame Apple, since they can't control online commenters and it's proven stupid to get anywhere near that discussion.

Re:Am I reading this correctly?

[alienzed]

"Overall code robustness is abysmal in any Apple product I've assessed--they fall over with trivial fuzzing or a few hours of analysis." And Microsoft's code doesn't? I find it irresponsible to state 'facts' like that without pointing out at least one example of 'code' that does meet your standards. I mean, for all we know, you think ALL code is horrible when it comes to security.

Re:Am I reading this correctly?

[calmofthestorm]

I agree. Citation needed, Bill. Citation needed.

Re:Am I reading this correctly?

[Cronock]

I've had a Mac OS X Server machine open to the world for 2 years now, partially to just see what people would try to do. I watch the system very closely hoping I will see something happen so I can learn a little about it. Services running are SMB, AFP, Apache, Cal/CardDAV, Email for a few domains, MySQL, Software Update Server, AFP, VNC, and ARD. This server is setup as mostly default with only basic security precautions taken: Disabling clear text authentication mechanisms and using overly-strong passwords to rule out brute force attacks. The firewall has only recently been turned on, all ports open, to utilize the brute-force attempt throttling mechanism that requires it. This server hosts a few of my personal pet project domains, any information that would be considered valuable to intruders is actually kept in AES-encrypted sparse images. I'm overly paranoid about backups, so any vandalism-type attacks are quickly recovered from. So far I've only seen a good share of brute force attacks from IPs in Poland and China agaist SSH, FTP, and VNC. There have also been a whole crapload of spam registrations to the hosted WordPress site, but that's not an OS X issue.

Re:Am I reading this correctly?

[fuzzyfuzzyfungus]

Some degree of ASLR showed up in Vista and 10.5, respectively. Same year; but Vista's was a little earlier. Both are limited in some respects, but that gets into serious nit-picking.

Windows picked up OS-integrated file-level encryption with EFS in Win2k, and volume-level encryption with Bitlocker in Vista. I don't think OSX does full volume level stuff to this day; but 10.3 and later supported using encrypted disk images for user home directories. There isn't really a 1 to 1 equivalence between the two approaches. Filevault is architecturally kind of a nasty hack; but it is quite easy to use. EFS exhibits a much more sensible design; but is exudes a strong sense of "don't touch, this is really here for corporate admins".

Re:Am I reading this correctly?

[Cronock]

It's also a great machine to use for hacking. Any one of these guys worth their salt would surely know what's not secure and lock it down.

Re:Am I reading this correctly?

[Cronock]

Also, one competition, especially one with such prizes as the actual computer being targeted, is hardly a measure of overall security and system design.

This is just one competition where the key is to crack something quickly so you can have a prize. This is hardly the defining mark of a platform's security, only one minor measure. People act as though it's the end-all benchmark of security. It's not, and I don't believe that anyone involved in the competition would agree that it is.

Re:Am I reading this correctly?

[tysonedwards]

Are you suggesting that it's not?

I mean seriously, I have yet to meet a single developer who can sit down in front of *any* code and state that it meets their standards.
More often than not, I have seen developers sit down to their own code a few years later and say "Whoever wrote this is a moron. This will need to be completely redone."

Re:Am I reading this correctly?

[Kitkoan]

Your first post claimed that people attacked the Mac first due to the fact that they wanted to win the Mac. Charlie Miller stated that he attacked the Mac because Apple is an easier target, which does dispute exactly what you wrote. He doesn't attack it because he wants to win the Mac, its just the easier target due to its weaker security.

Re:Am I reading this correctly?

[Cronock]

Because one person's opinion = fact? That's not exactly how that whole fact thing works.

Re:Am I reading this correctly?

[gig]

Yeah, it is fucking ridiculous.

Windows is a tire fire of botnets and viruses. There are banks who give free iPads to their high value transaction customers so their money transfers don't end up in a malware author's account.

Charlie Miller, the guy who wins the Mac every year at pwn to own, recommends users buy Macs and refuse to install FlashPlayer if they want to be as safe as possible. Just the fact that Mac OS X no longer comes with FlashPlayer and Java reduces the attack surface.

I mean, just Unix and Software Update alone are better advantages than anything Windows has. It doesn't matter that Windows 7 has some tricks the Mac doesn't have when Windows 7 runs 80% of XP malware.

I have friends who take their Windows machine in twice a year to get malware cleaned off it. How can that possibly be safer than a platform that has no viruses?

And 90% of Mac users are using the latest version and receive patches automatically from Apple within a week. More than half of Windows users are on XP. It is pathetic.

> Apple is historically months
> behind in patching publicly
> disclosed vulnerabilities
> in core libraries they share
> with other Unix-like systems

First, we're talking about fucking Windows, not other Unix.

Apple is slower in deploying a patch than other Unix because it has to work for non-technical users, but then the patch goes out to 90% of the community within a week via their automatic Software Update system, and almost the entire 100% within a month. That removes the incentive to create a commercial exploit. There just aren't going to be enough users to exploit. On Windows, most machines are not up to date on their patches. It's results that matter — % of platform patched, value of exploits lowered — not just how fast you create a patch.

> Java

Mac OS X Lion does not ship with Java, and the Java that runs on it is made by Oracle.

Are you saying you recommend Windows over Mac to a non-technical user?

Even recommending another Unix to a Mac user is ridiculous, because they are not going to know how to patch it.

Really, the nerd-blindness in your comment is disheartening. Be practical.

Re:Am I reading this correctly?

[Cronock]

I don't know much about Apple's "security culture," but since you're asking what's missing from your list, the missing piece would be acting upon the information they receive and releasing security patches on a timely basis.

This is Apple's Achilles' heel, and what they're working to resolve. Look at the recent high profile security hires and it should be rather apparent they at least have a few dedicated people on it these days, when before they would just set a keyboard in a monkey's cage and wait him to pound in a fix.

Re:Am I reading this correctly?

[catmistake]

I agree that safer != secure, but it is disingenuous to suggest that safer = less secure, and to even remotely incinuate that using Windows is like wearing a bullet-proof vest. The summary isn't merely poorly worded, it is a troll.

Re:Am I reading this correctly?

[The End Of Days]

I own a Mac, but fanboyism like yours is almost enough to make me reconsider it.

Macs are not more secure because you love Apple and hate Microsoft. That's just not how the real world works.

Re:Am I reading this correctly?

[polaris20]

Apologies, I didn't mean to suggest that safer means less secure. Obviously the two aren't always hand in hand. And a bullet proof vest probably is a bad analogy; how about wearing a vest made of aluminum cans? I kid, I kid. :)

Re:Am I reading this correctly?

[Kitkoan]

No it doesn't. Stating it and showing that it does is fact which is exactly what he did. He stated that its not as secure and also (3 years running) keeps showing that it falls during the Pwn2Own and pointing out the fact that Mac OS lacks basic security options like weak ASLR and (up to the latest Pwn2Own) no DEP. That is what the 'whole fact thing' works, by pointing out the fact and actually doing it. Windows does have a strong ASLR and has DEP which gives it an edge over OSX. Charlie Miller stated that OSX security is getting better, its still behind Windows (with no doubt their weak ASLR being the reason).

Re:Am I reading this correctly?

[the_humeister]

No kidding. I use Plan 9, and I have never gotten malware. Definitely it's due to its better security architecture.

Re:Am I reading this correctly?

[catmistake]

You, sir, rock. That is all.

Re:Am I reading this correctly?

[Anonymous Coward]

I'm confused, you "don't know much about Apple's security" but yet you have an answer. Can you back up your claims; has Apple not acted on information? Should Apple be pushing out beta versions of apps like Apache or is it OK they're releasing incremental updates that bundle in all the apps?

Re:Am I reading this correctly?

[Anonymous Coward]

I do IBM Lotus Notes to Microsoft SharePoint migrations. Also do the opposite, but I can count those cases on one hand, even if I had no hands. SharePoint is eating IBM's cake. Funny thing is, the company I am with does training as well, we were training IBM services personnel to do Notes to SharePoint migrations ;-)

Re:Am I reading this correctly?

[korean.ian]

I've been hearing "The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort." for so many years the effect has worn off. Year after year - You know, it really gets old hearing that excuse. If that really is the case, I hope it continues.

10% of the personal computing market is Apple. That's it. Now, sure some of the remaining 90% aren't running Windows, but we know that since 2011 is The Year of Linux, the conversion isn't complete, so as of today the majority are.

Some excuses are repeated because they're... valid.

But that 10% is the bunch of idiots that spend gleefully on overpriced commodity hardware i thought? So surely they would be a very appealing market for malware writers...

Re:Am I reading this correctly?

[kestasjk]

Pwn2Own has never been about "which is more secure". It's *always* been about glory and headlines. It's also been said at least twice (2009 and 2010) that a primary motivation for hacking the Macbook was because it was considered more valuable.

Citation needed, I've read interviews of these people on many occasions and have never heard that.

Want to see which is the most secure OS? Hook a Win 7, OS X, and standard Linux install (let's say Ubuntu) up to an unfiltered network port and see which drops first.

Probably none will; remotely exploitable holes in a default install (requiring no user interaction) are practically non existent due to inbound firewalls.

Re:Am I reading this correctly?

[juasko]

Acording to F-Secure Macs had more viruses than PC's in the -80s and early -90s. The PC took the crown around 1992-1993 from the Mac with more viruses.

Macs had even less market share back then. Market shares has very little to do with how much malware there is for a platform. If it's easy to make malware for a platform there will be malware. If it's hard to make it, there will be little or no malware.

Re:Am I reading this correctly?

[kestasjk]

Better disclosure, a faster patch release cycle, longer back-porting of patches and security features to older releases. There are a few things that would help, and it looks like they've recognized this and are moving in the right direction.

Re:Am I reading this correctly?

[99BottlesOfBeerInMyF]

Apple is historically months behind in patching publicly disclosed vulnerabilities in core libraries they share with other Unix-like systems (Samba and Java are two key examples).

This is interesting because as of Lion, Apple isn't maintaining a JVM. Samba isn't even running by default. That doesn't mean it isn't an issue, but it also doesn't mean OS X is particularly vulnerable as a desktop as a result. The small number of exposed services makes many of those potential vulnerabilities fairly moot. Add onto that the default sandboxing for some services and the increased use in the next version, probably has a lot more real world impact than rate up updating libraries that are not exposed on the majority of users' systems. For example, the zeroconf daemon exploits a few years ago were problematic on numerous OS's but were completely ineffective against OS X because of the MAC sanboxing.

Overall code robustness is abysmal in any Apple product I've assessed--they fall over with trivial fuzzing or a few hours of analysis.

It seems like some Apple products are really hit and miss in this regard. Some of the developers are very security conscious and some seem to give little or no thought to security at all.

They're an absolute pain in the ass to deal with when trying to resolve a responsibly reported vulnerability: they often don't seem to have qualified people triaging inbound reports, and when they do finally acknowledge the correct severity of a reported issue it can take years before they finally push out a fix.

That has not been my experience. My former company submitted a small number of vulnerabilities to Apple through the public facing bug report system, and they were reasonably responsive, replying within a week or two and doing a good job of crediting us with the fix in the next security patch.

And to top it all off, their core security counter-measures (e.g. ASLR and NX) are useless as anything more than marketing fluff because they're not implemented consistently.

Their NX is well implemented from my understanding. Did you have a specific complaint about it? ASLR is only applied to libraries, but is applied widely in Lion. The sandboxing is well implemented but not ubiquitous and is more widely applied to userspace apps in Lion (we'll see how far). The malware detection is half assed and I've heard nothing about improvements in Lion. But it sounds like most of your complaints in this regard are already on the table in Lion.

The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort.

You are way, way, way oversimplifying. Their market share is plenty to be attractive. Not having to fight other bot operators over the Mac market share would be very profitable. There are worms now with dozens of different Windows attacks fighting over the small share of vulnerable Windows systems, adding macs to that would be a considerable increase. Also, if you work in network security you are no doubt aware of the trend towards malware that mines data such as account info and credit card and bank account info. Macs would be a goldmine in that regard. Rather, I think OS X's lack of exploitation has to do with good choices for default services, some sandboxing, lack of malware author familiarity with non-windows development, and failure to properly create multi-vector worms that contain OS X attacks in conjunction with Windows attacks. Market share alone does not explain what we see in the wild.

If they ever cross the magic 15% threshold they're in for a very rude awakening.

People said the same thing with 5% and 10%. Part of the joy of arbitrary goalposts in internet forums is the lack of accountability. They're so easy to shift over time... unless, of course, you have specific reasons and data to suggest why 15% would be the specific number we need to consider.

Re:Am I reading this correctly?

[angel'o'sphere]

The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort. If they ever cross the magic 15% threshold they're in for a very rude awakening.

Like everyone you mix up market share with install base.
Who cares how many "compputers" a company is selling per year? Only investors ....
The install base of Macs is likely around 30% in 1st world countries.
The Mac is per definition more secure, despite of your good points, as a user is not running with Admin privileges, the Mail and Web Applications don't auto execute incoming traffic etc. The only way to infiltrate a Mac, that I'm ware off, is via Buffer overflows.
angel'o'sphere

Re:Am I reading this correctly?

[Anonymous Coward]

And if few skilled and malicious people use that platform then there will also be little malware for it. Take phones: if WP7 had 50% marketshare tomorrow -- putting it in the lead -- but all the hackers happened to use Android because of preference, then Android would have the most malware, even if Android was by far the more secure platform.

Re:Am I reading this correctly?

[juasko]

No they are not, as they where not valid in the -80s, back then a smaller platform (by market share) had more viruses than the other platform what had almost 90% market share.

Yes it was the old champions Mac vs PC. And Mac had more Viruses in the -80, market share has been even less than now.

The point is invalid, but few accept the facts.

Re:Am I reading this correctly?

[vague disclaimer]

The key word was "credible", not "hit-whoring".

Re:Am I reading this correctly?

[vague disclaimer]

Every single year, OSX loses the Pwn2Own competition first. Windows and Linux always go down on the same day. No matter what version has been current, OSX has always been less secure than Windows when both are up to date on patches. If Apple changes its security culture, it could mean big things for Apple in corporate environments.

So in a competition that is basically set up for Apple to lose, Apple loses ('cos no-one gets publicity for breaking the broken)

Seriously, did you really just use pose2own as evidence?

Re:Am I reading this correctly?

[juasko]

Yeah, I agree, but there is a difference between being secure against active hackers that target your system, and being secure against automated malware.

True the OSX house today has more doors and windows to crack which burglars welcome. But it's still pretty tight house against the cockroaches. The Win7 and maybe Vista house is quite the opposite. Less tight and the cockroaches get's in more easily, but has few doors or windows for burglars to crack.

Re:Am I reading this correctly?

[node 3]

They all fall within minutes of each other. It's not like he hacks it in real time. You prepare your payload, then deploy it during the competition. That's why the Macs fall first, because people attack it first.

Re:Am I reading this correctly?

[node 3]

I'm telling you, no matter what Charlie says, and no matter what the theory behind which is more secure or not is, the 100% truth is that Macs are significantly more secure in practice, which is all that matters for the user.

Re:Am I reading this correctly?

[node 3]

Theoretical security versus actual security. Windows may be *theoretically* more secure, but in the real world, it's the least secure system out there.

Re:Am I reading this correctly?

[Anonymous Coward]

Hilarious.

Re:Am I reading this correctly?

[Kitkoan]

Sure, if this is what you wish to believe. I've shown you the facts and even gave you the links from the mans mouth about why they really do fall first (being that they are the easiest target). You have tried to re-phrase and alter your answer but it doesn't change the reality. Its not because people attack it first, it's due to the fact they are the easiest target. You can reply to this claiming something else thats just a slightly altered answer yet again, it won't change the truth.

If you do wish to claim yet again that the facts are wrong, please show me something to back it up. At the current moment I have facts (weak ASLR and up to now no DEP, with a track history from Pwn2Own to back it up) that are backing up my claim and your entire retort has be your word which is starting to wear very thin and weak. You need facts, not claims to argue against the facts I've shown you. And trying to claim that my facts aren't correct isn't any better then what your doing now unless you have something that can prove it.

Re:Am I reading this correctly?

[Kitkoan]

Look Node, you can tell me what you wish and believe whatever you wish. The facts have shown the opposite of what you wish to believe here. They showed that Macs are less secure, with showing how they are less secure and you are more then welcome to try to rephrase, alter and/or change anything you wish but it won't change the facts that have been laid bare before you.

As I mentioned in my other post, if you wish to still state otherwise, please show something to back it up. Your answers to every post have been your own claims with nothing to back it up, which amounts to nothing when compared to the facts. If you wish for me to take you seriously, you'll have something to back it up that is a creditable source (no random posts of someone making random claims). I've shown Charlie Miller who has a track record of 3 years showing the weakness of the Mac OS and his experience of this as my facts, I should be able to honestly expect something along these lines from you if you are correct in your statements about the Mac OS's security. If the Mac OS is as secure as you are claiming, then you should be able to find many, MANY security-backgrounded people who will agree with you.

Re:Am I reading this correctly?

[Kitkoan]

And your source to this claim is? Facts please, I've showed you mine, now your turn. Because until you've shown something that can back up this claim of yours, you are using a theoretical claim instead of an actual claim.

Re:Am I reading this correctly?

[Anonymous Coward]

It has to be compared to Windows XP. Windows XP is much easier to compromise than MacOS X, and once you're in, there's nothing standing between you and complete control of the compromised system. It also still has something like 60% market share. Attackers are generally targeting XP still, because it's still the biggest, softest target, and potentially the most valuable.

Not to mention that the security conscious XP users are the ones that upgraded to Vista / Windows 7, and the ones sticking with XP are likely to be the same people who don't install upgrades or service packs.

Attackers don't generally target Vista or Windows 7 either. Too much work, and too little payoff.

Re:Am I reading this correctly?

[Anonymous Coward]

Yes. Exactly what he said. It also gets owned first regularly at Pwn2Own because of how shit the security is. Can't even implement ASLR properly. It's a piece of trash compared to Windows.

Re:Am I reading this correctly?

[hunangarden]

Examples please.

If you're going to go out there and trash Apple how about some examples of what you are talking about.

Were the patches that took years to fix major issues, or minor stuff?

Re:Am I reading this correctly?

[haruchai]

Apple is making serious inroads in healthcare largely on the strength of its appeal to tech-savvy doctors and researchers and the clout they have in affecting purchasing decisions.

Re:Am I reading this correctly?

[gandhi_2]

See also, Pwn2Own results.

Re:Am I reading this correctly?

[Anonymous Coward]

Want to see which is the most secure OS? Hook a Win 7, OS X, and standard Linux install (let's say Ubuntu) up to an unfiltered network port and see which drops first.

That's a test for which OS is attacked most often, not which is most secure. I could hook up up TSR-80 along with the 3 you mentioned and I willing to bet it's the last one to drop.

Re:Am I reading this correctly?

[Anonymous Coward]

s/tech-savvy/trend-whoring/

Apple Corp is for douchebags, and overpriced fanboyism has no place in tax-payer funded systems or corporate enterprises.

The shit isn't magical, it's the same hardware for more money, with an artsy UI, and an instant "in" with the liberals.

Re:Am I reading this correctly?

[Anonymous Coward]

Sorry, but you're totally clueless.

Re:Am I reading this correctly?

[drsmithy]

The Mac is per definition more secure, despite of your good points, as a user is not running with Admin privileges, the Mail and Web Applications don't auto execute incoming traffic etc.

So... Just like Windows, then ?

The only way to infiltrate a Mac, that I'm ware off, is via Buffer overflows.

Or convince the user to run something, like most Windows "exploits" do.

Re:Am I reading this correctly?

[hairyfeet]

Uhhh...you DO know none of the problems you listed apply to Windows since Vista, yes? Let us be consistent here, I mean it isn't like we are comparing Win 7 to system 7 either, so at least compare like to like.

And if Mac is so secure, why does it consistently fall first in "pwn to own"? To me pwn to own seems like the fairer test, since you A.-have an equal reason to pwn all three machines (because you get to keep it and they are nice machines) and B.-have the same bog standard software like flash that a good 90%+ of the public is likely to have.

The simple fact is ALL OSes are seriously complex pieces of code now, and with complexity comes vulnerability. The main weakness in Windows (running as admin) was removed with Vista and now with 7 you simply never run as admin (even the admin account in 7 has less rights than the old XP admin, and like *NIX and OSX is almost never needed) and with DEP, ASLR, and file and registry virtualization Windows has gotten pretty damned secure. Sadly though all the security in the world doesn't stop social engineering and working PC repair I can tell you nearly every infected PC that crosses my desk was infected by the user via social engineering tactics.

Re:Am I reading this correctly?

[drsmithy]

If Apple changes its security culture, it could mean big things for Apple in corporate environments.

Not so long as Apple's overall attitude to corporate IT is swinging between indifference and contempt, it couldn't.

Re:Am I reading this correctly?

[JSombra]

The install base of Macs is likely around 30% in 1st world countries.

Not even half that. Where are at least 50% if not more of the computers? In Offices...and what do 99% of companies use? Windows
Even 10% of install base would be pushing it

Re:Am I reading this correctly?

