Secunia: Apple has more security holes than Microsoft

Apple Store“Here’s another blow to those insist that Apple products are rock solid and unhackable: The security company Secunia reports that Apple products have more vulnerabilities than those of any other company. Oracle came in second place, with Microsoft in third,” Preston Gralla reports for Computerworld.

MacDailyNews Take: Ooh, big blow. Give us a call when cascading self-replicating viruses cost hundreds of billions of dollars in lost productivity, data, and time, m’kay?

Full article, which also includes the painfully obvious fact that “simply listing the total number of potential vulnerabilities isn’t the best way to gauge the relative security or insecurity of a computer, because some vulnerabilities may be more prevalent than others. So Secunia is not saying that Apple products are less secure than other products” here.

90 Comments

  1. Funny how this seems to coincide with Apple passing Microsoft in market value. Of course this will be picked up by the mainstream media, delivered to the masses as a soundbite or dramatic headline then suddenly people everywhere are flooding the Apple store barraging their employees with endless questions about security.

  2. Their vulnerability assessment model is not based on actual facts but their own perspective that market size = vulnerability size and that they have now factored iTunes etc into the mix.

    Isn’t this just another view that obscurity means security?

    Seems like what they are saying is the M$ is becoming more obscure, however the obscurity security issue has always been irrelevant and never backed up with facts.

    Article would therefore appear irrelevant along with the authors.

  3. Big difference between theoretical vulnerabilities, obvious vulnerabilities and exploited vulnerabilities.

    All of OS X’s vulnerabilities are theoretical. All of Microsoft Windows’ vulnerabilities are exploited, sooner or later.

    Big difference.

  4. @Max

    That is like saying who the hell is Acer. Big name, but if you are clueless to security you would not know. Secunia’s PSI and CSI are the bomb.

    Unix has many more small files then Microsoft, when they finally feel get to attacking OS X there will be a fertile semi untouched OS to bombard.

    And no, I am a Mac guy with 6 Macs and 2 PCs. Just listen to Charlie Miller (pown to own white hat) stating OS X is far easier to hack then Windows 7.

    OS X has never been tested with the full Russian/Ukraine/China/Asia hacking world hacking it 24/7. It will have weekly breaches just like MS has when it becomes a target from the pros and government pros. To this date you have only seen a couple grains of sand hitting OS X. Wait till the whole beach of sand starts knocking on it’s door. Mass pownage.

  5. I agree mostly with RIF: IT IS NOT ABOUT OS X !

    It is however about software on Win XP and Win Vista, therefore the report (not the article) includes Win Safari and Win iTunes.
    (See page 9 of the report).

    Reminds me of the article in the Economist, about antenna gate saying that Apple didn’t accept the problem about signal strength going down, provides a link to the Apple KB, and the LINK says “we have a problem…”.

    These days one has to read the source documents, because the press is becoming too lost in their prejudices that they can´t READ straight their own quoted sources.

  6. in the dept of defense there are vulnerabilities (theoretical) and susceptibilities (practical). having a vulnerability doesn’t make ti something to be concerned about necessarily. m.s. has demonstrated a history of practical susceptibilities.

  7. Sorry, But until I see an all out attack on Apple products, this is just BS. With all of the Apple haters, I find it hard to believe that no one wants to put Apple in their place. The security through minority theory doesn’t hold water any more.

  8. @Ted: Fear + Uncertainty + Doubt = FUD

    Mac OS is not impregnable. There are currently several Trojans which can be downloaded and run on a Mac. They have to be actively downloaded and run by the user.

    Having said that, OS X is a version of UNIX, which was designed to be networked, unlike Windows, which was designed to be stand-alone. Windows has massive holes and spaghetti code where all sorts of malware can run without the user knowing.

    In UNIX, nothing can run unless it’s been approved to run by an administrator. Also, every piece of software resides in a library, and there are a limited number of them. There’s really not much room to hide; if the virus is not running on the Admin account, very little damage can be done. Read more about that here: http://daringfireball.net/2004/06/broken_windows

    Additionally, Macs are virtually invisible on the internet right out of the box. Even without a firewall on, you are essentially in “stealth mode,” so Macs are safer from crap that’s out there being passed around. “… by default, OS X doesn’t leave many ports open. In contrast, most versions of Windows ship with a bunch of open ports, which is one reason that operating system is a riper target for malicious hackers. And while Leopard leaves open more ports than earlier versions of Mac OS X, so far there have been no known attacks on those default services.” http://www.macworld.com/article/132558/2008/03/connect2504.html

    Because Macs are hard to crack, and Windows is easy, the goons target Windows. But that doesn’t mean they haven’t tried. Read about the “Hack-my-Mac” challenge here: http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=181502078

  9. @ Pay Attention,

    Apple quit making claims about Mac security because Windows users were getting pissed off.

    Since Windows users make up about 60% of new Mac buyers, Apple no longer wants to piss off 60% of their Mac customers.

  10. Secunia can make a bigger name for itself by 1) submit an app to the app store that gets approved and end up exploiting the users; or 2) steal personal info through a Safari exploit.

    To say professional crackers have not targeted Mac OS 24/7 yet due to (lack of) popularity is a postulate without proof. Makes no sense considering average Apple owners have higher income. Makes more sense considering most corporate and government enterprise systems are not run on Mac OS. Plus the diverse Apple devises and various numbers and situations that people run them makes choosing a target for maximum profit difficult.

  11. @aka Christian

    Read it again, I know it’s Unix. Daaa

    Additionally, Macs are virtually invisible on the internet right out of the box. Even without a firewall on, you are essentially in “stealth mode,”

    Browser headers, and zero day. Mac is just as vulnerable as Windows. IF you get a pro hacking it. Many many many zero days left in OS X per Safari and Firefox.

    All at the feet of a advanced pro hacker with the clueless unprotected nieve Mac user with “browser headers yelling “here I am, and I am a Mac ” to any website 99% of Mac owners would do who does not know how to switch his browser agent.

    Wake the hell up! Thinking OS X is this God of an operating system. It will fall if some doctorate brain hacker from Russia/ china who wants to cause some strife points to it and spends some time on it. There is not enough value in it know $$$ wise. There will be in the coming years.

    OH OH but your full of FUD. Yea.

    It is just code that has not been pounded on by true pros. Yet

  12. How many copies of OSX out there? 40+ million?
    Still nothing happening? Where is the virus?
    Why would anyone wait when fame would await them by creating one?

    You know what? Time to end the false politeness. Time for the truth:
    Ted, you are an idiot! And I have no problem saying so.

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.