Slashdot Log In
PC Mag - Mac OS X Insecure
Posted by
CmdrTaco
on Thu Dec 11, 2003 03:13 PM
from the no-big-surprise-here dept.
from the no-big-surprise-here dept.
Suki writes "In this recent story a PC Mag writer concludes that "Panther and Jaguar were not better at outrunning vulnerabilities than Windows" and as my personal fav. ends by asking "How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here." The article discusses many previous Windows security holes against a recent Mac OS X security flaw."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
so, there's a hole (Score:5, Insightful)
was it worth the rant, or has he just been waiting a long time to make it?
Not much of a comparison (Score:5, Insightful)
Mind you, I'm not too overwhelmed with his research; if he'd been paying attention, he'd have caught the SSH vulnerability the other month. It's not like Macs have been immune, and nobody with any clue claims they are.
What you can claim accurately is that Apple fixes holes promptly and fairly quickly, and that the MacOS X architecture does not have flaws which result in two or three active IE holes in the wild right now.
Apple isn't perfect, they're just pretty good. Microsoft isn't evil, they're just not as good as they should be. It's perfectly reasonable to use those two facts in making one's security decisions.
Re:Not much of a comparison (Score:5, Interesting)
The other thing that you can claim is that Apple appears to perform more thorough testing of their security patches. I have been using OS X since beta and I have yet to have applied a patch that has caused any real pain. Windows on the other hand......Well, I cannot count the wasted hours I have spent either rolling back an update or scrubbing the hard drive clean and doing a reinstall due to Windows either seriously corrupting things or even worse, outright killing a machine. In fact, at our lab it was a W2k security update that killed a machine dead that was responsible for us replacing all of our W2k systems with 17in iMacs running OS X. I simply got tired of the grief associated with maintaining a Windows computer. We use our systems to get work done, not to goof around with maintaining Windows.
Parent
Re:Not much of a comparison (Score:5, Insightful)
Lance writes: I know this is wrong, but in one respect I was happy to learn earlier this month about the discovery of a significant security hole in the Jaguar and Panther versions (10.2 and 10.3, respectively) of the Apple operating system (OS).
Lance, let me tell you. It's not wrong for you to feel this way
Get a grip on yourself, man! Stand up straight, take the panties off your head and start acting like you've got a pair! Repeat after me, I am not the products I buy. Sometimes the products I buy work out, sometimes they don't meet my expectations. When they fall short, it is not a reflection of who I am, my intelligence or the size of my magic wand. If the product fails, it is a reflection of the manufacturer.
Now go out there and do something useful with your life like kicking the butt of the manufacturers who sold you inferior products!
Parent
What a bunch of crap (Score:5, Insightful)
Personally I would not have made that choice, but at least there was check box to turn off the default DNS trust. If only windows came with checkboxes to remove its bugs. And I dont mean like checkboxes that say "turn off scripting and cripple my browser please".
In fact mac has not even fixed the so-called hole because its not neccessarily a mistake.
In any case the SSH vulnerability, and the screen-locker vulnerability were in fact true holes created by mistakes. These are what should be scrutinized. But these did not lead to widesperead network worms at least. they did not arrise out of a insecure by desing attitude that pervades all the Active-X philosopy, the power-user-by-default philosophy, the standards crushing embrace-and-extend, the optional log-in password philosophy, or the add features rather than fix bugs philosophy that rightfully inspires all the anti-windows zealotry.
Parent
Got quiet, eh? (Score:5, Funny)
Can someone tell him that HIS WEBSITE IS NOT A BLOG, OTHERWISE HE WOULD BE INUNDATED WITH REPLIES!!!!
Thank you. ;-)
Go to the PC Mag URL instead (Score:5, Insightful)
Then you can go here [pcmag.com] to discuss what a steaming load this "commentary" is. Oh, my gosh. Someone who already has access to your network can put a malicious machine on it that will lead to your Mac being owned when it reboots. That's so freakin' simple. Not like those astonishingly difficult Windows attacks of sending emails, setting up websites and/or having users download spyware. The sky is obviously falling. AAAAAHHHHHHH!
Parent
sad... (Score:5, Insightful)
Next Month... (Score:5, Insightful)
Whatever. All OSes have their inherent problems, but next month, when Microsoft racks up another suit of deathly insecure vulnerabilities, OS X will probably be fixed and free from defects for another couple of months.
