“OS vulnerabilities are a result of OS characteristics, and the CPU they run on is pretty much irrelevant,” Larry Seltzer writes for eWeek. “I guess Black Hat just gets hackers excited and optimistic for more bad news. This leads them to believe, for example, that Apple’s move to x86 for the Mac will make the platform less secure. Claims like these raise basic questions about what creates a vulnerability in an operating system and how attackers exploit them. The short answer is that rarely, if ever, are the existence of vulnerabilities related to the specifics of one processor architecture versus another.”
“The vulnerability is in the structure of the program, not strictly in the implementation generated by the compiler. You’re far more likely to be able to leverage an exploit from the PowerPC Mac OS on the x86 Mac OS than you are an x86 Windows attack on x86 Mac OS. Apple has had no shortage of vulnerabilities disclosed in the last several years. FRSirt lists 33 for the last year, and 13 of them are rated as ‘critical.’ Why were there no major exploits of these vulnerabilities? Was it because they were too hard to do? Of course not. They weren’t worth exploiting because there are a dearth of actual Mac systems out there, and they have reasonably good defenses available to them,” Seltzer writes.
“So what changes when the Mac moves to x86? If Apple’s market-share shoots up and attackers suddenly have a better shot of finding Macs to attack, then more malware will be written to the Mac. But it won’t be any easier to exploit for being on x86. Lots of real vulnerability news comes out of the average Black Hat conference, but there’s also typically a share of weird ideas out of left field, and this is one of them,” Seltzer writes. “Perhaps those black hats are on a bit too tight for the arteries in the brain.”
Full article here.
MacDailyNews Take: This is some real wrath-of-God type stuff. Fire and brimstone coming down from the skies… Rivers and seas boiling… Forty years of darkness… Earthquakes, volcanoes… The dead rising from the grave… Human sacrifice, dogs and cats living together… eWeek publishing common sense regarding Mac OS X security… Mass hysteria.
By the way: Macs aren’t secure due to obscurity. First of all, Macs aren’t obscure, they only appear so during nationally televised commercial breaks. And, secondly, Mac OS X is designed to be secure on networks. By design, Mac OS X is simply more secure than Windows. Period. For reference and reasons why Mac OS X is more secure than Windows, read The New York Times’ David Pogue’s mea culpa on the subject of the “Mac Security Via Obscurity” myth here. There are over 20 million Mac OS X users in the world and there are still zero (0) viruses. If platforms’ install bases dictated the numbers of viruses, the fact that Mac OS X has zero (0) viruses discounts “security via obscurity.” There should be at least some Mac OS X viruses. There are none. The reason for this fact is not attributable to “obscurity,” it’s attributable to superior security design. According to CNET, the Windows Vista Beta was released “to about 10,000 testers” at the time the first Windows Vista virus arrived. So much for the security via obscurity myth.
Advertisements:
• MacBook Pro. The first Mac notebook built upon Intel Core Duo with iLife ’06, Front Row and built-in iSight. Starting at $1999. Free shipping.
• iMac. Twice as amazing — Intel Core Duo, iLife ’06, Front Row media experience, Apple Remote, built-in iSight. Starting at $1299. Free shipping.
• iMac and MacBook Pro owners: Apple USB Modem. Easily connect to the Internet using dial-up service. Only $49.
• iPod Radio Remote. Listen to FM radio on your iPod and control everything with a convenient wired remote. Just $49.
• iPod. 15,000 songs. 25,000 photos. 150 hours of video. The new iPod. 30GB and 60GB models start at just $299. Free shipping.
• Connect iPod to your television set with the iPod AV Cable. Just $19.
Related MacDailyNews articles:
eWeek article about potential Mac OS X security exploits is fiction, factually wrong – January 27, 2006
Security technologies that have made Mac OS X secure for PowerPC remain same for Intel-based Macs – January 27, 2006
Who you gonna call?
Well after driving a steam roller over both feet and their credibility with a recent piece about the processor switch opening the door to virus gloom on Macs they had to backpedal fast and publish something real.
nice Ghostbusters reference, MDN.
Holy hell, what is the temperature down there today? This is a shock and a half. eWeek publishing something truthful about the Mac…it’s a rare thing indeed.
BTW, MDN, perfect choice for a quote. Ghostbusters references are just awesome. 😀
Don’t get too excited, this article raises the old “the reason there aren’t any exploits for Macs is because Macs aren’t popular” canard.
Sigh.
Re MDN Take: “…eWeek publishing common sense regarding Mac OS X security…”
But this is unheard of! MDN actually saying that the following is common sense:
“Why were there no major exploits of these vulnerabilities? Was it because they were too hard to do? Of course not. They weren’t worth exploiting because there are a dearth of actual Mac systems out there…”
Which leads to the logical conclusion: as the number of Mac systems increase, so will the probability that hackers will target them.
But that’s heresy! OS X is invulnerable!!! There will never be a virus written for it! All Mac users should remember – do not buy anti-virus software and make sure to send your
daily dose of hate mail to those security firms and IT types so they leave you and your blessed OS alone.
Remember that.
Evil_MS_User
Shouldn’t you go count your huge salary?
Some security tips is worth it
http://homepage.mac.com/hogfish/Personal9.html
Oh. You saw that. Hey, I apologized already, didn’t I? Give a guy a break. It’s not my fault my boss loves me…
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />
I’m being duped. Identity theft! Identity theft!
I swear. Really. I believe MS rules. Rules forever. One EUA to rule them all.
Bwaaa-ha-ha-ha-ha-ha-haaahhhhhhhhhh!!!!!!!
Tools. You are all MS minions. Quicktime is a smokescreen. Steve will sell Apple at the peakof it’s value in about a year and a half.
Or MS will take it over by force before then.