[Anonymous Coward]

Your UID suggests you were born in the late 80s, making your recollection suspect.

Re:Am I reading this correctly?

[Anonymous Coward]

They didn't all fall within minutes of each other like you state. Several times they've had to go the next phase of the contest, which allows more access to the machine, before Windows and Linux fell.

Re:Am I reading this correctly?

[Anonymous Coward]

I think Charlie Miller knows a bit more then you about OS security. He will tell you the most secure browser and OS environment is windows 7, IE8 or Chrome with no flash installed.

Re:Am I reading this correctly?

[Relayman]

I think, if you bother to check, that most Mac viruses in the '80s and '90s were Office macro viruses. Until Office introduced macros with the ability to have cross-platform viruses, Mac virus protection was handled by one person working in his basement.

Re:Am I reading this correctly?

[Penguinisto]

See also, Pwn2Own results.

...all from one guy (Charlie Miller), who does nothing much beyond his level best to hunt down any vuln in OSX, and only manages to do it with semi-local machine access.

Doesn't quite jibe with the real world, where you only find the odd and rather blatant trojan for OSX (and trust me - if you get infected by one of those, you're also likely the type to give your bank account number to guys in Nigeria...)

Re:Am I reading this correctly?

[Penguinisto]

...err, "hacker", singular. Charlie Miller.

Re:Am I reading this correctly?

[ColdWetDog]

Apple is making serious inroads in healthcare largely on the strength of its appeal to tech-savvy doctors and researchers and the clout they have in affecting purchasing decisions.

Not really. What you are seeing is people bringing in MacPros to run legacy hospital software under Parallels or some other similar system. Nobody is buying large volumes of Macs nor are they using Macs for servers. The iPad might change that - the healthcare industry has been trying to find a decent tablet since Moses dropped his and the battery life / size / simple UI are really appealing. But Apple doesn't really seem to want to go play with the big boys, nor are there big system integrators nuzzling up to Apple (at least that I'm aware of).

Re:Am I reading this correctly?

[ShnowDoggie]

This is a bit old but gives a hint to where apple's install base may be today:
http://arstechnica.com/apple/news/2010/03/mac-os-x-north-american-installed-base-almost-11.ars

I would guess that there install base has gone up based on folks being influenced by the iphone and ipad. If I had to guess I would guess 13%. (Not counting ipads as computers)

Re:Am I reading this correctly?

[Anonymous Coward]

what you are doing here is comparing an unreleased version of osx to windows xp.

Did you just imply that windows patches somehow dont work for non-technical users? because last time i checked they do.

Did you imply that banks give locked down iPads as compared to win7 machines? apples and oranges there big guy. If they gave iMacs, then that is saying something. they dont, so it doesn't.

If your friends are really getting malware twice a year on a win7 machine with msse then. . . there is some bigger problem at play here. This is not 1995 anymore, Modern machines and malware dont really mix. You can cry foul here, but this is really true.

Re:Am I reading this correctly?

[Anonymous Coward]

All that crap and you don't have anything to say about the lack of ASLR and DEP? lol who is the one being nerd-blind?

Re:Am I reading this correctly?

[Anonymous Coward]

Really? I always thought it was due to the fact that in the current economy only HMOs have the money to afford apple hardware... and afford it they can! :D

Re:Am I reading this correctly?

[The Second Horseman]

Weren't a fair number of them WDEF-based viruses on floppies?

Re:Am I reading this correctly?

[Anonymous Coward]

yet the windows and linux computers last longer.

Like it or not, the kid that got a virus every day as a child is a pretty healthy adult.

Re:Am I reading this correctly?

[teh*fink]

This year, Snow Leopard has DEP, so its no longer trivial to exploit.

Snow Leopard was released in 2009, and according to Wikipedia, Apple has used DEP since 2006.
Is he referring to some aspect of DEP in particular?

Re:Am I reading this correctly?

[Anonymous Coward]

So what you're saying is you hope apple stays a niche?

Re:Am I reading this correctly?

[ShnowDoggie]

Fact: *nix is more secure by design than windows. I do not think anyone disputes this.
Fact: All of the OS have become more hardened.
Wager: While it does appear that while the guts of Windows is less secure, Windows (Microsoft) has done a much better job of creating a good wall around its guts.
Wager: All the browsers have a lot of vulnerabilities. (Chrome has done pretty well though)


So where does that lead us? In real world practice I believe that windows is still less secure. This is due to install base, 3 party apps, (just looks at adobe reader 9 and less), years of built up skills and tools for hacking windows, and a Mac OS that is far better security wise than Windows XP. I am not willing to say that the current Mac OS is better or worse that windows 7. I like both of them. Neither are perfect. In some ways IE is more secure than Safari. But where I work I just can not get completely away from active x controls and the like. So if the hackers were starting from scratch, and they were up against windows 7 and OS X, I think it would be a draw. If I add in IE and Safari then I think that Safari loses. But if I use Chrome, well then - who knows!

Re:Am I reading this correctly?

[aiht]

Not everybody created a Slashdot account as soon as they learned to type.

Re:Am I reading this correctly?

[Anonymous Coward]

"as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true."

This is what us security researchers call "common sense."

Please, keep the fanboyism at bay. I have personally authored over a dozen exploits to OS X over the years, and I'm sure that I haven't covered the tip of the iceberg. It's horrifying how easy it is to get access. Anyone who doesn't know that is fact obviously has no experience in this field.

My reports to Apple have fallen on deaf ears, so screw them. I've never once gotten a reply, and to this day 80% of my exploits remain unpatched.
But if that's the way they want to do business in their magical fantasy world, so be it. They won't get any more support from me. I can't say I haven't tried.

Re:Am I reading this correctly?

[Kitkoan]

After looking up the Wiki source for the claim here and then butched with Google translate, I get the (bad engrish) line of:

Apple DEP since 2006 and the first implementation was to have only for the stack, not even for the heap.

What this tells me is that while Apple had a form of DEP since 2006, it was a very small, non-complete version of DEP (so to speak) which would explain when Charlie Miller states that OSX didn't have DEP until Snow Leopard (guessing thats when they used a more full/true version of DEP).

Re:Am I reading this correctly?

[thefixer(tm)]

Well said.

Re:Am I reading this correctly?

[AvitarX]

Does default Ubuntu have any open ports?

I don't think it does.

Re:Am I reading this correctly?

[Kitkoan]

The only problem I have with your statements is while OSX is based on Unix, Apple hasn't been the most proactive in keeping it's security up to date/maintenance. And when they do patch the holes, 2 3 the list of holes tend to be quite large which means they are doing quite a large backlog (with some of the holes being months overdue, like in the first example having a security hole known since August and not patched until January the next year).

You can take something very secure but if your falter in it's maintenance then it won't be of a lot of use in real world usage. And its due to issues like these that make me believe the opposite. Sure, due to it's Unix background, OSX could be very secure, but its not. And as long as these issues keep happening then people like Charlie Miller will keep breaking into Macs and showing that they are in fact less secure then Windows. And while Microsoft isn't always patching security holes on day 0, they are much more likely to address the holes a lot faster then Apple has.

Re:Am I reading this correctly?

[AvitarX]

I do remember reading that the exploit one year was cross platform, but that getting it to do the business was easier in OS X, than in Windows (Vista I think).

Re:Am I reading this correctly?

[Anonymous Coward]

> Even recommending another Unix to a Mac user is ridiculous, because they are not going to know how to patch it.

I'm not a particularly heavy Linux user but keeping Ubuntu up to date is about as easy as keeping my Macbook up to date. Last time I checked it had a notification icon when there were packages to update and you clicked on it, entered your admin password and off it went. Alternately you can load up the package manager, check for updates, and then hit the update button.

Is that drastically different from your experience?

> Are you saying you recommend Windows over Mac to a non-technical user?

If his/her friends primarily use Windows, then yes. If they primarily use something else, then no. Eventually most people need help with something. I would actually say recommending something you AREN'T familiar with is doing someone else a disservice.

> Yeah, it is fucking ridiculous.
> First, we're talking about fucking Windows, not other Unix.
> Really, the nerd-blindness in your comment is disheartening. Be practical.

The rage in your post is also pretty disheartening.

Re:Am I reading this correctly?

[Anonymous Coward]

Some excuses are repeated because they're... valid.

True story.

Re:Am I reading this correctly?

[Phopojijo]

"Safari Charlie" Miller is not credible?

Re:Am I reading this correctly?

[Anonymous Coward]

Every single year, OSX loses the Pwn2Own competition first. Windows and Linux always go down on the same day.

Wait... What? last I checked, Linux has yet to go down at all in the Pwn2Own.
http://www.google.com/search?hl=en&client=ubuntu&hs=y6v&channel=fs&q=Linux+pwn2own&aq=f&aqi=g-v2&aql=&oq=

Last I checked, Linux wasn't even around last year. I guess because it's just... Well... Too secure.

Re:Am I reading this correctly?

[qchan]

You mean, once the contest enters the phase where you can run a program remotely, people attack the Mac first, because they want to win the Mac, and Windows and Linux are successfully attacked minutes later.

Umm... No. http://www.google.com/search?hl=en&client=ubuntu&hs=y6v&channel=fs&q=Linux+pwn2own&aq=f&aqi=g-v2&aql=&oq= Linux has yet to be successfully exploited. Last I checked, it's still considered to be the reigning champ.

Re:Am I reading this correctly?

[TrancePhreak]

I do recall an infected version of Snow Leopard people were downloading and using.
And here's a link about it http://gigaom.com/apple/apple-users-targeted-with-snow-leopard-malware/

Re:Am I reading this correctly?

[TrancePhreak]

Apparently Safari fails, which is still going to be stock?Now this was from 2010, so we don't know what's changed. So let's hope they figured it out this time.
http://www.theregister.co.uk/2010/03/25/pwn2own_2010_day_one/

Re:Am I reading this correctly?

[Anonymous Coward]

There's no practical way to accurately quantify which OS is more secure. What one can say with accuracy is that Windows has the larger installed base, and is therefore the bigger target for cyber crime.

Re:Am I reading this correctly?

[Anonymous Coward]

You just keep repeating those points as if somehow it magically erases the real life bad experiences nearly all of us had with windows -- it does not. CLUE: In theory, practice and theory are the same. In practice, they are not.

Re:Am I reading this correctly?

[Anonymous Coward]

Fact: *nix is more secure by design than windows. I do not think anyone disputes this.

A lot of people would dispute that. Please elaborate on the design issues that make Windows 7 or Windows Server 2008 less secure than *nix. I'd really love to hear it.

Re:Am I reading this correctly?

[Kitkoan]

And in reality everyone has bad experiences with any OS they use. Yes, even OSX. Its one of the reasons they put an in house repair shop (the genius bar) in every Mac store, because people have issues with OSX. Problems aren't limited to Windows, no matter how much you would like them to be. I've heard numerous complaints about OSX from normal (ie non-slashdot) users about the Mac they bought or can I fix Mac problem XYZ. Basic users when switching to a Mac trade problems X for problems Y.

Re:Am I reading this correctly?

[Anonymous Coward]

The sad part is, we're probably right ;). Most of us are complete idiots the first time we write something, then barely smarter the next dozen iterations.

Re:Am I reading this correctly?

[yuhong]

This is interesting because as of Lion, Apple isn't maintaining a JVM.

I think partly because it was such a hassle to keep up with Java security updates in the first place.

Re:Am I reading this correctly?

[Anonymous Coward]

http://www.bastille-unix.org/jay/dc14.pdf

Re:Am I reading this correctly?

[Anonymous Coward]

That is such crap. My company supports non-technical GNU/Linux users on Ubuntu and patches get to users automatically. Now GNU/Linux isn't Unix. However neither is Mac. There is an obvious advantage and ease of use in using GNU/Linux over Mac or MS Windows. Apple and Microsoft both just sucks at security. Arguing that it is a market share issue is bogus. It isn't. The real reason most average users don't use GNU/Linux is nobody is selling it to them. You can't point me to many stores and therefore the numbers are low. That doesn't mean it isn't easier to use than Mac or MS Windows. GNU/Linux has a larger market share and better driver support than any other operating system in history. It is on more devices, desktops, and in other products combined than MS Windows or Mac OS X. Every company supports GNU/Linux to some degree internally. You can't say that about Microsoft or Apple.

Re:Am I reading this correctly?

[kevinmenzel]

I know quite a few people that are moving to windows because of their iPhones... owning an iPhone has left a bad taste in their mouth, and now they want out of the Apple ecosphere completely. I'm not sure how widespread it is, but it is interesting to me that there does seem to be a small formerly Apple-loyal segment that is moving away from Apple because of how controlling and form over function they are perceived to be...

Re:Am I reading this correctly?

[CAIMLAS]

Not really. If an Apple laptop or iMac had to put up with the thermal and material wear issues resulting from malware that your common $400 Dell does on a daily basis, there'd likely be a number of wrongful death lawsuits. Yeah, the original iMacs and iBooks were bad, and they've improved a bit (ok, substantially) since then, but they're still liable to simply fail due to excessive heat (whereas a PC would have the fan kick up a notch, the Mac has none).

Re:Am I reading this correctly?

[Anonymous Coward]

Like most of Slashdot, he doesn't know what ASLR and DEP are. They're living in a fantasy world where *nix has an impenetrable security model.

Re:Am I reading this correctly?

[CAIMLAS]

Considering that the Linux and Windows machines are usually substantially more awesome (in terms of "component for component capabilities") than you can even get in a Mac (despite the quoted price tag), that's doubtful.

Re:Am I reading this correctly?

[CheerfulMacFanboy]

"Safari Charlie" Miller is not credible?

Whenever I quote him how unsafe jailbroken iPhones are, he sure isn't around here.

Re:Am I reading this correctly?

[CheerfulMacFanboy]

The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort. If they ever cross the magic 15% threshold they're in for a very rude awakening.

Don't you mean the magic goal post that's moving up for years now?

Re:Am I reading this correctly?

[sznupi]

Moses?... (it's kinda difficult to search / check the possibility it is actually about some product)

Re:Am I reading this correctly?

[Anonymous Coward]

What on earth are you talking about? Why do you believe things that are not true?

Re:Am I reading this correctly?

[Anonymous Coward]

10% of the PC market is... pretty huge, actually.

Not only that, but surely without any kind of third party security you can easily install loggers and whatnot, and that would make the fat bank accounts of those Mac hippies easy prey. Seems odd that nobody has done it yet, because '10% is insignificant'.

What a fucking idiotic argument. Macs are desirable targets because their owners use them for banking and other sensitive personal tasks. Linux is a desirable target because a gigantic chunk of the world's commerce is first of all processed by Linux servers. Those two facts alone mean that people ARE trying to hack Linux and Mac. Happily, so far, they haven't been too successful.

Re:Am I reading this correctly?

[juasko]

Was no Office back then....

But there was Excel and Word.

Re:Am I reading this correctly?

[BeanThere]

Feel the flamebait! I got sucked in too. I know they post these inflammatory comments to generate lively discussion but ... can't ... help ... self ... ungh.

Re:Am I reading this correctly?

[renoX]

> Every single year, OSX loses the Pwn2Own competition first.

Note though that this is only one datapoint: remember that Windows's exploits have a high monetary value, so those who have them would be less inclined to show them in a competition (even if the competition rewards them if they think they can have a better price elsewhere).

Re:Am I reading this correctly?

[Anonymous Coward]

I guess you haven't followed the Pwn2Own hacking competitions in which MacOS was the first to be compromised for the past three years. I'm betting that nothing will change for CanSecWest 2011

Re:Am I reading this correctly?

[glebd]

So malware writers don't write malware for Macs because they are afraid Macs will overheat? You could not be more ridiculous. And Macs don't have fans? Have you ever used a Mac? I regularly test my iMac's fan by opening a Flash-based website.

Re:Am I reading this correctly?

[Anonymous Coward]

You are an idiot. Period.

Re:Am I reading this correctly?

[Xest]

That's slanted by the US though, which along with Australia has always had a higher percentage of Apple computers in the install base than elsewhere.

In Europe in Asia the figure is much lower, and pulls the global average down to below 10%. Here in the UK I know of only one Mac user at home in our office of 160 people and I don't know anyone in my personal life that owns a Mac. This doesn't stop iPhones being popular, I know lots of people with them but Macs? Not so.

If I had to guess I'd bet the UK Mac install base is absolutely tiny- probably less than 5% in fact. These figures from last year show Apple was only at 6.8% across Europe:

http://www.tuaw.com/2010/05/27/apple-market-share-climbs-to-6-8-in-europe/

What's interesting though is these stats are from pro-Apple's sites and based on browser visits, so are likely even inherently biased towards Apple systems too meaning the actual figure could well be a fair bit lower again.

Whilst Apple's iPod did well globally, and the iPhone has made good penetration into Europe, the US is very much an anomally in terms of Apple related statistics as their market penetration there is distinctly higher than almost everywhere else.

Re:Am I reading this correctly?

[drinkypoo]

I'm telling you, no matter what Charlie says, and no matter what the theory behind which is more secure or not is, the 100% truth is that Macs are significantly more secure in practice, which is all that matters for the user.

Macs are more secure against drive-by takeover because less people are attacking them; they are more vulnerable against a targeted attack because they have weaker security features. It remains to be seen if this new release will improve this situation.

Re:Am I reading this correctly?

[drinkypoo]

Charlie Miller, the guy who wins the Mac every year at pwn to own, recommends users buy Macs and refuse to install FlashPlayer if they want to be as safe as possible. Just the fact that Mac OS X no longer comes with FlashPlayer and Java reduces the attack surface.

It also means that OS X users are in the web ghetto. Over 50% of users have Java installed. I would guess Flash penetration is similar. Websites expect you to have these things, though Java seems to be waning in popularity finally. Once you install at least Flash (which the average user WILL do so they can view videos from funnyordie or similar) then all bets are off again. And anyway, Safari has had plenty of holes.

Re:Am I reading this correctly?

[drinkypoo]

ASLR is only applied to libraries, but is applied widely in Lion.

Charlie Miller bypassed ASLR twice to win Pwn2Own. It doesn't matter where it's applied unless they also made it useful. Last time he did it, the ASLR implementations in Windows, Linux, and OSX were compared. Windows had the best implementation, Linux next, OSX had one not even worth mentioning as ASLR and they should be sued for fraud. Unless they have improved this, applying it to more things won't improve security.

Re:Am I reading this correctly?

[JamesP]

Yes, of course, 15% is where the magic begins, sure

Or maybe it's 16%? 20%?

Of course it has nothing to do with changes on malware, browser vulnerabilities, and the
tendency of Windows users of downloading every crap software off the net

Re:Am I reading this correctly?

[JamesP]

Well I've heard Gnu HURD has perfect security until now! Of curse it's a better security architecture.

It's called 'total code execution denial'

Re:Am I reading this correctly?

[JamesP]

AMEN brother

Re:Am I reading this correctly?

[Anonymous Coward]

QuickTime?

Re:Am I reading this correctly?

[VolciMaster]

Not really. If an Apple laptop or iMac had to put up with the thermal and material wear issues resulting from malware that your common $400 Dell does on a daily basis, there'd likely be a number of wrongful death lawsuits. Yeah, the original iMacs and iBooks were bad, and they've improved a bit (ok, substantially) since then, but they're still liable to simply fail due to excessive heat (whereas a PC would have the fan kick up a notch, the Mac has none).

Have you ever used a Mac? Seriously you think the fans won't "kick up a notch"?

Re:Am I reading this correctly?

[VolciMaster]

No they are not, as they where not valid in the -80s, back then a smaller platform (by market share) had more viruses than the other platform what had almost 90% market share.

Yes it was the old champions Mac vs PC. And Mac had more Viruses in the -80, market share has been even less than now.

The point is invalid, but few accept the facts.

Disinfectant was the first antivirus program for the Mac. It was free, and was kept around until 1998.
Personally, I haven't seen any malware for the Mac since OS X

Re:Am I reading this correctly?

[Anonymous Coward]

> The install base of Macs

INSTALLED base. INSTALLED.

Install is a verb. I install computers.

Once I have completed the installation, it is INSTALLED.

Re:Am I reading this correctly?

[mrrudge]

Afaik the only mac without a fan was the cube, in 2001. Your troll is ten years out of date.

Re:Am I reading this correctly?

[Anonymous Coward]

Office came out in 1990, but the first macro virus didn't appear until 1995.

Re:Am I reading this correctly?

[99BottlesOfBeerInMyF]

Charlie Miller bypassed ASLR twice to win Pwn2Own. It doesn't matter where it's applied unless they also made it useful.

Umm, by bypass you mean attack the stack, which would now be randomized. Really, well if you're so fond of Mr. Miller's expertise, here's what he said in that regard:

"It'd be harder. Right now they have DEP+some ASLR. Of the executable code, which is what you really care about for DEP bypass, they randomize all but one library and the executable. So the amount of code you have is already small (so its already hard), but it'd be way harder if there was NONE - which is what full ALSR would give you."

Re:Am I reading this correctly?

