Slashdot Mirror
Do Macs Have an Edge Against APTs?
itwbennett writes "Macs aren't being hit with advanced persistent threat (APT) attacks, but that doesn't mean they're invulnerable, say researchers at iSec Partners. Speaking at the Black Hat conference in Las Vegas Wednesday, iSec founder Alex Stamos and his team of researchers took a look at the typical stages of an APT attack — and compared how the Mac would do versus Windows 7. Their conclusion: Macs provide good protection against the initial phases of the attack, but once the bad guys are on the network, it's a whole different story. 'They're pretty good for [protecting from] remote exploitation,' Stamos said. '[But] once you install OS X server you're toast.'"
Wash. Rinse Repeat.
Macs aren't as vulnerable because they don't have a big enough footprint so they aren't stumbling upon the infected sites or aren't being targeted directly. Windows, including Windows 7, is still more prevalent and more vulnerable.
How many times are we going to get the same stories? If the user is willing to do anything the app or websites tells them to, well, you can't protect them.
My apartment is safe against Macs
"For example, Mac's Keychain software is vulnerable to what's known as a brute-force attack, he said."
Idiot alert, article is crap.
Windows server looked after by a good sysadmin == secure.
Mac server looked after by bad sysadmin == insecure.
As always, it's up to the people running it. Is any OS inherently secure, no, definitely not when there is a complete idiot looking after it.
Calling someone a "hater" only means you can not rationally rebut their argument.
Can someone explain what apt is, other than the package manager for ubuntu?
The package manager for Debian.
But seriously, if you read the summary, you see that it's referring to advanced persistent threats.
Metasploit only has a couple dozen exploits for OSX. On the windows side, it has a search field for Microsoft Security Bulletin ID. Metasploit is the lazy-man's way to hack, if you don't want to go through the trouble of finding your own exploits. That could partly explain the issue.
"First they came for the slanderers and i said nothing."
Not quite sure on the definition of an APT. Wikipeida says its generally a foreign state. .dmg are not instantly ran like exe.
I would think that due to core system generally having less holes in it, getting in without user execution would be harder. I don't think it matters in the end as you would still execute something, but
I would also think getting the user to execute malicious code would be significantly harder. Base apple software is generally usable so you don't need to find replacements. People who buy macs because they are macs will go apple for other software and the app store is generally easier to go to than the internet to search for program that you might need. The behaviour of having idiot users searching on the internet for unknown third-party solutions is not encouraged on OSX.
Good News! Apple is taking steps to making that impossible!
Macs are Unix. Unix is better than Windows for security, therefore Macs are better than Windows.
Linux are kinda Unix, but it's made by amateurs. Macs are better than Linux boxes.
Did I miss any desktop OS?
Thanks for reading.
This is a "Duh" in *every* business, whether it be IT or plumbing or medical care. Put an incompetent nincompoop in charge and there will probably be problems. If I had mod points and there was a "Duh" option, your post would get my "Duh" point.
And one that is already occupied by another term in the realm of IT.
Advanced Persistent Threat, eh?
Ugh... really? You couldn't just say "targeted attack"? What about spear-phishing? Too hard to spell? Dipshits.
...unless we're talking about "unused" Keychain files.
Suppose a desktop Mac has been compromised. Then we can assume, for the purposes of security, that the local Keychain binaries have been compromised. Thus the attacker has free access to the cleartext of any keychain used ("unlocked") on the system. But this is hardly a flaw in Keychain, since it's true, by design, for any credential cache whatsoever.
Macs run TNPP (Turtle Neck Protection Protocol) that protects the Mac from all unwarranted ugliness.
Nope, not true, unless there is a root compromise, rather than a normal user compromise. The keychain daemon runs as root. It communicates with other apps via Mach ports, which let it know the pid and the uid of the process requesting data. It then checks whether that binary has been modified since it last tried to access the keychain, and whether the (user, binary) has access to the specific key, and prompts the user to authorise it if it doesn't. If you find an exploit in Apache, for example, then this does not give you access to the keychains of logged-in users, you also need a root exploit.
I am TheRaven on Soylent News
And Mac OS X explicitly warns you if you are about to open an application downloaded from the Internet. This means that getting someone to run your code requires tricking them (through social engineering) into knowingly launching an application that they've never launched before, as opposed to tricking them into running your code by making it look like a JPEG file of Lindsay Lohan naked or whatever. Maybe Windows 7 does the same thing (I'm not sure), but that was at least historically a big problem on Windows.
In Windows, files downloaded from the internet has the origin written in an alternate datastream. If you execute such a file you get a warning (like in OS X), but then even if you choose to run the executable, it will run with low integrity. Low integrity is part of UAC and sandboxes the process so that it by default has only read access as the current user. Write access (safe a few cache locations) is completely blocked, safe a few safe cache locations. This is a major obstacle for anyone wanting to use a trojan to install malware. He cannot even infect the local user, bar som sandbox escape vulnerability or some more clever social engineering.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
The VERY REASON Windows gets targetted MOST is because it IS THE MOST USED.
Malware maker types out there don't expend efforts on Operating systems that don't have a LARGE usershare/mindshare/marketshare, anymore than pickpockets operate on "crowds of 1" for a return on their efforts expended - they want GOOD "ROI"!
Malware makers are JUST LIKE PICKPOCKETS, & they operate on large crowds typically (think trainstations, bus stations, city streets, malls, etc.et al), & so does the malware making crowd.
From their perspective, & you need to "channel your 'inner criminal'" on this? Think, or try to, like THEY do!
What shows this BETTER THAN ANYTHING?
ANDROID (a Linux variant)!
Sure - It's largely taken the "mobile smartphone" world by storm, even being a relative "newcomer" compared to say, IOS, on mobile phones, but it's gaining fast IF NOT EXCEEDING IPhone IOS usershare/marketshare by now!
( & thus, THAT IS WHY YOU SEE nearly DAILY new attacks, hacks/cracks, + malwares being made for it... ala my only PARTIAL LIST OF EXAMPLES THEREOF, here -> http://mobile.slashdot.org/comments.pl?sid=2359532&cid=36978946 )
Again, WHY??
Because there's so much of ANDROID out there, & so fast too (new OS' always get targetted, especially ones with a ton of new apps available, or new features, because these present attack surfaces for the malware-maker crowd as well)...!
APK
P.S.=> Same goes for IPhone IOS... Once ANY platform gains a HUGE share-of-market & large amounts of unsuspecting/unwary users, it's SURE to be the "prime target" of attacks (do you see cat burglars attempting to rob houses with nobody in them, or no belongings of worth in them, such as a just being built housing tract? No. They target already populated areas with systems in use that have credit card transactions going through them, valuable information/data on them, & more... not ghost towns!)
... apk
" — and compared how the Mac would do versus Windows 7. "
I was promised a comparison between Mac vs Windows 7. The article totally failed to deliver. Sure, you can hack a Mac. But is it easier or harder than Windows?
Those Windows boxes probably had dozens if not more pirated apps installed, along with all the trojan laden China "sharing" and chat software. My company's offices in China are infected with warez, the only way around it is to lock down the boxes, even then, the helpful IT guys gladly install a "copy" of Photoshop, Office, etc.
The old Mac OS had about 10% market share in the 1990s, and OS X now has 10% market share. But there was was far more malware for the old Mac OS "back in the day". The false equivalency suggesting that differences in system architecture do not matter has worn very thin: Windows adherents ought to stop wearing it like it was a fig leaf.
Macs don't have any edges! They are shiny and smooth.