Suckers.
Boy, using the same sig all the time probably isn’t a good idea. Some Mac fanboys sure have a sense of humor
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />.
Anyways, the tone of a post is a lot more difficult to emulate.
So everyone should be able to tell when it’s the real deal that’s posting – not some joker.
John Gruber at Daring Fireball: http://daringfireball.net/2004/06/broken_windows
An excellent read on this very topic.
And crackers/hackers can “target” the Mac OS all they want. It’s a non-story until they actually DO break through, which will be a truly momentous day and all those doom and gloom Ghostbuster reasons will TRULY come true. I bet Bill Murray will be long gone before it happens, though. Every corner of the media universe will assail Apple mercilessly for weeks upon weeks if that ever happens. And it probably will. But not for a LOOOOONNNG time.
There is a real side to security through obscurity. Apple posts security patches regularly to Mac OS X. If you take a really old version of Mac OS X, there are known exploits for it that Apple has long since patched. Run that old version of Mac OS X on your G4, and nobody is going to take advantage of those exploits because nobody gives a crap.
MDN, you folks can’t be as ignorant as you seem to be every time that you post your security vs. obscurity argument. Every logical virus maker would target the most common operating system so that their viruses could do the most damage. Just because macs have 5% of market share does not at all mean that they receive 5% as much virus targeting as windows. That’s just common sense.
Also, viruses came out for Vista when only 10,000 people had it because virus makers know that soon millions and millions of people will have it. They are just trying to get a head start.
Lastly, I believe you when you say that OS X has had zero documented viruses, but, especially for the number of times that you post that information, I wouldn’t mind it if you also posted a source.
I have never owned a computer that is not a Macintosh. Macs are obviously significantly more secure than Windows PCs (not to mention better in just about every other way). But we must admit that everything has some flaws, and perhaps if OS X was targetted as often as windows is hackers might have found a couple of ways to create viruses.
Hey Evil,
I’ve been running OS X since it came out, and I’ve been “going commando”. Yep, that’s right: No viruses, no malware, no spyware, not a one. Now, would you/could you claim the same thing? Probably not. I’ll continue to do so. I won’t claim that no virus will ever be built for Mac OS X, but I will say that if the hackers and crackers and virus writers thought that they could do it, they would have built one by now. Take a look at all of the viruses out there. Every single one has the writer’s sig on it somewhere, so that they can claim it. To be the first Mac virus author would give you infamy. But it just hasn’t happened.
Now, if you *REALLY* work in the IT field, you should understand a little something about security. And if you really do use a Mac and really do use Windows, you’d instantly understand this whole discussion. Macs ARE secure. The OS was built to be secure. I doubt I need to explain this to you. Windows IS NOT secure. It never will be as long as it continues to be built on the same faulty code over and over.
So, you come into this forum talking about “mac fan boys”, yet you are the one that is showing his fan boy side. Does it make you feel superior that you are using Windows (no doubt because everyone else does)? That is something to laugh about.
Jimbo, my friend. All I ask is that you peruse the MDN archives for all my posts. After you have a more definite idea of what I do we can have a livelier discussion on OS security.
I don’t know why I try. To educate you Macheads is almost futile.
I don’t HATE the Mac OS, it’s just not as versatile. Educate?!? Enlighten?!? Share another perspective??!!??
“Blasphemy!!!!!! Macs are invulnerable!!!!!! You are a troll!!!!!!”
Come on … get a clue. More OS installations = more Viruses and attacks. It’s simple logic. Except around here.
Get a clue, fanwankers.
Evil — There must be some leftover whippets or something lying around here.
Help yourself, Cheese.
Evil_MS_User,
Please stop making Windows users look like complete asses. You’re wrong. OS X is not only safe via obscurity (a non-sequitur) but it is ALSO safe by design. Simple as that. Until Windows is as strict about requiring the use of an admin password to modify system files or install ANY program, it’s simply a fact that OS X is more secure. Not shut up about it and quit reminding people. You are no friend of Microsoft!
Regards,
Carnegie…er Billy
“Until Windows is as strict about requiring the use of an admin password to modify system files or install ANY program, it’s simply a fact that OS X is more secure.”
Partially true. IT departments learned this a long time ago, which is why you will be hard-pressed to find any corporation nowadays that hasn’t “locked down” their users’ desktops. I actually started using a non-admin account for everyday use back when NT 4.0 was released and have been doing it ever since.
The big problem has always been these legacy apps that required local admin rights to run properly. I know about them very well – I can’t count the number of apps I’ve had to repackage to work around this problem. But it’s actually getting better – the other day I installed a small photo album app for a Philips digital camera and I was fully expecting to have to tweak it to get it to work without admin rights. But lo and behold – it worked right out of the bat. So the developers are finally coming around to programming to Win2K specs…
The overwhelming number of IT installations require oversight and off-site (or near-site) administration from within the confines of the resident IT fortress. That’s the building (or department) where the average employee doesn’t have a prayer in hell of getting into. This mentality serves to further secure the IT department’s permanence and safety from corporate downsizing attack.
This mentality is predominant in corporate culture. And it’s precisely why Macs will never make a dent in the corporate business infrastructure. They are simply too secure and far, far too user-manageable. With current IT loss rates at only -1% per annum nationwide, no IT manager in his right mind will recommend a switch to a more secure Linux or OS X paradigm, lest said department suddenly begin to experience greater loss and employee defection rates — probably in the neighborhood of +33% or higher.
It’s really simple human nature.
I made a poopy.
Just caught the above two posts. You should really hear me laughing now. This is hilarious!
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />
Love it. 8-P
Keep it up…
You ARE a poopy.
You ALL suck! ALL of you!
I’m going for a walk now.
<sound of door slamming>