[Anonymous Coward]

If that really is the case, I hope it continues.

Me too, because that bodes well for the decrease in crash-prone and vulnerable POS computers in my enterprise, and by that I mean macs.

Re:Am I reading this correctly?

[Anonymous Coward]

you mean "fewer" people.

Re:Am I reading this correctly?

[mrrudge]

So far your input to this topic has been:

- Mac's aren't exploited because they don't have case fans.
- Windows is exploited because windows is cool.
- Linux & Windows machines are made of 'more awesome' components.

I'm more a believer that the tiny spinning noise coming from over there is a fan in a mac, Windows has never been cool, and most desktops are made of very similar components.

Citations please, mr troll.

Re:Am I reading this correctly?

[grrrgrrr]

My g3 imac did not have a fan.

Re:Am I reading this correctly?

[juasko]

And we are talking about viruses in the -1984 to 1992(3) period when macs had more viruses.

So macro viruses weren't even on the table. BTW wasn't the first malicious computer virus made on a Apple][?

hmm seems so, if a poem is malicious?
http://en.wikipedia.org/wiki/Computer_virus#Virus_programs

Re:Am I reading this correctly?

[John Betonschaar]

Charlie Miller is the kind of fireman who doesn't mind screaming FIRE! in a theater every now and then, just so he can make a point to stress his own relevance extinguishing fires. Every time anything is published on OS X security, this guy is quoted along with some title of some books he wrote. He might know a lot about OS X security and the way you could theoretically exploit it, but that's hardly a measure how secure OS X is compared to other operating systems.

Every time I read an article that brings up the 'small market share' that makes OS X 'less attractive to malware writers' I know I can safely disregard anything in it. People have been saying this for decades, meanwhile OS X market share has almost quadrupled, many Mac users are the kind of people with disposable income and credit cards, yet *no* viruses *whatsoever* have *ever* managed to succesfully exploit Macs. Not a *single* one. No matter how much bigger the Windows market share is, you'd expect at least one or two prolific malware writers to give it a shot, just to make a point, or to make a market out of the 10% of Macs already out there.

Both articles linked are just like that. A summary of security features OS X doesn't have, and/or a list of 'critical security flaws' and how fast they are solved, and a concluding remark that 'OS X users do not have to worry _yet_, because OS X market share is still not high enough for it to be interesting'. We'll talk yet another decade from now and see how many OS X viruses have surfaced in the mean time...

Re:Am I reading this correctly?

[Anonymous Coward]

I'm writing this because I'm concerned about you. You seem unstable and incapable of rational thought. Many of your observations are non sequitur. You seem to be mostly writing out of anger and in defense of Apple as if it were some deeply held belief.

The criticisms are valid. It is a fair point that Apple is taking steps with addressing them in Lion. But first of all, it hasn't been established that all of these steps are primarily motivated by concern for security (the removal of Flash and Java likely have to do with other considerations). If they are doing better address randomization I salute them, but it's only fair to state that this has been standard issue in *BSD, Linux, and Windows for a long time; it's been nearly 10 years since I first read of these techniques. Second, these are first steps only, and Apple's actions should be analyzed to see how well they follow through, particularly with regards to patch schedules. (Let's be honest, by the way, your explanation of why Apple are laggards with patching known vulnerabilities in open source libraries doesn't make any sense at all. I had trouble parsing it as anything but an angry rant used to justify a delusion.)

Lastly... When Apple makes a mistake, it can't be in every instance because they have some genius explanation for why it wasn't a mistake after all. The people who work at Apple are mere mortals like you or I. This means they'll have flaws and be bad at things. They'll screw up, sometimes frequently. Take that in, and breathe deeply. It's not really as much of a problem as you think.

Re:Am I reading this correctly?

[mrrudge]

Cool. Thanks, seems it might have been the second generation iMac, about 2003 ?

Re:Am I reading this correctly?

[Anonymous Coward]

I think this was a relatively recent change.

Historically, Windows and Mac OS have been comparable in their overall vulnerability, but as late as XP, Windows defaulted to poor settings such as single user with root access and no password, while Mac OS defaulted to slightly better settings (you had to set a password).

The result of this is that in the wild a Windows box was easier to exploit than a Mac. However in any sort of security audit (where the security features are turned on) they tended to be roughly equal in vulnerability from a technical standpoint, with Windows vulnerabilities being more widely known (because there's more incentive to attack the larger user base and the less secure base line of Windows users).

Over time however Windows has been put through something of a trial by fire, and Microsoft has been focusing heavily on improving security for the last two iterations of Windows. Mac OS on the other hand has been pretty spoiled with little to no effort being made to attack them. It would not surprise me at all if Windows 7 were more secure than OSX.

Re:Am I reading this correctly?

[SpudNYC]

Maybe if the windows boxes folks compete for were more desirable, they'd be taken more quickly.

Re:Am I reading this correctly?

[grrrgrrr]

Yes it was a gray slot loading imac. Very nice machine never gave me a bit of trouble. The good old powerpc times

Re:Am I reading this correctly?

[NickFortune]

I completely sympathize. I've become tired of the same old excuses why faster-than-light travel isn't possible, just like you and the Apple malware thing. I mean, come on. Why don't they come up with new material?

Oh! Oh! I know that one!

This is the one that says "The reason that faster than light travel isn't possible is that users can't flap their arms fast enough, and has nothing to do with those pesky laws of physics that Microsoft would have overcome in an instant had they not decided on a more strategic approach of making the light come to you instead, (a service they intend to monetize in the near future) so it's not their fault, so there!".

The thing is, you've got two more-or-less indisputable facts there. People can't as a rule flap their arms fast enough to achieve flight, and we have excellent reason to believe that faster than light travel is impossible.

I'm just not convinced that one is a complete and adequate explanation of the other, y'know?

Re:Am I reading this correctly?

[Raenex]

Fact: *nix is more secure by design than windows. I do not think anyone disputes this.

If you were talking about Windows 98, yeah, you'd be absolutely right. You're just repeating a reputation that hasn't been true since the XP days. XP was based off of NT and has permissions and users, just like *nix.

Re:Am I reading this correctly?

[pandrijeczko]

To be honest, if I was hit-whoring, I'd be more inclined to put "Windows Sucks For Security" rather than "Apple Sucks For Security" based on the respective user bases... just an observation.

Re:Am I reading this correctly?

[GizmoToy]

The reason I've always been skeptical of using the Pwn to Own contest results in the way you have is that the guys creating these exploits are going to go after the most valuable targets first. Invariably, that's the Mac in the category. Even if the retail values of the devices are close to each other, the resale value of the Mac is going to be higher.

So, to make the most money from Pwn to Own, you go after the Macs.

Then, you have the notoriety factor, given that Macs have press for being more secure, whether that's accurate or not, you're going to get more press for targeting the Mac.

Re:Am I reading this correctly?

[Anonymous Coward]

... the patch goes out to 90% of the community within a week via their automatic Software Update system, and almost the entire 100% within a month.

Yea that might be true, but you're not counting the fact that almost 75.23% of your statistics are made up.

Re:Am I reading this correctly?

[LanMan04]

10% of the personal computing market is Apple. That's it. Now, sure some of the remaining 90% aren't running Windows...[snip]

Do you really, REALLY think malware authors are content to let 10% of their target market slip through their fingers?

COME ON, writing just about any level of mass-distributed malware has an excellent ROI. There's malware for almost every network-connected device out there....except for Macs.

Re:Am I reading this correctly?

[DinDaddy]

unless, of course, you have specific reasons and data to suggest why 15% would be the specific number we need to consider.

Of course he does. We haven't reached it yet.

Re:Am I reading this correctly?

[DinDaddy]

I doubt it. They'd have to change their sales and support structure, and their secretive product roadmap culture as well.

Re:Am I reading this correctly?

[isaaccs]

Just like car thieves never target BMWs or Mercedes because of their paltry market-share. Right.

Re:Am I reading this correctly?

[Wovel]

You do realize those store say it has less security tools available because they are unnecessary right?

Re:Am I reading this correctly?

[Wovel]

The Apple demographic is worth like 50x per hit..

Re:Am I reading this correctly?

[Bassman59]

I do recall an infected version of Snow Leopard people were downloading and using. And here's a link about it http://gigaom.com/apple/apple-users-targeted-with-snow-leopard-malware/

Stupid fucking idiots who are too cheap to spend $29 on a copy of Snow Leopard pretty much get what they deserve.

Re:Am I reading this correctly?

[Wovel]

It seems clear that you have never actually used a mac. Good job, your Internet credibility is as compelling as your personality.

Re:Am I reading this correctly?

[Anonymous Coward]

Even recommending another Unix to a Mac user is ridiculous, because they are not going to know how to patch it.

yes, because clicking the icon that says "updates available" is so damn hard. It's not 1999 any more, you can deploy Linux machines your grandma can use for her facebook without issue.

Re:Am I reading this correctly?

[Wovel]

Give one person we can reference. (Everyone knows you are lying, thats what makes it fun to ask).

Re:Am I reading this correctly?

[Wovel]

And hopefully shot.

Re:Am I reading this correctly?

[Wovel]

And they like a challenge. There is no press for being the one to hack the Windows systems. Any kid off the street could walk in with his hackomatic script and grab exploit-of-the-day from the mothership and have at it. Microsoft patches faster and they are still losing..

Re:Am I reading this correctly?

[isaaccs]

I appreciate your comments and I'm sure you know a lot more about underlying security mechanisms than I do. That said, the proof is in the pudding - I've never seen a Mac hijacked by malware, and almost every PC I've seen at some point or another has been.

The market share argument is total bullocks. For a security expert you seem somewhat ignorant of the "not-a-zero-sum-game" principle, by which there is (throughout broader society) no demonstrated correlation between the preponderance (market share) of targets and the quantity of attempts to attack them. Hence, despite the fact that the wealthy only represent a small fraction of human society (I dunno, like 5%? Smaller than Apple's computer share, to be sure), they are still targeted *more* often by thieves than the huddled masses, etc: Why? Because even though there are far more average people (with or without in-home-security) to attack, the wealthy present a compelling opportunity. Why only try to steal from one when you could steal from both? You can apply this argument almost anything; go wild. Remember also that malware has been written and circulated for nuclear plant controller system software (I forget the details, but I think the total install base for this particular package is like 5 or 6 units - but still represented a "compelling opportunity" for someone).

Further, by virtue of the fact that Mac's aren't loaded with 3rd party security software, that their users don't expect malware, that there is NOTHING else in Mac malware space, and that the demographic of Mac users is financially "elite" - if I were a hacker, I can tell you which niche platform I'd have my eye on. It's pretty obvious. Not worth the effort? Really? Says you.

Re:Am I reading this correctly?

[Wovel]

I agree, with XP that would have been ugly, but Windows 7 would survive that as well as anything.

Re:Am I reading this correctly?

[Wovel]

You have not actually shown any facts. The GP is correct all the payloads are prepared in advance. Windows does not survive its pre-made attacks any longer than OSX. You will continue to believe what you want. You will continue to be wrong.

Re:Am I reading this correctly?

[dgatwood]

Not only that, but surely without any kind of third party security you can easily install loggers and whatnot....

For some time, Mac OS X has required that any software that wants to attach to any device that identifies itself as a keyboard (including some presenter remotes, much to my chagrin) be running as root. Because of this design decision, in order to install a keylogger without the user typing his or her admin password, you would have to not only attack an arbitrary application and gain the ability to run code on the user's machine, but also either find an additional vulnerability in one of only a handful of daemons that run as root or find a kernel exploit that allows you to gain root privileges.

In effect, although you could make a Mac OS X trojan or virus that installs a keylogger, it would be exceedingly difficult to do so without the user doing something careless.

Re:Am I reading this correctly?

[WaffleMonster]

In effect, although you could make a Mac OS X trojan or virus that installs a keylogger, it would be exceedingly difficult to do so without the user doing something careless.

OMG nobody gets it do they...The millions of zombie PCs out there...are not there because someone explioted some vulnerability ... They exist in large measure due to SOCIAL ENGINEERING.

Re:Am I reading this correctly?

[dgatwood]

No, I do get it. In such situations, the user had to deliberately install something. You're missing a critical difference between Mac OS X and Windows, though.

Unlike in Windows, where security dialogs pop up for mundane things, Mac OS X's security model only pops up those dialog boxes when you're doing something that you should legitimately be cautious about. Mac users are trained to be wary when they see those boxes.

It is this fundamental difference that distinguishes Mac OS X from Windows, and makes such social engineering attacks significantly less likely. Also, warnings in Mac OS X make it far more obvious if you've accidentally clicked on an application that has been hacked to look like a document, which further improves security in this regard.

Re:Am I reading this correctly?

[CAIMLAS]

They're relatively easy to overheat and crash/burn. Just because the fan sounds like a jet engine does not mean that it's doing a sufficient job cooling.

Re:Am I reading this correctly?

[CAIMLAS]

Your reading comprehension is almost as lacking as your personality. You're like a harpy girlfriend who bitches about little things you did, which you never actually did.

Re:Am I reading this correctly?

[mrrudge]

You seem to have accidentally posted generic flamebait rather than citations ?

Re:Am I reading this correctly?

[LiENUS]

It's a story from the bible. He's saying they've been looking for one forever.

Re:Am I reading this correctly?

[Kitkoan]

Because in the real world, no one would ever be prepared in advanced. This will also go against the fact that the Mac OS has gone down in seconds where the Windows hacks takes minutes. A normal user would have restarted their computer (if they are using it) after 20-30 seconds of no/slow response which in the real world would kill the Windows attack, the Mac would be already too late.

You have also managed to contradict your self. Your post is trying to claim that OSX is better then Windows in security like Node said, then you turn around and claim that they are equal since they both fall at the same time. Which answer was the one you meant? Your can't flip between both of them.

Re:Am I reading this correctly?

[VolciMaster]

They're relatively easy to overheat and crash/burn. Just because the fan sounds like a jet engine does not mean that it's doing a sufficient job cooling.

Again - have you used a Mac recently? With the G5 iMac series, I could agree with you. That was years ago.

Re:Am I reading this correctly?

[Weedhopper]

OS X doesn't fail. It is either Java or Flash that gets the system in trouble.
You may have noticed that the Pwn2Own contest is run against stock systems.
Now that flash and java are not on the system when it ships lets see who fails first.

And just as a side note the person who crashes OS X first is an Apple hater.
If he was a windows hater I wonder which system would go down first......

Even with that OS X passes the first day of testing. So does windows.
It is only when they can get to the keyboard and send the browser to a website that the system gets in trouble.

This post is so wrong, I barely know where to begin.

First, Charlie Miller is far from an "Apple hater." His uses an Apple and his preferred browser/OS combo is Safari on OS X.

Two, you also imply that the exploit requires physical access to a machine, which is far from true. These are drive by download exploits - the point being that the machine is exploited when it goes to an insecure web site.

And third, I'm not sure what you're trying to say - that it's Java and Flash's fault? That these two not being there will somehow make OS X more secure?

Re:Am I reading this correctly?

[daver00]

You do realize those store say it has less security tools available because they are unnecessary right?

In what way is this relevant to the security of OSX? You basically just said: OSX is not as secure as windows by design. There is no such thing as unnecessary security in an OS.

Re:Am I reading this correctly?

[c6gunner]

Do you really think you are going to get a malware author to comment on why they don't write viruses for Macs?

Sure: back when, as a bored teenager, I used to write "malware", I targeted Windows because:

1. I couldn't afford to buy a Mac even if I wanted to, so trying to write malware for one would have been somewhat difficult.
2. Any time I did a random port-scan, I'd get 10,000 windows PC's for every Mac.
3. People who inquired about paying for my services NEVER asked about software for the Mac OS.

I might be exaggerating a bit with #2, but you get the gist. I know macs accounted for maybe 5% of the overall market at that point, but they were under-represented online because a lot of the systems that were connected 24/7 were corporate and school computers, and macs were a much lower portion of THAT market.

Granted I was never some 3v1l h4x0r hammering away assembly code in a dark basement with a green monochrome CRT, but given that most vulnerabilities tend to be exploited by curious amateurs with an intermediate understanding of computers I'd say my reasoning was quite common amongst self-styled "hackers" and script-kiddies. You can try and find some "l33t" guy to see what he thinks, but I have a feeling you'd get the same answer. Macs aren't worth going for unless you're looking to do a targeted attack against a specific individual or organization; if you're looking to build a bot-net or just gain notoriety, you go after whatever has the biggest market share.

That said, with the current growth in the mobile market, if I were still interested in such activities (and not worried about going to jail for a long, long time) I'd probably set my sights on iPhones and Android devices. People store a hell of a lot of personal data on them, and, from what I understand, their security is pretty abysmal. Now that 3g and WiFi are pretty much standard on phones, I think we'll see more and more malware for those platforms.

Re:Am I reading this correctly?

[PCM2]

I said that was what was missing from the guy's list. I don't have a Mac, so I don't really know how Apple handles patches these days.

Re:Am I reading this correctly?

[Phopojijo]

So... if Apple has a list of publicly known security flaws that can own the machine and they wait 'til they get 1/4 gigabyte patches to bother fixing them... and they don't get infected with a virus... how is it anything BUT lack of interest and obscurity that saved them? You're forgetting that most virus attacks are for Botnets and Spam Email where the goal is to reach tens-to-hundreds of thousands of machines before it's profitable. Spearphishing just isn't popular.

Re:Am I reading this correctly?

[LO0G]

Ummm... Have you looked at the Apple patch record? This page seems to indicate that they release security fixes every couple of weeks or so (none since January but every two weeks or so before then). The last quicktime fix contained fixes for over a dozen different CVE issues.

Re:Am I reading this correctly?

[hairyfeet]

While what you say is true on the surface, what you have to remember is this: Number 1 the guys doing this ain't poor, and I doubt they'll be selling their trophy which is what the pwn to own prize is.. Number 2 you have the prisoner's dilemma where if everyone else is going after A then the logical course would be to go after B, and Number 3 you have to remember that with all the new security features in Windows (DEP, ASLR, file and registry virtualization) being able to punch through all that will score some serious bragging rights. And finally don't forget the first to pwn gets $10k, which means the easiest target would be hit first since most would rather have 10 grand than a laptop anyway.

So in the end I'd say pwn to own is a pretty fair test, as it is using the bog standard OS with patches and typical software. There are too many ways to rig a test any other way, such as not allowing flash and other typical third party software, and pwn to own has been pretty good about setting up a machine you would see in the typical user's hands.

Now it is a shame that they don't have Linux in the running anymore, but from what I understand there was serious arguments over whether you should use the latest beta, the latest release, or the LTS version and nobody could decide. Considering how fractured the Linux landscape is right now you'd just get "Of course it fell, you used Distro X! You should have used Distro Y instead" anyway I can see why they just quit messing with the Linux portion.

Re:Am I reading this correctly?

[haruchai]

It's more about the iPhones and iPads - things that can be taken to a patient bedside, check medicine & dosage and update patient records or the doc can have something light and portable ( and starts up quickly ) that also has enough clarity to view medical images ( the iPad performs tolerably here )

Re:Am I reading this correctly?

[Anonymous Coward]

As a native speaker of Portuguese, which uses 'seguro' for both meanings, I had never fully appreciated that.

Thanks.

Re:Am I reading this correctly?

[Guy Harris]

The shit isn't magical, it's the same hardware for more money, with an artsy UI, and an instant "in" with the liberals.

Yeah, I'm sure this guy's Mac use will win big points with liberals....

Re:Am I reading this correctly?

[DavidRavenMoon]

Weren't a fair number of them WDEF-based viruses on floppies?

I got my first mac in 1994, a Performa 6115 (PPC). I remember that WDEF virus. I had gotten infected with it twice. Once was from a Zip disk (from someone else's Mac) and the other time it was on the installer CD for InternetPhone. It was annoying, but harmless. Since then I have had zero issues with malware and viruses. On the other hand, every person I know with a PC has problems on a regular basis. A friend gave me a flash-drive to copy a file onto, and it had two infected files. He doesn't even know where they came from. I don't understand why more Windows users don't use anti virus software. I use Norton Anti-virus just for those reasons, because I have to exchange files with Windows users, and I don't want that stuff to spread. I can't imagine how you would run an exploit on OS X anyway. You would have to run an installer, since it doesn't let just anything get installed on it without a warning or prompt.

Re:Am I reading this correctly?

[DavidRavenMoon]

The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort. If they ever cross the magic 15% threshold they're in for a very rude awakening.

Like everyone you mix up market share with install base. Who cares how many "compputers" a company is selling per year? Only investors .... The install base of Macs is likely around 30% in 1st world countries. The Mac is per definition more secure, despite of your good points, as a user is not running with Admin privileges, the Mail and Web Applications don't auto execute incoming traffic etc. The only way to infiltrate a Mac, that I'm ware off, is via Buffer overflows. angel'o'sphere

This is a good point. I haven't bought a *new* Mac since 2000. I'm on my second G4, which a friend gave me. My first one lasted 10 years, which is a real accomplishment in the PC world. My wife uses an old iMac, and both her and my son use older iBooks. So we have four Macs in our home, but those wont show up in "market" share based on new computer purchases. We are getting some newer Intel Macs this year, but still not brand new. I run all my user accounts with admit privileges, but that still has not shown to be an issue. You still have to use you pass word to anything to be installed, and down loaded files don't execute on their own (unless you have that feature turned on).