I'm not a Mac fanatic, but it's because OS X is based on Unix, and Unix is more elegant in its design that gives OS X its better security.
It's all about the scope... (Score:5, Interesting)
The attacker must:
Be on your local network
Already have control of your DHCP server
If both of the above are true, you already have much more serious problems.
While I agree that remote root/admin is bad juju, in this case it's hardly equivalent to the Windows remote admin exploits to which he's comparing it.
How many recent flaws? (Score:5, Insightful)
> a recent OS X security flaw
That's the significant word, I think. A single one
it's quiet because you're such a pussy.... (Score:5, Informative)
Lance_Ulanoff@ziffdavis.com
Share and enjoy!
Re:it's quiet because you're such a pussy.... (Score:5, Funny)
An e-mail address! Quick, send him an Outlook virus!
Parent
Quick! (Score:5, Funny)
I think I already did.
Parent
Is this really the same? (Score:5, Interesting)
So, a guy has to get on my network, set up another machine as a trusted server, wait for me to reboot, and then...? Is this a fair comparison to email viruses, etc...?
My cube's been up for 90 days. I plan to take it down and upgrade it eventually. Does this mean I'm going to be vulnerable?
Whatever.
I'll second that... (Score:5, Funny)
It's about time Apple did something about the POS security in OS X!
And this guy is an editor? (Score:5, Funny)
That's the sound of no one caring what you think, Lance.
A series of what ifs, followed by the reaction of imaginary mac fields that exist only in Lance's head.
And the whole "Macs don't suffer viruses because there's so few" myth was dead and buried long ago. Sheesh. Who cares? If Lance is happy with his bloated, cheerless, abominable bugfest of an OS, more power to him.
And now, Obligatory Car Analogy: it's like Lance is sitting by the side of the road with his Chevy Vega that just flew to pieces for the fifth time that week, and he's pointing at the Lexus that just sped by because it had a defective radio knob that just fell off.
Re:And this guy is an editor? (Score:5, Insightful)
Claiming that OS X sufers fewer hacks because it's a smaller market is a post hoc fallacy.
Parent
His reply to an e-mail I send him earlier today (Score:5, Interesting)
http://discuss.pcmag.com/pcmag/start/?msg=32413 [pcmag.com]
-----Original Message-----
From: ***
Sent: Thursday, December 11, 2003 10:24 AM
To: Ulanoff, Lance
Subject: Eureka
Hello.
in your piece at http://www.pcmag.com/article2/0,4149,1408953,00.a
you have this to say in conclusion:
Ultimately, those on the Mac fringe have to face facts: Panther and Jaguar were not better at outrunning vulnerabilities than Windows. I expect other gaps will emerge, and while the Mac OS may still draw far fewer attacks, this discovery might suck a little wind (or is it Windows?) out of Mac radicals' sails. They can scarcely claim this was a minor hole. OS root access is serious stuff. How cocky are you feeling now, Mac elite? Hmm. Suddenly it's gotten pretty quiet around here.
So, that's all it takes for you? One potentially serious loophole in an
OS to declare it "no better at outrunning vulnerabilities than
windows"?
Have you recently counted the number of Cert advisory reports that have
come out for XP? Last I checked, more than a month ago, it was in the
40-some range. For XP alone. This year only. For the past few weeks,
those reports have come in bundles of 3-to-5 at a time. Nearly every
other week.
While gaining root access is serious on a Unix machine, you also need
to point out the fact that to be able to gain access to this loophole,
you absolutely need to be on the same subnet as the compromised
computer. Therefore shielding 60%-some percent of home Mac installation
(as those connect to the interner through some phone connection like
PPP) and a great deal (don't have numbers) of the remaining 40% still
not at risk, provided their Cable or ISDN, [A]DSL ISPs have done their
work properly.
It's not like one could attack the entire machine simply by sending an
email containing some VBL script. Right?
Of course I'm a Mac head. And I'm still as cocky as I've been since
roughly 1988. Because every time I see those IT folks around here
struggling to keep the company running when the next wave of Win
trouble appears, I'll be smiling at my desk, uninterrupted, and
occasionally offering to help (okay... I'm just pointing them to some
Linux site or Apple.com... but hey... I seriously believe that would
help
them).
Keep us entertained.
