Forgot your password?
typodupeerror
Security OS X Apple

Intego's "Year In Mac Security" Report 132

Posted by kdawson
from the almost-popular-enough dept.
david.emery notes the release of Intego's "Year In Mac Security" report (PDF), adding: "Mac OS X and iPhones that haven't been jailbroken fare pretty well (although vulnerabilities exist, there's not been a lot of exploitation). Apple does come in for criticism for 'time to fix' known vulnerabilities. Jailbroken iPhones are a mess. The biggest risk to Macs are Trojan horses, often from pirated software."
This discussion has been archived. No new comments can be posted.

Intego's "Year In Mac Security" Report

Comments Filter:
  • by rsborg (111459) on Tuesday January 26, 2010 @04:26AM (#30901462) Homepage

    Should it be any surprise that unmoderated software could introduce security vulnerabilities?

    Really, the main problem is that jailbreak processes don't try to change your default root password. So the vulnerability is that Apple supplied a default root password (that isn't workable without jailbreak), and the haxx0rs remove the protection but fail to force user to change or randomize (and remember/show to user) that password.

    Nothing bizarre about that.

  • by prawn_narwp (1579473) on Tuesday January 26, 2010 @04:31AM (#30901486)

    This is basically 7 total pages:

    * first couple pages on installing bitorrent'd software
    * Page 4 and 5 about people who installed openssh on their jailbroken iphones and didn't change their passwords
    * last page has citations back to their own blog

    The meat of it is about PDF, Java -- surely those have a more widespread effect right? But they spend a lot less words on those topics. Note that all the visuals have to do with the stupid ssh-admin-password and bittorent'd malware.

    Skip to the concluding paragraph -- they just have to emphasize the iphone again.

    I was going to say "I declare this posting unfit for Slashdot" but the good I see is that we can pick it apart to sort out the fluff.

    My rating system on severity overall on the entire population of apple products:

    1) pdf/java (5 stars)
    2) I-enabled-ssh-w/o-a-password (1 star - you're fault for being a retard)
    3) Charles Miller iphone vuln (5 stars when it wasn't patched)

  • by silentace (992647) on Tuesday January 26, 2010 @04:46AM (#30901544)
    So you basically said what PC users do everyday (the ones that don't ever get viruses)...
  • by DrXym (126579) on Tuesday January 26, 2010 @06:23AM (#30901922)
    If Apple didn't put such draconian limits on what a person could do with their own property, perhaps there wouldn't be the need to "jailbreak" it.
  • by bdsesq (515351) on Tuesday January 26, 2010 @08:21AM (#30902540)

    Apple either supplies a default root password or it has to build in a backdoor. Otherwise there is no way to upgrade the OS. Which way do you think is more secure?
    The jail break issue isn't Apple's problem. It is a problem with people doing things they don't understand.
    Looks like the jail break is just another way to root kit a computer (phone).

  • by mdwh2 (535323) on Tuesday January 26, 2010 @09:35AM (#30903166) Journal

    When people point out something the Iphone can't do, we hear "Oh it can, but you just have to jailbreak it". When we get stories about security holes, we hear "Oh that doesn't count, you just have to not jailbreak it".

    So er, which is it?

    The problem is that the Iphone is the only phone where "jailbreaking" is necessary to get basic functionality working (e.g., tethering, running applications that Apple don't like).

    Consider, do you ever hear people talking about "jailbreaking" in the context of any other phone?

    My 5800 works fine, not had a virus (indeed on any of my phones), never needed to hack it.

  • by dave562 (969951) on Tuesday January 26, 2010 @12:39PM (#30906020) Journal

    Except for those exploits that target Acrobat, or Flash, or .. or .. or.

    Microsoft has made some improvements with DEP and IE8 on Win7, but there are still far too many vulnerabilities in commonly used and widely distributed applications to make me comfortable with Windows.

  • by DrXym (126579) on Tuesday January 26, 2010 @02:45PM (#30907886)
    This means that any software I install on it gets at least a screening from a company that has a lot to lose by allowing malware on the phone.

    They also have a lot to lose by allowing apps like voip, instant messaging, map readers, voice search, flash player, browsers, podcasters, movie players, music players, file downloaders etc. etc.. Basically anything that competes with their tech, or offends the network, or they simply don't like on grounds of taste or any other arbitrary reason. They even ban apps with scripting / runtime capability even extending to the absurd banning of a C64 emulator lest somebody figure a way of using it to jailbreak the phone. It's not even the small fry that have been hurt - Google have had apps rejected.

    The restrictions are draconian, and it isn't surprising given the above, and the way the device is locked to certain networks (even outside of contract) that people want to jailbreak it.

Anyone can do any amount of work provided it isn't the work he is supposed to be doing at the moment. -- Robert Benchley

Working...