Re:Am I reading this correctly?

[DavidRavenMoon]

The install base of Macs is likely around 30% in 1st world countries.

Not even half that. Where are at least 50% if not more of the computers? In Offices...and what do 99% of companies use? Windows Even 10% of install base would be pushing it

But that's like quoting the market share of a Ford Crown Victoria; based on police department use. That's not the "real world." A lot of people have to use a PC at work, but have a Mac at home. My wife falls into that category. I'm lucky that I use Macs in my work. What's being done on those PCs in offices? The computer used at home (or even a laptop) is a better indication of what kind of machines people are using, as it is with cars people drive.

Also, as I mentioned before; in the NYC metro area I see Apple laptops outnumbering Windows Laptops 3 to 1 in my daily commute. And these are work machines with the owners being in suit and tie, etc. I know they are work machines, because I like to peek and see what people are running. The last person that sat next to me was a young guy with a MacBook Pro, and he was writing code. He was also using the terminal for everything, including launching URLs in Google Chrome. That seemed kind of pointless, but hey, he was a fast typist. ;)

Give it another 10 years and Apple will be at 50%. Look at what they did with the smartphone, MP3 player, tablet and music store market. They own those. And even if not everyone has an iPhone, look how many other phones are direct copies, right down to the icons and the form factor. I own an LG Rumor because I can't use an iPhone on Virgin. I'm sure I'm not alone.

Re:Am I reading this correctly?

[sznupi]

Well duh, that's what makes it hard to exclude possibilities between propensity for expensive gadgets (generally the most expensive per capita medical system - despite large numbers of non- & under-insured, despite that being just average driven by top spenders - for less than stellar results) and, somehow, one of quite few developed places where myths play such (at the least outwardly) role...

Good Old Apple...

[fuzzyfuzzyfungus]

They sure have increased their emphasis on security, now that they are in a position where insecurity might allow their customers to treat the devices that they own as such...

Re:Good Old Apple...

[Anonymous Coward]

mr. fuzzyfuzzyfungus, sir. i need to inquire about the status of your anus.

Re:Good Old Apple...

[makomk]

They sure have increased their emphasis on security, now that they are in a position where insecurity might allow their customers to treat the devices that they own as such...

I'm not convinced this actually counts as a troll. Apple left old and well-known vulnerabilities in third party libraries unpatched on the iDevices, right up until people started using them to jailbreak.

The opposite???

[BWJones]

"For as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true. "

Say, what? Is this FUD? No, seriously. I am unaware of *any* study that makes a compelling case for OS X being more insecure than Windows. Care to back up that assertion? Link?

Re:The opposite???

[Anonymous Coward]

It has been on Slashdot and other web publications many times. Google is your friend.

Re:The opposite???

[Anonymous Coward]

The burden of proof lies on the one making the assertion.

Re:The opposite???

[Anonymous Coward]

http://www.google.com/search?q=whats+more+secure+windows+7+or+mac+os+x&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a#hl=en&client=firefox-a&hs=YIo&rls=org.mozilla:en-US:official&&sa=X&ei=ZrdqTa2aEom-sAOkuPj9Cw&ved=0CBMQvwUoAQ&q=what's+more+secure+windows+7+or+mac+os+x&spell=1&bav=on.1,or.&fp=3f40f95b1b9c7c0d

BEGONE FANBOI, BEGONE!!

I'm not saying its true, but it seems a lot of people do say that's true.

Re:The opposite???

[Anonymous Coward]

Yes, we all know the FUD has been flying, he was asking for actual data.

Still waiting for the first Mac OS X virus in the wild...

Re:The opposite???

[Anonymous Coward]

you ever heard about Pwn2Own? OSX got cracked in about 2 minutes in one of the more recent contests. It was the first OS to be taken down. Win7 took awhile longer, since they already have experience in dealing with security issues (~90% market share tends to get you targeted a hell of a lot more).

Re:The opposite???

[Anonymous Coward]

http://www.google.com/search?q=whats+more+secure+windows+7+or+mac+os+x&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a#hl=en&client=firefox-a&hs=YIo&rls=org.mozilla:en-US:official&&sa=X&ei=ZrdqTa2aEom-sAOkuPj9Cw&ved=0CBMQvwUoAQ&q=what's+more+secure+windows+7+or+mac+os+x&spell=1&bav=on.1,or.&fp=3f40f95b1b9c7c0d

Followed a few of those links, they say the opposite.

I'm not saying its true, but it seems a lot of people do say that's true.

"I'm not saying that Obama is a communistic atheistic muslim terrorist transvestite, but it seems a lot of people do say that's true."

That's not an argument, it's a drive-by shooting.

Re:The opposite???

[Shikaku]

http://en.wikipedia.org/wiki/Pwn2Own

Pwn2Own contests regularly have Safari/Mac software as a valid winning target.

Is it good data? Maybe not. But the point is that Mac's aren't targeted much because the Windows desktop share is much larger (some figures say 90%). So while they can get viruses, it's not a valuable target for botnets.

Still waiting for the first Mac OS X virus in the wild...

http://www.symantec.com/security_response/threatexplorer/azlisting.jsp?azid=O

OSX.* near the bottom of the list. There's 13 on that list.

Re:The opposite???

[xactuary]

"For as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true. "

"Security researchers won't hesitate to point out the opposite is, in fact, true when paid to do so."

There, fixed it for ya.

Re:The opposite???

[rtaylor]

Windows is really easy to lock down and control from a central location in a corporate environment.

I can't even imagine what deploying and maintaining 1000+ macs would be like.

Re:The opposite???

[zlogic]

Apple has been insisting for years that OSX has zero viruses. Users start to think they're invincible and run any downloaded binaries without a second thought.
Apple is also releasing security updates (but less frequently than Microsoft). In addition, since Apple products "just work", sometimes they have to reduce security in order to make the product easier to use.

Re:The opposite???

[Anonymous Coward]

You're waiting days are over!

http://news.techworld.com/security/5392/worlds-first-os-x-virus-hits-apple/

It's amazing to me how you even mention that OS X might be susceptible to malicious users, and all the mac boys start foaming at the mouth.

Re:The opposite???

[bloodhawk]

No it isn't FUD, do some research online, Just about every hacking contest sees OS X go down in a ball of flames in minutes, Just about every patch cycle from apple sees more security vulnerabilities patches than are found in all MS products combined in a year. Many security researchers have been pointing out Apples Lax Security practises for a long time, seems they might finally be getting the message now that there share of the pie is significant enough to warrant it being an issue.

Re:The opposite???

[Anonymous Coward]

Hmmm... Security issues? Or is it more likely that a talented hacker would rather hack a £1500 Macbook Pro rather than a crappy generic Windows laptop?

Re:The opposite???

[JSombra]

Work in a place with 1500+ mac's and it's hell

Re:The opposite???

[klubar]

Question is... are there any restrictions on what the "security experts" can report? Is this a way to legally limit what they are allowed to say... in exchange for preview copies they sign a nondisclosure agreement to only report the issues to Apple? It seems that if Apple was really serious about security they would allow the experts (and others) to have access to the source code.

Re:The opposite???

[speedingant]

It's not bad actually... You need a MacMini server x2 to replicate each other, and push out the managed settings. You can authenticate machines via AD/OD/OpenLDAP. You can host the home folders off any NFS/AFP server. Netboot, netrestore etc makes deploying easy.. I'm looking after 150 Macs at the moment, as well as a host of PC's, and I don't have many issues. It' s just me.

Re:The opposite???

[mikael_j]

Well, the pwn2own losses for OS X have all been due to flaws in Safari. While still serious it's hardly proof of OS X being inherently less secure than Windows or Linux.

Re:The opposite???

[Anonymous Coward]

As soon as there is a virus that has actually affected macs worldwide come back to gloat. Hacking with rules is like doing science in a lab. Look how messed up global warming theories are.
Also one would think that Apple's 90% share of computers above 1000$ would make a better target than cheap ass pcs.
http://www.betanews.com/joewilcox/article/Apple-has-91-of-market-for-1000-PCs-says-NPD/1248313624

Re:The opposite???

[Daniel Dvorkin]

And there's one actual virus on that list ... which, if you read the description, you'll see is a proof of concept. Wow, OS X is just as insecure as Windows!

GMAFB. You can talk about pwn2own all you want, but in the real world, no rational person doubts that OS X users are much, much safer from malware of all kinds than Windows users are. The market share argument doesn't hold water either, because in the "Classic" Mac OS days, there were in fact large numbers of genuinely dangerous Mac viruses in the wild -- not as many as PC (Windows and DOS) viruses to be sure, but a hell of a lot of them, as opposed to the effectively zero there are now. The millions of installed OS X machines running with default out-of-the-box setups would be a juicy target for malware authors, precisely because of the casual attitude most OS X users take toward security. If you're going to come up with a reason why this hasn't happened yet, other than just admitting OS X is inherently more secure than Windows, you're going to have to do better than a link to a Symantec list or a contest that represents security threats very different from those most users of all OSs face in everyday use.

Re:The opposite???

[polaris20]

There are no viruses in the wild for OS X. There are, however, Trojans in the wild. Not the same thing. However Apple users by and large are quite arrogant and care-free about the security of their OS, and IMO are just asking for it. BTW, you can easily run OS X in a non-admin account without issue, which is more than can be said for Windows 7, which is irritating as all hell unless you run as an admin. At least OS X has that going for it.

Re:The opposite???

[AliasMarlowe]

Still waiting for the first Mac OS X virus in the wild...

McAfee lists 48 known "viruses" for OSX. Most appear to be Trojans giving remote access or subverting DNS. I perused a few of the McAfee descriptions, and it was not immediately clear whether these infections would be self-propagating (as one would ordinarily expect of viruses). Just like other *nix threats, they require the user to actively run the infecting program and enter a privilege-escalating password.
While not a Mac user or fan (Linux user, mostly), I am also mystified by the characterization of OSX as being less secure then Windows. Even turning to social engineering as a security hole, it's not certain that Mac users would be easier to subborn than Windows users.

Re:The opposite???

[Relayman]

According to this link, Pwn2Own was about cracking browsers, not operating systems. Seems to me that there is a difference.

Re:The opposite???

[Anonymous Coward]

While Ive never personally claimed anything beyond more "security" by obscurity... I would point out that at many of the hacking contests, the people targeting OSX do so specifically because they feel it is a smaller target. (fewer competitors? Easier to be the "only" one to know about a specific issue? whatever)

I will say that OSX has been phenomenally more stable than windows. Windows 7 was long overdue, and has held up pretty well, but it is stil a bit if a pain in the ass.

I am glad to hear that Apple is finally thiking more about security. They have relied on obscurity and "we have a Unix foundation" to get by for too long. They ceertainly have to tools and expertise... They just haven't had much of a reason until lately. If Apple starts really putting the Unix underpinnings in OSX to use, thinks about security, and does with the *nix enterprise management tools what they have with the GUI.. Windows could be in trouble in the enterprise... Not that Apple has ever really shown any interest in the enterprise...

Re:The opposite???

[Relayman]

I should have said "will be." It's going to be March 9 through 11.

Re:The opposite???

[simoncpu was here]

Work in a place with 1500+ mac's and it's hell

Work in a place with 1500+ Mac users and it's hell. There, fix that for you.

Re:The opposite???

[Anonymous Coward]

Obama is a communistic atheistic muslim terrorist transvestite

atheist AND a muslim? props to him if he can pull that off

Re:The opposite???

[Anonymous Coward]

Actually, Windows 7 works great with a standard User account, with one exception - it won't let you install fonts. I really wish there was a separate permission somewhere for that.

Re:The opposite???

[nighty5]

a great deal of these 'vulnerabilities' in OS X are from open source software projects which release the advisories.

i guess you haven't seen any security updates from Ubuntu/Redhat or any other UNIX, before have you?

when you release a UNIX distro with a ton of software using many different packages, frameworks and programmers with varying levels of appetite for security completeness, you are going to run into a myriad of issues.

MS also have their issues, but you can't compare apples with oranges.

Re:The opposite???

[Anonymous Coward]

well, for instance, you have never been able to get past windows logon by simply entering a few thousand spaces as your password.. cant say the same about fadintosh

Re:The opposite???

[node 3]

However Apple users by and large are quite arrogant and care-free about the security of their OS, and IMO are just asking for it.

That's an odd take.

Anyway, as things stand right now, being "care-free" about viruses/malware is warranted. Once some actual outbreak occurs, or malware becomes more than a handful of trojans on pirated copies of Photoshop and iWork, the care-free days are over. But until then, what's wrong with accepting reality as it is as opposed to worrying about what might someday come to pass (but for over a decade now, hasn't)?

Re:The opposite???

[Shikaku]

GMAFB.

Is it good data? Maybe not.

Meaning I'm implying it's data, but probably only that. I said no such thing as MACS ARE SECURE HURR.

I actually don't care about this topic, AC asked for data.

And if I really want to, I can spin it the other way with Windows XP:

http://blogs.chron.com/techblog/archives/2008/07/average_time_to_infection_4_minutes_1.html

Which means that there are viruses that scan the internet for open security holes regularly at random IP addresses to infect other machines.

OH NO XP IS INSECURE, WE SHOULD ABANDON IT!

No, not really, it just means you should keep it patched, and not used EOLed OSes. If you are unlucky to have an XP without any SP for whatever reason, you should not connect it to the internet, and patch it offline.

So what is my point? The internet is dangerous where known and unknown threats can be found, but there are simple steps for each OS (car analogy: wear seatbelts) to help keep you safe, such as regular patching.

Re:The opposite???

[Anonymous Coward]

http://news.cnet.com/8301-10789_3-9973703-57.html

BEGONE FANBOI BEGONE!!

Re:The opposite???

[polaris20]

Just because it's not widespread doesn't mean it doesn't exist. I don't see the harm in exercising a little caution and common sense when downloading and installing apps, even on OS X.

Re:The opposite???

[jimicus]

There are very few true viruses in the wild at all these days. The great majority are actually trojans or worms.

Re:The opposite???

[fluffy99]

The statistics bear this out. 2003-2011, Mac OSX had 2.6x as many vulnerabilites at Windows 7. Plus a higher percentage were serious vulnerabilities.
http://secunia.com/advisories/product/27467/?task=statistics
http://secunia.com/advisories/product/96/?task=statistics

Re:The opposite???

[Haedrian]

And there's one actual virus on that list ... which, if you read the description, you'll see is a proof of concept. Wow, OS X is just as insecure as Windows!

Alcatraz has had a number of jailbreaks. My grandmother's white fence has had 0 jailbreaks. My grandmother's fence is more secure than Alcatraz!

Just because few people take advantage of such a system doesn't mean anything. Mac has a tendacy to pull out a large patch every few months or so - that's insecurity at its finest. Obviously if they had larger market share in this day and age, they'd be more viruses.

Re:The opposite???

[node 3]

No it isn't FUD, do some research online, Just about every hacking contest sees OS X go down in a ball of flames in minutes

Yes, minutes... After the contest enters the phase where you can load files remotely. And minutes later, Windows and Linux go down (everyone attacks the Mac first, because pwn2own means you get to keep the computer you pwn, and everyone wants the Mac).

Just about every patch cycle from apple sees more security vulnerabilities patches than are found in all MS products combined in a year.

Not remotely true. However it is true that in pure numbers, Apple patches more vulnerabilities than MS. These are primarily in Open Source products included with Mac OS X, and is seen as a strength, not a weakness. Also, Mac OS X patches tend to be local vulnerabilities, while Windows patches are far more often remote vulnerabilities, which are significantly more critical.

Many security researchers have been pointing out Apples Lax Security practises for a long time

Yet somehow the sky has never fallen. It's possible that Mac OS X is theoretically less secure than Windows, but it's absolutely certain that Mac OS X is, in actual real world usage, significantly more secure than Windows. Hands down, no-contest.

Pwn2own and "patches per year" are interesting metrics, but the only thing that matters is whether a user has to worry about their computer being compromised, and Mac users don't, Windows users do. It's as simple as that. Everything else is academic and hand-waving side-stepping of the actual issue.

seems they might finally be getting the message now that there share of the pie is significant enough to warrant it being an issue.

Apple has had sufficient market share since the beginning of consumer viruses and malware. There were plenty of Mac viruses back when their market share was far lower than it is now. It's absurd to claim that there are essentially zero malware for Macs because of market share, when their market share is large enough for thriving third-party software and hardware. Market share plays a role, but is not *the* primary reason.

What this indicates is that Apple is being proactive in making sure Macs remain as secure as they are today, and not resting on their laurels.

Re:The opposite???

[mr100percent]

Easy, get OS X Server, make a standard disk image and either use NetBoot or have them reimaged regularly. Not that hard, there are numerous mailing lists and Howtos for it.

Re:The opposite???

[Concerned Onlooker]

That's nothing compared to putting up with PC users. They are far more irritating that any Mac user I've ever run into.

Re:The opposite???

[Concerned Onlooker]

As arrogant as Mac users happen to be, it seems they are always half as arrogant as PC users.

Re:The opposite???

[Daniel Dvorkin]

Amazing. The market share argument has been shown to be utter crap, over and over again, and you people just keep repeating it. Is it some kind of religious belief with you? Mac users get accused of fanaticism a lot, and not without justification, but I swear there's nobody more fanatical in the computer world than a Mac hater on a roll.

Re:The opposite???

[polaris20]

Hard to say. What's worse, smugly saying "My computer just works, and it's totally safe" or "I can build a more powerful PC for half as much as your shiny Mac!". I guess we're all douchebags. Since I use both, I guess that makes me a confused douchebag. :)

Re:The opposite???

[99BottlesOfBeerInMyF]

There are very few true viruses in the wild at all these days. The great majority are actually trojans or worms.

You do know that, "worm" is a subset of, "virus" right?

Re:The opposite???

[Anonymous Coward]

However Apple users by and large are quite arrogant and care-free about the security of their OS.

As opposed to all the fucking geniuses running Windows. Haven't you walked into an office and seen the idiots at just about any PC who have trouble selecting a font?

Re:The opposite???

[Jeremi]

My grandmother's white fence has had 0 jailbreaks. My grandmother's fence is more secure than Alcatraz! Just because few people take advantage of such a system doesn't mean anything.

It means a lot to your grandmother. I'm sure she's much happier living in a nice house with a nice white fence, than she would be living in Alcatraz. And in either location, she hasn't had her living space broken into.

Re:The opposite???

[Jeremi]

Work in a place with 1500+ mac's and it's hell

Care to explain what makes it hell? I'm genuinely curious.

Re:The opposite???

[Jon Abbott]

Lies, damned lies, and statistics. Considering that Windows 7 has only been out 493 days as of this posting, and 2979 days have elapsed since the beginning of 2003, that means that one vulnerability is announced every 8.6 days on average for Windows 7, versus one vulnerability every 19.9 days on average for OS X.

Re:The opposite???

[gcerullo]

Apple has been insisting for years that OSX has zero viruses.

This is wrong. Stop spreading this myth. Apple has NEVER made any such claim. Please show me where Apple makes a claim that OS X has zero viruses.

Re:The opposite???

[UnknowingFool]

So what is my point? The internet is dangerous where known and unknown threats can be found, but there are simple steps for each OS (car analogy: wear seatbelts) to help keep you safe, such as regular patching.

There are no secure systems out there. There are only some system less vulnerable than others. The problem with Windows is that its history of security is very pathetic. You assume that regular patching is the panacea to Windows security. Just last week, MS acknowledged a zero day flaw in SMB. How is regular patching going to guard against a zero day? The main problem for MS has been that Windows is coming from a design which never had security in mind in the beginning. Whereas Unix dealt with the challenges of networks, security, and multiple user access decades ago, MS has bolted on security time and time again.

Whether you want to admit it, Windows has security problems and sometimes there's very little a user can do about it or even detect it. I remember the last time I got a trojan. I was visiting a news site. Somewhere in one of the ads, it planted a trojan. This wasn't some dark corner of the internet. This was the Atlantic Monthly. Getting rid of the trojan required a fresh install.

Re:The opposite???

[gcerullo]

Just about every patch cycle from apple sees more security vulnerabilities patches than are found in all MS products combined in a year.

Although this is patently false, all this proves is that Apple is better at discovering and patching vulnerabilities than Microsoft is. The total number of vulnerabilities in an OS at any one time is an unknowable figure. For all we know there are thousands of vulnerabilities in Windows and only hundreds in Mac OS. If that were the case then the fewer number of vulnerabilities found and patched by Microsoft each month would only prove that many vulnerabilities remain un-patched and the many number of vulnerabilities found and patched by Apple means that fewer vulnerabilities remain un-patched.

Therefore, because of the fact the actual total number of vulnerabilities is unknown in any one system, your metric of measurement is meaningless.

Re:The opposite???

[AdrianKemp]

You realize that "Clicking on the file" is not a virus right? Viruses must by definition replicate without user interaction.