Have a good day.
yeah punk, I'm feeling lucky (Score:5, Insightful)
- Number of Macs reported/suspected to be cracked by recent vulnerabilities: ZERO
- Number of Windows PCs known to be cracked by recent vulnerabilities: MILLIONS [google.com]
So... I'm feeling pretty damn cocky, thanks for asking.Mac Elite? (Score:5, Insightful)
I feel bad for anyone who feels the need to put a group of users down simply due to their choice in tools. That goes for the "Mac elite" that Mr. Ulanoff has to deal with as well.
WSJ Article vs. PC Magazine (Score:5, Interesting)
I have never been able to shake my perception of PC Magazine/ZD as just a shill for their biggest advertisers. Just ask yourself: Who butters their bread?
The new variant of "Apple's dying" (Score:5, Insightful)
PC Mag proves once again its writers are inept (Score:5, Insightful)
Security (Score:5, Interesting)
Building A has one broken window, that is kind of small and can only be breached if you can get passed the outer gate (with its own security), and have the right (specialized) equipment.
Building B has many broken windows, and windows breaks as fast as they fix them. Many of the broken windows can be breached from down the street. The latest broken window could allow anyone to imitate building C, and only when you have entered the building do you realize that you have been duped into entering Goat's house of cx.
Which building is more secure?
The issue is that security is offered in LEVELS. No place is 100% secure, however some places offer much higher levels of security, providing a safer place to be.
So which building is more secure?
iTunes (Score:5, Informative)
Meanwhile, we can already see what happens when Apple has a broadly popular product that cuts across platforms. The Apple iPod is the number one MP3 player, and now that its companion computer utility, iTunes, is available for both the Mac and the PC, it has become a hack target. In fact, Jon Lech Johansen, the same Norwegian who cracked the DVD security code, recently circumvented the iTunes music protection scheme.
An event like that occurring makes sense to me, since iTunes' popularity makes it a target worth hacking -- and whatever mystical Mac mojo there may be, it didn't go far in protecting a popular Apple product.Steve Jobs stated when the iTunes music store was announced that the DRM would be hacked. The point was to provide a DRM solution that was not restrictive to honest users. That was delivered.
The author also says: DRM is NOT Evil (Score:5, Informative)
His email address: Lance_Ulanoff@ziffdavis.com
His brief bio here [pcmag.com]
He's Right! (Score:5, Funny)
Overheard whispers: "He's not going do it" "Yes, he is - you didn't see last months rant against one button mice?" "I dare you" "I bet his ethernet cables not plugged in" "It's been a pleasure working with you" "I knew he was an idiot, but nobody's that dumb" "Didn't his last article get taken out by the Melissa virus?"
Insecure? (Score:5, Funny)
I think you can add Lance Ulanoff to the list of things that are "insecure".
That's exactly why... (Score:5, Funny)
Parent
Re:That's exactly why... (Score:5, Funny)
i hate the lameness filter. ti code is all caps so i need to put a lot of non caps in here to balance it out. this is not capatilized. take that you worthless filter. the above wasn't yelling, but now i think i just night start.
Parent
Re:Mac isn't more secure, BUT: (Score:5, Funny)
Parent
Quick, someone mod parent down! (Score:5, Funny)
Parent
Re:Good points... (Score:5, Insightful)
It's almost root.
W/o some extra frobbing of permissions, all the Applications (in /Applications) are world writeable by users in the 'admin' group.
The first user in macosx is in the 'admin' group. Unless you make a 2nd user for yourself, you can basically overwrite anything in the Applications folder.
files /System/Library is root:wheel; 755, so that mitigates an OS-level attack... but still.
Parent
Re:Good points... (Score:5, Insightful)
Mac OSX is not perfect
To bash Macs... it's paragraph after paragraph of "See? I told you so."
I own a mac, but I use PC's at work and home, I barely notice a difference between the two when I move between them because most of the apps that I use, like Office and Mozilla are fairly close in appearance and functionality.
BUT... the absolute, positive, no questions asked fact, is that last time my office of 300+ people had some worm running around, my mac was NOT infected and I was not required to jump through IT-hoops for hours to get rid of it or prevent it from happening.
Whether or not it has flaws or not is a stupid question, of course it does... but so far they haven't proven to be anywhere near as disasterous as the bullsh*t that we have to deal with from Windows.
Parent
Re:Good points... (Score:5, Insightful)
This in and of itself is another 50 pounds of "bite my shiny metal ass, Micro Soft apologist" to hand to the author of this article (i RTFA as well - he carped on a LONG time about this one quite obscure vulnerability, and didn't bother to name a single Mac virus or mail.app worm.. i wonder why?)