That's like me sending you a dos batch file on windows and you being dumb enough to run it. If we're extending the definition of virus to "anything some dumbass might run that could hurt their system" then every operating system has an infinite number of viruses just waiting to nail it.

Re:The opposite???

[Xyrus]

When it comes to security, the problem is the person operating the computer. Malware and viruses don't just magically appear on a system unless there is a remote exploit, and even then it often takes user interaction to make it work.

It doesn't matter how secure you think your favorite operating system is. If someone has admin rights on that machine, then it will be vulnerable to the first NataliePortmanNekkedWithGrits.* that person downloads and runs.

Re:The opposite???

[ColdWetDog]

Idiot.

With reports of the Leap-A program infecting some Macs, it’s important to keep the news in perspective. While Leap-A has the potential for mischief, it’s not anything like a crippling Windows virus that periodically brings the rest of the computing world to its knees. More important, as explained below, this incident doesn’t expose a security hole in the Mac operating system. Rather, it’s a piece of malware that can be easily rebuffed by vigilant Mac user.

Source

Re:The opposite???

[WaffleMonster]

Yes, we all know the FUD has been flying, he was asking for actual data. Still waiting for the first Mac OS X virus in the wild...

That noone is even bothering to write viruses for OSX speaks volumes for the situation.

I've been hearing how the MAC platform is secure...since...back before they even had a preemptive kernel or a sane security model when apps and the OS crashed regularly. This is/was obviously bullshit.

Perception is everything... windows is viewed to be less secure because it is by far a bigger target. All social engineering / botnet efforts are focused on it to maximize attacker ROI.

If an OSX luser received an email telling them to download and run a program to see if they won $1million ... what precisely would make the outcome of that exercise any better than the same situation twoard a windows vista/7 user?

I imagine in either case the attacker would include instructions for bypassing UAC/security prompts as is quite normal for many popular legitimate software installs from the Internet today.

Fooling lusers is easier than finding vulnerabilities and a system is only as secure as its weakest link.

Re:The opposite???

[WaffleMonster]

Apple has had sufficient market share since the beginning of consumer viruses and malware. There were plenty of Mac viruses back when their market share was far lower than it is now. It's absurd to claim that there are essentially zero malware for Macs because of market share, when their market share is large enough for thriving third-party software and hardware. Market share plays a role, but is not *the* primary reason. What this indicates is that Apple is being proactive in making sure Macs remain as secure as they are today, and not resting on their laurels

Can I ask what makes OSX more secure than windows vista/7 when faced with the problem of a user being tricked into loading malicious software? Complete with instructions for bypassing any UAC/security warning prompting they may encounter?

I would love to see someone provide a cogent answer for this one simple question... Most successful attacks on the masses are social engineering that expliot no systems vulnerabilities of any kind.

I get your perception = reality = security idea but it is in fact a lie... security by obscurity.. It is critically important to understand the underlying reality...

The IPhone is a good model of protecting the user from themselves but personally I would only submit to that level of lockin and single vendor control after I am long since dead.

How do you protect the user from themselves while still preserving choice and an open ecosystem?

You could do least privledge but even then malicious code has access to all of the data the user cares about! You could virtualize and sandbox everything but programs often need to interact and interchange data.

It is in fact a very difficult question...one that no general purpose operating system vendor currently has an luser proof response.

Re:The opposite???

[jimicus]

Never really thought of it like that, always thought of a virus as being something that requires a running program to infect and spread by.

A worm, OTOH, doesn't necessarily attach itself to a running program.

In common parlance today, "virus" has become a bit of an umbrella term for more-or-less any sort of malware. If you want to be strict about it, that's not correct, but let's face it - as far as the general public is concerned, that ship sailed a long time ago.

Re:The opposite???

[makomk]

There are no viruses in the wild for OS X. There are, however, Trojans in the wild.

There aren't enough OS X systems to make a virus worthwhile. It probably wouldn't be able to spread due to all the non-infectable Windows installs out there. Now, you might be able to write a virus that infected both, but once you've got to 90% why bother with the last 10%? Especially given that adding a second platform is probably going to require at least as much effort as the first, possibly much more depending on the type of vulnerability and the restrictions it places on your payload.

Re:The opposite???

[pandrijeczko]

You clearly have little concept of the differences between Windows and OS X (well, beyond "Windows sucks but Apple is cool, dude" anyway) so I'll try to explain it in simplistic terms.

Viruses and Trojans propagate easily through Windows systems because there is a common platform across many machines in which a piece of malware can run, and because a lot of Windows users run in administrator mode with deeply-embedded applications running with similar permissions, malware can get deeply into the system. Yep, a lot of that is bad design of the OS but that's how it is.

A UNIX-like system is not susceptible to the same type of malware propagation because there are many different variants of UNIX that don't frequently run common binaries (i.e. programs need to be compiled for each specific type of UNIX). However, a bigger barrier to virus propogation is the fact that UNIX instills in you from the outset to do as much as possible as a normal user and just change to root when you need to.

I am a huge fan and user of Linux but I tell you now, categorically, the above facts DO NOT AUTOMATICALLY MAKE YOU SAFE!

UNIX "presents" applications to the network ("daemons") that have been started from their own shell and if you manage to crash those daemons, then you can force the system to drop to a shell prompt. If that daemon was running with root permissions, then it will drop to a root shell prompt and you then have unrestricted access to the system to do what you like - this type of attack is known as a "buffer overflow attack" because it's purpose is to crash the daemon by sending either too much data for it to process or badly constructed data. And this is precisely why modern UNIX systems usually try to run daemons at normal user level, rather than root, so that in the case of a crash, it drops to a user shell only in which you can do a lot less damage because you are far more restricted at a permissions level.

Another form of attack is "brute forcing" where you try to break open an application by continually trying to send, say, a valid password to log into the system.

In both cases, such attacks need to be directed at a specific application, maybe even a specific version of that application with a known vulnerability that can be exploited. However, because it's possible to drive attacks from an automated program, a lot of machines can be tested very quickly for vulnerabilities.

If you have enough knowledge of what you are doing and don't believe me, make sure your machine is logging everything and then stick it in the DMZ of your home router, maybe run up Wireshark packet sniffing at the same time. I guarantee you that if not immediately, then within minutes you will see signs that something out on the Internet is having a look at what's running on your machine - a common one is brute forcing the SSH daemon where syslog will show you spurts of activity of something trying to get access to your machine by systematically trying common account names.

What's worse in your case is Apple markets their machines as being easy to use but, the fact is, you need to know a lot about UNIX before you can be relatively confident that you are safe. Incidentally, I got seriously into UNIX security about 8 years ago when I put a home server on the Internet, stupidly left an FTP service running, it got buffer overflowed and a script got installed on it to kick users from an IRC channel. I found out about it when my ISP disconnected my account due to complaints and it took me over two weeks of sending them logs and emailing them to get it reinstated. Suffice it to say, I've never been hacked since.

The moral of the story is "Don't get too complacent" and you'd be far better off reading a few books about UNIX security now rather than sitting there thinking it will never happen to you.

Re:The opposite???

[Wovel]

He is lying, made up a big number to sound cool. Having worked in large environments with both platforms, the tools for managing large OSX deployments are as good or better than Windows and significantly less expensive.

(see below).

Re:The opposite???

[Wovel]

Interesting, because the market share of servers running that version of ftpd is significantly less than the desktop OSX market.

Weird. I believe it is impossible anyone took the time to exploit it.

Re:The opposite???

[Wovel]

You fail at statistics. Wow. I would dare say, Epic Fail.

Re:The opposite???

[Anonymous Coward]

What's worse in your case is Apple markets their machines as being easy to use but, the fact is, you need to know a lot about UNIX before you can be relatively confident that you are safe. Incidentally, I got seriously into UNIX security about 8 years ago when I put a home server on the Internet, stupidly left an FTP service running, it got buffer overflowed and a script got installed on it to kick users from an IRC channel. I found out about it when my ISP disconnected my account due to complaints and it took me over two weeks of sending them logs and emailing them to get it reinstated. Suffice it to say, I've never been hacked since.

The moral of the story is "Don't get too complacent" and you'd be far better off reading a few books about UNIX security now rather than sitting there thinking it will never happen to you.

I know you love to act like you're all high and mighty and l33t, but all you are is an idiot blowhard who can't see the forest for the trees. OS X installs default to having zero services (FTP, SSH, whatever) enabled, and in my experience inexpert OS X users are unlikely to try to enable any. The pref pane isn't really obscure, but it is in a place where they tend not to look, in part because they aren't looking for it -- one truism about inexpert users is that they don't usually think in terms of setting up one computer as a server for another. No services equals no network vulnerability, short of finding remote exploit holes in the TCP/IP stack.

The one and only principle you MIGHT need to teach UNIX-naive OS X users is "don't turn anything in the Sharing section of System Preferences on if you don't know what you're doing". They do not need to be shell wizards before being confident that they're safe from the type of hacking you ranted about.

Re:The opposite???

[pandrijeczko]

Look, I'm sorry, I'm a simple security consultant, a mere mortal, nothing more than that.

When I read phrases like "market share", my brain starts to hurt & braincells scream their last dying breaths... I'm *just* a bloke wot fixes stuff, nothing more.

Please, go now. Go find someone who lives on that higher plane of "tax dollars", "margins" and "pre-tax profits" because your words are now going fuzzy and are spinning around... I need to go lie down now...

Re:The opposite???

[pandrijeczko]

Not that I care what some bloke I've never met on the other side of a computer screen somewhere in another part of the world thinks of me but here's a quick story.

I work in system security for a telecoms company, have done for 5 years now & spent about 20 years in tech support in telecoms & UNIX, also done more than my fair share of sysadmin work. (Yes, I'm *that* old.)

Yep, I used to think I was a pretty "l33t" guy, then my home Linux server got hacked about 8 years ago because I stupidly left an FTP daemon running. Several scripts were dumped on my machine that kept kicking people off of a few IRC channels, someone complained to my ISP and my connection got severed by them. After two weeks of emailing them and sending them logs, they accepted it wasn't me and reinstated my connection - being hacked is quite a humbling experience.

Since that time, I read up a lot on OS security, tried a lot of stuff myself and now I work as a security consultant for a telecoms company - it's interesting, it pays well, I'm happy.

I do a lot of auditing and hardening of customer servers, I see (and fix) a lot of security holes put on systems by people who were well intentioned but didn't fully understand what they were doing - passwordless accounts, unpatched daemons running, scripts doing some pretty scary things on systems. Not one of my customers is confident enough in their management abilities of those servers to trust them to be exactly the same as when they were delivered in shrinkwrapped boxes, so they get me to come in and close down any holes.

So if you choose to ignore my advice, that's your call, it makes no difference to me. But rest assured that one of the worst things you can do is not double check your systems on a regular basis and become too self-assured about your own security.

Re:The opposite???

[fluffy99]

You fail at statistics. Wow. I would dare say, Epic Fail.

What? You can't understand that OSX has had more TOTAL vulnerabilities than Windows7, a higher percentage of which were serious vulnerabilities? Sure you can interpret the other way and look at the rate at which they were found, but that's a different argument.

Re:The opposite???

[Guy Harris]

What? You can't understand that OSX has had more TOTAL vulnerabilities than Windows7,

What? You can't understand that "OS X" corresponds not to "Windows 7", but to the entire Windows NT series, and that the equivalent of "Windows 7" would be something like "OS X Snow Leopard"? And that the only reason that, 2003-2008, Windows 7 had zero vulnerabilities was that, 2003-2008, Windows 7 didn't, err, umm, exist as a product, as it was released to manufacturing in the middle of 2009? (BTW, is it just me, or is "windowsteamblog.com" continuing in the grand tradition of "expertsexchange.com"? Why is steam condensed on your window worthy of an entire blog? :-))

Unfortunately, Secunia neither offers a page for the Windows NT family as a whole, nor for individual releases of Mac OS X (although they do offer pages for individual releases of iOS!), so there's no way to compare, for example, Windows 7 and OS X Snow Leopard, but if, for example, we compare Windows 7 and OS X statistics in 2010 (that being the only year in which both Windows 7 and OS X Snow Leopard were available for the entire year), we have 47 advisories for Windows 7, 20 of which are critical, and 6 of which, 4 non-critical, are unpatched, and 12 vulnerabilities for Snow Leopard, 8 of which are critical, and 2 of which, both non-critical, are unpatched. Statistics for 2009, where they were both available for approximately the same amount of time, and for 2011, where they are available for exactly the same amount of time, are left as an exercise for the reader.

Then again, if Windows 7 in its entirety has more lines of code than Snow Leopard in its entirety, that might just be a case of "the same number of vulnerabilities per line of code, or fewer vulnerabilities per line of code, but they have more lines of code", so it's not clear that, even once you compare particular OS versions, rather than comparing a particular version of one OS to all versions of another OS, you necessarily have an easy way for fanboys or foeboys of one particular OS to validly beat up another OS or defend a particular OS.

Re:The opposite???

[Guy Harris]

UNIX "presents" applications to the network ("daemons") that have been started from their own shell and if you manage to crash those daemons, then you can force the system to drop to a shell prompt.

Err, umm, what? At least one UNIX has its daemons started directly by a system daemon, without an intervening shell. Even in UN*Xes that launch daemons from rc files, the shell running the rc file doesn't hang around forever.

If that daemon was running with root permissions, then it will drop to a root shell prompt and you then have unrestricted access to the system to do what you like - this type of attack is known as a "buffer overflow attack" because it's purpose is to crash the daemon by sending either too much data for it to process or badly constructed data.

No, buffer overflow attacks aren't intended to crash the daemon so you get to type at the (either non-existent or, if there are any cases where it exists, non-interactive) shell that started the daemon, buffer overflow attacks are typically intended to get the daemon to run code you stuffed into the buffer in question.

Why did they wait until now?

[kmdrtako]

I'm certain they have their own internal security experts, but if they were going to reach out to outside experts, they should have done it a lot sooner.

Re:Why did they wait until now?

[Anonymous Coward]

I'm certain they have their own internal security experts, but if they were going to reach out to outside experts, they should have done it a lot sooner.

Mac OS X Lion was only released to developers this last Thursday. Bringing in security people to look at it earlier than that would require putting them under NDAs, which makes them effectively insiders and defeats the purpose of getting outsiders to look at it (i.e. peer review and sharing research results with other researchers).

I know that Slashdotters assert Apple as evil, but good grief, rein in the jingoism, please.

Re:Why did they wait until now?

[ynp7]

Apple is a nation now? Geez, you Apple fanboys have it even worse than I imagined.

Re:Why did they wait until now?

[Anonymous Coward]

They didn't. They already tried (ref [https://ssl.apple.com/support/security/commoncriteria])

Re:Why did they wait until now?

[kmdrtako]

I'm certain they have their own internal security experts, but if they were going to reach out to outside experts, they should have done it a lot sooner.

Mac OS X Lion was only released to developers this last Thursday. Bringing in security people to look at it earlier than that would require putting them under NDAs, which makes them effectively insiders and defeats the purpose of getting outsiders to look at it (i.e. peer review and sharing research results with other researchers).

Nope, I don't buy your argument. If they find something major now, the likelihood is it's not going to get fixed. If they found it six months ago, there's a lot better chance it could have been fixed by now.

Snow Leopard developer preview was June 2009, FCS was August 2009. If we can judge anything at all from that then Lion will ship in April or May. Three months is not enough time for a major overhaul if one is needed and QA, etc.

I know that Slashdotters assert Apple as evil, but good grief, rein in the jingoism, please.

Huh?

Re:Why did they wait until now?

[Anonymous Coward]

I think he meant sooner as in "versions before Lion." Why hasn't Apple been caring about security for these past 10 years?

Re:Why did they wait until now?

[catmistake]

I know that Slashdotters assert Apple as evil, but good grief, rein in the jingoism, please.

I think it's more about loving to hate. If you read the book first, you'll insist it is better than the movie. So if you already love Windows, you'll hate anything else. I never loved Windows, so I love everything and anything else. Any security expert that claims Windows is secure OTB has self-interest in non-security experts using Windows: i.e. it keeps them employed. This thing Apple is doing is likely the first time evar that any security expert made money with OS X concerning security. Counter examples are welcome (like... "we tried to secure the 50 OS X boxes in the lab... but they fell like dominoes and the NOC tells us their now part of some giant botnet").

Re:Why did they wait until now?

[Cronock]

Well now that they don't have an enterprise-class server, and exciting the pro market, it's the perfect time to make their OS enterprise ready!

Re:Why did they wait until now?

[gcerullo]

Why hasn't Apple been caring about security for these past 10 years?

Yes, because as we all know, during the past 10 years Apple hasn't issued a single security patch nor have they implemented any security measures what so ever such as ASLR, DEP, or application sandboxing etc.

You know, just because you post it on slashdot doesn't make it true.

Re:Why did they wait until now?

[Cronock]

Snow Leopard was a more minor update than Lion is, as far as devs are concerned. I suspect it will be at least late summer till this is out. They've released a very early and buggy(from what I hear) DP build so devs will have plenty of time to get their apps ready for the more drastic changes. This should provide plenty of time for security researchers to battle-test it.

Re:Why did they wait until now?

[Ash-Fox]

You know, just because you post it on slashdot doesn't make it true.

You obviously doubt the power of Slashdot. Slashdot can heal people and raise them from the dead, turn water into wine, it's power is limitless.

"that the opposite is, in fact, true"

[javacowboy]

"For as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true."

Have any quotes or links to back that up, Mr. Submitter?

Re:"that the opposite is, in fact, true"

[Gaygirlie]

Have any quotes or links to back that up, Mr. Submitter?

Why would the submitter need to provide those? It's not his claim, it's a direct quote from the article itself.

And yes, among security researchers the general consensus indeed does seem that OSX is quite poor from security standpoint and I applaud Apple on their efforts in trying to beefen it up. It's hard to point one to some direct quotes on this as it's mostly just a comment here or there, but here's atleast two links:

http://www.techrepublic.com/blog/security/security-vs-popularity/4403
http://pcworld.about.com/od/securit1/The-Truth-About-Apple-Securit.htm

Re:"that the opposite is, in fact, true"

[fluffy99]

Have any quotes or links to back that up, Mr. Submitter?

Is it just me, or do a lot of the Mac fan-boys not know how to use Google before they open their moth and insert their foot?
http://www.tomshardware.com/news/pc-windows-apple-mac-osx,9557.html (second google hit, btw)

Re:"that the opposite is, in fact, true"

[javacowboy]

Doesn't matter. The submitter stated it as a fact. The article doesn't make much of a case for it either.

I won't say that OS X has a perfect security record, but Windows historical has an abominable security record. Things are much better now, but I still read about vulnerabilities in Windows 7 and IE, and Microsoft still patches very frequently after 0-day exploits come out.

Besides, the techrepublic link you posted still says that OS X's security architecture is much stronger than Windows and only really makes a case for saying that Apple's secrecy and slow patching are the problem, in addition to applications like Safari. Granted, Safari is distributed with OS X, but saying that the OS itself is insecure is very different from saying that individual applications are to blame.

Still, it's really an incredible claim to say that any OS can be more insecure than Windows. The reason Windows will always have security problems is the legacy baggage, including old APIs and developer expectations of users having administrator rights out of the box. A complete rewrite of Windows and elimination of any expectations of backward compatibility will be needed to address the fundamental security flaws in Windows' architecture.

Re:"that the opposite is, in fact, true"

[angel'o'sphere]

Thats a news site, in other words a newspaper.
Citating a newspaper is kinda ... stupid, isn't it?

angel'o'sphere

Re:"that the opposite is, in fact, true"

[fluffy99]

Thats a news site, in other words a newspaper.
Citating a newspaper is kinda ... stupid, isn't it?

angel'o'sphere

Thats a news site, in other words a newspaper.
Citating a newspaper is kinda ... stupid, isn't it?

angel'o'sphere

Did you bother to read the article and the quotations from Security experts. Just because it's in a newspaper doesn't mean its wrong.

Free work?

[Anonymous Coward]

So they're asking for free work? I mean, it's not like we as a community (or security experts as a community) can take advantage of the knowledge put into these fixes. Not to mention that security consultants' time is expensive.

Re:Free work?

[aiht]

No, they are offering interested parties a chance to do free work, if it interests them to do so. They're not creating any obligation on the security experts to provide their time if they don't want to.

Anonymous?

[xactuary]

Posted by Anonymous. Not the 133+ haxors, but rather Steve Ballmer.

What an honor to work for free

[rdarden]

How about paying reputable security researchers (or testers) to evaluate the software?

Re:What an honor to work for free

[Anonymous Coward]

They want the benefits of open source mentality without having to give back.

Re:What an honor to work for free

[99BottlesOfBeerInMyF]

They want the benefits of open source mentality without having to give back.

Umm, most all of their security frameworks are open source. The MAC framework was based on the TrustedBSD variant of the same, and although not required by the license, Apple has continued to keep their fork open source. They are giving back the source to tons of code. They are, in fact, a huge OSS contributor. For example, Webkit2, incorporating protected memory threads into Webkit directly is open source and written by Apple. Google wrote similar software, but kept it out of Webkit so that other Webkit based browsers did not automatically gain the same security/stability benefits as Chrome. It is a serious security improvement, Apple wrote it, and contributed it, and the OSS community is incorporating it to the benefit of all.

more secure

[Anonymous Coward]

The problem is that security experts like to point out potential things that bad people could do, instead of actual bad things that bad people are doing. OS X is still one of the least attacked platforms out there, and most of the exploits that security researchers talk about finding are the sort that aren't going to be exploited by the people doing the exploiting. For example a LOT of the exploits that they talk about are for if you actually have physical access to the computer. Well I'm sorry to tell you, if you have physical access to the computer you're already boned!

wow a Free OS!

[Anonymous Coward]

wow a Free OS! That will get lots of time and interest from highly paid security experts...
If they were actually interested in improving security they would put their money where their mouth is and start a bug bounty.

Re:wow a Free OS!

[Anonymous Coward]

Why would they do that without first seeing what they can get for free?

I don't think it's about the money anyway. Most researchers like to look at stuff!

"security researchers" point out...

[Anonymous Coward]

"security researchers won't hesitate to point out that the opposite is, in fact, true"

Without a citation or naming said researchers, I assume that anonymous/samzenpus pulled this out of their ass.

Much better link, avoids the FUD

[Anonymous Coward]

This link avoid the FUD at edibleapple, http://news.cnet.com/8301-1009_3-20036218-83.html

(too lazy to login)

YAY !! APPLE IS BACK IN BLACK !!

[Anonymous Coward]

I wonder what Steve will be thinking, cooped up in his emerald coffin six0feet under. Something like, HA! And they said I couldn't take it with me! HA! HA! HA!

Yeah !!

Click Here to Install Silverlight!

[fluor2]

Click Here to Install Silverlight!

i miss the days...

[Anonymous Coward]

...when /. wasn't completely over-run with nauseating Apple fanbois.

So?

[lennier1]

Someone doesn't want to wait until the next Pwn2Own?

Enough with the felidae names already!

[Bobakitoo]

They should take a hint from Ubuntu. Their names always raise some complaint, but they are funny, intriguing and more importantly they sound like new stuff. Cat ++; is meh.

Re:Enough with the felidae names already!

[zippthorne]

Plus, Lions are just about the laziest big cats out there. Male lions don't even hunt...

Re:Enough with the felidae names already!

[Anonymous Coward]

Cat++ is "meow," not "meh."

Re:Enough with the felidae names already!

[Anonymous Coward]

In all fairness, the male do scare the pray toward the female group. When you got that big hair head it prety much all you can do. Forget the stealth.

Doesn't surprise me

[Myria]

It took them 8 months to fix a 10.6 simple kernel privilege escalation exploit I submitted to their security team last year.

It's x86-specific; otherwise, I would've sent it to the iPhone jailbreak hackers instead of Apple.

wtf

[Anonymous Coward]

lemmy guess: HBGary? Tanja Nijmeijer must be using Macs

One Big Security Improvement In Lion

[lseltzer]

IIRC, this is the version in which they will no longer deliver a Java VM. This alone will drop the vulnerability and patch count significantly. Can anyone with the preview confirm that it is/is not included?

Re:One Big Security Improvement In Lion

[Anonymous Coward]

It offers to download and install when you encounter java, but isn't part of the base install.

Re:One Big Security Improvement In Lion

[Anonymous Coward]

I can, it's not included. Interestingly enough, when I tried to run XCODE of all things, I got a box saying "You have to install JVM to run this program - Install now?" When I clicked yes, it downloaded some oracle VM and installed it automatically.

For flash, however, I had to do the more manual process - download the DMG, run the installer.

Re:One Big Security Improvement In Lion

[gcerullo]

Java is not included.

http://www.appleinsider.com/articles/11/02/26/mac_os_x_lion_drops_front_row_java_runtime_rosetta.html

More secure != Safer

[Anonymous Coward]

Life isn't pwn2own. Now that Mac has finally joined Ubuntu in having a built-in app store, distrust of web-based software downloads should become intense enough to nearly eliminate malware. Whenever I'm presented with a person that says "go download this," my response is "when will this be in the Software Center." It's not a question, it's a statement. If it's not in Apple's, Google's, or Canonical's app store, there's a reason for that, and I'm not downloading it until I know what that reason is.

Actual Security Conversation

[99BottlesOfBeerInMyF]

It is disappointing to see the comments thus far have not bothered to mention what potential security improvements are likely to be in the final version of Lion and how effective they might be. So far the ones I've heard mentioned include:

• ASLR applied to more than just the libraries.
• More ubiquitous use of the sandboxing framework, enough so that there are now bugs around applications being unable to save files if the file name changes in the Finder, while open in the app.
• Dropping the custom java runtime, and making a deal with Oracle to maintain it alongside the Windows JVM.
• A new full disk encryption system built in (branded the same as the old Filevault) with a rapid system wipe.
• Webkit2 with a sandboxed thread model.

I'm sure in more security oriented forums there will be some good analysis of these new features, how well implemented they are, and how effective they are likely to be. The Mac App Store offers some potential security improvements by standardizing application updates and pushing them out more quickly and widely and hopefully encouraging developers to make more use of security frameworks already present. Personally, I think the sandboxing combined with the Mac App Store could be a huge boon to security if Apple can get enough developers on board, but I'm not sure if Apple will go that route. Hopefully feedback from experts will help push them in that direction.

Re:Actual Security Conversation

[drinkypoo]

ASLR applied to more than just the libraries.

Did they implement useful ASLR yet?

Dropping the custom java runtime, and making a deal with Oracle to maintain it alongside the Windows JVM.

Oh good, more Oracle, that's what we all need.

Re:Actual Security Conversation

[99BottlesOfBeerInMyF]

ASLR applied to more than just the libraries.

Did they implement useful ASLR yet?

They supposedly have applied it across the stack and heap and all libraries now, which is what most security experts have been asking for. We'll have to wait until someone actually looks at it and reviews it to have a better idea. Or did you have some other, specific, item you thought they should change about their ASLR?

Dropping the custom java runtime, and making a deal with Oracle to maintain it alongside the Windows JVM.

Oh good, more Oracle, that's what we all need.

It's a strange mind that interprets "dropping the JVM" as "more Oracle". To be clear, there is no JVM bundled in OS X Lion beta, so that's a pretty large attack space gone off of a significant number of machines. Whether or not those who download a JVM from Oracle will find it more or less secure than Apple's custom JVM was is questionable, but one certainly can't make the assumption it won't be more secure given the history.

Yet another trolling summary

[Anonymous Coward]

The summary is fucking awful in a long line of terrible abstracts which link to terrible articles and paraphrase things which aren't usually in the original article.

How much did edibleapple.com pay for this, incidentally? I note that this website had only 4 adverts on the linked page - amazing, well done! Usually I have to search for the 15 words of content within the advert.

Enough is enough, slashdot is not fucking AOL!

Maybe we'd get better service from AOL. When's the buyout?

Windows has always been more secure.

[Anonymous Coward]

Here's the facts:

Microsoft Windows
1) People go and find exploits and write viruses/malware etc.
2) Microsoft patches and fixes these exploits.
3) Windows becomes more secure. Repeat step 1-3.

Apple OS X
1) People don't really bother to find exploits or write viruses/malware for OS X, because more people use PCs than Macs.
2) Vulnerabilities and exploits remain un-patched.
3) Apple gloats that OS X is more secure than Windows.

A developer's perspective

[MrEricSir]

Look at the development tools. On Windows, you have Visual Studio which makes writing exploits rather easy. It can show you a memory dump of any address, help you debug programs with a very easy UI, and Microsoft is kind enough to provide Detours to let you hook functions in system libraries.

On the Mac? Honestly, you have to admit that Xcode and other development tools are much less robust than Microsoft's. You'd have to work a lot harder to create malware.

Re:A developer's perspective

[Microlith]

It can show you a memory dump of any address, help you debug programs with a very easy UI

This is nothing special, I can do the same with GDB (or rather, DDD.) And GDB/DDD will work on (indeed, come with) OS X.

Re:A developer's perspective

[Anonymous Coward]

Those aren't the tools they'd be using. VS sucks for debugging 3rd party programs (absent PDB information). Try WinDbg, Ollydbg, and IDA for a start. Hooking functions is a HelloWorld-in-complexity task.

I think the basic reason is much more obvious: most hackers don't use OS X at all, ever, so they simply don't target it. Linux receives a disproportionate amount of hacking attention, and that's because some hackers do use Linux. Market percentage isn't an accurate prediction of future attention.

Re:A developer's perspective

[juasko]

Jepp but what about memory injection? Taking a dump is a report from a app that has privileges to read the whole memory. The kernel?

Re:A developer's perspective

[mario_grgic]

I"m a developer too and I don't think there is a better IDE than UNIX shell and associated tool chain. Of course it requires you to actually learn to read and write instead of clicking on pictures to program (and forget about XCode, it's a complete crap). There are really good tools for OS X like dtrace, disassemblers, assemblers, gcc, gdb etc. Anything you may imagine doing, there is a tool for it out of the box so to speak. Yes, these tools are just not packaged into MDI interface with dumb editor, but that doesn't mean they don't exist.

Metric that counts

[cratermoon]

Here's the only metric that really counts in my book.

If you've ever done desktop support for your friends and family, count up the times you've had to go in and clean up a rooted, malware-laden mess on Windows, either by running a full, time-consuming, malware scan and removal, or just doing a reformat and reinstall. Now do the same thing for your OS X user friends. Adjust for market share and compare the numbers.

Yeah, brb, going over to friend's house for free beer after I fix his Windows infection.

Re:Metric that counts

[Anonymous Coward]

I've used a variety of machines at work, and I noticed a disturbing trend:

When I use a Linux box, I am careful when it comes to security. I disable services and features that aren't absolutely needed and am generally untrusting.

When I use a Mac box, it's pretty much the same when.

When I use an Microsoft box, I give up. I just stop caring.

Consequently, I blame the UI for Microsoft's problems, not their market share, nor their technical ability.

Re:Metric that counts

[Anonymous Coward]

Yeah lemme just reinstall the anti-virus software on my Mac.

Oh.

Re:Metric that counts

[angel'o'sphere]

I second that.

I stopped repairing other ppls Windows machines when XP came out.

Man, I wanted to repair a machine and configure its internet connection. (After working with Windows from 3.11 up to Win 2k, in parallel to Linux and occasionally on a Mac)
The fucking system finds the router automatically, assumes the router knows how to connect to its ISP. It works out of the box ... but: how to assign IP adresses, network masks?
No CLUE! I did not find it in the system configuration. So after backig up the most of it I needed to stand down and shrug and say: I guess you have to reinstall it, by an "expert" ...

Anyway, on Mac it is all like it was on Unix 20+ years ago. Only instead of editing a text file I use a GUI to configure it. If that makes me a fanboy I'm gladly a fanboy. Want to set up a WLAN or join one? 2 clicks ... no one on windows can do that ..

angel'o'sphere

Re:Metric that counts

[zippthorne]

Server versions of OS X come with ClamAV pre-installed....

Re:Metric that counts

[Anonymous Coward]

Okay, I'll bite. Happened once. I installed MSE with Malwarebyte's Anti-Malware after that on the computer, and have never had a problem with her since. Maybe your friends are retarded?

Re:Metric that counts

[WatertonMan]

For scanning email that might have windows viruses.

Re:Metric that counts

[Anonymous Coward]

Do you really think that people have enough friends to adjust for market share when mac is only ~10%?

Do you really think that people can accurately divorce themselves from the ill feelings of windows computers 10 years ago?

Do you think that there -might- be a difference in how problems are handled? "take it in / buy a new one" vs "talk to your cousin"?

Because here is my experience. In the last 5 years computers, their users, the browsers, and the security software has advanced to the point that the average vista / win7 computer doesn't need maintainance every 6 months. or every year. or two.

I used to reformat every year for my home pc. Now i dont. at all.

I think slashdot is riddled with old people that have preconceived notions about the state of personal computing a decade ago, and. just. wont. let. it. go.

Re:Metric that counts

[Cronock]

Are the rest of your friends still on typewriter: qwerty edition? I work for a small consulting company and all my friends bring their dead machines asking for free virus cleanings. I make them pay me in beer or real money these days because it takes so much time if I don't disregard their data. Unless your friends are all security savvy, or very low in numbers, chances are you're like me cleaning off their machines and begging them to keep up on their AV software.

They don't have to be "retarded" just computer-retarded, which many of my friends are and have no issue with admitting it. Unfortunately a lot of them now have macs and my beer supply is running low.

Re:Metric that counts

[Em Adespoton]

OS X: safer.
Windows: more secure.

Stuff that runs on them: a mixed bag.

Re:Metric that counts

[Spaham]

yup or reply to this simple question :
how many windows users don't have any antivirus installed, like I do, on my mac ? :)
And how many never ever had any virus in the last 20 years ?

Re:Metric that counts

[pandrijeczko]

If you've ever done desktop support for your friends and family, count up the times you've had to go in and clean up a rooted, malware-laden mess on Windows, either by running a full, time-consuming, malware scan and removal, or just doing a reformat and reinstall. Now do the same thing for your OS X user friends.

I have no OS X using friends, period. The nearest I've ever got was one friend who was given a Mac by his boss (because the boss was given it by a client and never used it) and he took it out the box, played with it for a half-hour, didn't like it and put it back in the box.

Yes, you're in the US and OS X penetration is higher - but here in Europe, and as someone who has worked in the IT, telecoms & security industry for 25+ years, I think I've actually seen, or know of, about 5 people who use desktop or laptop Macs.

Re:Metric that counts

[Anonymous Coward]

Here's the only metric that really counts in my book.

If you've ever done desktop support for your friends and family, count up the times you've had to go in and clean up a rooted, malware-laden mess on Windows, either by running a full, time-consuming, malware scan and removal, or just doing a reformat and reinstall. Now do the same thing for your OS X user friends. Adjust for market share and compare the numbers.

Yeah, brb, going over to friend's house for free beer after I fix his Windows infection.

Maybe because nobody uses Macs. lol

Re:Metric that counts

[atlasdropperofworlds]

The fact you have to go over to your friend's house to help him shows how dated your information is.

And FYI, I end up 'fixing' macs as much I do PCs for some reason, even though fewer of my friends own them. Apple has some nice polish, but they sure don't make anything resembling a solid OS. Last week one friend Mac Pro was slow as fuck and would just grind the HDD, even just opening Finder. The solution ultimately was to reinstall OSX. The problem was gone after that.

Re:Metric that counts

[Samizdata]

Frankly, I AM the only local Mac user I know, and that's a 10 year old Sawtooth running 10.4.11.

why?

[Anonymous Coward]

nothing to do with wanting to improve "security." they want to improve "security" like they have on the iOS platform. im scared for my os x :(

What about the new RAT for macs?

[Anonymous Coward]

I haven't seen any comments referring to the new RAT for Mac nor have I even seen mention of it on Slashdot.

Re:What about the new RAT for macs?

[99BottlesOfBeerInMyF]

If you're referring to a security auditing tool, I've heard not a peep about a new one. Do you have a source? If you're referring to something else, maybe you should define your acronym :)

Re:What about the new RAT for macs?

[Anonymous Coward]

By RAT I meant Remote Access Trojan and it seems that Slash Dot caught up today and posted something about it.

Viruses

[Nukedoom]

I tried getting some once. My Mac wouldn't let me. :/

Got my copy

[Anonymous Coward]

Already found about 30 security related bugs. I don't care if you are Microsoft, Linux or Mac, when you release a Beta, there will be problems found.

No it won't

[Sycraft-fu]

Apple's problem in corporate environments is there complete and utter lack of understanding and support of a real enterprise. They want to play make believe at enterprise support but they don't take it seriously. It is a disaster and only getting worse. We've been looking at integrating Macs in to a lab (and we are going to) but will need 3rd party software to make it work well.

Some big noteworthy things they've done recently are discontinue servers and screw over virtualization. So you can't buy a blade server, the most popular kind of server, for Macs anymore. You can buy a Mac mini, an overpriced tiny little desktop thing ($1000 for a Core 2 Duo server box) and use that, or you can buy a Mac Pro tower. That's it. No rack servers. Ya that is real enterprise support.

In terms of virtualization VMWare fully supports OS-X server, client tools and all... However Apple won't license it to run on anything but Mac hardware. So if you want Mac VM servers you have to buy a Mac Pro tower and find a place to put that, then get VMWare Fusion on it, which is a desktop solution, not a server one, then virtualize OS-X server on that. That Big rack of high availability, bare-metal ESXi servers that you run Windows, Linux, etc on? Nope, fuck you can't run OS-X on it because Apple says so.

Apple will never get big in corporate environments until they get real with enterprise support. Not half assed solutions, real support.

Re:No it won't

[Em Adespoton]

Just so you know, VirtualBox has full support for OS X Server, and Apple sells OS X Server without hardware (straight license) in a configuration to run in a virtualized environment. The "can't run OS X that way" was from when they still sold blades.

Of course, it's possible they only do these agreements with real enterprises; I haven't seen what they put as conditions on the small volume server licenses.

Re:No it won't

[Billly Gates]

Apple wont deal with the enterprise because they got burned in the 1980s when Dos killed it out of the office!

Many businesses are buying macbook pros for executives and some are even using mac minis. However, Apple, just isn't interested in the investment because some jerk in the office has to keep his job by showing it was a good thing to buy this activeX IE only CRM package that only runs on Windows XP.

It is a battle they can't win.

Re:No it won't

[tk77]

VirtualBox and VMWare Fusion are not valid solutions for all enterprise use.

Apple needs to allow OSX Server to run virtualized on non-Apple branded hardware so that it can be run under a bare-metal hypervisor like VMWare vSphere.

Yeah, I know there's Parallels Server, but that only runs on Apple branded hardware and doesn't even come close to the capabilities of vSphere.

OSX Server running on a HA-FT vSphere cluster would be, basically speaking, amazing.

Re:No it won't

[Anonymous Coward]

They aren't playing make believe. They have no interest in enterprise support at the present moment.

Re:No it won't

[Em Adespoton]

Agreed :)

Re:No it won't

[Anonymous Coward]

Apple's UI alone will keep them out of certain enterprise applications. Our shop develops software. Each of us have at minimum 2 27" monitors, and some have 3 30" monitors. Using OSX with that much screen real-estate is brutal at best. The application menu bar is so often far separate from the application window itself that you sometimes have to traverse (I kid you not) 4 feet of screen real-estate to, say, save under a different name or open another file. In contrast, both Windows and Ubuntu Linux users have no problems spreading applications out and using them effectively.

OSX is just not an option for us. We do like a lot of things about the OS, but when it comes to getting work done OSX just puts up too much of a fight.

Re:No it won't

[Weedhopper]

Your entire post labors under the impression that Apple even wants to be involved in the enterprise space. Apple's not playing "make believe at enterprise support." Those are token gestures.

Apple's making money hand over fist by NOT playing the enterprise game. Why get into a highly competitive, relatively low margin market when consumers are practically throwing money at them?

Half assed is the assumption that every company out there has to play the same game and get into the same rat race as every other tech company. Apple got to where it was by playing their own game, not the one defined by every other player.

OpenJDK

[Gary W. Longsine]

Better than merely reducing the attack surface of the platform by not including Java, Apple has also begun working with Oracle/Sun and contributed to OpenJDK. This should provide more timely updates to folk using Java on Mac OS X.

rsync

[frank_carmody]

Not specifically security related but does anyone have any idea what version of rsync has shown up in the beta? The version that ships with 10.6 is rather outdated so it'd be great if this (pretty important) tool were brought in line with where rsync is now.

laughable

[Gary W. Longsine]

No matter how many times you repeat that claim, it's still unsupported by the evidence. Mac OS (7/8/9) had a much smaller market share than Mac OS X has today, and a dramatically smaller user base, and yet there were many virus, aheh, "available" for it, whereas there are none on Mac OS X. Furthermore, it's widely known that Apple takes the lion's share of profits in the PC industry, despite selling far fewer systems. It does this by selling systems at the top end of the market, which it dominates (something like 90% of all laptops for which people are willing to pay more than $1000 are Apple computers). Obviously those people would be a rather more lucrative pool of victims, yet they remain almost entirely unexploited. There are other reasons, but those are sufficient to shatter your claim.

Re:laughable

[Ash-Fox]

Mac OS (7/8/9) had a much smaller market share than Mac OS X has today

Back in the time when people wrote viruses for fun, I don't even recall a single Mac classic virus payload to steal information like the ones we have today.

Obviously those people would be a rather more lucrative pool of victims, yet they remain almost entirely unexploited.

lighten up.

market share

[Gary W. Longsine]

Roughly 10% of the total PC market is Apple. Apple has roughly 0% (zero percent) of the enterprise PC market, which is roughly half of the overall PC market (the number of installed systems is smaller than the consumer market, but consumers tend to refresh less often). So, Apple apparently has about 20% of the consumer market these days.

There are automated, automatically propagating exploits for obscure BBS systems, for IIS back when it was a tiny sliver of the web server market, for data base systems installed on a tiny fraction of web servers, in numbers utterly dwarfed by the installations of a single model of MacBook Pro.