Until Microsoft changes their ways on having every useless network service turned on by defualt and making it easy (read: not requireing use of Regedit) to turn off and on services (read: Sharing System Preference Panel - checkboxes for all services), Macs will continue to be far less vulnerable to attacks than Windows is.
Parent
Re:Good points... (Score:5, Insightful)
Parent
Re:Good points... (Score:5, Interesting)
12.10.2003
Internet Explorer Spoofing Vulnerability Found
12.10.2003
Security Experts Warn of New Way to Attack Windows
This same "exploit" Apple claims is normal [slashdot.org]. One "exploit" will not make Mac users eat crow. Let's see some real OS X viruses and Apple having to release so many patches that it moves to a monthly bug release program first.
Parent
Re:Good points... (Score:5, Interesting)
For the record, I'm not a Mac user and my few attempts at using it ended in annoyance and frustration. It does not, however, take a genius to recognize the logical leaps inherent in the author's petulant outburst.
To wit:
1) A single flaw does not compare to the egregious history of security problems on Windows.
2) The conjecture that if Mac OS were more used than Windows, it would have the same vulnerability rate is just that, conjecture, and it is unsupported in the article.
3) The iTunes/iPod "hack" is not comparable to an operating system comprimise. It is a comprimise of a digital restrictions management (DRM) system. DRM systems are known to be inherently vulnerable and practically insecurable. Nobody but deluded content industry executives expect DRM systems to have any more than brief protection. Also, once broken, they can't be fixed.
4) The swipes at Mac "zealots" are irrelevant ad hominems
5) The complaint about the complexity of MacOS X is silly. All software is complex. Some is just done worse than other.
There's nothing here to see.
Parent
Re:Good points... (Score:5, Insightful)
Parent
Re:Good points... (Score:5, Informative)
As others have noted, yes, you do. The main user you are asked to create when you setup a machine is an admin, and that is the account that most home users use.
Parent
Re:Good points... (Score:5, Informative)
Parent
Re:Good points... (Score:5, Informative)
Parent
Re:Same DHCP "Flaw" (Score:5, Informative)
Dave Schroeder writes, "This isn't so much of a root vulnerability as a default configuration that trusts the integrity of the local network services. This functionality has been around since NeXTSTEP, and is designed to allow for auto-configuration of new servers/machines brought into the network."
Parent
Re:Hum... (Score:5, Funny)
Pro-MACs on my left, pro-PCs on my right.
I think Rush Limbaugh might take offense at being placed on the Left [macnn.com].
Parent
Re:Hum... (Score:5, Funny)
Pro-MACs on my left, pro-PCs on my right.
I'm Stuck in the Middle with you.
Yes I'm stuck in the middle with Linux.
Parent
Re:The author is an idiot (Score:5, Informative)
If you don't use a DHCP / LDAP server then its recommended that you turn it off.
This is from the apple site:
You don't use a directory service
Parent
Re:unix vs windows security (Score:5, Insightful)
Sorry, but this is nonsense. UNIX *is* more secure than Windows, but Windows was *designed* with more security in mind. UNIX comes from an academic background where loose and free access is the norm (or was in the 70s). All of the security trappings are post-hoc.
Now if you want to say that UNIX's technical excellence is demonstrated by the fact that even security being a crude add-on, it's still superior to Windows' baked-in attempts, then you would of course be right. But UNIX was never designed for security from the ground up...
Parent
reaping and sowing. (Score:5, Insightful)
Wrong. There is something to be said for how security is considered in the design of an OS. For Windows, it wasn't much of a consideration, which contributed heavily to why there have been so many systemic vulnerabilities.
The system was designed to be user-friendly, not secure. They got their market-share because of that fact. I think it is much easier to make a secure system user-friendly than to make a user-friendly system secure. Microsoft is finding that out as well. You reap what you sow.
Parent
Re:If Mac OS X were REAL unix... (Score:5, Informative)
then, apparently, you don't know jack. you absolutely cannot write to / unless you (and follow this carefully):
1) open up a terminal
2) type sudo
3) then type say: cat
4) type password
you my friend, are full of shit. now, if like me, you create another user, which i always run at, then i have to open the term, su to an admin user, then sudo. osx turns off root by default. to enable it, you have to go into net info, and specifically enable root, THEN, you have to change it's terminal from
Parent