What's it gonna take for y'all to give up on the "market share" ghost?

Re:market share

[Anonymous Coward]

Tend to agree with you on this one. GNU/Linux has a larger user base too than people give credit for. Considering all the devices, servers, and desktops around if it were a market share GNU/Linux would be the first target not the last. GNU/Linux may not be the most secure platform however it is used in more devices, computers, and other products than any other operating system.

Re:market share

[CAIMLAS]

Slight difference between the 'then' and 'now', too:

* It's always been "cool" to exploit Windows (just as it was cool to exploit old school Unix, before that) and "the man"
* Being obscure makes it more interesting.
* There was a lot more obscure stuff traveling BBSes back then than there is on the odd back-channel on the Internet, simply due to higher signal to noise ratio. Back then, if you were online you were probably either doing that kind of thing yourself or knew a couple people who did.
* Using a mac has, for the better part of a decade, been the mark of a toolbag. Developing on one is embarrassing: there's nothing "cool", in a geeky sense, about them.

Unfortunately for Apple, they're earning the "The Man" stigma, and every popular douchebag at a frag party has an iPad or iPhone.

Re:market share

[cbhacking]

Back then, malware was a challenge, or was targeted at a specific entity. Now, both of those reason still exist, and malware probpagation based on them does occur, but they've been completley dwarfed by the main purpose of malware today: making money. It's all about business. Take over a Windows box, and it's worth maybe a dollar or two each, on average. Take over an OS X box, and it's worth the same - in general, nothing makes it easier to monetize OS X than Windows.

Now, here's the catch. Developing malware isn't free; even if you don't actually pay for the exploits, it takes time. So which platform do you target? These days, Windows is significantly harder to find new exploits for than OS X. You'll have to spend more time, or pay more (since Windows exploits are in high demand). Here's the catch, though: until the difference in cost is equal to the difference in income between hitting 90% of the market and hitting 10% of the market, it just isn't worthwhile.

Some numbers, based on rough estimates of real-world costs:
A typical Windows exploit runs for $10k to $50k, depending on various factors. We'll take the high end of that - I'll give every possible advantage to your point of view. Next lets suppose that finding an equivalent exploit for OS X is effectively free (it's not, of course). There's a little bit of cost on top of that either way, to "weaponize" an exploit into actual malware you can make money off of (keyloggers, botnet nodes, etc.) Now, consider the environment you can release them into. Windows botnets come in various sizes, but 9 million machines is a decent size. For every 9 million Windows boxes, there are 1 million OS X boxes (close enough). However, I'll throw you another bone here: remembering that Windows comes in a number of versions and some people upgrade faster than others, and that security software quality varies significantly, lets say that you're only hitting half the Windows boxes. OS X is more uniform, so let's say for every 9M exploitable Windows boxes you have 2M exploitable Macs. Time to release your malware into the wild...
If you chose OS X, you paid very little, exploited 2M boxes, and made maybe a couple dollars each. Congratulations, you've just gained about $2,000,000.
Of you chose Windows, you paid $50,000, plus that cost to weaponize. You took over 9 million machines though, for an income of $18M. Total profit: $17,950,000.
You spent the same amount of time on each.

You spent far more money on the Windows one. Yet, looking at the final numbers, targeting OS X is almost pointless.

Re:market share

[Anonymous Coward]

As somebody who uses Apple, can I just say "please stop poking the bear with the stick". If you're happy with the way things are, don't taunt the security pros please!

Re:market share

[wisty]

Another point, Macs are often on slow wireless connections (home laptops), while Windows machines are wired into a T3 (corporate network). Fast connections are worth more than slow connections.

Also, I bet more people do their banking at work than at home. After all, it's not like you can watch YouTube or poke your friends on Facebook, and you gotta pay those bills sometime. Bank accounts (if they can be stolen) are worth more than facebook accounts, I would guess.

Re:market share

[Anonymous Coward]

Your stats are as dumb as they come. Quote some facts, or go home.

Re:market share

[Darth Cider]

Your final calculation is wrong. You said 2M macs at $2 apiece, so the profit for exploiting macs would be $4 million, not $2 million. You flubbed where it counted most, in "looking at the final numbers." You make a lot of bad assumptions, too, which will be obvious to anybody who read your post and actually paid attention to it.

Re:market share

[Gary W. Longsine]

Profit maximizing enterprises would, if they could do so as easily as you suggest, not choose one over the other, they would add Mac OS X systems to their zombie fleets and boost profits by 10%. In fact, even if it cost them $1 million dollars to make the first $2 million, they would do it. That would be a hundred percent profit on the exercise, and the marginal cost of the effort for the next million would be close to zero, at least it is in the Windows exploiting world.

Re:market share

[Anonymous Coward]

I have no data to back this up, but have you considered that enterprise could be a very important target for people who write exploits, so they don't really care about systems that only run in the consumer market?

Re:market share

[Anonymous Coward]

I'm going to just assume, for the moment, that your figures are actually correct.

There is a piece of data missing, and it's one I see all the time: How many people own both an OSX and a Windows machine? Even the most hard-core Mac fanboys I know own a windows based machine. If that's the case, then in terms of population, Apple has potentially nearly double it's current market share.

But, while I do see some Apple laptops out there, I would hesitate to say it's even as much as 1 in 5, even with a sample size of 6 different coffee shops.

Re:market share

[DavidRavenMoon]

Apple has roughly 0% (zero percent) of the enterprise PC market, which is roughly half of the overall PC market...

That's not entirely true. I've been doing freelance work at Sony in NYC, and they have a LOT of Macs. In fact the majority of computers there are Macs. And not just for graphics and stuff, everyone's desk has a recent Mac Pro or iMac on it. Sure, it's an entertainment company, but it's still "enterprise". Also a lot of companies are starting to issue iPhones and iPads, which of course both run a variation of Mac OS X. As far as market share, in my experience when commuting on the train in the morning from NJ to NYC, I used to see maybe one Apple laptop on the entire train (assuming I was walking from car to car to find a seat). That was like ten years ago. Now I easily see two or three PER CAR. I also see at least two iPads a day, an a zillion iPhones/iPods. Last year Apple's share just reached over 10% (3Q '10) when combining the iPhone with Macs. They went from 9% in 3Q9 to 10.5% in a year. Now with the iPad thrown in, and counted as a computer, that's going to climb. They are currently the 5th largest computer maker. But I agree... market share has nothing to to do with malware.

Better Hurry

[Anonymous Coward]

they better get the security experts at HBGary on this shit pronto!

Fix the comments, already.

[R.Mo_Robert]

Dear Slashdot,

I don't want to veer off-topic, but this redesign is a mess. Comments have the score randomly disappear from them (the only "fix" is to find the problematic parent and expand it), and every few times I load a hidden comment, my entire browser content area turns gray.

I'm not complaining about the look, although for what it's worth I did like the old one better. I'm complaining about the fact that I literally cannot use the new layout because it is broken on a relatively popular browser (Firefox 3.6 on OS X).

We can haz fix?

Mod parent

[Billly Gates]

True.

IIS and SQL Server injections were on the rise when Solaris was still king of the internet server market a decade ago. Windows Server back then was not the dominant player yet had most of the backdoors. The reason Windows has more viruses and trojans is due to activeX and shoddy design for IE and Windows. Not because it was the dominant client operating system.

I would mod you up if I had points. I have been refuting this until I am blue in the face.

It has nothing to do with popularity. Fact is in 1999 all you had to do was wrote a few lines of code in C++ to do a delete a partition and put it in an ocx container for activeX and voila! Anyone visiting your site lost their hard drive! Yes security was that bad in the 1990s with Windows.

Re:Mod parent

[jittles]

True.

IIS and SQL Server injections were on the rise when Solaris was still king of the internet server market a decade ago.

What you and the parent are failing to take into consideration with those attacks is that compromising a server on the internet is far more valuable than some random person's computer. The server has far greater bandwidth (and probably computational power) than the average Mac is likely to have.

Re:Mod parent

[Wovel]

So are you saying MS products are more exploited because they are more exploitable? Say it isn't so Joe.

don't get the metric

[batistuta]

Is the speed at which an OS gets compromised a viable metric for its security? I mean, imagine (I'm talking hypothetically here) MacOS had 1 open bug that allows someone to compromise the system in 10 min, and Windows had 15 open holes, which of which would require 1 day to circumvent. Which OS is more secure? If you ask me, I'd say Windows because right now the MAC OS would be a better target. But that can change overnight if Apple released a patch. Quite often people also say that Mac OS is not targeted because of their market share. That IS a security advantage, even if it was given to them for free. For the average Joe, measuring security in a product should boil down to how likely is that his machine gets compromised, with all factors involved, including likelihood that someone cares. I think my Mint box is much more secure that my Windows box. Not because Mint is free of holes, but because no one really cares to hack me. And to me, at the end of the day that's all that matters.

HBGary getting a look?

[Anonymous Coward]

I wonder if Apple will be asking HBGary to have a look at the security

Read THIS & "channel your inner criminal" then

[Anonymous Coward]

"I've been hearing "The only reason every Mac isn't infested with malware is that they're not a big enough chunk of the market for it to be worth the effort." for so many years the effect has worn off. Year after year - You know, it really gets old hearing that excuse. If that really is the case, I hope it continues." - by Cheech Wizard (698728) on Sunday February 27, @04:38PM (#35333006) Homepage

Ok then, explain this: Do pickpockets operate on "crowds of 1" only, vs. massive crowds of potential possible victims in crowded city streets, train or bus stations, or malls?

ANSWER = No, they do NOT!

Pickpockets (and yes, online criminals too) go where their efforts expended to "do the job" are most effective for the BEST "ROI" (return-on-investment), from a single method of attack (codebase in malware)!

(And, just like pickpockets? THAT is done by going where the MOST POSSIBLE VICTIMS (users) ARE... & currently (and for decades now), that is on Windows).

You think share of market doesn't matter?

Today's ( & this past decade's), online criminal is NO DIFFERENT than the street pickpocket... and they are BOTH AFTER YOUR MONIES!

Thus - It makes sense for them to attempt to attack Windows on that very same basis (as it IS "where the crowds are").

NOW, ONTO ACTUAL STATISTICS/FACTS & FIGURES of UNPATCHED KNOWN SECURITY VULNERABILITIES: (MacOS X vs. Windows 7)

---

Vulnerability Report - Microsoft Windows 7:

http://secunia.com/advisories/product/27467/

Unpatched = 6 of 57 Secunia advisories

---

vs.

---

Vulnerability Report - Apple Macintosh OS X:

http://secunia.com/advisories/product/96/?task=advisories

Unpatched 9 of 150 Secunia advisories

---

NOT ONLY HAS THE CURRENT MacOS X BUILD SHOWN MORE OVERALL SECURITY ADVISORIES THAN DOES WINDOWS 7, BUT, IT ALSO HAS MORE KNOWN OUTSTANDING UNPATCHED KNOWN SECURITY VULNERABILITIES THAN DOES Windows 7... period!

(So, "argue with the numbers"... & good luck!)

Lastly - I hope one of you tries the "local/local network" vs. "remote" tactic "spin-CON-troll" too, because I'll use what I used on the Linux crew a few days back in regards to THAT little "trick" too, due to how malwares today are being constructed... & they are NOT "your dad's oldsmobile" anymore...

APK

P.S.=> Here's a list of problems MacOS X has had in its tenure, for those of you that are interested, that I've been compiling for a few years now - So, "chew on these" (35 of them, or thereabouts...):

---

MacOS X - A Worm for Your Apple MacOSX:

http://www.beskerming.com/commentary/2007/07/18/222/A_Worm_for_Your_Apple

---

MacOS X - Another Mac Trojan/Fake Codec - Security Watch:

http://blogs.pcmag.com/securitywatch/2007/11/another_mac_trojanfake_codec.php

---

Apple's FaceTime for Mac debuts with security holes:

http://www.theregister.co.uk/2010/10/21/apple_facetime_security_hole/

---

Apple Patches OS X Flaws:

http://www.eweek.com/c/a/Apple/Apple-Patches-OS-X-Flaws/

---

Apple patches QuickTime to root out 15 ugly vulns:

http://www.theregister.co.uk/2010/12/09/apple_patches_quicktime_again/

---

Appleâ(TM)s Snow Leopard Is Less Secure Than Windows, But Safer:

real world

[SuperBanana]

Every single year, OSX loses the Pwn2Own competition first. Windows and Linux always go down on the same day.

Perhaps because everyone wants the Mac and focuses the most intensely? Desirability in a hacking contest with local network access != real world security exposure.

In my decade+ IT career, I've never seen a Mac rooted or infected with a virus beyond a Office macro. Curious, no?

Also curious that I've seen Linux boxes routinely rooted (usually by IRC-bot-seeking scriptkiddies) and Window machines infected with spyware at an average of around 1 a week out of a population of about 75-100.

Maybe, Just Maybe, Apple Will Turn On The Firewall

[NeverVotedBush]

By default instead of leaving it set OFF.

And yep, I know that the threat profile has changed, but come on. Why leave the system open to any other systems behind whatever other hardware firewall there is - if there is - services running or no?

Re:Read THIS & "channel your inner criminal" t

[dgatwood]

NOW, ONTO ACTUAL STATISTICS/FACTS & FIGURES of UNPATCHED KNOWN SECURITY VULNERABILITIES: (MacOS X vs. Windows 7)

Uh... you do realize that the only reason most known vulnerabilities for Mac OS X are "known" is because they are in Open Source bits, right? And that basically none of Windows is Open Source? This means that the number of known unpatched vulnerabilities in Windows should inherently be smaller, not because there are fewer unpatched vulnerabilities, but because its source code has not undergone the same level of external scrutiny.

Also, most of the things on your list are not vulnerabilities, and the few that were are almost all reports about Apple having fixed those vulnerabilities. The only one I saw that did not fall into that category was a DNS cache poisoning bug. Besides being difficult to exploit usefully, it applies to a DNS server daemon that doesn't even run in Mac OS X unless you explicitly enable the name server by editing config files (or in the GUI in Mac OS X Server).

Not all vulnerabilities are created equal. That's what makes comparisons of vulnerability counts useless. As long as Windows supports AutoRun in any form, it will continue to be so far behind Mac OS X that it isn't really even in the race just from that one fundamental design flaw alone.

accounting for value

[Gary W. Longsine]

Why do you think compromising those web servers was so valuable to the cracker? Because it was the gateway to compromising a metric fuck tonne of home and business desktop PC systems, onto which keyloggers were installed, and from which data was harvested. To that end: the systems on the desktop which became parts of giant zombie PC fleets were not running Mac OS X, they were (and are) running Windows. Furthermore, within the context of the web server market, you seem to have failed to understand that platforms with tiny slivers of market share, dwarfed by Mac OS X installations, were routinely compromised. If your beloved "market share theory of OS security" were true, then crackers wouldn't bother with these tiny slivers, they would have been attacking Apache/UNIX, rather than the much smaller market share of IIS/Windows or the then-infintessimle market share of the various BBS systems and database systems which were actually exploited, routinely. System architecture matters, and the system architecture of Mac OS X is holding up pretty well, by comparison in the real wild world of automated exploitation of computer systems.

blindingly obvious

[Gary W. Longsine]

One would think it was so obvious that it didn't merit mention, but apparently there are those who will argue against this obvious truth to their last breath.

geeks and hackers love Macs

[Gary W. Longsine]

Someone claiming to be you at Slashdot wrote this stupid troll:

"* Using a mac has, for the better part of a decade, been the mark of a toolbag. Developing on one is embarrassing: there's nothing "cool", in a geeky sense, about them."

Uh, where have you been? Have you seen the sea of Apple logos on the MacBook Pros cradled in the arms of developers at hacker development conference any time in oh, say, the past six or seven years? Do you actually *know* any software developers?

corporate zombie fleets

[Gary W. Longsine]

You're in some strange fantasy world. Corporations are often the target of attacks, but zombie fleets are not much comprised of T3 connected corporate desktop systems. The corporate systems get discovered and cleaned up routinely, so most zombie fleets consist mainly of home user systems. The bottleneck isn't the WiFi connection, it's the DSL or Cable Modem connection, which offers the zombie PC greater bandwidth to the internet than most corporate PCs have anyway. (Not every corporation resembles Google with respect to internet bandwidth to the desktop).

facts and figures

[Gary W. Longsine]

Well, my "stats" are not particularly controversial. Do your own homework, and prove me wrong, if you think I'm wrong.

Each of YOUR points, cut to shreds (easily)... apk

[Anonymous Coward]

"not because there are fewer unpatched vulnerabilities, but because its source code has not undergone the same level of external scrutiny." - by dgatwood (11270) on Monday February 28, @12:30PM (#35339432)

The RUSSIANS HAVE Windows NT-based OS source:

---

http://news.softpedia.com/news/Microsoft-Shares-the-Windows-7-RTM-Source-Code-with-Russia-146738.shtml

---

Thus, Windows HAS "undergone that same level of scrutiny", AND, from better than mere "security researchers" but instead, from "hacker/cracker" types themselves!

So... hate to "burst your bubble" on that note, but... there 'tis!

(And, where does a HUGE portion of malware come out of? The Communist block, inclusive of .ru, .su, & .cn domains as just SOME 'examples thereof'... I know this, 1st hand, from populating a custom HOSTS file vs. known malicious sites/servers/domains-hosts for 17++ yrs. now...)

---

"As long as Windows supports AutoRun in any form." - by dgatwood (11270) on Monday February 28, @12:30PM (#35339432)

This is & WAS very EASILY DISABLED, either via a powertoy from MS called "TweakUI", or via manual registry hacking... for a decade++ or more now in fact!

---

MS has issued patches for that too, as far back as Feb. 2009, AND also, so you know, recently, as well:

http://www.microsoft.com/technet/security/advisory/967940.mspx

---

( So, SO MUCH FOR THAT from you, eh? )

---

"it will continue to be so far behind Mac OS X that it isn't really even in the race just from that one fundamental design flaw alone.." - by dgatwood (11270) on Monday February 28, @12:30PM (#35339432)

Windows is "behind" alright... less known security vulnerabilities... so, I agree on THAT note, lol!

---

"This means that the number of known unpatched vulnerabilities in Windows should inherently be smaller" - by dgatwood (11270) on Monday February 28, @12:30PM (#35339432)

It is, and I put up data showing that VERY thing, no less, AND, from a reputable + respected source for said data, in SECUNIA.COM!

APK

P.S.=> There is only 1 place MacOS X is superior to Windows... GETTING ITS ASS KICKED:

Because:

---

1.) MacOS Xt certainly hasn't taken the "lion's share" (pun intended) of market here

2.) NOR is MacOS X giving a better showing than Windows on KNOWN security vulnerabilities unpatched either...

---

Period! apk

poking bears with sticks

[Gary W. Longsine]

Well, I am a security professional. These guys make us look bad, and need to be challenged. Not to worry, though. Mac OS X has never been a stationary target. It's security architecture has continued to improve, and will continue to improve. And the Bad Guys (TM) already know the economics of the situation. They'll exploit Mac OS X at their earliest opportunity, and continue to look for ways to do so. Lying about it, or remaining silent when others lie, won't help that.

Let's look into the details if you don't mind

[sergiy.gagarin]

Here is information regarding the only threat of those 13 that is marked as a Virus
http://www.symantec.com/security_response/writeup.jsp?docid=2006-110217-1331-99/

OSX.Macarena
Risk Level 1: Very Low
Discovered: November 2, 2006
Updated: February 13, 2007 1:01:55 PM
Type: Virus
Systems Affected: Macintosh, Macintosh OS X

OSX.Macarena is a proof of concept virus that infects files in the current folder on the compromised computer.

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
Damage
Damage Level: Low
Distribution
Distribution Level: Low

No comments.

Catty remark

[djdanlib]

Apple diagnostic technicians should probably be called "Apple Veterinarians"... cat names and all that

Re:Each of YOUR points, cut to shreds (easily)...

[RyuuzakiTetsuya]

Everytime APK posts I have a weird flashback to TimeCube.com

This must be what Acid flashbacks are like.

No, seriously. Windows more secure than OSX? Put up or shut up. Release some code or go home.

Is THAT the "best you got", boy? apk

[Anonymous Coward]

Dispute my points then, big talker... I see that ALL you apparently have here, is somekind of ATTEMPT (puny one) @ ad hominem attacks on myself (thinking you're "clever" (lol, not)).

I.E./To wit:

"Everytime APK posts I have a weird flashback to TimeCube.com This must be what Acid flashbacks are like." - by RyuuzakiTetsuya (195424) on Monday February 28, @02:07PM (#35340338)

WoW... really "on topic" that one, eh? Not...

---

"No, seriously. Windows more secure than OSX? Put up or shut up. Release some code or go home." - by RyuuzakiTetsuya (195424) on Monday February 28, @02:07PM (#35340338)

Ok then, from my initial post, some words of others I am "putting up" to SHUT YOU UP, easily:

APK

P.S.=> Want more? See my 1st reply in this thread exchange, then... & GOOD LUCK disproving my points (as you can see, others have tried, + FAILED HUGE on their replies, point-by-point, already):

http://apple.slashdot.org/comments.pl?sid=2014606&cid=35339624

Ah, man... I just GOTTA say it, as-per-my-usual: "too, Too, TOO EASY... just '2EZ'", everytime..., lol!

However, what do I get in reply vs. solid verifiable facts I posted here in this exchange, in my 1st reply here:

http://apple.slashdot.org/comments.pl?sid=2014606&cid=35336798

Ad hominem attacks & off topic b.s. replies like this fool RyuuzakiTetsuya has done? LOL, please... apk

Re:Is THAT the "best you got", boy? apk

[RyuuzakiTetsuya]

Also, most of the things on your list are not vulnerabilities, and the few that were are almost all reports about Apple having fixed those vulnerabilities. The only one I saw that did not fall into that category was a DNS cache poisoning bug. Besides being difficult to exploit usefully, it applies to a DNS server daemon that doesn't even run in Mac OS X unless you explicitly enable the name server by editing config files (or in the GUI in Mac OS X Server).

From the parent poster above yours.

Put up or shut up. Exploit something or go back to writing shitty Delphi code that's worthy of thedailywtf.com.

Zero drive-bys for OSX versus... how many ever for Windows, I can't even count anymore.

Re:Each of YOUR points, cut to shreds (easily)...

[dgatwood]

The RUSSIANS HAVE Windows NT-based OS source:

Irrelevant to my point, which was that the source is not out in the open and therefore the known vulnerabilities for that source are likewise not out in the open. Therefore, the odds of any single security bug in Mac OS X getting pointed out publicly are much greater than the odds for a similar bug in Windows simply because the disclosure is much more likely to occur in a public forum or through a publicly visible commit log.

The fact remains that you don't know how many internally known vulnerabilities there are in Windows because you don't have access to Microsoft's internal bug tracking system. Similarly, you don't know how many vulnerabilities there are in the closed source portions of Mac OS X, but you do know how many have been discovered in the open source portions because those bugs are reported out in the open.

Therefore, the fact that Mac OS X contains lots of open source means that you would expect the number of publicly known bugs to be much higher even if the total number of internally known bugs is comparable or lower. In effect, this means that the number of publicly known vulnerabilities is completely useless as a metric of software quality because it has no real relationship to the number of exploitable bugs.

More to the point, the crackers usually already know about the bugs whether they're discussed publicly (as with open source bugs and announcements by legitimate security researchers) or not. The disclosed vulnerabilities, therefore, are largely uninteresting. What matters is the total number of vulnerabilities known to the bad guys, which as I explained above, is not strongly correlated with the number of vulnerabilities known to the general public.

( So, SO MUCH FOR THAT from you, eh? )

Read what the Microsoft bulletin said again. It says AutoRun is still in full force, but only for optical media. Although that does diminish the impact (by preventing people from unknowingly spreading malware by moving flash drives from machine to machine), the fundamental vulnerability is very much still present. Malware producers can still infect a CD manufacturing plant with malware and cause millions of discs from multiple manufacturers to infect Windows boxes on insertion. This is not a theoretical vulnerability, either; people have actually gotten infections from commercial software discs in the past. So they might have put a lock on the front door with that change, but they still left the window right next to it completely ajar with a footstool below it for your convenience.

Time to cut you in 1/2 (w/ your own words)... apk

[Anonymous Coward]

Here's another one for you, "hot off the presses" TODAY no less, below & beyond my init. post here's list":

---

Backdoor Trojan For Windows Ported To Mac OS:

http://apple.slashdot.org/story/11/02/28/1559229/Backdoor-Trojan-For-Windows-Ported-To-Mac-OS

---

By the by: I never ONCE said Windows was without bugs & unfixed security vulnerabilities either... so, trying to "put words in my mouth" I never said? Please - POOR tactic troll!

---

"Put up or shut up." - by RyuuzakiTetsuya (195424) on Monday February 28, @03:48PM (#35341138)

On bugs in MacOS X? I did, by the truckload:

http://apple.slashdot.org/comments.pl?sid=2014606&cid=35336798

AND I JUST GAVE YOU YET ANOTHER, right here, above... lol!

So... Put up WHAT?

Code I've done over the past 17++ yrs. here that did well in the eyes of respected others, since you are attempting to attack me on that basis (ad hominem on YOUR part, as usual)??

Sure - I can do that, you know (yes, YOU in particular, DEFINITELY know that)...

Question is, can you?? LOL, nope.

(Afaik? Well - You've NEVER been in written publication, much less for commercially sold & Ms-TechEd 2 yr. in a row FINALIST level work, as I have (amongst many others, & I suspect before YOU were EVEN BORN)).

AND ON MacOS X vulnerabilities I noted (as just examples thereof over time)?

Heh, you had BEST look at what the OP you quoted said... he even knew not all of them are fixed - I cited those, specifically, from SECUNIA!

There's MORE OF THEM UNPATCHED on MacOS X, than there are on Windows... period!

(So, sure, some of what I put up are fixed, I never said they were not... they were ONLY EXAMPLES to the effect that what Apple implied on TV)

E.G.-> "MacOS X is sure, PC's are not" etc./et al, is COMPLETE BULLSHIT! That list of errors alone, and the fact they even occurred, proves it...

---

"Exploit something or go back to writing shitty Delphi code that's worthy of thedailywtf.com. - by RyuuzakiTetsuya (195424) on Monday February 28, @03:48PM (#35341138)

My code's also NEVER been found to bear errors in it either, & it surely did well over time:

----

Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61

(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).

WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)

PC-WELT FEB 1998 - page 84, again, my work is featured there

WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there

PC-WELT FEB 1999 - page 83, again, my work is featured there

CHIP Magazine 7/99 - page 100, my work is there

GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it

HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!

Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only...

Being paid for an article that made me money over @ PCPitstop in 2008 for writing up a guide that has people showing NO VIRUSES/SPYWARES

Time to cut you into more pieces, easily again...

[Anonymous Coward]

"Irrelevant to my point, which was that the source is not out in the open and therefore the known vulnerabilities for that source are likewise not out in the open." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

No, YOU said Windows source was closed... funny:

I showed you, with backing proof/documentation no less, that MS DOES LICENSE OUT THE SOURCE TO WINDOWS (and, ever since Windows 2000 onwards) so others can "pore over it"...

I used the russkies (blood line cousins of mine in fact, slavic descent here is why I note that)... they are NOTORIOUS for creating malware & online exploits...

(OR, does RBN not "ring a bell" to you?)

---

"Therefore, the odds of any single security bug in Mac OS X getting pointed out publicly are much greater than the odds for a similar bug in Windows simply because the disclosure is much more likely to occur in a public forum or through a publicly visible commit log.." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

WTF? Man - You must NOT "hang around" here very much... for nearly a DECADE here, most of what you saw was TOTAL "Anti-Microsoft/Anti-Windows" propoganda!

(For Pete's sake, look @ the "Bill Gates BORG" icon/avatar they use to mark posts here even!)

---

"The fact remains that you don't know how many internally known vulnerabilities there are in Windows because you don't have access to Microsoft's internal bug tracking system." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

You know, MAYBE I DO, or maybe I don't... how do you know I don't work for MS, for example?

(And, you don't, afaik @ least, have access to Apple's internal lists either so... your point? It's MOOT, and goes for you also...)

---

"Similarly, you don't know how many vulnerabilities there are in the closed source portions of Mac OS X." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

This? THIS MAKES ME LAUGH: What is MacOS X based on @ its core?? BSD!

(Where did Apple get THAT from? Hmmm?? At least MS didn't outright "rip" code from VMS, or OS/2, etc. as Apple did... sure, they hired on D. Cutler from VMS, but he didn't AND COULDN'T outright use VMS core/kernel code, not without opening up MS to a HUGE lawsuit I imagine!)

I don't think the same can be said for Apple... because they acknowledge that MacOS X is derived from BSD, and is in fact, a UNIX itself!

---

"but you do know how many have been discovered in the open source portions because those bugs are reported out in the open." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

Well, like you said of MS above, & Windows being "closed source" (even though it's LICENSED to others as I proved)? Goes for MacOS X then too!

I.E.-> You have NO WAY of knowing what's up in its closed portions too... unless YOU work for them!

---

"Therefore, the fact that Mac OS X contains lots of open source means that you would expect the number of publicly known bugs to be much higher even if the total number of internally known bugs is comparable or lower.." - by dgatwood (11270) on Monday February 28, @04:00PM (#35341250)

And, IT IS HIGHER! MacOS X does just plain have MORE UNPATCHED KNOWN SECURITY VULNERABILITIES, period...

(I showed you ALL that much from SECUNIA.COM in fact (along with the list I posted of other bugs in MacOS X over time too (some patched, some not))

The point was this:

To show that the MacOS X/Apple commercials on TV were COMPLETE BULLSHIT (as to "MacOS X is more secure" type crap!)

---

"In effect, this means that the number of publicly known vulnerabilities is completely useless as a metric of software quality because it has no real rela

Re:Time to cut you in 1/2 (w/ your own words)... a

[RyuuzakiTetsuya]

darkComet's a payload, not a vulnerability.

Post an exploit or shut up. I'm seriously tired of your unhinged rants.

Does it MATTER what it is? It HARMS MacOS X!

[Anonymous Coward]

1st - See subject-line above & "mince words" ALL YOU LIKE, doesn't change a thing about that new problem in MacOS X that JUST CAME OUT TODAY!

"darkComet's a payload, not a vulnerability." - by RyuuzakiTetsuya (195424) on Monday February 28, @05:14PM (#35342006)

Yes, "GEE, I GUESS THAT MAKES IT OK!" (not)... lmao!

(It's just out there "doing good" for MacOS X, eh?)

---

"Post an exploit or shut up.." - by RyuuzakiTetsuya (195424) on Monday February 28, @05:14PM (#35342006)

I just DID... & you're caught "flat-footed" by it, as it is BRAND NEW, lol, no less... & it certainly isn't doing MacOS X users a "favor", now is it?

Nope!

---

"I'm seriously tired of your unhinged rants." - by RyuuzakiTetsuya (195424) on Monday February 28, @05:14PM (#35342006)

No, what you're "tired of" is trying to "take me on" & failing, everytime... lol!

HOWEVER - On the converse/flipside, here?

LMAO - I love tearing up you FUD spreading b.s. artists from the "Pro-*NIX" camp... as it's just "too, Too, TOO EASY - just '2EZ'" everytime!

APK

P.S.=> Now, since you RAN from posting anything you've done of note in respected written publications in the arena of the computer sciences (because, you CAN'T, lol)?

Well, ok: Here are some unpatched KNOWN SECURITY VULNERABILITIES that ARE exploitable, AND UNPATCHED, and from a reputable source:

MacOS X UNPATCHED SECURITY VULNERABILITIES

http://secunia.com/advisories/product/96/?task=advisories

(That's MORE than Windows 7 has, mind you!)... apk

Ask & YE SHALL RECEIVE (and you LOSE, troll)..

[Anonymous Coward]

"Ask, & YE SHALL RECEIVE":

"Post an exploit or shut up." - by RyuuzakiTetsuya (195424) on Monday February 28, @05:14PM (#35342006)

Ok, & REMOTELY EXPLOITABLE too:\

FROM -> http://secunia.com/advisories/38066/

---

PERTINENT QUOTE/EXCERPT:

Apple Mac OS X "strtod()" Floating Point Parsing Memory Corruption

Unpatched. Secunia Advisory 12 of 12 in 2010. 2,181 views.

Release Date: 2010-01-12
Secunia Advisory ID: SA38066
Solution Status: Unpatched

Criticality: System access

Impact: DoS

Where: From remote

Short Description:

A vulnerability has been discovered in Mac OS X, which can be exploited by malicious people to potentially compromise a vulnerable system. [Read More]

---

Oh man, I just GOTTA do it:

ROTFLMAO!

---

" I'm seriously tired of your unhinged rants." - by RyuuzakiTetsuya (195424) on Monday February 28, @05:14PM (#35342006)

LMAO - apparently not, because I have kicked your ASS, yet again... & I answer all questions put to me, with proofs (just like you asked for above, lol, much to your OWN dismay, as per your usual)...

APK

P.S.=> Want more of them? Ok, see here (as to MacOS X being "more secure than Windows7"):

http://secunia.com/advisories/38066/

That shows the rest of the UNPATCHED VULNERABILITIES on MacOS X... & new NEWS/NewsFlash:

IT'S MORE THAN WINDOWS 7 HAS, period... apk

Re:Ask & YE SHALL RECEIVE (and you LOSE, troll

[RyuuzakiTetsuya]

NOTE: Currently, there is no application known that can be used as attack vector.

...and?

What's the point of an exploit if there's no attack vector?

The REMOTE FLAW in MacOS X is 1++ yrs. old! apk

[Anonymous Coward]

"What's the point of an exploit if there's no attack vector?" - by RyuuzakiTetsuya (195424) on Monday February 28, @05:42PM (#35342298)

First of all, the exploit IS remote, and they (like anyone else) CANNOT be sure that by now, there isn't such a programmed exploit (or, what you're calling a vector).

HOW CAN I SAY THAT? LOOK AT THE DATE OF IT = 1/12/2010 -> MORE THAN 1 YEAR OLD NO LESS!

(Plenty of time for it to have been used/abused, and you have to remember 1 thing: Not every malware-maker/hacker-cracker (whatever) gives away the fact they have a working exploit in code... that'd be DUMB from THEIR PERSPECTIVE, in fact!)

Yes - It's remotely exploitable, AND VERY old, and still unpatched...

A REMOTE EXPLOIT no less (dumb move by Apple imo - even MS usually IMMEDIATELY chases the remotely exploitable ones, right away, MOST times!)

APK

P.S.=> My point here, was simple: TO SHOW THAT ALL THE B.S. FROM THE MacOS X Commercials by Apple on T.V. was JUST THAT - PURE BullShit!

After all - Windows 7 has less unpatched bugs going on in its codebase, than does MacOS X!

Quite a LOT more in fact... lol, and IT SURE GOT A "RISE" OUT OF YOU, now, didn't it? Never let them see you "sweat", & you ought to try that sometime... apk

Re:Time to cut you into more pieces, easily again.

[dgatwood]

No, YOU said Windows source was closed... funny:

It is closed source. The fact that source code has been shown to specific third parties under nondisclosure does nothing to change that fact. I'd be surprised if any closed source piece of software exists that has not at some point been similarly made available to at least one third party under NDA. That's not the same thing as Open Source, in which the source code is out there with public change logs and bug tracking such that almost every single security bug is disclosed to the entire world the moment it is discovered.

...there ARE & WERE valid workarounds....

Which are completely beyond the average Windows user. As far as I'm concerned, an OS is only as secure as it is in the default configuration. If, as installed, an OS has a hole so big you can drive a truck through it, the fact that they provide mortar and a bunch of bricks so that you can patch the hole yourself doesn't really change anything. By that standard, a ten-year-old Linux distro has no security holes because you can recompile BIND, Apache, OpenSSL, etc. yourself. It's a ludicrous argument.

Again, see 1-3 paragraphs above, & tell us that MOST "hacker/cracker wannabes" out there do NOT re-use existing exploits in THEIR variations of them... or that toolkits that get RAMPANTLY "re-used/used" to create malware, don't exist... ok?

Most of the wannabes do, sure. They rely on people not patching their machines for long periods of time. The people who created those exploits in the first place, however, don't generally sit around trolling the list of patched vulnerabilities. By the time there's a patch out there, the bulk of the potential targets are going to be protected before they can roll an attack, leaving only a small percentage of stragglers. For maximum impact, the serious hackers are exploiting zero-day holes.

I'd like YOUR THOUGHTS on the validity of the MacOS X commercials & their "FUD" regarding them implying "MacOS X is more secure than Windows".

My thoughts are that the facts you give do not prove what you think they do.

Also, the articles you are pointing to this time are pretty much harping about ASLR differences. While ASLR is nice and all, that's only one very small aspect of total OS security, and one that is no more or less important than sandboxing, privilege separation, etc. No OS is the best at every aspect of security.

These links are basically tantamount to saying that a Ferrari is better than a Porsche because the cupholders are nicer. While one or the other might be better, it should be obvious to anyone with a modicum of common sense that using one minor feature as the sole basis for comparison is sheer foolishness.

Question: Which has more vulns (MacOS X or Win7)?

[Anonymous Coward]

Just answer that... in regards to BOTH MacOS X &/or Windows 7, and KNOWN security vulnerabilities!

APK

P.S.=> Now, onto the rest of the points in your post:

"As far as I'm concerned, an OS is only as secure as it is in the default configuration." - by dgatwood (11270) on Monday February 28, @06:03PM (#35342468)

You're going to be "upset" w/ yourself here, possibly: MacOS X is FAR from as "secure as it can be", because IF YOU SEARCH THE APPLE WEBSITE? You'll find guides for securing it, & FAR BETTER THAN IT IS OUT OF THE BOX!

---

"Also, the articles you are pointing to this time are pretty much harping about ASLR differences. While ASLR is nice and all, that's only one very small aspect of total OS security" - by dgatwood (11270) on Monday February 28, @06:03PM (#35342468)

Correct me IF I am wrong here, but... MacOS X doesn't implement ASRL, does it? Not afaik/iirc... only DEP (or, is it the other way around? Doesn't matter - I know it lacks one of them)

Ahem - MOST importantly, THIS NOTE though?

This merely illustrates an INFERIORITY IN SECURITY IN MacOS X vs. Windows 7, since Win7 uses BOTH DEP &/or ASRL!

---

"Which are completely beyond the average Windows user." - by dgatwood (11270) on Monday February 28, @06:03PM (#35342468)

Oh man... COME ON: I thought YOU were better than THAT!

TweakUI is beyond MOST USERS? Please... that's like saying any GUI is "beyond most users", because the MS PowerToy, TweakUI, is a GUI Win32 usermode app!

(There are, also & I omitted this earlier, iirc, options in either gpedit.msc OR secpol.msc MS mgt. console snap-ins also that are GUI easy to use too!)

So, you're NOT just "stuck" with .reg hacks (those are easy too, once they're in notepad, for use/reuse).

---

"I'd be surprised if any closed source piece of software exists that has not at some point been similarly made available to at least one third party under NDA." - by dgatwood (11270) on Monday February 28, @06:03PM (#35342468)

Yes, quite right & I HAVE BEEN THERE MYSELF with commercially sold ware I myself contributed code to - I had to submit a sourcecode list for attorneys (of ALL people, no less)...

---

"Most of the wannabes do, sure." - by dgatwood (11270) on Monday February 28, @06:03PM (#35342468)

Thanks for at least conceding that point of mine thusfar... apk

Re:Question: Which has more vulns (MacOS X or Win7

[dgatwood]

MacOS X is FAR from as "secure as it can be"...

Nobody said it was. It does not, however, to my knowledge, ship with things turned on that are more insecure than an emo kid.

TweakUI is beyond MOST USERS?

In principle, no. In practice, the average computer user has never heard of AutoRun, much less TweakUI. That's why the default state must have at least a certain minimum level of security or you're screwed.

I don't think you realize just how little the average computer user knows about how computers work. A sizable percentage of Windows users don't know how to install software at all, relying only on the software that came preinstalled from Best Buy. Thus, even the act of downloading and installing TweakUI is beyond them....

So yeah. It's way beyond a significant percentage of Windows users. Way, way beyond.

You may actually find this, useful

[Anonymous Coward]

This is straight from Apple - I think you'll be surprised how much MORE you can security-harden a MacOS X setup:

"Nobody said it was. It does not, however, to my knowledge, ship with things turned on that are more insecure than an emo kid." - by dgatwood (11270) on Tuesday March 01, @01:40PM (#35349650)

---

APPLE SECURITY GUIDES FOR MacOS X:

http://www.apple.com/support/security/guides/

---

APK

P.S.=> I still think you underestimate people who own & use computers though... TweakUI is very simple to use, a "point-N-click" GUI affair! apk

Safari's doing "so well" (not) @ pwn2own, eh?

[Anonymous Coward]

Safari/MacBook First To Fall At Pwn2Own 2011:

http://apple.slashdot.org/story/11/03/10/0319224/SafariMacBook-First-To-Fall-At-Pwn2Own-2011

(LMAO!)

APK

P.S.=> Now, couple that with the fact that MacOS X has had a REMOTE EXPLOIT http://apple.slashdot.org/comments.pl?sid=2014606&cid=35342402 , & one that's been open to attack for more than 1 year now? Please... apk

"Theoretical"? SAFARI falling 1st @ pwn2own!

[Anonymous Coward]

Safari/MacBook First To Fall At Pwn2Own 2011:

http://apple.slashdot.org/story/11/03/10/0319224/SafariMacBook-First-To-Fall-At-Pwn2Own-2011

(LMAO!!!)

APK

P.S.=> Now, couple that with the fact that MacOS X has had a REMOTE EXPLOIT http://apple.slashdot.org/comments.pl?sid=2014606&cid=35342402 , & one that's been open to attack for more than 1 year now? Please... apk